--- beforedivvun11.reg 2012-12-11 01:28:05.000000000 +0100 +++ afterdivvun22installed.reg 2012-12-11 01:29:50.000000000 +0100 @@ -760646,6 +760646,9 @@ "FindAllWordFormsFiles_1036"="" "OCR_1036"="" +[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\57CB6F3B98FBBB64A855473F371F97EB] +"Sami_F"="" + [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\DFC90B5F2B0FFA63D84FD16F6BF37C4B] "NetFx_Core_x86"="" "NetFx_Core_amd64"="" @@ -1302371,8 +1302374,8 @@ 00,00,00,00,00,00,00,01,00,00,00,64,00,00,00,48,00,00,00,1c,00,00,00,42,00,\ 61,00,74,00,74,00,65,00,72,00,79,00,53,00,74,00,61,00,74,00,75,00,73,00,00,\ 00,00,00,00,00,00,00,00,00,30,00,00,00,1a,00,00,00,49,00,6e,00,73,00,74,00,\ - 61,00,6e,00,63,00,65,00,4e,00,61,00,6d,00,65,00,00,00,20,49,6e,63,6c,75,64,\ - 65,20,66,69,6c,65,20,40,00,00,00,00,00,00,00,02,00,00,00,03,00,00,00,00,00,\ + 61,00,6e,00,63,00,65,00,4e,00,61,00,6d,00,65,00,00,00,2f,2f,2f,2f,2f,2f,2f,\ + 2f,2f,2f,2f,2f,2f,2f,40,00,00,00,00,00,00,00,02,00,00,00,03,00,00,00,00,00,\ 00,00,64,00,00,00,00,00,01,00,40,00,00,00,16,00,00,00,43,00,68,00,61,00,72,\ 00,67,00,65,00,52,00,61,00,74,00,65,00,00,00,00,00,00,00,00,00,48,00,00,00,\ 00,00,00,00,04,00,00,00,03,00,00,00,00,00,00,00,64,00,00,00,00,00,01,00,48,\ @@ -1302390,7 +1302393,7 @@ 49,00,5f,00,43,00,6f,00,6e,00,6e,00,65,00,63,00,74,00,69,00,6f,00,6e,00,53,\ 00,74,00,61,00,74,00,69,00,73,00,74,00,69,00,63,00,73,00,00,00,00,00,00,00,\ 00,00,00,00,00,00,30,00,00,00,1a,00,00,00,49,00,6e,00,73,00,74,00,61,00,6e,\ - 00,63,00,65,00,4e,00,61,00,6d,00,65,00,00,00,40,00,00,00,00,00,10,5a,40,00,\ + 00,63,00,65,00,4e,00,61,00,6d,00,65,00,00,00,74,00,79,00,00,00,00,00,00,00,\ 00,00,00,00,48,00,00,00,0c,00,00,00,0e,00,00,00,15,00,00,00,00,00,00,00,64,\ 00,00,00,00,05,41,10,48,00,00,00,1c,00,00,00,42,00,79,00,74,00,65,00,73,00,\ 52,00,65,00,63,00,65,00,69,00,76,00,65,00,64,00,00,00,00,00,00,00,00,00,00,\ @@ -1302408,8 +1302411,8 @@ 5f,00,49,00,6e,00,69,00,74,00,69,00,61,00,74,00,6f,00,72,00,49,00,6e,00,73,\ 00,74,00,61,00,6e,00,63,00,65,00,53,00,74,00,61,00,74,00,69,00,73,00,74,00,\ 69,00,63,00,73,00,00,00,00,00,00,00,30,00,00,00,1a,00,00,00,49,00,6e,00,73,\ - 00,74,00,61,00,6e,00,63,00,65,00,4e,00,61,00,6d,00,65,00,00,00,00,00,15,00,\ - 00,00,00,00,00,00,64,00,00,00,70,00,00,00,16,00,00,00,18,00,00,00,13,00,00,\ + 00,74,00,61,00,6e,00,63,00,65,00,4e,00,61,00,6d,00,65,00,00,00,39,00,00,00,\ + 00,00,58,01,39,00,00,00,00,00,70,00,00,00,16,00,00,00,18,00,00,00,13,00,00,\ 00,00,00,00,00,64,00,00,00,00,00,01,00,70,00,00,00,46,00,00,00,53,00,65,00,\ 73,00,73,00,69,00,6f,00,6e,00,43,00,6f,00,6e,00,6e,00,65,00,63,00,74,00,69,\ 00,6f,00,6e,00,54,00,69,00,6d,00,65,00,6f,00,75,00,74,00,45,00,72,00,72,00,\ @@ -1302429,8 +1302432,8 @@ 00,49,00,5f,00,49,00,6e,00,69,00,74,00,69,00,61,00,74,00,6f,00,72,00,4c,00,\ 6f,00,67,00,69,00,6e,00,53,00,74,00,61,00,74,00,69,00,73,00,74,00,69,00,63,\ 00,73,00,00,00,00,00,00,00,00,00,00,00,00,00,30,00,00,00,1a,00,00,00,49,00,\ - 6e,00,73,00,74,00,61,00,6e,00,63,00,65,00,4e,00,61,00,6d,00,65,00,00,00,00,\ - 00,15,00,00,00,00,00,00,00,64,00,00,00,48,00,00,00,20,00,00,00,22,00,00,00,\ + 6e,00,73,00,74,00,61,00,6e,00,63,00,65,00,4e,00,61,00,6d,00,65,00,00,00,39,\ + 00,00,00,00,00,58,01,39,00,00,00,00,00,48,00,00,00,20,00,00,00,22,00,00,00,\ 13,00,00,00,00,00,00,00,64,00,00,00,00,00,01,00,48,00,00,00,20,00,00,00,4c,\ 00,6f,00,67,00,69,00,6e,00,41,00,63,00,63,00,65,00,70,00,74,00,52,00,73,00,\ 70,00,73,00,00,00,00,00,00,00,58,00,00,00,20,00,00,00,24,00,00,00,13,00,00,\ @@ -1302463,8 +1302466,8 @@ 00,00,00,4d,00,53,00,69,00,53,00,43,00,53,00,49,00,5f,00,4d,00,4d,00,49,00,\ 50,00,53,00,45,00,43,00,53,00,74,00,61,00,74,00,73,00,00,00,00,00,00,00,00,\ 00,00,00,00,00,30,00,00,00,1a,00,00,00,49,00,6e,00,73,00,74,00,61,00,6e,00,\ - 63,00,65,00,4e,00,61,00,6d,00,65,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ - 00,00,00,48,00,00,00,34,00,00,00,36,00,00,00,15,00,00,00,00,00,00,00,64,00,\ + 63,00,65,00,4e,00,61,00,6d,00,65,00,00,00,00,00,1a,00,00,00,49,00,6e,00,73,\ + 00,74,00,48,00,00,00,34,00,00,00,36,00,00,00,15,00,00,00,00,00,00,00,64,00,\ 00,00,00,01,01,00,48,00,00,00,20,00,00,00,41,00,63,00,71,00,75,00,69,00,72,\ 00,65,00,46,00,61,00,69,00,6c,00,75,00,72,00,65,00,73,00,00,00,00,00,00,00,\ 48,00,00,00,34,00,00,00,38,00,00,00,15,00,00,00,00,00,00,00,64,00,00,00,00,\ @@ -1302531,8 +1302534,8 @@ 00,00,00,2e,00,00,00,4d,00,53,00,69,00,53,00,43,00,53,00,49,00,5f,00,4e,00,\ 49,00,43,00,50,00,65,00,72,00,66,00,6f,00,72,00,6d,00,61,00,6e,00,63,00,65,\ 00,00,00,00,00,00,00,00,00,30,00,00,00,1a,00,00,00,49,00,6e,00,73,00,74,00,\ - 61,00,6e,00,63,00,65,00,4e,00,61,00,6d,00,65,00,00,00,00,00,00,00,00,00,00,\ - 00,00,00,00,00,00,00,48,00,00,00,60,00,00,00,62,00,00,00,13,00,00,00,00,00,\ + 61,00,6e,00,63,00,65,00,4e,00,61,00,6d,00,65,00,00,00,00,00,1a,00,00,00,49,\ + 00,6e,00,73,00,74,00,48,00,00,00,60,00,00,00,62,00,00,00,13,00,00,00,00,00,\ 00,00,64,00,00,00,00,04,41,10,48,00,00,00,1c,00,00,00,42,00,79,00,74,00,65,\ 00,73,00,52,00,65,00,63,00,65,00,69,00,76,00,65,00,64,00,00,00,00,00,00,00,\ 00,00,00,00,50,00,00,00,60,00,00,00,64,00,00,00,13,00,00,00,00,00,00,00,64,\ @@ -1302548,8 +1302551,8 @@ 00,00,2a,00,00,00,4d,00,53,00,69,00,53,00,43,00,53,00,49,00,5f,00,51,00,4d,\ 00,49,00,50,00,53,00,45,00,43,00,53,00,74,00,61,00,74,00,73,00,00,00,00,00,\ 00,00,00,00,00,00,00,00,30,00,00,00,1a,00,00,00,49,00,6e,00,73,00,74,00,61,\ - 00,6e,00,63,00,65,00,4e,00,61,00,6d,00,65,00,00,00,00,00,15,00,00,00,00,00,\ - 00,00,64,00,00,00,40,00,00,00,6a,00,00,00,6c,00,00,00,15,00,00,00,00,00,00,\ + 00,6e,00,63,00,65,00,4e,00,61,00,6d,00,65,00,00,00,00,00,1a,00,00,00,49,00,\ + 6e,00,73,00,74,00,40,00,00,00,6a,00,00,00,6c,00,00,00,15,00,00,00,00,00,00,\ 00,64,00,00,00,00,01,01,00,40,00,00,00,12,00,00,00,41,00,63,00,74,00,69,00,\ 76,00,65,00,53,00,41,00,00,00,00,00,00,00,00,00,00,00,00,00,48,00,00,00,6a,\ 00,00,00,6e,00,00,00,15,00,00,00,00,00,00,00,64,00,00,00,00,01,01,00,48,00,\ @@ -1302612,8 +1302615,8 @@ 53,00,49,00,5f,00,52,00,65,00,71,00,75,00,65,00,73,00,74,00,54,00,69,00,6d,\ 00,65,00,53,00,74,00,61,00,74,00,69,00,73,00,74,00,69,00,63,00,73,00,00,00,\ 00,00,00,00,00,00,00,00,30,00,00,00,1a,00,00,00,49,00,6e,00,73,00,74,00,61,\ - 00,6e,00,63,00,65,00,4e,00,61,00,6d,00,65,00,00,00,00,00,15,00,00,00,00,00,\ - 00,00,64,00,00,00,58,00,00,00,90,00,00,00,92,00,00,00,13,00,00,00,00,00,00,\ + 00,6e,00,63,00,65,00,4e,00,61,00,6d,00,65,00,00,00,6e,00,63,00,65,00,02,00,\ + 00,02,1b,34,00,00,58,00,00,00,90,00,00,00,92,00,00,00,13,00,00,00,00,00,00,\ 00,64,00,00,00,00,05,41,10,58,00,00,00,2c,00,00,00,41,00,76,00,65,00,72,00,\ 61,00,67,00,65,00,50,00,72,00,6f,00,63,00,65,00,73,00,73,00,69,00,6e,00,67,\ 00,54,00,69,00,6d,00,65,00,00,00,00,00,00,00,00,00,00,00,58,00,00,00,90,00,\ @@ -1302625,7 +1302628,7 @@ 00,43,00,53,00,49,00,5f,00,53,00,65,00,73,00,73,00,69,00,6f,00,6e,00,53,00,\ 74,00,61,00,74,00,69,00,73,00,74,00,69,00,63,00,73,00,00,00,00,00,00,00,00,\ 00,00,00,30,00,00,00,1a,00,00,00,49,00,6e,00,73,00,74,00,61,00,6e,00,63,00,\ - 65,00,4e,00,61,00,6d,00,65,00,00,00,00,00,15,00,00,00,00,00,00,00,64,00,00,\ + 65,00,4e,00,61,00,6d,00,65,00,00,00,6e,00,63,00,65,00,02,00,00,02,1b,34,00,\ 00,48,00,00,00,96,00,00,00,98,00,00,00,15,00,00,00,00,00,00,00,64,00,00,00,\ 00,05,41,10,48,00,00,00,1c,00,00,00,42,00,79,00,74,00,65,00,73,00,52,00,65,\ 00,63,00,65,00,69,00,76,00,65,00,64,00,00,00,00,00,00,00,00,00,00,00,40,00,\ @@ -1564697,7 +1564700,7 @@ f5,ea,03,00,00 "ProfileLoadTimeLow"=dword:00000000 "ProfileLoadTimeHigh"=dword:00000000 -"RefCount"=dword:00000004 +"RefCount"=dword:00000005 "RunLogonScriptSync"=dword:00000000 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-4242609267-1877866684-4123670283-1003] @@ -1568068,7 +1568071,7 @@ [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore] "RPSessionInterval"=dword:00000001 "FirstRun"=dword:00000000 -"LastIndex"=dword:00000011 +"LastIndex"=dword:00000012 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore\cfg] "DiskPercent"=dword:0000000f @@ -1568080,6 +1568083,10 @@ [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore\Setup_Last] "Generalize_DisableSR"=dword:00000000 +[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore\Volatile] +"NestingLevel"=dword:00000001 +"StartNesting"=hex(b):5a,df,21,3d,36,d7,cd,01 + [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\TSAppAllowList] @@ -1717926,6 +1717933,11 @@ [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products] +[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\57CB6F3B98FBBB64A855473F371F97EB] + +[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\57CB6F3B98FBBB64A855473F371F97EB\Features] +"Sami_F"="" + [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings] "EnablePunycode"=dword:00000001 "CodeBaseSearchPath"="CODEBASE" @@ -1722675,6 +1722687,11 @@ [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx] +[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Divvun_Sámi_Proofing_Tools_for_MS_Office1.5] +"DisplayName"="Divvun_Sámi_Proofing_Tools_for_MS_Office1.5" +"UninstallString"="C:\\WINDOWS\\Installer\\{B3F6BC75-BF89-46BB-8A55-74F373F179BE}\\Uninstall.exe" +"NoModify"=dword:00000001 + [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore] [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE40] @@ -1810593,7 +1810610,7 @@ f5,ea,03,00,00 "ProfileLoadTimeLow"=dword:00000000 "ProfileLoadTimeHigh"=dword:00000000 -"RefCount"=dword:00000004 +"RefCount"=dword:00000005 "RunLogonScriptSync"=dword:00000000 [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-4242609267-1877866684-4123670283-1003] @@ -2124173,20 +2124190,20 @@ d7,cd,01,b0,03,00,00,c4,08,00,00,d3,07,00,00,00,00,00,00,00,00,00,00,00,00,\ 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ 00,00,00,00,00,00,00,00,00 -"SppGatherWriterMetadata (Leave)"=hex:48,00,00,00,00,00,00,00,ae,40,3d,cf,6f,\ - d4,cd,01,54,0f,00,00,a0,0b,00,00,d3,07,00,00,01,00,00,00,00,00,00,00,00,00,\ +"SppGatherWriterMetadata (Leave)"=hex:48,00,00,00,00,00,00,00,76,ba,94,79,36,\ + d7,cd,01,b0,03,00,00,c4,08,00,00,d3,07,00,00,01,00,00,00,00,00,00,00,00,00,\ 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ 00,00,00,00,00,00,00,00,00 -"SppAddInterestingComponents (Enter)"=hex:48,00,00,00,00,00,00,00,8c,7a,57,cf,\ - 6f,d4,cd,01,54,0f,00,00,a0,0b,00,00,d4,07,00,00,00,00,00,00,00,00,00,00,00,\ +"SppAddInterestingComponents (Enter)"=hex:48,00,00,00,00,00,00,00,76,ba,94,79,\ + 36,d7,cd,01,b0,03,00,00,c4,08,00,00,d4,07,00,00,00,00,00,00,00,00,00,00,00,\ 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ 00,00,00,00,00,00,00,00,00,00 -"SppAddInterestingComponents (Leave)"=hex:48,00,00,00,00,00,00,00,0a,da,97,cf,\ - 6f,d4,cd,01,54,0f,00,00,a0,0b,00,00,d4,07,00,00,01,00,00,00,00,00,00,00,00,\ +"SppAddInterestingComponents (Leave)"=hex:48,00,00,00,00,00,00,00,64,52,0e,7a,\ + 36,d7,cd,01,b0,03,00,00,c4,08,00,00,d4,07,00,00,01,00,00,00,00,00,00,00,00,\ 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ 00,00,00,00,00,00,00,00,00,00 -"SppCreate (Leave)"=hex:48,00,00,00,00,00,00,00,e8,9a,45,d3,6f,d4,cd,01,54,0f,\ - 00,00,a0,0b,00,00,d0,07,00,00,01,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ +"SppCreate (Leave)"=hex:48,00,00,00,00,00,00,00,7c,a8,1c,8a,36,d7,cd,01,b0,03,\ + 00,00,c4,08,00,00,d0,07,00,00,01,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ 00,00,00,00 @@ -2124195,8 +2124212,8 @@ 00,00,c4,08,00,00,d5,07,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ 00,00,00,00 -"SrCreateRp (Leave)"=hex:48,00,00,00,00,00,00,00,e8,9a,45,d3,6f,d4,cd,01,54,0f,\ - 00,00,a0,0b,00,00,d5,07,00,00,01,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ +"SrCreateRp (Leave)"=hex:48,00,00,00,00,00,00,00,d6,0a,1f,8a,36,d7,cd,01,b0,03,\ + 00,00,c4,08,00,00,d5,07,00,00,01,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ 00,00,00,00 @@ -2124221,8 +2124238,134 @@ 00,00,e8,0b,00,00,e8,03,00,00,00,00,00,00,01,00,00,00,00,00,00,00,00,00,00,\ 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ 00,00,00,00 +"PREPAREBACKUP (Enter)"=hex:48,00,00,00,00,00,00,00,ee,ce,2e,7b,36,d7,cd,01,1c,\ + 02,00,00,94,09,00,00,e9,03,00,00,01,00,00,00,01,00,00,00,00,00,00,00,2a,6e,\ + de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00 +"PREPAREBACKUP (Leave)"=hex:48,00,00,00,00,00,00,00,7c,8c,ce,7b,36,d7,cd,01,1c,\ + 02,00,00,94,09,00,00,e9,03,00,00,00,00,00,00,01,00,00,00,00,00,00,00,2a,6e,\ + de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00 +"VSS_WS_STABLE (SetCurrentState)"=hex:48,00,00,00,00,00,00,00,7c,8c,ce,7b,36,\ + d7,cd,01,1c,02,00,00,94,09,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,\ + 00,00,2a,6e,de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,\ + 00,00,00,00,00,00,00,00,00 +"GETSTATE (Enter)"=hex:48,00,00,00,00,00,00,00,16,3a,1d,7c,36,d7,cd,01,1c,02,\ + 00,00,34,05,00,00,f9,03,00,00,01,00,00,00,01,00,00,00,00,00,00,00,2a,6e,de,\ + 35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00 +"GETSTATE (Leave)"=hex:48,00,00,00,00,00,00,00,ca,fe,21,7c,36,d7,cd,01,1c,02,\ + 00,00,34,05,00,00,f9,03,00,00,00,00,00,00,01,00,00,00,00,00,00,00,2a,6e,de,\ + 35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00 +"PREPARESNAPSHOT (Enter)"=hex:48,00,00,00,00,00,00,00,b4,dc,af,80,36,d7,cd,01,\ + 1c,02,00,00,10,04,00,00,ea,03,00,00,01,00,00,00,01,00,00,00,00,00,00,00,2a,\ + 6e,de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00,00 +"PREPARESNAPSHOT (Leave)"=hex:48,00,00,00,00,00,00,00,f0,e6,7c,81,36,d7,cd,01,\ + 1c,02,00,00,10,04,00,00,ea,03,00,00,00,00,00,00,01,00,00,00,00,00,00,00,2a,\ + 6e,de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00,00 +"VSS_WS_WAITING_FOR_FREEZE (SetCurrentState)"=hex:48,00,00,00,00,00,00,00,f0,\ + e6,7c,81,36,d7,cd,01,1c,02,00,00,10,04,00,00,02,00,00,00,01,00,00,00,01,00,\ + 00,00,00,00,00,00,2a,6e,de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,\ + 00,00,00,00,00,00,00,00,00,00,00,00,00 +"FREEZE (Enter)"=hex:48,00,00,00,00,00,00,00,86,53,4c,82,36,d7,cd,01,1c,02,00,\ + 00,d0,09,00,00,eb,03,00,00,01,00,00,00,02,00,00,00,00,00,00,00,2a,6e,de,35,\ + 2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00 +"FREEZE (Leave)"=hex:48,00,00,00,00,00,00,00,86,53,4c,82,36,d7,cd,01,1c,02,00,\ + 00,d0,09,00,00,eb,03,00,00,00,00,00,00,02,00,00,00,00,00,00,00,2a,6e,de,35,\ + 2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00 +"VSS_WS_WAITING_FOR_THAW (SetCurrentState)"=hex:48,00,00,00,00,00,00,00,86,53,\ + 