KGRKJGETMRETU895U-589TY5MIGM5JGB5SDFESFREWTGR54TY
Server : Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12
System : Windows NT SERVER-PC 10.0 build 26200 (Windows 11) AMD64
User : ServerPC ( 0)
PHP Version : 8.2.12
Disable Function : NONE
Directory :  C:/Windows/System32/

Upload File :
current_dir [ Writeable ] document_root [ Writeable ]

 

Current File : C:/Windows/System32/ntfsres.dll
MZ����@���	�!�L�!This program cannot be run in DOS mode.

$A[=�:S�:S�:S�|���:S�|�Q�:S�Rich:S�PEd��5��" &��


���` �hT.rdata@@.rsrc�h p @@�5�
lll�5�$���5�����T.rdataT.rdata$voltmdl�.rdata$zzzdbg .rsrc$01!�g.rsrc$02 y�ǩ�m!}8��d�|`d����_X�Z��5���(�@�X�p�����	�	�	������$$�!�
WEVT_TEMPLATE�4VS_VERSION_INFO��
��e
��e?StringFileInfo�040904B0LCompanyNameMicrosoft Corporationh FileDescriptionNT File System Driver Resourcesn'FileVersion10.0.26100.6899 (WinBuild.160101.0800)8InternalNamentfsres.dll�.LegalCopyright� Microsoft Corporation. All rights reserved.@OriginalFilenamentfsres.dllj%ProductNameMicrosoft� Windows� Operating SystemDProductVersion10.0.26100.6899DVarFileInfo$Translation	�#PP�
��(�C��E�G�\=I�J�`@L�R�BT�y��H{�|�\f~���$i����@k���������������(�����	����
��|��y��{�}�����\�����\�����@����������������
����� �N��P�P��LR�g� Mi�k�D\m�x��]z����e����|u��������ԨCritical

Error

Warning

 Information

Verbose

�NtfsLookupRealAllocation: Vcn %1!I64x!, LowestVcn %2!I64x!, HighestVcn %3!I64x!, AllocationClusters %4!I64x!

�NtfsAllocateAttribute MaxAlloc for Mft's AttrList IC:%1!p!, Scb:%2!p!

�FileObject: %1!p!, Scb: %2!p!, StaringVcn: %3!I64x!, ClusterCount: %4!I64x!, Flags: %5!08x!, CcbForWriteExtend: %6!p!

 NtfsAddAllocation IC:%1!p!, FileObject:%2!p!, Scb:%3!p!, StaringVcn:%4!I64x!, ClusterCount:%5!I64x!, Flags:%6!08x!, CcbForWriteExtend:%7!p!

tPurge failed: Scb: %1!p!, PurgeOffset: 0x%2!016I64x!

�Purge failed: Scb: %1!p!, PurgeOffset: 0x%2!016I64x!, PurgeChunkLength: 0x%3!x!

�NtfsGetLastVcnForNewMappingPairSize IC:%1!p!, Using LastVcn:%2!4I64x!, InstanceId:%3!x!

XCan't find StdInfo in FileRef %1!I64x!

�NtfsCreateNonresidentWithValue Create Mft's NonResident Attribute List IC:%1!p!ValueLength:%2!x!, AttrFlags=%3!x!

NtfsAddAttributeAllocation(%1!p!,%2!p!): Scb %3!p!, FileRef %4!I64x!, LastVcn %5!I64x!, NewHighestVcn %6!I64x!, PassCount %7!x! - step 6

DNtfsAddAttributeAllocation(%1!p!,%2!p!): Scb %3!p!, FileRef %4!I64x!, LowestVcn %5!I64x!, HighestVcn %6!I64x!, ALE.LowestVcn %7!I64x! - try to merge backward

DNtfsAddAttributeAllocation(%1!p!,%2!p!): Scb %3!p!, FileRef %4!I64x!, LowestVcn %5!I64x!, HighestVcn %6!I64x!, ALE.LowestVcn %7!I64x! - after merge backward

xNtfsAddAttributeAllocation(%1!p!,%2!p!): Scb %3!p!, FileRef %4!I64x!, LowestVcn %5!I64x!, HighestVcn %6!I64x!, ALE.LowestVcn %7!I64x!, PassCount %8!x! - before last merge after step 6

TNtfsAddAttributeAllocation(%1!p!,%2!p!): Scb %3!p!, FileRef %4!I64x!, LowestVcn %5!I64x!, HighestVcn %6!I64x!, ALE.LowestVcn %7!I64x! - after last merge after step 6

�NtfsAddAttributeAllocation(%1!p!,%2!p!): Scb %3!p!, FileRef %4!I64x!, MergeSkipCt %5!x! - done

�NtfsRestartRemoveAttribute FileRef:0x%1!04x!_%2!08x!, BaseFRS:0x%3!012I64x!, Attrib:0x%4!x!

�NtfsRestartChangeValue FileRef:0x%1!04x!_%2!08x!, BaseFRS:0x%3!012I64x!, Attrib:0x%4!x!

�AddToAttributeList(%1!p!,%2!p!): FRef %3!I64x!, OldSig %4!x!, OldLCS %5!x!, NewLCS %6!x!

�DeleteFromAttributeList(%1!p!,%2!p!): FRef %3!I64x!, OldSig %4!x!, OldLCS %5!x!, NewLCS %6!x!

MakeRoomForAttribute Moving Mft's attribute IC:%1!p!, Moving Attrib %2!x!/%3!x!, Type=%4!x!, RecLengh=%5!x!, Instance:%6!x!

MoveAttributeToOwnRecord Moving Mft's $BITMAP IC:%1!p!, SizeNeeded:%2!x!, TypeCode:%3!x!, RecLen:%4!x!, Form:%5!x!, Instance:%6!x!

�MoveAttributeToOwnRecord IC:%1!p!, SizeNeeded:%2!x!, Bytes2Free:%3!x!, OldMappingSize:%4!x!, NewMappingSize:%5!x!

�NtfsRestartZeroEndOfFileRecord FileRef:0x%1!04x!_%2!08x!, BaseFRS:0x%3!012I64x!, Start:0x%4!x!, Len:0x%5!x!

�MergeFRS2(%1!p!,%2!p!): Scb %3!p!, FileRef %4!I64x!, TypeCode %5!x!, AttrName %6!S!, LowVcn %7!I64x!, HalfWayVcn %8!I64x!, FinalVcn %9!I64x!, PackedMode %10!x!, TryPrior %11!x! - about to merge

�MergeFRS2(%1!p!,%2!p!): Scb %3!p!, FileRef %4!I64x!, TypeCode %5!x!, AttrName %6!S!, DeleteFileRef %7!x!0000%8!08x!, LowVcn %9!I64x!, LastVcn %10!I64x!, FinalVcn %11!I64x! - all fit in one so get rid of the second one

�MergeFRS2(%1!p!,%2!p!): Scb %3!p!, FileRef %4!I64x!, TypeCode %5!x!, AttrName %6!S!, DeleteFileRef %7!x!0000%8!08x!, LowVcn %9!I64x!, LastVcn %10!I64x!, FinalVcn %11!I64x! - should all fit into one so get rid of the second one FIRST

�MergeFRS2(%1!p!,%2!p!): Scb %3!p!, FileRef %4!I64x!, Vcn %5!I64x! - initial RangePtr query

�MergeFRS2(%1!p!,%2!p!): Scb %3!p!, FileRef %4!I64x!, Vcn %5!I64x!, Rptr %6!p! - secondary RangePtr query

�MergeFRS2(%1!p!,%2!p!): Scb %3!p!, FileRef %4!I64x!, Vcn %5!I64x!, Rptr %6!p! - calling lookup runs range

�MergeFRS2(%1!p!,%2!p!): Scb %3!p!, FileRef %4!I64x!, McbArray %5!p! (%6!I64x!, %7!I64x!) - current McbArray

�MergeFRS2(%1!p!,%2!p!): Scb %3!p!, FileRef %4!I64x!, McbArray %5!p! (%6!I64x!, %7!I64x!) - previous McbArray

�MergeFRS2(%1!p!,%2!p!): Scb %3!p!, FileRef %4!I64x!, McbArray %5!p! (%6!I64x!, %7!I64x!) - prev prev McbArray

�MergeFRS2(%1!p!,%2!p!): Scb %3!p!, FileRef %4!I64x!, McbArray %5!p! (%6!I64x!, %7!I64x!) - next McbArray

MergeFRS2(%1!p!,%2!p!): Scb %3!p!, FileRef %4!I64x!, NewFinalVcnInMcb %5!I64x! > NewFinalVcn %6!I64x! - NewFinalVcn is smaller

4MergeFRS2(%1!p!,%2!p!): Scb %3!p!, FileRef %4!I64x!, NewStartVcn %5!I64x!, LastVcn %6!I64x!, NewFinalVcn %7!I64x!, NewFinalVcnInMcb %8!I64x!, #Ranges %9!x!, DeletedNextAttribute %10!x!, Mcb1(%11!x!,%12!x!), Mcb2(%13!x!,%14!x!), McbArraySizeInUseChange %15!d! - final vcn in mcb

�MergeFRS2(%1!p!,%2!p!): Scb %3!p!, FileRef %4!I64x!, StartingVcn %5!I64x!, EndingVcn %6!I64x! - redefined mcb range1

�MergeFRS2(%1!p!,%2!p!): Scb %3!p!, FileRef %4!I64x!, StartingVcn %5!I64x!, EndingVcn %6!I64x! - redefined mcb range2

�RedoAttribute(%1!p!,%2!p!): Scb %3!p!, FileRef %4!I64x!, TypeCode %5!x!, AttrName %6!S!, FileRef %7!I64x!, OldLowVcn %8!I64x!, NewLowVcn %9!I64x!, Instance %10!x! - updating LowestVcn in attribute list entry

�RedoAttribute(%1!p!,%2!p!): Scb %3!p!, FileRef %4!I64x!, TypeCode %5!x!, AttrName %6!S!, OldLowVcn %7!I64x!, NewLowVcn %8!I64x!, OldHighVcn %9!I64x!, NewHighVcn %10!I64x!, ChildRef %11!x!0000%12!08x! - done

�NtfsConsolidateAllFileRecords: Invalid Vcb. Thread: %1!p!.

@NtfsConsolidateAllFileRecords: Volume is locked. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, Volume Id: %5!S!, Vcb State: 0x%6!08x!.

�NtfsConsolidateAllFileRecords(%1!p!,%2!p!): Fcb %3!p!, FileRef %4!I64x!, FirstRequest %5!x! - opened fcb

�NtfsConsolidateAllFileRecords(%1!p!,%2!p!): Fcb %3!p!, FileRef %4!I64x! - already in progress so get out

�NtfsConsolidateAllFileRecords(%1!p!,%2!p!): Fcb %3!p!, FileRef %4!I64x! - set in progress flag

<NtfsConsolidateAllFileRecords(%1!p!,%2!p!): Fcb %3!p!, FileRef %4!I64x!, RstrTypeCode %5!x!, RstrAttrName %6!S!, RstrVcn %7!I64x!, RstrAttrListEntryOffset %8!x!, AttrListEntryOffset %9!x!, AttrListLength %10!I64x!, AttrListGrowBy %11!x!(%12!d!) - adjust FinalCompactedSizeDeduction

�NtfsConsolidateAllFileRecords(%1!p!,%2!p!): Fcb %3!p!, FileRef %4!I64x!, TypeCode %5!x!, AttrName %6!S!, Vcn %7!I64x!, Instance %8!x!, RstrAttrListEntryOffset %9!x!, AttrListLength %10!I64x! - breaking up 1

�NtfsConsolidateAllFileRecords(%1!p!,%2!p!): Fcb %3!p!, FileRef %4!I64x!, TypeCode %5!x!, AttrName %6!S!, Vcn %7!I64x!, Instance %8!x!, RstrAttrListEntryOffset %9!x!, AttrListLength %10!I64x! - breaking up 2

�NtfsConsolidateAllFileRecords(%1!p!,%2!p!): Fcb %3!p!, FileRef %4!I64x!, Scb %5!p! - completed this Scb

�NtfsConsolidateAllFileRecords(%1!p!,%2!p!): Fcb %3!p!, FileRef %4!I64x! - going into finally

�NtfsConsolidateAllFileRecords(%1!p!,%2!p!): FileRef %3!I64x!, Status %4!x! - Abnormal Termination

�NtfsConsolidateAllFileRecords(%1!p!,%2!p!): Fcb %3!p!, FileRef %4!I64x! - decremented close counts

�NtfsConsolidateAllFileRecords(%1!p!,%2!p!): Fcb %3!p!, FileRef %4!I64x! - clearing in progress flag

�NtfsConsolidateAllFileRecords(%1!p!,%2!p!): Fcb %3!p!, FileRef %4!I64x!, ExceptionStatus %5!x!- released

,NtfsConsolidateAllFileRecords(%1!p!,%2!p!): Fcb %3!p!, FileRef %4!I64x!, RemovedFcb %5!x!, AllFlags.FcbAcquired %6!x!, TransId %7!x! - no release

�NtfsConsolidateAllFileRecords(%1!p!,%2!p!): DeltaTime %3!I64d! (ms), TotalTime %4!I64d! (ms)

�UpdateLCS: Vcb %1!p!, IC %2!p!, FRef %3!I64x!, OldSig %4!x!, OldLCS %5!x!, NewLCS %6!x!

�NtfsAllocateClustersPriv IC: %1!p!, Vcb: %2!p!, Scb: %3!p!, Mcb: %4!p!, Vcn: 0x%5!I64x!, Length: 0x%6!I64x!, AllocateAll: %7!S!, TargetLcn: 0x%8!I64x!, PreAllocated: %9!S!, DelayedAllocation: %10!S!

�NtfsAllocateClustersPriv: Incremented TotalAllocated by 0x%1!I64x! clusters, Scb: %2!p!, TotalAllocated: 0x%3!I64x!

�NtfsAllocateClustersPriv: Skipped incrementing TotalAllocated by 0x%1!I64x! clusters, Scb: %2!p!, TotalAllocated: 0x%3!I64x!ScbState: %4!08x!, IrpContextState2: %5!08x!, AllocateWithNoHole: %6!d!

�NtfsAllocateClustersPriv IC: %1!p!, ClustersAllocated: %2!S!

�NtfsDeallocateClusters IC: %1!p!, Vcb: %2!p!, Scb: %3!p!, Mcb: %4!p!, StartVcn: 0x%5!I64x!, EndVcn: 0x%6!I64x!

�NtfsDeallocateClusters: Vcb %1!p! - deleting FR %2!I64x! from clusters %3!I64x! to %4!I64x!

�NtfsDeallocateClusters: Vcb %1!p! - deleting FR %2!I64x! starting at %3!I64x! for %4!I64x! clusters

|NtfsDeallocateClusters: Vcb %1!p! - raising logfile full

�NtfsDeallocateClusters: Vcb %1!p! - adding clusters to DeallocatedClusters: %2!p! ==> Lsn: %3!I64x!, ClusterCount: %4!I64x!, Flags: %5!08x!; Vcb's DeallocatedClustersCount old: %6!I64x! new: %7!I64x!

$NtfsDeallocateClusters: Decremented TotalAllocated by 0x%1!I64x! clusters, Scb: %2!p!, TotalAllocated: 0x%3!I64x!Addr(TotalAllocated): %4!p!

XNtfsDeallocateClusters: Skipped decrementing TotalAllocated by 0x%1!I64x! clusters, Scb: %2!p!Addr(TotalAllocated): %3!p!, ScbState: %4!08x!, IrpContextState2: %5!08x!

�NtfsDeallocateClusters: Vcb %1!p! - Undoing some changes to DeallocatedClustersCount from %2!I64x! to %3!I64x!

�NtfsDeallocateClusters IC: %1!p!, ClustersDeallocated: %2!S!

NtfsModifyBitsInBitmap IC: %1!p!, Vcb: %2!p!, FirstBit: 0x%3!I64x!, BeyondLastBit: 0x%4!I64x!, Redo: 0x%5!x!, Undo: 0x%6!x!

�NtfsModifyBitsInBitmap IC: %1!p!, Bitmap: %2!p!, BaseLcn: 0x%3!I64x!, CurrentLcn: 0x%4!I64x!

�NtfsAllocateBitmapRun IC: %1!p!, Vcb: %2!p!, StartingLcn: 0x%3!I64x!, ClusterCount: 0x%4!I64x!

�NtfsAllocateBitmapRun IC: %1!p!, Bitmap: %2!p!, BaseLcn: 0x%3!I64x!, StartingLcn: 0x%4!I64x!

�NtfsRestartSetBitsInBitMap IC: %1!p!, Bitmap: %2!p!, BitMapOffset: 0x%3!08x!, NumBits: 0x%4!08x!

�NtfsFreeBitmapRun IC: %1!p!, Vcb: %2!p!, StartingLcn: 0x%3!I64x!, ClusterCount: 0x%4!I64x!

�NtfsFreeBitmapRun IC: %1!p!, Bitmap: %2!p!, BaseLcn: 0x%3!I64x!, StartingLcn: 0x%4!I64x!

�NtfsRestartClearBitsInBitMap IC: %1!p!, Bitmap: %2!p!, BitMapOffset: 0x%3!08x!, NumBits: 0x%4!08x!

�NtfsSetOrClearBitsUsingBaseMcb IC: %1!p!, Vcb: %2!p!, Bitmap: %3!p!, StartingBitmapLcn: 0x%4!I64x!, SetBits: %5!S!

�NtfsSetOrClearBitsUsingBaseMcb IC: %1!p!, Bitmap: %2!p!, StartLcn: 0x%3!I64x!, EndLcn: 0x%4!I64x!

xNtfsSetOrClearBitsUsingBaseMcb IC: %1!p!, Result: %2!S!

�System files not marked as in use in the MFT bitmap.  DWord offset %1!x!, value %2!x!.

�Length:        0 --> BinIndex :        0    - Unexpected length

Length: %1!8I64d! --> BinIndex : %2!8u!    - Key: %3!u!, BitPosition: %4!ld!, GroupIndex: %5!ld!, GroupShiftFactor: %6!ld!

�Length: %1!8I64d! --> BinIndex : %2!8u!    - BinIndex was beyond TotalBins: %3!u! hence brought down

�BinIndex: %1!8u! --> MaxLength: %2!8I64d!  - BinIndex is set to last bin or beyond, TotalBins: %3!u!

�BinIndex: %1!8u! --> MaxLength: %2!8I64d!  - GroupIndex: %3!ld!, RelativeBinIndex: %4!ld!, MaxKey: %5!u!

�BinGroupShift: %1!8ld!, BinGroupSize: %2!8u!, BinGroupMask: %3!8x!

xBinIndex: %1!8u! --> MaxLength: %2!8I64u! (0x%3!8I64x!)

TSearched committed allocations but didnt find enough free space.  StartingCluster %1!I64x!, ClusterCount %2!I64x!, Committed %3!I64x!, Total %4!I64x!, Free %5!I64x!

�NtfsRemoveClustersFromTPMap: Vcb %1!p! - Clearing TP map bit(s): first bit 0x%2!X!, last bit 0x%3!X!

�NtfsRemoveClustersFromTPMap: Vcb %1!p! - Clearing TP map bit(s): no leading partial slab

NtfsRemoveClustersFromTPMap: Vcb %1!p! - Clearing TP map bit(s): leading partial slab returned - LCN %2!I64X!, len %3!I64X!

�NtfsRemoveClustersFromTPMap: Vcb %1!p! - Clearing TP map bit(s): no trailing partial slab

NtfsRemoveClustersFromTPMap: Vcb %1!p! - Clearing TP map bit(s): trailing partial slab returned - lcn %2!I64X!, len %3!I64X!

�NtfsValidateTotalClustersCommitted(%1!p!,%2!p!): TCC %3!I64x!, TC %4!I64x!, BMSize %5!x!

\Illegal MDL Complete for major code %1!u!

�Entering: Scb: %1!p!, StartingZero: 0x%2!016I64x!, ByteCount: 0x%3!016I64x!, ExtentsDescriptor: %4!p!, ExtentsDescriptorIndex: %5!d!, ExtentsDescriptorStartOffset: 0x%6!016I64x!, Offset: 0x%7!016I64x!, MaxRuns: %8!d!,

 RunEntry ==> %1!4d!: [0x%2!016I64x!, 0x%3!016I64x!], ExtentLength: 0x%4!016I64x!, Offset: 0x%5!016I64x!, RunIndexStartOffset: 0x%6!016I64x!

lOffset is beyond this extent skipping the extent.

�Shrinking LengthInExtent (0x%1!016I64x!) to ByteCount (0x%2!016I64x!) that we have to zero

�Zeroing: StartingPhysicalAddr: 0x%1!016I64x!, LengthInExtent: 0x%2!016I64x!

�Exiting: ExtentsDescriptorIndex: %1!d! ExtentsDescriptorStartOffset: 0x%2!016I64x!

�Entering: Scb: %1!p!, StartingZero: 0x%2!016I64x!, BeyondEndOffset: 0x%3!016I64x!

�Dsm Ranges[%1!d!]: StartingOffset: 0x%2!016I64x!, LengthInBytes: 0x%3!016I64x!

�RemainingClusterCount: 0x%1!I64x!, DataSetRangeIndex: %2!d!

�Dsm: TotalNumberOfRanges: %1!d!, NumberOfRangesReturned: %2!d!

�DsmOut Ranges[%1!d!]: StartingAddress: 0x%2!016I64x!, LengthInBytes: 0x%3!016I64x!

Updating ExtentsDescriptor Index and StartOffset from Locals: ExtentsDescriptorIndex: %1!d!, ExtentsDescriptorStartOffset: 0x%2!016I64x!

�Entering: Scb: %1!p!, StartingZero: 0x%2!016I64x!, BeyondEndOffset: 0x%3!016I64x!, ByteCount: 0x%4!016I64x!, ExtentsDescriptor: %5!p!, ExtentsDescriptorIndex: %6!d!, ExtentsDescriptorStartOffset: 0x%7!016I64x!

�IrpContext: %1!p!; Scb: %2!p!; StartOffset: 0x%3!I64x!; ByteCount: 0x%4!x!

<Return. IrpContext: %1!p!

TUnexpected open type received: %1!u!

tRaising STATUS_SUCCESS from NtfsCommonCleanup: %1!S!

xRaising STATUS_SUCCESS from NtfsCommonCleanup: 0x%1!X!

�Irp: %1!p!, IC: %2!p!, Vcb: %3!p!, FileObject: %4!p!, RelatedFileObject: %5!p!, FileIdBuffer: %6!S!, Options: 0x%7!08x!, FileAttributes: 0x%8!04x!, DesiredAccess: 0x%9!08x!, ShareAccess: 0x%10!04x!, EaLength: 0x%11!08x!

�Irp: %1!p!, IC: %2!p!, Vcb: %3!p!, FileObject: %4!p!, RelatedFileObject: %5!p!, Path: %6!S!, Options: 0x%7!08x!, FileAttributes: 0x%8!04x!, DesiredAccess: 0x%9!08x!, ShareAccess: 0x%10!04x!, EaLength: 0x%11!08x!

�NtfsCommonCreate: Volume is locked. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, Vcb State: %5!x!.

�NtfsCommonVolumeOpen: Invalid create disposition for volume open. Thread: %1!p!, CreateDisposition: 0x%2!x!.

HNtfsCommonVolumeOpen: Volume is locked or we have performed a dismount. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, Vcb State: 0x%5!08x!.

hNtfsCommonVolumeOpen: Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, Requested ShareAccess: 0x%5!08x!, Vcb->CleanupCount: %6!d!, BiasedCleanupCount: %7!d!.

HNtfsCommonVolumeOpen: Volume is locked or we have performed a dismount.Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, Vcb State: 0x%5!08x!.

�NtfsCommonVolumeOpen: Conlicting file objects. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, Requested ShareAccess: 0x%5!08x!, Vcb->ReadOnlyCloseCount: %6!d!, Vcb->CloseCount: %7!d!, Vcb->SystemFileCloseCount: %8!d!.

NtfsHandlePagingFile: Paging file already open, paging files can only be opened once. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, Fcb: %5!p!, FileRef: 0x%6!I64x!, Fcb->CleanupCount: %7!d!, Fcb->FcbState: 0x%8!08x!, IrpSp->Flags: 0x%9!08x!.

�NtfsHandlePagingFile: Cannot open system file as paging file. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, Fcb: %5!p!, FileRef: 0x%6!I64x!, Fcb->FcbState: 0x%7!08x!, IrpSp->Flags: 0x%8!08x!.

�NtfsHandlePagingFile: Persisted paging file already exists. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, Fcb: %5!p!, FileRef: 0x%6!I64x!, IrpContext->State: 0x%7!08x!, IrpSp->Flags: 0x%8!08x!.

�NtfsOpenFcbById: Invalid system file access. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, Fcb: %5!p!, FileRef: 0x%6!I64x!, FcbState: 0x%7!08x!, CreateDisposition: 0x%8!08x!, DesiredAccess: 0x%9!08x!.

�NtfsOpenExistingPrefixFcb: Can not directly open txf directory. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, Fcb: %5!p!, FileRef: 0x%6!I64x!, FileAttributes: 0x%7!08x!, Rmstate: 0x%8!08x!.

�NtfsOpenExistingPrefixFcb: Invalid system file access. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, Fcb: %5!p!, FileRef: 0x%6!I64x!, FcbState: 0x%7!08x!, CreateDisposition: 0x%8!08x!, DesiredAccess: 0x%9!08x!.

�NtfsOpenFile: Unsafe to acquire parent directory after acquiring a txf-system file. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, Fcb: %5!p!, FileRef: 0x%6!I64x!, FcbState: 0x%7!08x!.

�NtfsOpenFile: Invalid system file access. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, Fcb: %5!p!, FileRef: 0x%6!I64x!, FcbState: 0x%7!08x!, CreateDisposition: 0x%8!08x!, DesiredAccess: 0x%9!08x!.

dNtfsOpenFile: Deny open when txf rm is active. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, Fcb: %5!p!, FileRef: 0x%6!I64x!, TxfRmcb Rmstate: 0x%7!08x!.

NtfsCreateNewFile: Deny creation in system directory (except root). Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, (Parent Fcb): Fcb: %5!p!, FileRef: 0x%6!I64x!, FcbState: 0x%7!08x!, TxfRmcb state: 0x%8!08x!, AttrTypeCode: 0x%9!x!.

�NtfsCreateNewFile: Unable to create Ea for the file. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, Fcb: %5!p!, FileRef: 0x%6!I64x!, Create options: 0x%7!08x!, Ccb flags: 0x%8!08x!.

�NtfsCreateNewFile: Unable to create in the $txf directory. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, (Parent Fcb) Fcb: %5!p!, FileRef: 0x%6!I64x!, FcbState: 0x%7!08x!, TxfRmcb state: 0x%8!08x!.

�NtfsOpenSubdirectory: Denying access to $Txf file when the RM is active. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, Fcb: %5!p!, FileRef: 0x%6!I64x!, TxfRmcb state: 0x%7!08x!.

�NtfsOpenAttributeInExistingFile: Denying access due to caller being Ea blind. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, Fcb: %5!p!, FileRef: 0x%6!I64x!, NeedEaCount: %7!d!, CreateOptions: 0x%8!08x!, CcbFlags: 0x%9!08x!.

�NtfsOpenAttributeInExistingFile: Fail to find $INDEX_ROOT attribute. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, Fcb: %5!p!, FileRef: 0x%6!I64x!, AttrTypeCode to create: 0x%7!x!, CreateDisposition: 0x%8!08x!.

�NtfsOpenAttributeInExistingFile: Denying access for volume root directory. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, Fcb: %5!p!, FileRef: 0x%6!I64x!, CreateDisposition: 0x%7!08x!.

�NtfsCreateNewFile: Not allowed to create streams on system files. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, Fcb: %5!p!, FileRef: 0x%6!I64x!, FcbState: 0x%7!08x!, AttrTypeCode: 0x%8!x!.

�NtfsOverwriteAttr: Cannot overwrite hidden or system attribute for a non-paging file. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, Fcb: %5!p!, FileRef: 0x%6!I64x!, DuplicateInfo attributes: 0x%7!08x!, FileAttributes: 0x%8!08x!.

|NtfsOverwriteAttr: Denying access due to user being Ea blind. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, Fcb: %5!p!, FileRef: %6!I64x!, Create options: 0x%7!08x!.

NtfsOverwriteAttr: Deny access due to encryption happening on the stream. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, Fcb: %5!p!, FileRef: 0x%6!I64x!, AttributeTypeCode: 0x%7!x!, Scb state: 0x%8!08x!, Scb HighWaterMark: %9!I64d!.

�NtfsCheckValidAttributeAccess: Supersede or overwrite is not allowed on this type of named attribute. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, AttributeTypeCode: 0x%5!x!, CreateDisposition: 0x%6!08x!.

�NtfsCheckValidAttributeAccess: Only read attributes access is supported on this attribute. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, AttributeTypeCode: 0x%5!x!, DesiredAccess: 0x%6!08x!.

�NtfsCheckValidAttributeAccess: Deny access for protected system attributes. Thread: %1!p!, AttributeTypeCode: %2!x!.

TNtfsOpenAttributeCheck: File already has user writable references. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, Fcb: %5!p!, FileRef: 0x%6!I64x!, Scb: %7!p!, Scb Type Code: 0x%8!x!, Scb Name: %9!S!, Requested ShareAccess: 0x%10!08x!, Previously granted access: 0x%11!08x!.

�NtfsOpenAttributeCheck: Deny access for online encryption backup data stream. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, Fcb: %5!p!, FileRef: 0x%6!I64x!, Scb: %7!p!, AttributeTypeCode: 0x%8!x!, Attribute Name: %9!S!.

 NtfsOpenAttributeCheck: File was granted write access but has image section. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, Fcb: %5!p!, FileRef: 0x%6!I64x!, Scb: %7!p!, Scb Type Code: 0x%8!x!, Scb Name: %9!S!, Previously granted access: 0x%10!08x!.

�NtfsOpenAttribute: Denying write access on disallowed writes. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, Fcb: %5!p!, FileRef: 0x%6!I64x!, Scb: %7!p!, Disallow write count: %8!d!, Desired Access: 0x%9!08x!.

HNtfsOpenAttribute: File already has user writable references. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, Fcb: %5!p!, FileRef: 0x%6!I64x!, Scb: %7!p!, Scb Type Code: 0x%8!x!, Scb Name: %9!S!, Requested ShareAccess: 0x%10!08x!, Previously granted access: 0x%11!08x!.

�NtfsOpenAttribute: Open for exclusive read access is not allowed. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, Fcb: %5!p!, FileRef: 0x%6!I64x!, Requested share access: 0x%7!08x!, FO flags: 0x%8!08x!.

NtfsCheckExistingFile: Desired access conflicts with read-only state. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, Fcb: %5!p!, FileRef: 0x%6!I64x!, Desired Access: 0x%7!08x!, FileAttributes: 0x%8!08x!, SL control flags: 0x%9!08x!.

�NtfsOpenExistingEncryptedStream: No encryption driver found. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, Fcb: %5!p!, FileRef: 0x%6!I64x!, FileAttributes: 0x%7!08x!, NtfsData flags: 0x%8!08x!.

NtfsOpenExistingEncryptedStream: Opening for read/write access not allowed on compressed file. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, Fcb: %5!p!, FileRef: 0x%6!I64x!, FileAttributes: 0x%7!08x!, Stream attribute flags: 0x%8!08x!.

$NtfsEncryptionCreateCallback: Encrytion engine fail to encrypt all streams for file with open handle. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, Fcb: %5!p!, FileRef: 0x%6!I64x!, Fcb cleanup count: %7!d!, EncryptionCallBackTable flags: 0x%8!08x!.

0NtfsFindStartingNode: Opening not allowed for txf name when RM is active. Thread: %1!p!, Fcb: %2!p!, FileRef: 0x%3!I64x!, TxfRmcb RM state: %4!x!.

NtfsCheckShareAccess: IoCheckLinkShareAccess failed with sharing violation. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, Fcb: %5!p!, FileRef: 0x%6!I64x!, Link Name: %7!S!, DesiredAccess: 0x%8!08x!, DesiredShareAccess: 0x%9!08x!, IoShareAccessFlags: 0x%10!08x!, LinkShareAccess->OpenCount: %11!d!, LinkShareAccess->Deleters: %12!d!, LinkShareAccess->SharedDelete: %13!d!.

4NtfsCheckShareAccess: IoCheckLinkShareAccess failed with sharing violation. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, Fcb: %5!p!, FileRef: 0x%6!I64x!, Scb Type Code: 0x%7!x!, Scb Name: %8!S!, DesiredAccess: 0x%9!08x!, DesiredShareAccess: 0x%10!08x!, IoShareAccessFlags: 0x%11!08x!, ShareAccess->OpenCount: %12!d!, ShareAccess->Readers: %13!d!, ShareAccess->Writers: %14!d!, ShareAccess->->Deleters: %15!d!, ShareAccess->SharedRead: %16!d!, ShareAccess->SharedWrite: %17!d!, ShareAccess->SharedDelete: %18!d!.

4NtfsCheckShareAccess: IoCheckLinkShareAccess failed with sharing violation. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, Fcb: %5!p!, FileRef: 0x%6!I64x!, Scb Type Code: 0x%7!x!, Scb Name: %8!S!, Link Name: %9!S!, DesiredAccess: 0x%10!08x!, DesiredShareAccess: 0x%11!08x!, IoShareAccessFlags: 0x%12!08x!, ShareAccess->OpenCount: %13!d!, ShareAccess->Readers: %14!d!, ShareAccess->Writers: %15!d!, ShareAccess->->Deleters: %16!d!, ShareAccess->SharedRead: %17!d!, ShareAccess->SharedWrite: %18!d!, ShareAccess->SharedDelete: %19!d!, LinkShareAccess->OpenCount: %20!d!, LinkShareAccess->Deleters: %21!d!, LinkShareAccess->SharedDelete: %22!d!.

�NtfsReCheckShareAccess: Does not meet allow open requirement. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, Fcb: %5!p!, FileRef: 0x%6!I64x!, Scb Type Code: 0x%7!x!, Scb Name: %8!S!, Link Name: %9!S!, Previously granted access: 0x%10!08x!, AccessState->Flags: 0x%11!08x!, DesiredShareAccess: 0x%12!08x!, CreateDisposition: 0x%13!08x!, OpenCount: %14!d!, Readers: %15!d!, Writers: %16!d!, Deleters: %17!d!, SharedRead: %18!d!, Lcb Deleters: %19!d!.

d%1!S!:%2!d! Status: %3!S! ProcessName: %4!S!

�NtfsSendUnusedClustersHint: Vcb %1!p! - Will tell storage we are freeing at %2!I64x! for %3!x! clusters

xNtfsSendUnusedClustersHint: Vcb %1!p! - Flush requested

�NtfsSendUnusedClustersHint: Vcb %1!p! -  Created new MarkUnusedContext %2!p!, DEALLOCATED_CLUSTERS %3!p!, MCB %4!p!

�NtfsSendUnusedClustersHint: Vcb %1!p! - Successfully added clusters starting at %2!I64x! for %3!x! into MCB %4!p!

|NtfsSendUnusedClustersHint: Vcb %1!p! - MCB %2!p! is full

�NtfsSendUnusedClustersHint: Vcb %1!p! - Queuing request to IC pre-trim list, MUC %2!p!, IC %3!p!

�NtfsSendUnusedClustersHint: Vcb %1!p! -  Failed to allocate/initial MarkUnusedContext

NtfsTransferMaxDataSetRanges: Src %1!p!, Dst %2!p!, SrcRemainClusCt %3!I64x!, SrcOrigClusCt %4!I64x!, SrcDSRL %5!x! - Entering

DNtfsTransferMaxDataSetRanges: Src %1!p!, Dst %2!p!, SrcRemainClusCt %3!I64x!, DstClusCt %4!I64x!, DstDSRL %5!x!, DstLIB %6!I64x!, DstSOff %7!I64x! - Leaving

lNtfsMarkUnusedContextPostTrimProcessing: Entering

NtfsMarkUnusedContextPostTrimProcessing: Vcb %1!p!, MUC %2!p! - DC %3!I64x!, DCIT %4!x!, DCTD %5!x!, CC %6!I64x!, IR %7!x!

�NtfsMarkUnusedContextPostTrimProcessing: Vcb %1!p!, MUC %2!p! - Removed interior slab(s) from TP map - [LCN %3!I64X!, len %4!I64X!] => [LCN %5!I64X!, len %6!I64X!], [LCN %7!I64X!, len %8!I64X!]

�NtfsMarkUnusedContextPostTrimProcessing: Vcb %1!p! - Releasing bitmap

�NtfsMarkUnusedContextPostTrimProcessing: Vcb %1!p! - CloseCount %2!x!

lNtfsMarkUnusedContextPostTrimProcessing: Leaving

�NtfsAsyncSendUnusedClustersHintCompletionRoutine: Irp %1!p!

�NtfsMarkUnusedContextPreTrimProcessing: Vcb %1!p!, IC %2!p! - Entering

�NtfsMarkUnusedContextPreTrimProcessing: Vcb %1!p! - Kicked off DelayedWorkQueue

�NtfsMarkUnusedContextPreTrimProcessing: Vcb %1!p! - Leaving

�NtfsMarkUnusedContextPreTrimWorkItemProcessing: Entering Vcb %1!p!

�NtfsMarkUnusedContextPreTrimWorkItemProcessing: Vcb %1!p! - Small MUC %2!p! instead of MUC %3!p!

