Standby: Begin Root Container <--> Standby Suspend: Children: SuspendProcesses <--> Suspend Processes: Event-Based Start with provider=31c3b3a-2005-44c2-ac5e-77220c37d6b4, id=22, and version=0 Event-Based Stop with provider=31c3b3a-2005-44c2-ac5e-77220c37d6b4, id=23, and version=0 Additionally, only match start to stop if the PIDs are the same. Children: Suspend Process <--> Suspend Process Event-Based Start with provider=331c3b3a-2005-44c2-ac5e-77220c37d6b4, id=16, and version=1 Event-Based Stop with provider=331c3b3a-2005-44c2-ac5e-77220c37d6b4, id=17, and version=1 Additionally, only match start to stop if the field "Pid" is the same. Instance based off payload field called "Pid" In the start event. This field is of type PID and will have a proces name associated with it as well as ID. <--> End Suspend Processes <--> Suspend Services: Event-Based Start with provider=31c3b3a-2005-44c2-ac5e-77220c37d6b4, id=24, and version=0 Event-Based Stop with provider=31c3b3a-2005-44c2-ac5e-77220c37d6b4, id=25, and version=0 Additionally, only match start to stop if the PIDs are the same. Children: Suspend Service <--> Suspend Service Event-Based Start with provider=331c3b3a-2005-44c2-ac5e-77220c37d6b4, id=18, and version=1 Event-Based Stop with provider=331c3b3a-2005-44c2-ac5e-77220c37d6b4, id=19, and version=1 Additionally, only match start to stop if the field "Name" is the same. Instance based off payload field called "Name" in the start event. <--> End Suspend Services <--> Superfetch Prepare Memory Event-Based Start with provider=331c3b3a-2005-44c2-ac5e-77220c37d6b4, id=64, and version=0 Event-Based Stop with provider=331c3b3a-2005-44c2-ac5e-77220c37d6b4, id=65, and version=0 Additionally, only match start to stop if the PIDs are the same. <--> Pre-Sleep Callbacks Event-Based Start with provider=331c3b3a-2005-44c2-ac5e-77220c37d6b4, id=68, and version=0 Event-Based Stop with provider=331c3b3a-2005-44c2-ac5e-77220c37d6b4, id=69, and version=0 Additionally, only match start to stop if the PIDs are the same. <--> Worker Threads Swap-In Event-Based Start with provider=331c3b3a-2005-44c2-ac5e-77220c37d6b4, id=69, and version=0 Event-Based Stop with provider=331c3b3a-2005-44c2-ac5e-77220c37d6b4, id=35, version=0, and Query="true" Additionally, only match start to stop if the PIDs are the same. <--> Flush Storage Volumes Event-Based Start with provider=331c3b3a-2005-44c2-ac5e-77220c37d6b4, id=36, and version=0 Event-Based Stop with provider=331c3b3a-2005-44c2-ac5e-77220c37d6b4, id=35, version=0, and Query="false" Additionally, only match start to stop if the PIDs are the same. <--> Query Devices: Event-Based Start with provider=331c3b3a-2005-44c2-ac5e-77220c37d6b4, id=35, version=0 and Query="true" Event-Based Stop with provider=331c3b3a-2005-44c2-ac5e-77220c37d6b4, id=36, and version=0 Additionally, only match start to stop if the PIDs are the same. Children: Query Device <--> Query Device: Event-Based Start with provider=331c3b3a-2005-44c2-ac5e-77220c37d6b4, id=7, version=1, MinorFunction="3" and PowerStateType="0" Event-Based Stop with provider=331c3b3a-2005-44c2-ac5e-77220c37d6b4, id=8, and version=0 Additionally, only match start to stop if the field "Irp" is the same. Instance based off payload field called "InstanceName" in the start event. This is of type Device and will have a device description, name, and ID associated with it. <--> End Query Devices <--> Suspend Devices: Event-Based Start with provider=331c3b3a-2005-44c2-ac5e-77220c37d6b4, id=35, version=0 