4c,82,36,d7,cd,01,1c,02,00,00,d0,09,00,00,03,00,00,00,01,00,00,00,02,00,00,\ + 00,00,00,00,00,2a,6e,de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,\ + 00,00,00,00,00,00,00,00,00,00,00,00 +"BKGND_FREEZE_THREAD (Enter)"=hex:48,00,00,00,00,00,00,00,86,53,4c,82,36,d7,cd,\ + 01,1c,02,00,00,b0,05,00,00,fc,03,00,00,01,00,00,00,03,00,00,00,00,00,00,00,\ + 2a,6e,de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00,00,00 +"THAW (Enter)"=hex:48,00,00,00,00,00,00,00,a6,1d,32,8a,36,d7,cd,01,1c,02,00,00,\ + 6c,08,00,00,f2,03,00,00,01,00,00,00,03,00,00,00,00,00,00,00,2a,6e,de,35,2b,\ + ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00 +"BKGND_FREEZE_THREAD (Leave)"=hex:48,00,00,00,00,00,00,00,a6,1d,32,8a,36,d7,cd,\ + 01,1c,02,00,00,b0,05,00,00,fc,03,00,00,00,00,00,00,03,00,00,00,00,00,00,00,\ + 2a,6e,de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00,00,00 +"THAW (Leave)"=hex:48,00,00,00,00,00,00,00,a6,1d,32,8a,36,d7,cd,01,1c,02,00,00,\ + 6c,08,00,00,f2,03,00,00,00,00,00,00,03,00,00,00,00,00,00,00,2a,6e,de,35,2b,\ + ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00 +"VSS_WS_WAITING_FOR_POST_SNAPSHOT (SetCurrentState)"=hex:48,00,00,00,00,00,00,\ + 00,a6,1d,32,8a,36,d7,cd,01,1c,02,00,00,6c,08,00,00,04,00,00,00,01,00,00,00,\ + 03,00,00,00,00,00,00,00,2a,6e,de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,\ + 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 +"POSTSNAPSHOT (Enter)"=hex:48,00,00,00,00,00,00,00,63,e7,ea,91,36,d7,cd,01,1c,\ + 02,00,00,34,08,00,00,f5,03,00,00,01,00,00,00,04,00,00,00,00,00,00,00,2a,6e,\ + de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00 +"POSTSNAPSHOT (Leave)"=hex:48,00,00,00,00,00,00,00,bd,49,ed,91,36,d7,cd,01,1c,\ + 02,00,00,34,08,00,00,f5,03,00,00,00,00,00,00,04,00,00,00,00,00,00,00,2a,6e,\ + de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00 +"VSS_WS_WAITING_FOR_BACKUP_COMPLETE (SetCurrentState)"=hex:48,00,00,00,00,00,\ + 00,00,bd,49,ed,91,36,d7,cd,01,1c,02,00,00,34,08,00,00,05,00,00,00,01,00,00,\ + 00,04,00,00,00,00,00,00,00,2a,6e,de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,\ + 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Lovelace] +"OPEN_VOLUME_HANDLE (Enter)"=hex:48,00,00,00,00,00,00,00,5c,92,fb,86,36,d7,cd,\ + 01,1c,02,00,00,84,07,00,00,fd,03,00,00,01,00,00,00,00,00,00,00,00,00,00,00,\ + 2a,6e,de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00,00,00 +"OPEN_VOLUME_HANDLE (Leave)"=hex:48,00,00,00,00,00,00,00,46,16,27,89,36,d7,cd,\ + 01,1c,02,00,00,84,07,00,00,fd,03,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ + 2a,6e,de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00,00,00 +"IOCTL_FLUSH_AND_HOLD (Enter)"=hex:48,00,00,00,00,00,00,00,46,16,27,89,36,d7,\ + cd,01,1c,02,00,00,84,07,00,00,fe,03,00,00,01,00,00,00,00,00,00,00,00,00,00,\ + 00,2a,6e,de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00,00,00,00 +"IOCTL_FLUSH_AND_HOLD (Leave)"=hex:48,00,00,00,00,00,00,00,50,fc,ae,89,36,d7,\ + cd,01,1c,02,00,00,84,07,00,00,fe,03,00,00,00,00,00,00,00,00,00,00,00,00,00,\ + 00,2a,6e,de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00,00,00,00 +"IOCTL_RELEASE (Enter)"=hex:48,00,00,00,00,00,00,00,20,0f,c2,89,36,d7,cd,01,1c,\ + 02,00,00,84,07,00,00,ff,03,00,00,01,00,00,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00 +"IOCTL_RELEASE (Leave)"=hex:48,00,00,00,00,00,00,00,20,0f,c2,89,36,d7,cd,01,1c,\ + 02,00,00,84,07,00,00,ff,03,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00 + +[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Lovelace(__?_Volume{560e95cb-3b3e-11e2-aafd-806e6f6e6963}_)] +"OPEN_VOLUME_HANDLE (Enter)"=hex:48,00,00,00,00,00,00,00,5c,92,fb,86,36,d7,cd,\ + 01,1c,02,00,00,e4,0b,00,00,fd,03,00,00,01,00,00,00,00,00,00,00,00,00,00,00,\ + 2a,6e,de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00,00,00 +"OPEN_VOLUME_HANDLE (Leave)"=hex:48,00,00,00,00,00,00,00,46,16,27,89,36,d7,cd,\ + 01,1c,02,00,00,e4,0b,00,00,fd,03,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ + 2a,6e,de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00,00,00 +"IOCTL_FLUSH_AND_HOLD (Enter)"=hex:48,00,00,00,00,00,00,00,46,16,27,89,36,d7,\ + cd,01,1c,02,00,00,e4,0b,00,00,fe,03,00,00,01,00,00,00,00,00,00,00,00,00,00,\ + 00,2a,6e,de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00,00,00,00 +"IOCTL_FLUSH_AND_HOLD (Leave)"=hex:48,00,00,00,00,00,00,00,50,fc,ae,89,36,d7,\ + cd,01,1c,02,00,00,e4,0b,00,00,fe,03,00,00,00,00,00,00,00,00,00,00,00,00,00,\ + 00,2a,6e,de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00,00,00,00 +"IOCTL_RELEASE (Enter)"=hex:48,00,00,00,00,00,00,00,20,0f,c2,89,36,d7,cd,01,1c,\ + 02,00,00,e4,0b,00,00,ff,03,00,00,01,00,00,00,00,00,00,00,00,00,00,00,2a,6e,\ + de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00 +"IOCTL_RELEASE (Leave)"=hex:48,00,00,00,00,00,00,00,20,0f,c2,89,36,d7,cd,01,1c,\ + 02,00,00,e4,0b,00,00,ff,03,00,00,00,00,00,00,00,00,00,00,00,00,00,00,2a,6e,\ + de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00 [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\MSSearch Service Writer] "IDENTIFY (Enter)"=hex:48,00,00,00,00,00,00,00,7c,86,fd,42,36,d7,cd,01,fc,06,\ @@ -2124233,6 +2124376,82 @@ 00,00,00,0b,00,00,e8,03,00,00,00,00,00,00,01,00,00,00,00,00,00,00,00,00,00,\ 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ 00,00,00,00 +"PREPAREBACKUP (Enter)"=hex:48,00,00,00,00,00,00,00,ee,ce,2e,7b,36,d7,cd,01,fc,\ + 06,00,00,00,0b,00,00,e9,03,00,00,01,00,00,00,01,00,00,00,00,00,00,00,2a,6e,\ + de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00 +"PREPAREBACKUP (Leave)"=hex:48,00,00,00,00,00,00,00,dc,66,a8,7b,36,d7,cd,01,fc,\ + 06,00,00,00,0b,00,00,e9,03,00,00,00,00,00,00,01,00,00,00,00,00,00,00,2a,6e,\ + de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00 +"VSS_WS_STABLE (SetCurrentState)"=hex:48,00,00,00,00,00,00,00,dc,66,a8,7b,36,\ + d7,cd,01,fc,06,00,00,00,0b,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,\ + 00,00,2a,6e,de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,\ + 00,00,00,00,00,00,00,00,00 +"GETSTATE (Enter)"=hex:48,00,00,00,00,00,00,00,32,88,2b,7c,36,d7,cd,01,fc,06,\ + 00,00,00,0b,00,00,f9,03,00,00,01,00,00,00,01,00,00,00,00,00,00,00,2a,6e,de,\ + 35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00 +"GETSTATE (Leave)"=hex:48,00,00,00,00,00,00,00,e6,4c,30,7c,36,d7,cd,01,fc,06,\ + 00,00,00,0b,00,00,f9,03,00,00,00,00,00,00,01,00,00,00,00,00,00,00,2a,6e,de,\ + 35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00 +"PREPARESNAPSHOT (Enter)"=hex:48,00,00,00,00,00,00,00,bc,8b,df,80,36,d7,cd,01,\ + fc,06,00,00,00,0b,00,00,ea,03,00,00,01,00,00,00,01,00,00,00,00,00,00,00,2a,\ + 6e,de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00,00 +"PREPARESNAPSHOT (Leave)"=hex:48,00,00,00,00,00,00,00,ce,20,97,81,36,d7,cd,01,\ + fc,06,00,00,00,0b,00,00,ea,03,00,00,00,00,00,00,01,00,00,00,00,00,00,00,2a,\ + 6e,de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00,00 +"VSS_WS_WAITING_FOR_FREEZE (SetCurrentState)"=hex:48,00,00,00,00,00,00,00,ce,\ + 20,97,81,36,d7,cd,01,fc,06,00,00,00,0b,00,00,02,00,00,00,01,00,00,00,01,00,\ + 00,00,00,00,00,00,2a,6e,de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,\ + 00,00,00,00,00,00,00,00,00,00,00,00,00 +"FREEZE (Enter)"=hex:48,00,00,00,00,00,00,00,86,53,4c,82,36,d7,cd,01,fc,06,00,\ + 00,00,0b,00,00,eb,03,00,00,01,00,00,00,02,00,00,00,00,00,00,00,2a,6e,de,35,\ + 2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00 +"FREEZE (Leave)"=hex:48,00,00,00,00,00,00,00,86,53,4c,82,36,d7,cd,01,fc,06,00,\ + 00,00,0b,00,00,eb,03,00,00,00,00,00,00,02,00,00,00,00,00,00,00,2a,6e,de,35,\ + 2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00 +"VSS_WS_WAITING_FOR_THAW (SetCurrentState)"=hex:48,00,00,00,00,00,00,00,86,53,\ + 4c,82,36,d7,cd,01,fc,06,00,00,00,0b,00,00,03,00,00,00,01,00,00,00,02,00,00,\ + 00,00,00,00,00,2a,6e,de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,\ + 00,00,00,00,00,00,00,00,00,00,00,00 +"BKGND_FREEZE_THREAD (Enter)"=hex:48,00,00,00,00,00,00,00,86,53,4c,82,36,d7,cd,\ + 01,fc,06,00,00,b0,02,00,00,fc,03,00,00,01,00,00,00,03,00,00,00,00,00,00,00,\ + 2a,6e,de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00,00,00 +"THAW (Enter)"=hex:48,00,00,00,00,00,00,00,b4,44,39,8a,36,d7,cd,01,fc,06,00,00,\ + 00,0b,00,00,f2,03,00,00,01,00,00,00,03,00,00,00,00,00,00,00,2a,6e,de,35,2b,\ + ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00 +"BKGND_FREEZE_THREAD (Leave)"=hex:48,00,00,00,00,00,00,00,b4,44,39,8a,36,d7,cd,\ + 01,fc,06,00,00,b0,02,00,00,fc,03,00,00,00,00,00,00,03,00,00,00,00,00,00,00,\ + 2a,6e,de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00,00,00 +"THAW (Leave)"=hex:48,00,00,00,00,00,00,00,b4,44,39,8a,36,d7,cd,01,fc,06,00,00,\ + 00,0b,00,00,f2,03,00,00,00,00,00,00,03,00,00,00,00,00,00,00,2a,6e,de,35,2b,\ + ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00 +"VSS_WS_WAITING_FOR_POST_SNAPSHOT (SetCurrentState)"=hex:48,00,00,00,00,00,00,\ + 00,b4,44,39,8a,36,d7,cd,01,fc,06,00,00,00,0b,00,00,04,00,00,00,01,00,00,00,\ + 03,00,00,00,00,00,00,00,2a,6e,de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,\ + 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 +"POSTSNAPSHOT (Enter)"=hex:48,00,00,00,00,00,00,00,cb,70,f4,91,36,d7,cd,01,fc,\ + 06,00,00,00,0b,00,00,f5,03,00,00,01,00,00,00,04,00,00,00,00,00,00,00,2a,6e,\ + de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00 +"POSTSNAPSHOT (Leave)"=hex:48,00,00,00,00,00,00,00,65,a5,d6,95,36,d7,cd,01,fc,\ + 06,00,00,00,0b,00,00,f5,03,00,00,00,00,00,00,04,00,00,00,00,00,00,00,2a,6e,\ + de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00 +"VSS_WS_WAITING_FOR_BACKUP_COMPLETE (SetCurrentState)"=hex:48,00,00,00,00,00,\ + 00,00,65,a5,d6,95,36,d7,cd,01,fc,06,00,00,00,0b,00,00,05,00,00,00,01,00,00,\ + 00,04,00,00,00,00,00,00,00,2a,6e,de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,\ + 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer] "IDENTIFY (Enter)"=hex:48,00,00,00,00,00,00,00,3e,72,09,43,36,d7,cd,01,1c,02,\ @@ -2124243,6 +2124462,82 @@ 00,00,34,05,00,00,e8,03,00,00,00,00,00,00,01,00,00,00,00,00,00,00,00,00,00,\ 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ 00,00,00,00 +"PREPAREBACKUP (Enter)"=hex:48,00,00,00,00,00,00,00,ee,ce,2e,7b,36,d7,cd,01,1c,\ + 02,00,00,f0,06,00,00,e9,03,00,00,01,00,00,00,01,00,00,00,00,00,00,00,2a,6e,\ + de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00 +"PREPAREBACKUP (Leave)"=hex:48,00,00,00,00,00,00,00,30,51,d3,7b,36,d7,cd,01,1c,\ + 02,00,00,f0,06,00,00,e9,03,00,00,00,00,00,00,01,00,00,00,00,00,00,00,2a,6e,\ + de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00 +"VSS_WS_STABLE (SetCurrentState)"=hex:48,00,00,00,00,00,00,00,30,51,d3,7b,36,\ + d7,cd,01,1c,02,00,00,f0,06,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,\ + 00,00,2a,6e,de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,\ + 00,00,00,00,00,00,00,00,00 +"GETSTATE (Enter)"=hex:48,00,00,00,00,00,00,00,ca,fe,21,7c,36,d7,cd,01,1c,02,\ + 00,00,f0,06,00,00,f9,03,00,00,01,00,00,00,01,00,00,00,00,00,00,00,2a,6e,de,\ + 35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00 +"GETSTATE (Leave)"=hex:48,00,00,00,00,00,00,00,7e,c3,26,7c,36,d7,cd,01,1c,02,\ + 00,00,f0,06,00,00,f9,03,00,00,00,00,00,00,01,00,00,00,00,00,00,00,2a,6e,de,\ + 35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00 +"PREPARESNAPSHOT (Enter)"=hex:48,00,00,00,00,00,00,00,68,a1,b4,80,36,d7,cd,01,\ + 1c,02,00,00,b8,09,00,00,ea,03,00,00,01,00,00,00,01,00,00,00,00,00,00,00,2a,\ + 6e,de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00,00 +"PREPARESNAPSHOT (Leave)"=hex:48,00,00,00,00,00,00,00,58,70,86,81,36,d7,cd,01,\ + 1c,02,00,00,b8,09,00,00,ea,03,00,00,00,00,00,00,01,00,00,00,00,00,00,00,2a,\ + 6e,de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00,00 +"VSS_WS_WAITING_FOR_FREEZE (SetCurrentState)"=hex:48,00,00,00,00,00,00,00,58,\ + 70,86,81,36,d7,cd,01,1c,02,00,00,b8,09,00,00,02,00,00,00,01,00,00,00,01,00,\ + 00,00,00,00,00,00,2a,6e,de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,\ + 00,00,00,00,00,00,00,00,00,00,00,00,00 +"FREEZE (Enter)"=hex:48,00,00,00,00,00,00,00,62,83,3f,83,36,d7,cd,01,1c,02,00,\ + 00,34,08,00,00,eb,03,00,00,01,00,00,00,02,00,00,00,00,00,00,00,2a,6e,de,35,\ + 2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00 +"FREEZE (Leave)"=hex:48,00,00,00,00,00,00,00,02,30,f9,86,36,d7,cd,01,1c,02,00,\ + 00,34,08,00,00,eb,03,00,00,00,00,00,00,02,00,00,00,00,00,00,00,2a,6e,de,35,\ + 2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00 +"VSS_WS_WAITING_FOR_THAW (SetCurrentState)"=hex:48,00,00,00,00,00,00,00,02,30,\ + f9,86,36,d7,cd,01,1c,02,00,00,34,08,00,00,03,00,00,00,01,00,00,00,02,00,00,\ + 00,00,00,00,00,2a,6e,de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,\ + 00,00,00,00,00,00,00,00,00,00,00,00 +"BKGND_FREEZE_THREAD (Enter)"=hex:48,00,00,00,00,00,00,00,5c,92,fb,86,36,d7,cd,\ + 01,1c,02,00,00,74,02,00,00,fc,03,00,00,01,00,00,00,03,00,00,00,00,00,00,00,\ + 2a,6e,de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00,00,00 +"THAW (Enter)"=hex:48,00,00,00,00,00,00,00,a6,1d,32,8a,36,d7,cd,01,1c,02,00,00,\ + 6c,08,00,00,f2,03,00,00,01,00,00,00,03,00,00,00,00,00,00,00,2a,6e,de,35,2b,\ + ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00 +"BKGND_FREEZE_THREAD (Leave)"=hex:48,00,00,00,00,00,00,00,a6,1d,32,8a,36,d7,cd,\ + 01,1c,02,00,00,74,02,00,00,fc,03,00,00,00,00,00,00,03,00,00,00,00,00,00,00,\ + 2a,6e,de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00,00,00 +"THAW (Leave)"=hex:48,00,00,00,00,00,00,00,a6,1d,32,8a,36,d7,cd,01,1c,02,00,00,\ + 6c,08,00,00,f2,03,00,00,00,00,00,00,03,00,00,00,00,00,00,00,2a,6e,de,35,2b,\ + ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00 +"VSS_WS_WAITING_FOR_POST_SNAPSHOT (SetCurrentState)"=hex:48,00,00,00,00,00,00,\ + 00,a6,1d,32,8a,36,d7,cd,01,1c,02,00,00,6c,08,00,00,04,00,00,00,01,00,00,00,\ + 03,00,00,00,00,00,00,00,2a,6e,de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,\ + 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 +"POSTSNAPSHOT (Enter)"=hex:48,00,00,00,00,00,00,00,bd,49,ed,91,36,d7,cd,01,1c,\ + 02,00,00,34,08,00,00,f5,03,00,00,01,00,00,00,04,00,00,00,00,00,00,00,2a,6e,\ + de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00 +"POSTSNAPSHOT (Leave)"=hex:48,00,00,00,00,00,00,00,17,ac,ef,91,36,d7,cd,01,1c,\ + 02,00,00,34,08,00,00,f5,03,00,00,00,00,00,00,04,00,00,00,00,00,00,00,2a,6e,\ + de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00 +"VSS_WS_WAITING_FOR_BACKUP_COMPLETE (SetCurrentState)"=hex:48,00,00,00,00,00,\ + 00,00,17,ac,ef,91,36,d7,cd,01,1c,02,00,00,34,08,00,00,05,00,00,00,01,00,00,\ + 00,04,00,00,00,00,00,00,00,2a,6e,de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,\ + 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer] "IDENTIFY (Enter)"=hex:48,00,00,00,00,00,00,00,98,d4,0b,43,36,d7,cd,01,1c,02,\ @@ -2124253,8 +2124548,124 @@ 00,00,ac,0b,00,00,e8,03,00,00,00,00,00,00,01,00,00,00,00,00,00,00,00,00,00,\ 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ 00,00,00,00 +"PREPAREBACKUP (Enter)"=hex:48,00,00,00,00,00,00,00,ee,ce,2e,7b,36,d7,cd,01,1c,\ + 02,00,00,34,05,00,00,e9,03,00,00,01,00,00,00,01,00,00,00,00,00,00,00,2a,6e,\ + de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00 +"PREPAREBACKUP (Leave)"=hex:48,00,00,00,00,00,00,00,4c,9f,e1,7b,36,d7,cd,01,1c,\ + 02,00,00,34,05,00,00,e9,03,00,00,00,00,00,00,01,00,00,00,00,00,00,00,2a,6e,\ + de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00 +"VSS_WS_STABLE (SetCurrentState)"=hex:48,00,00,00,00,00,00,00,4c,9f,e1,7b,36,\ + d7,cd,01,1c,02,00,00,34,05,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,\ + 00,00,2a,6e,de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,\ + 00,00,00,00,00,00,00,00,00 +"GETSTATE (Enter)"=hex:48,00,00,00,00,00,00,00,ca,fe,21,7c,36,d7,cd,01,1c,02,\ + 00,00,34,05,00,00,f9,03,00,00,01,00,00,00,01,00,00,00,00,00,00,00,2a,6e,de,\ + 35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00 +"GETSTATE (Leave)"=hex:48,00,00,00,00,00,00,00,32,88,2b,7c,36,d7,cd,01,1c,02,\ + 00,00,34,05,00,00,f9,03,00,00,00,00,00,00,01,00,00,00,00,00,00,00,2a,6e,de,\ + 35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00 +"PREPARESNAPSHOT (Enter)"=hex:48,00,00,00,00,00,00,00,68,a1,b4,80,36,d7,cd,01,\ + 1c,02,00,00,e4,09,00,00,ea,03,00,00,01,00,00,00,01,00,00,00,00,00,00,00,2a,\ + 6e,de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00,00 +"PREPARESNAPSHOT (Leave)"=hex:48,00,00,00,00,00,00,00,b2,d2,88,81,36,d7,cd,01,\ + 1c,02,00,00,e4,09,00,00,ea,03,00,00,00,00,00,00,01,00,00,00,00,00,00,00,2a,\ + 6e,de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00,00 +"VSS_WS_WAITING_FOR_FREEZE (SetCurrentState)"=hex:48,00,00,00,00,00,00,00,b2,\ + d2,88,81,36,d7,cd,01,1c,02,00,00,e4,09,00,00,02,00,00,00,01,00,00,00,01,00,\ + 00,00,00,00,00,00,2a,6e,de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,\ + 00,00,00,00,00,00,00,00,00,00,00,00,00 +"FREEZE (Enter)"=hex:48,00,00,00,00,00,00,00,9a,f2,2a,82,36,d7,cd,01,1c,02,00,\ + 00,34,08,00,00,eb,03,00,00,01,00,00,00,02,00,00,00,00,00,00,00,2a,6e,de,35,\ + 2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00 +"FREEZE (Leave)"=hex:48,00,00,00,00,00,00,00,9a,f2,2a,82,36,d7,cd,01,1c,02,00,\ + 00,34,08,00,00,eb,03,00,00,00,00,00,00,02,00,00,00,00,00,00,00,2a,6e,de,35,\ + 2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00 +"VSS_WS_WAITING_FOR_THAW (SetCurrentState)"=hex:48,00,00,00,00,00,00,00,9a,f2,\ + 2a,82,36,d7,cd,01,1c,02,00,00,34,08,00,00,03,00,00,00,01,00,00,00,02,00,00,\ + 00,00,00,00,00,2a,6e,de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,\ + 00,00,00,00,00,00,00,00,00,00,00,00 +"BKGND_FREEZE_THREAD (Enter)"=hex:48,00,00,00,00,00,00,00,9a,f2,2a,82,36,d7,cd,\ + 01,1c,02,00,00,d8,04,00,00,fc,03,00,00,01,00,00,00,03,00,00,00,00,00,00,00,\ + 2a,6e,de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00,00,00 +"THAW (Enter)"=hex:48,00,00,00,00,00,00,00,98,f6,2a,8a,36,d7,cd,01,1c,02,00,00,\ + 34,08,00,00,f2,03,00,00,01,00,00,00,03,00,00,00,00,00,00,00,2a,6e,de,35,2b,\ + ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00 +"BKGND_FREEZE_THREAD (Leave)"=hex:48,00,00,00,00,00,00,00,98,f6,2a,8a,36,d7,cd,\ + 01,1c,02,00,00,d8,04,00,00,fc,03,00,00,00,00,00,00,03,00,00,00,00,00,00,00,\ + 2a,6e,de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00,00,00 +"THAW (Leave)"=hex:48,00,00,00,00,00,00,00,98,f6,2a,8a,36,d7,cd,01,1c,02,00,00,\ + 34,08,00,00,f2,03,00,00,00,00,00,00,03,00,00,00,00,00,00,00,2a,6e,de,35,2b,\ + ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00 +"VSS_WS_WAITING_FOR_POST_SNAPSHOT (SetCurrentState)"=hex:48,00,00,00,00,00,00,\ + 00,98,f6,2a,8a,36,d7,cd,01,1c,02,00,00,34,08,00,00,04,00,00,00,01,00,00,00,\ + 03,00,00,00,00,00,00,00,2a,6e,de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,\ + 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 +"POSTSNAPSHOT (Enter)"=hex:48,00,00,00,00,00,00,00,17,ac,ef,91,36,d7,cd,01,1c,\ + 02,00,00,34,08,00,00,f5,03,00,00,01,00,00,00,04,00,00,00,00,00,00,00,2a,6e,\ + de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00 [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}] +"PROVIDER_BEGINPREPARE (Enter)"=hex:48,00,00,00,00,00,00,00,a0,5c,db,7a,36,d7,\ + cd,01,1c,02,00,00,34,05,00,00,01,04,00,00,01,00,00,00,00,00,00,00,00,00,00,\ + 00,2a,6e,de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00,00,00,00 +"PROVIDER_BEGINPREPARE (Leave)"=hex:48,00,00,00,00,00,00,00,40,82,01,7b,36,d7,\ + cd,01,1c,02,00,00,34,05,00,00,01,04,00,00,00,00,00,00,00,00,00,00,00,00,00,\ + 00,2a,6e,de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00,00,00,00 +"PROVIDER_ENDPREPARE (Enter)"=hex:48,00,00,00,00,00,00,00,34,bf,83,7c,36,d7,cd,\ + 01,1c,02,00,00,84,07,00,00,02,04,00,00,01,00,00,00,00,00,00,00,00,00,00,00,\ + 2a,6e,de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00,00,00 +"PROVIDER_ENDPREPARE (Leave)"=hex:48,00,00,00,00,00,00,00,36,7d,6f,80,36,d7,cd,\ + 01,1c,02,00,00,84,07,00,00,02,04,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ + 2a,6e,de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00,00,00 +"PROVIDER_PRECOMMIT (Enter)"=hex:48,00,00,00,00,00,00,00,02,30,f9,86,36,d7,cd,\ + 01,1c,02,00,00,84,07,00,00,03,04,00,00,01,00,00,00,00,00,00,00,00,00,00,00,\ + 2a,6e,de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00,00,00 +"PROVIDER_PRECOMMIT (Leave)"=hex:48,00,00,00,00,00,00,00,5c,92,fb,86,36,d7,cd,\ + 01,1c,02,00,00,84,07,00,00,03,04,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ + 2a,6e,de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00,00,00 +"PROVIDER_COMMIT (Enter)"=hex:48,00,00,00,00,00,00,00,5e,23,b6,89,36,d7,cd,01,\ + 1c,02,00,00,68,06,00,00,04,04,00,00,01,00,00,00,00,00,00,00,00,00,00,00,2a,\ + 6e,de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00,00 +"PROVIDER_COMMIT (Leave)"=hex:48,00,00,00,00,00,00,00,c6,ac,bf,89,36,d7,cd,01,\ + 1c,02,00,00,68,06,00,00,04,04,00,00,00,00,00,00,00,00,00,00,00,00,00,00,2a,\ + 6e,de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00,00 +"PROVIDER_POSTCOMMIT (Enter)"=hex:48,00,00,00,00,00,00,00,20,0f,c2,89,36,d7,cd,\ + 01,1c,02,00,00,84,07,00,00,05,04,00,00,01,00,00,00,00,00,00,00,00,00,00,00,\ + 2a,6e,de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00,00,00 +"PROVIDER_POSTCOMMIT (Leave)"=hex:48,00,00,00,00,00,00,00,22,46,1a,8a,36,d7,cd,\ + 01,1c,02,00,00,84,07,00,00,05,04,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ + 2a,6e,de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00,00,00 +"PROVIDER_PREFINALCOMMIT (Enter)"=hex:48,00,00,00,00,00,00,00,b4,44,39,8a,36,\ + d7,cd,01,1c,02,00,00,84,07,00,00,06,04,00,00,01,00,00,00,00,00,00,00,00,00,\ + 00,00,2a,6e,de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,\ + 00,00,00,00,00,00,00,00,00 +"PROVIDER_PREFINALCOMMIT (Leave)"=hex:48,00,00,00,00,00,00,00,0f,fd,bf,91,36,\ + d7,cd,01,1c,02,00,00,84,07,00,00,06,04,00,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,2a,6e,de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,\ + 00,00,00,00,00,00,00,00,00 [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\System Writer] "IDENTIFY (Enter)"=hex:48,00,00,00,00,00,00,00,c8,c1,f8,42,36,d7,cd,01,34,04,\ @@ -2124265,6 +2124676,82 @@ 00,00,74,05,00,00,e8,03,00,00,00,00,00,00,01,00,00,00,00,00,00,00,00,00,00,\ 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ 00,00,00,00 +"PREPAREBACKUP (Enter)"=hex:48,00,00,00,00,00,00,00,ee,ce,2e,7b,36,d7,cd,01,34,\ + 04,00,00,74,05,00,00,e9,03,00,00,01,00,00,00,01,00,00,00,00,00,00,00,2a,6e,\ + de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00 +"PREPAREBACKUP (Leave)"=hex:48,00,00,00,00,00,00,00,92,62,05,7c,36,d7,cd,01,34,\ + 04,00,00,74,05,00,00,e9,03,00,00,00,00,00,00,01,00,00,00,00,00,00,00,2a,6e,\ + de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00 +"VSS_WS_STABLE (SetCurrentState)"=hex:48,00,00,00,00,00,00,00,92,62,05,7c,36,\ + d7,cd,01,34,04,00,00,74,05,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,\ + 00,00,2a,6e,de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,\ + 00,00,00,00,00,00,00,00,00 +"GETSTATE (Enter)"=hex:48,00,00,00,00,00,00,00,62,75,18,7c,36,d7,cd,01,34,04,\ + 00,00,a4,0a,00,00,f9,03,00,00,01,00,00,00,01,00,00,00,00,00,00,00,2a,6e,de,\ + 35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00 +"GETSTATE (Leave)"=hex:48,00,00,00,00,00,00,00,16,3a,1d,7c,36,d7,cd,01,34,04,\ + 00,00,a4,0a,00,00,f9,03,00,00,00,00,00,00,01,00,00,00,00,00,00,00,2a,6e,de,\ + 35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00 +"PREPARESNAPSHOT (Enter)"=hex:48,00,00,00,00,00,00,00,16,ee,e1,80,36,d7,cd,01,\ + 34,04,00,00,a4,0a,00,00,ea,03,00,00,01,00,00,00,01,00,00,00,00,00,00,00,2a,\ + 6e,de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00,00 +"PREPARESNAPSHOT (Leave)"=hex:48,00,00,00,00,00,00,00,32,69,21,82,36,d7,cd,01,\ + 34,04,00,00,a4,0a,00,00,ea,03,00,00,00,00,00,00,01,00,00,00,00,00,00,00,2a,\ + 6e,de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00,00 +"VSS_WS_WAITING_FOR_FREEZE (SetCurrentState)"=hex:48,00,00,00,00,00,00,00,32,\ + 69,21,82,36,d7,cd,01,34,04,00,00,a4,0a,00,00,02,00,00,00,01,00,00,00,01,00,\ + 00,00,00,00,00,00,2a,6e,de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,\ + 00,00,00,00,00,00,00,00,00,00,00,00,00 +"FREEZE (Enter)"=hex:48,00,00,00,00,00,00,00,86,53,4c,82,36,d7,cd,01,34,04,00,\ + 00,a4,0a,00,00,eb,03,00,00,01,00,00,00,02,00,00,00,00,00,00,00,2a,6e,de,35,\ + 2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00 +"FREEZE (Leave)"=hex:48,00,00,00,00,00,00,00,a0,97,33,83,36,d7,cd,01,34,04,00,\ + 00,a4,0a,00,00,eb,03,00,00,00,00,00,00,02,00,00,00,00,00,00,00,2a,6e,de,35,\ + 2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00 +"VSS_WS_WAITING_FOR_THAW (SetCurrentState)"=hex:48,00,00,00,00,00,00,00,a0,97,\ + 33,83,36,d7,cd,01,34,04,00,00,a4,0a,00,00,03,00,00,00,01,00,00,00,02,00,00,\ + 00,00,00,00,00,2a,6e,de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,\ + 00,00,00,00,00,00,00,00,00,00,00,00 +"BKGND_FREEZE_THREAD (Enter)"=hex:48,00,00,00,00,00,00,00,a0,97,33,83,36,d7,cd,\ + 01,34,04,00,00,9c,06,00,00,fc,03,00,00,01,00,00,00,03,00,00,00,00,00,00,00,\ + 2a,6e,de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00,00,00 +"THAW (Enter)"=hex:48,00,00,00,00,00,00,00,a6,1d,32,8a,36,d7,cd,01,34,04,00,00,\ + a4,0a,00,00,f2,03,00,00,01,00,00,00,03,00,00,00,00,00,00,00,2a,6e,de,35,2b,\ + ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00 +"BKGND_FREEZE_THREAD (Leave)"=hex:48,00,00,00,00,00,00,00,a6,1d,32,8a,36,d7,cd,\ + 01,34,04,00,00,9c,06,00,00,fc,03,00,00,00,00,00,00,03,00,00,00,00,00,00,00,\ + 2a,6e,de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00,00,00 +"THAW (Leave)"=hex:48,00,00,00,00,00,00,00,a6,1d,32,8a,36,d7,cd,01,34,04,00,00,\ + a4,0a,00,00,f2,03,00,00,00,00,00,00,03,00,00,00,00,00,00,00,2a,6e,de,35,2b,\ + ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00 +"VSS_WS_WAITING_FOR_POST_SNAPSHOT (SetCurrentState)"=hex:48,00,00,00,00,00,00,\ + 00,a6,1d,32,8a,36,d7,cd,01,34,04,00,00,a4,0a,00,00,04,00,00,00,01,00,00,00,\ + 03,00,00,00,00,00,00,00,2a,6e,de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,\ + 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 +"POSTSNAPSHOT (Enter)"=hex:48,00,00,00,00,00,00,00,e7,be,02,92,36,d7,cd,01,34,\ + 04,00,00,a4,0a,00,00,f5,03,00,00,01,00,00,00,04,00,00,00,00,00,00,00,2a,6e,\ + de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00 +"POSTSNAPSHOT (Leave)"=hex:48,00,00,00,00,00,00,00,8f,93,58,92,36,d7,cd,01,34,\ + 04,00,00,a4,0a,00,00,f5,03,00,00,00,00,00,00,04,00,00,00,00,00,00,00,2a,6e,\ + de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00 +"VSS_WS_WAITING_FOR_BACKUP_COMPLETE (SetCurrentState)"=hex:48,00,00,00,00,00,\ + 00,00,8f,93,58,92,36,d7,cd,01,34,04,00,00,a4,0a,00,00,05,00,00,00,01,00,00,\ + 00,04,00,00,00,00,00,00,00,2a,6e,de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,\ + 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VolSnap] "Volume{560e95cb-3b3e-11e2-aafd-806e6f6e6963}DiscoverSnapshots (Enter)"=hex:48,\ @@ -2124284,15 +2124771,15 @@ 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 "Volume{560e95cb-3b3e-11e2-aafd-806e6f6e6963}ComputeIgnorableProduct (Enter)"=hex:48,\ - 00,00,00,00,00,00,00,dc,6e,fe,49,36,d7,cd,01,00,00,00,00,00,00,00,00,0c,00,\ + 00,00,00,00,00,00,00,a6,4a,63,8b,36,d7,cd,01,00,00,00,00,00,00,00,00,0c,00,\ 00,00,01,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 "Volume{560e95cb-3b3e-11e2-aafd-806e6f6e6963}ComputeIgnorableProduct (Leave)"=hex:48,\ - 00,00,00,00,00,00,00,ad,d7,04,4b,36,d7,cd,01,00,00,00,00,00,00,00,00,0d,00,\ + 00,00,00,00,00,00,00,ca,47,a1,8b,36,d7,cd,01,00,00,00,00,00,00,00,00,0d,00,\ 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 "Volume{560e95cb-3b3e-11e2-aafd-806e6f6e6963}DeleteProcess (Enter)"=hex:48,00,\ - 00,00,00,00,00,00,c4,61,6f,49,36,d7,cd,01,00,00,00,00,00,00,00,00,12,00,00,\ + 00,00,00,00,00,00,22,46,1a,8a,36,d7,cd,01,00,00,00,00,00,00,00,00,12,00,00,\ 00,01,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 "Volume{560e95cb-3b3e-11e2-aafd-806e6f6e6963}Activate (Leave)"=hex:48,00,00,00,\ @@ -2124304,15 +2124791,15 @@ 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 "Volume{560e95cb-3b3e-11e2-aafd-806e6f6e6963}SetIgnorable (Enter)"=hex:48,00,\ - 00,00,00,00,00,00,a6,f8,9f,53,35,d7,cd,01,00,00,00,00,00,00,00,00,0a,00,00,\ + 00,00,00,00,00,00,22,46,1a,8a,36,d7,cd,01,00,00,00,00,00,00,00,00,0a,00,00,\ 00,01,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 "Volume{560e95cb-3b3e-11e2-aafd-806e6f6e6963}SetIgnorable (Leave)"=hex:48,00,\ - 00,00,00,00,00,00,6e,c4,0c,5d,35,d7,cd,01,00,00,00,00,00,00,00,00,0b,00,00,\ + 00,00,00,00,00,00,96,ec,03,8b,36,d7,cd,01,00,00,00,00,00,00,00,00,0b,00,00,\ 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 "Volume{560e95cb-3b3e-11e2-aafd-806e6f6e6963}AdjustBitmap (Enter)"=hex:48,00,\ - 