Hibernate: Begin Root Container <--> Hibernate Suspend: Children: Suspend Processes Suspend Services Superfetch Prepare Memory Pre-Sleep Callbacks Worker Threads Swap-in Flush Storage Volumes Query Devices Suspend Devices Winlogon Suspend Total Hiberfile Write Hibernate <--> Suspend Processes: Event-Based Start with provider=31c3b3a-2005-44c2-ac5e-77220c37d6b4, id=22, and version=0 Event-Based Stop with provider=31c3b3a-2005-44c2-ac5e-77220c37d6b4, id=23, and version=0 Additionally, only match start to stop if the PIDs are the same. Children: Suspend Process <--> Suspend Process Event-Based Start with provider=331c3b3a-2005-44c2-ac5e-77220c37d6b4, id=16, and version=1 Event-Based Stop with provider=331c3b3a-2005-44c2-ac5e-77220c37d6b4, id=17, and version=1 Additionally, only match start to stop if the field "Pid" is the same. Instance based off payload field called "Pid" In the start event. This field is of type PID and will have a proces name associated with it as well as ID. <--> End Suspend Process <--> Suspend Services: Event-Based Start with provider=31c3b3a-2005-44c2-ac5e-77220c37d6b4, id=24, and version=0 Event-Based Stop with provider=31c3b3a-2005-44c2-ac5e-77220c37d6b4, id=25, and version=0 Additionally, only match start to stop if the PIDs are the same. Children: Suspend Service Begin Suspend Services <--> Suspend Service Event-Based Start with provider=331c3b3a-2005-44c2-ac5e-77220c37d6b4, id=18, and version=1 Event-Based Stop with provider=331c3b3a-2005-44c2-ac5e-77220c37d6b4, id=19, and version=1 Additionally, only match start to stop if the field "Name" is the same. Instance based off payload field called "Name" in the start event. <--> End Suspend Service <--> Superfetch Prepare Memory Event-Based Start with provider=331c3b3a-2005-44c2-ac5e-77220c37d6b4, id=64, and version=0 Event-Based Stop with provider=331c3b3a-2005-44c2-ac5e-77220c37d6b4, id=65, and version=0 Additionally, only match start to stop if the PIDs are the same. <--> Pre-Sleep Callbacks Event-Based Start with provider=331c3b3a-2005-44c2-ac5e-77220c37d6b4, id=68, and version=0 Event-Based Stop with provider=331c3b3a-2005-44c2-ac5e-77220c37d6b4, id=69, and version=0 Additionally, only match start to stop if the PIDs are the same. <--> Worker Threads Swap-In Event-Based Start with provider=331c3b3a-2005-44c2-ac5e-77220c37d6b4, id=69, and version=0 Event-Based Stop with provider=331c3b3a-2005-44c2-ac5e-77220c37d6b4, id=35, version=0, and Query="true" Additionally, only match start to stop if the PIDs are the same. <--> Flush Storage Volumes Event-Based Start with provider=331c3b3a-2005-44c2-ac5e-77220c37d6b4, id=36, and version=0 Event-Based Stop with provider=331c3b3a-2005-44c2-ac5e-77220c37d6b4, id=35, version=0, and Query="false" Additionally, only match start to stop if the PIDs are the same. <--> Query Devices: Event-Based Start with provider=331c3b3a-2005-44c2-ac5e-77220c37d6b4, id=35, version=0 and Query="true" Event-Based Stop with provider=331c3b3a-2005-44c2-ac5e-77220c37d6b4, id=36, and version=0 Additionally, only match start to stop if the PIDs are the same. Children: Query Device Begin Query Devices <--> Query Device: Event-Based Start with provider=331c3b3a-2005-44c2-ac5e-77220c37d6b4, id=7, version=1, MinorFunction="3" and PowerStateType="0" Event-Based Stop with provider=331c3b3a-2005-44c2-ac5e-77220c37d6b4, id=8, and version=0 Additionally, only match start to stop if the field "Irp" is the same. Instance based off payload field called "InstanceName" in the start event. This is of type Device and will have a device description, name, and ID associated with it. <--> End Query Device <--> Suspend Devices: Event-Based Start with provider=331c3b3a-2005-44c2-ac5e-77220c37d6b4, id=35, version=0 and Query="false" Event-Based Stop with provider=331c3b3a-2005-44c2-ac5e-77220c37d6b4, id=36, and version=0 Additionally, only match start to stop if the PIDs are