and Query="false" Event-Based Stop with provider=331c3b3a-2005-44c2-ac5e-77220c37d6b4, id=36, and version=0 Additionally, only match start to stop if the PIDs are the same. Children: Suspend Device <--> Suspend Device: Event-Based Start with provider=331c3b3a-2005-44c2-ac5e-77220c37d6b4, id=7, version=1, MinorFunction="2" and PowerStateType="0" Event-Based Stop with provider=331c3b3a-2005-44c2-ac5e-77220c37d6b4, id=8, and version=0 Additionally, only match start to stop if the field "Irp" is the same. Instance based off payload field called "InstanceName" in the start event. This is of type Device and will have a device description, name, and ID associated with it. <--> End Supend Devices <--> User Session Shutdown: Event-Based Start with provider=dbe9b383-7cf3-4331-91cc-a3cb16a3b538, id=301, and version=0 Event-Based Stop with provider=dbe9b383-7cf3-4331-91cc-a3cb16a3b538, id=201, version=0 <--> Total Hiberfile Write [Hybrid Sleep]: Children: Hiberfile Initialization [Hybrid Sleep] Hiberfile Write [Hybrid Sleep] Begin Container <--> Hiberfile Initialization [Hybrid Sleep]: Region-Based Start based off the stop of region: d8d639a0-cf4c-45fb-976a-00000000000c (Suspend Devices) Duration-Based Stop, add the duration * 1000000 found in payload field "InitTime" of event provider=331c3b3a-2005-44c2-ac5e-77220c37d6b4, id=117, and version=0 from the Start. <--> Hiberfile Write [Hybrid Sleep]: Region-Based Start based off the stop of region: A384ECC4-1F9A-4b12-9965-21531C725618 (Hiberfile Initialization [Hybrid Sleep]) Duration-Based Stop, add the duration * 1000000 found in payload field "HiberHiberFileTime" of event provider=331c3b3a-2005-44c2-ac5e-77220c37d6b4, id=117, and version=0 from the Start. <--> End Total Hiberfile Write [Hybrid Sleep] <--> End Standby Suspend <--> Powered Off/Sleeping: Region-Based Start based off the stop of region: D38BE1A3-2A14-436A-9064-6D3E6CB85F88(Standby Suspend) Region-Based Stop based off the start of region: A7BD69A9-C484-4795-B4B6-DD8BEFB4F3F2 (Standby Resume) <--> Standby Resume: Children: Main Path Resume Console Session Disconnect Begin Standby Resume Container <--> Main Path Resume: Children: Resume Devices Winlogon Resume Time to Idle Detection starts Begin Main Path Resume Container <--> Resume Devices: Event-Based Start with provider=331c3b3a-2005-44c2-ac5e-77220c37d6b4, id=37, and version=0 Event-Based Stop with provider=331c3b3a-2005-44c2-ac5e-77220c37d6b4, id=38, and version=0 Additionally, only match start to stop if the PIDs are the same. Children: Resume Device Begin Resume Devices <--> Resume Device: Event-Based Start with provider=331c3b3a-2005-44c2-ac5e-77220c37d6b4, id=7, version=1, MinorFunction=2, PowerStateType=0 Event-Based Stop with provider=331c3b3a-2005-44c2-ac5e-77220c37d6b4, id=8, and version=0 Additionally, only match start to stop if the field "Irp" is the same. Instance based off payload field called "InstanceName" in the start event. This is of type Device and will have a device description, name, and ID associated with it. <--> End Resume Devices <--> Winlogon Resume: Event-Based Start with provider=dbe9b383-7cf3-4331-91cc-a3cb16a3b538, id=202, and version=0 Event-Based Stop with provider=dbe9b383-7cf3-4331-91cc-a3cb16a3b538, id=10, and version=0 Additionally, only match start to stop if the PIDs are the same. Children: Request Credentials Authenticate User Prepare Themes Notify DWM Notify Themes Check License Restore Network Connections