<?xml version='1.0' encoding='utf-8' standalone='yes'?>
<?Copyright (c) Microsoft Corporation. All rights reserved.?>
<instrumentationManifest>
  <instrumentation>
    <intervals>
      <interval guid="{d8d639a0-cf4c-45fb-976a-000000000900}" name="Shutdown-Overall-Time" friendlyname="Full Shutdown">
        <metadata>
          <ValidateInterval.PerformValidation>yes</ValidateInterval.PerformValidation>
        </metadata>

        <interval guid="{d8d639a0-cf4c-45fb-976a-000000000220}" key="$ProcessId" name="Shutdown-UserSessionShutdown" friendlyname="User Session Shutdown">
          <event provider="{206f6dea-d3c5-4d10-bc72-989f03c8b84b}" type="start" value="1" version="0"/>
          <event provider="{206f6dea-d3c5-4d10-bc72-989f03c8b84b}" type="stop" value="2" version="0"/>
          <metadata>
            <ValidateInterval.Required>yes</ValidateInterval.Required>
          </metadata>
        </interval>

        <interval guid="{d8d639a0-cf4c-45fb-976a-000000000300}" key="$ProcessId" name="Shutdown-ShutdownProcesses-Phase" friendlyname="Shutdown Processes">
          <event provider="{e8316a2d-0d94-4f52-85dd-1e15b66c5891}" type="start" value="1" version="0"/>
          <event provider="{e8316a2d-0d94-4f52-85dd-1e15b66c5891}" type="stop" value="2" version="0"/>
          <metadata>
            <ValidateInterval.Required>yes</ValidateInterval.Required>
          </metadata>

          <interval guid="{d8d639a0-0000-0000-0000-000000000301}" key="ProcessId" instance="ProcessId" instancetype="pid" name="Shutdown-ShutdownProcesses-Process" friendlyname="Shutdown Process">
            <event provider="{9d55b53d-449b-4824-a637-24f9d69aa02f}" type="start" value="12009" version="1"/>
            <event provider="{9d55b53d-449b-4824-a637-24f9d69aa02f}" type="stop" value="12010" version="1"/>
          </interval>
        </interval>
        
        <interval guid="{d8d639a0-cf4c-45fb-976a-000000000100}" name="Shutdown-Winlogon-Phase" friendlyname="Winlogon Shutdown">
          <metadata>
            <ValidateInterval.Required>yes</ValidateInterval.Required>
          </metadata>
          
          <interval guid="{d8d639a0-0000-0000-0000-000000000101}" key="$ProcessId" name="Shutdown-Winlogon-NotifyExecute" friendlyname="Winlogon Notify Execute">
            <event provider="{dbe9b383-7cf3-4331-91cc-a3cb16a3b538}" type="start" value="801" version="0"/>
            <event provider="{dbe9b383-7cf3-4331-91cc-a3cb16a3b538}" type="stop" value="802" version="0"/>
            
            <interval guid="{d8d639a0-0000-0000-0000-000000000102}" key="$ProcessId" instance="SubscriberName" name="Shutdown-Winlogon-NotifySubscriber" friendlyname="Notify Subscriber">
              <event provider="{dbe9b383-7cf3-4331-91cc-a3cb16a3b538}" type="start" value="805" version="0"/>
              <event provider="{dbe9b383-7cf3-4331-91cc-a3cb16a3b538}" type="stop" value="806" version="0"/>
              
              <interval guid="{d8d639a0-0000-0000-0000-000000000103}" key="$ProcessId" instance="SubscriberName" name="Shutdown-Winlogon-ConnectToSubscriber" friendlyname="Connect to Subscriber">
                <event provider="{dbe9b383-7cf3-4331-91cc-a3cb16a3b538}" type="start" value="809" version="0"/>
                <event provider="{dbe9b383-7cf3-4331-91cc-a3cb16a3b538}" type="stop" value="810" version="0"/>
              </interval>
              
              <interval guid="{d8d639a0-0000-0000-0000-000000000104}" key="$ProcessId" instance="SubscriberName" name="Shutdown-Winlogon-CallSubscriber" friendlyname="Call Subscriber">
                <event provider="{dbe9b383-7cf3-4331-91cc-a3cb16a3b538}" type="start" value="811" version="0"/>
                <event provider="{dbe9b383-7cf3-4331-91cc-a3cb16a3b538}" type="stop" value="812" version="0"/>
              </interval>
            </interval>
            
          </interval> <!-- End of Winlogon NotifyExecute-->
        </interval> <!-- End of Winlogon Shutdown -->