�NtfsMarkUnusedContextPreTrimWorkItemProcessing: Vcb %1!p! - Failed to allocate small MUC so use MUC %2!p!

�NtfsMarkUnusedContextPreTrimWorkItemProcessing: Vcb %1!p! - Sending storage ioctl down.  MUC %2!p!

NtfsMarkUnusedContextPreTrimWorkItemProcessing: Vcb %1!p!, MUC %2!p! - [%3!x!] Offset %4!I64x!, Length %5!I64x! - trim entry

�NtfsMarkUnusedContextPreTrimWorkItemProcessing: Vcb %1!p!, MUC %2!p!, Irp %3!p! - Completed

�NtfsMarkUnusedContextPreTrimWorkItemProcessing: Vcb %1!p!, MUC %2!p! - %3!x! - failed to send

�NtfsMarkUnusedContextPreTrimWorkItemProcessing: Vcb %1!p! - Add MUC %2!p! to post trim list

�NtfsMarkUnusedContextPreTrimWorkItemProcessing: Vcb %1!p! - Free small MUC %2!p!

NtfsMarkUnusedContextPreTrimWorkItemProcessing: Vcb %1!p! - Sending storage ioctl down failed with %2!x!.  MUC %3!p!, Count %4!I64x!

xNtfsMarkUnusedContextPreTrimWorkItemProcessing: Leaving

�NtfsWakeupDeallocatedClustersWaiters: Vcb %1!p! - There are waiters for DC %2!p!

�NtfsWakeupDeallocatedClustersWaiters: Vcb %1!p! - Waking up waiter for DC %2!p!

�NtfsWakeupDeallocatedClustersWaiters: Vcb %1!p! - Done waking up DC %2!p!

�NtfsWaitForDeallocatedClustersToDrain: Vcb %1!p!, All %2!x! - Entering

�NtfsWaitForDeallocatedClustersToDrain: Vcb %1!p! - Waiting to drain

�NtfsWaitForDeallocatedClustersToDrain: Vcb %1!p! - Waiting for partial drain

�NtfsWaitForDeallocatedClustersToDrain: Vcb %1!p! - Leaving

�NtfsPrepareToWaitForDeallocatedClustersToDrain: Vcb %1!p! - Entering

�NtfsPrepareToWaitForDeallocatedClustersToDrain: Vcb %1!p! - Inserted %2!p!

�NtfsPrepareToWaitForDeallocatedClustersToDrain: Vcb %1!p! - Leaving

�NtfsWaitForDeallocatedClustersToDrainAfterPrepare: Vcb %1!p! - Wait for DC %2!p!

NtfsWaitForDeallocatedClustersToDrainAfterPrepare: Waited for %1!d! (s), Exceeded by %2!d! (s), IC %3!p!, Vcb %4!p!, DC %5!p!

�NtfsCheckForTrimThrottling: Vcb %1!p! - hitting trim threshold %2!d!

hNtfsUpdateSmartTrimState: Vcb %1!p! - Entering

�NtfsUpdateSmartTrimState: Vcb %1!p! - Precondition checks failed

�NtfsUpdateSmartTrimState: Vcb %1!p! - Precondition checks failed; AcquiredSyncResource %2!u!

�NtfsUpdateSmartTrimState: Vcb %1!p!, MUC %2!p! - Skipping deallocated clusters gen'd by smart trim

�NtfsUpdateSmartTrimState: Vcb %1!p!, MUC %2!p! - MCB run %3!u!; offs 0x%4!I64X!, len 0x%5!I64X!

�NtfsUpdateSmartTrimState: Vcb %1!p! - MUC %2!p!, DSR count %3!u!, MCB count %4!u!, ST free slots %5!u!

�NtfsUpdateSmartTrimState: Vcb %1!p!, MUC %2!p! - DSR range %3!u!; offs 0x%4!I64X!, len 0x%5!I64X!

�NtfsUpdateSmartTrimState: Vcb %1!p! - MCB lcn %2!I64X! len %3!I64X! maps to TP map bits [0x%4!X!, 0x%5!X!]

�NtfsUpdateSmartTrimState: Vcb %1!p! - Smart trim state on exit; %2!u! ranges:

�NtfsUpdateSmartTrimState: Vcb %1!p! - Range %2!u!: FirstTPMapBit 0x%3!X!, LastTPMapBit 0x%4!X!

dNtfsUpdateSmartTrimState: Vcb %1!p! - Leaving

dNtfsEvalSmartTrimState: Vcb %1!p! - Entering

�NtfsEvalSmartTrimState: Vcb %1!p! - Precondition checks failed

�NtfsEvalSmartTrimState: Vcb %1!p! - Precondition checks failed; AcquiredBitmap %2!u!

�NtfsEvalSmartTrimState: Vcb %1!p! - Checking slab 0x%2!X! for allocations

�NtfsEvalSmartTrimState: Vcb %1!p! - Slab 0x%2!X! has allocations, will not trim

�NtfsEvalSmartTrimState: Vcb %1!p! - Free slab found - TP map bit 0x%2!X!, lcn %3!I64X!, len %4!I64X!

`NtfsEvalSmartTrimState: Vcb %1!p! - Leaving

�NtfsFlushAllTrimHintsSynchronous (%1!p!): Calling NtfsFreeRecentlyDeallocated

�NtfsFlushAllTrimHintsSynchronous (%1!p!): Done calling NtfsFreeRecentlyDeallocated

�NtfsCommonDeviceControl: IOCTL_DISK_COPY_DATA is not allowed on unlocked volume. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, VcbState: 0x%5!08x!, SL control flags: 0x%6!08x!.

NtfsVolumeDasdIo: Data section blocking flush. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, Flush status: %5!S!.

HCould not find paging file run.

TCould not find paging file MCB entry.

�Writing to $Bitmap. Vcb: %1!p!, Offset: 0x%2!I64x!, Length: 0x%3!x!

`NTFS: Posting hotfix on file object: %1!p!

`NTFS:     Freeing Bad Vcn: %1!08x!, %2!08x!

dNTFS:     Retiring Bad Lcn: %1!08x!, %2!08x!

HNTFS:     Reallocating Bad Vcn

HNTFS:     Bad Cluster replaced

xIrpContext: %1!p!; Vcb: %2!p!; NewBufferSize: 0x%3!08x!

�Compression buffers are already big enough. NewBufferSize: 0x%1!08x!, ExistingBufferSize: 0x%2!08x!

%1!S!

�NtfsDefragFileInternal: Defrag is denied. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, Fcb: %5!p!, FileRef: 0x%6!I64x!, Scb: %7!p!, Scb Type Code: 0x%8!x!, Scb Name: %9!S!, Persist flags: 0x%10!08x!, Ccb flags: 0x%11!08x!.

hNtfsDefragFileInternal: Vcb %1!p! - Calling FRD

tNtfsDefragFileInternal: Vcb %1!p! - Done calling FRD

hNtfsDefragFileInternal(%1!p!,%2!p!): Scb %3!p!, FRef %4!I64x!, Vcn %5!I64x!, CC %6!I64x!, CurrLcn %7!I64x!, NewLcn %8!I64x!, Len %9!x!, DA %10!d!, Status %11!x! - copy offload

LNtfsDefragFileInternal(%1!p!,%2!p!): Scb %3!p!, FRef %4!I64x!, Vcn %5!I64x!, CC %6!I64x!, CurrLcn %7!I64x!, NewLcn %8!I64x!, Len %9!x!, DA %10!d!, Status %11!x!

�NtfsDefragFileInternal(%1!p!,%2!p!): Scb %3!p!, FRef %4!I64x!, CurrLcn %5!I64x!, Len %6!x!, Status %7!x! - read completed

�NtfsDefragFileInternal(%1!p!,%2!p!): Scb %3!p!, FRef %4!I64x!, NewLcn %5!I64x!, Len %6!x!, Status %7!x! - write completed

`NtfsDefragFileInternal(%1!p!,%2!p!): Scb %3!p!, FRef %4!I64x!, Vcn %5!I64x!, CC %6!I64x!, CurrLcn %7!I64x!, NewLcn %8!I64x!, DA %9!d!, ValidClusters %10!I64x! - beyond VDL

�NtfsDefragFileInternal(%1!p!,%2!p!): Scb %3!p!, FRef %4!I64x!, Vcn %5!I64x!, CC %6!I64x! - committed

xNtfsDefragFile: Defrag is denied without manage volume access. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, Fcb: %5!p!, FileRef: 0x%6!I64x!, Ccb flags: 0x%7!08x!.

�NtfsEncryptDecryptOnline: Defrag is denied. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, Fcb: %5!p!, FileRef: 0x%6!I64x!, Scb: %7!p!, Scb Type Code: 0x%8!x!, Scb Name: %9!S!, Persist flags: 0x%10!08x!, Ccb flags: 0x%11!08x!.

lNtfsEncryptDecryptOnline: Vcb %1!p! - Calling FRD

xNtfsEncryptDecryptOnline: Vcb %1!p! - Done calling FRD

�SCB: %1!p!, VDL=0x%2!I64x!, FS=0x%3!I64x!, StartOff=0x%4!I64x!, StartVcn=0x%5!I64x!, Length=0x%6!I64x!

HStartOff=0x%1!I64x!, Length=0x%2!I64x!, EffectiveLength=0x%3!I64x! StartVcn=0x%4!I64x!, BeyondEndVcn=0x%5!I64x!, Clusters=0x%6!I64x!, LastVcnInFile=0x%7!I64x!

4NumberOfValidRuns: 0

�RemainingClusterCount: 0x%1!I64x!, DataSetRangeIndex: %2!d!, OutputBufferLength: 0x%3!d!

�STATUS_BUFFER_TOO_SMALL from FsLib. NumberOfValidRuns: 0x%1!x!, MaxRuns: 0x%2!x!, BytesReturned: 0x%3!I64x!

�Made an educated guess for remaining runs. RemainingClusterCount: 0x%1!I64x!, NumberOfValidRuns: 0x%2!x!

�Made a wild guess for remaining runs. RemainingClusterCount: 0x%1!I64x!, NumberOfValidRuns: 0x%2!x!

�NumberOfValidRuns: 0x%1!08x!, MaxRuns: 0x%2!08x!, Status: 0x%3!08x!, BytesReturned: 0x%4!I64x!

lBasePage: 0x%1!-16I64x!, PageCount: 0x%2!-16I64x!

�About to zero range - ZeroStart: 0x%1!016I64x!, ZeroEnd: 0x%2!016I64x!

�Zeroed range - ZeroStart: 0x%1!016I64x!, ZeroEnd: 0x%2!016I64x!

PNtfsCommonQueryInformation: File information query not allowed as file was opened by ID without traversal privilege. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, Fcb: %5!p!, FileRef: 0x%6!I64x!, Scb: %7!p!, Scb Type Code: 0x%8!x!, Scb Name: %9!S!, Ccb flags: 0x%10!08x!.

pNtfsQueryCaseSensitiveInfo: Case sensitive info query not allowed without read attributes access. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, Fcb: %5!p!, FileRef: 0x%6!I64x!, Scb: %7!p!, Scb Type Code: 0x%8!x!, Scb Name: %9!S!, Ccb access flags: 0x%10!08x!, Granted access: 0x%11!08x!.

$NtfsQueryNameInfo: Name info query not allowed as file was opened without traverse privilege. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, Fcb: %5!p!, FileRef: 0x%6!I64x!, Scb: %7!p!, Scb Type Code: 0x%8!x!, Scb Name: %9!S!, Ccb flags: 0x%10!08x!.

�NtfsQueryLinksInfo: Link info query not allowed as file was opened without traverse privilege. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, Fcb: %5!p!, FileRef: 0x%6!I64x!, Ccb flags: 0x%7!08x!.

NtfsSetCaseSensitiveInfo: Cannot mark root directory of a volume case-sensitive. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, Fcb: %5!p!, FileRef: 0x%6!I64x!, Scb: %7!p!, Scb Type Code: 0x%8!x!, Scb Name: %9!S!, Device Object flags: 0x%10!08x!.

�NtfsRemoveSupersededTarget: Can not do a superseding rename over a system file. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, Fcb: %5!p!, FileRef: 0x%6!I64x!, Fcb state: %7!x!.

�NtfsRemoveSupersededTarget: Can not do a superseding rename over a file with open handles. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, Fcb: %5!p!, FileRef: 0x%6!I64x!, TxfNumWriters count: %7!d!.

�NtfsRemoveSupersededTarget: Can not do a superseding rename over a file with open handles. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, Fcb: %5!p!, FileRef: 0x%6!I64x!, Lcb: %7!p!, Link name: %8!S!, TxfNumWriters count: %9!d!.

�NtfsRemoveSupersededTarget: Can not do a superseding rename over a file opened by ID. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, Fcb: %5!p!, FileRef: 0x%6!I64x!, Cleanup count: %7!d!.

�NtfsRemoveSupersededTarget: Can not do a superseding rename over a file with open handles via either part of the long/short pair. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, Fcb: %5!p!, FileRef: 0x%6!I64x!, Lcb: %7!p!, Link name: %8!S!, Link cleanup count: %9!d!, SplitPrimaryLcb: %10!p!, Split link name: %11!S!, Split link cleanup count: %12!d!.

NtfsSetRenameInfo: Can not rename a file marked for deletion. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, Fcb: %5!p!, FileRef: 0x%6!I64x!, Fcb state: 0x%7!08x!, Lcb: %8!p!, link name: %9!S!, link name flag: 0x%10!08x!, link state: 0x%11!08x!.

lNtfsSetRenameInfo: Can not rename a txf directory. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, Fcb: %5!p!, FileRef: 0x%6!I64x!, File attributes: 0x%7!08x!.

pNtfsSetRenameInfo: Can not rename into a system directory. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, Fcb: %5!p!, FileRef: 0x%6!I64x!, FcbState: 0x%7!08x!.

�NtfsSetRenameInfo: Can not rename a file that is part of a TxF transaction. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, Fcb: %5!p!, FileRef: 0x%6!I64x!, FileAttributes: 0x%7!08x!, Rmstate: 0x%8!08x!.

hNtfsSetRenameInfo: The file should not have in-memory directory descendents. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, Fcb: %5!p!, FileRef: 0x%6!I64x!.

dNtfsSetRenameInfo: Child Scb mismatch. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, Fcb: %5!p!, FileRef: 0x%6!I64x!, Potential child FileRef: %7!I64x!.

pNtfsSetLinkInfo: Set link info is not allowed on txf directory. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, Fcb: %5!p!, FileRef: 0x%6!I64x!, FileName: %7!S!.

�NtfsSetLinkInfo: Set link info is not allowed on a file in a TxF transaction. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, Fcb: %5!p!, FileRef: 0x%6!I64x!, FileName: %7!S!, TxfVisibleLinks: %8!d!.

�NtfsSetLinkInfo: Set link info failed due to caller not having FILE_WRITE_ATTRIBUTES access. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, Fcb: %5!p!, FileRef: 0x%6!I64x!, FileName: %7!S!, SeAccessCheck status: %8!S!.

�NtfsSetLinkInfo: Creating a link in system directory is not allowed. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, Fcb: %5!p!, FileRef: 0x%6!I64x!, NewLinkName: %7!S!.

�NtfsSetLinkInfo: Creating a link in $txf is not allowed if the RM is running. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, Fcb: %5!p!, FileRef: 0x%6!I64x!, NewLinkName: %7!S!, Target RM state: %8!x!.

�NtfsSetShortNameInfo: Can not set a short name on a deleted file. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, Fcb: %5!p!, FileRef: 0x%6!I64x!, Lcb: %7!p!, Link Name: %8!S!.

�NtfsSetShortNameInfo: Can not set a short name on a file under the $TxF directory. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, Fcb: %5!p!, FileRef: 0x%6!I64x!, Lcb: %7!p!, Link Name: %8!S!, Parent FileRef: %9!I64x!.

�NtfsCheckScbForLinkRemoval: Existing handles are not allowed if Txf transaction is doing the rename. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, Fcb: %5!p!, FileRef: 0x%6!I64x!, Stream cleanup count: %7!d!.

�NtfsCheckScbForLinkRemoval: Not all open handles for the stream are by-id opens. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, Fcb: %5!p!, FileRef: 0x%6!I64x!, ByID opens: %7!d!, Stream cleanup count: %8!d!.

8NtfsStreamRename: Deny access due to encryption happening on source stream. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, Fcb: %5!p!, FileRef: 0x%6!I64x!, Scb: %7!p!, Scb Type Code: 0x%8!x!, Scb Name: %9!S!, Scb state: 0x%10!08x! Scb HighWaterMark: %11!I64d!.

�NtfsProcessTreeForRename: Deny access due to number of batch oplocks has grown. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, Fcb: %5!p!, FileRef: 0x%6!I64x!, Previous batch oplock count: %7!d!, current batch oplock count: %8!d!.

�NtfsFlushVolumeFlushSingleFcb: Thread: %1!p!, Vcb: %2!p!, Fcb: %3!p!, LocalFlags: %4!#08x!

|NtfsFlushVolumeFlushSingleFcb: Thread: %1!p!, Scb: %2!p!

�NtfsFlushVolume: Thread: %1!p!, Vcb: %2!p!, LocalFlags: %3!#08x!

�NtfsFlushVolume setting SCB_PERSIST_VOLUME_DISMOUNTED on BitmapScb Scb: %1!p! Vcb: %2!p!

�NtfsFlushVolume setting SCB_PERSIST_VOLUME_DISMOUNTED on MftScb Scb: %1!p! Vcb: %2!p!

�NtfsFlushCompletionRoutine: Vcb %1!p! - Add context %2!p! into completion queue

�NtfsFlushCompletionRoutine: Vcb %1!p! - Add context %2!p! into WorkQueue - Flink %3!p!

|NtfsDiskFlushContextWorkItemProcessing: Process work item

�NtfsDiskFlushContextWorkItemProcessing: Nothing to work on

�Irp: %1!p!, IC: %2!p!, Vcb: %3!p!, MinorCode: %4!02x!, FsControlCode: 0x%5!08x!

�NtfsLockVolumeInternal: Cannot lock the volume. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, Vcb State: 0x%5!08x!, DisallowDismountCount: %6!d!, ExplicitLock: %7!d!, Volume CleanupCount: %8!d!, Handle count: %9!d!.

NtfsLockVolumeInternal: Volume is already locked.Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, Vcb State: 0x%5!08x!.

@NtfsLockVolumeInternal: Failed to flush system files on the volume. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, Flush Status: %5!S!.

<NtfsLockVolumeInternal: Failed to flush system files on the volume.Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, Flush Status: %5!S!.

�NtfsLockVolumeInternal: Outstanding user files open after flush and retry. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, Volume close count: %5!d!, System file close count: %6!d!, User handle count: %7!d!.

xNtfsLockVolume: Cannot lock volume due to caller does not have manage volume privilege. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, Ccb access flags: 0x%5!08x!.

�NtfsLockVolume: Cannot lock volume due to active secondary RMs on the volume. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, Active RM count: %5!d!, Default RM Active: %6!d!.

�%1!S!: Setting RM at 0x%2!p! ({%3!S!}) up for auto-restart.

�NtfsUnlockVolume: Cannot unlock volume due to caller does not have manage volume privilege. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, Ccb access flags: 0x%5!08x!.

�NtfsDismountVolume: IC: %1!p!, Vcb: %2!p!, Label: %3!S!, DeviceName: %4!S!

�NtfsDismountVolume: Cannot dismount volume due to system/pagefiles being open for write access. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, Ccb access flags: 0x%5!08x!.

DNtfsDismountVolume: Cannot dismount volume due to volume being locked. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, VcbState: 0x%5!08x!.

NtfsDismountVolume: Cannot dismount volume due to system/pagefiles being open for write access. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, VcbState: 0x%5!08x!, ReadOnlyCloseCount: %6!d!, CloseCount: %7!d!, SystemFileCloseCount: %8!d!.

`NtfsDismountVolume: Could not flush trim hints.  Couldn't make progress flushing log.Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, VcbState: 0x%5!08x!.

�NtfsMarkVolumeDirty: Cannot mark volume dirty due to caller not having manage volume privilege. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, Ccb access flags: 0x%5!08x!.

�NtfsGetVolumeBitmap: Cannot get volume bitmap due to caller not having manage volume privilege. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, Ccb access flags: 0x%5!08x!.

�NtfsGetBootAreaInfo: Cannot get boot area info due to caller not having manage volume privilege. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, Ccb access flags: 0x%5!08x!.

�NtfsGetRetrievalPointers: Cannot get retrieval pointers due to caller not having manage volume privilege. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, Ccb access flags: 0x%5!08x!.

�NtfsGetRetrievalPointerBase: Cannot get revrieval pointer base info due to caller not having manage volume privilege. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, Ccb access flags: 0x%5!08x!.

NtfsGetRetrievalPointerBase: Cannot get revrieval pointer base info due to caller not having manage volume privilege or this is not a volume open. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, Ccb access flags: 0x%5!08x!, TypeOfOpen: %6!d!.

�NtfsCreateUsnJournal: Cannot create Usn journal due to caller not having manage volume privilege. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, Ccb access flags: 0x%5!08x!, Irp Request Mode: %6!d!.

�NtfsUsnTrackModifiedRanges: Cannot enable range tracking due to caller not having manage volume privilege. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, Ccb access flags: 0x%5!08x!.

�NtfsEnumerateUsnData: Cannot enumerate Usn data due to caller not having manage volume privilege. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, Ccb access flags: 0x%5!08x!.

�NtfsFindFilesOwnedBySid: Caller not having manage volume privilege, backup access or can bypass traverse checks. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, Ccb access flags: 0x%5!08x!, Ccb flags: 0x%6!08x!.

NtfsFindFilesOwnedBySid: Caller not having manage volume privilege or backup access and is not admin. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, Ccb access flags: 0x%5!08x!, Ccb flags: 0x%6!08x!, CallerId: %7!d!, Context owner ID: %8!d!.

NtfsSetSparse: Caller does not have appropriate write access to the stream. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, Fcb: %5!p!, FileRef: 0x%6!I64x!, FullFileName: %7!S!, Ccb access flags: 0x%8!08x!, FileObject write access: %9!d!.

�NtfsSetSparse: Cannot desparse encrypted file without write data access. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, Fcb: %5!p!, FileRef: 0x%6!I64x!, FullFileName: %7!S!, Ccb access flags: 0x%8!08x!, Scb attributes: 0x%9!08x!.

�NtfsZeroRange: User mode caller not allowed. Thread: %1!p!, Zero flags: 0x%2!08x!, Irp Requestor Mode: %3!d!.

\IC: %1!p!, Scb: %2!p!, FileObject: %3!p!

\IC: %1!p!, EncryptionOperation: 0x%2!08x!

�NtfsReadRawEncrypted: Caller does not have backup access or read data access. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, Fcb: %5!p!, FileRef: 0x%6!I64x!, FullFileName: %7!S!, Ccb access flags: 0x%8!08x!.

�NtfsWriteRawEncrypted: Caller does not have write data access or restore access. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, Fcb: %5!p!, FileRef: 0x%6!I64x!, FullFileName: %7!S!, Ccb access flags: 0x%8!08x!.

LNtfsWriteRawEncrypted: Caller not having manage volume privilege. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, Ccb access flags: 0x%5!08x!.

XNtfsLookupStreamFromCluster: Caller not having manage volume privilege. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, Ccb access flags: 0x%5!08x!.

HNtfsChangeVolumeSize: Caller not having manage volume privilege. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, Ccb access flags: 0x%5!08x!.

�NtfsChangeVolumeSize (%1!p!): Calling NtfsFreeRecentlyDeallocated

�NtfsChangeVolumeSize (%1!p!): Done calling NtfsFreeRecentlyDeallocated

�NtfsMarkHandle: Caller does not have a valid volume handle or manage volume access or is not kernel model caller. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, Fcb: %5!p!, FileRef: 0x%6!I64x!, FullFileName: %7!S!, Ccb access flags: 0x%8!08x!, HandleInfo flags: 0x%9!08x!, Irp Requestor Mode: %10!d!.

<NtfsMarkHandle: Caller not having manage volume privilege. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, Ccb access flags: 0x%5!08x!.

�NtfsMarkHandle: Cannot deny defrag. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, Fcb: %5!p!, FileRef: 0x%6!I64x!, Scb: %7!p!, Scb Type Code: 0x%8!x!, Scb Name: %9!S!, Persist flags: 0x%10!08x!, HandleInfo flags: 0x%11!08x!.

8NtfsMarkHandle: Cannot deny Frs consolidation. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, Fcb: %5!p!, FileRef: 0x%6!I64x!, FcbState2: 0x%7!08x!, Scb: %8!p!, Scb Type Code: 0x%9!x!, Scb Name: %10!S!, Persist flags: 0x%11!08x!, HandleInfo flags: 0x%12!08x!.

\NtfsMarkHandle: Cannot filter metadata. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, Fcb: %5!p!, FileRef: 0x%6!I64x!, FcbState: 0x%7!08x!, Scb: %8!p!, Scb Type Code: 0x%9!x!, Scb Name: %10!S!, Persist flags: 0x%11!08x!, HandleInfo flags: 0x%12!08x!, Irp RequestorMode: %13!d!.

�NtfsMarkHandle: Mark handle is not allowed on system files. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, Fcb: %5!p!, FileRef: 0x%6!I64x!, FcbState: 0x%7!08x!, HandleInfo flags: %8!x!.

�NtfsMarkHandle: File already has user writable references. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, Fcb: %5!p!, FileRef: 0x%6!I64x!, Scb: %7!p!, Scb Type Code: 0x%8!x!, Scb Name: %9!S!, HandleInfo: 0x%10!08x!.

NtfsMarkHandle: File was granted write access previously but no oplocks were broken. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, Fcb: %5!p!, FileRef: 0x%6!I64x!, Scb: %7!p!, Scb Type Code: 0x%8!x!, Scb Name: %9!S!, Writers: %10!d!.

�NtfsPrefetchFile: Caller not having manage volume privilege. Thread: %1!p!, TypeOfOpen: %2!d!, Vcb: %3!p!, VolumeName: %4!S!, VolumeLabel: %5!S!, Fcb: %6!p!, FileRef: 0x%7!I64x!, Ccb FullFileName: %8!S!, Ccb access flags: 0x%9!08x!.

PNtfsSetZeroOnDeallocate: Only allowed on regular user files opened for write. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, TypeOfOpen: %5!d!, WriteAccess: %6!d!, Fcb: %7!p!, FileRef: 0x%8!I64x!, FcbState: %9!x!, Scb AttributeTypeCode: 0x%10!x!, Ccb FullFileName: %11!S!.

PNtfsSetShortNameBehavior: Caller not having manage volume privilege. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, Ccb access flags: 0x%5!08x!.

�Setting VCB_EXT_CHAR_STATE_ALLOW_EXT_CHAR for volume 0x%1!p! to %2!u!.

XNtfsQueryPagefileEncryption: Caller not having manage volume privilege. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, Ccb access flags: 0x%5!08x!.

PNtfsResetVolsnapBehaviorForVolume: Volsnap hints are disabled by registry. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, NtfsData Flags: %5!x!.

dNtfsResetVolsnapBehaviorForVolume: Caller not having manage volume privilege. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, Ccb access flags: 0x%5!08x!.

�Resetting Volsnap behavior for VCB = 0x%1!p!.  New state is 0x%2!x!.

LNtfsCorruptionHandling: Caller not having manage volume privilege. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, Ccb access flags: 0x%5!08x!.

$NtfsGlobalCorruptionHandling: Caller does not have manage volume privilege. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!.

�Scrub resume from SystemScbIndex: %1!u! Vcn: %2!#I64x! + %3!#x!

pScb:%1!p! Scrub resume from Vcn: %2!#I64x! + %3!#x!

@Scrub SystemScbIndex: %1!u!

�NtfsScrubData: Caller not having manage volume privilege. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, TypeOfOpen: %5!d!, Fcb: %6!p!, FileRef: 0x%7!I64x!, Ccb FullFileName: %8!S!, Ccb access flags: 0x%9!08x!.

�Scrub not supported for Txf file, Scb: %1!p!, TxfScb: %2!p!

�Scrub SCRUB_DATA_INPUT_FLAG_SKIP_NON_INTEGRITY_DATA is request. noop

4Scb:%1!p! ScrubInternal OperationStatus: %2!S! Repaired: %3!#I64x! Failed: %4!#I64x! FileOffset: %5!#I64x! Length: %6!#I64x! ParityExtentCount: %7!u!

�Scb:%1!p! ScrubInternal Status: %2!S! Repaired: %3!#I64x! Failed: %4!#I64x! ParityExtentCount: %5!u!

DInternalFileReference: %1!u!

@InternalFileReference:%1!u!

�Scb:%1!p! Incomplete IoCount:%2!u! Cancel:%3!u! ParityExtentCount:%4!u!

xScb:%1!p! Scrub skipping resident attribute (d) (%2!S!)

pScb:%1!p! Scrub skipping resident attribute (%2!S!)

pScb:%1!p! Scrub StartingVcn(%2!#I64d!) is negative

�Scb:%1!p! Scrub starting vcn is beyond VDL (FileOffset: %2!#I64x!, SectorAlignedVdl: %3!#I64x!)

�Scb:%1!p! Scrub no more Mcb entries from StartingVcn:%2!#I64x!

�Scb:%1!p! Scrub skipping UNUSED_LCN Vcn: %2!#I64x!, ClusterCount: %3!#I64x!

dScb:%1!p! StartingVcn:%2!#I64x! is beyond Vdl

Scb:%1!p! ScrubDsmRange [%2!#I64x!,%3!#I64x!) Length:%4!#I64x! (Bytes) StartingVcn:%5!#I64x! + %6!#x! SectorAlignedVdl:%7!#I64x!

`Scrub found problems Scb: %1!p! Vcn %2!#I64x! FileOffset: %3!#I64x! Length: %4!#I64x! Status: %5!S! BytesFailed: %6!#I64x! BytesRepaired: %7!#I64x! NewParityExtents: %8!u!

tScb:%1!p! DsmAction_Scrub call failed, Status: %2!S!

|Scb:%1!p! DsmAction_Scrub operation failed, Status: %2!S!

�FSCTL_REPAIR_COPIES not supported for Txf file, Scb: %1!p!, TxfScb: %2!p!

�Scb:%1!p! FSCTL_REPAIR_COPIES skipping resident attribute (d) (%2!S!)

�Scb:%1!p! FSCTL_REPAIR_COPIES skipping resident attribute (%2!S!)

xFSCTL_REPAIR_COPIES interrupted by thread termination.

DFSCTL_REPAIR_COPIES canceled

�Scb:%1!p! FSCTL_REPAIR_COPIES no more Mcb entries from StartingVcn:%2!#I64x!

�Scb:%1!p! FSCTL_REPAIR_COPIES No more Mcb entries (unallocated) from StartingVcn:%2!#I64x!

�Scb:%1!p! FSCTL_REPAIR_COPIES skipping UNUSED_LCN Vcn: %2!#I64x!, ClusterCount: %3!#I64x!

�Scb:%1!p! RepairDsmRange [%2!#I64x!,%3!#I64x!) Length:%4!#I64x! (Bytes) FileOffset: %5!#I64x!

tScb:%1!p! DsmAction_Repair call failed, Status: %2!S!

�Scb:%1!p! DsmAction_Repair operation failed, Status: %2!S!

xScb:%1!p! DsmAction_Repair completed, IrpStatus: %2!S!

�NtfsQueryCachedRuns: Caller not having manage volume privilege. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, TypeOfOpen: %5!d!, Fcb: %6!p!, FileRef: 0x%7!I64x!, Ccb FullFileName: %8!S!, Ccb access flags: 0x%9!08x!.

�NtfsQueryStorageClasses: Caller not having manage volume privilege. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, TypeOfOpen: %5!d!, Fcb: %6!p!, FileRef: 0x%7!I64x!, Ccb FullFileName: %8!S!, Ccb access flags: 0x%9!08x!.

�NtfsQueryRegionInfo: Caller not having manage volume privilege. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, TypeOfOpen: %5!d!, Fcb: %6!p!, FileRef: 0x%7!I64x!, Ccb FullFileName: %8!S!, Ccb access flags: 0x%9!08x!.

�NtfsUnloadFile: Caller not having manage volume privilege. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, TypeOfOpen: %5!d!, Fcb: %6!p!, FileRef: 0x%7!I64x!, Ccb FullFileName: %8!S!, Ccb access flags: 0x%9!08x!.

�NtfsCheckForSection: File already has image section. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, Fcb: %5!p!, FileRef: 0x%6!I64x!, Scb: %7!p!, Scb Type Code: 0x%8!x!, Scb Name: %9!S!.

�NtfsShuffleFile: User mode caller is not allowed. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, TypeOfOpen: %5!d!, Fcb: %6!p!, FileRef: 0x%7!I64x!, Ccb FullFileName: %8!S!, Irp RequestorMode: %9!d!.

�NtfsShuffleFile: Denying access due to volume is locked. Thread: %1!p!, TypeOfOpen: %2!d!, Vcb: %3!p!, VolumeName: %4!S!, VolumeLabel: %5!S!, Fcb: %6!p!, FileRef: %7!I64x!, Ccb FullFileName: %8!S!, VcbState: 0x%9!08x!.

�NtfsShuffleFile: Defrag is denied. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, Fcb: %5!p!, FileRef: 0x%6!I64x!, Scb: %7!p!, Scb Type Code: 0x%8!x!, Scb Name: %9!S!, Persist flags: 0x%10!08x!, Ccb flags: 0x%11!08x!.

�NtfsShuffleFile: Denying access due to conflicting with read-only state. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, Fcb: %5!p!, FileRef: 0x%6!I64x!, FileAttributes: 0x%7!08x!, SL control flags: 0x%8!08x!.

�NtfsRearrangeFile: User mode caller is not allowed. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, Fcb: %5!p!, FileRef: 0x%6!I64x!, Ccb FullFileName: %7!S!, Irp RequestorMode: %8!d!.

�NtfsRearrangeFile: Denying access due to volume is locked. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, Fcb: %5!p!, FileRef: 0x%6!I64x!, Ccb FullFileName: %7!S!, VcbState: 0x%8!08x!.

�NtfsRearrangeFile: Defrag is denied. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, Fcb: %5!p!, FileRef: 0x%6!I64x!, Scb: %7!p!, Scb Type Code: 0x%8!x!, Scb Name: %9!S!, Persist flags: 0x%10!08x!, Ccb flags: 0x%11!08x!.

�NtfsSparseOverAllocate: Caller does not have appropriate write access. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, FileRef: %5!I64x!, FullFileName: %6!S!, Ccb access flags: %7!x!.

�NtfsInitiateFileMetadataOptimization: Only allowed on regular user files/directories opened for write. Thread: %1!p!, TypeOfOpen: %2!d!, Vcb: %3!p!, VolumeName: %4!S!, VolumeLabel: %5!S!, Fcb: %6!p!, FileRef: %7!I64x!, Scb AttributeTypeCode: %8!x!, FcbState2: %9!x!, Ccb FullFileName: %10!S!, Ccb Access flags: %11!x!, Ccb Flags2: %12!x!.

hNtfsQueryFileMetadataOptimization: Only allowed on regular user files/directories opened for read. Thread: %1!p!, TypeOfOpen: %2!d!, Vcb: %3!p!, VolumeName: %4!S!, VolumeLabel: %5!S!, Fcb: %6!p!, FileRef: 0x%7!I64x!, Scb AttributeTypeCode: 0x%8!x!, Ccb FullFileName: %9!S!, Ccb Access flags: 0x%10!08x!.

�NtfsCleanVolumeMetadata: Caller not having manage volume privilege. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, Fcb: %5!p!, FileRef: 0x%6!I64x!, Ccb FullFileName: %7!S!, Ccb access flags: 0x%8!08x!.

�NtfsEnumOnMountToDeleteWorker(%1!p!,%2!p!): Open status=0x%3!x!, path="%4!S!"

�NtfsEnumOnMountToDeleteWorker(%1!p!,%2!p!): Enumerate status=0x%3!x!

�NtfsEnumMountWorker(%1!p!,%2!p!): Open status=0x%3!x!, file="%4!S!"

xNtfsEnumMountWorker(%1!p!,%2!p!): Close status=0x%3!x!

�NtfsEnumOnMountToDeleteWorker(%1!p!,%2!p!): Close dir status=0x%3!x!

NtfsCleanVolumeMetadata: Caller not having manage volume privilege. Thread: %1!p!, TypeOfOpen: %2!d!, Vcb: %3!p!, VolumeName: %4!S!, VolumeLabel: %5!S!, Fcb: %6!p!, FileRef: 0x%7!I64x!, Ccb FullFileName: %8!S!, Ccb access flags: 0x%9!08x!, EffectiveMode: %10!d!.

�SCB: %1!p!, StartOffset: 0x%2!I64x!, Length: 0x%3!I64x!, StartVcn=0x%4!I64x!, BeyondEndVcn=0x%5!I64x!

�FsLibGetBadAddressRanges returned Status: %1!S!, NumBadRanges: 0x%2!x!

�FsInputRangeIndex: %1!u!, FileOffset: 0x%2!I64x!, VolumeOffset: 0x%3!I64x!, LengthInBytes: 0x%4!I64x!

tScb: %1!p!, Status: %2!S!, AbnormalTermination: %3!S!

<Scb: %1!p!, Status: %2!S!

NtfsEncryptionKeyCtl: Caller does not have SE_TCB_PRIVILEGE. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!.

`Logic error of posting close to work queue.