Logon Start Shell Begin Winlogon Resume <--> Request Credentials: Event-Based Start with provider=dbe9b383-7cf3-4331-91cc-a3cb16a3b538, id=203, and version=0 Event-Based Stop with provider=dbe9b383-7cf3-4331-91cc-a3cb16a3b538, id=204, and version=0 Additionally, only match start to stop if the PIDs are the same. <--> Authenticate User: Event-Based Start with provider=dbe9b383-7cf3-4331-91cc-a3cb16a3b538, id=1, and version=0 Event-Based Stop with provider=dbe9b383-7cf3-4331-91cc-a3cb16a3b538, id=2, and version=0 Additionally, only match start to stop if the PIDs are the same. <--> Prepare Themes: Event-Based Start with provider=dbe9b383-7cf3-4331-91cc-a3cb16a3b538, id=11, and version=0 Event-Based Stop with provider=dbe9b383-7cf3-4331-91cc-a3cb16a3b538, id=12, and version=0 Additionally, only match start to stop if the PIDs are the same. <--> Notify DWM: Event-Based Start with provider=dbe9b383-7cf3-4331-91cc-a3cb16a3b538, id=67, and version=0 Event-Based Stop with provider=dbe9b383-7cf3-4331-91cc-a3cb16a3b538, id=68, and version=0 Additionally, only match start to stop if the PIDs are the same. <--> Notify Themes: Event-Based Start with provider=dbe9b383-7cf3-4331-91cc-a3cb16a3b538, id=13, and version=0 Event-Based Stop with provider=dbe9b383-7cf3-4331-91cc-a3cb16a3b538, id=14, and version=0 Additionally, only match start to stop if the PIDs are the same. <--> Check License: Event-Based Start with provider=dbe9b383-7cf3-4331-91cc-a3cb16a3b538, id=5, and version=0 Event-Based Stop with provider=dbe9b383-7cf3-4331-91cc-a3cb16a3b538, id=6, and version=0 Additionally, only match start to stop if the PIDs are the same. <--> Restore Connections Event-Based Start with provider=dbe9b383-7cf3-4331-91cc-a3cb16a3b538, id=7, and version=0 Event-Based Stop with provider=dbe9b383-7cf3-4331-91cc-a3cb16a3b538, id=8, and version=0 Additionally, only match start to stop if the PIDs are the same. <--> Explorer Initialization Event-Based Start with provider=dbe9b383-7cf3-4331-91cc-a3cb16a3b538, id=9, and version=0 Event-Based Stop with provider=30336ed4-e327-447c-9de0-51b652c86108, id=27231, and version=0 Additionally, only match start to stop if the PIDs are the same. <--> End Winlogon Resume <--> Time to Idle Detection starts: Region-Based Start based off the stop of region: 9964C11C-574E-4497-B7F8-15A9E6A53265 Event-Based Stop with provider=331C3B3A-2005-44C2-AC5E-77220C37D6B4, id=121, and version=0 This region is a temperory one until we get the Idle Detection start changed to begin when the Standby process is done <--> UNSUPPORTED REGION: In future versions, this will contain the following region: Post On/Off Region-Based Start based off the stop of region: 9964C11C-574E-4497-B7F8-15A9E6A53265 (Main Path Resume) Idle-Based Stop based after we detect idle for 5000 ms Additionally, only match start to stop if the PIDs are the same. <--> End Main Path Resume <--> Console Session Disconnect Event-Based Start with provider=dbe9b383-7cf3-4331-91cc-a3cb16a3b538, id=801 version=0, and Event=8 Event-Based Stop with provider=dbe9b383-7cf3-4331-91cc-a3cb16a3b538, id=802 version=0, and Event=8 Additionally, only match start to stop if the PIDs are the same. <--> End Standby Resume <--> Post On/Off Event-Based Start with Provider="{030F2F57-ABD0-4427-BCF1-3A3587D7DC7D}" Id="1102", and version=0 Event-Based Stop with Provider="{030F2F57-ABD0-4427-BCF1-3A3587D7DC7D}" Id="1103", and version=0 Additionally, only match start to stop if the PIDs are the same. <-->