        <interval guid="{d8d639a0-0000-0000-0000-000000000310}" key="$ProcessId" name="Shutdown-PreShutdownNotification-Phase" friendlyname="Pre-Shutdown Notification">
          <event provider="{206f6dea-d3c5-4d10-bc72-989f03c8b84b}" type="start" value="3" version="0"/>
          <event provider="{206f6dea-d3c5-4d10-bc72-989f03c8b84b}" type="stop" value="4" version="0"/>
          <metadata>
            <ValidateInterval.Required>yes</ValidateInterval.Required>
          </metadata>
        </interval>

        <interval guid="{d8d639a0-cf4c-45fb-976a-000000000200}" key="$ProcessId" name="Shutdown-ShutdownWindows-SystemSession" friendlyname="System Session Shutdown">
          <event provider="{206f6dea-d3c5-4d10-bc72-989f03c8b84b}" type="start" value="9" version="0"/>
          <event provider="{206f6dea-d3c5-4d10-bc72-989f03c8b84b}" type="stop" value="10" version="0"/>
          <metadata>
            <ValidateInterval.Required>yes</ValidateInterval.Required>
          </metadata>
        </interval>

        <interval guid="{d8d639a0-cf4c-45fb-976a-000000000320}" name="Shutdown-ShutdownServices-Phase" friendlyname="Shutdown Services">
          <metadata>
            <ValidateInterval.Required>yes</ValidateInterval.Required>
          </metadata>
          
          <interval guid="{d8d639a0-cf4c-45fb-976a-000000000321}" key="ServiceName" instance="ServiceName" name="Shutdown-ShutdownServices-Service" friendlyname="Shutdown Service">
            <event provider="{0063715b-eeda-4007-9429-ad526f62696e}" type="start" value="105" version="0" filter="CurrentState=4,ExecutionPhase=3"/>
            <event provider="{0063715b-eeda-4007-9429-ad526f62696e}" type="stop" value="105" version="0" filter="CurrentState=1"/>
          </interval>
        </interval>

        <interval guid="{d8d639a0-cf4c-45fb-976a-000000000330}" name="Shutdown-SystemShutdown-Phase" friendlyname="Shutdown System">
          <intlink type="start" interval="{d8d639a0-cf4c-45fb-976a-000000000200}"/>
          <marker type="endoftrace"/>
          <metadata>
            <ValidateInterval.Required>yes</ValidateInterval.Required>
          </metadata>

          <interval guid="{d8d639a0-cf4c-45fb-976a-000000000331}" key="$Global" name="Shutdown-NtShutdownSystem" friendlyname="NT Shutdown System">
            <event provider="{206f6dea-d3c5-4d10-bc72-989f03c8b84b}" type="start" value="8" version="0"/>
            <event provider="{206f6dea-d3c5-4d10-bc72-989f03c8b84b}" type="stop" value="51" version="0"/>
          </interval>
          
          <interval guid="{d8d639a0-cf4c-45fb-976a-000000000333}" key="$ProcessId" name="Shutdown-FlushVolumes" friendlyname="Flush Storage Volumes">
            <event provider="{331c3b3a-2005-44c2-ac5e-77220c37d6b4}" type="start" value="45" version="0"/>
            <event provider="{331c3b3a-2005-44c2-ac5e-77220c37d6b4}" type="stop" value="46" version="0"/>
            <metadata>
              <ValidateInterval.Required>yes</ValidateInterval.Required>
            </metadata>
          </interval>
          
          <interval guid="{d8d639a0-cf4c-45fb-976a-000000000335}" key="$ProcessId" name="Shutdown-ZeroPageFile" friendlyname="Zero Page File">
            <event provider="{331c3b3a-2005-44c2-ac5e-77220c37d6b4}" type="start" value="49" version="0"/>
            <event provider="{331c3b3a-2005-44c2-ac5e-77220c37d6b4}" type="stop" value="50" version="0"/>
          </interval>
          
          <interval guid="{d8d639a0-cf4c-45fb-976a-000000000337}" key="$ProcessId" name="Shutdown-IOShutdownSystem" friendlyname="IO Shutdown System">
            <event provider="{331c3b3a-2005-44c2-ac5e-77220c37d6b4}" type="start" value="51" version="0"/>
            <event provider="{331c3b3a-2005-44c2-ac5e-77220c37d6b4}" type="stop" value="52" version="0"/>
          </interval>
          
          <interval guid="{d8d639a0-cf4c-45fb-976a-000000000339}" key="$ProcessId" name="Shutdown-CmShutdownSystem" friendlyname="CM Shutdown System">
            <event provider="{331c3b3a-2005-44c2-ac5e-77220c37d6b4}" type="start" value="55" version="0"/>
            <event provider="{331c3b3a-2005-44c2-ac5e-77220c37d6b4}" type="stop" value="56" version="0"/>
          </interval>
        </interval> <!-- End of Shutdown System -->
       
      </interval>
    </intervals>
  </instrumentation>
</instrumentationManifest>