�NtfsFindPrefixHashEntry: {Hash table: %1!p!} {ParentScb: %2!p!, '%3!S!'} {RemainingName: '%4!S!'}

TNtfsFindPrefixHashEntry: {Lcb: NULL}

hNtfsFindPrefixHashEntry: {Lcb: %1!p!, '%2!S!'}

\NtfsFindPrefixHashEntry: {Lcb not found}

�NtfsInsertHashEntry: {Hash table: %1!p!} {HashValue: %2!08x!} {FullNameLength: %3!d!} {Lcb: %4!p!, '%5!S!'}

�NtfsRemoveHashEntry: {Hash table: %1!p!} {HashValue: %2!08x!} {HashLcb: %3!p!, '%4!S!'}

hVcb %1!p!.  Checkpoint injection.  Count %2!d!

�Vcb %1!p!.  Log %2!d!%!PCT! full.  Wait for CC to flush metadata first. Count %3!d!

lVcb %1!p!.  Done waiting for CC to flush metadata

LVcb %1!p!.  Injected checkpoint.

HVcb %1!p!.  Start of checkpoint

\Vcb %1!p!.  Clean checkpoint. Count %2!d!

XVcb %1!p!.  Overflowed DPT. Count %2!d!

\Vcb %1!p!.  Fuzzy checkpoint. Count %2!d!

\Vcb %1!p!.  Flush oldest FO.  Count %2!d!

`Vcb %1!p!.  Flush starts with FRef %2!I64x!

LVcb %1!p!.  Flush ends.  FO %2!p!

HNtfsCheckpointForVolumeSnapshot: Denying access due to volume is locked. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, VcbState: 0x%5!08x!.

LVcb %1!p!.  Checkpoint completed.

\Vcb %1!p!.  Leaving NtfsCheckpointVolume.

�NtfsCommitCurrentTransaction IC: %1!p!, TransactionId: 0x%2!08x!

�NtfsCommitCurrentTransaction (%1!p!,%2!p!,%3!p!): Pre NtfsWriteLog failure %4!x!

�NtfsCommitCurrentTransaction (%1!p!,%2!p!,%3!p!): Post NtfsWriteLog failure %4!x!

�NtfsCommitCurrentTransaction (%1!p!,%2!p!,%3!p!): LfsFlushToLsn failure %4!x! Count %5!d!

�NtfsCommitCurrentTransaction (%1!p!,%2!p!,%3!p!): Pre NtfsProcessNewLengthQueue failure %4!x!

�NtfsCommitCurrentTransaction (%1!p!,%2!p!,%3!p!): Post NtfsProcessNewLengthQueue failure %4!x!

�NtfsCommitCurrentTransaction IC: %1!p!, TransactionId: 0x%2!08x! Completed

�NtfsFreeRecentlyDeallocated: Vcb %1!p! - Entering - ActiveLsn: %2!I64x!, ClearAll: %3!S!

�NtfsFreeRecentlyDeallocated: Vcb %1!p! empty list - Leaving

�NtfsFreeRecentlyDeallocated: Vcb %1!p! empty list  - Leaving

�NtfsFreeRecentlyDeallocated: Vcb %1!p! - Found frozen deallocated clusters with %2!I64x! clusters

�NtfsFreeRecentlyDeallocated: Vcb %1!p! - No actionable deallocated clusters

NtfsFreeRecentlyDeallocated: Vcb %1!p! - Found a deallocated clusters %2!p! with %3!I64x! clusters, Lsn: %4!I64x!, Flags: %5!08x!

�Vcb: %1!p!, Processing range. DeallocatedClusters: %2!p!, RunIndex: %3!d!, StartingLcn: %4!I64x!, ClusterCount: %5!I64x!

<Looking for dangling MDLs

hFsLibGroupSubExtentsByDanglingMdl failed: %1!S!

TFsLibAddBaseMcbEntryEx failed: %1!S!

�NtfsAddToMatchingDeallocatedClusters( ExtentsWithoutDanglingMdl ) failed: %1!S!

�NtfsAddToMatchingDeallocatedClusters( ExtentsWithDanglingMdl ) failed: %1!S!

HNo sub extents has dangling MDL

�NtfsFreeRecentlyDeallocated: Vcb %1!p! - Telling volsnap freeing at %2!I64x! for %3!x! clusters

�NtfsFreeRecentlyDeallocated: Vcb %1!p! - Volsnap responsed with freeing at %2!I64x! for %3!x! clusters

�NtfsFreeRecentlyDeallocated: Vcb %1!p! - Got error 0x%2!x! from below

�NtfsFreeRecentlyDeallocated: Vcb %1!p! - Deleting MarkUnusedContext %2!p!

lNtfsFreeRecentlyDeallocated: Vcb %1!p! - Leaving

�NtfsRemoveNtfsMcbEntry Scb: %1!p!, Mcb: %2!p!, Vcn: 0x%3!I64x!, Length: 0x%4!I64x!

dNtfsRemoveNtfsMcbEntry Mcb: %1!p! Completed.

�NtfsAddNtfsMcbEntry Scb: %1!p!, Mcb: %2!p!, Vcn: 0x%3!I64x!, Lcn: 0x%4!I64x!, Length: 0x%5!I64x!

dNtfsAddNtfsMcbEntry Mcb: %1!p!, Result: %2!S!

�NtfsUnloadNtfsMcbRange Scb: %1!p!, Mcb: %2!p!, StartVcn: 0x%3!I64x!, EndVcn: 0x%4!I64x!, TruncateOnly: %5!S!

dNtfsUnloadNtfsMcbRange Mcb: %1!p! Completed.

tValid NTFS boot sector. Vcb: %1!p!; BootSector: %2!p!

�Not an NTFS boot sector. Vcb: %1!p!; BootSector: %2!p!; CheckNumber: %3!d!

�NtfsMountVolume: Vcb:%1!p!, IC:%2!p!, Growing allocation for Mft's Attribute List failed with exception:0x%3!x!

�NtfsMountVolume: IC: %1!p!, Vcb: %2!p!, Label: %3!S!, DeviceName: %4!S!

PMounting DAX partition. Vcb: %1!p!

�DAX volume mounted without DAX support because storage is not DAX capable. Vcb: %1!p!

�NtfsGrowMftsAttributeListAllocation Vcb:%1!p!, IC:%2!p! Mft AttributeList not found, skipping growth

�NtfsGrowMftsAttributeListAllocation Vcb:%1!p!, IC:%2!p! Converting Resident AttributeList(size:0x%3!I64x!) to NonResident

(NtfsGrowMftsAttributeListAllocation Vcb:%1!p!, IC:%2!p!, AttrListScb:%3!p! Added Allocation for NonResident AttributeList (old size:0x%4!I64x!)

dUnexpected exception code of 0x%1!x! received

lException code of 0x%1!x! received during mount.

hUnexpected exception code of 0x%1!x! received.

�LogFileFull %1!S! BackTrace: ln %2!p!; ln %3!p!; ln %4!p!; ln %5!p!; ln %6!p!; ln %7!p!; ln %8!p!; ln %9!p!; ln %10!p!; ln %11!p!; ln %12!p!; ln %13!p!; ln %14!p!; ln %15!p!; ln %16!p!; ln %17!p!; ln %18!p!; ln %19!p!; ln %20!p!; ln %21!p!;

�Unexpected raise of 0x%1!x! during critical non-raise code

|NtfsProcessException IC: %1!p!, ExceptionCode: 0x%2!08x!

�Failed to abort - IrpContext %1!p!, Irp %2!p!, Vcb %3!p!, Count %4!x!, Status %5!x!

�Failed to abort - IrpContext %1!p!, Irp %2!p!, Vcb %3!p!, Scb %4!p!, FileRef %5!I64x!

�Setting STATUS_CANT_WAIT in top-level exception status for write @ 0x%1!08x!%2!08x!

�Setting 0x%1!x! in top-level exception status for write @ 0x%2!08x!%3!08x!

x[%1!S!, %2!02x!]: Irp: %3!p!, IC: %4!p!, Status: %5!S!

hCan't handle invalid bitmap in a positive way.

HNTFS ETW tracing is now active.

XUpdating NtfsMinTrimTotalSize to %1!x!.

XUpdating NtfsMaxTrimTotalSize to %1!x!.

�NtfsSetObjectId: Caller does not have restore access. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, Fcb: %5!p!, FileRef: 0x%6!I64x!, Ccb FullFileName: %7!S!, Ccb access flags: 0x%8!08x!, Irp Minor Function: 0x%9!08x!.

�NtfsSetObjectIdExtendedInfo: Caller does not have write access. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, Fcb: %5!p!, FileRef: 0x%6!I64x!, Ccb FullFileName: %7!S!, Ccb access flags: 0x%8!08x!, Irp Minor Function: 0x%9!08x!.

�NtfsDeleteObjectId: Caller does not have write access. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, Fcb: %5!p!, FileRef: 0x%6!I64x!, Ccb FullFileName: %7!S!, Ccb access flags: 0x%8!08x!, Irp Minor Function: 0x%9!08x!.

NtfsFsQuotaSetInfo: Denying access due to administrator limit. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!.

DNtfsCommonSetQuota: Caller does not have manage volume privilege and it's not quota file. Thread: %1!p!, TypeOfOpen: %2!d!, Vcb: %3!p!, VolumeName: %4!S!, VolumeLabel: %5!S!, Fcb: %6!p!, FileRef: 0x%7!I64x!, Ccb FullFileName: %8!S!, Ccb access flags: 0x%9!08x!, Ccb Flags: 0x%10!08x!.

|Unexpected Paging-Read on DAX mappable stream, Scb=%1!p!

�NtfsSetReparsePoint: Caller does not have write access. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, Fcb: %5!p!, FileRef: %6!I64x!, Ccb FullFileName: %7!S!, Ccb Access flags: 0x%8!08x!, File Object Write Access: %9!d!.

�NtfsSetReparsePointEx: Caller does not have write access. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, Fcb: %5!p!, FileRef: %6!I64x!, Ccb FullFileName: %7!S!, Ccb Access flags: 0x%8!08x!, File Object Write Access: %9!d!.

�NtfsDeleteReparsePoint: Caller does not have write access. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, Fcb: %5!p!, FileRef: %6!I64x!, Ccb FullFileName: %7!S!, Ccb Access flags: 0x%8!08x!, File Object Write Access: %9!d!.

NtfsReleaseVcbCheckDelete - NtfsDeleteVcb() returned FALSE; scheduling checkpoint. Vcb: %1!p!, Vcb->LogFileObject: %2!p!, IC: %3!p!

|NtfsReleaseVcbCheckDelete - deleted Vcb: %1!p!, IC: %2!p!

�NtfsReleaseVcbCheckDelete - Scheduling checkpoint due to dismounted Vcb: %1!p!, Vcb->LogFileObject: %2!p!, IC: %3!p!

|NtfsAbortTransaction IC: %1!p!, TransactionId: 0x%2!08x!

�DoAction::InitializeFRS IC:%1!p!, FileRef:0x%2!04x!_%3!08x!, BaseFRS:0x%4!012I64x!

�DoAction::DeallocateFRS IC:%1!p!, FileRef:0x%2!04x!_%3!08x!, BaseFRS:0x%4!012I64x!

DoAction::WriteEndOfFRS IC:%1!p!, FileRef:0x%2!04x!_%3!08x!, BaseFRS:0x%4!012I64x!, Attrib:0x%5!x! Off:0x%6!x!, Len:0x%7!x!

�DoAction::CreateAttribute IC:%1!p!, FileRef:0x%2!04x!_%3!08x!, BaseFRS:0x%4!012I64x!, Attrib:0x%5!x!

�NtfsRestartChangeValue IC:%1!p!, FileRef:0x%2!04x!_%3!08x!, BaseFRS:0x%4!012I64x!, FileRef:0x%5!I64x!

�DoAction::SetNewAttributeSizes IC:%1!p!, FileRef:0x%2!04x!_%3!08x!, BaseFRS:0x%4!012I64x! OLD: Alloc:%5!I64x!, FileSize:%6!I64x!, VDL:%7!I64x!, TotalAlloc:%8!I64x! NEW: Alloc:%9!I64x!, FileSize:%10!I64x!, VDL:%11!I64x!, TotalAlloc:%12!I64x!

�DoAction(SetBitsInNonresidentBitMap) IC: %1!p!, Vcb: %2!p!, Bitmap: %3!p!

�DoAction(ClearBitsInNonresidentBitMap) IC: %1!p!, Vcb: %2!p!, Bitmap: %3!p!

dNtfsUpgradeFileSecurity: Denying access due to volume does not support Txf. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, Fcb: %5!p!, FileRef: %6!I64x!.

�NtfsCaseSensitiveInfoAccessCheck: Caller does not have write access. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, Fcb: %5!p!, FileRef: %6!I64x!, Ccb FullFileName: %7!S!, Ccb Access flags: 0x%8!08x!.

�NtfsCaseSensitiveInfoAccessCheck: Caller does not have appropriate access. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, Fcb: %5!p!, FileRef: %6!I64x!, Ccb FullFileName: %7!S!.

�NtfsCheckFileForDelete: Denying access due to there are same-tx handles open to this file. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, Fcb: %5!p!, FileRef: %6!I64x!, Txf Writers Count: %7!d!.

�NtfsCheckFileForDelete: Denying access due to TxfCheckForLockConflict failed. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, Fcb: %5!p!, FileRef: %6!I64x!, Original status: %7!S!.

�NtfsCheckFileForDelete: Denying access due to superseding view indexes are not allowed. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, Fcb: %5!p!, FileRef: %6!I64x!, File Attributes: 0x%7!08x!.

�NtfsCheckFileForDelete: Denying access due to non-posix delete of target directory open is not allowed. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, Fcb: %5!p!, FileRef: %6!I64x!, File Attributes: 0x%7!08x!.

XNtfsCheckFileForDelete: Denying access due to file is not deleteable. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, Fcb: %5!p!, FileRef: %6!I64x!.

�NtfsCheckFileForDelete: Denying access due to target file is read only. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, Fcb: %5!p!, FileRef: %6!I64x!, File Attributes: 0x%7!08x!, IrpSp->Flags: 0x%8!08x!.

NtfsCheckFileForDelete: Caller does not have write attributes access (TxfAccessCheck failed). Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, Fcb: %5!p!, FileRef: %6!I64x!, Ccb AccessFlags: 0x%7!08x!, TxfAccessCheck access status: %8!S!.

�NtfsCheckFileForDelete: Denying access due to failing to remove image section. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, Fcb: %5!p!, FileRef: %6!I64x!, Scb: %7!p!, AttributeTypeCode: 0x%8!x!, Attribute Name: %9!S!.

�NtfsGlobalSdUpdate: Caller does not have manage volume privilege. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, Fcb: %5!p!, FileRef: %6!I64x!, Ccb FullFileName: %7!S!, Ccb access flags: 0x%8!08x!.

(NtfsRepairItem: Denying access due to volume is locked. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, VcbState: 0x%5!08x!.

�NtfsSetRepairState: Caller does not have manage volume privilege. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, Fcb: %5!p!, FileRef: %6!I64x!, Ccb FullFileName: %7!S!, Ccb access flags: 0x%8!08x!.

�NtfsInitiateRepair: Caller does not have manage volume privilege. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, Fcb: %5!p!, FileRef: %6!I64x!, Ccb FullFileName: %7!S!, Ccb access flags: 0x%8!08x!.

PNTFS ETW tracing is shutting down.

�NtfsDefineStorageReserve: Caller does not have manage volume privilege. Thread: %1!p!, TypeOfOpen: %2!d!, Vcb: %3!p!, VolumeName: %4!S!, VolumeLabel: %5!S!, Fcb: %6!p!, FileRef: %7!I64x!, Ccb FullFileName: %8!S!, Ccb access flags: 0x%9!08x!.

�NtfsDeleteStorageReserve: Caller does not have manage volume privilege. Thread: %1!p!, TypeOfOpen: %2!d!, Vcb: %3!p!, VolumeName: %4!S!, VolumeLabel: %5!S!, Fcb: %6!p!, FileRef: %7!I64x!, Ccb FullFileName: %8!S!, Ccb access flags: 0x%9!08x!.

�NtfsRepairStorageReserve: Caller does not have manage volume privilege. Thread: %1!p!, TypeOfOpen: %2!d!, Vcb: %3!p!, VolumeName: %4!S!, VolumeLabel: %5!S!, Fcb: %6!p!, FileRef: %7!I64x!, Ccb FullFileName: %8!S!, Ccb access flags: 0x%9!08x!.

�NtfsSetStorageReserveIdInfo: System files are not allowed to be part of a storage reserve. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, Fcb: %5!p!, FileRef: %6!I64x!, Fcb State: 0x%7!08x!, Ccb FullFileName: %8!S!.

�NtfsSetStorageReserveIdInfo: Caller does not have appropriate access. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, Fcb: %5!p!, FileRef: %6!I64x!, Ccb FullFileName: %7!S!, Ccb access flags: 0x%8!08x!.

NtfsChangeStorageReserveId: Caller does not have manage volume privilege. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, Fcb: %5!p!, FileRef: %6!I64x!, Ccb FullFileName: %7!S!, Ccb access flags: 0x%8!08x!, Operation flags: 0x%9!08x!.

DNtfsChangeStorageReserveId: Caller does not have manage volume privilege to explicitly setting reserve ID to/from a "restricted area". Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, Fcb: %5!p!, FileRef: %6!I64x!, Ccb FullFileName: %7!S!, Ccb access flags: 0x%8!08x!.

�Failed to get a non-volatile token for Vcb: %1!p!, Status: %2!S!

�Failed to free non-volatile token for Vcb: %1!p!, Status: %2!S!

�NtfsRestoreScbSnapshots: Restored TotalAllocated, Scb: %1!p!, TotalAllocated: 0x%2!I64x!

�NtfsGetDeallocatedClusters: Lsn updated for DeallocatedClusters: %1!p!, Lsn: %2!I64x!

�ClustersLinkAsHead: %1!p!, FlagsToMatch: 0x%2!x!, InsertAfter: %3!S!

HClusters: %1!p!, Flags: 0x%2!x!

hMatching cluster: %1!p!, NumberOfRuns: 0x%2!x!

(Clusters: %1!p!

PAllocated new deallocated clusters

�Need to add Range. DanglingMdl: %1!S!, DeallocatedClusters: %2!p!, Lcn: %3!I64x!, ClusterCount: %4!I64x!

�Added range. DanglingMdl: %1!S!, DeallocatedClusters: %2!p!, Lcn: %3!I64x!, ClusterCount: %4!I64x!

�TxfCheckForLockConflict: File locked for modify transaction. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!,Fcb: %5!p!, FileRef: 0x%6!I64x!, TxfFcb Flags: 0x%7!08x!, ShareMode: 0x%8!08x!.

�TxfCheckForLockConflict: Locking transaction is doomed and caller is non-trans or different trans who wants to modify. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, Fcb: %5!p!, FileRef: 0x%6!I64x!, Granted Access: 0x%7!08x!.

pTxfCheckForLockConflict: Modification access desired. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, Fcb: %5!p!, FileRef: 0x%6!I64x!, Granted Access: 0x%7!08x!.

TxfCheckForLockConflict: File has user handle opened on one of the versions or user-mapping on a section. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, Fcb: %5!p!, FileRef: 0x%6!I64x!, Granted Access: 0x%7!08x!, Reader cleanup count: %8!d!.

�%1!S!: from %2!S! (%3!S!:%4!d!) RM at 0x%5!p! {%6!S!}, Tx at 0x%7!p! {%8!S!}, Status was 0x%9!x!

�%1!S!: RM at 0x%2!p! {%3!S!} aborting transaction at 0x%4!p! {%5!S!}

�%1!S!: RM at 0x%2!p! {%3!S!}: Unexpected exception code of 0x%4!x! received.

�%1!S!: TxfStartRm reports RM will be reset: RM metadata corrupt

�%1!S!: TxfStartRm reports RM will be reset: TM could not be initialized

�%1!S!: TxfStartRm reports RM will be reset: RM log corrupt

�%1!S!: TxfStartRm reports RM will be reset: log version changed

�%1!S!: TxfStartRm reports RM will be reset: dedicated log found, need multiplexed

�%1!S!: TxfStartRm reports RM will be reset: multiplexed log found, need dedicated

�%1!S!: TxfStartRm reports RM will be reset: CLFS log metadata corrupt

p%1!S!: TxfStartRm reports RM will be reset: 0x%2!x!

�%1!S!: RM did not start and WILL NOT be reset, status code is 0x%2!x!!

h%1!S!: Could not initialize IrpContext: 0x%2!x!

�TxfInitializeVolume: Denying access due to Txf start is not allowed (possible racing with dismount or volume shutdown). Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, FxfVcb flags: 0x%5!08x!.

�%1!S!: IOCTL_VOLUME_GET_GPT_ATTRIBUTES returned 0x%2!x! for default RM on VCB at 0x%3!p!

�%1!S!: Exception code 0x%2!x!, Status 0x%3!x! for default RM on VCB at 0x%4!p!

�%1!S!: Couldn't reset default RM on VCB at 0x%2!p! after %3!d! tries: 0x%4!x!

%1!S!: Exception 0x%2!x! raised from TxfConvertRmStartFailureStatusCode for default RM on VCB at 0x%3!p!.  RM will NOT be reset.

�%1!S!: %2!S! auto-restart of RM at 0x%3!p! ({%4!S!}): 0x%5!x!

|%1!S!: Attempting auto-restart of RM at 0x%2!p! ({%3!S!})

|%1!S!: Volume too small to start RM at 0x%2!p! ({%3!S!})

�%1!S!: Corrupt RM at 0x%2!p! {%3!S!}: invalid flags in $Tops

�TxfStartRm: Denying access due to Txf start is not allowed (possible racing with dismount or volume shutdown). Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, FxfVcb flags: 0x%5!08x!.

�%1!S!: Raising to reset RM at 0x%2!p! ({%3!S!}): Explicit reset requested

|%1!S!: Corrupt RM at 0x%2!p! {%3!S!}: no TXF_DATA in root

�%1!S!: RM at 0x%2!p! {%3!S!}: Different nesting levels of 0x%4!x! and 0x%5!x!

�%1!S!: Corrupt RM at 0x%2!p! {%3!S!}: restart area already exists

�%1!S!: Corrupt RM at 0x%2!p! {%3!S!}: RmID in restart area does not match {%4!S!}

�%1!S!: Got %2!d! from ClfsGetLogFileInformation for RM at 0x%3!p! {%4!S!}

�%1!S!: Corrupt RM at 0x%2!p! {%3!S!}: Restart LSN is before beginning of log.

�%1!S!: Corrupt RM at 0x%2!p! {%3!S!}: MinRollforwardEndLsn is beyond end of log.

x%1!S!: TxF RM at 0x%2!p! {%3!S!} started successfully.

�%1!S!: TxF RM at 0x%2!p! {%3!S!} failed to start with Status 0x%4!x! %5!S!

�%1!S!: Shutting down %2!S! RM at 0x%3!p! {%4!S!}.  Shutdown is %5!S!

|%1!S!: Setting RM at 0x%2!p! {%3!S!} up for auto-restart.

�TxfFlushAndInvalidateExistingStructures: File has open user handles. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, Fcb: %5!p!, FileRef: 0x%6!I64x!, CleanupCount: %7!d!.

�(%1!S!:%2!d!) - TXF_HARD_ERROR on RM at 0x%3!p! ({%4!S!}): %5!S!)

t%1!S!: Renamed RM at 0x%2!p! from {%3!S!} to {%4!S!}

�%1!S!: RM at 0x%2!p! {%3!S!}, rolling back Tx at 0x%4!p! {%5!S!}, Status was 0x%6!x!

@TxfFsctlStartRm: Denying access due starting default RM is not allowed. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, RmRootFcb: %5!p!.

HTxfFsctlWriteBackupInformation: Denying access due RM is active. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, BackupInfo flags: 0x%5!08x!.

�%1!S!: Corrupt RM at 0x%2!p! {%3!S!}: Found too high of a TxF ID in log

�%1!S!: Error Setting Delete Disposition: 0x%2!x!  FileObject: 0x%3!p!

�%1!S!: Corrupt RM at 0x%2!p! {%3!S!}: Got a RECOVER notification for a transaction that isn't in-doubt

HTxfSetupTransactionContextFromCcb: Modifying operation is now allowed with a non-TxF modify handle. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, Fcb: %5!p!, FileRef: %6!I64x!, Scb: %7!p!, Attribute Type Code: 0x%8!x!, Ccb FullFileName: %9!S!, Ccb flags: 0x%10!08x!.

�TxfSetupTransactionContextFromCcb: Invalid TxF structure. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, Fcb: %5!p!, FileRef: %6!I64x!, Scb: %7!p!, TxfFo: %8!p!, KtmTrans: %9!p!, TxfRmcb: %10!p!, Ccb FullFileName: %11!S!

tTxfSetupTransactionContextFromCcb: Denying access of modifying operation on a read-only handle. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, Fcb: %5!p!, FileRef: %6!I64x!, Scb: %7!p!, Ccb FullFileName: %8!S!, Ccb access flags: 0x%9!08x!, FO write access: %10!d!, FO delete access: %11!d!.

t%1!S!: RM at 0x%2!p! {%3!S!} raising 0x%4!x! to KTM!

�%1!S!: Commit (0x%2!x!) of%3!S!tx {%4!S!} on RM at 0x%5!p! {%6!S!} failed with 0x%7!x!

�%1!S!: RM at 0x%2!p! {%3!S!} aborting transaction at 0x%4!p! {%5!S!} (notify commit)

�%1!S!: RM at 0x%2!p! {%3!S!} aborting transaction at 0x%4!p! {%5!S!} (notify rollback)

�%1!S!: Error doing IRP_MJ_FLUSH_BUFFERS on RM at 0x%2!p! {%3!S!}: 0x%4!x!

�%1!S!: RM at 0x%2!p! {%3!S!} trying to abort transaction at 0x%4!p! {%5!S!}

�%1!S!: Aborting call stack: 0x%2!p! 0x%3!p! 0x%4!p! 0x%5!p! 0x%6!p!

�%1!S!: 0x%2!x! initializing IrpContext for tx at %3!p! {%4!S!}, RM at %5!p! {%6!S!}

�%1!S!: 0x%2!x! writing log record for RM at 0x%3!p! {%4!S!}, Tx at 0x%5!p! {%6!S!}

x%1!S!: About to force aborts on RM at 0x%2!p! {%3!S!}.

�%1!S!: BaseLsn is greater than TargetLsn on RM at 0x%2!p! {%3!S!}.

x%1!S!: No transactions remain on RM at 0x%2!p! {%3!S!}.

�%1!S!: Transaction's first undo LSN greater than TargetLsn on RM at 0x%2!p! {%3!S!}.

�%1!S!: RM at 0x%2!p! {%3!S!} surprise-aborting transaction at 0x%4!p! {%5!S!}

�%1!S!: RM at 0x%2!p! {%3!S!} got 0x%4!x! from TxfTryAbortTransaction on Tx 0x%5!p! {%6!S!}

X%1!S!: Inactive RM at 0x%2!p! {%3!S!}.

h%1!S!: Log is pinned on RM at 0x%2!p! {%3!S!}.

�%1!S!: RM at 0x%2!p! {%3!S!}, rolling back KTM Tx at 0x%4!p! {%5!S!}, Status was 0x%6!x!

�%1!S!: Log pinned trying to advance RestartLsn on RM at 0x%2!p! {%3!S!}.

�%1!S!: Log pinned by doomed transaction on RM at 0x%2!p! {%3!S!}.

�%1!S!: Reporting 0x%2!X! to CLFS from RM at 0x%3!p! {%4!S!}: 0x%5!x!

t%1!S!: Done forcing aborts on RM at 0x%2!p! {%3!S!}.

�%1!S!: Corrupt RM at 0x%2!p! {%3!S!}: $Txf directory is missing in pre-existing RM

�%1!S!: Corrupt RM at 0x%2!p! {%3!S!}: Found $Txf without DUP_INDEX_IS_DOLLAR_TXF_DIRECTORY

�%1!S!: Corrupt RM at 0x%2!p! {%3!S!}: Found non-empty $Txf but there is no log

�%1!S!: Corrupt RM at 0x%2!p! {%3!S!}: Couldn't find $INDEX_ROOT on $Txf

�%1!S!: Corrupt RM at 0x%2!p! {%3!S!}: Couldn't find TXF_DATA_ATTR on $Txf

�%1!S!: Corrupt RM at 0x%2!p! {%3!S!}: Found TXF_DATA_ATTR for normal file on $Txf

�%1!S!: Corrupt RM at 0x%2!p! {%3!S!}: Expected a secondary RM here

�%1!S!: Corrupt RM at 0x%2!p! {%3!S!}: $Tops is missing but $Txf is non-empty

�%1!S!: Corrupt RM at 0x%2!p! {%3!S!}: $Tops is missing but there is already a log

t%1!S!: Corrupt RM at 0x%2!p! {%3!S!}: $Tops is %4!S!

�%1!S!: Corrupt RM at 0x%2!p! {%3!S!}: Missing $STANDARD_INFORMATION

�%1!S!: Corrupt RM at 0x%2!p! {%3!S!}: Couldn't find file attributes

x%1!S!: Corrupt RM at 0x%2!p! {%3!S!}: $Tops is corrupt

�%1!S!: Corrupt RM at 0x%2!p! {%3!S!}: Could not find unnamed data stream

�%1!S!: Corrupt RM at 0x%2!p! {%3!S!}: $Tops metadata is the wrong version or records wrong size

�%1!S!: Corrupt RM at 0x%2!p! {%3!S!}: $Tops metadata is the wrong size

�%1!S!: Corrupt RM at 0x%2!p! {%3!S!}: Non-NULL RM ID found in $Tops and there is no log

�%1!S!: Corrupt RM at 0x%2!p! {%3!S!}: Epoch in $Tops metadata doesn't match RM

�%1!S!: Corrupt RM at 0x%2!p! {%3!S!}: Couldn't find $T stream

�NtfsReadUsnJournal: Caller does not have manage volume privilege. Thread: %1!p!, TypeOfOpen: %2!d!, Vcb: %3!p!, VolumeName: %4!S!, VolumeLabel: %5!S!, Fcb: %6!p!, FileRef: %7!I64x!, Ccb FullFileName: %8!S!, Ccb access flags: 0x%9!08x!.

hTrimUsnJournal (%1!p!, %2!p!): Decided to trim usn journal.  FirstValidUsn %3!I64x!, new FirstValidUsn %4!I64x!, FS %5!I64x!, AS %6!I64x!, MaxSize %7!I64x!, DeltaSize %8!I64x!

�TrimUsnJournal (%1!p!, %2!p!): About to delete allocation till %3!I64x!, SavedReserve %4!I64x!, RequiredReserve %5!I64x!

�TrimUsnJournal (%1!p!, %2!p!): Before trimming journal AS %3!I64x!, FS %4!I64x!, VDL %5!I64x!, TA %6!I64x!

�TrimUsnJournal (%1!p!, %2!p!): After trimming journal AS %3!I64x!, FS %4!I64x!, VDL %5!I64x!, TA %6!I64x!

xTrimUsnJournal (%1!p!, %2!p!): Mapping pairs validated

`TrimUsnJournal (%1!p!, %2!p!): Checkpointed

\NtfsQueryUsnJournal: Denying access due to NULL Ccb. Thread: %1!p!, TypeOfOpen: %2!d!, Vcb: %3!p!, VolumeName: %4!S!, VolumeLabel: %5!S!, Fcb: %6!p!, FileRef: %7!I64x!.

�NtfsDeleteUsnJournal: Caller does not have manage volume access. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, Fcb: %5!p!, FileRef: %6!I64x!, Ccb FullFileName: %7!S!, Ccb access flags: 0x%8!08x!.

�NtfsRestartUsnJournal: Caller does not have manage volume privilege. Thread: %1!p!, TypeOfOpen: %2!d!, Vcb: %3!p!, VolumeName: %4!S!, VolumeLabel: %5!S!, Fcb: %6!p!, FileRef: %7!I64x!, Ccb FullFileName: %8!S!, Ccb access flags: 0x%9!08x!.

�NtOfsCreateAttributeEx: Stream already has a open user handle. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, Fcb: %5!p!, FileRef: 0x%6!I64x!, Scb: %7!p!, Scb Type Code: 0x%8!x!, Scb Name: %9!S!, Scb CleanupCount: %10!d!.

�OfsSetLength (%1!p!,%2!p!,%3!p!,%4!p!): Extending journal from AS %5!I64x!, FS %6!I64x!, VDL %7!I64x!, to AS %8!I64x!

�OfsSetLength (%1!p!,%2!p!,%3!p!,%4!p!): Done extending journal AS %5!I64x!, FS %6!I64x!, VDL %7!I64x!, TA %8!I64x!

�OfsSetLength (%1!p!,%2!p!,%3!p!,%4!p!): After NtfsWriteFileSizes

�OfsSetLength (%1!p!,%2!p!,%3!p!,%4!p!): After NtfsSetCcFileSizesUsnBiasAware

�NtOfsPostNewLength (%1!p!,%2!p!,%3!p!): Status %4!x! before calling NtfsReadUsnJournal

NtfsIsRegionDangling: RemainingClusterCount: 0x%1!I64x!, Scb: %2!p!, Vcn: 0x%3!I64x!, Lcn: 0x%4!I64x!, Clusters: 0x%5!I64x!

LVcb %1!p! - has *no* active PFNs

�Vcb %1!p! - failed to query active PFNs assuming there are some

@Vcb %1!p! - has active PFNs

TNtfsPerformDismountOnVcb: Vcb %1!p! 

�NtfsPerformDismountOnVcb: Vcb %1!p! - Found frozen deallocated clusters

�NtfsPerformDismountOnVcb: Vcb %1!p! - Wait for any on going trim to finish

�NtfsPerformDismountOnVcb: Vcb %1!p! - No more on going trim

�NtfsPerformDismountOnVcb: IC: %1!p!, Vcb: %2!p!, Label: %3!S!, DeviceName: %4!S!

0NtfsPostVcbIsCorrupt(%1!p!, %2!x!, %3!p!, %4!p!, %5!016I64x!): IrpContext->TopLevelIrpContext->ExceptionStatus == %6!x! before NtfsSetVcbDirtyFlag.

�NtfsPostVcbIsCorrupt: Marking volume dirty.  Vcb %1!p!, WasDirty: %2!x!, FileReference %3!I64x!, Source %4!016I64x!

XNtfsCommonSetVolumeInfo: Operation is only allowed on a VolumeOpen except for IndexOpen of \$Extend\$Quota with FileFsControlInformation. Thread: %1!p!, TypeOfOpen: %2!d!, Vcb: %3!p!, VolumeName: %4!S!, VolumeLabel: %5!S!, Fcb: %6!p!, FileRef: %7!I64x!, FsInformationClass: 0x%8!x!, Scb: %9!p!.

�Succeeding log write @ 0x%1!08x!%2!08x! after getting 0x%3!x! in top-level irpcontext

�Unexpected Paging-Write on stream accessed in Direct-Access mode, Scb=%1!p!

�NtfsCommonWrite: Writing beyond highest writable sector on active volume is not allowed. Thread: %1!p!, Vcb: %2!p!, VolumeName: %3!S!, VolumeLabel: %4!S!, RequestedRange: 0x%5!I64x!, AllowedRange: 0x%6!I64x!.

�Ignoring write to 0x%1!I64x!, SCB length is 0x%2!I64x! for SCB 0x%3!Ix!

�Truncating write from 0x%1!I64x! to 0x%2!I64x! for SCB 0x%3!Ix!