the same. Children: Suspend Device Begin Suspend Devices <--> Suspend Device: Event-Based Start with provider=331c3b3a-2005-44c2-ac5e-77220c37d6b4, id=7, version=1, MinorFunction="2" and PowerStateType="0" Event-Based Stop with provider=331c3b3a-2005-44c2-ac5e-77220c37d6b4, id=8, and version=0 Additionally, only match start to stop if the field "Irp" is the same. Instance based off payload field called "InstanceName" in the start event. This is of type Device and will have a device description, name, and ID associated with it. <--> Winlogon Suspend: Children: LogonUI Server Startup Begin Winlogon Suspend Container <--> LogonUI Server Startup: Event-Based Start with provider=dbe9b383-7cf3-4331-91cc-a3cb16a3b538, id=501 and version=0 Event-Based Stop with provider=dbe9b383-7cf3-4331-91cc-a3cb16a3b538, id=502, and version=0 Additionally, only match start to stop if the field "Irp" is the same. <--> End Winlogon Suspend <--> Total Hiberfile Write: Children: Hiberfile Initialization Hiberfile Write Begin Total Hiberfile Write Container <--> Hiberfile Initialization: Region-Based Start based off the stop of region: EFB8A907-72AE-489d-ADCF-A45AA6557A43 (Suspend Devices) Region-Based Stop based off the start of region: CA0C6A87-67F6-4b99-889E-1C1365A1CBD9 (Hiberfile Write) <--> Hiberfile Write: Duration-Based Start, subtract the duration * 1000000 found in payload field "TotalHibernateTime" of event provider=331c3b3a-2005-44c2-ac5e-77220c37d6b4, id=117, and version=0 from the Stop. Region-Based Stop based off the start of region: AFF6A955-8918-4e1f-855D-022B3D2AED54 (Powered Off/ Sleeping) <--> End Total Hiberfile Write <--> End Hibernate Suspend <--> Powered Off/Sleeping: Region-Based Start based off the stop of region: 2A6FBA9A-44D4-4511-A7C8-6D4040E98EC5 (System Suspend) Region-Based Stop based off the start of region: d8d639a0-cf4c-45fb-976a-000006002000 (Powered On to Kernel Resume Complete) <--> BIOS Initialization: Region-Based Start based off the stop of region: AFF6A955-8918-4e1f-855D-022B3D2AED54 (Powered Off/Sleeping) Duration-Based Stop, add the duration * 1000000 found in payload field "POSTTime" of event provider=331c3b3a-2005-44c2-ac5e-77220c37d6b4, id=117, and version=0 to the Start <--> Powered On to Kernel Resume Complete: Duration-Based Start, subtract the duration * 1000000 found in payload field "TotalResumeTime" of event provider=331c3b3a-2005-44c2-ac5e-77220c37d6b4, id=117, and version=0 from the Stop Event-Based stop with provider=331c3b3a-2005-44c2-ac5e-77220c37d6b4, id=117, and version=0 <--> Hibernate Resume: Children: Main Path Resume Console Session Disconnect Begin Hibernate Resume Container <--> Main Path Resume: Children: Boot Manager Hiberfile Read Resume Devices Resume Components Winlogon Resume Begin Main Path Resume Container <--> Boot Manager: Region-Based Start based off the stop of region: 99EB5E4B-0338-4e25-9ECC-846767A9EA5C (BIOS Initialization) Duration-Based Stop, add the duration * 1000000 found in payload field "ResumeBootMgrTime" of event provider=331c3b3a-2005-44c2-ac5e-77220c37d6b4, id=117, and version=0 to the Start <--> Hiberfile Read: Children: Resume Application Begin Hiberfile Read Container <--> Resume Application: Region-Based Start based off the stop of region: d8d639a0-cf4c-45fb-976a-000002002000 (Boot Manager) Duration-Based Stop, add the duration * 1000000 found in payload field "ResumeAppTime" of event provider=331c3b3a-2005-44c2-ac5e-77220c37d6b4, id=117, and version=0 to the Start <--> Kernel Hiberfile Read: Region-Based Start based off the stop of region: d8d639a0-cf4c-45fb-976a-000003002000 (Resume Application) Duration-Based Stop, add the duration * 1000000 found in payload field "KernelResumeHiberFileTime" of event provider=331c3b3a-2005-44c2-ac5e-77220c37d6b4, id=117, and version=0 to the Start <--> End Hiberfile Read <--> Resume Devices: Event-Based Start with