00,00,00,00,00,00,6e,c4,0c,5d,35,d7,cd,01,00,00,00,00,00,00,00,00,04,00,00,\ + 00,00,00,00,00,00,96,ec,03,8b,36,d7,cd,01,00,00,00,00,00,00,00,00,04,00,00,\ 00,01,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 "Volume{560e95cb-3b3e-11e2-aafd-806e6f6e6963}ValidateDiffAreaFiles (Enter)"=hex:48,\ @@ -2124332,13 +2124819,37 @@ 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 "Volume{560e95cb-3b3e-11e2-aafd-806e6f6e6963}DeleteProcess (Leave)"=hex:48,00,\ - 00,00,00,00,00,00,f0,0d,dd,49,36,d7,cd,01,00,00,00,00,00,00,00,00,13,00,00,\ + 00,00,00,00,00,00,1c,fb,73,8b,36,d7,cd,01,00,00,00,00,00,00,00,00,13,00,00,\ 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 "Volume{560e95cb-3b3e-11e2-aafd-806e6f6e6963}AdjustBitmap (Leave)"=hex:48,00,\ - 00,00,00,00,00,00,de,56,a8,5f,35,d7,cd,01,00,00,00,00,00,00,00,00,05,00,00,\ + 00,00,00,00,00,00,8c,33,ad,8b,36,d7,cd,01,00,00,00,00,00,00,00,00,05,00,00,\ 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 +"Volume{560e95cb-3b3e-11e2-aafd-806e6f6e6963}PrepareForSnapshot (Enter)"=hex:48,\ + 00,00,00,00,00,00,00,6e,92,f8,7c,36,d7,cd,01,b8,0a,00,00,08,09,00,00,00,00,\ + 00,00,01,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 +"Volume{560e95cb-3b3e-11e2-aafd-806e6f6e6963}PreExposure (Enter)"=hex:48,00,00,\ + 00,00,00,00,00,36,7d,6f,80,36,d7,cd,01,b8,0a,00,00,08,09,00,00,02,00,00,00,\ + 01,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 +"Volume{560e95cb-3b3e-11e2-aafd-806e6f6e6963}PreExposure (Leave)"=hex:48,00,00,\ + 00,00,00,00,00,36,7d,6f,80,36,d7,cd,01,b8,0a,00,00,08,09,00,00,03,00,00,00,\ + 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 +"Volume{560e95cb-3b3e-11e2-aafd-806e6f6e6963}PrepareForSnapshot (Leave)"=hex:48,\ + 00,00,00,00,00,00,00,36,7d,6f,80,36,d7,cd,01,b8,0a,00,00,08,09,00,00,01,00,\ + 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 +"Volume{560e95cb-3b3e-11e2-aafd-806e6f6e6963}EndCommit (Enter)"=hex:48,00,00,\ + 00,00,00,00,00,20,0f,c2,89,36,d7,cd,01,b8,0a,00,00,08,09,00,00,06,00,00,00,\ + 01,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 +"Volume{560e95cb-3b3e-11e2-aafd-806e6f6e6963}EndCommit (Leave)"=hex:48,00,00,\ + 00,00,00,00,00,22,46,1a,8a,36,d7,cd,01,b8,0a,00,00,08,09,00,00,07,00,00,00,\ + 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssapiPublisher] "IDENTIFY (Enter)"=hex:48,00,00,00,00,00,00,00,0c,4e,c4,42,36,d7,cd,01,b0,03,\ @@ -2124349,8 +2124860,108 @@ 00,00,cc,09,00,00,e8,03,00,00,00,00,00,00,00,00,00,00,00,00,00,00,2a,6e,de,\ 35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,00,\ 00,00,00,00 +"PREPAREBACKUP (Enter)"=hex:48,00,00,00,00,00,00,00,4e,a9,08,7b,36,d7,cd,01,b0,\ + 03,00,00,c8,08,00,00,e9,03,00,00,01,00,00,00,00,00,00,00,00,00,00,00,2a,6e,\ + de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00 +"PREPAREBACKUP (Leave)"=hex:48,00,00,00,00,00,00,00,92,62,05,7c,36,d7,cd,01,b0,\ + 03,00,00,c8,08,00,00,e9,03,00,00,00,00,00,00,00,00,00,00,00,00,00,00,2a,6e,\ + de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00 +"GETSTATE (Enter)"=hex:48,00,00,00,00,00,00,00,ec,c4,07,7c,36,d7,cd,01,b0,03,\ + 00,00,c4,01,00,00,f9,03,00,00,01,00,00,00,00,00,00,00,00,00,00,00,2a,6e,de,\ + 35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00 +"GETSTATE (Leave)"=hex:48,00,00,00,00,00,00,00,e6,4c,30,7c,36,d7,cd,01,b0,03,\ + 00,00,c4,01,00,00,f9,03,00,00,00,00,00,00,00,00,00,00,00,00,00,00,2a,6e,de,\ + 35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00 +"DOSNAPSHOT (Enter)"=hex:48,00,00,00,00,00,00,00,da,5c,81,7c,36,d7,cd,01,b0,03,\ + 00,00,c4,08,00,00,0a,04,00,00,01,00,00,00,00,00,00,00,00,00,00,00,2a,6e,de,\ + 35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00 +"DOSNAPSHOT (Leave)"=hex:48,00,00,00,00,00,00,00,22,46,1a,8a,36,d7,cd,01,b0,03,\ + 00,00,f8,06,00,00,0a,04,00,00,00,00,00,00,00,00,00,00,00,00,00,00,2a,6e,de,\ + 35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00 [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssvcPublisher] +"PREPARESNAPSHOT (Enter)"=hex:48,00,00,00,00,00,00,00,4c,53,a6,80,36,d7,cd,01,\ + 1c,02,00,00,84,07,00,00,ea,03,00,00,01,00,00,00,00,00,00,00,00,00,00,00,2a,\ + 6e,de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00,00 +"PREPARESNAPSHOT (Leave)"=hex:48,00,00,00,00,00,00,00,32,69,21,82,36,d7,cd,01,\ + 1c,02,00,00,84,07,00,00,ea,03,00,00,00,00,00,00,00,00,00,00,00,00,00,00,2a,\ + 6e,de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00,00 +"FREEZE (Enter)"=hex:48,00,00,00,00,00,00,00,32,69,21,82,36,d7,cd,01,1c,02,00,\ + 00,84,07,00,00,eb,03,00,00,01,00,00,00,00,00,00,00,00,00,00,00,2a,6e,de,35,\ + 2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00 +"FREEZE_FRONT (Enter)"=hex:48,00,00,00,00,00,00,00,32,69,21,82,36,d7,cd,01,1c,\ + 02,00,00,84,07,00,00,ec,03,00,00,01,00,00,00,00,00,00,00,00,00,00,00,2a,6e,\ + de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00 +"FREEZE_FRONT (Leave)"=hex:48,00,00,00,00,00,00,00,b6,40,39,82,36,d7,cd,01,1c,\ + 02,00,00,84,07,00,00,ec,03,00,00,00,00,00,00,00,00,00,00,00,00,00,00,2a,6e,\ + de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00 +"FREEZE_BACK (Enter)"=hex:48,00,00,00,00,00,00,00,b6,40,39,82,36,d7,cd,01,1c,\ + 02,00,00,84,07,00,00,ed,03,00,00,01,00,00,00,00,00,00,00,00,00,00,00,2a,6e,\ + de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00 +"FREEZE_BACK (Leave)"=hex:48,00,00,00,00,00,00,00,1e,ca,42,82,36,d7,cd,01,1c,\ + 02,00,00,84,07,00,00,ed,03,00,00,00,00,00,00,00,00,00,00,00,00,00,00,2a,6e,\ + de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00 +"FREEZE_SYSTEM (Enter)"=hex:48,00,00,00,00,00,00,00,1e,ca,42,82,36,d7,cd,01,1c,\ + 02,00,00,84,07,00,00,ee,03,00,00,01,00,00,00,00,00,00,00,00,00,00,00,2a,6e,\ + de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00 +"FREEZE_SYSTEM (Leave)"=hex:48,00,00,00,00,00,00,00,a0,97,33,83,36,d7,cd,01,1c,\ + 02,00,00,84,07,00,00,ee,03,00,00,00,00,00,00,00,00,00,00,00,00,00,00,2a,6e,\ + de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00 +"FREEZE_KTM (Enter)"=hex:48,00,00,00,00,00,00,00,a0,97,33,83,36,d7,cd,01,1c,02,\ + 00,00,84,07,00,00,f0,03,00,00,01,00,00,00,00,00,00,00,00,00,00,00,2a,6e,de,\ + 35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00 +"FREEZE_KTM (Leave)"=hex:48,00,00,00,00,00,00,00,a0,97,33,83,36,d7,cd,01,1c,02,\ + 00,00,84,07,00,00,f0,03,00,00,00,00,00,00,00,00,00,00,00,00,00,00,2a,6e,de,\ + 35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00 +"FREEZE_RM (Enter)"=hex:48,00,00,00,00,00,00,00,a0,97,33,83,36,d7,cd,01,1c,02,\ + 00,00,84,07,00,00,ef,03,00,00,01,00,00,00,00,00,00,00,00,00,00,00,2a,6e,de,\ + 35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00 +"FREEZE_RM (Leave)"=hex:48,00,00,00,00,00,00,00,02,30,f9,86,36,d7,cd,01,1c,02,\ + 00,00,84,07,00,00,ef,03,00,00,00,00,00,00,00,00,00,00,00,00,00,00,2a,6e,de,\ + 35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00 +"FREEZE (Leave)"=hex:48,00,00,00,00,00,00,00,02,30,f9,86,36,d7,cd,01,1c,02,00,\ + 00,84,07,00,00,eb,03,00,00,00,00,00,00,00,00,00,00,00,00,00,00,2a,6e,de,35,\ + 2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00 +"THAW_KTM (Enter)"=hex:48,00,00,00,00,00,00,00,22,46,1a,8a,36,d7,cd,01,1c,02,\ + 00,00,84,07,00,00,f4,03,00,00,01,00,00,00,00,00,00,00,00,00,00,00,2a,6e,de,\ + 35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00 +"THAW_KTM (Leave)"=hex:48,00,00,00,00,00,00,00,22,46,1a,8a,36,d7,cd,01,1c,02,\ + 00,00,84,07,00,00,f4,03,00,00,00,00,00,00,00,00,00,00,00,00,00,00,2a,6e,de,\ + 35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00 +"THAW (Enter)"=hex:48,00,00,00,00,00,00,00,22,46,1a,8a,36,d7,cd,01,1c,02,00,00,\ + 84,07,00,00,f2,03,00,00,01,00,00,00,00,00,00,00,00,00,00,00,2a,6e,de,35,2b,\ + ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00 +"THAW (Leave)"=hex:48,00,00,00,00,00,00,00,b4,44,39,8a,36,d7,cd,01,1c,02,00,00,\ + 84,07,00,00,f2,03,00,00,00,00,00,00,00,00,00,00,00,00,00,00,2a,6e,de,35,2b,\ + ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00 +"POSTSNAPSHOT (Enter)"=hex:48,00,00,00,00,00,00,00,c3,c1,c4,91,36,d7,cd,01,1c,\ + 02,00,00,84,07,00,00,f5,03,00,00,01,00,00,00,00,00,00,00,00,00,00,00,2a,6e,\ + de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00 [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\WMI Writer] "IDENTIFY (Enter)"=hex:48,00,00,00,00,00,00,00,14,fd,f3,42,36,d7,cd,01,b0,03,\ @@ -2124361,6 +2124972,82 @@ 00,00,6c,09,00,00,e8,03,00,00,00,00,00,00,01,00,00,00,00,00,00,00,00,00,00,\ 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ 00,00,00,00 +"PREPAREBACKUP (Enter)"=hex:48,00,00,00,00,00,00,00,ee,ce,2e,7b,36,d7,cd,01,b0,\ + 03,00,00,d8,0a,00,00,e9,03,00,00,01,00,00,00,01,00,00,00,00,00,00,00,2a,6e,\ + de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00 +"PREPAREBACKUP (Leave)"=hex:48,00,00,00,00,00,00,00,42,b9,59,7b,36,d7,cd,01,b0,\ + 03,00,00,d8,0a,00,00,e9,03,00,00,00,00,00,00,01,00,00,00,00,00,00,00,2a,6e,\ + de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00 +"VSS_WS_STABLE (SetCurrentState)"=hex:48,00,00,00,00,00,00,00,42,b9,59,7b,36,\ + d7,cd,01,b0,03,00,00,d8,0a,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,\ + 00,00,2a,6e,de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,\ + 00,00,00,00,00,00,00,00,00 +"GETSTATE (Enter)"=hex:48,00,00,00,00,00,00,00,ae,b0,13,7c,36,d7,cd,01,b0,03,\ + 00,00,c4,09,00,00,f9,03,00,00,01,00,00,00,01,00,00,00,00,00,00,00,2a,6e,de,\ + 35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00 +"GETSTATE (Leave)"=hex:48,00,00,00,00,00,00,00,62,75,18,7c,36,d7,cd,01,b0,03,\ + 00,00,c4,09,00,00,f9,03,00,00,00,00,00,00,01,00,00,00,00,00,00,00,2a,6e,de,\ + 35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00 +"PREPARESNAPSHOT (Enter)"=hex:48,00,00,00,00,00,00,00,ca,b2,e6,80,36,d7,cd,01,\ + b0,03,00,00,e8,0a,00,00,ea,03,00,00,01,00,00,00,01,00,00,00,00,00,00,00,2a,\ + 6e,de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00,00 +"PREPARESNAPSHOT (Leave)"=hex:48,00,00,00,00,00,00,00,ce,20,97,81,36,d7,cd,01,\ + b0,03,00,00,e8,0a,00,00,ea,03,00,00,00,00,00,00,01,00,00,00,00,00,00,00,2a,\ + 6e,de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00,00 +"VSS_WS_WAITING_FOR_FREEZE (SetCurrentState)"=hex:48,00,00,00,00,00,00,00,ce,\ + 20,97,81,36,d7,cd,01,b0,03,00,00,e8,0a,00,00,02,00,00,00,01,00,00,00,01,00,\ + 00,00,00,00,00,00,2a,6e,de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,\ + 00,00,00,00,00,00,00,00,00,00,00,00,00 +"FREEZE (Enter)"=hex:48,00,00,00,00,00,00,00,9a,f2,2a,82,36,d7,cd,01,b0,03,00,\ + 00,c0,01,00,00,eb,03,00,00,01,00,00,00,02,00,00,00,00,00,00,00,2a,6e,de,35,\ + 2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00 +"FREEZE (Leave)"=hex:48,00,00,00,00,00,00,00,b6,40,39,82,36,d7,cd,01,b0,03,00,\ + 00,c0,01,00,00,eb,03,00,00,00,00,00,00,02,00,00,00,00,00,00,00,2a,6e,de,35,\ + 2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00 +"VSS_WS_WAITING_FOR_THAW (SetCurrentState)"=hex:48,00,00,00,00,00,00,00,b6,40,\ + 39,82,36,d7,cd,01,b0,03,00,00,c0,01,00,00,03,00,00,00,01,00,00,00,02,00,00,\ + 00,00,00,00,00,2a,6e,de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,\ + 00,00,00,00,00,00,00,00,00,00,00,00 +"BKGND_FREEZE_THREAD (Enter)"=hex:48,00,00,00,00,00,00,00,b6,40,39,82,36,d7,cd,\ + 01,b0,03,00,00,70,06,00,00,fc,03,00,00,01,00,00,00,03,00,00,00,00,00,00,00,\ + 2a,6e,de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00,00,00 +"THAW (Enter)"=hex:48,00,00,00,00,00,00,00,5a,e2,36,8a,36,d7,cd,01,b0,03,00,00,\ + c0,01,00,00,f2,03,00,00,01,00,00,00,03,00,00,00,00,00,00,00,2a,6e,de,35,2b,\ + ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00 +"BKGND_FREEZE_THREAD (Leave)"=hex:48,00,00,00,00,00,00,00,5a,e2,36,8a,36,d7,cd,\ + 01,b0,03,00,00,70,06,00,00,fc,03,00,00,00,00,00,00,03,00,00,00,00,00,00,00,\ + 2a,6e,de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00,00,00 +"THAW (Leave)"=hex:48,00,00,00,00,00,00,00,5a,e2,36,8a,36,d7,cd,01,b0,03,00,00,\ + c0,01,00,00,f2,03,00,00,00,00,00,00,03,00,00,00,00,00,00,00,2a,6e,de,35,2b,\ + ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00 +"VSS_WS_WAITING_FOR_POST_SNAPSHOT (SetCurrentState)"=hex:48,00,00,00,00,00,00,\ + 00,5a,e2,36,8a,36,d7,cd,01,b0,03,00,00,c0,01,00,00,04,00,00,00,01,00,00,00,\ + 03,00,00,00,00,00,00,00,2a,6e,de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,\ + 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 +"POSTSNAPSHOT (Enter)"=hex:48,00,00,00,00,00,00,00,33,fa,fd,91,36,d7,cd,01,b0,\ + 03,00,00,c0,01,00,00,f5,03,00,00,01,00,00,00,04,00,00,00,00,00,00,00,2a,6e,\ + de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00 +"POSTSNAPSHOT (Leave)"=hex:48,00,00,00,00,00,00,00,8d,5c,00,92,36,d7,cd,01,b0,\ + 03,00,00,c0,01,00,00,f5,03,00,00,00,00,00,00,04,00,00,00,00,00,00,00,2a,6e,\ + de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00 +"VSS_WS_WAITING_FOR_BACKUP_COMPLETE (SetCurrentState)"=hex:48,00,00,00,00,00,\ + 00,00,8d,5c,00,92,36,d7,cd,01,b0,03,00,00,c0,01,00,00,05,00,00,00,01,00,00,\ + 00,04,00,00,00,00,00,00,00,2a,6e,de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,\ + 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Providers] @@ -2284572,20 +2285259,20 @@ d7,cd,01,b0,03,00,00,c4,08,00,00,d3,07,00,00,00,00,00,00,00,00,00,00,00,00,\ 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ 00,00,00,00,00,00,00,00,00 -"SppGatherWriterMetadata (Leave)"=hex:48,00,00,00,00,00,00,00,ae,40,3d,cf,6f,\ - d4,cd,01,54,0f,00,00,a0,0b,00,00,d3,07,00,00,01,00,00,00,00,00,00,00,00,00,\ +"SppGatherWriterMetadata (Leave)"=hex:48,00,00,00,00,00,00,00,76,ba,94,79,36,\ + d7,cd,01,b0,03,00,00,c4,08,00,00,d3,07,00,00,01,00,00,00,00,00,00,00,00,00,\ 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ 00,00,00,00,00,00,00,00,00 -"SppAddInterestingComponents (Enter)"=hex:48,00,00,00,00,00,00,00,8c,7a,57,cf,\ - 6f,d4,cd,01,54,0f,00,00,a0,0b,00,00,d4,07,00,00,00,00,00,00,00,00,00,00,00,\ +"SppAddInterestingComponents (Enter)"=hex:48,00,00,00,00,00,00,00,76,ba,94,79,\ + 36,d7,cd,01,b0,03,00,00,c4,08,00,00,d4,07,00,00,00,00,00,00,00,00,00,00,00,\ 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ 00,00,00,00,00,00,00,00,00,00 -"SppAddInterestingComponents (Leave)"=hex:48,00,00,00,00,00,00,00,0a,da,97,cf,\ - 6f,d4,cd,01,54,0f,00,00,a0,0b,00,00,d4,07,00,00,01,00,00,00,00,00,00,00,00,\ +"SppAddInterestingComponents (Leave)"=hex:48,00,00,00,00,00,00,00,64,52,0e,7a,\ + 36,d7,cd,01,b0,03,00,00,c4,08,00,00,d4,07,00,00,01,00,00,00,00,00,00,00,00,\ 