FALSE

TRUE

false

true

CRIM��C�&=7�8�"2ܼ$WEVT������	|�
�����������`PMAPS���VMAP$���VMAP$���BOOLEANboolTTBL��TEMPDM��H�QS�6$C�H����D�	EventDataA��9�oData!K�NameA10_Vcn
A��}�oDataeK�Name)A11_Attribute->Form.Nonresident.LowestVcn
A���oDatagK�Name*A12_Attribute->Form.Nonresident.HighestVcn
A��W�oData?K�NameA13_AllocationClusters
Pd�A10_VcnXA11_Attribute->Form.Nonresident.LowestVcn\A12_Attribute->Form.Nonresident.HighestVcn4A13_AllocationClustersTEMP<(=�<�`K[|w�|e�����D�	EventDataA��G�oData/K�NameA10_IrpContext
A��9�oData!K�NameA11_Scb
Pt$A10_IrpContextA11_ScbTEMPd��r��]���N<�3���D�	EventDataA��G�oData/K�NameA10_FileObject
A��9�oData!K�NameA11_Scb
A��I�oData1K�NameA12_StartingVcn
A��K�oData3K�NameA13_ClusterCount
A��=�oData%K�Name	A14_Flags
A��U�oData=K�NameA15_CcbForWriteExtend
 DX|��$A10_FileObjectA11_Scb$A12_StartingVcn(A13_ClusterCountA14_Flags0A15_CcbForWriteExtendTEMP�X���#�	Z��2����8D�	EventDataA��G�oData/K�NameA10_IrpContext
A��G�oData/K�NameA11_FileObject
A��9�oData!K�NameA12_Scb
A��I�oData1K�NameA13_StartingVcn
A��K�oData3K�NameA14_ClusterCount
A��=�oData%K�Name	A15_Flags
A��U�oData=K�NameA16_CcbForWriteExtend
�,@d��$A10_IrpContext$A11_FileObjectA12_Scb$A13_StartingVcn(A14_ClusterCountA15_Flags0A16_CcbForWriteExtendTEMP@�
/p��L�:Xٚć�->���D�	EventDataA��9�oData!K�NameA10_Scb
A��I�oData1K�NameA11_PurgeOffset
�
�
A10_Scb$A11_PurgeOffsetTEMP�L%B	�UN\��Q{�;���D�	EventDataA��9�oData!K�NameA10_Scb
A��I�oData1K�NameA11_PurgeOffset
A��S�oData;K�NameA12_PurgeChunkLength
���A10_Scb$A11_PurgeOffset0A12_PurgeChunkLengthTEMP�8���$X�-�j��W���D�	EventDataA��G�oData/K�NameA10_IrpContext
A��C�oData+K�NameA11_*LastVcn
A��Y�oDataAK�NameA12_Attribute->Instance
t��$A10_IrpContext A11_*LastVcn4A12_Attribute->InstanceTEMP\�	8����mW9m<֐3�����D�	EventDataA����oDatasK�Name0A10_NtfsFullFileRefNumber( _Fcb->FileReference )
�hA10_NtfsFullFileRefNumber( _Fcb->FileReference )TEMP�����T-&qhlG^���D�	EventDataA��G�oData/K�NameA10_IrpContext
A��I�oData1K�NameA11_ValueLength
A��O�oData7K�NameA12_AttributeFlags
��$A10_IrpContext$A11_ValueLength,A12_AttributeFlagsTEMP�5U4�U�i�"k����TD�	EventDataA��9�oData!K�NameA10_Vcb
A��G�oData/K�NameA11_IrpContext
A��9�oData!K�NameA12_Scb
A��}�oDataeK�Name)A13_*(PULONGLONG)_Scb->Fcb->FileReference
A��A�oData)K�NameA14_LastVcn
A��M�oData5K�NameA15_NewHighestVcn
A��E�oData-K�Name
A16_PassCount
Pd���8A10_Vcb$A11_IrpContextA12_ScbXA13_*(PULONGLONG)_Scb->Fcb->FileReferenceA14_LastVcn(A15_NewHighestVcn A16_PassCountTEMP4��0x#���SRC�������^D�	EventDataA��9�oData!K�NameA10_Vcb
A��G�oData/K�NameA11_IrpContext
A��9�oData!K�NameA12_Scb
A��}�oDataeK�Name)A13_*(PULONGLONG)_Scb->Fcb->FileReference
A����oData�K�NameAA14_Context->FoundAttribute.Attribute->Form.Nonresident.LowestVcn
A����oData�K�NameBA15_Context->FoundAttribute.Attribute->Form.Nonresident.HighestVcn
A����oDataiK�Name+A16_Context->AttributeList.Entry->LowestVcn
x����0A10_Vcb$A11_IrpContextA12_ScbXA13_*(PULONGLONG)_Scb->Fcb->FileReference�A14_Context->FoundAttribute.Attribute->Form.Nonresident.LowestVcn�A15_Context->FoundAttribute.Attribute->Form.Nonresident.HighestVcn\A16_Context->AttributeList.Entry->LowestVcnTEMP�l#�����IZA8�H�K�����D�	EventDataA��9�oData!K�NameA10_Vcb
A��G�oData/K�NameA11_IrpContext
A��9�oData!K�NameA12_Scb
A��}�oDataeK�Name)A13_*(PULONGLONG)_Scb->Fcb->FileReference
A����oData�K�NameAA14_Context->FoundAttribute.Attribute->Form.Nonresident.LowestVcn
A����oData�K�NameBA15_Context->FoundAttribute.Attribute->Form.Nonresident.HighestVcn
A����oDataiK�Name+A16_Context->AttributeList.Entry->LowestVcn
A��E�oData-K�Name
A17_PassCount
$ $D$X$�$8%�% &A10_Vcb$A11_IrpContextA12_ScbXA13_*(PULONGLONG)_Scb->Fcb->FileReference�A14_Context->FoundAttribute.Attribute->Form.Nonresident.LowestVcn�A15_Context->FoundAttribute.Attribute->Form.Nonresident.HighestVcn\A16_Context->AttributeList.Entry->LowestVcn A17_PassCountTEMP�t([{܊��[��I��B��D�	EventDataA��9�oData!K�NameA10_Vcb
A��G�oData/K�NameA11_IrpContext
A��9�oData!K�NameA12_Scb
A��}�oDataeK�Name)A13_*(PULONGLONG)_Scb->Fcb->FileReference
A����oDatauK�Name1A14_NtfsFrsConsolidationStatistics.MergeSkipCount
�(�()$)|)A10_Vcb$A11_IrpContextA12_ScbXA13_*(PULONGLONG)_Scb->Fcb->FileReferencehA14_NtfsFrsConsolidationStatistics.MergeSkipCountTEMP�8,�6x.�^��Z�3��� D�	EventDataA��u�oData]K�Name%A10_FileRecord->SegmentNumberHighPart
A��s�oData[K�Name$A11_FileRecord->SegmentNumberLowPart
A����oData�K�Name?A12_NtfsFullSegmentNumber( _FileRecord->BaseFileRecordSegment )
A��Y�oDataAK�NameA13_Attribute->TypeCode
�,�,(-�-PA10_FileRecord->SegmentNumberHighPartPA11_FileRecord->SegmentNumberLowPart�A12_NtfsFullSegmentNumber( _FileRecord->BaseFileRecordSegment )4A13_Attribute->TypeCodeTEMP��0�~�E.��W��p�b����D�	EventDataA��C�oData+K�NameA10_Fcb->Vcb
A��G�oData/K�NameA11_IrpContext
A��s�oData[K�Name$A12_*(PULONGLONG)_Fcb->FileReference
A��q�oDataYK�Name#A13_StdInfoAttrListEntry->Signature
A����oDataiK�Name+A14_StdInfoAttrListEntry->LastCompactedSize
A��c�oDataKK�NameA15_CurrentAttributeListSize
$1D1h1�12`2 A10_Fcb->Vcb$A11_IrpContextPA12_*(PULONGLONG)_Fcb->FileReferenceLA13_StdInfoAttrListEntry->Signature\A14_StdInfoAttrListEntry->LastCompactedSize@A15_CurrentAttributeListSizeTEMP�5�ܴJ�0�]�V���/���D�	EventDataA��C�oData+K�NameA10_Fcb->Vcb
A��G�oData/K�NameA11_IrpContext
A��s�oData[K�Name$A12_*(PULONGLONG)_Fcb->FileReference
A��q�oDataYK�Name#A13_StdInfoAttrListEntry->Signature
A����oDataiK�Name+A14_StdInfoAttrListEntry->LastCompactedSize
A����oDatamK�Name-A15_NewStdInfoAttrListEntry.LastCompactedSize
6$6H6�6�6@7 A10_Fcb->Vcb$A11_IrpContextPA12_*(PULONGLONG)_Fcb->FileReferenceLA13_StdInfoAttrListEntry->Signature\A14_StdInfoAttrListEntry->LastCompactedSize`A15_NewStdInfoAttrListEntry.LastCompactedSizeTEMP�:\�?Uۑ�R���f��G��4D�	EventDataA��G�oData/K�NameA10_IrpContext
A��5�oDataK�NameA11_i
A��a�oDataIK�NameA12_MAX_MOVEABLE_ATTRIBUTES
A��Y�oDataAK�NameA13_Attribute->TypeCode
A��a�oDataIK�NameA14_Attribute->RecordLength
A��Y�oDataAK�NameA15_Attribute->Instance
�:�:�:�:$;`;$A10_IrpContextA11_i<A12_MAX_MOVEABLE_ATTRIBUTES4A13_Attribute->TypeCode<A14_Attribute->RecordLength4A15_Attribute->InstanceTEMP>x����jS�Ma[�}{��>D�	EventDataA��G�oData/K�NameA10_IrpContext
A��G�oData/K�NameA11_SizeNeeded
A��Y�oDataAK�NameA12_Attribute->TypeCode
A��a�oDataIK�NameA13_Attribute->RecordLength
A��Y�oDataAK�NameA14_Attribute->FormCode
A��Y�oDataAK�NameA15_Attribute->Instance
�>�>�>�>8?l?$A10_IrpContext$A11_SizeNeeded4A12_Attribute->TypeCode<A13_Attribute->RecordLength4A14_Attribute->FormCode4A15_Attribute->InstanceTEMP �A3p�*�]�
]]U����D�	EventDataA��G�oData/K�NameA10_IrpContext
A��G�oData/K�NameA11_SizeNeeded
A��I�oData1K�NameA12_BytesToFree
A��Q�oData9K�NameA13_MappingPairSize
A��W�oData?K�NameA14_NewMappingPairSize
�AB<B`B�B$A10_IrpContext$A11_SizeNeeded$A12_BytesToFree,A13_MappingPairSize4A14_NewMappingPairSizeTEMP\PEp�؊8�_�?0?-�����ZD�	EventDataA��u�oData]K�Name%A10_FileRecord->SegmentNumberHighPart
A��s�oData[K�Name$A11_FileRecord->SegmentNumberLowPart
A����oData�K�Name?A12_NtfsFullSegmentNumber( _FileRecord->BaseFileRecordSegment )
A��E�oData-K�Name
A13_StartZero
A��G�oData/K�NameA14_ZeroLength
�EFTF�F�FPA10_FileRecord->SegmentNumberHighPartPA11_FileRecord->SegmentNumberLowPart�A12_NtfsFullSegmentNumber( _FileRecord->BaseFileRecordSegment ) A13_StartZero$A14_ZeroLengthTEMP�K@P��,�]��@��g6����D�	EventDataA��9�oData!K�NameA10_Vcb
A��G�oData/K�NameA11_IrpContext
A��9�oData!K�NameA12_Scb
A��}�oDataeK�Name)A13_*(PULONGLONG)_Scb->Fcb->FileReference
A��_�oDataGK�NameA14_Scb->AttributeTypeCode
A��Y�oDataAK�NameA15__Scb->AttributeName
A��I�oData1K�NameA16_NewStartVcn
A��M�oData5K�NameA17_NewHalfWayVcn
A��I�oData1K�NameA18_NewFinalVcn
A��G�oData/K�NameA19_PackedMode
	A��C�oData+K�NameA20_TryPrior
�KL$L8L�L�LM$MLMpM�MA10_Vcb$A11_IrpContextA12_ScbXA13_*(PULONGLONG)_Scb->Fcb->FileReference<A14_Scb->AttributeTypeCode4A15__Scb->AttributeName$A16_NewStartVcn(A17_NewHalfWayVcn$A18_NewFinalVcn$A19_PackedMode A20_TryPriorTEMP �Q,���C0}Q#�O�;����D�	EventDataA��9�oData!K�NameA10_Vcb
A��G�oData/K�NameA11_IrpContext
A��9�oData!K�NameA12_Scb
A��}�oDataeK�Name)A13_*(PULONGLONG)_Scb->Fcb->FileReference
A��_�oDataGK�NameA14_Scb->AttributeTypeCode
A��Y�oDataAK�NameA15__Scb->AttributeName
A��g�oDataOK�NameA16_FileRecord->SequenceNumber
A��s�oData[K�Name$A17_FileRecord->SegmentNumberLowPart
A��I�oData1K�NameA18_NewStartVcn
A��A�oData)K�NameA19_LastVcn
	A��I�oData1K�NameA20_NewFinalVcn
�R�RSSlS�S�S TpT�T�TA10_Vcb$A11_IrpContextA12_ScbXA13_*(PULONGLONG)_Scb->Fcb->FileReference<A14_Scb->AttributeTypeCode4A15__Scb->AttributeNameDA16_FileRecord->SequenceNumberPA17_FileRecord->SegmentNumberLowPart$A18_NewStartVcnA19_LastVcn$A20_NewFinalVcnTEMP4�V�l#>�&�V���ci���D�	EventDataA��C�oData+K�NameA10_Scb->Vcb
A��G�oData/K�NameA11_IrpContext
A��9�oData!K�NameA12_Scb
A��}�oDataeK�Name)A13_*(PULONGLONG)_Scb->Fcb->FileReference
A��I�oData1K�NameA14_NewFinalVcn
4WTWxW�W�W A10_Scb->Vcb$A11_IrpContextA12_ScbXA13_*(PULONGLONG)_Scb->Fcb->FileReference$A14_NewFinalVcnTEMP�PZH��7Jp_��)�D�����D�	EventDataA��C�oData+K�NameA10_Scb->Vcb
A��G�oData/K�NameA11_IrpContext
A��9�oData!K�NameA12_Scb
A��}�oDataeK�Name)A13_*(PULONGLONG)_Scb->Fcb->FileReference
A��M�oData5K�NameA14_NewHalfWayVcn
A��C�oData+K�NameA15_RangePtr
�Z�Z[ [x[�[ A10_Scb->Vcb$A11_IrpContextA12_ScbXA13_*(PULONGLONG)_Scb->Fcb->FileReference(A14_NewHalfWayVcn A15_RangePtrTEMP��^�ʘ4�NS}�(�m��D���D�	EventDataA��C�oData+K�NameA10_Scb->Vcb
A��G�oData/K�NameA11_IrpContext
A��9�oData!K�NameA12_Scb
A��}�oDataeK�Name)A13_*(PULONGLONG)_Scb->Fcb->FileReference
A��K�oData3K�NameA14_NtfsMcbArray
A��e�oDataMK�NameA15_NtfsMcbArray->StartingVcn
A��a�oDataIK�NameA16_NtfsMcbArray->EndingVcn
_<_`_t_�_�_4` A10_Scb->Vcb$A11_IrpContextA12_ScbXA13_*(PULONGLONG)_Scb->Fcb->FileReference(A14_NtfsMcbArray@A15_NtfsMcbArray->StartingVcn<A16_NtfsMcbArray->EndingVcnTEMP��b�5�|~yEW\(��ۄ�~�� D�	EventDataA��C�oData+K�NameA10_Scb->Vcb
A��G�oData/K�NameA11_IrpContext
A��9�oData!K�NameA12_Scb
A��}�oDataeK�Name)A13_*(PULONGLONG)_Scb->Fcb->FileReference
A��S�oData;K�NameA14_NewFinalVcnInMcb
A��I�oData1K�NameA15_NewFinalVcn
<c\c�c�c�cd A10_Scb->Vcb$A11_IrpContextA12_ScbXA13_*(PULONGLONG)_Scb->Fcb->FileReference0A14_NewFinalVcnInMcb$A15_NewFinalVcnTEMP�	�iO�i���Z�7��F_��lD�	EventDataA��C�oData+K�NameA10_Scb->Vcb
A��G�oData/K�NameA11_IrpContext
A��9�oData!K�NameA12_Scb
A��}�oDataeK�Name)A13_*(PULONGLONG)_Scb->Fcb->FileReference
A��I�oData1K�NameA14_NewStartVcn
A��A�oData)K�NameA15_LastVcn
A��I�oData1K�NameA16_NewFinalVcn
A��S�oData;K�NameA17_NewFinalVcnInMcb
A��O�oData7K�NameA18_NumberOfRanges
A��[�oDataCK�NameA19_DeletedNextAttribute
	A��c�oDataKK�NameA20_Mcb1StartWithNewStartVcn
A��Y�oDataAK�NameA21_Mcb1HoldNewStartVcn
A��c�oDataKK�NameA22_Mcb2StartWithNewStartVcn
A��Y�oDataAK�NameA23_Mcb2HoldNewStartVcn

A��a�oDataIK�NameA24_McbArraySizeInUseChange
k,kPkdk�k�k�k lPl|l�l�l(mhm�m A10_Scb->Vcb$A11_IrpContextA12_ScbXA13_*(PULONGLONG)_Scb->Fcb->FileReference$A14_NewStartVcnA15_LastVcn$A16_NewFinalVcn0A17_NewFinalVcnInMcb,A18_NumberOfRanges8A19_DeletedNextAttribute@A20_Mcb1StartWithNewStartVcn4A21_Mcb1HoldNewStartVcn@A22_Mcb2StartWithNewStartVcn4A23_Mcb2HoldNewStartVcn<A24_McbArraySizeInUseChangeTEMPdxp��@c[9�ѤP}6���jD�	EventDataA��C�oData+K�NameA10_Scb->Vcb
A��G�oData/K�NameA11_IrpContext
A��9�oData!K�NameA12_Scb
A��}�oDataeK�Name)A13_*(PULONGLONG)_Scb->Fcb->FileReference
A��I�oData1K�NameA14_NewStartVcn
A����oData�K�Name9A15_DeletedNextAttribute ? NewFinalVcnInMcb : (LastVcn-1)
�pq4qHq�q�q A10_Scb->Vcb$A11_IrpContextA12_ScbXA13_*(PULONGLONG)_Scb->Fcb->FileReference$A14_NewStartVcnxA15_DeletedNextAttribute ? NewFinalVcnInMcb : (LastVcn-1)TEMP��t�1��OxT�������D�	EventDataA��C�oData+K�NameA10_Scb->Vcb
A��G�oData/K�NameA11_IrpContext
A��9�oData!K�NameA12_Scb
A��}�oDataeK�Name)A13_*(PULONGLONG)_Scb->Fcb->FileReference
A��A�oData)K�NameA14_LastVcn
A��S�oData;K�NameA15_NewFinalVcnInMcb
u uDuXu�u�u A10_Scb->Vcb$A11_IrpContextA12_ScbXA13_*(PULONGLONG)_Scb->Fcb->FileReferenceA14_LastVcn0A15_NewFinalVcnInMcbTEMP

 z�Sa�$�nX�"�8������D�	EventDataA��C�oData+K�NameA10_Scb->Vcb
A��G�oData/K�NameA11_IrpContext
A��9�oData!K�NameA12_Scb
A��}�oDataeK�Name)A13_*(PULONGLONG)_Scb->Fcb->FileReference
A��_�oDataGK�NameA14_Scb->AttributeTypeCode
A��Y�oDataAK�NameA15__Scb->AttributeName
A����oData�K�Name@A16_*(PULONGLONG)_Context->AttributeList.Entry->SegmentReference
A��K�oData3K�NameA17_OldLowestVcn
A��C�oData+K�NameA18_StartVcn
A��_�oDataGK�NameA19_NewAttribute->Instance
	�z{,{@{�{�{|�|�|�| A10_Scb->Vcb$A11_IrpContextA12_ScbXA13_*(PULONGLONG)_Scb->Fcb->FileReference<A14_Scb->AttributeTypeCode4A15__Scb->AttributeName�A16_*(PULONGLONG)_Context->AttributeList.Entry->SegmentReference(A17_OldLowestVcn A18_StartVcn<A19_NewAttribute->InstanceTEMP����(_��o\Z�x15r���\D�	EventDataA��C�oData+K�NameA10_Scb->Vcb
A��G�oData/K�NameA11_IrpContext
A��9�oData!K�NameA12_Scb
A��}�oDataeK�Name)A13_*(PULONGLONG)_Scb->Fcb->FileReference
A��_�oDataGK�NameA14_Scb->AttributeTypeCode
A��Y�oDataAK�NameA15__Scb->AttributeName
A��K�oData3K�NameA16_OldLowestVcn
A��C�oData+K�NameA17_StartVcn
A��M�oData5K�NameA18_OldHighestVcn
A��A�oData)K�NameA19_LastVcn
	A��g�oDataOK�NameA20_FileRecord->SequenceNumber
A��s�oData[K�Name$A21_FileRecord->SegmentNumberLowPart
����؂�D�����܃��$�@��� A10_Scb->Vcb$A11_IrpContextA12_ScbXA13_*(PULONGLONG)_Scb->Fcb->FileReference<A14_Scb->AttributeTypeCode4A15__Scb->AttributeName(A16_OldLowestVcn A17_StartVcn(A18_OldHighestVcnA19_LastVcnDA20_FileRecord->SequenceNumberPA21_FileRecord->SegmentNumberLowPartTEMP���X��Sj^<'Cc�5���|D�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
��8A10_PsGetCurrentThread()TEMP���&|b1��Pg�6�o���D�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��9�oData!K�NameA11_Vcb
A��S�oData;K�NameA12__Vcb->VolumeName
A����oData�K�NameXA13_WppCountedStringW( Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Vcb->Vpb ) )
A��E�oData-K�Name
A14__VolumeId
A��M�oData5K�NameA15_Vcb->VcbState
�L�`���H�h�8A10_PsGetCurrentThread()A11_Vcb0A12__Vcb->VolumeName�A13_WppCountedStringW( Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Vcb->Vpb ) ) A14__VolumeId(A15_Vcb->VcbStateTEMP4����xp��Wmd@�AzN���D�	EventDataA��9�oData!K�NameA10_Vcb
A��G�oData/K�NameA11_IrpContext
A��9�oData!K�NameA12_Fcb
A��s�oData[K�Name$A13_*(PULONGLONG)_Fcb->FileReference
A��]�oDataEK�NameA14_AllFlags.FirstRequest
��(�<���A10_Vcb$A11_IrpContextA12_FcbPA13_*(PULONGLONG)_Fcb->FileReference8A14_AllFlags.FirstRequestTEMP�\����n�6Vɏ#&cC��bD�	EventDataA��9�oData!K�NameA10_Vcb
A��G�oData/K�NameA11_IrpContext
A��9�oData!K�NameA12_Fcb
A��s�oData[K�Name$A13_*(PULONGLONG)_Fcb->FileReference
�������A10_Vcb$A11_IrpContextA12_FcbPA13_*(PULONGLONG)_Fcb->FileReferenceTEMPl
0�D���)��QyR$6�Ah���D�	EventDataA��9�oData!K�NameA10_Vcb
A��G�oData/K�NameA11_IrpContext
A��9�oData!K�NameA12_Fcb
A��s�oData[K�Name$A13_*(PULONGLONG)_Fcb->FileReference
A����oData}K�Name5A14_FrsConsolidationContext->RestartAttributeTypeCode
A����oDatawK�Name2A15__FrsConsolidationContext->RestartAttributeName
A��y�oDataaK�Name'A16_FrsConsolidationContext->RestartVcn
A����oData�K�Name<A17_FrsConsolidationContext->RestartAttributeListEntryOffset
A��c�oDataKK�NameA18_AttributeListEntryOffset
A����oData�K�NameMA19_AttrContext.AttributeList.AttributeList->Form.Nonresident.ValidDataLength
	A��Y�oDataAK�NameA20_AttributeListGrowBy
A��Y�oDataAK�NameA21_AttributeListGrowBy
 �4�X�l���,����l���L���A10_Vcb$A11_IrpContextA12_FcbPA13_*(PULONGLONG)_Fcb->FileReferencepA14_FrsConsolidationContext->RestartAttributeTypeCodelA15__FrsConsolidationContext->RestartAttributeNameTA16_FrsConsolidationContext->RestartVcn�A17_FrsConsolidationContext->RestartAttributeListEntryOffset@A18_AttributeListEntryOffset�A19_AttrContext.AttributeList.AttributeList->Form.Nonresident.ValidDataLength4A20_AttributeListGrowBy4A21_AttributeListGrowByTEMP@	

��!@J�lXޘ��Y) ��D�	EventDataA��9�oData!K�NameA10_Vcb
A��G�oData/K�NameA11_IrpContext
A��9�oData!K�NameA12_Fcb
A��s�oData[K�Name$A13_*(PULONGLONG)_Fcb->FileReference
A����oData}K�Name5A14_FrsConsolidationContext->RestartAttributeTypeCode
A����oDatawK�Name2A15__FrsConsolidationContext->RestartAttributeName
A��y�oDataaK�Name'A16_FrsConsolidationContext->RestartVcn
A��u�oData]K�Name%A17_FrsConsolidationContext->Instance
A����oData�K�Name<A18_FrsConsolidationContext->RestartAttributeListEntryOffset
A����oData�K�NameMA19_AttrContext.AttributeList.AttributeList->Form.Nonresident.ValidDataLength
	��̠��T�ġ0���ԢT�A10_Vcb$A11_IrpContextA12_FcbPA13_*(PULONGLONG)_Fcb->FileReferencepA14_FrsConsolidationContext->RestartAttributeTypeCodelA15__FrsConsolidationContext->RestartAttributeNameTA16_FrsConsolidationContext->RestartVcnPA17_FrsConsolidationContext->Instance�A18_FrsConsolidationContext->RestartAttributeListEntryOffset�A19_AttrContext.AttributeList.AttributeList->Form.Nonresident.ValidDataLengthTEMP�̥Y4~?�"T]�ʀ��զ���D�	EventDataA��9�oData!K�NameA10_Vcb
A��G�oData/K�NameA11_IrpContext
A��9�oData!K�NameA12_Fcb
A��s�oData[K�Name$A13_*(PULONGLONG)_Fcb->FileReference
A��9�oData!K�NameA14_Scb
0�D�h�|�̦A10_Vcb$A11_IrpContextA12_FcbPA13_*(PULONGLONG)_Fcb->FileReferenceA14_ScbTEMP4Ш�S�X�M8[FޖBP����D�	EventDataA��9�oData!K�NameA10_Vcb
A��G�oData/K�NameA11_IrpContext
A����oData�K�Name8A12_*(PULONGLONG)_FrsConsolidationContext->FileReference
A��i�oDataQK�NameA13_IrpContext->ExceptionStatus
 �4�X�ЩA10_Vcb$A11_IrpContextxA12_*(PULONGLONG)_FrsConsolidationContext->FileReferenceDA13_IrpContext->ExceptionStatusTEMP�Ы��'����Wn~V��#���D�	EventDataA��9�oData!K�NameA10_Vcb
A��G�oData/K�NameA11_IrpContext
A��9�oData!K�NameA12_Fcb
A��A�oData)K�NameA13_FileRef
A��Q�oData9K�NameA14_ExceptionStatus
4�H�l�����A10_Vcb$A11_IrpContextA12_FcbA13_FileRef,A14_ExceptionStatusTEMPH�Lb���@Y�┃�[	+��LD�	EventDataA��9�oData!K�NameA10_Vcb
A��G�oData/K�NameA11_IrpContext
A��9�oData!K�NameA12_Fcb
A��A�oData)K�NameA13_FileRef
A��G�oData/K�NameA14_RemovedFcb
A��[�oDataCK�NameA15_AllFlags.FcbAcquired
A��e�oDataMK�NameA16_IrpContext->TransactionId
ԯ�� �<�`���A10_Vcb$A11_IrpContextA12_FcbA13_FileRef$A14_RemovedFcb8A15_AllFlags.FcbAcquired@A16_IrpContext->TransactionIdTEMP0�Žn�#�Z�x���|���$D�	EventDataA��9�oData!K�NameA10_Vcb
A��G�oData/K�NameA11_IrpContext
A����oData�K�Name=A12_(EndTime.QuadPart*1000)/NtfsPerformanceFrequency.QuadPart
	A����oData�K�NameOA13_(FrsConsolidationContext->TotalTime*1000)/NtfsPerformanceFrequency.QuadPart
	����		��		8�A10_Vcb$A11_IrpContext�A12_(EndTime.QuadPart*1000)/NtfsPerformanceFrequency.QuadPart�A13_(FrsConsolidationContext->TotalTime*1000)/NtfsPerformanceFrequency.QuadPartTEMP���i����DoU�ةw<����D�	EventDataA��C�oData+K�NameA10_Fcb->Vcb
A��G�oData/K�NameA11_IrpContext
A��s�oData[K�Name$A12_*(PULONGLONG)_Fcb->FileReference
A��q�oDataYK�Name#A13_StdInfoAttrListEntry->Signature
A����oDataiK�Name+A14_StdInfoAttrListEntry->LastCompactedSize
A��U�oData=K�NameA15_AttributeListSize
�0�T����L� A10_Fcb->Vcb$A11_IrpContextPA12_*(PULONGLONG)_Fcb->FileReferenceLA13_StdInfoAttrListEntry->Signature\A14_StdInfoAttrListEntry->LastCompactedSize0A15_AttributeListSizeTEMP<

4������ [��� &4G���D�	EventDataA��G�oData/K�NameA10_IrpContext
A��9�oData!K�NameA11_Vcb
A��9�oData!K�NameA12_Scb
A��E�oData-K�Name
A13__Scb->Mcb
A��Y�oDataAK�NameA14_OriginalStartingVcn
A��K�oData3K�NameA15_ClusterCount
A��I�oData1K�NameA16_AllocateAll
A����oData{K�Name4A17_(TargetLcn != NULL) ? *TargetLcn : (ULONGLONG)-1
A��K�oData3K�NameA18_PreAllocated
A��[�oDataCK�NameA19_UseDelayedAllocation
	�� �4�H�h����ľ��X����$A10_IrpContextA11_VcbA12_Scb A13__Scb->Mcb4A14_OriginalStartingVcn(A15_ClusterCount$A16_AllocateAllpA17_(TargetLcn != NULL) ? *TargetLcn : (ULONGLONG)-1(A18_PreAllocated8A19_UseDelayedAllocationTEMP��h�N#
l]643�l���D�	EventDataA��U�oData=K�NameA10_FoundClusterCount
A��9�oData!K�NameA11_Scb
A��Y�oDataAK�NameA12_Scb->TotalAllocated
@�p���0A10_FoundClusterCountA11_Scb4A12_Scb->TotalAllocatedTEMP��c7>m�9W@�ԟ��Q�� D�	EventDataA��U�oData=K�NameA10_FoundClusterCount
A��9�oData!K�NameA11_Scb
A��Y�oDataAK�NameA12_Scb->TotalAllocated
A��G�oData/K�NameA13_Scb->State
A��W�oData?K�NameA14_IrpContext->State2
A��W�oData?K�NameA15_AllocateWithNoHole
�������� �T�0A10_FoundClusterCountA11_Scb4A12_Scb->TotalAllocated$A13_Scb->State4A14_IrpContext->State24A15_AllocateWithNoHoleTEMPt����}����U��uԖ�qT���D�	EventDataA��G�oData/K�NameA10_IrpContext
A��U�oData=K�NameA11_ClustersAllocated
�����$A10_IrpContext0A11_ClustersAllocatedTEMP,�[��u�ZR�O���'�����D�	EventDataA��G�oData/K�NameA10_IrpContext
A��9�oData!K�NameA11_Vcb
A��9�oData!K�NameA12_Scb
A��E�oData-K�Name
A13__Scb->Mcb
A��I�oData1K�NameA14_StartingVcn
A��E�oData-K�Name
A15_EndingVcn
x����������$A10_IrpContextA11_VcbA12_Scb A13__Scb->Mcb$A14_StartingVcn A15_EndingVcnTEMP���F�,f9�=]�W��G����zD�	EventDataA��9�oData!K�NameA10_Vcb
A��}�oDataeK�Name)A11_*(PULONGLONG)_Scb->Fcb->FileReference
A��I�oData1K�NameA12_StartingVcn
A��E�oData-K�Name
A13_EndingVcn
(�<�����A10_VcbXA11_*(PULONGLONG)_Scb->Fcb->FileReference$A12_StartingVcn A13_EndingVcnTEMP���E����\��S�����|D�	EventDataA��9�oData!K�NameA10_Vcb
A��}�oDataeK�Name)A11_*(PULONGLONG)_Scb->Fcb->FileReference
A��?�oData'K�Name
A12_AdjLcn
A��Q�oData9K�NameA13_AdjClusterCount
����D�`�A10_VcbXA11_*(PULONGLONG)_Scb->Fcb->FileReferenceA12_AdjLcn,A13_AdjClusterCountTEMP���\Ѭg��]����X����ZD�	EventDataA��9�oData!K�NameA10_Vcb
0�A10_VcbTEMP�����͖'WP�(4�9�m��D�	EventDataA��9�oData!K�NameA10_Vcb
A��Y�oDataAK�NameA11_DeallocatedClusters
A��u�oData]K�Name%A12_DeallocatedClusters->Lsn.QuadPart
A��u�oData]K�Name%A13_DeallocatedClusters->ClusterCount
A��g�oDataOK�NameA14_DeallocatedClusters->Flags
A��c�oDataKK�NameA15_Vcb->DeallocatedClusters
A����oDataoK�Name.A16_Vcb->DeallocatedClusters + AdjClusterCount
�0�d����H���A10_Vcb4A11_DeallocatedClustersPA12_DeallocatedClusters->Lsn.QuadPartPA13_DeallocatedClusters->ClusterCountDA14_DeallocatedClusters->Flags@A15_Vcb->DeallocatedClustersdA16_Vcb->DeallocatedClusters + AdjClusterCountTEMPt|��W��b��Y6�9/8Vg7��ZD�	EventDataA��K�oData3K�NameA10_ClusterCount
A��9�oData!K�NameA11_Scb
A��Q�oData9K�NameA12_*TotalAllocated
A��O�oData7K�NameA13_TotalAllocated
�����4�(A10_ClusterCountA11_Scb,A12_*TotalAllocated,A13_TotalAllocatedTEMPD���_�W���2�B9���D�	EventDataA��K�oData3K�NameA10_ClusterCount
A��9�oData!K�NameA11_Scb
A��O�oData7K�NameA12_TotalAllocated
A��G�oData/K�NameA13_Scb->State
A��W�oData?K�NameA14_IrpContext->State2
�������4�(A10_ClusterCountA11_Scb,A12_TotalAllocated$A13_Scb->State4A14_IrpContext->State2TEMPt���u�1s��]u�MYl����ND�	EventDataA��9�oData!K�NameA10_Vcb
A��c�oDataKK�NameA11_Vcb->DeallocatedClusters
A����oDatakK�Name,A12_Vcb->DeallocatedClusters-ClustersRemoved
(�<�|�A10_Vcb@A11_Vcb->DeallocatedClusters`A12_Vcb->DeallocatedClusters-ClustersRemovedTEMP|��}>q�q"�Xf?z���:���D�	EventDataA��G�oData/K�NameA10_IrpContext
A��Y�oDataAK�NameA11_ClustersDeallocated
��$�$A10_IrpContext4A11_ClustersDeallocatedTEMPp|��C�n�Q���������D�	EventDataA��G�oData/K�NameA10_IrpContext
A��9�oData!K�NameA11_Vcb
A��C�oData+K�NameA12_FirstBit
A��O�oData7K�NameA13_BeyondFinalBit
A��M�oData5K�NameA14_RedoOperation
A��M�oData5K�NameA15_UndoOperation
���,�L�x���$A10_IrpContextA11_Vcb A12_FirstBit,A13_BeyondFinalBit(A14_RedoOperation(A15_UndoOperationTEMPLD�H�	�<S�5�O��<��FD�	EventDataA��G�oData/K�NameA10_IrpContext
A��A�oData)K�NameA11__Bitmap
A��A�oData)K�NameA12_BaseLcn
A��G�oData/K�NameA13_CurrentLcn
��������$A10_IrpContextA11__BitmapA12_BaseLcn$A13_CurrentLcnTEMPT����E(�&_���B"��JD�	EventDataA��G�oData/K�NameA10_IrpContext
A��9�oData!K�NameA11_Vcb
A��I�oData1K�NameA12_StartingLcn
A��K�oData3K�NameA13_ClusterCount
����@�$A10_IrpContextA11_Vcb$A12_StartingLcn(A13_ClusterCountTEMPL���É
�6�R%��m�~����HD�	EventDataA��G�oData/K�NameA10_IrpContext
A��A�oData)K�NameA11__Bitmap
A��A�oData)K�NameA12_BaseLcn
A��I�oData1K�NameA13_StartingLcn
4�X�t���$A10_IrpContextA11__BitmapA12_BaseLcn$A13_StartingLcnTEMPh<�I�:^*�Z-N�E@���RD�	EventDataA��G�oData/K�NameA10_IrpContext
A��?�oData'K�Name
A11_Bitmap
A��K�oData3K�NameA12_BitMapOffset
A��K�oData3K�NameA13_NumberOfBits
��������$A10_IrpContextA11_Bitmap(A12_BitMapOffset(A13_NumberOfBitsTEMPT�����@g�Q,׉�5�-D��LD�	EventDataA��G�oData/K�NameA10_IrpContext
A��9�oData!K�NameA11_Vcb
A��I�oData1K�NameA12_StartingLcn
A��M�oData5K�NameA13_*ClusterCount
���$�H�$A10_IrpContextA11_Vcb$A12_StartingLcn(A13_*ClusterCountTEMP�8�*@��p��Z;�D��Eɵ���D�	EventDataA��G�oData/K�NameA10_IrpContext
A��9�oData!K�NameA11_Vcb
A��?�oData'K�Name
A12_Bitmap
A��U�oData=K�NameA13_StartingBitmapLcn
A��A�oData)K�NameA14_SetBits
��������� �$A10_IrpContextA11_VcbA12_Bitmap0A13_StartingBitmapLcnA14_SetBitsTEMPT��U�6�*T�N��"���JD�	EventDataA��G�oData/K�NameA10_IrpContext
A��?�oData'K�Name
A11_Bitmap
A��I�oData1K�NameA12_StartingBit
A��E�oData-K�Name
A13_EndingBit
�0�L�p�$A10_IrpContextA11_Bitmap$A12_StartingBit A13_EndingBitTEMPLt���l\�frTz|��kc�����D�	EventDataA��G�oData/K�NameA10_IrpContext
A��A�oData)K�NameA11_Results
�����$A10_IrpContextA11_ResultsTEMP��w,��-�V��Bq���D�	EventDataA��5�oDataK�NameA10_i
A����oData�K�Name?A11_OriginalSystemBitmap[i / sizeof( OriginalSystemBitmap[0] )]
@�P�A10_i�A11_OriginalSystemBitmap[i / sizeof( OriginalSystemBitmap[0] )]TEMPX�����X�Z9$V�
����D�	EventDataA��?�oData'K�Name
A10_Length
	A��C�oData+K�NameA11_BinIndex
A��9�oData!K�NameA12_Key
A��I�oData1K�NameA13_BitPosition
A��G�oData/K�NameA14_GroupIndex
A��S�oData;K�NameA15_GroupShiftFactor
		d����������A10_Length A11_BinIndexA12_Key$A13_BitPosition$A14_GroupIndex0A15_GroupShiftFactorTEMP�X�͙����]]����T����D�	EventDataA��?�oData'K�Name
A10_Length
	A��C�oData+K�NameA11_BinIndex
A��E�oData-K�Name
A12_TotalBins
		�����A10_Length A11_BinIndex A12_TotalBinsTEMP�$����J�qZ�n�+��D�	EventDataA��C�oData+K�NameA10_BinIndex
A��I�oData1K�NameA11_MAXLONGLONG
	A��E�oData-K�Name
A12_TotalBins
`�		���� A10_BinIndex$A11_MAXLONGLONG A12_TotalBinsTEMP����7{9�T�c��T�����D�	EventDataA��C�oData+K�NameA10_BinIndex
A��E�oData-K�Name
A11_MaxLength
	A��G�oData/K�NameA12_GroupIndex
A��S�oData;K�NameA13_RelativeBinIndex
A��?�oData'K�Name
A14_MaxKey
��		<`� A10_BinIndex A11_MaxLength$A12_GroupIndex0A13_RelativeBinIndexA14_MaxKeyTEMP�@�T[;��jQcz��W���`D�	EventDataA��g�oDataOK�NameA10_NtfsCachedRunBinGroupShift
A��e�oDataMK�NameA11_NtfsCachedRunBinGroupSize
A��e�oDataMK�NameA12_NtfsCachedRunBinGroupMask
|�DA10_NtfsCachedRunBinGroupShift@A11_NtfsCachedRunBinGroupSize@A12_NtfsCachedRunBinGroupMaskTEMP�p�A��W]�P���nUi���D�	EventDataA��C�oData+K�NameA10_BinIndex
A��E�oData-K�Name
A11_MaxLength