provider=331c3b3a-2005-44c2-ac5e-77220c37d6b4, id=37, and version=0 Event-Based Stop with provider=331c3b3a-2005-44c2-ac5e-77220c37d6b4, id=38, and version=0 Additionally, only match start to stop if the PIDs are the same. Children: Resume Device Begin Resume Devices <--> Resume Device: Event-Based Start with provider=331c3b3a-2005-44c2-ac5e-77220c37d6b4, id=7, version=1, MinorFunction=2, PowerStateType=0 Event-Based Stop with provider=331c3b3a-2005-44c2-ac5e-77220c37d6b4, id=8, and version=0 Additionally, only match start to stop if the field "Irp" is the same. Instance based off payload field called "InstanceName" in the start event. This is of type Device and will have a device description, name, and ID associated with it. <--> End Resume Devices <--> Resume Components: Event-Based Start with provider=331c3b3a-2005-44c2-ac5e-77220c37d6b4, id=38, and version=0 Event-Based Stop with provider=331c3b3a-2005-44c2-ac5e-77220c37d6b4, id=2, and version=0 <--> Winlogon Resume: Children: LogonUI Server Shutdown Request Credentials Authenticate User Prepare Themes Notify DWM Notify Themes Check License Restore Connections Begin Winlogon Resume <--> LogonUI Server Shutdown: Event-Based Start with provider=dbe9b383-7cf3-4331-91cc-a3cb16a3b538, id=503, and version=0 Event-Based Stop with provider=dbe9b383-7cf3-4331-91cc-a3cb16a3b538, id=504, and version=0 Additionally, only match start to stop if the PIDs are the same. <--> Request Credentials: Event-Based Start with provider=dbe9b383-7cf3-4331-91cc-a3cb16a3b538, id=203, and version=0 Event-Based Stop with provider=dbe9b383-7cf3-4331-91cc-a3cb16a3b538, id=204, and version=0 Additionally, only match start to stop if the PIDs are the same. <--> Authenticate User: Event-Based Start with provider=dbe9b383-7cf3-4331-91cc-a3cb16a3b538, id=1, and version=0 Event-Based Stop with provider=dbe9b383-7cf3-4331-91cc-a3cb16a3b538, id=2, and version=0 Additionally, only match start to stop if the PIDs are the same. <--> Prepare Themes: Event-Based Start with provider=dbe9b383-7cf3-4331-91cc-a3cb16a3b538, id=11, and version=0 Event-Based Stop with provider=dbe9b383-7cf3-4331-91cc-a3cb16a3b538, id=12, and version=0 Additionally, only match start to stop if the PIDs are the same. <--> Notify DWM: Event-Based Start with provider=dbe9b383-7cf3-4331-91cc-a3cb16a3b538, id=67, and version=0 Event-Based Stop with provider=dbe9b383-7cf3-4331-91cc-a3cb16a3b538, id=68, and version=0 Additionally, only match start to stop if the PIDs are the same. <--> Notify Themes: Event-Based Start with provider=dbe9b383-7cf3-4331-91cc-a3cb16a3b538, id=13, and version=0 Event-Based Stop with provider=dbe9b383-7cf3-4331-91cc-a3cb16a3b538, id=14, and version=0 Additionally, only match start to stop if the PIDs are the same. <--> Check License: Event-Based Start with provider=dbe9b383-7cf3-4331-91cc-a3cb16a3b538, id=5, and version=0 Event-Based Stop with provider=dbe9b383-7cf3-4331-91cc-a3cb16a3b538, id=6, and version=0 Additionally, only match start to stop if the PIDs are the same. <--> Restore Network Connections Event-Based Start with provider=dbe9b383-7cf3-4331-91cc-a3cb16a3b538, id=7, and version=0 Event-Based Stop with provider=dbe9b383-7cf3-4331-91cc-a3cb16a3b538, id=8, and version=0 Additionally, only match start to stop if the PIDs are the same. <--> End Main Path Resume <--> End Winlogon Resume <--> Post On/Off Event-Based Start with Provider="{030F2F57-ABD0-4427-BCF1-3A3587D7DC7D}" Id="1102", and version=0 Event-Based Stop with Provider="{030F2F57-ABD0-4427-BCF1-3A3587D7DC7D}" Id="1103", and version=0 Additionally, only match start to stop if the PIDs are the same. <--> Console Session Disconnect Event-Based Start with provider=dbe9b383-7cf3-4331-91cc-a3cb16a3b538, id=801 version=0, and Event=8 Event-Based Stop with provider=dbe9b383-7cf3-4331-91cc-a3cb16a3b538, id=802 version=0, and Event=8 Additionally, only match start to stop if the PIDs are the same. <-->