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ 00,00,00,00,00,00,00,00,00,00 -"SppCreate (Leave)"=hex:48,00,00,00,00,00,00,00,e8,9a,45,d3,6f,d4,cd,01,54,0f,\ - 00,00,a0,0b,00,00,d0,07,00,00,01,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ +"SppCreate (Leave)"=hex:48,00,00,00,00,00,00,00,7c,a8,1c,8a,36,d7,cd,01,b0,03,\ + 00,00,c4,08,00,00,d0,07,00,00,01,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ 00,00,00,00 @@ -2284594,8 +2285281,8 @@ 00,00,c4,08,00,00,d5,07,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ 00,00,00,00 -"SrCreateRp (Leave)"=hex:48,00,00,00,00,00,00,00,e8,9a,45,d3,6f,d4,cd,01,54,0f,\ - 00,00,a0,0b,00,00,d5,07,00,00,01,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ +"SrCreateRp (Leave)"=hex:48,00,00,00,00,00,00,00,d6,0a,1f,8a,36,d7,cd,01,b0,03,\ + 00,00,c4,08,00,00,d5,07,00,00,01,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ 00,00,00,00 @@ -2284620,8 +2285307,134 @@ 00,00,e8,0b,00,00,e8,03,00,00,00,00,00,00,01,00,00,00,00,00,00,00,00,00,00,\ 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ 00,00,00,00 +"PREPAREBACKUP (Enter)"=hex:48,00,00,00,00,00,00,00,ee,ce,2e,7b,36,d7,cd,01,1c,\ + 02,00,00,94,09,00,00,e9,03,00,00,01,00,00,00,01,00,00,00,00,00,00,00,2a,6e,\ + de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00 +"PREPAREBACKUP (Leave)"=hex:48,00,00,00,00,00,00,00,7c,8c,ce,7b,36,d7,cd,01,1c,\ + 02,00,00,94,09,00,00,e9,03,00,00,00,00,00,00,01,00,00,00,00,00,00,00,2a,6e,\ + de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00 +"VSS_WS_STABLE (SetCurrentState)"=hex:48,00,00,00,00,00,00,00,7c,8c,ce,7b,36,\ + d7,cd,01,1c,02,00,00,94,09,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,\ + 00,00,2a,6e,de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,\ + 00,00,00,00,00,00,00,00,00 +"GETSTATE (Enter)"=hex:48,00,00,00,00,00,00,00,16,3a,1d,7c,36,d7,cd,01,1c,02,\ + 00,00,34,05,00,00,f9,03,00,00,01,00,00,00,01,00,00,00,00,00,00,00,2a,6e,de,\ + 35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00 +"GETSTATE (Leave)"=hex:48,00,00,00,00,00,00,00,ca,fe,21,7c,36,d7,cd,01,1c,02,\ + 00,00,34,05,00,00,f9,03,00,00,00,00,00,00,01,00,00,00,00,00,00,00,2a,6e,de,\ + 35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00 +"PREPARESNAPSHOT (Enter)"=hex:48,00,00,00,00,00,00,00,b4,dc,af,80,36,d7,cd,01,\ + 1c,02,00,00,10,04,00,00,ea,03,00,00,01,00,00,00,01,00,00,00,00,00,00,00,2a,\ + 6e,de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00,00 +"PREPARESNAPSHOT (Leave)"=hex:48,00,00,00,00,00,00,00,f0,e6,7c,81,36,d7,cd,01,\ + 1c,02,00,00,10,04,00,00,ea,03,00,00,00,00,00,00,01,00,00,00,00,00,00,00,2a,\ + 6e,de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00,00 +"VSS_WS_WAITING_FOR_FREEZE (SetCurrentState)"=hex:48,00,00,00,00,00,00,00,f0,\ + e6,7c,81,36,d7,cd,01,1c,02,00,00,10,04,00,00,02,00,00,00,01,00,00,00,01,00,\ + 00,00,00,00,00,00,2a,6e,de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,\ + 00,00,00,00,00,00,00,00,00,00,00,00,00 +"FREEZE (Enter)"=hex:48,00,00,00,00,00,00,00,86,53,4c,82,36,d7,cd,01,1c,02,00,\ + 00,d0,09,00,00,eb,03,00,00,01,00,00,00,02,00,00,00,00,00,00,00,2a,6e,de,35,\ + 2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00 +"FREEZE (Leave)"=hex:48,00,00,00,00,00,00,00,86,53,4c,82,36,d7,cd,01,1c,02,00,\ + 00,d0,09,00,00,eb,03,00,00,00,00,00,00,02,00,00,00,00,00,00,00,2a,6e,de,35,\ + 2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00 +"VSS_WS_WAITING_FOR_THAW (SetCurrentState)"=hex:48,00,00,00,00,00,00,00,86,53,\ + 4c,82,36,d7,cd,01,1c,02,00,00,d0,09,00,00,03,00,00,00,01,00,00,00,02,00,00,\ + 00,00,00,00,00,2a,6e,de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,\ + 00,00,00,00,00,00,00,00,00,00,00,00 +"BKGND_FREEZE_THREAD (Enter)"=hex:48,00,00,00,00,00,00,00,86,53,4c,82,36,d7,cd,\ + 01,1c,02,00,00,b0,05,00,00,fc,03,00,00,01,00,00,00,03,00,00,00,00,00,00,00,\ + 2a,6e,de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00,00,00 +"THAW (Enter)"=hex:48,00,00,00,00,00,00,00,a6,1d,32,8a,36,d7,cd,01,1c,02,00,00,\ + 6c,08,00,00,f2,03,00,00,01,00,00,00,03,00,00,00,00,00,00,00,2a,6e,de,35,2b,\ + ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00 +"BKGND_FREEZE_THREAD (Leave)"=hex:48,00,00,00,00,00,00,00,a6,1d,32,8a,36,d7,cd,\ + 01,1c,02,00,00,b0,05,00,00,fc,03,00,00,00,00,00,00,03,00,00,00,00,00,00,00,\ + 2a,6e,de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00,00,00 +"THAW (Leave)"=hex:48,00,00,00,00,00,00,00,a6,1d,32,8a,36,d7,cd,01,1c,02,00,00,\ + 6c,08,00,00,f2,03,00,00,00,00,00,00,03,00,00,00,00,00,00,00,2a,6e,de,35,2b,\ + ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00 +"VSS_WS_WAITING_FOR_POST_SNAPSHOT (SetCurrentState)"=hex:48,00,00,00,00,00,00,\ + 00,a6,1d,32,8a,36,d7,cd,01,1c,02,00,00,6c,08,00,00,04,00,00,00,01,00,00,00,\ + 03,00,00,00,00,00,00,00,2a,6e,de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,\ + 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 +"POSTSNAPSHOT (Enter)"=hex:48,00,00,00,00,00,00,00,63,e7,ea,91,36,d7,cd,01,1c,\ + 02,00,00,34,08,00,00,f5,03,00,00,01,00,00,00,04,00,00,00,00,00,00,00,2a,6e,\ + de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00 +"POSTSNAPSHOT (Leave)"=hex:48,00,00,00,00,00,00,00,bd,49,ed,91,36,d7,cd,01,1c,\ + 02,00,00,34,08,00,00,f5,03,00,00,00,00,00,00,04,00,00,00,00,00,00,00,2a,6e,\ + de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00 +"VSS_WS_WAITING_FOR_BACKUP_COMPLETE (SetCurrentState)"=hex:48,00,00,00,00,00,\ + 00,00,bd,49,ed,91,36,d7,cd,01,1c,02,00,00,34,08,00,00,05,00,00,00,01,00,00,\ + 00,04,00,00,00,00,00,00,00,2a,6e,de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,\ + 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\VSS\Diag\Lovelace] +"OPEN_VOLUME_HANDLE (Enter)"=hex:48,00,00,00,00,00,00,00,5c,92,fb,86,36,d7,cd,\ + 01,1c,02,00,00,84,07,00,00,fd,03,00,00,01,00,00,00,00,00,00,00,00,00,00,00,\ + 2a,6e,de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00,00,00 +"OPEN_VOLUME_HANDLE (Leave)"=hex:48,00,00,00,00,00,00,00,46,16,27,89,36,d7,cd,\ + 01,1c,02,00,00,84,07,00,00,fd,03,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ + 2a,6e,de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00,00,00 +"IOCTL_FLUSH_AND_HOLD (Enter)"=hex:48,00,00,00,00,00,00,00,46,16,27,89,36,d7,\ + cd,01,1c,02,00,00,84,07,00,00,fe,03,00,00,01,00,00,00,00,00,00,00,00,00,00,\ + 00,2a,6e,de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00,00,00,00 +"IOCTL_FLUSH_AND_HOLD (Leave)"=hex:48,00,00,00,00,00,00,00,50,fc,ae,89,36,d7,\ + cd,01,1c,02,00,00,84,07,00,00,fe,03,00,00,00,00,00,00,00,00,00,00,00,00,00,\ + 00,2a,6e,de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00,00,00,00 +"IOCTL_RELEASE (Enter)"=hex:48,00,00,00,00,00,00,00,20,0f,c2,89,36,d7,cd,01,1c,\ + 02,00,00,84,07,00,00,ff,03,00,00,01,00,00,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00 +"IOCTL_RELEASE (Leave)"=hex:48,00,00,00,00,00,00,00,20,0f,c2,89,36,d7,cd,01,1c,\ + 02,00,00,84,07,00,00,ff,03,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00 + +[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\VSS\Diag\Lovelace(__?_Volume{560e95cb-3b3e-11e2-aafd-806e6f6e6963}_)] +"OPEN_VOLUME_HANDLE (Enter)"=hex:48,00,00,00,00,00,00,00,5c,92,fb,86,36,d7,cd,\ + 01,1c,02,00,00,e4,0b,00,00,fd,03,00,00,01,00,00,00,00,00,00,00,00,00,00,00,\ + 2a,6e,de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00,00,00 +"OPEN_VOLUME_HANDLE (Leave)"=hex:48,00,00,00,00,00,00,00,46,16,27,89,36,d7,cd,\ + 01,1c,02,00,00,e4,0b,00,00,fd,03,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ + 2a,6e,de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00,00,00 +"IOCTL_FLUSH_AND_HOLD (Enter)"=hex:48,00,00,00,00,00,00,00,46,16,27,89,36,d7,\ + cd,01,1c,02,00,00,e4,0b,00,00,fe,03,00,00,01,00,00,00,00,00,00,00,00,00,00,\ + 00,2a,6e,de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00,00,00,00 +"IOCTL_FLUSH_AND_HOLD (Leave)"=hex:48,00,00,00,00,00,00,00,50,fc,ae,89,36,d7,\ + cd,01,1c,02,00,00,e4,0b,00,00,fe,03,00,00,00,00,00,00,00,00,00,00,00,00,00,\ + 00,2a,6e,de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00,00,00,00 +"IOCTL_RELEASE (Enter)"=hex:48,00,00,00,00,00,00,00,20,0f,c2,89,36,d7,cd,01,1c,\ + 02,00,00,e4,0b,00,00,ff,03,00,00,01,00,00,00,00,00,00,00,00,00,00,00,2a,6e,\ + de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00 +"IOCTL_RELEASE (Leave)"=hex:48,00,00,00,00,00,00,00,20,0f,c2,89,36,d7,cd,01,1c,\ + 02,00,00,e4,0b,00,00,ff,03,00,00,00,00,00,00,00,00,00,00,00,00,00,00,2a,6e,\ + de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\VSS\Diag\MSSearch Service Writer] "IDENTIFY (Enter)"=hex:48,00,00,00,00,00,00,00,7c,86,fd,42,36,d7,cd,01,fc,06,\ @@ -2284632,6 +2285445,82 @@ 00,00,00,0b,00,00,e8,03,00,00,00,00,00,00,01,00,00,00,00,00,00,00,00,00,00,\ 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ 00,00,00,00 +"PREPAREBACKUP (Enter)"=hex:48,00,00,00,00,00,00,00,ee,ce,2e,7b,36,d7,cd,01,fc,\ + 06,00,00,00,0b,00,00,e9,03,00,00,01,00,00,00,01,00,00,00,00,00,00,00,2a,6e,\ + de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00 +"PREPAREBACKUP (Leave)"=hex:48,00,00,00,00,00,00,00,dc,66,a8,7b,36,d7,cd,01,fc,\ + 06,00,00,00,0b,00,00,e9,03,00,00,00,00,00,00,01,00,00,00,00,00,00,00,2a,6e,\ + de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00 +"VSS_WS_STABLE (SetCurrentState)"=hex:48,00,00,00,00,00,00,00,dc,66,a8,7b,36,\ + d7,cd,01,fc,06,00,00,00,0b,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,\ + 00,00,2a,6e,de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,\ + 00,00,00,00,00,00,00,00,00 +"GETSTATE (Enter)"=hex:48,00,00,00,00,00,00,00,32,88,2b,7c,36,d7,cd,01,fc,06,\ + 00,00,00,0b,00,00,f9,03,00,00,01,00,00,00,01,00,00,00,00,00,00,00,2a,6e,de,\ + 35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00 +"GETSTATE (Leave)"=hex:48,00,00,00,00,00,00,00,e6,4c,30,7c,36,d7,cd,01,fc,06,\ + 00,00,00,0b,00,00,f9,03,00,00,00,00,00,00,01,00,00,00,00,00,00,00,2a,6e,de,\ + 35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00 +"PREPARESNAPSHOT (Enter)"=hex:48,00,00,00,00,00,00,00,bc,8b,df,80,36,d7,cd,01,\ + fc,06,00,00,00,0b,00,00,ea,03,00,00,01,00,00,00,01,00,00,00,00,00,00,00,2a,\ + 6e,de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00,00 +"PREPARESNAPSHOT (Leave)"=hex:48,00,00,00,00,00,00,00,ce,20,97,81,36,d7,cd,01,\ + fc,06,00,00,00,0b,00,00,ea,03,00,00,00,00,00,00,01,00,00,00,00,00,00,00,2a,\ + 6e,de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00,00 +"VSS_WS_WAITING_FOR_FREEZE (SetCurrentState)"=hex:48,00,00,00,00,00,00,00,ce,\ + 20,97,81,36,d7,cd,01,fc,06,00,00,00,0b,00,00,02,00,00,00,01,00,00,00,01,00,\ + 00,00,00,00,00,00,2a,6e,de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,\ + 00,00,00,00,00,00,00,00,00,00,00,00,00 +"FREEZE (Enter)"=hex:48,00,00,00,00,00,00,00,86,53,4c,82,36,d7,cd,01,fc,06,00,\ + 00,00,0b,00,00,eb,03,00,00,01,00,00,00,02,00,00,00,00,00,00,00,2a,6e,de,35,\ + 2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00 +"FREEZE (Leave)"=hex:48,00,00,00,00,00,00,00,86,53,4c,82,36,d7,cd,01,fc,06,00,\ + 00,00,0b,00,00,eb,03,00,00,00,00,00,00,02,00,00,00,00,00,00,00,2a,6e,de,35,\ + 2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00 +"VSS_WS_WAITING_FOR_THAW (SetCurrentState)"=hex:48,00,00,00,00,00,00,00,86,53,\ + 4c,82,36,d7,cd,01,fc,06,00,00,00,0b,00,00,03,00,00,00,01,00,00,00,02,00,00,\ + 00,00,00,00,00,2a,6e,de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,\ + 00,00,00,00,00,00,00,00,00,00,00,00 +"BKGND_FREEZE_THREAD (Enter)"=hex:48,00,00,00,00,00,00,00,86,53,4c,82,36,d7,cd,\ + 01,fc,06,00,00,b0,02,00,00,fc,03,00,00,01,00,00,00,03,00,00,00,00,00,00,00,\ + 2a,6e,de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00,00,00 +"THAW (Enter)"=hex:48,00,00,00,00,00,00,00,b4,44,39,8a,36,d7,cd,01,fc,06,00,00,\ + 00,0b,00,00,f2,03,00,00,01,00,00,00,03,00,00,00,00,00,00,00,2a,6e,de,35,2b,\ + ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00 +"BKGND_FREEZE_THREAD (Leave)"=hex:48,00,00,00,00,00,00,00,b4,44,39,8a,36,d7,cd,\ + 01,fc,06,00,00,b0,02,00,00,fc,03,00,00,00,00,00,00,03,00,00,00,00,00,00,00,\ + 2a,6e,de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00,00,00 +"THAW (Leave)"=hex:48,00,00,00,00,00,00,00,b4,44,39,8a,36,d7,cd,01,fc,06,00,00,\ + 00,0b,00,00,f2,03,00,00,00,00,00,00,03,00,00,00,00,00,00,00,2a,6e,de,35,2b,\ + ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00 +"VSS_WS_WAITING_FOR_POST_SNAPSHOT (SetCurrentState)"=hex:48,00,00,00,00,00,00,\ + 00,b4,44,39,8a,36,d7,cd,01,fc,06,00,00,00,0b,00,00,04,00,00,00,01,00,00,00,\ + 03,00,00,00,00,00,00,00,2a,6e,de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,\ + 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 +"POSTSNAPSHOT (Enter)"=hex:48,00,00,00,00,00,00,00,cb,70,f4,91,36,d7,cd,01,fc,\ + 06,00,00,00,0b,00,00,f5,03,00,00,01,00,00,00,04,00,00,00,00,00,00,00,2a,6e,\ + de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00 +"POSTSNAPSHOT (Leave)"=hex:48,00,00,00,00,00,00,00,65,a5,d6,95,36,d7,cd,01,fc,\ + 06,00,00,00,0b,00,00,f5,03,00,00,00,00,00,00,04,00,00,00,00,00,00,00,2a,6e,\ + de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00 +"VSS_WS_WAITING_FOR_BACKUP_COMPLETE (SetCurrentState)"=hex:48,00,00,00,00,00,\ + 00,00,65,a5,d6,95,36,d7,cd,01,fc,06,00,00,00,0b,00,00,05,00,00,00,01,00,00,\ + 00,04,00,00,00,00,00,00,00,2a,6e,de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,\ + 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\VSS\Diag\Registry Writer] "IDENTIFY (Enter)"=hex:48,00,00,00,00,00,00,00,3e,72,09,43,36,d7,cd,01,1c,02,\ @@ -2284642,6 +2285531,82 @@ 00,00,34,05,00,00,e8,03,00,00,00,00,00,00,01,00,00,00,00,00,00,00,00,00,00,\ 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ 00,00,00,00 +"PREPAREBACKUP (Enter)"=hex:48,00,00,00,00,00,00,00,ee,ce,2e,7b,36,d7,cd,01,1c,\ + 02,00,00,f0,06,00,00,e9,03,00,00,01,00,00,00,01,00,00,00,00,00,00,00,2a,6e,\ + de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00 +"PREPAREBACKUP (Leave)"=hex:48,00,00,00,00,00,00,00,30,51,d3,7b,36,d7,cd,01,1c,\ + 02,00,00,f0,06,00,00,e9,03,00,00,00,00,00,00,01,00,00,00,00,00,00,00,2a,6e,\ + de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00 +"VSS_WS_STABLE (SetCurrentState)"=hex:48,00,00,00,00,00,00,00,30,51,d3,7b,36,\ + d7,cd,01,1c,02,00,00,f0,06,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,\ + 00,00,2a,6e,de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,\ + 00,00,00,00,00,00,00,00,00 +"GETSTATE (Enter)"=hex:48,00,00,00,00,00,00,00,ca,fe,21,7c,36,d7,cd,01,1c,02,\ + 00,00,f0,06,00,00,f9,03,00,00,01,00,00,00,01,00,00,00,00,00,00,00,2a,6e,de,\ + 35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00 +"GETSTATE (Leave)"=hex:48,00,00,00,00,00,00,00,7e,c3,26,7c,36,d7,cd,01,1c,02,\ + 00,00,f0,06,00,00,f9,03,00,00,00,00,00,00,01,00,00,00,00,00,00,00,2a,6e,de,\ + 35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00 +"PREPARESNAPSHOT (Enter)"=hex:48,00,00,00,00,00,00,00,68,a1,b4,80,36,d7,cd,01,\ + 1c,02,00,00,b8,09,00,00,ea,03,00,00,01,00,00,00,01,00,00,00,00,00,00,00,2a,\ + 6e,de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00,00 +"PREPARESNAPSHOT (Leave)"=hex:48,00,00,00,00,00,00,00,58,70,86,81,36,d7,cd,01,\ + 1c,02,00,00,b8,09,00,00,ea,03,00,00,00,00,00,00,01,00,00,00,00,00,00,00,2a,\ + 6e,de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00,00 +"VSS_WS_WAITING_FOR_FREEZE (SetCurrentState)"=hex:48,00,00,00,00,00,00,00,58,\ + 70,86,81,36,d7,cd,01,1c,02,00,00,b8,09,00,00,02,00,00,00,01,00,00,00,01,00,\ + 00,00,00,00,00,00,2a,6e,de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,\ + 00,00,00,00,00,00,00,00,00,00,00,00,00 +"FREEZE (Enter)"=hex:48,00,00,00,00,00,00,00,62,83,3f,83,36,d7,cd,01,1c,02,00,\ + 00,34,08,00,00,eb,03,00,00,01,00,00,00,02,00,00,00,00,00,00,00,2a,6e,de,35,\ + 2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00 +"FREEZE (Leave)"=hex:48,00,00,00,00,00,00,00,02,30,f9,86,36,d7,cd,01,1c,02,00,\ + 00,34,08,00,00,eb,03,00,00,00,00,00,00,02,00,00,00,00,00,00,00,2a,6e,de,35,\ + 2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00 +"VSS_WS_WAITING_FOR_THAW (SetCurrentState)"=hex:48,00,00,00,00,00,00,00,02,30,\ + f9,86,36,d7,cd,01,1c,02,00,00,34,08,00,00,03,00,00,00,01,00,00,00,02,00,00,\ + 00,00,00,00,00,2a,6e,de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,\ + 00,00,00,00,00,00,00,00,00,00,00,00 +"BKGND_FREEZE_THREAD (Enter)"=hex:48,00,00,00,00,00,00,00,5c,92,fb,86,36,d7,cd,\ + 01,1c,02,00,00,74,02,00,00,fc,03,00,00,01,00,00,00,03,00,00,00,00,00,00,00,\ + 2a,6e,de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00,00,00 +"THAW (Enter)"=hex:48,00,00,00,00,00,00,00,a6,1d,32,8a,36,d7,cd,01,1c,02,00,00,\ + 6c,08,00,00,f2,03,00,00,01,00,00,00,03,00,00,00,00,00,00,00,2a,6e,de,35,2b,\ + ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00 +"BKGND_FREEZE_THREAD (Leave)"=hex:48,00,00,00,00,00,00,00,a6,1d,32,8a,36,d7,cd,\ + 01,1c,02,00,00,74,02,00,00,fc,03,00,00,00,00,00,00,03,00,00,00,00,00,00,00,\ + 2a,6e,de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00,00,00 +"THAW (Leave)"=hex:48,00,00,00,00,00,00,00,a6,1d,32,8a,36,d7,cd,01,1c,02,00,00,\ + 6c,08,00,00,f2,03,00,00,00,00,00,00,03,00,00,00,00,00,00,00,2a,6e,de,35,2b,\ + ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00 +"VSS_WS_WAITING_FOR_POST_SNAPSHOT (SetCurrentState)"=hex:48,00,00,00,00,00,00,\ + 00,a6,1d,32,8a,36,d7,cd,01,1c,02,00,00,6c,08,00,00,04,00,00,00,01,00,00,00,\ + 03,00,00,00,00,00,00,00,2a,6e,de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,\ + 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 +"POSTSNAPSHOT (Enter)"=hex:48,00,00,00,00,00,00,00,bd,49,ed,91,36,d7,cd,01,1c,\ + 02,00,00,34,08,00,00,f5,03,00,00,01,00,00,00,04,00,00,00,00,00,00,00,2a,6e,\ + de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00 +"POSTSNAPSHOT (Leave)"=hex:48,00,00,00,00,00,00,00,17,ac,ef,91,36,d7,cd,01,1c,\ + 02,00,00,34,08,00,00,f5,03,00,00,00,00,00,00,04,00,00,00,00,00,00,00,2a,6e,\ + de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00 +"VSS_WS_WAITING_FOR_BACKUP_COMPLETE (SetCurrentState)"=hex:48,00,00,00,00,00,\ + 00,00,17,ac,ef,91,36,d7,cd,01,1c,02,00,00,34,08,00,00,05,00,00,00,01,00,00,\ + 00,04,00,00,00,00,00,00,00,2a,6e,de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,\ + 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\VSS\Diag\Shadow Copy Optimization Writer] "IDENTIFY (Enter)"=hex:48,00,00,00,00,00,00,00,98,d4,0b,43,36,d7,cd,01,1c,02,\ @@ -2284652,8 +2285617,124 @@ 00,00,ac,0b,00,00,e8,03,00,00,00,00,00,00,01,00,00,00,00,00,00,00,00,00,00,\ 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ 00,00,00,00 +"PREPAREBACKUP (Enter)"=hex:48,00,00,00,00,00,00,00,ee,ce,2e,7b,36,d7,cd,01,1c,\ + 02,00,00,34,05,00,00,e9,03,00,00,01,00,00,00,01,00,00,00,00,00,00,00,2a,6e,\ + de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00 +"PREPAREBACKUP (Leave)"=hex:48,00,00,00,00,00,00,00,4c,9f,e1,7b,36,d7,cd,01,1c,\ + 02,00,00,34,05,00,00,e9,03,00,00,00,00,00,00,01,00,00,00,00,00,00,00,2a,6e,\ + de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00 +"VSS_WS_STABLE (SetCurrentState)"=hex:48,00,00,00,00,00,00,00,4c,9f,e1,7b,36,\ + d7,cd,01,1c,02,00,00,34,05,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,\ + 00,00,2a,6e,de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,\ + 00,00,00,00,00,00,00,00,00 +"GETSTATE (Enter)"=hex:48,00,00,00,00,00,00,00,ca,fe,21,7c,36,d7,cd,01,1c,02,\ + 00,00,34,05,00,00,f9,03,00,00,01,00,00,00,01,00,00,00,00,00,00,00,2a,6e,de,\ + 35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00 +"GETSTATE (Leave)"=hex:48,00,00,00,00,00,00,00,32,88,2b,7c,36,d7,cd,01,1c,02,\ + 00,00,34,05,00,00,f9,03,00,00,00,00,00,00,01,00,00,00,00,00,00,00,2a,6e,de,\ + 35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00 +"PREPARESNAPSHOT (Enter)"=hex:48,00,00,00,00,00,00,00,68,a1,b4,80,36,d7,cd,01,\ + 1c,02,00,00,e4,09,00,00,ea,03,00,00,01,00,00,00,01,00,00,00,00,00,00,00,2a,\ + 6e,de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00,00 +"PREPARESNAPSHOT (Leave)"=hex:48,00,00,00,00,00,00,00,b2,d2,88,81,36,d7,cd,01,\ + 1c,02,00,00,e4,09,00,00,ea,03,00,00,00,00,00,00,01,00,00,00,00,00,00,00,2a,\ + 6e,de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00,00 +"VSS_WS_WAITING_FOR_FREEZE (SetCurrentState)"=hex:48,00,00,00,00,00,00,00,b2,\ + d2,88,81,36,d7,cd,01,1c,02,00,00,e4,09,00,00,02,00,00,00,01,00,00,00,01,00,\ + 00,00,00,00,00,00,2a,6e,de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,\ + 00,00,00,00,00,00,00,00,00,00,00,00,00 +"FREEZE (Enter)"=hex:48,00,00,00,00,00,00,00,9a,f2,2a,82,36,d7,cd,01,1c,02,00,\ + 00,34,08,00,00,eb,03,00,00,01,00,00,00,02,00,00,00,00,00,00,00,2a,6e,de,35,\ + 2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00 +"FREEZE (Leave)"=hex:48,00,00,00,00,00,00,00,9a,f2,2a,82,36,d7,cd,01,1c,02,00,\ + 00,34,08,00,00,eb,03,00,00,00,00,00,00,02,00,00,00,00,00,00,00,2a,6e,de,35,\ + 2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00 +"VSS_WS_WAITING_FOR_THAW (SetCurrentState)"=hex:48,00,00,00,00,00,00,00,9a,f2,\ + 2a,82,36,d7,cd,01,1c,02,00,00,34,08,00,00,03,00,00,00,01,00,00,00,02,00,00,\ + 00,00,00,00,00,2a,6e,de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,\ + 00,00,00,00,00,00,00,00,00,00,00,00 +"BKGND_FREEZE_THREAD (Enter)"=hex:48,00,00,00,00,00,00,00,9a,f2,2a,82,36,d7,cd,\ + 01,1c,02,00,00,d8,04,00,00,fc,03,00,00,01,00,00,00,03,00,00,00,00,00,00,00,\ + 2a,6e,de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00,00,00 +"THAW (Enter)"=hex:48,00,00,00,00,00,00,00,98,f6,2a,8a,36,d7,cd,01,1c,02,00,00,\ + 34,08,00,00,f2,03,00,00,01,00,00,00,03,00,00,00,00,00,00,00,2a,6e,de,35,2b,\ + ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00 +"BKGND_FREEZE_THREAD (Leave)"=hex:48,00,00,00,00,00,00,00,98,f6,2a,8a,36,d7,cd,\ + 01,1c,02,00,00,d8,04,00,00,fc,03,00,00,00,00,00,00,03,00,00,00,00,00,00,00,\ + 2a,6e,de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00,00,00 +"THAW (Leave)"=hex:48,00,00,00,00,00,00,00,98,f6,2a,8a,36,d7,cd,01,1c,02,00,00,\ + 34,08,00,00,f2,03,00,00,00,00,00,00,03,00,00,00,00,00,00,00,2a,6e,de,35,2b,\ + ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00 +"VSS_WS_WAITING_FOR_POST_SNAPSHOT (SetCurrentState)"=hex:48,00,00,00,00,00,00,\ + 00,98,f6,2a,8a,36,d7,cd,01,1c,02,00,00,34,08,00,00,04,00,00,00,01,00,00,00,\ + 03,00,00,00,00,00,00,00,2a,6e,de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,\ + 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 +"POSTSNAPSHOT (Enter)"=hex:48,00,00,00,00,00,00,00,17,ac,ef,91,36,d7,cd,01,1c,\ + 02,00,00,34,08,00,00,f5,03,00,00,01,00,00,00,04,00,00,00,00,00,00,00,2a,6e,\ + de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}] +"PROVIDER_BEGINPREPARE (Enter)"=hex:48,00,00,00,00,00,00,00,a0,5c,db,7a,36,d7,\ + cd,01,1c,02,00,00,34,05,00,00,01,04,00,00,01,00,00,00,00,00,00,00,00,00,00,\ + 00,2a,6e,de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00,00,00,00 +"PROVIDER_BEGINPREPARE (Leave)"=hex:48,00,00,00,00,00,00,00,40,82,01,7b,36,d7,\ + cd,01,1c,02,00,00,34,05,00,00,01,04,00,00,00,00,00,00,00,00,00,00,00,00,00,\ + 00,2a,6e,de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00,00,00,00 +"PROVIDER_ENDPREPARE (Enter)"=hex:48,00,00,00,00,00,00,00,34,bf,83,7c,36,d7,cd,\ + 01,1c,02,00,00,84,07,00,00,02,04,00,00,01,00,00,00,00,00,00,00,00,00,00,00,\ + 2a,6e,de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00,00,00 +"PROVIDER_ENDPREPARE (Leave)"=hex:48,00,00,00,00,00,00,00,36,7d,6f,80,36,d7,cd,\ + 01,1c,02,00,00,84,07,00,00,02,04,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ + 2a,6e,de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00,00,00 +"PROVIDER_PRECOMMIT (Enter)"=hex:48,00,00,00,00,00,00,00,02,30,f9,86,36,d7,cd,\ + 01,1c,02,00,00,84,07,00,00,03,04,00,00,01,00,00,00,00,00,00,00,00,00,00,00,\ + 2a,6e,de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00,00,00 +"PROVIDER_PRECOMMIT (Leave)"=hex:48,00,00,00,00,00,00,00,5c,92,fb,86,36,d7,cd,\ + 01,1c,02,00,00,84,07,00,00,03,04,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ + 2a,6e,de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00,00,00 +"PROVIDER_COMMIT (Enter)"=hex:48,00,00,00,00,00,00,00,5e,23,b6,89,36,d7,cd,01,\ + 1c,02,00,00,68,06,00,00,04,04,00,00,01,00,00,00,00,00,00,00,00,00,00,00,2a,\ + 6e,de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00,00 +"PROVIDER_COMMIT (Leave)"=hex:48,00,00,00,00,00,00,00,c6,ac,bf,89,36,d7,cd,01,\ + 1c,02,00,00,68,06,00,00,04,04,00,00,00,00,00,00,00,00,00,00,00,00,00,00,2a,\ + 6e,de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00,00 +"PROVIDER_POSTCOMMIT (Enter)"=hex:48,00,00,00,00,00,00,00,20,0f,c2,89,36,d7,cd,\ + 01,1c,02,00,00,84,07,00,00,05,04,00,00,01,00,00,00,00,00,00,00,00,00,00,00,\ + 2a,6e,de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00,00,00 +"PROVIDER_POSTCOMMIT (Leave)"=hex:48,00,00,00,00,00,00,00,22,46,1a,8a,36,d7,cd,\ + 01,1c,02,00,00,84,07,00,00,05,04,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ + 2a,6e,de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00,00,00 +"PROVIDER_PREFINALCOMMIT (Enter)"=hex:48,00,00,00,00,00,00,00,b4,44,39,8a,36,\ + d7,cd,01,1c,02,00,00,84,07,00,00,06,04,00,00,01,00,00,00,00,00,00,00,00,00,\ + 00,00,2a,6e,de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,\ + 00,00,00,00,00,00,00,00,00 +"PROVIDER_PREFINALCOMMIT (Leave)"=hex:48,00,00,00,00,00,00,00,0f,fd,bf,91,36,\ + d7,cd,01,1c,02,00,00,84,07,00,00,06,04,00,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,2a,6e,de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,\ + 00,00,00,00,00,00,00,00,00 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\VSS\Diag\System Writer] "IDENTIFY (Enter)"=hex:48,00,00,00,00,00,00,00,c8,c1,f8,42,36,d7,cd,01,34,04,\ @@ -2284664,6 +2285745,82 @@ 00,00,74,05,00,00,e8,03,00,00,00,00,00,00,01,00,00,00,00,00,00,00,00,00,00,\ 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ 00,00,00,00 +"PREPAREBACKUP (Enter)"=hex:48,00,00,00,00,00,00,00,ee,ce,2e,7b,36,d7,cd,01,34,\ + 04,00,00,74,05,00,00,e9,03,00,00,01,00,00,00,01,00,00,00,00,00,00,00,2a,6e,\ + de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00 +"PREPAREBACKUP (Leave)"=hex:48,00,00,00,00,00,00,00,92,62,05,7c,36,d7,cd,01,34,\ + 04,00,00,74,05,00,00,e9,03,00,00,00,00,00,00,01,00,00,00,00,00,00,00,2a,6e,\ + de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00 +"VSS_WS_STABLE (SetCurrentState)"=hex:48,00,00,00,00,00,00,00,92,62,05,7c,36,\ + d7,cd,01,34,04,00,00,74,05,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,\ + 00,00,2a,6e,de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,\ + 00,00,00,00,00,00,00,00,00 +"GETSTATE (Enter)"=hex:48,00,00,00,00,00,00,00,62,75,18,7c,36,d7,cd,01,34,04,\ + 00,00,a4,0a,00,00,f9,03,00,00,01,00,00,00,01,00,00,00,00,00,00,00,2a,6e,de,\ + 35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00 +"GETSTATE (Leave)"=hex:48,00,00,00,00,00,00,00,16,3a,1d,7c,36,d7,cd,01,34,04,\ + 00,00,a4,0a,00,00,f9,03,00,00,00,00,00,00,01,00,00,00,00,00,00,00,2a,6e,de,\ + 35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00 +"PREPARESNAPSHOT (Enter)"=hex:48,00,00,00,00,00,00,00,16,ee,e1,80,36,d7,cd,01,\ + 34,04,00,00,a4,0a,00,00,ea,03,00,00,01,00,00,00,01,00,00,00,00,00,00,00,2a,\ + 6e,de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00,00 +"PREPARESNAPSHOT (Leave)"=hex:48,00,00,00,00,00,00,00,32,69,21,82,36,d7,cd,01,\ + 34,04,00,00,a4,0a,00,00,ea,03,00,00,00,00,00,00,01,00,00,00,00,00,00,00,2a,\ + 6e,de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00,00 +"VSS_WS_WAITING_FOR_FREEZE (SetCurrentState)"=hex:48,00,00,00,00,00,00,00,32,\ + 69,21,82,36,d7,cd,01,34,04,00,00,a4,0a,00,00,02,00,00,00,01,00,00,00,01,00,\ + 00,00,00,00,00,00,2a,6e,de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,\ + 00,00,00,00,00,00,00,00,00,00,00,00,00 +"FREEZE (Enter)"=hex:48,00,00,00,00,00,00,00,86,53,4c,82,36,d7,cd,01,34,04,00,\ + 00,a4,0a,00,00,eb,03,00,00,01,00,00,00,02,00,00,00,00,00,00,00,2a,6e,de,35,\ + 2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00 +"FREEZE (Leave)"=hex:48,00,00,00,00,00,00,00,a0,97,33,83,36,d7,cd,01,34,04,00,\ + 00,a4,0a,00,00,eb,03,00,00,00,00,00,00,02,00,00,00,00,00,00,00,2a,6e,de,35,\ + 2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00 +"VSS_WS_WAITING_FOR_THAW (SetCurrentState)"=hex:48,00,00,00,00,00,00,00,a0,97,\ + 33,83,36,d7,cd,01,34,04,00,00,a4,0a,00,00,03,00,00,00,01,00,00,00,02,00,00,\ + 00,00,00,00,00,2a,6e,de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,\ + 00,00,00,00,00,00,00,00,00,00,00,00 +"BKGND_FREEZE_THREAD (Enter)"=hex:48,00,00,00,00,00,00,00,a0,97,33,83,36,d7,cd,\ + 01,34,04,00,00,9c,06,00,00,fc,03,00,00,01,00,00,00,03,00,00,00,00,00,00,00,\ + 2a,6e,de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00,00,00 +"THAW (Enter)"=hex:48,00,00,00,00,00,00,00,a6,1d,32,8a,36,d7,cd,01,34,04,00,00,\ + a4,0a,00,00,f2,03,00,00,01,00,00,00,03,00,00,00,00,00,00,00,2a,6e,de,35,2b,\ + ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00 +"BKGND_FREEZE_THREAD (Leave)"=hex:48,00,00,00,00,00,00,00,a6,1d,32,8a,36,d7,cd,\ + 01,34,04,00,00,9c,06,00,00,fc,03,00,00,00,00,00,00,03,00,00,00,00,00,00,00,\ + 2a,6e,de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00,00,00 +"THAW (Leave)"=hex:48,00,00,00,00,00,00,00,a6,1d,32,8a,36,d7,cd,01,34,04,00,00,\ + a4,0a,00,00,f2,03,00,00,00,00,00,00,03,00,00,00,00,00,00,00,2a,6e,de,35,2b,\ + ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00 +"VSS_WS_WAITING_FOR_POST_SNAPSHOT (SetCurrentState)"=hex:48,00,00,00,00,00,00,\ + 00,a6,1d,32,8a,36,d7,cd,01,34,04,00,00,a4,0a,00,00,04,00,00,00,01,00,00,00,\ + 03,00,00,00,00,00,00,00,2a,6e,de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,\ + 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 +"POSTSNAPSHOT (Enter)"=hex:48,00,00,00,00,00,00,00,e7,be,02,92,36,d7,cd,01,34,\ + 04,00,00,a4,0a,00,00,f5,03,00,00,01,00,00,00,04,00,00,00,00,00,00,00,2a,6e,\ + de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00 +"POSTSNAPSHOT (Leave)"=hex:48,00,00,00,00,00,00,00,8f,93,58,92,36,d7,cd,01,34,\ + 04,00,00,a4,0a,00,00,f5,03,00,00,00,00,00,00,04,00,00,00,00,00,00,00,2a,6e,\ + de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00 +"VSS_WS_WAITING_FOR_BACKUP_COMPLETE (SetCurrentState)"=hex:48,00,00,00,00,00,\ + 00,00,8f,93,58,92,36,d7,cd,01,34,04,00,00,a4,0a,00,00,05,00,00,00,01,00,00,\ + 00,04,00,00,00,00,00,00,00,2a,6e,de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,\ + 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\VSS\Diag\VolSnap] "Volume{560e95cb-3b3e-11e2-aafd-806e6f6e6963}DiscoverSnapshots (Enter)"=hex:48,\ @@ -2284683,15 +2285840,15 @@ 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 "Volume{560e95cb-3b3e-11e2-aafd-806e6f6e6963}ComputeIgnorableProduct (Enter)"=hex:48,\ - 00,00,00,00,00,00,00,dc,6e,fe,49,36,d7,cd,01,00,00,00,00,00,00,00,00,0c,00,\ + 00,00,00,00,00,00,00,a6,4a,63,8b,36,d7,cd,01,00,00,00,00,00,00,00,00,0c,00,\ 00,00,01,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 "Volume{560e95cb-3b3e-11e2-aafd-806e6f6e6963}ComputeIgnorableProduct (Leave)"=hex:48,\ - 00,00,00,00,00,00,00,ad,d7,04,4b,36,d7,cd,01,00,00,00,00,00,00,00,00,0d,00,\ + 00,00,00,00,00,00,00,ca,47,a1,8b,36,d7,cd,01,00,00,00,00,00,00,00,00,0d,00,\ 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 "Volume{560e95cb-3b3e-11e2-aafd-806e6f6e6963}DeleteProcess (Enter)"=hex:48,00,\ - 00,00,00,00,00,00,c4,61,6f,49,36,d7,cd,01,00,00,00,00,00,00,00,00,12,00,00,\ + 00,00,00,00,00,00,22,46,1a,8a,36,d7,cd,01,00,00,00,00,00,00,00,00,12,00,00,\ 00,01,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 "Volume{560e95cb-3b3e-11e2-aafd-806e6f6e6963}Activate (Leave)"=hex:48,00,00,00,\ @@ -2284703,15 +2285860,15 @@ 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 "Volume{560e95cb-3b3e-11e2-aafd-806e6f6e6963}SetIgnorable (Enter)"=hex:48,00,\ - 00,00,00,00,00,00,a6,f8,9f,53,35,d7,cd,01,00,00,00,00,00,00,00,00,0a,00,00,\ + 00,00,00,00,00,00,22,46,1a,8a,36,d7,cd,01,00,00,00,00,00,00,00,00,0a,00,00,\ 00,01,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 "Volume{560e95cb-3b3e-11e2-aafd-806e6f6e6963}SetIgnorable (Leave)"=hex:48,00,\ - 00,00,00,00,00,00,6e,c4,0c,5d,35,d7,cd,01,00,00,00,00,00,00,00,00,0b,00,00,\ + 00,00,00,00,00,00,96,ec,03,8b,36,d7,cd,01,00,00,00,00,00,00,00,00,0b,00,00,\ 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 "Volume{560e95cb-3b3e-11e2-aafd-806e6f6e6963}AdjustBitmap (Enter)"=hex:48,00,\ - 00,00,00,00,00,00,6e,c4,0c,5d,35,d7,cd,01,00,00,00,00,00,00,00,00,04,00,00,\ + 00,00,00,00,00,00,96,ec,03,8b,36,d7,cd,01,00,00,00,00,00,00,00,00,04,00,00,\ 00,01,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 "Volume{560e95cb-3b3e-11e2-aafd-806e6f6e6963}ValidateDiffAreaFiles (Enter)"=hex:48,\ @@ -2284731,13 +2285888,37 @@ 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 "Volume{560e95cb-3b3e-11e2-aafd-806e6f6e6963}DeleteProcess (Leave)"=hex:48,00,\ - 00,00,00,00,00,00,f0,0d,dd,49,36,d7,cd,01,00,00,00,00,00,00,00,00,13,00,00,\ + 00,00,00,00,00,00,1c,fb,73,8b,36,d7,cd,01,00,00,00,00,00,00,00,00,13,00,00,\ 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 "Volume{560e95cb-3b3e-11e2-aafd-806e6f6e6963}AdjustBitmap (Leave)"=hex:48,00,\ - 00,00,00,00,00,00,de,56,a8,5f,35,d7,cd,01,00,00,00,00,00,00,00,00,05,00,00,\ + 00,00,00,00,00,00,8c,33,ad,8b,36,d7,cd,01,00,00,00,00,00,00,00,00,05,00,00,\ 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 +"Volume{560e95cb-3b3e-11e2-aafd-806e6f6e6963}PrepareForSnapshot (Enter)"=hex:48,\ + 00,00,00,00,00,00,00,6e,92,f8,7c,36,d7,cd,01,b8,0a,00,00,08,09,00,00,00,00,\ + 00,00,01,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 +"Volume{560e95cb-3b3e-11e2-aafd-806e6f6e6963}PreExposure (Enter)"=hex:48,00,00,\ + 00,00,00,00,00,36,7d,6f,80,36,d7,cd,01,b8,0a,00,00,08,09,00,00,02,00,00,00,\ + 01,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 +"Volume{560e95cb-3b3e-11e2-aafd-806e6f6e6963}PreExposure (Leave)"=hex:48,00,00,\ + 00,00,00,00,00,36,7d,6f,80,36,d7,cd,01,b8,0a,00,00,08,09,00,00,03,00,00,00,\ + 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 +"Volume{560e95cb-3b3e-11e2-aafd-806e6f6e6963}PrepareForSnapshot (Leave)"=hex:48,\ + 00,00,00,00,00,00,00,36,7d,6f,80,36,d7,cd,01,b8,0a,00,00,08,09,00,00,01,00,\ + 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 +"Volume{560e95cb-3b3e-11e2-aafd-806e6f6e6963}EndCommit (Enter)"=hex:48,00,00,\ + 00,00,00,00,00,20,0f,c2,89,36,d7,cd,01,b8,0a,00,00,08,09,00,00,06,00,00,00,\ + 01,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 +"Volume{560e95cb-3b3e-11e2-aafd-806e6f6e6963}EndCommit (Leave)"=hex:48,00,00,\ + 00,00,00,00,00,22,46,1a,8a,36,d7,cd,01,b8,0a,00,00,08,09,00,00,07,00,00,00,\ + 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\VSS\Diag\VssapiPublisher] "IDENTIFY (Enter)"=hex:48,00,00,00,00,00,00,00,0c,4e,c4,42,36,d7,cd,01,b0,03,\ @@ -2284748,8 +2285929,108 @@ 00,00,cc,09,00,00,e8,03,00,00,00,00,00,00,00,00,00,00,00,00,00,00,2a,6e,de,\ 35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,00,\ 00,00,00,00 +"PREPAREBACKUP (Enter)"=hex:48,00,00,00,00,00,00,00,4e,a9,08,7b,36,d7,cd,01,b0,\ + 03,00,00,c8,08,00,00,e9,03,00,00,01,00,00,00,00,00,00,00,00,00,00,00,2a,6e,\ + de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00 +"PREPAREBACKUP (Leave)"=hex:48,00,00,00,00,00,00,00,92,62,05,7c,36,d7,cd,01,b0,\ + 03,00,00,c8,08,00,00,e9,03,00,00,00,00,00,00,00,00,00,00,00,00,00,00,2a,6e,\ + de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00 +"GETSTATE (Enter)"=hex:48,00,00,00,00,00,00,00,ec,c4,07,7c,36,d7,cd,01,b0,03,\ + 00,00,c4,01,00,00,f9,03,00,00,01,00,00,00,00,00,00,00,00,00,00,00,2a,6e,de,\ + 35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00 +"GETSTATE (Leave)"=hex:48,00,00,00,00,00,00,00,e6,4c,30,7c,36,d7,cd,01,b0,03,\ + 00,00,c4,01,00,00,f9,03,00,00,00,00,00,00,00,00,00,00,00,00,00,00,2a,6e,de,\ + 35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00 +"DOSNAPSHOT (Enter)"=hex:48,00,00,00,00,00,00,00,da,5c,81,7c,36,d7,cd,01,b0,03,\ + 00,00,c4,08,00,00,0a,04,00,00,01,00,00,00,00,00,00,00,00,00,00,00,2a,6e,de,\ + 35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00 +"DOSNAPSHOT (Leave)"=hex:48,00,00,00,00,00,00,00,22,46,1a,8a,36,d7,cd,01,b0,03,\ + 00,00,f8,06,00,00,0a,04,00,00,00,00,00,00,00,00,00,00,00,00,00,00,2a,6e,de,\ + 35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\VSS\Diag\VssvcPublisher] +"PREPARESNAPSHOT (Enter)"=hex:48,00,00,00,00,00,00,00,4c,53,a6,80,36,d7,cd,01,\ + 1c,02,00,00,84,07,00,00,ea,03,00,00,01,00,00,00,00,00,00,00,00,00,00,00,2a,\ + 6e,de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00,00 +"PREPARESNAPSHOT (Leave)"=hex:48,00,00,00,00,00,00,00,32,69,21,82,36,d7,cd,01,\ + 1c,02,00,00,84,07,00,00,ea,03,00,00,00,00,00,00,00,00,00,00,00,00,00,00,2a,\ + 6e,de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00,00 +"FREEZE (Enter)"=hex:48,00,00,00,00,00,00,00,32,69,21,82,36,d7,cd,01,1c,02,00,\ + 00,84,07,00,00,eb,03,00,00,01,00,00,00,00,00,00,00,00,00,00,00,2a,6e,de,35,\ + 2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00 +"FREEZE_FRONT (Enter)"=hex:48,00,00,00,00,00,00,00,32,69,21,82,36,d7,cd,01,1c,\ + 02,00,00,84,07,00,00,ec,03,00,00,01,00,00,00,00,00,00,00,00,00,00,00,2a,6e,\ + de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00 +"FREEZE_FRONT (Leave)"=hex:48,00,00,00,00,00,00,00,b6,40,39,82,36,d7,cd,01,1c,\ + 02,00,00,84,07,00,00,ec,03,00,00,00,00,00,00,00,00,00,00,00,00,00,00,2a,6e,\ + de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00 +"FREEZE_BACK (Enter)"=hex:48,00,00,00,00,00,00,00,b6,40,39,82,36,d7,cd,01,1c,\ + 02,00,00,84,07,00,00,ed,03,00,00,01,00,00,00,00,00,00,00,00,00,00,00,2a,6e,\ + de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00 +"FREEZE_BACK (Leave)"=hex:48,00,00,00,00,00,00,00,1e,ca,42,82,36,d7,cd,01,1c,\ + 02,00,00,84,07,00,00,ed,03,00,00,00,00,00,00,00,00,00,00,00,00,00,00,2a,6e,\ + de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00 +"FREEZE_SYSTEM (Enter)"=hex:48,00,00,00,00,00,00,00,1e,ca,42,82,36,d7,cd,01,1c,\ + 02,00,00,84,07,00,00,ee,03,00,00,01,00,00,00,00,00,00,00,00,00,00,00,2a,6e,\ + de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00 +"FREEZE_SYSTEM (Leave)"=hex:48,00,00,00,00,00,00,00,a0,97,33,83,36,d7,cd,01,1c,\ + 02,00,00,84,07,00,00,ee,03,00,00,00,00,00,00,00,00,00,00,00,00,00,00,2a,6e,\ + de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00 +"FREEZE_KTM (Enter)"=hex:48,00,00,00,00,00,00,00,a0,97,33,83,36,d7,cd,01,1c,02,\ + 00,00,84,07,00,00,f0,03,00,00,01,00,00,00,00,00,00,00,00,00,00,00,2a,6e,de,\ + 35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00 +"FREEZE_KTM (Leave)"=hex:48,00,00,00,00,00,00,00,a0,97,33,83,36,d7,cd,01,1c,02,\ + 00,00,84,07,00,00,f0,03,00,00,00,00,00,00,00,00,00,00,00,00,00,00,2a,6e,de,\ + 35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00 +"FREEZE_RM (Enter)"=hex:48,00,00,00,00,00,00,00,a0,97,33,83,36,d7,cd,01,1c,02,\ + 00,00,84,07,00,00,ef,03,00,00,01,00,00,00,00,00,00,00,00,00,00,00,2a,6e,de,\ + 35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00 +"FREEZE_RM (Leave)"=hex:48,00,00,00,00,00,00,00,02,30,f9,86,36,d7,cd,01,1c,02,\ + 00,00,84,07,00,00,ef,03,00,00,00,00,00,00,00,00,00,00,00,00,00,00,2a,6e,de,\ + 35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00 +"FREEZE (Leave)"=hex:48,00,00,00,00,00,00,00,02,30,f9,86,36,d7,cd,01,1c,02,00,\ + 00,84,07,00,00,eb,03,00,00,00,00,00,00,00,00,00,00,00,00,00,00,2a,6e,de,35,\ + 2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00 +"THAW_KTM (Enter)"=hex:48,00,00,00,00,00,00,00,22,46,1a,8a,36,d7,cd,01,1c,02,\ + 00,00,84,07,00,00,f4,03,00,00,01,00,00,00,00,00,00,00,00,00,00,00,2a,6e,de,\ + 35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00 +"THAW_KTM (Leave)"=hex:48,00,00,00,00,00,00,00,22,46,1a,8a,36,d7,cd,01,1c,02,\ + 00,00,84,07,00,00,f4,03,00,00,00,00,00,00,00,00,00,00,00,00,00,00,2a,6e,de,\ + 35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00 +"THAW (Enter)"=hex:48,00,00,00,00,00,00,00,22,46,1a,8a,36,d7,cd,01,1c,02,00,00,\ + 84,07,00,00,f2,03,00,00,01,00,00,00,00,00,00,00,00,00,00,00,2a,6e,de,35,2b,\ + ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00 +"THAW (Leave)"=hex:48,00,00,00,00,00,00,00,b4,44,39,8a,36,d7,cd,01,1c,02,00,00,\ + 84,07,00,00,f2,03,00,00,00,00,00,00,00,00,00,00,00,00,00,00,2a,6e,de,35,2b,\ + ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00 +"POSTSNAPSHOT (Enter)"=hex:48,00,00,00,00,00,00,00,c3,c1,c4,91,36,d7,cd,01,1c,\ + 02,00,00,84,07,00,00,f5,03,00,00,01,00,00,00,00,00,00,00,00,00,00,00,2a,6e,\ + de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\VSS\Diag\WMI Writer] "IDENTIFY (Enter)"=hex:48,00,00,00,00,00,00,00,14,fd,f3,42,36,d7,cd,01,b0,03,\ @@ -2284760,6 +2286041,82 @@ 00,00,6c,09,00,00,e8,03,00,00,00,00,00,00,01,00,00,00,00,00,00,00,00,00,00,\ 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ 00,00,00,00 +"PREPAREBACKUP (Enter)"=hex:48,00,00,00,00,00,00,00,ee,ce,2e,7b,36,d7,cd,01,b0,\ + 03,00,00,d8,0a,00,00,e9,03,00,00,01,00,00,00,01,00,00,00,00,00,00,00,2a,6e,\ + de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00 +"PREPAREBACKUP (Leave)"=hex:48,00,00,00,00,00,00,00,42,b9,59,7b,36,d7,cd,01,b0,\ + 03,00,00,d8,0a,00,00,e9,03,00,00,00,00,00,00,01,00,00,00,00,00,00,00,2a,6e,\ + de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00 +"VSS_WS_STABLE (SetCurrentState)"=hex:48,00,00,00,00,00,00,00,42,b9,59,7b,36,\ + d7,cd,01,b0,03,00,00,d8,0a,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,\ + 00,00,2a,6e,de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,\ + 00,00,00,00,00,00,00,00,00 +"GETSTATE (Enter)"=hex:48,00,00,00,00,00,00,00,ae,b0,13,7c,36,d7,cd,01,b0,03,\ + 00,00,c4,09,00,00,f9,03,00,00,01,00,00,00,01,00,00,00,00,00,00,00,2a,6e,de,\ + 35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00 +"GETSTATE (Leave)"=hex:48,00,00,00,00,00,00,00,62,75,18,7c,36,d7,cd,01,b0,03,\ + 00,00,c4,09,00,00,f9,03,00,00,00,00,00,00,01,00,00,00,00,00,00,00,2a,6e,de,\ + 35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00 +"PREPARESNAPSHOT (Enter)"=hex:48,00,00,00,00,00,00,00,ca,b2,e6,80,36,d7,cd,01,\ + b0,03,00,00,e8,0a,00,00,ea,03,00,00,01,00,00,00,01,00,00,00,00,00,00,00,2a,\ + 6e,de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00,00 +"PREPARESNAPSHOT (Leave)"=hex:48,00,00,00,00,00,00,00,ce,20,97,81,36,d7,cd,01,\ + b0,03,00,00,e8,0a,00,00,ea,03,00,00,00,00,00,00,01,00,00,00,00,00,00,00,2a,\ + 6e,de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00,00 +"VSS_WS_WAITING_FOR_FREEZE (SetCurrentState)"=hex:48,00,00,00,00,00,00,00,ce,\ + 20,97,81,36,d7,cd,01,b0,03,00,00,e8,0a,00,00,02,00,00,00,01,00,00,00,01,00,\ + 00,00,00,00,00,00,2a,6e,de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,\ + 00,00,00,00,00,00,00,00,00,00,00,00,00 +"FREEZE (Enter)"=hex:48,00,00,00,00,00,00,00,9a,f2,2a,82,36,d7,cd,01,b0,03,00,\ + 00,c0,01,00,00,eb,03,00,00,01,00,00,00,02,00,00,00,00,00,00,00,2a,6e,de,35,\ + 2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00 +"FREEZE (Leave)"=hex:48,00,00,00,00,00,00,00,b6,40,39,82,36,d7,cd,01,b0,03,00,\ + 00,c0,01,00,00,eb,03,00,00,00,00,00,00,02,00,00,00,00,00,00,00,2a,6e,de,35,\ + 2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00 +"VSS_WS_WAITING_FOR_THAW (SetCurrentState)"=hex:48,00,00,00,00,00,00,00,b6,40,\ + 39,82,36,d7,cd,01,b0,03,00,00,c0,01,00,00,03,00,00,00,01,00,00,00,02,00,00,\ + 00,00,00,00,00,2a,6e,de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,\ + 00,00,00,00,00,00,00,00,00,00,00,00 +"BKGND_FREEZE_THREAD (Enter)"=hex:48,00,00,00,00,00,00,00,b6,40,39,82,36,d7,cd,\ + 01,b0,03,00,00,70,06,00,00,fc,03,00,00,01,00,00,00,03,00,00,00,00,00,00,00,\ + 2a,6e,de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00,00,00 +"THAW (Enter)"=hex:48,00,00,00,00,00,00,00,5a,e2,36,8a,36,d7,cd,01,b0,03,00,00,\ + c0,01,00,00,f2,03,00,00,01,00,00,00,03,00,00,00,00,00,00,00,2a,6e,de,35,2b,\ + ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00 +"BKGND_FREEZE_THREAD (Leave)"=hex:48,00,00,00,00,00,00,00,5a,e2,36,8a,36,d7,cd,\ + 01,b0,03,00,00,70,06,00,00,fc,03,00,00,00,00,00,00,03,00,00,00,00,00,00,00,\ + 2a,6e,de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00,00,00 +"THAW (Leave)"=hex:48,00,00,00,00,00,00,00,5a,e2,36,8a,36,d7,cd,01,b0,03,00,00,\ + c0,01,00,00,f2,03,00,00,00,00,00,00,03,00,00,00,00,00,00,00,2a,6e,de,35,2b,\ + ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00 +"VSS_WS_WAITING_FOR_POST_SNAPSHOT (SetCurrentState)"=hex:48,00,00,00,00,00,00,\ + 00,5a,e2,36,8a,36,d7,cd,01,b0,03,00,00,c0,01,00,00,04,00,00,00,01,00,00,00,\ + 03,00,00,00,00,00,00,00,2a,6e,de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,\ + 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 +"POSTSNAPSHOT (Enter)"=hex:48,00,00,00,00,00,00,00,33,fa,fd,91,36,d7,cd,01,b0,\ + 03,00,00,c0,01,00,00,f5,03,00,00,01,00,00,00,04,00,00,00,00,00,00,00,2a,6e,\ + de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00 +"POSTSNAPSHOT (Leave)"=hex:48,00,00,00,00,00,00,00,8d,5c,00,92,36,d7,cd,01,b0,\ + 03,00,00,c0,01,00,00,f5,03,00,00,00,00,00,00,04,00,00,00,00,00,00,00,2a,6e,\ + de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00 +"VSS_WS_WAITING_FOR_BACKUP_COMPLETE (SetCurrentState)"=hex:48,00,00,00,00,00,\ + 00,00,8d,5c,00,92,36,d7,cd,01,b0,03,00,00,c0,01,00,00,05,00,00,00,01,00,00,\ + 00,04,00,00,00,00,00,00,00,2a,6e,de,35,2b,ed,66,4b,bb,6f,0f,b4,b2,6c,19,f9,\ + 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\VSS\Providers] @@ -2298285,8 +2299642,8 @@ 65,00,35,00,30,00,39,00,2d,00,31,00,62,00,33,00,34,00,2d,00,34,00,31,00,63,\ 00,30,00,2d,00,61,00,63,00,62,00,37,00,2d,00,36,00,64,00,34,00,36,00,35,00,\ 30,00,31,00,36,00,38,00,39,00,31,00,35,00,00,00,00,00,00,00,00,00,ad,a4,ee,\ - eb,04,00,00,00,00,00,00,00,08,00,00,00,00,00,00,00,00,00,00,00,9e,d5,3c,e7,\ - 04,00,00,00,00,00,00,00,08,00,00,00,ca,b6,b5,aa,62,d4,cd,01,58,19,2c,c1,01,\ + eb,04,00,00,00,00,00,00,00,08,00,00,00,00,00,00,00,00,00,00,00,25,8d,ad,d9,\ + 04,00,00,00,00,00,00,00,08,00,00,00,9d,f5,b7,9a,36,d7,cd,01,58,19,2c,c1,01,\ 00,00,00,00,00,00,00,04,00,00,00,78,00,00,00,00,00,00,00,84,7b,cc,f1,01,00,\ 00,00,00,00,00,00,04,00,00,00,60,27,00,00,00,00,00,00 @@ -2304844,8 +2306201,8 @@ 00,00,00,00,00,00,00,00,00,00,62,00,65,00,66,00,6f,00,72,00,65,00,64,00,69,\ 00,76,00,76,00,75,00,6e,00,31,00,31,00,2e,00,72,00,65,00,67,00,00,00,22,00,\ 00,00 -"MRUListEx"=hex:00,00,00,00,08,00,00,00,07,00,00,00,06,00,00,00,05,00,00,00,04,\ - 00,00,00,03,00,00,00,02,00,00,00,01,00,00,00,ff,ff,ff,ff +"MRUListEx"=hex:03,00,00,00,00,00,00,00,08,00,00,00,07,00,00,00,06,00,00,00,05,\ + 00,00,00,04,00,00,00,02,00,00,00,01,00,00,00,ff,ff,ff,ff "1"=hex:14,00,1f,58,0d,1a,2c,f0,21,be,50,43,88,b0,73,67,fc,96,ef,3c,1a,02,00,\ 00,14,02,bb,af,93,3b,06,02,04,00,00,00,00,00,3d,00,00,00,31,53,50,53,30,f1,\ 25,b7,ef,47,1a,10,a5,f1,02,60,8c,9e,eb,ac,21,00,00,00,0a,00,00,00,00,1f,00,\ @@ -2305160,8 +2306517,8 @@ 00,00,00,00,00,00,00,00,00,00,62,00,65,00,66,00,6f,00,72,00,65,00,64,00,69,\ 00,76,00,76,00,75,00,6e,00,31,00,31,00,2e,00,72,00,65,00,67,00,00,00,22,00,\ 00,00 -"MRUListEx"=hex:00,00,00,00,08,00,00,00,07,00,00,00,06,00,00,00,05,00,00,00,04,\ - 00,00,00,03,00,00,00,02,00,00,00,01,00,00,00,ff,ff,ff,ff +"MRUListEx"=hex:03,00,00,00,00,00,00,00,08,00,00,00,07,00,00,00,06,00,00,00,05,\ + 00,00,00,04,00,00,00,02,00,00,00,01,00,00,00,ff,ff,ff,ff "1"=hex:14,00,1f,58,0d,1a,2c,f0,21,be,50,43,88,b0,73,67,fc,96,ef,3c,1a,02,00,\ 00,14,02,bb,af,93,3b,06,02,04,00,00,00,00,00,3d,00,00,00,31,53,50,53,30,f1,\ 25,b7,ef,47,1a,10,a5,f1,02,60,8c,9e,eb,ac,21,00,00,00,0a,00,00,00,00,1f,00,\ @@ -2309314,7 +2310671,7 @@ 68,06,00,00,00,80,bf,00,00,80,bf,00,00,80,bf,00,00,80,bf,00,00,80,bf,00,00,\ 80,bf,00,00,80,bf,00,00,80,bf,00,00,80,bf,00,00,80,bf,ff,ff,ff,ff,7e,5e,3b,\ a3,4c,cf,cd,01,00,00,00,00 -"HRZR_PGYFRFFVBA"=hex:00,00,00,00,7b,00,00,00,f4,00,00,00,05,56,62,00,0e,00,00,\ +"HRZR_PGYFRFFVBA"=hex:00,00,00,00,7c,00,00,00,fb,00,00,00,f7,2d,63,00,0e,00,00,\ 00,15,00,00,00,a0,68,06,00,4d,00,69,00,63,00,72,00,6f,00,73,00,6f,00,66,00,\ 74,00,2e,00,57,00,69,00,6e,00,64,00,6f,00,77,00,73,00,2e,00,47,00,65,00,74,\ 00,74,00,69,00,6e,00,67,00,53,00,74,00,61,00,72,00,74,00,65,00,64,00,00,00,\ @@ -2309336,49 +2310693,49 @@ 00,00,00,fd,fc,98,77,00,00,00,00,3f,61,d3,74,00,00,00,00,01,00,00,00,00,00,\ 00,00,50,94,5d,ff,fe,07,00,00,00,00,00,00,00,00,00,00,01,00,00,00,00,00,00,\ 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,02,00,00,00,00,00,00,00,\ - 02,00,00,00,04,00,00,00,28,00,00,00,b3,a9,0f,00,7b,00,46,00,33,00,38,00,42,\ + 02,00,00,00,04,00,00,00,2c,00,00,00,40,0d,10,00,7b,00,46,00,33,00,38,00,42,\ 00,46,00,34,00,30,00,34,00,2d,00,31,00,44,00,34,00,33,00,2d,00,34,00,32,00,\ 46,00,32,00,2d,00,39,00,33,00,30,00,35,00,2d,00,36,00,37,00,44,00,45,00,30,\ 00,42,00,32,00,38,00,46,00,43,00,32,00,33,00,7d,00,5c,00,65,00,78,00,70,00,\ - 6c,00,6f,00,72,00,65,00,72,00,2e,00,65,00,78,00,65,00,00,00,b8,18,00,00,50,\ - 7c,35,00,00,00,00,00,00,00,00,00,00,00,00,00,20,e0,d8,02,00,00,00,00,60,87,\ - 0b,09,00,00,00,00,48,00,00,00,00,00,00,00,08,00,00,00,00,00,00,00,00,00,00,\ - 00,00,00,00,00,01,00,00,00,00,00,00,00,00,00,35,00,00,00,00,00,18,00,00,00,\ - 00,00,00,00,00,00,00,00,00,00,00,00,a0,db,67,06,00,00,00,00,00,00,35,00,00,\ - 00,00,00,60,f8,17,09,00,00,00,00,85,18,89,77,00,00,00,00,00,00,35,00,00,00,\ - 00,00,01,13,56,06,00,00,00,00,00,00,00,00,00,00,00,00,60,78,35,00,00,00,00,\ - 00,60,00,00,00,00,00,00,00,60,7a,35,00,00,00,00,00,20,bb,03,09,00,00,00,00,\ - 58,00,00,00,00,00,00,00,08,00,00,00,00,00,00,00,01,0e,00,00,00,00,00,00,00,\ - 00,00,00,00,00,00,00,48,00,00,00,00,00,00,00,08,00,00,00,00,00,00,00,00,00,\ - 00,00,00,00,00,00,80,88,87,02,00,00,00,00,b5,15,f7,fd,fe,07,00,00,02,00,00,\ - 00,00,00,00,00,40,00,00,00,00,00,00,00,c8,02,35,00,00,00,00,00,74,c6,88,77,\ - 00,00,00,00,1c,53,0d,b1,35,d7,00,00,78,ed,17,09,00,00,00,00,00,00,00,00,00,\ + 6c,00,6f,00,72,00,65,00,72,00,2e,00,65,00,78,00,65,00,00,00,00,00,00,00,00,\ 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ - 00,00,01,00,00,00,00,00,00,00,00,e3,d8,02,00,00,00,00,58,e2,d8,02,00,00,00,\ - 00,f0,52,c1,01,00,00,00,00,30,3c,db,01,00,00,00,00,88,22,6a,fc,fe,07,00,00,\ - a7,09,01,f4,ff,ff,ff,ff,28,3a,db,01,00,00,00,00,a7,09,01,f4,ff,ff,ff,ff,28,\ - 3a,db,01,00,00,00,00,f0,52,c1,01,04,00,00,00,28,00,00,00,b3,a9,0f,00,7b,00,\ + 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00,00,00,00,00,00,00,00,48,90,9a,ff,fe,07,00,00,00,00,00,00,00,\ + 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,70,90,9a,ff,fe,07,\ + 00,00,9b,02,01,ea,ff,ff,ff,ff,40,c8,c7,02,00,00,00,00,00,00,00,00,00,00,00,\ + 00,70,90,9a,ff,fe,07,00,00,9b,02,01,ea,ff,ff,ff,ff,40,c8,c7,02,00,00,00,00,\ + 00,00,00,00,00,00,00,00,0f,00,00,00,00,00,00,00,d4,17,c7,02,00,00,00,00,d0,\ + 19,c7,02,00,00,00,00,d4,17,c7,02,00,00,00,00,00,00,00,00,00,00,00,00,64,66,\ + 6c,74,00,00,00,00,1c,1a,c7,02,00,00,00,00,b4,1a,c7,02,00,00,00,00,f0,e1,d8,\ + 02,00,00,00,00,4c,e5,9b,ff,fe,07,00,00,00,00,00,00,00,00,00,00,4c,e5,9b,ff,\ + fe,07,00,00,00,00,00,00,00,00,00,00,38,19,c7,02,00,00,00,00,b4,1a,c7,02,00,\ + 00,00,00,08,a1,9a,ff,fe,07,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,1c,1a,c7,02,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,ff,ff,ff,\ + ff,00,00,00,00,00,00,00,00,d4,17,c7,02,00,00,00,00,38,19,c7,02,00,00,00,00,\ + 0f,00,00,00,00,00,00,00,1c,1a,c7,02,00,00,00,00,00,00,00,00,00,00,00,00,b4,\ + 1a,c7,02,00,00,00,00,1c,1a,c7,02,04,00,00,00,2c,00,00,00,40,0d,10,00,7b,00,\ 46,00,33,00,38,00,42,00,46,00,34,00,30,00,34,00,2d,00,31,00,44,00,34,00,33,\ 00,2d,00,34,00,32,00,46,00,32,00,2d,00,39,00,33,00,30,00,35,00,2d,00,36,00,\ 37,00,44,00,45,00,30,00,42,00,32,00,38,00,46,00,43,00,32,00,33,00,7d,00,5c,\ 00,65,00,78,00,70,00,6c,00,6f,00,72,00,65,00,72,00,2e,00,65,00,78,00,65,00,\ - 00,00,b8,18,00,00,50,7c,35,00,00,00,00,00,00,00,00,00,00,00,00,00,20,e0,d8,\ - 02,00,00,00,00,60,87,0b,09,00,00,00,00,48,00,00,00,00,00,00,00,08,00,00,00,\ - 00,00,00,00,00,00,00,00,00,00,00,00,01,00,00,00,00,00,00,00,00,00,35,00,00,\ - 00,00,00,18,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,a0,db,67,06,00,00,\ - 00,00,00,00,35,00,00,00,00,00,60,f8,17,09,00,00,00,00,85,18,89,77,00,00,00,\ - 00,00,00,35,00,00,00,00,00,01,13,56,06,00,00,00,00,00,00,00,00,00,00,00,00,\ - 60,78,35,00,00,00,00,00,60,00,00,00,00,00,00,00,60,7a,35,00,00,00,00,00,20,\ - bb,03,09,00,00,00,00,58,00,00,00,00,00,00,00,08,00,00,00,00,00,00,00,01,0e,\ - 00,00,00,00,00,00,00,00,00,00,00,00,00,00,48,00,00,00,00,00,00,00,08,00,00,\ - 00,00,00,00,00,00,00,00,00,00,00,00,00,80,88,87,02,00,00,00,00,b5,15,f7,fd,\ - fe,07,00,00,02,00,00,00,00,00,00,00,40,00,00,00,00,00,00,00,c8,02,35,00,00,\ - 00,00,00,74,c6,88,77,00,00,00,00,1c,53,0d,b1,35,d7,00,00,78,ed,17,09,00,00,\ 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ - 00,00,00,00,00,00,00,00,00,01,00,00,00,00,00,00,00,00,e3,d8,02,00,00,00,00,\ - 58,e2,d8,02,00,00,00,00,f0,52,c1,01,00,00,00,00,30,3c,db,01,00,00,00,00,88,\ - 22,6a,fc,fe,07,00,00,a7,09,01,f4,ff,ff,ff,ff,28,3a,db,01,00,00,00,00,a7,09,\ - 01,f4,ff,ff,ff,ff,28,3a,db,01,00,00,00,00,f0,52,c1,01 + 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,48,90,9a,ff,fe,07,\ + 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ + 00,70,90,9a,ff,fe,07,00,00,9b,02,01,ea,ff,ff,ff,ff,40,c8,c7,02,00,00,00,00,\ + 00,00,00,00,00,00,00,00,70,90,9a,ff,fe,07,00,00,9b,02,01,ea,ff,ff,ff,ff,40,\ + c8,c7,02,00,00,00,00,00,00,00,00,00,00,00,00,0f,00,00,00,00,00,00,00,d4,17,\ + c7,02,00,00,00,00,d0,19,c7,02,00,00,00,00,d4,17,c7,02,00,00,00,00,00,00,00,\ + 00,00,00,00,00,64,66,6c,74,00,00,00,00,1c,1a,c7,02,00,00,00,00,b4,1a,c7,02,\ + 00,00,00,00,f0,e1,d8,02,00,00,00,00,4c,e5,9b,ff,fe,07,00,00,00,00,00,00,00,\ + 00,00,00,4c,e5,9b,ff,fe,07,00,00,00,00,00,00,00,00,00,00,38,19,c7,02,00,00,\ + 00,00,b4,1a,c7,02,00,00,00,00,08,a1,9a,ff,fe,07,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,00,00,00,00,00,1c,1a,c7,02,00,00,00,00,00,00,00,00,00,00,00,00,\ + 00,00,00,00,ff,ff,ff,ff,00,00,00,00,00,00,00,00,d4,17,c7,02,00,00,00,00,38,\ + 19,c7,02,00,00,00,00,0f,00,00,00,00,00,00,00,1c,1a,c7,02,00,00,00,00,00,00,\ + 00,00,00,00,00,00,b4,1a,c7,02,00,00,00,00,1c,1a,c7,02 "{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\\qvfcynlfjvgpu.rkr"=hex:00,00,00,00,0d,\ 00,00,00,13,00,00,00,60,cc,05,00,00,00,80,bf,00,00,80,bf,00,00,80,bf,00,00,\ 80,bf,00,00,80,bf,00,00,80,bf,00,00,80,bf,00,00,80,bf,00,00,80,bf,00,00,80,\ @@ -2309424,7 +2310781,7 @@ bf,00,00,80,bf,00,00,80,bf,00,00,80,bf,00,00,80,bf,ff,ff,ff,ff,50,f6,c3,31,\ 4d,cf,cd,01,00,00,00,00 "{S38OS404-1Q43-42S2-9305-67QR0O28SP23}\\rkcybere.rkr"=hex:00,00,00,00,04,00,\ - 00,00,28,00,00,00,b3,a9,0f,00,00,00,80,bf,00,00,80,bf,00,00,80,bf,00,00,80,\ + 00,00,2c,00,00,00,40,0d,10,00,00,00,80,bf,00,00,80,bf,00,00,80,bf,00,00,80,\ bf,00,00,80,bf,00,00,80,bf,00,00,80,bf,00,00,80,bf,00,00,80,bf,00,00,80,bf,\ ff,ff,ff,ff,90,20,11,bc,35,d7,cd,01,00,00,00,00 "Q:\\IOBKJVAQBJFNQQVGVBAF-NZQ64.RKR"=hex:00,00,00,00,00,00,00,00,08,00,00,00,\ @@ -2309464,7 +2310821,7 @@ bf,00,00,80,bf,00,00,80,bf,00,00,80,bf,ff,ff,ff,ff,00,00,00,00,00,00,00,00,\ 00,00,00,00 "{S38OS404-1Q43-42S2-9305-67QR0O28SP23}\\ertrqvg.rkr"=hex:00,00,00,00,03,00,00,\ - 00,16,00,00,00,4c,5c,06,00,00,00,80,bf,00,00,80,bf,00,00,80,bf,00,00,80,bf,\ + 00,19,00,00,00,2b,a0,06,00,00,00,80,bf,00,00,80,bf,00,00,80,bf,00,00,80,bf,\ 00,00,80,bf,00,00,80,bf,00,00,80,bf,00,00,80,bf,00,00,80,bf,00,00,80,bf,ff,\ ff,ff,ff,90,65,26,c1,35,d7,cd,01,00,00,00,00 "P:\\Hfref\\zfbss2010\\Qbjaybnqf\\QviihaVafgnyyre-20081231.rkr"=hex:00,00,00,\ @@ -2309487,10 +2310844,10 @@ 00,00,00,04,00,00,00,02,00,00,00,b9,7f,01,00,00,00,80,bf,00,00,80,bf,00,00,\ 80,bf,00,00,80,bf,00,00,80,bf,00,00,80,bf,00,00,80,bf,00,00,80,bf,00,00,80,\ bf,00,00,80,bf,ff,ff,ff,ff,50,f4,de,69,6f,d4,cd,01,00,00,00,00 -"P:\\Hfref\\zfbss2010\\Qbjaybnqf\\ZFBssvprQviihaGbbyf.rkr"=hex:00,00,00,00,02,\ - 00,00,00,00,00,00,00,66,52,00,00,00,00,80,bf,00,00,80,bf,00,00,80,bf,00,00,\ +"P:\\Hfref\\zfbss2010\\Qbjaybnqf\\ZFBssvprQviihaGbbyf.rkr"=hex:00,00,00,00,03,\ + 00,00,00,00,00,00,00,ec,82,00,00,00,00,80,bf,00,00,80,bf,00,00,80,bf,00,00,\ 80,bf,00,00,80,bf,00,00,80,bf,00,00,80,bf,00,00,80,bf,00,00,80,bf,00,00,80,\ - bf,ff,ff,ff,ff,f0,2e,8e,d0,35,d7,cd,01,00,00,00,00 + bf,ff,ff,ff,ff,f0,a7,6f,75,36,d7,cd,01,00,00,00,00 "P:\\Onpxhc\\Qviiha\\erzbir_FnzvCebbsvatGbbyf.rkr"=hex:00,00,00,00,02,00,00,00,\ 00,00,00,00,00,00,00,00,00,00,80,bf,00,00,80,bf,00,00,80,bf,00,00,80,bf,00,\ 00,80,bf,00,00,80,bf,00,00,80,bf,00,00,80,bf,00,00,80,bf,00,00,80,bf,ff,ff,\ @@ -2315500,7 +2316857,7 @@ [HKEY_USERS\S-1-5-21-4242609267-1877866684-4123670283-1002\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU] "NodeSlots"=hex:02,02,02,02,02,02,02,02,02,02,02,02,02,02,02,02,02,02,02,02,02,\ 02,02,02,02,02,02,02,02,02,02,02,02,02,02,02,02,02,02,02,02,02,02,02 -"MRUListEx"=hex:03,00,00,00,00,00,00,00,04,00,00,00,01,00,00,00,02,00,00,00,06,\ +"MRUListEx"=hex:04,00,00,00,03,00,00,00,00,00,00,00,01,00,00,00,02,00,00,00,06,\ 00,00,00,05,00,00,00,ff,ff,ff,ff "0"=hex:14,00,1f,50,e0,4f,d0,20,ea,3a,69,10,a2,d8,08,00,2b,30,30,9d,00,00 "1"=hex:14,00,1f,70,68,06,ee,26,0a,a0,d7,44,93,71,be,b0,64,c9,86,83,00,00 @@ -2321534,7 +2322891,7 @@ [HKEY_USERS\S-1-5-21-4242609267-1877866684-4123670283-1002_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU] "NodeSlots"=hex:02,02,02,02,02,02,02,02,02,02,02,02,02,02,02,02,02,02,02,02,02,\ 02,02,02,02,02,02,02,02,02,02,02,02,02,02,02,02,02,02,02,02,02,02,02 -"MRUListEx"=hex:03,00,00,00,00,00,00,00,04,00,00,00,01,00,00,00,02,00,00,00,06,\ +"MRUListEx"=hex:04,00,00,00,03,00,00,00,00,00,00,00,01,00,00,00,02,00,00,00,06,\ 00,00,00,05,00,00,00,ff,ff,ff,ff "0"=hex:14,00,1f,50,e0,4f,d0,20,ea,3a,69,10,a2,d8,08,00,2b,30,30,9d,00,00 "1"=hex:14,00,1f,70,68,06,ee,26,0a,a0,d7,44,93,71,be,b0,64,c9,86,83,00,00