A��E�oData-K�Name
A12_MaxLength
�

�� A10_BinIndex A11_MaxLength A12_MaxLengthTEMP�0��}���-_I��ȳ���D�	EventDataA��Q�oData9K�NameA10_StartingCluster
A��K�oData3K�NameA11_ClusterCount
A��i�oDataQK�NameA12_Vcb->TotalClustersCommitted
A��W�oData?K�NameA13_Vcb->TotalClusters
A��U�oData=K�NameA14_Vcb->FreeClusters
���,`,A10_StartingCluster(A11_ClusterCountDA12_Vcb->TotalClustersCommitted4A13_Vcb->TotalClusters0A14_Vcb->FreeClustersTEMP�	^�b{���\ZUb@�ܹ��D�	EventDataA��9�oData!K�NameA10_Vcb
A��Q�oData9K�NameA11_FirstBitToClear
A��c�oDataKK�NameA12_BeyondLastBitToClear - 1

0
\
A10_Vcb,A11_FirstBitToClear@A12_BeyondLastBitToClear - 1TEMP��1�H�4�\r�����@��D�	EventDataA��9�oData!K�NameA10_Vcb
A��U�oData=K�NameA11_*FreeClusterBase1
A��W�oData?K�NameA12_*FreeClusterCount1
 4dA10_Vcb0A11_*FreeClusterBase14A12_*FreeClusterCount1TEMP��
�ۘ�	!X�R�3�(G���D�	EventDataA��9�oData!K�NameA10_Vcb
A��U�oData=K�NameA11_*FreeClusterBase2
A��W�oData?K�NameA12_*FreeClusterCount2
0`A10_Vcb0A11_*FreeClusterBase24A12_*FreeClusterCount2TEMP���3�ΒAY�&��T5����D�	EventDataA��9�oData!K�NameA10_Vcb
A��[�oDataCK�NameA11_PsGetCurrentThread()
A��i�oDataQK�NameA12_Vcb->TotalClustersCommitted
A��W�oData?K�NameA13_Vcb->TotalClusters
A��a�oDataIK�NameA14_Vcb->TPMap.SizeOfBitMap
 4l��A10_Vcb8A11_PsGetCurrentThread()DA12_Vcb->TotalClustersCommitted4A13_Vcb->TotalClusters<A14_Vcb->TPMap.SizeOfBitMapTEMP�	��Z�T�V]�~#������D�	EventDataA��e�oDataMK�NameA10_IrpContext->MajorFunction
�@A10_IrpContext->MajorFunctionTEMP�$L��~ۨMY:�h�l����D�	EventDataA��9�oData!K�NameA10_Scb
A��K�oData3K�NameA11_StartingZero
A��E�oData-K�Name
A12_ByteCount
A��U�oData=K�NameA13_ExtentsDescriptor
A��a�oDataIK�NameA14_*ExtentsDescriptorIndex
A��m�oDataUK�Name!A15_*ExtentsDescriptorStartOffset
A��?�oData'K�Name
A16_Offset
A��A�oData)K�NameA17_MaxRuns
�� P���A10_Scb(A11_StartingZero A12_ByteCount0A13_ExtentsDescriptor<A14_*ExtentsDescriptorIndexHA15_*ExtentsDescriptorStartOffsetA16_OffsetA17_MaxRunsTEMP��?Ht�q_�D�6�Q��vD�	EventDataA��C�oData+K�NameA10_RunIndex
A����oDatamK�Name-A11_ExtentsDescriptor->Run[RunIndex].BasePage
A����oDataoK�Name.A12_ExtentsDescriptor->Run[RunIndex].PageCount
A��K�oData3K�NameA13_ExtentLength
A��?�oData'K�Name
A14_Offset
A��Y�oDataAK�NameA15_RunIndexStartOffset
0P�<X A10_RunIndex`A11_ExtentsDescriptor->Run[RunIndex].BasePagedA12_ExtentsDescriptor->Run[RunIndex].PageCount(A13_ExtentLengthA14_Offset4A15_RunIndexStartOffsetTEMPd|Et-��=�Q\$�ub]ja���D�	EventDataA��O�oData7K�NameA10_LengthInExtent
A��E�oData-K�Name
A11_ByteCount
��,A10_LengthInExtent A11_ByteCountTEMP�j~��Di9Y�����D�	EventDataA��m�oDataUK�Name!A10_StartingPhysicalAddr.QuadPart
A��O�oData7K�NameA11_LengthInExtent
0xHA10_StartingPhysicalAddr.QuadPart,A11_LengthInExtentTEMP�� ���D�\M�06��.���D�	EventDataA��a�oDataIK�NameA10_*ExtentsDescriptorIndex
A��m�oDataUK�Name!A11_*ExtentsDescriptorStartOffset
� 4!<A10_*ExtentsDescriptorIndexHA11_*ExtentsDescriptorStartOffsetTEMP��"����1y>Z-��A�8��D�	EventDataA��9�oData!K�NameA10_Scb
A��O�oData7K�NameA11_StartingOffset
A��Q�oData9K�NameA12_BeyondEndOffset
�"#4#A10_Scb,A11_StartingOffset,A12_BeyondEndOffsetTEMPtd%��te!^���g����D�	EventDataA��U�oData=K�NameA10_DataSetRangeIndex
A����oData�K�Name>A11_DsmBuffer->DataSetRanges[DataSetRangeIndex].StartingOffset
A����oData�K�Name=A12_DsmBuffer->DataSetRanges[DataSetRangeIndex].LengthInBytes
�%�%T&0A10_DataSetRangeIndex�A11_DsmBuffer->DataSetRanges[DataSetRangeIndex].StartingOffset�A12_DsmBuffer->DataSetRanges[DataSetRangeIndex].LengthInBytesTEMP��'�=w��/�S? ��MF���D�	EventDataA��]�oDataEK�NameA10_RemainingClusterCount
A��U�oData=K�NameA11_DataSetRangeIndex
(D(8A10_RemainingClusterCount0A11_DataSetRangeIndexTEMP\�)�f��>�^��vi/���8D�	EventDataA����oDatamK�Name-A10_DsmByteAddressRanges->TotalNumberOfRanges
A����oDatasK�Name0A11_DsmByteAddressRanges->NumberOfRangesReturned
*h*`A10_DsmByteAddressRanges->TotalNumberOfRangeshA11_DsmByteAddressRanges->NumberOfRangesReturnedTEMP��,(�a���]Q!�&����*���D�	EventDataA��=�oData%K�Name	A10_Index
A����oData{K�Name4A11_DsmByteAddressRanges->Ranges[Index].StartAddress
A����oData}K�Name5A12_DsmByteAddressRanges->Ranges[Index].LengthInBytes
�,�,\-A10_IndexpA11_DsmByteAddressRanges->Ranges[Index].StartAddresspA12_DsmByteAddressRanges->Ranges[Index].LengthInBytesTEMP��.j~��Di9Y�����D�	EventDataA��m�oDataUK�Name!A10_StartingPhysicalAddr.QuadPart
A��O�oData7K�NameA11_LengthInExtent
/T/HA10_StartingPhysicalAddr.QuadPart,A11_LengthInExtentTEMP��2j:�q2.~WK���H��D�	EventDataA��9�oData!K�NameA10_Scb
A��K�oData3K�NameA11_StartingZero
A��Q�oData9K�NameA12_BeyondEndOffset
A��E�oData-K�Name
A13_ByteCount
A��U�oData=K�NameA14_ExtentsDescriptor
A����oData�K�Name8A15_ExtentsDescriptorIndex ? *ExtentsDescriptorIndex : 0
A����oData�K�NameDA16_ExtentsDescriptorStartOffset ? *ExtentsDescriptorStartOffset : 0
H3\3�3�3�34x4A10_Scb(A11_StartingZero,A12_BeyondEndOffset A13_ByteCount0A14_ExtentsDescriptorxA15_ExtentsDescriptorIndex ? *ExtentsDescriptorIndex : 0�A16_ExtentsDescriptorStartOffset ? *ExtentsDescriptorStartOffset : 0TEMPD�6��{�I�Y]�T��y
���DD�	EventDataA��G�oData/K�NameA10_IrpContext
A��9�oData!K�NameA11_Scb
A��I�oData1K�NameA12_StartOffset
A��E�oData-K�Name
A13_ByteCount
�6�67,7$A10_IrpContextA11_Scb$A12_StartOffset A13_ByteCountTEMP��7�p"X��S��Î@�	���hD�	EventDataA��G�oData/K�NameA10_IrpContext
�7$A10_IrpContextTEMP��8��u\�7Y4`��G�(���hD�	EventDataA��G�oData/K�NameA10_TypeOfOpen
�8$A10_TypeOfOpenTEMP��9��� �W���U��S��`D�	EventDataA��?�oData'K�Name
A10_Status
�9A10_StatusTEMP�L:��� �W���U��S��`D�	EventDataA��?�oData'K�Name
A10_Status
`:A10_StatusTEMP�	@‹��`�]�¾��
W��RD�	EventDataA��9�oData!K�NameA10_Irp
A��G�oData/K�NameA11_IrpContext
A��9�oData!K�NameA12_Vcb
A��e�oDataMK�NameA13_CreateContext->FileObject
A����oDatasK�Name0A14_CreateContext->FileObject->RelatedFileObject
A��{�oDatacK�Name(A15__CreateContext->FileObject->FileName
A����oDatayK�Name3A16_CreateContext->IrpSp->Parameters.Create.Options
A����oData�K�Name:A17_CreateContext->IrpSp->Parameters.Create.FileAttributes
A��k�oDataSK�Name A18_CreateContext->DesiredAccess
A����oData�K�Name7A19_CreateContext->IrpSp->Parameters.Create.ShareAccess
	A����oData{K�Name4A20_CreateContext->IrpSp->Parameters.Create.EaLength
�@�@A,AlA�A,B�BC\C�CA10_Irp$A11_IrpContextA12_Vcb@A13_CreateContext->FileObjecthA14_CreateContext->FileObject->RelatedFileObjectXA15__CreateContext->FileObject->FileNamelA16_CreateContext->IrpSp->Parameters.Create.Options|A17_CreateContext->IrpSp->Parameters.Create.FileAttributesHA18_CreateContext->DesiredAccesstA19_CreateContext->IrpSp->Parameters.Create.ShareAccesspA20_CreateContext->IrpSp->Parameters.Create.EaLengthTEMP�	�IK�F�L�S���4�Fk���RD�	EventDataA��9�oData!K�NameA10_Irp
A��G�oData/K�NameA11_IrpContext
A��9�oData!K�NameA12_Vcb
A��e�oDataMK�NameA13_CreateContext->FileObject
A����oDatasK�Name0A14_CreateContext->FileObject->RelatedFileObject
A��{�oDatacK�Name(A15__CreateContext->FileObject->FileName
A����oDatayK�Name3A16_CreateContext->IrpSp->Parameters.Create.Options
A����oData�K�Name:A17_CreateContext->IrpSp->Parameters.Create.FileAttributes
A��k�oDataSK�Name A18_CreateContext->DesiredAccess
A����oData�K�Name7A19_CreateContext->IrpSp->Parameters.Create.ShareAccess
	A����oData{K�Name4A20_CreateContext->IrpSp->Parameters.Create.EaLength
�J�J�J�J0K�K�K\L�L M�MA10_Irp$A11_IrpContextA12_Vcb@A13_CreateContext->FileObjecthA14_CreateContext->FileObject->RelatedFileObjectXA15__CreateContext->FileObject->FileNamelA16_CreateContext->IrpSp->Parameters.Create.Options|A17_CreateContext->IrpSp->Parameters.Create.FileAttributesHA18_CreateContext->DesiredAccesstA19_CreateContext->IrpSp->Parameters.Create.ShareAccesspA20_CreateContext->IrpSp->Parameters.Create.EaLengthTEMP@�PF�Sgh6�[������1f��LD�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��9�oData!K�NameA11_Vcb
A��S�oData;K�NameA12__Vcb->VolumeName
A����oData�K�NameXA13_WppCountedStringW( Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Vcb->Vpb ) )
A��M�oData5K�NameA14_Vcb->VcbState
�P Q4QdQR8A10_PsGetCurrentThread()A11_Vcb0A12__Vcb->VolumeName�A13_WppCountedStringW( Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Vcb->Vpb ) )(A14_Vcb->VcbStateTEMP�PSCn�����P��b(�2�4���D�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��U�oData=K�NameA11_CreateDisposition
xS�S8A10_PsGetCurrentThread()0A11_CreateDispositionTEMP<tW)�>m%\��$iuH=��^D�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��9�oData!K�NameA11_Vcb
A��S�oData;K�NameA12__Vcb->VolumeName
A����oData�K�NameXA13_WppCountedStringW( Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Vcb->Vpb ) )
A��{�oDatacK�Name(A14_IrpSp->Parameters.Create.ShareAccess
A���oDatagK�Name*A15_ReadULongNoFence( _Vcb->CleanupCount )
A��W�oData?K�NameA16_BiasedCleanupCount
X8XLX|X4Y�Y�Y8A10_PsGetCurrentThread()A11_Vcb0A12__Vcb->VolumeName�A13_WppCountedStringW( Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Vcb->Vpb ) )XA14_IrpSp->Parameters.Create.ShareAccess\A15_ReadULongNoFence( _Vcb->CleanupCount )4A16_BiasedCleanupCountTEMP��];��m��\%�Y�e�����D�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��9�oData!K�NameA11_Vcb
A��S�oData;K�NameA12__Vcb->VolumeName
A����oData�K�NameXA13_WppCountedStringW( Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Vcb->Vpb ) )
A��{�oDatacK�Name(A14_IrpSp->Parameters.Create.ShareAccess
A��a�oDataIK�NameA15_Vcb->ReadOnlyCloseCount
A��Q�oData9K�NameA16_Vcb->CloseCount
A��e�oDataMK�NameA17_Vcb->SystemFileCloseCount
�^�^�^_�_$```�`8A10_PsGetCurrentThread()A11_Vcb0A12__Vcb->VolumeName�A13_WppCountedStringW( Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Vcb->Vpb ) )XA14_IrpSp->Parameters.Create.ShareAccess<A15_Vcb->ReadOnlyCloseCount,A16_Vcb->CloseCount@A17_Vcb->SystemFileCloseCountTEMP4		�db8K� Ї^a��fq�H���D�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��C�oData+K�NameA11_Fcb->Vcb
A��]�oDataEK�NameA12__Fcb->Vcb->VolumeName
A����oData�K�NamebA13_WppCountedStringW( Fcb->Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Fcb->Vcb->Vpb ) )
A��9�oData!K�NameA14_Fcb
A����oDatasK�Name0A15_NtfsFullFileRefNumber( _Fcb->FileReference )
A��U�oData=K�NameA16_Fcb->CleanupCount
A��M�oData5K�NameA17_Fcb->FcbState
A��K�oData3K�NameA18_IrpSp->Flags
�e�ef8fgg�g�g�g8A10_PsGetCurrentThread() A11_Fcb->Vcb8A12__Fcb->Vcb->VolumeName�A13_WppCountedStringW( Fcb->Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Fcb->Vcb->Vpb ) )A14_FcbhA15_NtfsFullFileRefNumber( _Fcb->FileReference )0A16_Fcb->CleanupCount(A17_Fcb->FcbState(A18_IrpSp->FlagsTEMP��kࠔ>s?�W�O�q����D�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��C�oData+K�NameA11_Fcb->Vcb
A��]�oDataEK�NameA12__Fcb->Vcb->VolumeName
A����oData�K�NamebA13_WppCountedStringW( Fcb->Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Fcb->Vcb->Vpb ) )
A��9�oData!K�NameA14_Fcb
A����oDatasK�Name0A15_NtfsFullFileRefNumber( _Fcb->FileReference )
A��M�oData5K�NameA16_Fcb->FcbState
A��K�oData3K�NameA17_IrpSp->Flags
ll�l�l�l�m�mDnln8A10_PsGetCurrentThread() A11_Fcb->Vcb8A12__Fcb->Vcb->VolumeName�A13_WppCountedStringW( Fcb->Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Fcb->Vcb->Vpb ) )A14_FcbhA15_NtfsFullFileRefNumber( _Fcb->FileReference )(A16_Fcb->FcbState(A17_IrpSp->FlagsTEMP�hr^��Y��T��{U������D�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��C�oData+K�NameA11_Fcb->Vcb
A��]�oDataEK�NameA12__Fcb->Vcb->VolumeName
A����oData�K�NamebA13_WppCountedStringW( Fcb->Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Fcb->Vcb->Vpb ) )
A��9�oData!K�NameA14_Fcb
A����oDatasK�Name0A15_NtfsFullFileRefNumber( _Fcb->FileReference )
A��U�oData=K�NameA16_IrpContext->State
A��K�oData3K�NameA17_IrpSp->Flags
s@s`s�sdtxt�tu8A10_PsGetCurrentThread() A11_Fcb->Vcb8A12__Fcb->Vcb->VolumeName�A13_WppCountedStringW( Fcb->Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Fcb->Vcb->Vpb ) )A14_FcbhA15_NtfsFullFileRefNumber( _Fcb->FileReference )0A16_IrpContext->State(A17_IrpSp->FlagsTEMPd			xz��#�?U�1iljW��
D�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��K�oData3K�NameA11_ThisFcb->Vcb
A��e�oDataMK�NameA12__ThisFcb->Vcb->VolumeName
A����oData�K�NamejA13_WppCountedStringW( ThisFcb->Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( ThisFcb->Vcb->Vpb ) )
A��A�oData)K�NameA14_ThisFcb
A����oData{K�Name4A15_NtfsFullFileRefNumber( _ThisFcb->FileReference )
A��U�oData=K�NameA16_ThisFcb->FcbState
A����oData�K�NameJA17_((CreateContext->IrpSp->Parameters.Create.Options >> 24) _ 0x000000ff)
A����oData�K�NameJA18_CreateContext->IrpSp->Parameters.Create.SecurityContext->DesiredAccess
,{d{�{�{�|�|4}d}~8A10_PsGetCurrentThread()(A11_ThisFcb->Vcb@A12__ThisFcb->Vcb->VolumeName�A13_WppCountedStringW( ThisFcb->Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( ThisFcb->Vcb->Vpb ) )A14_ThisFcbpA15_NtfsFullFileRefNumber( _ThisFcb->FileReference )0A16_ThisFcb->FcbState�A17_((CreateContext->IrpSp->Parameters.Create.Options >> 24) _ 0x000000ff)�A18_CreateContext->IrpSp->Parameters.Create.SecurityContext->DesiredAccessTEMP�	�pT�?�ZԒ`�o̅��� D�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��o�oDataWK�Name"A11_CreateContext->CurrentFcb->Vcb
A����oDataqK�Name/A12__CreateContext->CurrentFcb->Vcb->VolumeName
A��G�oData/K�Name�A13_WppCountedStringW( CreateContext->CurrentFcb->Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( CreateContext->CurrentFcb->Vcb->Vpb ) )
A��e�oDataMK�NameA14_CreateContext->CurrentFcb
A����oData�K�NameFA15_NtfsFullFileRefNumber( _CreateContext->CurrentFcb->FileReference )
A����oDatawK�Name2A16_CreateContext->CurrentFcb->Info.FileAttributes
A����oDataqK�Name/A17_CreateContext->CurrentFcb->TxfRmcb->RmState
��Ȅ�x���܆p�܇8A10_PsGetCurrentThread()LA11_CreateContext->CurrentFcb->VcbdA12__CreateContext->CurrentFcb->Vcb->VolumeName$A13_WppCountedStringW( CreateContext->CurrentFcb->Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( CreateContext->CurrentFcb->Vcb->Vpb ) )@A14_CreateContext->CurrentFcb�A15_NtfsFullFileRefNumber( _CreateContext->CurrentFcb->FileReference )lA16_CreateContext->CurrentFcb->Info.FileAttributesdA17_CreateContext->CurrentFcb->TxfRmcb->RmStateTEMP\		|���7��Q����%��D�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��o�oDataWK�Name"A11_CreateContext->CurrentFcb->Vcb
A����oDataqK�Name/A12__CreateContext->CurrentFcb->Vcb->VolumeName
A��G�oData/K�Name�A13_WppCountedStringW( CreateContext->CurrentFcb->Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( CreateContext->CurrentFcb->Vcb->Vpb ) )
A��e�oDataMK�NameA14_CreateContext->CurrentFcb
A����oData�K�NameFA15_NtfsFullFileRefNumber( _CreateContext->CurrentFcb->FileReference )
A��y�oDataaK�Name'A16_CreateContext->CurrentFcb->FcbState
A����oData�K�NameJA17_((CreateContext->IrpSp->Parameters.Create.Options >> 24) _ 0x000000ff)
A����oData�K�NameJA18_CreateContext->IrpSp->Parameters.Create.SecurityContext->DesiredAccess
0�h����<�|��d��8A10_PsGetCurrentThread()LA11_CreateContext->CurrentFcb->VcbdA12__CreateContext->CurrentFcb->Vcb->VolumeName$A13_WppCountedStringW( CreateContext->CurrentFcb->Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( CreateContext->CurrentFcb->Vcb->Vpb ) )@A14_CreateContext->CurrentFcb�A15_NtfsFullFileRefNumber( _CreateContext->CurrentFcb->FileReference )TA16_CreateContext->CurrentFcb->FcbState�A17_((CreateContext->IrpSp->Parameters.Create.Options >> 24) _ 0x000000ff)�A18_CreateContext->IrpSp->Parameters.Create.SecurityContext->DesiredAccessTEMPxP���)�Y=�']���~D�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��K�oData3K�NameA11_ThisFcb->Vcb
A��e�oDataMK�NameA12__ThisFcb->Vcb->VolumeName
A����oData�K�NamejA13_WppCountedStringW( ThisFcb->Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( ThisFcb->Vcb->Vpb ) )
A��A�oData)K�NameA14_ThisFcb
A����oData{K�Name4A15_NtfsFullFileRefNumber( _ThisFcb->FileReference )
A��U�oData=K�NameA16_ThisFcb->FcbState
ܗ�<�|�X�t��8A10_PsGetCurrentThread()(A11_ThisFcb->Vcb@A12__ThisFcb->Vcb->VolumeName�A13_WppCountedStringW( ThisFcb->Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( ThisFcb->Vcb->Vpb ) )A14_ThisFcbpA15_NtfsFullFileRefNumber( _ThisFcb->FileReference )0A16_ThisFcb->FcbStateTEMP�؝�KK�r�~Q�v�t���R���D�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��K�oData3K�NameA11_ThisFcb->Vcb
A��e�oDataMK�NameA12__ThisFcb->Vcb->VolumeName
A����oData�K�NamejA13_WppCountedStringW( ThisFcb->Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( ThisFcb->Vcb->Vpb ) )
A��A�oData)K�NameA14_ThisFcb
A����oData{K�Name4A15_NtfsFullFileRefNumber( _ThisFcb->FileReference )
A��e�oDataMK�NameA16_ThisFcb->TxfRmcb->RmState
d���Ğ����l�8A10_PsGetCurrentThread()(A11_ThisFcb->Vcb@A12__ThisFcb->Vcb->VolumeName�A13_WppCountedStringW( ThisFcb->Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( ThisFcb->Vcb->Vpb ) )A14_ThisFcbpA15_NtfsFullFileRefNumber( _ThisFcb->FileReference )@A16_ThisFcb->TxfRmcb->RmStateTEMP�		���đ6��SQ��(w����D�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��Y�oDataAK�NameA11_ParentScb->Fcb->Vcb
A��s�oData[K�Name$A12__ParentScb->Fcb->Vcb->VolumeName
A���oDataK�NamexA13_WppCountedStringW( ParentScb->Fcb->Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( ParentScb->Fcb->Vcb->Vpb ) )
A��O�oData7K�NameA14_ParentScb->Fcb
A����oData�K�Name;A15_NtfsFullFileRefNumber( _ParentScb->Fcb->FileReference )
A��c�oDataKK�NameA16_ParentScb->Fcb->FcbState
A��s�oData[K�Name$A17_ParentScb->Fcb->TxfRmcb->RmState
A��K�oData3K�NameA18_AttrTypeCode
@�x������ ���ܨ,�8A10_PsGetCurrentThread()4A11_ParentScb->Fcb->VcbPA12__ParentScb->Fcb->Vcb->VolumeName�A13_WppCountedStringW( ParentScb->Fcb->Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( ParentScb->Fcb->Vcb->Vpb ) ),A14_ParentScb->Fcb|A15_NtfsFullFileRefNumber( _ParentScb->Fcb->FileReference )@A16_ParentScb->Fcb->FcbStatePA17_ParentScb->Fcb->TxfRmcb->RmState(A18_AttrTypeCodeTEMPH|�$Ӽ$J-�Q�E>�m����D�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��9�oData!K�NameA11_Vcb
A��e�oDataMK�NameA12__ThisFcb->Vcb->VolumeName
A����oData�K�NamejA13_WppCountedStringW( ThisFcb->Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( ThisFcb->Vcb->Vpb ) )
A��A�oData)K�NameA14_ThisFcb
A����oData{K�Name4A15_NtfsFullFileRefNumber( _ThisFcb->FileReference )
A����oDatayK�Name3A16_CreateContext->IrpSp->Parameters.Create.Options
A��C�oData+K�NameA17_CcbFlags
�T�h��������|�8A10_PsGetCurrentThread()A11_Vcb@A12__ThisFcb->Vcb->VolumeName�A13_WppCountedStringW( ThisFcb->Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( ThisFcb->Vcb->Vpb ) )A14_ThisFcbpA15_NtfsFullFileRefNumber( _ThisFcb->FileReference )lA16_CreateContext->IrpSp->Parameters.Create.Options A17_CcbFlagsTEMP����ҽ��ZP��+Db�Y��2D�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��O�oData7K�NameA11_ParentScb->Vcb
A��i�oDataQK�NameA12__ParentScb->Vcb->VolumeName
A���oData�K�NamenA13_WppCountedStringW( ParentScb->Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( ParentScb->Vcb->Vpb ) )
A��O�oData7K�NameA14_ParentScb->Fcb
A����oData�K�Name;A15_NtfsFullFileRefNumber( _ParentScb->Fcb->FileReference )
A��c�oDataKK�NameA16_ParentScb->Fcb->FcbState
A��s�oData[K�Name$A17_ParentScb->Fcb->TxfRmcb->RmState
��ܵ�L�0�\�ط�8A10_PsGetCurrentThread(),A11_ParentScb->VcbDA12__ParentScb->Vcb->VolumeName�A13_WppCountedStringW( ParentScb->Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( ParentScb->Vcb->Vpb ) ),A14_ParentScb->Fcb|A15_NtfsFullFileRefNumber( _ParentScb->Fcb->FileReference )@A16_ParentScb->Fcb->FcbStatePA17_ParentScb->Fcb->TxfRmcb->RmStateTEMP�����=�^b#rZ�(���FD�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��9�oData!K�NameA11_Vcb
A��S�oData;K�NameA12__Vcb->VolumeName
A����oData�K�NameXA13_WppCountedStringW( Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Vcb->Vpb ) )
A��A�oData)K�NameA14_ThisFcb
A����oData{K�Name4A15_NtfsFullFileRefNumber( _ThisFcb->FileReference )
A��e�oDataMK�NameA16_ThisFcb->TxfRmcb->RmState
p����������0�8A10_PsGetCurrentThread()A11_Vcb0A12__Vcb->VolumeName�A13_WppCountedStringW( Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Vcb->Vpb ) )A14_ThisFcbpA15_NtfsFullFileRefNumber( _ThisFcb->FileReference )@A16_ThisFcb->TxfRmcb->RmStateTEMPD		 ��@\I�RL^��0P����zD�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��K�oData3K�NameA11_ThisFcb->Vcb
A��e�oDataMK�NameA12__ThisFcb->Vcb->VolumeName
A����oData�K�NamejA13_WppCountedStringW( ThisFcb->Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( ThisFcb->Vcb->Vpb ) )
A��A�oData)K�NameA14_ThisFcb
A����oData{K�Name4A15_NtfsFullFileRefNumber( _ThisFcb->FileReference )
A��o�oDataWK�Name"A16_ThisEaInformation->NeedEaCount
A����oDatayK�Name3A17_CreateContext->IrpSp->Parameters.Create.Options
A��C�oData+K�NameA18_CcbFlags
���4�t�P�l���(���8A10_PsGetCurrentThread()(A11_ThisFcb->Vcb@A12__ThisFcb->Vcb->VolumeName�A13_WppCountedStringW( ThisFcb->Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( ThisFcb->Vcb->Vpb ) )A14_ThisFcbpA15_NtfsFullFileRefNumber( _ThisFcb->FileReference )LA16_ThisEaInformation->NeedEaCountlA17_CreateContext->IrpSp->Parameters.Create.Options A18_CcbFlagsTEMP���MC2Z�����ad���D�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��K�oData3K�NameA11_ThisFcb->Vcb
A��e�oDataMK�NameA12__ThisFcb->Vcb->VolumeName
A����oData�K�NamejA13_WppCountedStringW( ThisFcb->Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( ThisFcb->Vcb->Vpb ) )
A��A�oData)K�NameA14_ThisFcb
A����oData{K�Name4A15_NtfsFullFileRefNumber( _ThisFcb->FileReference )
A��K�oData3K�NameA16_AttrTypeCode
A��U�oData=K�NameA17_CreateDisposition
X�����������`���8A10_PsGetCurrentThread()(A11_ThisFcb->Vcb@A12__ThisFcb->Vcb->VolumeName�A13_WppCountedStringW( ThisFcb->Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( ThisFcb->Vcb->Vpb ) )A14_ThisFcbpA15_NtfsFullFileRefNumber( _ThisFcb->FileReference )(A16_AttrTypeCode0A17_CreateDispositionTEMPxl������T)���k��~D�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��K�oData3K�NameA11_ThisFcb->Vcb
A��e�oDataMK�NameA12__ThisFcb->Vcb->VolumeName
A����oData�K�NamejA13_WppCountedStringW( ThisFcb->Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( ThisFcb->Vcb->Vpb ) )
A��A�oData)K�NameA14_ThisFcb
A����oData{K�Name4A15_NtfsFullFileRefNumber( _ThisFcb->FileReference )
A��U�oData=K�NameA16_CreateDisposition
��0�X���t����8A10_PsGetCurrentThread()(A11_ThisFcb->Vcb@A12__ThisFcb->Vcb->VolumeName�A13_WppCountedStringW( ThisFcb->Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( ThisFcb->Vcb->Vpb ) )A14_ThisFcbpA15_NtfsFullFileRefNumber( _ThisFcb->FileReference )0A16_CreateDispositionTEMP4�vSC���^N�����D�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��K�oData3K�NameA11_ThisFcb->Vcb
A��e�oDataMK�NameA12__ThisFcb->Vcb->VolumeName
A����oData�K�NamejA13_WppCountedStringW( ThisFcb->Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( ThisFcb->Vcb->Vpb ) )
A��A�oData)K�NameA14_ThisFcb
A����oData{K�Name4A15_NtfsFullFileRefNumber( _ThisFcb->FileReference )
A��U�oData=K�NameA16_ThisFcb->FcbState
A��K�oData3K�NameA17_AttrTypeCode
���4�t�P�l����8A10_PsGetCurrentThread()(A11_ThisFcb->Vcb@A12__ThisFcb->Vcb->VolumeName�A13_WppCountedStringW( ThisFcb->Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( ThisFcb->Vcb->Vpb ) )A14_ThisFcbpA15_NtfsFullFileRefNumber( _ThisFcb->FileReference )0A16_ThisFcb->FcbState(A17_AttrTypeCodeTEMP<T������^�ӊ��aY'���D�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��K�oData3K�NameA11_ThisFcb->Vcb
A��e�oDataMK�NameA12__ThisFcb->Vcb->VolumeName
A����oData�K�NamejA13_WppCountedStringW( ThisFcb->Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( ThisFcb->Vcb->Vpb ) )
A��A�oData)K�NameA14_ThisFcb
A����oData{K�Name4A15_NtfsFullFileRefNumber( _ThisFcb->FileReference )
A��k�oDataSK�Name A16_ThisFcb->Info.FileAttributes
A��O�oData7K�NameA17_FileAttributes
��,�T���p�����D�8A10_PsGetCurrentThread()(A11_ThisFcb->Vcb@A12__ThisFcb->Vcb->VolumeName�A13_WppCountedStringW( ThisFcb->Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( ThisFcb->Vcb->Vpb ) )A14_ThisFcbpA15_NtfsFullFileRefNumber( _ThisFcb->FileReference )HA16_ThisFcb->Info.FileAttributes,A17_FileAttributesTEMP�`�3�G�^_S20I�������D�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��K�oData3K�NameA11_ThisFcb->Vcb
A��e�oDataMK�NameA12__ThisFcb->Vcb->VolumeName
A����oData�K�NamejA13_WppCountedStringW( ThisFcb->Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( ThisFcb->Vcb->Vpb ) )
A��A�oData)K�NameA14_ThisFcb
A����oData{K�Name4A15_NtfsFullFileRefNumber( _ThisFcb->FileReference )
A����oDatayK�Name3A16_CreateContext->IrpSp->Parameters.Create.Options
��$�L���h�����8A10_PsGetCurrentThread()(A11_ThisFcb->Vcb@A12__ThisFcb->Vcb->VolumeName�A13_WppCountedStringW( ThisFcb->Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( ThisFcb->Vcb->Vpb ) )A14_ThisFcbpA15_NtfsFullFileRefNumber( _ThisFcb->FileReference )lA16_CreateContext->IrpSp->Parameters.Create.OptionsTEMP�		T���Xn�?2]���65�����D�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��K�oData3K�NameA11_ThisFcb->Vcb
A��e�oDataMK�NameA12__ThisFcb->Vcb->VolumeName
A����oData�K�NamejA13_WppCountedStringW( ThisFcb->Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( ThisFcb->Vcb->Vpb ) )
A��A�oData)K�NameA14_ThisFcb
A����oData{K�Name4A15_NtfsFullFileRefNumber( _ThisFcb->FileReference )
A����oDatamK�Name-A16_CreateContext->ThisScb->AttributeTypeCode
A��m�oDataUK�Name!A17_CreateContext->ThisScb->State
A����oDataK�Name6A18_CreateContext->ThisScb->ScbType.Data.HighWaterMark
	�@�h��������p�		��8A10_PsGetCurrentThread()(A11_ThisFcb->Vcb@A12__ThisFcb->Vcb->VolumeName�A13_WppCountedStringW( ThisFcb->Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( ThisFcb->Vcb->Vpb ) )A14_ThisFcbpA15_NtfsFullFileRefNumber( _ThisFcb->FileReference )`A16_CreateContext->ThisScb->AttributeTypeCodeHA17_CreateContext->ThisScb->StatetA18_CreateContext->ThisScb->ScbType.Data.HighWaterMarkTEMP��z�n8�M
Yj+��Y����D�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��9�oData!K�NameA11_Vcb
A��S�oData;K�NameA12__Vcb->VolumeName
A����oData�K�NameXA13_WppCountedStringW( Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Vcb->Vpb ) )
A��E�oData-K�Name
A14_*AttrCode
A��U�oData=K�NameA15_CreateDisposition
x��������8A10_PsGetCurrentThread()A11_Vcb0A12__Vcb->VolumeName�A13_WppCountedStringW( Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Vcb->Vpb ) ) A14_*AttrCode0A15_CreateDispositionTEMP�H����
g��W�L���@���D�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��9�oData!K�NameA11_Vcb
A��S�oData;K�NameA12__Vcb->VolumeName
A����oData�K�NameXA13_WppCountedStringW( Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Vcb->Vpb ) )
A��E�oData-K�Name
A14_*AttrCode
A����oData�K�NamePA15_IrpSp->Parameters.Create.SecurityContext->AccessState->OriginalDesiredAccess
�����<���8A10_PsGetCurrentThread()A11_Vcb0A12__Vcb->VolumeName�A13_WppCountedStringW( Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Vcb->Vpb ) ) A14_*AttrCode�A15_IrpSp->Parameters.Create.SecurityContext->AccessState->OriginalDesiredAccessTEMP|����'��,Sd�Y�$����D�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��E�oData-K�Name
A11_*AttrCode
��8A10_PsGetCurrentThread() A11_*AttrCodeTEMPx
Z����.[��jީ����D�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��K�oData3K�NameA11_ThisScb->Vcb
A��e�oDataMK�NameA12__ThisScb->Vcb->VolumeName
A����oData�K�NamejA13_WppCountedStringW( ThisScb->Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( ThisScb->Vcb->Vpb ) )
A��K�oData3K�NameA14_ThisScb->Fcb
A����oData�K�Name9A15_NtfsFullFileRefNumber( _ThisScb->Fcb->FileReference )
A��A�oData)K�NameA16_ThisScb
A��g�oDataOK�NameA17_ThisScb->AttributeTypeCode
A��a�oDataIK�NameA18__ThisScb->AttributeName
A��{�oDatacK�Name(A19_IrpSp->Parameters.Create.ShareAccess
	A����oData�K�NameRA20_IrpSp->Parameters.Create.SecurityContext->AccessState->PreviouslyGrantedAccess
�,T�p�,p�8A10_PsGetCurrentThread()(A11_ThisScb->Vcb@A12__ThisScb->Vcb->VolumeName�A13_WppCountedStringW( ThisScb->Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( ThisScb->Vcb->Vpb ) )(A14_ThisScb->FcbxA15_NtfsFullFileRefNumber( _ThisScb->Fcb->FileReference )A16_ThisScbDA17_ThisScb->AttributeTypeCode<A18__ThisScb->AttributeNameXA19_IrpSp->Parameters.Create.ShareAccess�A20_IrpSp->Parameters.Create.SecurityContext->AccessState->PreviouslyGrantedAccessTEMP�		8
�Pw�d��Q��	}�i���TD�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��K�oData3K�NameA11_ThisScb->Vcb
A��e�oDataMK�NameA12__ThisScb->Vcb->VolumeName
A����oData�K�NamejA13_WppCountedStringW( ThisScb->Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( ThisScb->Vcb->Vpb ) )
A��K�oData3K�NameA14_ThisScb->Fcb
A����oData�K�Name9A15_NtfsFullFileRefNumber( _ThisScb->Fcb->FileReference )
A��A�oData)K�NameA16_ThisScb
A��g�oDataOK�NameA17_ThisScb->AttributeTypeCode
A��a�oDataIK�NameA18__ThisScb->AttributeName
�
$L�h�$h8A10_PsGetCurrentThread()(A11_ThisScb->Vcb@A12__ThisScb->Vcb->VolumeName�A13_WppCountedStringW( ThisScb->Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( ThisScb->Vcb->Vpb ) )(A14_ThisScb->FcbxA15_NtfsFullFileRefNumber( _ThisScb->Fcb->FileReference )A16_ThisScbDA17_ThisScb->AttributeTypeCode<A18__ThisScb->AttributeNameTEMP�	

^���wVAY�����Oi��*D�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��K�oData3K�NameA11_ThisScb->Vcb
A��e�oDataMK�NameA12__ThisScb->Vcb->VolumeName
A����oData�K�NamejA13_WppCountedStringW( ThisScb->Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( ThisScb->Vcb->Vpb ) )
A��K�oData3K�NameA14_ThisScb->Fcb
A����oData�K�Name9A15_NtfsFullFileRefNumber( _ThisScb->Fcb->FileReference )
A��A�oData)K�NameA16_ThisScb
A��g�oDataOK�NameA17_ThisScb->AttributeTypeCode
A��a�oDataIK�NameA18__ThisScb->AttributeName
A����oData�K�NameRA19_IrpSp->Parameters.Create.SecurityContext->AccessState->PreviouslyGrantedAccess
	�,lHp�H�8A10_PsGetCurrentThread()(A11_ThisScb->Vcb@A12__ThisScb->Vcb->VolumeName�A13_WppCountedStringW( ThisScb->Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( ThisScb->Vcb->Vpb ) )(A14_ThisScb->FcbxA15_NtfsFullFileRefNumber( _ThisScb->Fcb->FileReference )A16_ThisScbDA17_ThisScb->AttributeTypeCode<A18__ThisScb->AttributeName�A19_IrpSp->Parameters.Create.SecurityContext->AccessState->PreviouslyGrantedAccessTEMP�		<��X_ޑQpKNP������D�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��Q�oData9K�NameA11_(*ThisScb)->Vcb
A��k�oDataSK�Name A12__(*ThisScb)->Vcb->VolumeName
A���oData�K�NamepA13_WppCountedStringW( (*ThisScb)->Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( (*ThisScb)->Vcb->Vpb ) )
A��Q�oData9K�NameA14_(*ThisScb)->Fcb
A����oData�K�Name<A15_NtfsFullFileRefNumber( _(*ThisScb)->Fcb->FileReference )
A��C�oData+K�NameA16_*ThisScb
A����oDatamK�Name-A17_(*ThisScb)->MarkHandleDisallowWritesCount
A����oData�K�Name;A18_IrpSp->Parameters.Create.SecurityContext->DesiredAccess
�( T � �!�!0"P"�"8A10_PsGetCurrentThread(),A11_(*ThisScb)->VcbHA12__(*ThisScb)->Vcb->VolumeName�A13_WppCountedStringW( (*ThisScb)->Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( (*ThisScb)->Vcb->Vpb ) ),A14_(*ThisScb)->Fcb�A15_NtfsFullFileRefNumber( _(*ThisScb)->Fcb->FileReference ) A16_*ThisScb`A17_(*ThisScb)->MarkHandleDisallowWritesCount|A18_IrpSp->Parameters.Create.SecurityContext->DesiredAccessTEMP�	�(�C����_s৒5����\D�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��Q�oData9K�NameA11_(*ThisScb)->Vcb
A��k�oDataSK�Name A12__(*ThisScb)->Vcb->VolumeName
A���oData�K�NamepA13_WppCountedStringW( (*ThisScb)->Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( (*ThisScb)->Vcb->Vpb ) )
A��Q�oData9K�NameA14_(*ThisScb)->Fcb
A����oData�K�Name<A15_NtfsFullFileRefNumber( _(*ThisScb)->Fcb->FileReference )
A��C�oData+K�NameA16_*ThisScb
A��m�oDataUK�Name!A17_(*ThisScb)->AttributeTypeCode
A��g�oDataOK�NameA18__(*ThisScb)->AttributeName
A��{�oDatacK�Name(A19_IrpSp->Parameters.Create.ShareAccess
	A��M�oData5K�NameA20_GrantedAccess
�)�)�)D*,+X+�+�+@,�,�,8A10_PsGetCurrentThread(),A11_(*ThisScb)->VcbHA12__(*ThisScb)->Vcb->VolumeName�A13_WppCountedStringW( (*ThisScb)->Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( (*ThisScb)->Vcb->Vpb ) ),A14_(*ThisScb)->Fcb�A15_NtfsFullFileRefNumber( _(*ThisScb)->Fcb->FileReference ) A16_*ThisScbHA17_(*ThisScb)->AttributeTypeCodeDA18__(*ThisScb)->AttributeNameXA19_IrpSp->Parameters.Create.ShareAccess(A20_GrantedAccessTEMP��1���*�A^�(�k����FD�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��Q�oData9K�NameA11_(*ThisScb)->Vcb
A��k�oDataSK�Name A12__(*ThisScb)->Vcb->VolumeName
A���oData�K�NamepA13_WppCountedStringW( (*ThisScb)->Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( (*ThisScb)->Vcb->Vpb ) )
A��Q�oData9K�NameA14_(*ThisScb)->Fcb
A����oData�K�Name<A15_NtfsFullFileRefNumber( _(*ThisScb)->Fcb->FileReference )
A��{�oDatacK�Name(A16_IrpSp->Parameters.Create.ShareAccess
A��c�oDataKK�NameA17_IrpSp->FileObject->Flags
 2X2�2�2�3�3`4�48A10_PsGetCurrentThread(),A11_(*ThisScb)->VcbHA12__(*ThisScb)->Vcb->VolumeName�A13_WppCountedStringW( (*ThisScb)->Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( (*ThisScb)->Vcb->Vpb ) ),A14_(*ThisScb)->Fcb�A15_NtfsFullFileRefNumber( _(*ThisScb)->Fcb->FileReference )XA16_IrpSp->Parameters.Create.ShareAccess@A17_IrpSp->FileObject->FlagsTEMP�<9�ҭ�[�Z��w}h�b��D�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��K�oData3K�NameA11_ThisFcb->Vcb
A��e�oDataMK�NameA12__ThisFcb->Vcb->VolumeName
A����oData�K�NamejA13_WppCountedStringW( ThisFcb->Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( ThisFcb->Vcb->Vpb ) )
A��A�oData)K�NameA14_ThisFcb
A����oData{K�Name4A15_NtfsFullFileRefNumber( _ThisFcb->FileReference )
A��{�oDatacK�Name(A16_IrpSp->Parameters.Create.ShareAccess
A��c�oDataKK�NameA17_IrpSp->FileObject->Flags
�9:<:|:X;t;�;<<8A10_PsGetCurrentThread()(A11_ThisFcb->Vcb@A12__ThisFcb->Vcb->VolumeName�A13_WppCountedStringW( ThisFcb->Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( ThisFcb->Vcb->Vpb ) )A14_ThisFcbpA15_NtfsFullFileRefNumber( _ThisFcb->FileReference )XA16_IrpSp->Parameters.Create.ShareAccess@A17_IrpSp->FileObject->FlagsTEMPl		@A�[aPݫ�R̨'��he����D�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��K�oData3K�NameA11_ThisFcb->Vcb
A��e�oDataMK�NameA12__ThisFcb->Vcb->VolumeName
A����oData�K�NamejA13_WppCountedStringW( ThisFcb->Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( ThisFcb->Vcb->Vpb ) )
A��A�oData)K�NameA14_ThisFcb
A����oData{K�Name4A15_NtfsFullFileRefNumber( _ThisFcb->FileReference )
A����oData�K�Name;A16_IrpSp->Parameters.Create.SecurityContext->DesiredAccess
A��k�oDataSK�Name A17_ThisFcb->Info.FileAttributes
A��K�oData3K�NameA18_IrpSp->Flags
�A,BTB�BpC�C�CxD�D8A10_PsGetCurrentThread()(A11_ThisFcb->Vcb@A12__ThisFcb->Vcb->VolumeName�A13_WppCountedStringW( ThisFcb->Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( ThisFcb->Vcb->Vpb ) )A14_ThisFcbpA15_NtfsFullFileRefNumber( _ThisFcb->FileReference )|A16_IrpSp->Parameters.Create.SecurityContext->DesiredAccessHA17_ThisFcb->Info.FileAttributes(A18_IrpSp->FlagsTEMP�0IYA�:<[�_Z�9Ѫ4���D�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��Q�oData9K�NameA11_CurrentFcb->Vcb
A��k�oDataSK�Name A12__CurrentFcb->Vcb->VolumeName
A���oData�K�NamepA13_WppCountedStringW( CurrentFcb->Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( CurrentFcb->Vcb->Vpb ) )
A��G�oData/K�NameA14_CurrentFcb
A����oData�K�Name7A15_NtfsFullFileRefNumber( _CurrentFcb->FileReference )
A��q�oDataYK�Name#A16_CurrentFcb->Info.FileAttributes
A��O�oData7K�NameA17_NtfsData.Flags
�IJ4J|JdK�K�KHL8A10_PsGetCurrentThread(),A11_CurrentFcb->VcbHA12__CurrentFcb->Vcb->VolumeName�A13_WppCountedStringW( CurrentFcb->Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( CurrentFcb->Vcb->Vpb ) )$A14_CurrentFcbtA15_NtfsFullFileRefNumber( _CurrentFcb->FileReference )LA16_CurrentFcb->Info.FileAttributes,A17_NtfsData.FlagsTEMP��PM5��y�X���G�wk��&D�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��Q�oData9K�NameA11_CurrentFcb->Vcb
A��k�oDataSK�Name A12__CurrentFcb->Vcb->VolumeName
A���oData�K�NamepA13_WppCountedStringW( CurrentFcb->Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( CurrentFcb->Vcb->Vpb ) )
A��G�oData/K�NameA14_CurrentFcb
A����oData�K�Name7A15_NtfsFullFileRefNumber( _CurrentFcb->FileReference )
A��q�oDataYK�Name#A16_CurrentFcb->Info.FileAttributes
A��a�oDataIK�NameA17_ThisScb->AttributeFlags
pQ�Q�QRS(S�S�S8A10_PsGetCurrentThread(),A11_CurrentFcb->VcbHA12__CurrentFcb->Vcb->VolumeName�A13_WppCountedStringW( CurrentFcb->Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( CurrentFcb->Vcb->Vpb ) )$A14_CurrentFcbtA15_NtfsFullFileRefNumber( _CurrentFcb->FileReference )LA16_CurrentFcb->Info.FileAttributes<A17_ThisScb->AttributeFlagsTEMP$�X���4��Q4��;^��`D�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��K�oData3K�NameA11_ThisScb->Vcb
A��e�oDataMK�NameA12__ThisScb->Vcb->VolumeName
A����oData�K�NamejA13_WppCountedStringW( ThisScb->Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( ThisScb->Vcb->Vpb ) )
A��K�oData3K�NameA14_ThisScb->Fcb
A����oData�K�Name9A15_NtfsFullFileRefNumber( _ThisScb->Fcb->FileReference )
A����oDataiK�Name+A16_CreateContext->CurrentFcb->CleanupCount
A����oData�K�Name8A17_NtfsData.EncryptionCallBackTable.ImplementationFlags
XY�Y�Y�Y�Z�Zt[�[8A10_PsGetCurrentThread()(A11_ThisScb->Vcb@A12__ThisScb->Vcb->VolumeName�A13_WppCountedStringW( ThisScb->Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( ThisScb->Vcb->Vpb ) )(A14_ThisScb->FcbxA15_NtfsFullFileRefNumber( _ThisScb->Fcb->FileReference )\A16_CreateContext->CurrentFcb->CleanupCountxA17_NtfsData.EncryptionCallBackTable.ImplementationFlagsTEMPxX^�H���\U��w���#���D�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��G�oData/K�NameA11_CurrentFcb
A����oData�K�Name7A12_NtfsFullFileRefNumber( _CurrentFcb->FileReference )
A��k�oDataSK�Name A13_CurrentFcb->TxfRmcb->RmState
�^�^_x_8A10_PsGetCurrentThread()$A11_CurrentFcbtA12_NtfsFullFileRefNumber( _CurrentFcb->FileReference )HA13_CurrentFcb->TxfRmcb->RmStateTEMP�

pf���Kb�2]u;��U��|D�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��M�oData5K�NameA11_Lcb->Fcb->Vcb
A��g�oDataOK�NameA12__Lcb->Fcb->Vcb->VolumeName
A���oData�K�NamelA13_WppCountedStringW( Lcb->Fcb->Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Lcb->Fcb->Vcb->Vpb ) )
A��C�oData+K�NameA14_Lcb->Fcb
A����oData}K�Name5A15_NtfsFullFileRefNumber( _Lcb->Fcb->FileReference )
A����oData�K�Name_A16_WppCountedStringW( Lcb->FileNameAttr->FileName, (USHORT)Lcb->FileNameAttr->FileNameLength )
A��M�oData5K�NameA17_DesiredAccess
A��W�oData?K�NameA18_DesiredShareAccess
A��W�oData?K�NameA19_IoShareAccessFlags
	A��g�oDataOK�NameA20_LinkShareAccess->OpenCount
A��e�oDataMK�NameA21_LinkShareAccess->Deleters
A��m�oDataUK�Name!A22_LinkShareAccess->SharedDelete
tg�g�gh�hi�iLjtj�j�j k`k8A10_PsGetCurrentThread()(A11_Lcb->Fcb->VcbDA12__Lcb->Fcb->Vcb->VolumeName�A13_WppCountedStringW( Lcb->Fcb->Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Lcb->Fcb->Vcb->Vpb ) ) A14_Lcb->FcbpA15_NtfsFullFileRefNumber( _Lcb->Fcb->FileReference )�A16_WppCountedStringW( Lcb->FileNameAttr->FileName, (USHORT)Lcb->FileNameAttr->FileNameLength )(A17_DesiredAccess4A18_DesiredShareAccess4A19_IoShareAccessFlagsDA20_LinkShareAccess->OpenCount@A21_LinkShareAccess->DeletersHA22_LinkShareAccess->SharedDeleteTEMP�
�sO�@@{oZf�
�'8���D�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��C�oData+K�NameA11_Scb->Vcb
A��]�oDataEK�NameA12__Scb->Vcb->VolumeName
A����oData�K�NamebA13_WppCountedStringW( Scb->Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Scb->Vcb->Vpb ) )
A��C�oData+K�NameA14_Scb->Fcb
A����oData}K�Name5A15_NtfsFullFileRefNumber( _Scb->Fcb->FileReference )
A��_�oDataGK�NameA16_Scb->AttributeTypeCode
A��Y�oDataAK�NameA17__Scb->AttributeName
A��M�oData5K�NameA18_DesiredAccess
A��W�oData?K�NameA19_DesiredShareAccess
	A��W�oData?K�NameA20_IoShareAccessFlags
A��_�oDataGK�NameA21_ShareAccess->OpenCount
A��[�oDataCK�NameA22_ShareAccess->Readers
A��[�oDataCK�NameA23_ShareAccess->Writers

A��]�oDataEK�NameA24_ShareAccess->Deleters
A��a�oDataIK�NameA25_ShareAccess->SharedRead
A��c�oDataKK�NameA26_ShareAccess->SharedWrite
A��e�oDataMK�NameA27_ShareAccess->SharedDelete
�t$uDu|uHvhv�vwHwpw�w�wxLx�x�x�x8y8A10_PsGetCurrentThread() A11_Scb->Vcb8A12__Scb->Vcb->VolumeName�A13_WppCountedStringW( Scb->Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Scb->Vcb->Vpb ) ) A14_Scb->FcbpA15_NtfsFullFileRefNumber( _Scb->Fcb->FileReference )<A16_Scb->AttributeTypeCode4A17__Scb->AttributeName(A18_DesiredAccess4A19_DesiredShareAccess4A20_IoShareAccessFlags<A21_ShareAccess->OpenCount8A22_ShareAccess->Readers8A23_ShareAccess->Writers8A24_ShareAccess->Deleters<A25_ShareAccess->SharedRead@A26_ShareAccess->SharedWrite@A27_ShareAccess->SharedDeleteTEMP���_P�ܐ]Q��)�v<~_���	D�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��C�oData+K�NameA11_Scb->Vcb
A��]�oDataEK�NameA12__Scb->Vcb->VolumeName
A����oData�K�NamebA13_WppCountedStringW( Scb->Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Scb->Vcb->Vpb ) )
A��C�oData+K�NameA14_Scb->Fcb
A����oData}K�Name5A15_NtfsFullFileRefNumber( _Scb->Fcb->FileReference )
A��_�oDataGK�NameA16_Scb->AttributeTypeCode
A��Y�oDataAK�NameA17__Scb->AttributeName
A����oData�K�Name_A18_WppCountedStringW( Lcb->FileNameAttr->FileName, (USHORT)Lcb->FileNameAttr->FileNameLength )
A��M�oData5K�NameA19_DesiredAccess
	A��W�oData?K�NameA20_DesiredShareAccess
A��W�oData?K�NameA21_IoShareAccessFlags
A��_�oDataGK�NameA22_ShareAccess->OpenCount
A��[�oDataCK�NameA23_ShareAccess->Readers

A��[�oDataCK�NameA24_ShareAccess->Writers
A��]�oDataEK�NameA25_ShareAccess->Deleters
A��a�oDataIK�NameA26_ShareAccess->SharedRead
A��c�oDataKK�NameA27_ShareAccess->SharedWrite
A��e�oDataMK�NameA28_ShareAccess->SharedDelete
A��g�oDataOK�NameA29_LinkShareAccess->OpenCount
A��e�oDataMK�NameA30_LinkShareAccess->Deleters
A��m�oDataUK�Name!A31_LinkShareAccess->SharedDelete
L�����܅��Ȇ8�t���l���Ȉ��8�p�����\���� �8A10_PsGetCurrentThread() A11_Scb->Vcb8A12__Scb->Vcb->VolumeName�A13_WppCountedStringW( Scb->Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Scb->Vcb->Vpb ) ) A14_Scb->FcbpA15_NtfsFullFileRefNumber( _Scb->Fcb->FileReference )<A16_Scb->AttributeTypeCode4A17__Scb->AttributeName�A18_WppCountedStringW( Lcb->FileNameAttr->FileName, (USHORT)Lcb->FileNameAttr->FileNameLength )(A19_DesiredAccess4A20_DesiredShareAccess4A21_IoShareAccessFlags<A22_ShareAccess->OpenCount8A23_ShareAccess->Readers8A24_ShareAccess->Writers8A25_ShareAccess->Deleters<A26_ShareAccess->SharedRead@A27_ShareAccess->SharedWrite@A28_ShareAccess->SharedDeleteDA29_LinkShareAccess->OpenCount@A30_LinkShareAccess->DeletersHA31_LinkShareAccess->SharedDeleteTEMP`����Q��)�Y���S&����	D�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��C�oData+K�NameA11_Scb->Vcb
A��]�oDataEK�NameA12__Scb->Vcb->VolumeName
A����oData�K�NamebA13_WppCountedStringW( Scb->Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Scb->Vcb->Vpb ) )
A��C�oData+K�NameA14_Scb->Fcb
A����oData}K�Name5A15_NtfsFullFileRefNumber( _Scb->Fcb->FileReference )
A��_�oDataGK�NameA16_Scb->AttributeTypeCode
A��Y�oDataAK�NameA17__Scb->AttributeName
A����oData�K�Name�A18_ARGUMENT_PRESENT( Lcb ) ?                          WppCountedStringW( Lcb->FileNameAttr->FileName, (USHORT)Lcb->FileNameAttr->FileNameLength ) :                          WppCountedStringW( NULL, 0 )
A��{�oDatacK�Name(A19_AccessState->PreviouslyGrantedAccess
	A��W�oData?K�NameA20_AccessState->Flags
A��W�oData?K�NameA21_DesiredShareAccess
A��U�oData=K�NameA22_CreateDisposition
A��g�oDataOK�NameA23_Scb->ShareAccess.OpenCount

A��c�oDataKK�NameA24_Scb->ShareAccess.Readers
A��c�oDataKK�NameA25_Scb->ShareAccess.Writers
A��e�oDataMK�NameA26_Scb->ShareAccess.Deleters
A��i�oDataQK�NameA27_Scb->ShareAccess.SharedRead
A����oData�K�Name?A28_ARGUMENT_PRESENT( Lcb ) ? Lcb->LinkShareAccess.Deleters : 0
�L�l���p����<�p��d���̛��@������D�8A10_PsGetCurrentThread() A11_Scb->Vcb8A12__Scb->Vcb->VolumeName�A13_WppCountedStringW( Scb->Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Scb->Vcb->Vpb ) ) A14_Scb->FcbpA15_NtfsFullFileRefNumber( _Scb->Fcb->FileReference )<A16_Scb->AttributeTypeCode4A17__Scb->AttributeName�A18_ARGUMENT_PRESENT( Lcb ) ?                          WppCountedStringW( Lcb->FileNameAttr->FileName, (USHORT)Lcb->FileNameAttr->FileNameLength ) :                          WppCountedStringW( NULL, 0 )XA19_AccessState->PreviouslyGrantedAccess4A20_AccessState->Flags4A21_DesiredShareAccess0A22_CreateDispositionDA23_Scb->ShareAccess.OpenCount@A24_Scb->ShareAccess.Readers@A25_Scb->ShareAccess.Writers@A26_Scb->ShareAccess.DeletersDA27_Scb->ShareAccess.SharedRead�A28_ARGUMENT_PRESENT( Lcb ) ? Lcb->LinkShareAccess.Deleters : 0TEMP��X��}��]���}i"�T���D�	EventDataA��q�oDataYK�Name#A10_FILEID_FROM_SOURCE( FileNLine )
A��s�oData[K�Name$A11_LINENUM_FROM_SOURCE( FileNLine )
A��?�oData'K�Name
A12_Status
A��K�oData3K�NameA13__ProcessName
�<�����LA10_FILEID_FROM_SOURCE( FileNLine )PA11_LINENUM_FROM_SOURCE( FileNLine )A12_Status(A13__ProcessNameTEMP��b�;u>�[��f�H�R���D�	EventDataA��9�oData!K�NameA10_Vcb
A��Q�oData9K�NameA11_StartingCluster
A��E�oData-K�Name
A12_RunLength
@�T���A10_Vcb,A11_StartingCluster A12_RunLengthTEMPt��R�z����^�h�bN����D�	EventDataA��9�oData!K�NameA10_Vcb
A��W�oData?K�NameA11_*MarkUnusedContext
A����oDatamK�Name-A12_(*MarkUnusedContext)->DeallocatedClusters
A����oDatayK�Name3A13__(*MarkUnusedContext)->DeallocatedClusters->Mcb
��H���A10_Vcb4A11_*MarkUnusedContext`A12_(*MarkUnusedContext)->DeallocatedClusterslA13__(*MarkUnusedContext)->DeallocatedClusters->McbTEMP��3���x]Gp�T�;���D�	EventDataA��9�oData!K�NameA10_Vcb
A��Q�oData9K�NameA11_StartingCluster
A��E�oData-K�Name
A12_RunLength
A����oDatayK�Name3A13__(*MarkUnusedContext)->DeallocatedClusters->Mcb
0�D�p���A10_Vcb,A11_StartingCluster A12_RunLengthlA13__(*MarkUnusedContext)->DeallocatedClusters->McbTEMP�$���=�g_��M���m����D�	EventDataA��9�oData!K�NameA10_Vcb
A����oDatayK�Name3A11__(*MarkUnusedContext)->DeallocatedClusters->Mcb
L�`�A10_VcblA11__(*MarkUnusedContext)->DeallocatedClusters->McbTEMP�����F�^K8�B�'�a��D�	EventDataA��9�oData!K�NameA10_Vcb
A��W�oData?K�NameA11_*MarkUnusedContext
A��G�oData/K�NameA12_IrpContext
D�X���A10_Vcb4A11_*MarkUnusedContext$A12_IrpContextTEMP�ܮ.���>�\��X�E�����D�	EventDataA��9�oData!K�NameA10_Src
A��9�oData!K�NameA11_Dst
A��W�oData?K�NameA12_Src->ClustersCount
A���oDatagK�Name*A13_Src->DeallocatedClusters->ClusterCount
A��q�oDataYK�Name#A14_SrcDsmAttr->DataSetRangesLength
@�T�h�����A10_SrcA11_Dst4A12_Src->ClustersCount\A13_Src->DeallocatedClusters->ClusterCountLA14_SrcDsmAttr->DataSetRangesLengthTEMP0T�o[A�l_�T�uJw���D�	EventDataA��9�oData!K�NameA10_Src
A��9�oData!K�NameA11_Dst
A��W�oData?K�NameA12_Src->ClustersCount
A��W�oData?K�NameA13_Dst->ClustersCount
A��q�oDataYK�Name#A14_DstDsmAttr->DataSetRangesLength
A���oDatagK�Name*A15_DstFirstDataSetRangePtr->LengthInBytes
A����oDataiK�Name+A16_DstFirstDataSetRangePtr->StartingOffset
���<�p����A10_SrcA11_Dst4A12_Src->ClustersCount4A13_Dst->ClustersCountLA14_DstDsmAttr->DataSetRangesLength\A15_DstFirstDataSetRangePtr->LengthInBytes\A16_DstFirstDataSetRangePtr->StartingOffsetTEMPX��e�Ιy�T���e�^�|���D�	EventDataA��9�oData!K�NameA10_Vcb
A��U�oData=K�NameA11_MarkUnusedContext
A��c�oDataKK�NameA12_Vcb->DeallocatedClusters
A����oDatakK�Name,A13_Vcb->DeallocatedClustersListLengthInTrim
A����oDatamK�Name-A14_Vcb->DeallocatedClustersListLengthToDrain
A��_�oDataGK�NameA15_Clusters->ClusterCount
A��M�oData5K�NameA16_InitialRanges
$�8�h����h���A10_Vcb0A11_MarkUnusedContext@A12_Vcb->DeallocatedClusters`A13_Vcb->DeallocatedClustersListLengthInTrim`A14_Vcb->DeallocatedClustersListLengthToDrain<A15_Clusters->ClusterCount(A16_InitialRangesTEMP�ĽW=�޾rYF#8�L!����D�	EventDataA��9�oData!K�NameA10_Vcb
A��U�oData=K�NameA11_MarkUnusedContext
A��I�oData1K�NameA12_StartingLcn
A��K�oData3K�NameA13_ClusterCount
A��S�oData;K�NameA14_FreeClusterBase1
A��U�oData=K�NameA15_FreeClusterCount1
A��S�oData;K�NameA16_FreeClusterBase2
A��U�oData=K�NameA17_FreeClusterCount2
d�x���̾�$�T���A10_Vcb0A11_MarkUnusedContext$A12_StartingLcn(A13_ClusterCount0A14_FreeClusterBase10A15_FreeClusterCount10A16_FreeClusterBase20A17_FreeClusterCount2TEMPP��;0WHK�Shd�Q��q����D�	EventDataA��9�oData!K�NameA10_Vcb
A��Q�oData9K�NameA11_Vcb->CloseCount
��A10_Vcb,A11_Vcb->CloseCountTEMP����A��.WE�}12i���ZD�	EventDataA��9�oData!K�NameA10_Irp
��A10_IrpTEMP<��[m�N�]z_(��H�AuR���D�	EventDataA��9�oData!K�NameA10_Vcb
A��G�oData/K�NameA11_IrpContext
����A10_Vcb$A11_IrpContextTEMPH����pq*�\�J���!���D�	EventDataA��9�oData!K�NameA10_Vcb
A��_�oDataGK�NameA11_SmallMarkUnusedContext
A��U�oData=K�NameA12_MarkUnusedContext
������A10_Vcb<A11_SmallMarkUnusedContext0A12_MarkUnusedContextTEMPX�����z��Q��<��z���D�	EventDataA��9�oData!K�NameA10_Vcb
A��U�oData=K�NameA11_MarkUnusedContext
�,�A10_Vcb0A11_MarkUnusedContextTEMP�����MeDz�Z��x8������D�	EventDataA��9�oData!K�NameA10_Vcb
A��U�oData=K�NameA11_MarkUnusedContext
A��S�oData;K�NameA12_TrimEntryCount++
A��q�oDataYK�Name#A13_DataSetRangePtr->StartingOffset
A��o�oDataWK�Name"A14_DataSetRangePtr->LengthInBytes
���8�h���A10_Vcb0A11_MarkUnusedContext0A12_TrimEntryCount++LA13_DataSetRangePtr->StartingOffsetLA14_DataSetRangePtr->LengthInBytesTEMP�4�[V�[)��\�'ϒ�����D�	EventDataA��9�oData!K�NameA10_Vcb
A��U�oData=K�NameA11_MarkUnusedContext
A��A�oData)K�NameA12_IrpUsed
p�����A10_Vcb0A11_MarkUnusedContextA12_IrpUsedTEMP����:�P���}�k,���D�	EventDataA��9�oData!K�NameA10_Vcb
A��U�oData=K�NameA11_MarkUnusedContext
A��?�oData'K�Name
A12_Status
<�P���A10_Vcb0A11_MarkUnusedContextA12_StatusTEMPd$�b~)�P�T DK)~#����TD�	EventDataA��9�oData!K�NameA10_Vcb
A��?�oData'K�Name
A11_Status
A��U�oData=K�NameA12_MarkUnusedContext
A��Q�oData9K�Name�A13_((MarkUnusedContext != NULL) __ (MarkUnusedContext->DeallocatedClusters != NULL)) ? MarkUnusedContext->DeallocatedClusters->ClusterCount : -1LL
t�������A10_VcbA11_Status0A12_MarkUnusedContext,A13_((MarkUnusedContext != NULL) __ (MarkUnusedContext->DeallocatedClusters != NULL)) ? MarkUnusedContext->DeallocatedClusters->ClusterCount : -1LLTEMP`���Pr4�HX���I{����D�	EventDataA��9�oData!K�NameA10_Vcb
A��Y�oDataAK�NameA11_DeallocatedClusters
�,�A10_Vcb4A11_DeallocatedClustersTEMP 0��'� OAP�c|�����D�	EventDataA��9�oData!K�NameA10_Vcb
A��9�oData!K�NameA11_All
X�l�A10_VcbA11_AllTEMP���b(�SWY
�8
Q�����D�	EventDataA��9�oData!K�NameA10_Vcb
A����oData}K�Name5A11_DeallocatedClustersToWaitFor->DeallocatedClusters
����A10_VcbpA11_DeallocatedClustersToWaitFor->DeallocatedClustersTEMP���)�?n�[��a�0͊��D�	EventDataA��Q�oData9K�NameA10_IrpContext->Vcb
A����oData}K�Name5A11_DeallocatedClustersToWaitFor->DeallocatedClusters
����,A10_IrpContext->VcbpA11_DeallocatedClustersToWaitFor->DeallocatedClustersTEMP�4�l���yZM�_6�LP���D�	EventDataA��M�oData5K�NameA10_WaitInSeconds
A��%�oData
K�Name�A11_((CurrentTime.QuadPart > DeallocatedClustersToWaitFor->EndTime.QuadPart) ?                                     (ULONG)(((CurrentTime.QuadPart - DeallocatedClustersToWaitFor->EndTime.QuadPart) * NtfsData.SystemTimeIncrement)/INTERVAL_ONE_SECOND) : 0)
A��G�oData/K�NameA12_IrpContext
A��Q�oData9K�NameA13_IrpContext->Vcb
A��Y�oDataAK�NameA14_DeallocatedClusters
���������(A10_WaitInSecondsA11_((CurrentTime.QuadPart > DeallocatedClustersToWaitFor->EndTime.QuadPart) ?                                     (ULONG)(((CurrentTime.QuadPart - DeallocatedClustersToWaitFor->EndTime.QuadPart) * NtfsData.SystemTimeIncrement)/INTERVAL_ONE_SECOND) : 0)$A12_IrpContext,A13_IrpContext->Vcb4A14_DeallocatedClustersTEMP�����%�zR�lib�����D�	EventDataA��M�oData5K�NameA10_WaitInSeconds
A���oDataK�Name�A11_((CurrentTime.QuadPart > DeallocatedClustersToWaitFor->EndTime.QuadPart) ?                                  (ULONG)(((CurrentTime.QuadPart - DeallocatedClustersToWaitFor->EndTime.QuadPart) * NtfsData.SystemTimeIncrement)/INTERVAL_ONE_SECOND) : 0)
A��G�oData/K�NameA12_IrpContext
A��Q�oData9K�NameA13_IrpContext->Vcb
A��Y�oDataAK�NameA14_DeallocatedClusters
x���������(A10_WaitInSeconds�A11_((CurrentTime.QuadPart > DeallocatedClustersToWaitFor->EndTime.QuadPart) ?                                  (ULONG)(((CurrentTime.QuadPart - DeallocatedClustersToWaitFor->EndTime.QuadPart) * NtfsData.SystemTimeIncrement)/INTERVAL_ONE_SECOND) : 0)$A12_IrpContext,A13_IrpContext->Vcb4A14_DeallocatedClustersTEMP�8�u�
R��X�~��r�J���D�	EventDataA��9�oData!K�NameA10_Vcb
A����oDatakK�Name,A11_Vcb->DeallocatedClustersListLengthInTrim
`�t�A10_Vcb`A11_Vcb->DeallocatedClustersListLengthInTrimTEMP@��#�I�¤IRֵ��������D�	EventDataA��9�oData!K�NameA10_Vcb
A��I�oData1K�NameA11_AcquiredVcb
����A10_Vcb$A11_AcquiredVcbTEMP����j�2�[�N�_��M���D�	EventDataA��9�oData!K�NameA10_Vcb
A��U�oData=K�NameA11_MarkUnusedContext
A��C�oData+K�NameA12_RunIndex
A��O�oData7K�NameA13_StartingOffset
A��M�oData5K�NameA14_LengthInBytes
X�l�������A10_Vcb0A11_MarkUnusedContext A12_RunIndex,A13_StartingOffset(A14_LengthInBytesTEMP8�a�|�YyrC��$���D�	EventDataA��9�oData!K�NameA10_Vcb
A��U�oData=K�NameA11_MarkUnusedContext
A��U�oData=K�NameA12_DataSetRangeCount
A��I�oData1K�NameA13_McbRunCount
A��a�oDataIK�NameA14_SmartTrimFreeRangeCount
t��������A10_Vcb0A11_MarkUnusedContext0A12_DataSetRangeCount$A13_McbRunCount<A14_SmartTrimFreeRangeCountTEMPl`�=�Vrg@�_4G��.�d���D�	EventDataA��9�oData!K�NameA10_Vcb
A��U�oData=K�NameA11_MarkUnusedContext
A��C�oData+K�NameA12_RunIndex
A��k�oDataSK�Name A13_DataSetRange->StartingOffset
A��i�oDataQK�NameA14_DataSetRange->LengthInBytes
�����(�p�A10_Vcb0A11_MarkUnusedContext A12_RunIndexHA13_DataSetRange->StartingOffsetDA14_DataSetRange->LengthInBytesTEMP���K�*KD��X����!?�����D�	EventDataA��9�oData!K�NameA10_Vcb
A��I�oData1K�NameA11_StartingLcn
A��K�oData3K�NameA12_ClusterCount
A��M�oData5K�NameA13_FirstTpMapBit
A��K�oData3K�NameA14_LastTpMapBit
���(�P�x�A10_Vcb$A11_StartingLcn(A12_ClusterCount(A13_FirstTpMapBit(A14_LastTpMapBitTEMP���X,�E0�P���$��k���D�	EventDataA��9�oData!K�NameA10_Vcb
A��q�oDataYK�Name#A11_SmartTrimState->SlabRangesCount
��A10_VcbLA11_SmartTrimState->SlabRangesCountTEMP�������rIX,Z
����C���D�	EventDataA��9�oData!K�NameA10_Vcb
A��O�oData7K�NameA11_SlabRangeIndex
A��c�oDataKK�NameA12_SlabRange->FirstTPMapBit
A��a�oDataIK�NameA13_SlabRange->LastTPMapBit
8�L�x���A10_Vcb,A11_SlabRangeIndex@A12_SlabRange->FirstTPMapBit<A13_SlabRange->LastTPMapBitTEMPL���P��P�%�+�/o���D�	EventDataA��9�oData!K�NameA10_Vcb
A��O�oData7K�NameA11_AcquiredBitmap
��A10_Vcb,A11_AcquiredBitmapTEMP4���=ហ�Zԙ�4�\���D�	EventDataA��9�oData!K�NameA10_Vcb
A��C�oData+K�NameA11_TpMapBit
@�T�A10_Vcb A11_TpMapBitTEMPl�U�h$��%X�7	��|��VD�	EventDataA��9�oData!K�NameA10_Vcb
A��C�oData+K�NameA11_TpMapBit
A��I�oData1K�NameA12_SlabBaseLcn
A��[�oDataCK�NameA13_SlabLengthInClusters
P�d�����A10_Vcb A11_TpMapBit$A12_SlabBaseLcn8A13_SlabLengthInClustersTEMP�� Ф*���U��L�c����D�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��9�oData!K�NameA11_Vcb
A��S�oData;K�NameA12__Vcb->VolumeName
A����oData�K�NameXA13_WppCountedStringW( Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Vcb->Vpb ) )
A��M�oData5K�NameA14_Vcb->VcbState
A��K�oData3K�NameA15_IrpSp->Flags
,dx�`�8A10_PsGetCurrentThread()A11_Vcb0A12__Vcb->VolumeName�A13_WppCountedStringW( Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Vcb->Vpb ) )(A14_Vcb->VcbState(A15_IrpSp->FlagsTEMP($a�F��[�
�6������>D�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��9�oData!K�NameA11_Vcb
A��S�oData;K�NameA12__Vcb->VolumeName
A����oData�K�NameXA13_WppCountedStringW( Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Vcb->Vpb ) )
A��?�oData'K�Name
A14_Status
����8A10_PsGetCurrentThread()A11_Vcb0A12__Vcb->VolumeName�A13_WppCountedStringW( Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Vcb->Vpb ) )A14_StatusTEMP�	$�Ȧ��W�dGVNJ���D�	EventDataA��C�oData+K�NameA10_Scb->Vcb
A��I�oData1K�NameA11_StartingVbo
A��E�oData-K�Name
A12_ByteCount
H	h	�	 A10_Scb->Vcb$A11_StartingVbo A12_ByteCountTEMP�H
t��y+��Ts<k�i���hD�	EventDataA��G�oData/K�NameA10_FileObject
\
$A10_FileObjectTEMP����*�,�\�E6yGj.���D�	EventDataA��Q�oData9K�NameA10_((ULONG)BadVcn)
A��y�oDataaK�Name'A11_((PLARGE_INTEGER)_BadVcn)->HighPart
��,A10_((ULONG)BadVcn)TA11_((PLARGE_INTEGER)_BadVcn)->HighPartTEMP�x
�c��RCh�⩯����D�	EventDataA��Q�oData9K�NameA10_((ULONG)BadLcn)
A��y�oDataaK�Name'A11_((PLARGE_INTEGER)_BadLcn)->HighPart
�
�
,A10_((ULONG)BadLcn)TA11_((PLARGE_INTEGER)_BadLcn)->HighPartTEMP�P�6��TY�8��������D�	EventDataA��G�oData/K�NameA10_IrpContext
A��9�oData!K�NameA11_Vcb
A��M�oData5K�NameA12_NewBufferSize
���$A10_IrpContextA11_Vcb(A12_NewBufferSizeTEMP���.�MR�
����>���D�	EventDataA��M�oData5K�NameA10_NewBufferSize
A��o�oDataWK�Name"A11_NtfsGetCompressionBufferSize()
,T(A10_NewBufferSizeLA11_NtfsGetCompressionBufferSize()TEMP��AoA4+��^�y��t����D�	EventDataA��M�oData5K�NameA10_NewBufferSize
A��i�oDataQK�NameA11_NtfsGetUsaBufferSize( Vcb )
�(A10_NewBufferSizeDA11_NtfsGetUsaBufferSize( Vcb )TEMPx(pr��VRo��G��P���D�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��C�oData+K�NameA11_Scb->Vcb
A��]�oDataEK�NameA12__Scb->Vcb->VolumeName
A����oData�K�NamebA13_WppCountedStringW( Scb->Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Scb->Vcb->Vpb ) )
A��C�oData+K�NameA14_Scb->Fcb
A����oData}K�Name5A15_NtfsFullFileRefNumber( _Scb->Fcb->FileReference )
A��9�oData!K�NameA16_Scb
A��_�oDataGK�NameA17_Scb->AttributeTypeCode
A��Y�oDataAK�NameA18__Scb->AttributeName
A��K�oData3K�NameA19_Scb->Persist
	A��G�oData/K�NameA20_Ccb->Flags
<\�`��@t�8A10_PsGetCurrentThread() A11_Scb->Vcb8A12__Scb->Vcb->VolumeName�A13_WppCountedStringW( Scb->Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Scb->Vcb->Vpb ) ) A14_Scb->FcbpA15_NtfsFullFileRefNumber( _Scb->Fcb->FileReference )A16_Scb<A17_Scb->AttributeTypeCode4A18__Scb->AttributeName(A19_Scb->Persist$A20_Ccb->FlagsTEMP8 X��Q*fV�7�:����D�	EventDataA��9�oData!K�NameA10_Vcb
A��G�oData/K�NameA11_IrpContext
A��9�oData!K�NameA12_Scb
A����oData}K�Name5A13_NtfsFullFileRefNumber( _Scb->Fcb->FileReference )
A��o�oDataWK�Name"A14_MoveData->StartingVcn.QuadPart
A��S�oData;K�NameA15_TransferClusters
A��9�oData!K�NameA16_Lcn
A��o�oDataWK�Name"A17_MoveData->StartingLcn.QuadPart
A��G�oData/K�NameA18_CopyLength
A��g�oDataOK�NameA19_Flags.UseDelayedAllocation
	A��?�oData'K�Name
A20_Status
� � !(!�!�!"("t"�"�"A10_Vcb$A11_IrpContextA12_ScbpA13_NtfsFullFileRefNumber( _Scb->Fcb->FileReference )LA14_MoveData->StartingVcn.QuadPart0A15_TransferClustersA16_LcnLA17_MoveData->StartingLcn.QuadPart$A18_CopyLengthDA19_Flags.UseDelayedAllocationA20_StatusTEMP@<'>5�e�P��r�za���D�	EventDataA��9�oData!K�NameA10_Vcb
A��G�oData/K�NameA11_IrpContext
A��9�oData!K�NameA12_Scb
A����oData}K�Name5A13_NtfsFullFileRefNumber( _Scb->Fcb->FileReference )
A��o�oDataWK�Name"A14_MoveData->StartingVcn.QuadPart
A��S�oData;K�NameA15_TransferClusters
A��9�oData!K�NameA16_Lcn
A��o�oDataWK�Name"A17_MoveData->StartingLcn.QuadPart
A��G�oData/K�NameA18_CopyLength
A��g�oDataOK�NameA19_Flags.UseDelayedAllocation
	A��C�oData+K�NameA20_MyStatus
(,(P(d(�( )P)d)�)�)*A10_Vcb$A11_IrpContextA12_ScbpA13_NtfsFullFileRefNumber( _Scb->Fcb->FileReference )LA14_MoveData->StartingVcn.QuadPart0A15_TransferClustersA16_LcnLA17_MoveData->StartingLcn.QuadPart$A18_CopyLengthDA19_Flags.UseDelayedAllocation A20_MyStatusTEMP0�,F<��;Tz(���>C���\D�	EventDataA��9�oData!K�NameA10_Vcb
A��G�oData/K�NameA11_IrpContext
A��9�oData!K�NameA12_Scb
A����oData}K�Name5A13_NtfsFullFileRefNumber( _Scb->Fcb->FileReference )
A��9�oData!K�NameA14_Lcn
A��G�oData/K�NameA15_CopyLength
A��C�oData+K�NameA16_MyStatus
T-h-�-�-.$.H.A10_Vcb$A11_IrpContextA12_ScbpA13_NtfsFullFileRefNumber( _Scb->Fcb->FileReference )A14_Lcn$A15_CopyLength A16_MyStatusTEMP�01��A���Vc�.YO=����D�	EventDataA��9�oData!K�NameA10_Vcb
A��G�oData/K�NameA11_IrpContext
A��9�oData!K�NameA12_Scb
A����oData}K�Name5A13_NtfsFullFileRefNumber( _Scb->Fcb->FileReference )
A��o�oDataWK�Name"A14_MoveData->StartingLcn.QuadPart
A��G�oData/K�NameA15_CopyLength
A��C�oData+K�NameA16_MyStatus
�1�1�12x2�2�2A10_Vcb$A11_IrpContextA12_ScbpA13_NtfsFullFileRefNumber( _Scb->Fcb->FileReference )LA14_MoveData->StartingLcn.QuadPart$A15_CopyLength A16_MyStatusTEMP�

7�s�U^�P��b��w����D�	EventDataA��9�oData!K�NameA10_Vcb
A��G�oData/K�NameA11_IrpContext
A��9�oData!K�NameA12_Scb
A����oData}K�Name5A13_NtfsFullFileRefNumber( _Scb->Fcb->FileReference )
A��o�oDataWK�Name"A14_MoveData->StartingVcn.QuadPart
A��S�oData;K�NameA15_TransferClusters
A��9�oData!K�NameA16_Lcn
A��o�oDataWK�Name"A17_MoveData->StartingLcn.QuadPart
A��g�oDataOK�NameA18_Flags.UseDelayedAllocation
A��M�oData5K�NameA19_ValidClusters
	�7�788�8�899h9�9A10_Vcb$A11_IrpContextA12_ScbpA13_NtfsFullFileRefNumber( _Scb->Fcb->FileReference )LA14_MoveData->StartingVcn.QuadPart0A15_TransferClustersA16_LcnLA17_MoveData->StartingLcn.QuadPartDA18_Flags.UseDelayedAllocation(A19_ValidClustersTEMP8\<���"�Z�Su��Dg���TD�	EventDataA��9�oData!K�NameA10_Vcb
A��G�oData/K�NameA11_IrpContext
A��9�oData!K�NameA12_Scb
A����oData}K�Name5A13_NtfsFullFileRefNumber( _Scb->Fcb->FileReference )
A��o�oDataWK�Name"A14_MoveData->StartingVcn.QuadPart
A��S�oData;K�NameA15_TransferClusters
�<�<= =�=�=A10_Vcb$A11_IrpContextA12_ScbpA13_NtfsFullFileRefNumber( _Scb->Fcb->FileReference )LA14_MoveData->StartingVcn.QuadPart0A15_TransferClustersTEMP��A�&�YゆQX���%����D�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��C�oData+K�NameA11_Fcb->Vcb
A��]�oDataEK�NameA12__Fcb->Vcb->VolumeName
A����oData�K�NamebA13_WppCountedStringW( Fcb->Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Fcb->Vcb->Vpb ) )
A��9�oData!K�NameA14_Fcb
A����oData�K�NameDA15_(Fcb != NULL) ? NtfsFullFileRefNumber( _Fcb->FileReference ) : 0
A��o�oDataWK�Name"A16_(Ccb != NULL) ? Ccb->Flags : 0
\B�B�B�B�C�C\D8A10_PsGetCurrentThread() A11_Fcb->Vcb8A12__Fcb->Vcb->VolumeName�A13_WppCountedStringW( Fcb->Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Fcb->Vcb->Vpb ) )A14_Fcb�A15_(Fcb != NULL) ? NtfsFullFileRefNumber( _Fcb->FileReference ) : 0LA16_(Ccb != NULL) ? Ccb->Flags : 0TEMP��IH2a^��Q� �+�QB����D�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��C�oData+K�NameA11_Scb->Vcb
A��]�oDataEK�NameA12__Scb->Vcb->VolumeName
A����oData�K�NamebA13_WppCountedStringW( Scb->Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Scb->Vcb->Vpb ) )
A��C�oData+K�NameA14_Scb->Fcb
A����oData}K�Name5A15_NtfsFullFileRefNumber( _Scb->Fcb->FileReference )
A��9�oData!K�NameA16_Scb
A��_�oDataGK�NameA17_Scb->AttributeTypeCode
A��e�oDataMK�NameA18_Scb->AttributeName.Buffer
A��K�oData3K�NameA19_Scb->Persist
	A��G�oData/K�NameA20_Ccb->Flags
pJ�J�JK�K�K\LpL�L�LM8A10_PsGetCurrentThread() A11_Scb->Vcb8A12__Scb->Vcb->VolumeName�A13_WppCountedStringW( Scb->Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Scb->Vcb->Vpb ) ) A14_Scb->FcbpA15_NtfsFullFileRefNumber( _Scb->Fcb->FileReference )A16_Scb<A17_Scb->AttributeTypeCode@A18_Scb->AttributeName.Buffer(A19_Scb->Persist$A20_Ccb->FlagsTEMP�@R����+y�]���h����D�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��C�oData+K�NameA11_Scb->Vcb
A��]�oDataEK�NameA12__Scb->Vcb->VolumeName
A����oData�K�NamebA13_WppCountedStringW( Scb->Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Scb->Vcb->Vpb ) )
A��C�oData+K�NameA14_Scb->Fcb
A����oData}K�Name5A15_NtfsFullFileRefNumber( _Scb->Fcb->FileReference )
A��9�oData!K�NameA16_Scb
A��_�oDataGK�NameA17_Scb->AttributeTypeCode
A��Y�oDataAK�NameA18__Scb->AttributeName
A��K�oData3K�NameA19_Scb->Persist
	A��o�oDataWK�Name"A20_(Ccb != NULL) ? Ccb->Flags : 0
STStS�SxT�TUUXU�U�U8A10_PsGetCurrentThread() A11_Scb->Vcb8A12__Scb->Vcb->VolumeName�A13_WppCountedStringW( Scb->Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Scb->Vcb->Vpb ) ) A14_Scb->FcbpA15_NtfsFullFileRefNumber( _Scb->Fcb->FileReference )A16_Scb<A17_Scb->AttributeTypeCode4A18__Scb->AttributeName(A19_Scb->PersistLA20_(Ccb != NULL) ? Ccb->Flags : 0TEMP|�X�Ls�.YC��N�|sO��xD�	EventDataA��9�oData!K�NameA10_Scb
A��{�oDatacK�Name(A11_Scb->Header.ValidDataLength.QuadPart
A��m�oDataUK�Name!A12_Scb->Header.FileSize.QuadPart
A��i�oDataQK�NameA13_QueryDaxExtents->FileOffset
A��I�oData1K�NameA14_StartingVcn
A��a�oDataIK�NameA15_QueryDaxExtents->Length
$Y8Y�Y�YZ@ZA10_ScbXA11_Scb->Header.ValidDataLength.QuadPartHA12_Scb->Header.FileSize.QuadPartDA13_QueryDaxExtents->FileOffset$A14_StartingVcn<A15_QueryDaxExtents->LengthTEMP�t]Bޘ��Y	N��-����D�	EventDataA��i�oDataQK�NameA10_QueryDaxExtents->FileOffset
A��a�oDataIK�NameA11_QueryDaxExtents->Length
A��o�oDataWK�Name"A12_EffectiveInputFileRegionLength
A��I�oData1K�NameA13_StartingVcn
A��K�oData3K�NameA14_BeyondEndVcn
A��]�oDataEK�NameA15_RemainingClusterCount
A��M�oData5K�NameA16_LastVcnInFile
^D^�^�^�^_P_DA10_QueryDaxExtents->FileOffset<A11_QueryDaxExtents->LengthLA12_EffectiveInputFileRegionLength$A13_StartingVcn(A14_BeyondEndVcn8A15_RemainingClusterCount(A16_LastVcnInFileTEMPD�`$�¶5�W<�9F�k����8D�	EventDataA��]�oDataEK�NameA10_RemainingClusterCount
A��U�oData=K�NameA11_DataSetRangeIndex
A��W�oData?K�NameA12_OutputBufferLength
 aXa�a8A10_RemainingClusterCount0A11_DataSetRangeIndex4A12_OutputBufferLengthTEMPL,cYB�4�dQ�BkJe����:D�	EventDataA��{�oDatacK�Name(A10_ExtentsDescriptor->NumberOfValidRuns
A��A�oData)K�NameA11_MaxRuns
A��O�oData7K�NameA12_*BytesReturned
hc�c�cXA10_ExtentsDescriptor->NumberOfValidRunsA11_MaxRuns,A12_*BytesReturnedTEMP�<e���#"�X�
c���	��D�	EventDataA��]�oDataEK�NameA10_RemainingClusterCount
A��{�oDatacK�Name(A11_ExtentsDescriptor->NumberOfValidRuns
de�e8A10_RemainingClusterCountXA11_ExtentsDescriptor->NumberOfValidRunsTEMP��g[<H��O[8�
� ~ȓ���D�	EventDataA��{�oDatacK�Name(A10_ExtentsDescriptor->NumberOfValidRuns
A��A�oData)K�NameA11_MaxRuns
A��?�oData'K�Name
A12_Status
A��O�oData7K�NameA13_*BytesReturned
�gPhlh�hXA10_ExtentsDescriptor->NumberOfValidRunsA11_MaxRunsA12_Status,A13_*BytesReturnedTEMP<j2�3�P�R�ną���(D�	EventDataA���oDatagK�Name*A10_ExtentsDescriptor->Run[Index].BasePage
A����oDataiK�Name+A11_ExtentsDescriptor->Run[Index].PageCount
8j�j\A10_ExtentsDescriptor->Run[Index].BasePage\A11_ExtentsDescriptor->Run[Index].PageCountTEMPH�k�{mĴ�[�'WC�m\����D�	EventDataA��E�oData-K�Name
A10_ZeroStart
A��A�oData)K�NameA11_ZeroEnd
�kl A10_ZeroStartA11_ZeroEndTEMPt

�p��-�y3�Y�q�1P�$��D�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��9�oData!K�NameA11_Vcb
A��S�oData;K�NameA12__Vcb->VolumeName
A����oData�K�NameXA13_WppCountedStringW( Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Vcb->Vpb ) )
A��9�oData!K�NameA14_Fcb
A����oDatasK�Name0A15_NtfsFullFileRefNumber( _Fcb->FileReference )
A��9�oData!K�NameA16_Scb
A��_�oDataGK�NameA17_Scb->AttributeTypeCode
A��Y�oDataAK�NameA18__Scb->AttributeName
A��G�oData/K�NameA19_Ccb->Flags
	Tq�q�q�q�r�rssTs�s8A10_PsGetCurrentThread()A11_Vcb0A12__Vcb->VolumeName�A13_WppCountedStringW( Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Vcb->Vpb ) )A14_FcbhA15_NtfsFullFileRefNumber( _Fcb->FileReference )A16_Scb<A17_Scb->AttributeTypeCode4A18__Scb->AttributeName$A19_Ccb->FlagsTEMP
Xy�_���	SJ�,_�*��xD�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��C�oData+K�NameA11_Scb->Vcb
A��]�oDataEK�NameA12__Scb->Vcb->VolumeName
A����oData�K�NamebA13_WppCountedStringW( Scb->Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Scb->Vcb->Vpb ) )
A��C�oData+K�NameA14_Scb->Fcb
A����oData}K�Name5A15_NtfsFullFileRefNumber( _Scb->Fcb->FileReference )
A��9�oData!K�NameA16_Scb
A��_�oDataGK�NameA17_Scb->AttributeTypeCode
A��Y�oDataAK�NameA18__Scb->AttributeName
A����oDatawK�Name2A19_ARGUMENT_PRESENT( Ccb ) ? Ccb->AccessFlags : 0
	A����oData�K�NameRA20_ARGUMENT_PRESENT( CreateContext ) ? CreateContext->PreviouslyGrantedAccess : 0
4zlz�z�z�{�{ |4|p|�|}8A10_PsGetCurrentThread() A11_Scb->Vcb8A12__Scb->Vcb->VolumeName�A13_WppCountedStringW( Scb->Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Scb->Vcb->Vpb ) ) A14_Scb->FcbpA15_NtfsFullFileRefNumber( _Scb->Fcb->FileReference )A16_Scb<A17_Scb->AttributeTypeCode4A18__Scb->AttributeNamelA19_ARGUMENT_PRESENT( Ccb ) ? Ccb->AccessFlags : 0�A20_ARGUMENT_PRESENT( CreateContext ) ? CreateContext->PreviouslyGrantedAccess : 0TEMP�

L��2����Z��EF�Q׋��ZD�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��C�oData+K�NameA11_Scb->Vcb
A��]�oDataEK�NameA12__Scb->Vcb->VolumeName
A����oData�K�NamebA13_WppCountedStringW( Scb->Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Scb->Vcb->Vpb ) )
A��C�oData+K�NameA14_Scb->Fcb
A����oData}K�Name5A15_NtfsFullFileRefNumber( _Scb->Fcb->FileReference )
A��9�oData!K�NameA16_Scb
A��_�oDataGK�NameA17_Scb->AttributeTypeCode
A��Y�oDataAK�NameA18__Scb->AttributeName
A��G�oData/K�NameA19_Ccb->Flags
	�L�l���p�����P���8A10_PsGetCurrentThread() A11_Scb->Vcb8A12__Scb->Vcb->VolumeName�A13_WppCountedStringW( Scb->Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Scb->Vcb->Vpb ) ) A14_Scb->FcbpA15_NtfsFullFileRefNumber( _Scb->Fcb->FileReference )A16_Scb<A17_Scb->AttributeTypeCode4A18__Scb->AttributeName$A19_Ccb->FlagsTEMPLD������R����%���hD�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��C�oData+K�NameA11_Fcb->Vcb
A��]�oDataEK�NameA12__Fcb->Vcb->VolumeName
A����oData�K�NamebA13_WppCountedStringW( Fcb->Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Fcb->Vcb->Vpb ) )
A��9�oData!K�NameA14_Fcb
A����oDatasK�Name0A15_NtfsFullFileRefNumber( _Fcb->FileReference )
A��o�oDataWK�Name"A16_(Ccb != NULL) ? Ccb->Flags : 0
Љ�(�`�,�@���8A10_PsGetCurrentThread() A11_Fcb->Vcb8A12__Fcb->Vcb->VolumeName�A13_WppCountedStringW( Fcb->Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Fcb->Vcb->Vpb ) )A14_FcbhA15_NtfsFullFileRefNumber( _Fcb->FileReference )LA16_(Ccb != NULL) ? Ccb->Flags : 0TEMPD

����8��YAƹz84�����D�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��C�oData+K�NameA11_Scb->Vcb
A��]�oDataEK�NameA12__Scb->Vcb->VolumeName
A����oData�K�NamebA13_WppCountedStringW( Scb->Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Scb->Vcb->Vpb ) )
A��C�oData+K�NameA14_Scb->Fcb
A����oData}K�Name5A15_NtfsFullFileRefNumber( _Scb->Fcb->FileReference )
A��9�oData!K�NameA16_Scb
A��_�oDataGK�NameA17_Scb->AttributeTypeCode
A��Y�oDataAK�NameA18__Scb->AttributeName
A��s�oData[K�Name$A19_Scb->Vcb->Vpb->RealDevice->Flags
	x���Б�Ԓ�d�x����8A10_PsGetCurrentThread() A11_Scb->Vcb8A12__Scb->Vcb->VolumeName�A13_WppCountedStringW( Scb->Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Scb->Vcb->Vpb ) ) A14_Scb->FcbpA15_NtfsFullFileRefNumber( _Scb->Fcb->FileReference )A16_Scb<A17_Scb->AttributeTypeCode4A18__Scb->AttributeNamePA19_Scb->Vcb->Vpb->RealDevice->FlagsTEMP� �R[��3
_���R��u���D�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��9�oData!K�NameA11_Vcb
A��S�oData;K�NameA12__Vcb->VolumeName
A����oData�K�NameXA13_WppCountedStringW( Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Vcb->Vpb ) )
A��k�oDataSK�Name A14_RenameCleanup->TargetLinkFcb
A����oData�K�NameIA15_NtfsFullFileRefNumber( _RenameCleanup->TargetLinkFcb->FileReference )
A���oDatagK�Name*A16_RenameCleanup->TargetLinkFcb->FcbState
�����(��(���8A10_PsGetCurrentThread()A11_Vcb0A12__Vcb->VolumeName�A13_WppCountedStringW( Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Vcb->Vpb ) )HA14_RenameCleanup->TargetLinkFcb�A15_NtfsFullFileRefNumber( _RenameCleanup->TargetLinkFcb->FileReference )\A16_RenameCleanup->TargetLinkFcb->FcbStateTEMP ��Jy�V4�W/&7a���D�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��9�oData!K�NameA11_Vcb
A��S�oData;K�NameA12__Vcb->VolumeName
A����oData�K�NameXA13_WppCountedStringW( Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Vcb->Vpb ) )
A��k�oDataSK�Name A14_RenameCleanup->TargetLinkFcb
A����oData�K�NameIA15_NtfsFullFileRefNumber( _RenameCleanup->TargetLinkFcb->FileReference )
A����oData�K�Name7A16_RenameCleanup->TargetLinkFcb->TxfFcb->TxfNumWriters
�����(��(���8A10_PsGetCurrentThread()A11_Vcb0A12__Vcb->VolumeName�A13_WppCountedStringW( Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Vcb->Vpb ) )HA14_RenameCleanup->TargetLinkFcb�A15_NtfsFullFileRefNumber( _RenameCleanup->TargetLinkFcb->FileReference )tA16_RenameCleanup->TargetLinkFcb->TxfFcb->TxfNumWritersTEMP�		4�\*}����^CC��J�Z����D�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��9�oData!K�NameA11_Vcb
A��S�oData;K�NameA12__Vcb->VolumeName
A����oData�K�NameXA13_WppCountedStringW( Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Vcb->Vpb ) )
A��S�oData;K�NameA14_LcbToDelete->Fcb
A����oData�K�Name=A15_NtfsFullFileRefNumber( _LcbToDelete->Fcb->FileReference )
A��I�oData1K�NameA16_LcbToDelete
A��	�oData�K�NameoA17_WppCountedStringW( LcbToDelete->FileNameAttr->FileName, (USHORT)LcbToDelete->FileNameAttr->FileNameLength )
A��g�oDataOK�NameA18_LcbToDelete->TxfNumWriters
� �4�d��L�̩�Ԫ8A10_PsGetCurrentThread()A11_Vcb0A12__Vcb->VolumeName�A13_WppCountedStringW( Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Vcb->Vpb ) )0A14_LcbToDelete->Fcb�A15_NtfsFullFileRefNumber( _LcbToDelete->Fcb->FileReference )$A16_LcbToDelete�A17_WppCountedStringW( LcbToDelete->FileNameAttr->FileName, (USHORT)LcbToDelete->FileNameAttr->FileNameLength )DA18_LcbToDelete->TxfNumWritersTEMP��s�U��[����6�����D�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��9�oData!K�NameA11_Vcb
A��S�oData;K�NameA12__Vcb->VolumeName
A����oData�K�NameXA13_WppCountedStringW( Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Vcb->Vpb ) )
A��k�oDataSK�Name A14_RenameCleanup->TargetLinkFcb
A����oData�K�NameIA15_NtfsFullFileRefNumber( _RenameCleanup->TargetLinkFcb->FileReference )
A����oDataoK�Name.A16_RenameCleanup->TargetLinkFcb->CleanupCount
��̯��Ȱ���8A10_PsGetCurrentThread()A11_Vcb0A12__Vcb->VolumeName�A13_WppCountedStringW( Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Vcb->Vpb ) )HA14_RenameCleanup->TargetLinkFcb�A15_NtfsFullFileRefNumber( _RenameCleanup->TargetLinkFcb->FileReference )dA16_RenameCleanup->TargetLinkFcb->CleanupCountTEMP�0�O�UjV����ˡ����D�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��9�oData!K�NameA11_Vcb
A��S�oData;K�NameA12__Vcb->VolumeName
A����oData�K�NameXA13_WppCountedStringW( Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Vcb->Vpb ) )
A��S�oData;K�NameA14_LcbToDelete->Fcb
A����oData�K�Name=A15_NtfsFullFileRefNumber( _LcbToDelete->Fcb->FileReference )
A��I�oData1K�NameA16_LcbToDelete
A��	�oData�K�NameoA17_WppCountedStringW( LcbToDelete->FileNameAttr->FileName, (USHORT)LcbToDelete->FileNameAttr->FileNameLength )
A��e�oDataMK�NameA18_LcbToDelete->CleanupCount
A��Q�oData9K�NameA19_SplitPrimaryLcb
	A���oData�K�Name�A20_(SplitPrimaryLcb != NULL) ?                                  WppCountedStringW( SplitPrimaryLcb->FileNameAttr->FileName, (USHORT)SplitPrimaryLcb->FileNameAttr->FileNameLength ) :                                  WppCountedStringW( NULL, 0 )
A����oData�K�NameAA21_(SplitPrimaryLcb != NULL) ? SplitPrimaryLcb->CleanupCount : 0
 �X�l���T����(��L�x�h�8A10_PsGetCurrentThread()A11_Vcb0A12__Vcb->VolumeName�A13_WppCountedStringW( Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Vcb->Vpb ) )0A14_LcbToDelete->Fcb�A15_NtfsFullFileRefNumber( _LcbToDelete->Fcb->FileReference )$A16_LcbToDelete�A17_WppCountedStringW( LcbToDelete->FileNameAttr->FileName, (USHORT)LcbToDelete->FileNameAttr->FileNameLength )@A18_LcbToDelete->CleanupCount,A19_SplitPrimaryLcb�A20_(SplitPrimaryLcb != NULL) ?                                  WppCountedStringW( SplitPrimaryLcb->FileNameAttr->FileName, (USHORT)SplitPrimaryLcb->FileNameAttr->FileNameLength ) :                                  WppCountedStringW( NULL, 0 )�A21_(SplitPrimaryLcb != NULL) ? SplitPrimaryLcb->CleanupCount : 0TEMPt	P��!]�ՒI^����Sg��*D�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��9�oData!K�NameA11_Vcb
A��S�oData;K�NameA12__Vcb->VolumeName
A����oData�K�NameXA13_WppCountedStringW( Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Vcb->Vpb ) )
A��C�oData+K�NameA14_Lcb->Fcb
A����oData}K�Name5A15_NtfsFullFileRefNumber( _Lcb->Fcb->FileReference )
A��W�oData?K�NameA16_Lcb->Fcb->FcbState
A��9�oData!K�NameA17_Lcb
A����oData�K�Name_A18_WppCountedStringW( Lcb->FileNameAttr->FileName, (USHORT)Lcb->FileNameAttr->FileNameLength )
A��c�oDataKK�NameA19_Lcb->FileNameAttr->Flags
	A��M�oData5K�NameA20_Lcb->LcbState
,�d�x���`�����$�8���<�8A10_PsGetCurrentThread()A11_Vcb0A12__Vcb->VolumeName�A13_WppCountedStringW( Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Vcb->Vpb ) ) A14_Lcb->FcbpA15_NtfsFullFileRefNumber( _Lcb->Fcb->FileReference )4A16_Lcb->Fcb->FcbStateA17_Lcb�A18_WppCountedStringW( Lcb->FileNameAttr->FileName, (USHORT)Lcb->FileNameAttr->FileNameLength )@A19_Lcb->FileNameAttr->Flags(A20_Lcb->LcbStateTEMP ����_��Z(+ޢ=�}���RD�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��9�oData!K�NameA11_Vcb
A��S�oData;K�NameA12__Vcb->VolumeName
A����oData�K�NameXA13_WppCountedStringW( Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Vcb->Vpb ) )
A��C�oData+K�NameA14_Scb->Fcb
A����oData}K�Name5A15_NtfsFullFileRefNumber( _Scb->Fcb->FileReference )
A��m�oDataUK�Name!A16_Scb->Fcb->Info.FileAttributes
x�����������<�8A10_PsGetCurrentThread()A11_Vcb0A12__Vcb->VolumeName�A13_WppCountedStringW( Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Vcb->Vpb ) ) A14_Scb->FcbpA15_NtfsFullFileRefNumber( _Scb->Fcb->FileReference )HA16_Scb->Fcb->Info.FileAttributesTEMP�<�C�{� �\fO�Z������D�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��9�oData!K�NameA11_Vcb
A��S�oData;K�NameA12__Vcb->VolumeName
A����oData�K�NameXA13_WppCountedStringW( Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Vcb->Vpb ) )
A��[�oDataCK�NameA14_TargetParentScb->Fcb
A����oData�K�NameAA15_NtfsFullFileRefNumber( _TargetParentScb->Fcb->FileReference )
A��o�oDataWK�Name"A16_TargetParentScb->Fcb->FcbState
����D���4���8A10_PsGetCurrentThread()A11_Vcb0A12__Vcb->VolumeName�A13_WppCountedStringW( Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Vcb->Vpb ) )8A14_TargetParentScb->Fcb�A15_NtfsFullFileRefNumber( _TargetParentScb->Fcb->FileReference )LA16_TargetParentScb->Fcb->FcbStateTEMP�L��&�yI8�_V_F��k���D�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��9�oData!K�NameA11_Vcb
A��S�oData;K�NameA12__Vcb->VolumeName
A����oData�K�NameXA13_WppCountedStringW( Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Vcb->Vpb ) )
A��[�oDataCK�NameA14_TargetParentScb->Fcb
A����oData�K�NameAA15_NtfsFullFileRefNumber( _TargetParentScb->Fcb->FileReference )
A����oDatamK�Name-A16_TargetParentScb->Fcb->Info.FileAttributes
A��o�oDataWK�Name"A17_TargetParentScb->Fcb->FcbState
��$�8�h� �X���@�8A10_PsGetCurrentThread()A11_Vcb0A12__Vcb->VolumeName�A13_WppCountedStringW( Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Vcb->Vpb ) )8A14_TargetParentScb->Fcb�A15_NtfsFullFileRefNumber( _TargetParentScb->Fcb->FileReference )`A16_TargetParentScb->Fcb->Info.FileAttributesLA17_TargetParentScb->Fcb->FcbStateTEMPP���d�=�S�
?�	�����D�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��9�oData!K�NameA11_Vcb
A��S�oData;K�NameA12__Vcb->VolumeName
A����oData�K�NameXA13_WppCountedStringW( Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Vcb->Vpb ) )
A��C�oData+K�NameA14_Scb->Fcb
A����oData}K�Name5A15_NtfsFullFileRefNumber( _Scb->Fcb->FileReference )
�P�d���L�l�8A10_PsGetCurrentThread()A11_Vcb0A12__Vcb->VolumeName�A13_WppCountedStringW( Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Vcb->Vpb ) ) A14_Scb->FcbpA15_NtfsFullFileRefNumber( _Scb->Fcb->FileReference )TEMP���EcL���T�߲��Dp���D�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��9�oData!K�NameA11_Vcb
A��S�oData;K�NameA12__Vcb->VolumeName
A����oData�K�NameXA13_WppCountedStringW( Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Vcb->Vpb ) )
A��C�oData+K�NameA14_Scb->Fcb
A����oData}K�Name5A15_NtfsFullFileRefNumber( _Scb->Fcb->FileReference )
A����oData�K�NameAA16_NtfsFullFileRefNumber( _TargetParentScb->Fcb->FileReference )
0�h�|���d�����8A10_PsGetCurrentThread()A11_Vcb0A12__Vcb->VolumeName�A13_WppCountedStringW( Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Vcb->Vpb ) ) A14_Scb->FcbpA15_NtfsFullFileRefNumber( _Scb->Fcb->FileReference )�A16_NtfsFullFileRefNumber( _TargetParentScb->Fcb->FileReference )TEMP���ϵ��x�U��b�|%0��<D�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��9�oData!K�NameA11_Vcb
A��S�oData;K�NameA12__Vcb->VolumeName
A����oData�K�NameXA13_WppCountedStringW( Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Vcb->Vpb ) )
A��C�oData+K�NameA14_Scb->Fcb
A����oData}K�Name5A15_NtfsFullFileRefNumber( _Scb->Fcb->FileReference )
A��W�oData?K�NameA16__Ccb->FullFileName
x�����������<�8A10_PsGetCurrentThread()A11_Vcb0A12__Vcb->VolumeName�A13_WppCountedStringW( Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Vcb->Vpb ) ) A14_Scb->FcbpA15_NtfsFullFileRefNumber( _Scb->Fcb->FileReference )4A16__Ccb->FullFileNameTEMP�8�F�/���Q��p�]3���D�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��9�oData!K�NameA11_Vcb
A��S�oData;K�NameA12__Vcb->VolumeName
A����oData�K�NameXA13_WppCountedStringW( Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Vcb->Vpb ) )
A��C�oData+K�NameA14_Scb->Fcb
A����oData}K�Name5A15_NtfsFullFileRefNumber( _Scb->Fcb->FileReference )
A��W�oData?K�NameA16__Ccb->FullFileName
A��Q�oData9K�NameA17_TxfVisibleLinks
���$�T��,����8A10_PsGetCurrentThread()A11_Vcb0A12__Vcb->VolumeName�A13_WppCountedStringW( Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Vcb->Vpb ) ) A14_Scb->FcbpA15_NtfsFullFileRefNumber( _Scb->Fcb->FileReference )4A16__Ccb->FullFileName,A17_TxfVisibleLinksTEMP�����T8ס9[�4�M�M���D�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��9�oData!K�NameA11_Vcb
A��S�oData;K�NameA12__Vcb->VolumeName
A����oData�K�NameXA13_WppCountedStringW( Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Vcb->Vpb ) )
A��C�oData+K�NameA14_Scb->Fcb
A����oData}K�Name5A15_NtfsFullFileRefNumber( _Scb->Fcb->FileReference )
A��W�oData?K�NameA16__Ccb->FullFileName
A��K�oData3K�NameA17_AccessStatus
`����������$�X�8A10_PsGetCurrentThread()A11_Vcb0A12__Vcb->VolumeName�A13_WppCountedStringW( Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Vcb->Vpb ) ) A14_Scb->FcbpA15_NtfsFullFileRefNumber( _Scb->Fcb->FileReference )4A16__Ccb->FullFileName(A17_AccessStatusTEMP<���?�I_�P{H�����`D�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��9�oData!K�NameA11_Vcb
A��S�oData;K�NameA12__Vcb->VolumeName
A����oData�K�NameXA13_WppCountedStringW( Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Vcb->Vpb ) )
A��[�oDataCK�NameA14_TargetParentScb->Fcb
A����oData�K�NameAA15_NtfsFullFileRefNumber( _TargetParentScb->Fcb->FileReference )
A��K�oData3K�NameA16__NewLinkName
�����8A10_PsGetCurrentThread()A11_Vcb0A12__Vcb->VolumeName�A13_WppCountedStringW( Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Vcb->Vpb ) )8A14_TargetParentScb->Fcb�A15_NtfsFullFileRefNumber( _TargetParentScb->Fcb->FileReference )(A16__NewLinkNameTEMP4�H�{�4�W�M� �ճ,���D�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��9�oData!K�NameA11_Vcb
A��S�oData;K�NameA12__Vcb->VolumeName
A����oData�K�NameXA13_WppCountedStringW( Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Vcb->Vpb ) )
A��[�oDataCK�NameA14_TargetParentScb->Fcb
A����oData�K�NameAA15_NtfsFullFileRefNumber( _TargetParentScb->Fcb->FileReference )
A��K�oData3K�NameA16__NewLinkName
A���oDatagK�Name*A17_TargetParentScb->Fcb->TxfRmcb->RmState
x����	�	l
�
8A10_PsGetCurrentThread()A11_Vcb0A12__Vcb->VolumeName�A13_WppCountedStringW( Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Vcb->Vpb ) )8A14_TargetParentScb->Fcb�A15_NtfsFullFileRefNumber( _TargetParentScb->Fcb->FileReference )(A16__NewLinkName\A17_TargetParentScb->Fcb->TxfRmcb->RmStateTEMP�4��9�,X������|��D�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��9�oData!K�NameA11_Vcb
A��S�oData;K�NameA12__Vcb->VolumeName
A����oData�K�NameXA13_WppCountedStringW( Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Vcb->Vpb ) )
A��C�oData+K�NameA14_Lcb->Fcb
A����oData}K�Name5A15_NtfsFullFileRefNumber( _Lcb->Fcb->FileReference )
A��9�oData!K�NameA16_Lcb
A����oData�K�Name_A17_WppCountedStringW( Lcb->FileNameAttr->FileName, (USHORT)Lcb->FileNameAttr->FileNameLength )
� P(��8A10_PsGetCurrentThread()A11_Vcb0A12__Vcb->VolumeName�A13_WppCountedStringW( Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Vcb->Vpb ) ) A14_Lcb->FcbpA15_NtfsFullFileRefNumber( _Lcb->Fcb->FileReference )A16_Lcb�A17_WppCountedStringW( Lcb->FileNameAttr->FileName, (USHORT)Lcb->FileNameAttr->FileNameLength )TEMP�		\��c�F�Yg~�
�����D�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��9�oData!K�NameA11_Vcb
A��S�oData;K�NameA12__Vcb->VolumeName
A����oData�K�NameXA13_WppCountedStringW( Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Vcb->Vpb ) )
A��C�oData+K�NameA14_Lcb->Fcb
A����oData}K�Name5A15_NtfsFullFileRefNumber( _Lcb->Fcb->FileReference )
A��9�oData!K�NameA16_Lcb
A����oData�K�Name_A17_WppCountedStringW( Lcb->FileNameAttr->FileName, (USHORT)Lcb->FileNameAttr->FileNameLength )
A����oData�K�Name;A18_NtfsFullFileRefNumber( _ParentScb->Fcb->FileReference )
H\�Dd���8A10_PsGetCurrentThread()A11_Vcb0A12__Vcb->VolumeName�A13_WppCountedStringW( Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Vcb->Vpb ) ) A14_Lcb->FcbpA15_NtfsFullFileRefNumber( _Lcb->Fcb->FileReference )A16_Lcb�A17_WppCountedStringW( Lcb->FileNameAttr->FileName, (USHORT)Lcb->FileNameAttr->FileNameLength )|A18_NtfsFullFileRefNumber( _ParentScb->Fcb->FileReference )TEMP��A��+jP�˳��	�����D�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��K�oData3K�NameA11_NextScb->Vcb
A��e�oDataMK�NameA12__NextScb->Vcb->VolumeName
A����oData�K�NamejA13_WppCountedStringW( NextScb->Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( NextScb->Vcb->Vpb ) )
A��K�oData3K�NameA14_NextScb->Fcb
A����oData�K�Name9A15_NtfsFullFileRefNumber( _NextScb->Fcb->FileReference )
A��]�oDataEK�NameA16_NextScb->CleanupCount
���$ !(!�!8A10_PsGetCurrentThread()(A11_NextScb->Vcb@A12__NextScb->Vcb->VolumeName�A13_WppCountedStringW( NextScb->Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( NextScb->Vcb->Vpb ) )(A14_NextScb->FcbxA15_NtfsFullFileRefNumber( _NextScb->Fcb->FileReference )8A16_NextScb->CleanupCountTEMP,�%
a)}U���q�s�����D�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��K�oData3K�NameA11_NextScb->Vcb
A��e�oDataMK�NameA12__NextScb->Vcb->VolumeName
A����oData�K�NamejA13_WppCountedStringW( NextScb->Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( NextScb->Vcb->Vpb ) )
A��K�oData3K�NameA14_NextScb->Fcb
A����oData�K�Name9A15_NtfsFullFileRefNumber( _NextScb->Fcb->FileReference )
A��C�oData+K�NameA16_ByIdCcbs
A��]�oDataEK�NameA17_NextScb->CleanupCount
�&�&�&0'(4(�(�(8A10_PsGetCurrentThread()(A11_NextScb->Vcb@A12__NextScb->Vcb->VolumeName�A13_WppCountedStringW( NextScb->Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( NextScb->Vcb->Vpb ) )(A14_NextScb->FcbxA15_NtfsFullFileRefNumber( _NextScb->Fcb->FileReference ) A16_ByIdCcbs8A17_NextScb->CleanupCountTEMP�.0du�\ܘZ!m�7�6�����D�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��C�oData+K�NameA11_Scb->Vcb
A��]�oDataEK�NameA12__Scb->Vcb->VolumeName
A����oData�K�NamebA13_WppCountedStringW( Scb->Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Scb->Vcb->Vpb ) )
A��C�oData+K�NameA14_Scb->Fcb
A����oData}K�Name5A15_NtfsFullFileRefNumber( _Scb->Fcb->FileReference )
A��9�oData!K�NameA16_Scb
A��_�oDataGK�NameA17_Scb->AttributeTypeCode
A��Y�oDataAK�NameA18__Scb->AttributeName
A��G�oData/K�NameA19_Scb->State
	A��q�oDataYK�Name#A20_Scb->ScbType.Data.HighWaterMark
	�. /@/x/D0d0�0�0$1X1		|18A10_PsGetCurrentThread() A11_Scb->Vcb8A12__Scb->Vcb->VolumeName�A13_WppCountedStringW( Scb->Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Scb->Vcb->Vpb ) ) A14_Scb->FcbpA15_NtfsFullFileRefNumber( _Scb->Fcb->FileReference )A16_Scb<A17_Scb->AttributeTypeCode4A18__Scb->AttributeName$A19_Scb->StateLA20_Scb->ScbType.Data.HighWaterMarkTEMP�D6W7B�[�\����yNB��HD�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��U�oData=K�NameA11_DirectoryScb->Vcb
A��o�oDataWK�Name"A12__DirectoryScb->Vcb->VolumeName
A���oData�K�NametA13_WppCountedStringW( DirectoryScb->Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( DirectoryScb->Vcb->Vpb ) )
A��U�oData=K�NameA14_DirectoryScb->Fcb
A����oData�K�Name>A15_NtfsFullFileRefNumber( _DirectoryScb->Fcb->FileReference )
A��u�oData]K�Name%A16_(ULONG) Irp->IoStatus.Information
A��S�oData;K�NameA17_BatchOplockCount
�67L7�7�8�8<9�98A10_PsGetCurrentThread()0A11_DirectoryScb->VcbLA12__DirectoryScb->Vcb->VolumeName�A13_WppCountedStringW( DirectoryScb->Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( DirectoryScb->Vcb->Vpb ) )0A14_DirectoryScb->Fcb�A15_NtfsFullFileRefNumber( _DirectoryScb->Fcb->FileReference )PA16_(ULONG) Irp->IoStatus.Information0A17_BatchOplockCountTEMP�T;�1��4�Wca*�3R���dD�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��9�oData!K�NameA11_Vcb
A��9�oData!K�NameA12_Fcb
A��a�oDataIK�NameA13_LocalFlags->EntireFlags
�;�;�;<8A10_PsGetCurrentThread()A11_VcbA12_Fcb<A13_LocalFlags->EntireFlagsTEMPd0=R
TA� PTZ3G�����D�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��9�oData!K�NameA11_Scb
X=�=8A10_PsGetCurrentThread()A11_ScbTEMP�>���I��WP
S�z!���"D�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��9�oData!K�NameA11_Vcb
A��_�oDataGK�NameA12_LocalFlags.EntireFlags
8?p?�?8A10_PsGetCurrentThread()A11_Vcb<A12_LocalFlags.EntireFlagsTEMPL�@n�5�i��]Y 3{�����D�	EventDataA��O�oData7K�NameA10_Vcb->BitmapScb
A��9�oData!K�NameA11_Vcb
�@�@,A10_Vcb->BitmapScbA11_VcbTEMP@�Ay"L��gSUF����L�����D�	EventDataA��I�oData1K�NameA10_Vcb->MftScb
A��9�oData!K�NameA11_Vcb
B8B$A10_Vcb->MftScbA11_VcbTEMP�lC���X�\�V/F�����D�	EventDataA����oDatakK�Name,A10_((PNTFS_DISK_FLUSH_CONTEXT)Context)->Vcb
A��A�oData)K�NameA11_Context
�C�C`A10_((PNTFS_DISK_FLUSH_CONTEXT)Context)->VcbA11_ContextTEMP��E[M<���^�_-Wm�
���D�	EventDataA����oDatakK�Name,A10_((PNTFS_DISK_FLUSH_CONTEXT)Context)->Vcb
A��A�oData)K�NameA11_Context
A����oData�K�Name9A12_NtfsData.DiskFlushContextCompletedWorkItem.List.Flink
FpF�F`A10_((PNTFS_DISK_FLUSH_CONTEXT)Context)->VcbA11_ContextxA12_NtfsData.DiskFlushContextCompletedWorkItem.List.FlinkTEMP�Hφ46�QS6�P��z����D�	EventDataA��9�oData!K�NameA10_Irp
A��G�oData/K�NameA11_IrpContext
A��Q�oData9K�NameA12_IrpContext->Vcb
A��[�oDataCK�NameA13_IrpSp->MinorFunction
A��M�oData5K�NameA14_FsControlCode
TIhI�I�I�IA10_Irp$A11_IrpContext,A12_IrpContext->Vcb8A13_IrpSp->MinorFunction(A14_FsControlCodeTEMP,		�N.���EQ��N�\>��nD�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��9�oData!K�NameA11_Vcb
A��S�oData;K�NameA12__Vcb->VolumeName
A����oData�K�NameXA13_WppCountedStringW( Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Vcb->Vpb ) )
A��M�oData5K�NameA14_Vcb->VcbState
A��g�oDataOK�NameA15_Vcb->DisallowDismountCount
A��[�oDataCK�NameA16_ExplicitLock ? 1 : 0
A���oDatagK�Name*A17_ReadULongNoFence( _Vcb->CleanupCount )
A����oData�K�NameMA18_(UserHandleCount + SystemHandleCount + Vcb->ExternalMetadataCleanupCount)
pO�O�O�O�P�PQHQ�Q8A10_PsGetCurrentThread()A11_Vcb0A12__Vcb->VolumeName�A13_WppCountedStringW( Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Vcb->Vpb ) )(A14_Vcb->VcbStateDA15_Vcb->DisallowDismountCount8A16_ExplicitLock ? 1 : 0\A17_ReadULongNoFence( _Vcb->CleanupCount )�A18_(UserHandleCount + SystemHandleCount + Vcb->ExternalMetadataCleanupCount)TEMP��U�BW�
]��u��Z��D�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��9�oData!K�NameA11_Vcb
A��S�oData;K�NameA12__Vcb->VolumeName
A����oData�K�NameXA13_WppCountedStringW( Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Vcb->Vpb ) )
A��Q�oData9K�NameA14_Vcb->CloseCount
A��e�oDataMK�NameA15_Vcb->SystemFileCloseCount
A��Q�oData9K�NameA16_UserHandleCount
VPVdV�VLWxW�W8A10_PsGetCurrentThread()A11_Vcb0A12__Vcb->VolumeName�A13_WppCountedStringW( Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Vcb->Vpb ) ),A14_Vcb->CloseCount@A15_Vcb->SystemFileCloseCount,A16_UserHandleCountTEMP��ZJ$>?�T��dFnf���zD�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��9�oData!K�NameA11_Vcb
A��S�oData;K�NameA12__Vcb->VolumeName
A����oData�K�NameXA13_WppCountedStringW( Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Vcb->Vpb ) )
A��{�oDatacK�Name(A14_(Ccb != NULL) ? Ccb->AccessFlags : 0
�Z0[D[t[,\8A10_PsGetCurrentThread()A11_Vcb0A12__Vcb->VolumeName�A13_WppCountedStringW( Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Vcb->Vpb ) )XA14_(Ccb != NULL) ? Ccb->AccessFlags : 0TEMP�l_��mlb�S翅$`�~���D�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��9�oData!K�NameA11_Vcb
A��S�oData;K�NameA12__Vcb->VolumeName
A����oData�K�NameXA13_WppCountedStringW( Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Vcb->Vpb ) )
A��M�oData5K�NameA14_ActiveRmCount
A��a�oDataIK�NameA15_DefaultRmActive ? 1 : 0
�_`0```a@a8A10_PsGetCurrentThread()A11_Vcb0A12__Vcb->VolumeName�A13_WppCountedStringW( Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Vcb->Vpb ) )(A14_ActiveRmCount<A15_DefaultRmActive ? 1 : 0TEMP$�c�p�<��Q�n�h���V��&D�	EventDataA��K�oData3K�NameA10___FUNCTION__
A��k�oDataSK�Name A11_(PVOID)Vcb->TxfVcb.DefaultRm
A��A�oData)K�Name�A12_(Vcb->TxfVcb.DefaultRm != NULL) ?                                  _Vcb->TxfVcb.DefaultRm->RmId :                                  NULL
d<d�d(A10___FUNCTION__HA11_(PVOID)Vcb->TxfVcb.DefaultRmA12_(Vcb->TxfVcb.DefaultRm != NULL) ?                                  _Vcb->TxfVcb.DefaultRm->RmId :                                  NULLTEMPh(g_�S�7�!Rd&e&����TD�	EventDataA��G�oData/K�NameA10_IrpContext
A��9�oData!K�NameA11_Vcb
A��K�oData3K�NameA12__VolumeLabel
A��S�oData;K�NameA13__Vcb->DeviceName
xg�g�g�g$A10_IrpContextA11_Vcb(A12__VolumeLabel0A13__Vcb->DeviceNameTEMPP�k�K��w�VT
c�|��xD�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��9�oData!K�NameA11_Vcb
A��S�oData;K�NameA12__Vcb->VolumeName
A����oData�K�NameXA13_WppCountedStringW( Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Vcb->Vpb ) )
A��M�oData5K�NameA14_Vcb->VcbState
A��a�oDataIK�NameA15_Vcb->ReadOnlyCloseCount
A��Q�oData9K�NameA16_Vcb->CloseCount
A��e�oDataMK�NameA17_Vcb->SystemFileCloseCount
Tl�l�l�l�m�m�mn8A10_PsGetCurrentThread()A11_Vcb0A12__Vcb->VolumeName�A13_WppCountedStringW( Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Vcb->Vpb ) )(A14_Vcb->VcbState<A15_Vcb->ReadOnlyCloseCount,A16_Vcb->CloseCount@A17_Vcb->SystemFileCloseCountTEMPP�pU�U�	
]qZ���o���RD�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��9�oData!K�NameA11_Vcb
A��S�oData;K�NameA12__Vcb->VolumeName
A����oData�K�NameXA13_WppCountedStringW( Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Vcb->Vpb ) )
A��S�oData;K�NameA14_Ccb->AccessFlags
Dq|q�q�qxr8A10_PsGetCurrentThread()A11_Vcb0A12__Vcb->VolumeName�A13_WppCountedStringW( Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Vcb->Vpb ) )0A14_Ccb->AccessFlagsTEMP$�u�O���^'[�SSjj�<���D�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��9�oData!K�NameA11_Vcb
A��S�oData;K�NameA12__Vcb->VolumeName
A����oData�K�NameXA13_WppCountedStringW( Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Vcb->Vpb ) )
A��{�oDatacK�Name(A14_(Ccb != NULL) ? Ccb->AccessFlags : 0
A��G�oData/K�NameA15_TypeOfOpen
vTvhv�vPw�w8A10_PsGetCurrentThread()A11_Vcb0A12__Vcb->VolumeName�A13_WppCountedStringW( Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Vcb->Vpb ) )XA14_(Ccb != NULL) ? Ccb->AccessFlags : 0$A15_TypeOfOpenTEMPD�zm͝�0_
8`��L�����D�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��9�oData!K�NameA11_Vcb
A��S�oData;K�NameA12__Vcb->VolumeName
A����oData�K�NameXA13_WppCountedStringW( Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Vcb->Vpb ) )
A��{�oDatacK�Name(A14_(Ccb != NULL) ? Ccb->AccessFlags : 0
A��W�oData?K�NameA15_Irp->RequestorMode
P{�{�{�{�|�|8A10_PsGetCurrentThread()A11_Vcb0A12__Vcb->VolumeName�A13_WppCountedStringW( Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Vcb->Vpb ) )XA14_(Ccb != NULL) ? Ccb->AccessFlags : 04A15_Irp->RequestorModeTEMP������bP)��1�E���D�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��9�oData!K�NameA11_Vcb
A��S�oData;K�NameA12__Vcb->VolumeName
A����oData�K�NameXA13_WppCountedStringW( Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Vcb->Vpb ) )
A��S�oData;K�NameA14_Ccb->AccessFlags
A��G�oData/K�NameA15_Ccb->Flags
\�����؀����8A10_PsGetCurrentThread()A11_Vcb0A12__Vcb->VolumeName�A13_WppCountedStringW( Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Vcb->Vpb ) )0A14_Ccb->AccessFlags$A15_Ccb->FlagsTEMP�\��xߝ�kg^�_�E�g��BD�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��9�oData!K�NameA11_Vcb
A��S�oData;K�NameA12__Vcb->VolumeName
A����oData�K�NameXA13_WppCountedStringW( Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Vcb->Vpb ) )
A��S�oData;K�NameA14_Ccb->AccessFlags
A��G�oData/K�NameA15_Ccb->Flags
A��C�oData+K�NameA16_CallerId
A��Q�oData9K�NameA17_Context.OwnerId
��4�H�x�0�`�����8A10_PsGetCurrentThread()A11_Vcb0A12__Vcb->VolumeName�A13_WppCountedStringW( Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Vcb->Vpb ) )0A14_Ccb->AccessFlags$A15_Ccb->Flags A16_CallerId,A17_Context.OwnerIdTEMPD		�h4���[�:�=}$���D�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��9�oData!K�NameA11_Vcb
A��S�oData;K�NameA12__Vcb->VolumeName
A����oData�K�NameXA13_WppCountedStringW( Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Vcb->Vpb ) )
A��9�oData!K�NameA14_Fcb
A����oDatasK�Name0A15_NtfsFullFileRefNumber( _Fcb->FileReference )
A��W�oData?K�NameA16__Ccb->FullFileName
A��S�oData;K�NameA17_Ccb->AccessFlags
A��q�oDataYK�Name#A18_FileObject->WriteAccess ? 1 : 0
����0����d���Ȏ8A10_PsGetCurrentThread()A11_Vcb0A12__Vcb->VolumeName�A13_WppCountedStringW( Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Vcb->Vpb ) )A14_FcbhA15_NtfsFullFileRefNumber( _Fcb->FileReference )4A16__Ccb->FullFileName0A17_Ccb->AccessFlagsLA18_FileObject->WriteAccess ? 1 : 0TEMP<		@��i#��g_��|n��8����D�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��9�oData!K�NameA11_Vcb
A��S�oData;K�NameA12__Vcb->VolumeName
A����oData�K�NameXA13_WppCountedStringW( Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Vcb->Vpb ) )
A��C�oData+K�NameA14_Scb->Fcb
A����oData}K�Name5A15_NtfsFullFileRefNumber( _Scb->Fcb->FileReference )
A��W�oData?K�NameA16__Ccb->FullFileName
A��S�oData;K�NameA17_Ccb->AccessFlags
A��Y�oDataAK�NameA18_Scb->AttributeFlags
�,�@�p�(�H�����8A10_PsGetCurrentThread()A11_Vcb0A12__Vcb->VolumeName�A13_WppCountedStringW( Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Vcb->Vpb ) ) A14_Scb->FcbpA15_NtfsFullFileRefNumber( _Scb->Fcb->FileReference )4A16__Ccb->FullFileName0A17_Ccb->AccessFlags4A18_Scb->AttributeFlagsTEMP$����qQ<EP��������&D�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��E�oData-K�Name
A11_ZeroFlags
A��W�oData?K�NameA12_Irp->RequestorMode
� �@�8A10_PsGetCurrentThread() A11_ZeroFlags4A12_Irp->RequestorModeTEMP���w�D��8YuAl)~H+8��D�	EventDataA��G�oData/K�NameA10_IrpContext
A��9�oData!K�NameA11_Scb
A��U�oData=K�NameA12_IrpSp->FileObject
�� �$A10_IrpContextA11_Scb0A12_IrpSp->FileObjectTEMP|L���诱V	�r�����D�	EventDataA��G�oData/K�NameA10_IrpContext
A��Y�oDataAK�NameA11_EncryptionOperation
t���$A10_IrpContext4A11_EncryptionOperationTEMPl���*Vd��T3����5���D�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��9�oData!K�NameA11_Vcb
A��S�oData;K�NameA12__Vcb->VolumeName
A����oData�K�NameXA13_WppCountedStringW( Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Vcb->Vpb ) )
A��9�oData!K�NameA14_Fcb
A����oDatasK�Name0A15_NtfsFullFileRefNumber( _Fcb->FileReference )
A��W�oData?K�NameA16__Ccb->FullFileName
A��S�oData;K�NameA17_Ccb->AccessFlags
$�\�p���X�l�ԡ�8A10_PsGetCurrentThread()A11_Vcb0A12__Vcb->VolumeName�A13_WppCountedStringW( Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Vcb->Vpb ) )A14_FcbhA15_NtfsFullFileRefNumber( _Fcb->FileReference )4A16__Ccb->FullFileName0A17_Ccb->AccessFlagsTEMP��A��[C�(T�х�]=�����D�	EventDataA����oDataoK�Name.A10_\                     PsGetCurrentThread()
A��9�oData!K�NameA11_Vcb
A��S�oData;K�NameA12__Vcb->VolumeName
A����oData�K�NameXA13_WppCountedStringW( Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Vcb->Vpb ) )
A��9�oData!K�NameA14_Fcb
A����oDatasK�Name0A15_NtfsFullFileRefNumber( _Fcb->FileReference )
A��W�oData?K�NameA16__Ccb->FullFileName
A��S�oData;K�NameA17_Ccb->AccessFlags
�� �4�d��0���̨dA10_\                     PsGetCurrentThread()A11_Vcb0A12__Vcb->VolumeName�A13_WppCountedStringW( Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Vcb->Vpb ) )A14_FcbhA15_NtfsFullFileRefNumber( _Fcb->FileReference )4A16__Ccb->FullFileName0A17_Ccb->AccessFlagsTEMP�

x�I�-���Z|�KХ@/���FD�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��9�oData!K�NameA11_Vcb
A��S�oData;K�NameA12__Vcb->VolumeName
A����oData�K�NameXA13_WppCountedStringW( Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Vcb->Vpb ) )
A��9�oData!K�NameA14_Fcb
A����oDatasK�Name0A15_NtfsFullFileRefNumber( _Fcb->FileReference )
A��W�oData?K�NameA16__Ccb->FullFileName
A��S�oData;K�NameA17_Ccb->AccessFlags
A��_�oDataGK�NameA18_HandleInfo->HandleInfo
A��W�oData?K�NameA19_Irp->RequestorMode
	@�x�����t����$�T���8A10_PsGetCurrentThread()A11_Vcb0A12__Vcb->VolumeName�A13_WppCountedStringW( Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Vcb->Vpb ) )A14_FcbhA15_NtfsFullFileRefNumber( _Fcb->FileReference )4A16__Ccb->FullFileName0A17_Ccb->AccessFlags<A18_HandleInfo->HandleInfo4A19_Irp->RequestorModeTEMP����v�a���S�P�H>H����D�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��9�oData!K�NameA11_Vcb
A��S�oData;K�NameA12__Vcb->VolumeName
A����oData�K�NameXA13_WppCountedStringW( Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Vcb->Vpb ) )
A����oDatasK�Name0A14_(DasdCcb != NULL) ? DasdCcb->AccessFlags : 0
� �4�d��8A10_PsGetCurrentThread()A11_Vcb0A12__Vcb->VolumeName�A13_WppCountedStringW( Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Vcb->Vpb ) )hA14_(DasdCcb != NULL) ? DasdCcb->AccessFlags : 0TEMP0@��ʘ���%ZP�\�z���D�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��9�oData!K�NameA11_Vcb
A��S�oData;K�NameA12__Vcb->VolumeName
A����oData�K�NameXA13_WppCountedStringW( Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Vcb->Vpb ) )
A��9�oData!K�NameA14_Fcb
A����oDatasK�Name0A15_NtfsFullFileRefNumber( _Fcb->FileReference )
A��9�oData!K�NameA16_Scb
A��_�oDataGK�NameA17_Scb->AttributeTypeCode
A��Y�oDataAK�NameA18__Scb->AttributeName
A��K�oData3K�NameA19_Scb->Persist
	A��_�oDataGK�NameA20_HandleInfo->HandleInfo
�T�h���P�d�̼��P�x�8A10_PsGetCurrentThread()A11_Vcb0A12__Vcb->VolumeName�A13_WppCountedStringW( Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Vcb->Vpb ) )A14_FcbhA15_NtfsFullFileRefNumber( _Fcb->FileReference )A16_Scb<A17_Scb->AttributeTypeCode4A18__Scb->AttributeName(A19_Scb->Persist<A20_HandleInfo->HandleInfoTEMP�����Y.(LmV��!�Yr����D�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��9�oData!K�NameA11_Vcb
A��S�oData;K�NameA12__Vcb->VolumeName
A����oData�K�NameXA13_WppCountedStringW( Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Vcb->Vpb ) )
A��9�oData!K�NameA14_Fcb
A����oDatasK�Name0A15_NtfsFullFileRefNumber( _Fcb->FileReference )
A��O�oData7K�NameA16_Fcb->FcbState2
A��9�oData!K�NameA17_Scb
A��_�oDataGK�NameA18_Scb->AttributeTypeCode
A��Y�oDataAK�NameA19__Scb->AttributeName
	A��K�oData3K�NameA20_Scb->Persist
A��_�oDataGK�NameA21_HandleInfo->HandleInfo
�����4����h��������@�8A10_PsGetCurrentThread()A11_Vcb0A12__Vcb->VolumeName�A13_WppCountedStringW( Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Vcb->Vpb ) )A14_FcbhA15_NtfsFullFileRefNumber( _Fcb->FileReference ),A16_Fcb->FcbState2A17_Scb<A18_Scb->AttributeTypeCode4A19__Scb->AttributeName(A20_Scb->Persist<A21_HandleInfo->HandleInfoTEMPh	

����fvaY�_v�J�l��:D�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��9�oData!K�NameA11_Vcb
A��S�oData;K�NameA12__Vcb->VolumeName
A����oData�K�NameXA13_WppCountedStringW( Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Vcb->Vpb ) )
A��9�oData!K�NameA14_Fcb
A����oDatasK�Name0A15_NtfsFullFileRefNumber( _Fcb->FileReference )
A��M�oData5K�NameA16_Fcb->FcbState
A��9�oData!K�NameA17_Scb
A��_�oDataGK�NameA18_Scb->AttributeTypeCode
A��Y�oDataAK�NameA19__Scb->AttributeName
	A��K�oData3K�NameA20_Scb->Persist
A��_�oDataGK�NameA21_HandleInfo->HandleInfo
A��W�oData?K�NameA22_Irp->RequestorMode
��(�<�l�$�8��������L�t���8A10_PsGetCurrentThread()A11_Vcb0A12__Vcb->VolumeName�A13_WppCountedStringW( Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Vcb->Vpb ) )A14_FcbhA15_NtfsFullFileRefNumber( _Fcb->FileReference )(A16_Fcb->FcbStateA17_Scb<A18_Scb->AttributeTypeCode4A19__Scb->AttributeName(A20_Scb->Persist<A21_HandleInfo->HandleInfo4A22_Irp->RequestorModeTEMP���Y�X�N�_`�;�D�B���D�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��9�oData!K�NameA11_Vcb
A��S�oData;K�NameA12__Vcb->VolumeName
A����oData�K�NameXA13_WppCountedStringW( Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Vcb->Vpb ) )
A��C�oData+K�NameA14_Scb->Fcb
A����oData}K�Name5A15_NtfsFullFileRefNumber( _Scb->Fcb->FileReference )
A��W�oData?K�NameA16_Scb->Fcb->FcbState
A��_�oDataGK�NameA17_HandleInfo->HandleInfo
\����������� �T�8A10_PsGetCurrentThread()A11_Vcb0A12__Vcb->VolumeName�A13_WppCountedStringW( Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Vcb->Vpb ) ) A14_Scb->FcbpA15_NtfsFullFileRefNumber( _Scb->Fcb->FileReference )4A16_Scb->Fcb->FcbState<A17_HandleInfo->HandleInfoTEMP

8����}_t�_�(��)��rD�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��C�oData+K�NameA11_Scb->Vcb
A��]�oDataEK�NameA12__Scb->Vcb->VolumeName
A����oData�K�NamebA13_WppCountedStringW( Scb->Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Scb->Vcb->Vpb ) )
A��C�oData+K�NameA14_Scb->Fcb
A����oData}K�Name5A15_NtfsFullFileRefNumber( _Scb->Fcb->FileReference )
A��9�oData!K�NameA16_Scb
A��_�oDataGK�NameA17_Scb->AttributeTypeCode
A��Y�oDataAK�NameA18__Scb->AttributeName
A��_�oDataGK�NameA19_HandleInfo->HandleInfo
	�8�X���\�|����<�p�8A10_PsGetCurrentThread() A11_Scb->Vcb8A12__Scb->Vcb->VolumeName�A13_WppCountedStringW( Scb->Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Scb->Vcb->Vpb ) ) A14_Scb->FcbpA15_NtfsFullFileRefNumber( _Scb->Fcb->FileReference )A16_Scb<A17_Scb->AttributeTypeCode4A18__Scb->AttributeName<A19_HandleInfo->HandleInfoTEMP$

X�V��;�Y.0kXKY4��vD�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��C�oData+K�NameA11_Scb->Vcb
A��]�oDataEK�NameA12__Scb->Vcb->VolumeName
A����oData�K�NamebA13_WppCountedStringW( Scb->Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Scb->Vcb->Vpb ) )
A��C�oData+K�NameA14_Scb->Fcb
A����oData}K�Name5A15_NtfsFullFileRefNumber( _Scb->Fcb->FileReference )
A��9�oData!K�NameA16_Scb
A��_�oDataGK�NameA17_Scb->AttributeTypeCode
A��Y�oDataAK�NameA18__Scb->AttributeName
A��c�oDataKK�NameA19_Scb->ShareAccess.Writers
	 �X�x���|���� �\���8A10_PsGetCurrentThread() A11_Scb->Vcb8A12__Scb->Vcb->VolumeName�A13_WppCountedStringW( Scb->Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Scb->Vcb->Vpb ) ) A14_Scb->FcbpA15_NtfsFullFileRefNumber( _Scb->Fcb->FileReference )A16_Scb<A17_Scb->AttributeTypeCode4A18__Scb->AttributeName@A19_Scb->ShareAccess.WritersTEMP�		@����Yw�Z�<�y9z&��:D�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��G�oData/K�NameA11_TypeOfOpen
A��9�oData!K�NameA12_Vcb
A��S�oData;K�NameA13__Vcb->VolumeName
A����oData�K�NameXA14_WppCountedStringW( Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Vcb->Vpb ) )
A��C�oData+K�NameA15_Scb->Fcb
A����oData}K�Name5A16_NtfsFullFileRefNumber( _Scb->Fcb->FileReference )
A����oDatamK�Name-A17_(Ccb != NULL) ? _Ccb->FullFileName : NULL
A��{�oDatacK�Name(A18_(Ccb != NULL) ? Ccb->AccessFlags : 0
��,�P�d���L�l���<�8A10_PsGetCurrentThread()$A11_TypeOfOpenA12_Vcb0A13__Vcb->VolumeName�A14_WppCountedStringW( Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Vcb->Vpb ) ) A15_Scb->FcbpA16_NtfsFullFileRefNumber( _Scb->Fcb->FileReference )`A17_(Ccb != NULL) ? _Ccb->FullFileName : NULLXA18_(Ccb != NULL) ? Ccb->AccessFlags : 0TEMP(	��x�ä/Q��H^E!v��D�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��9�oData!K�NameA11_Vcb
A��S�oData;K�NameA12__Vcb->VolumeName
A����oData�K�NameXA13_WppCountedStringW( Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Vcb->Vpb ) )
A��G�oData/K�NameA14_TypeOfOpen
A���oDatagK�Name*A15_IrpSp->FileObject->WriteAccess ? 1 : 0
A��C�oData+K�NameA16_Scb->Fcb
A����oData}K�Name5A17_NtfsFullFileRefNumber( _Scb->Fcb->FileReference )
A��_�oDataGK�NameA18_Scb->AttributeTypeCode
A��W�oData?K�NameA19_Scb->Fcb->FcbState
	A����oDatamK�Name-A20_(Ccb != NULL) ? _Ccb->FullFileName : NULL
������$���\�|��(�\�8A10_PsGetCurrentThread()A11_Vcb0A12__Vcb->VolumeName�A13_WppCountedStringW( Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Vcb->Vpb ) )$A14_TypeOfOpen\A15_IrpSp->FileObject->WriteAccess ? 1 : 0 A16_Scb->FcbpA17_NtfsFullFileRefNumber( _Scb->Fcb->FileReference )<A18_Scb->AttributeTypeCode4A19_Scb->Fcb->FcbState`A20_(Ccb != NULL) ? _Ccb->FullFileName : NULLTEMPl���!�VĐQGN���r���D�	EventDataA��G�oData/K�NameA10_(PVOID)Vcb
A��O�oData7K�NameA11_InputParameter
���$A10_(PVOID)Vcb,A11_InputParameterTEMP��]�
�\�:9]�P	����D�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��Q�oData9K�NameA11_IrpContext->Vcb
A��k�oDataSK�Name A12__IrpContext->Vcb->VolumeName
A���oData�K�NamepA13_WppCountedStringW( IrpContext->Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( IrpContext->Vcb->Vpb ) )
A��O�oData7K�NameA14_NtfsData.Flags
p������8A10_PsGetCurrentThread(),A11_IrpContext->VcbHA12__IrpContext->Vcb->VolumeName�A13_WppCountedStringW( IrpContext->Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( IrpContext->Vcb->Vpb ) ),A14_NtfsData.FlagsTEMPH����M��\V��ł������D�	EventDataA��9�oData!K�NameA10_Vcb
A��M�oData5K�NameA11_Vcb->VcbState
<�P�A10_Vcb(A11_Vcb->VcbStateTEMPp���wBY��
��^w��XD�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��Q�oData9K�NameA11_IrpContext->Vcb
A��k�oDataSK�Name A12__IrpContext->Vcb->VolumeName
A���oData�K�NamepA13_WppCountedStringW( IrpContext->Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( IrpContext->Vcb->Vpb ) )
T��8A10_PsGetCurrentThread(),A11_IrpContext->VcbHA12__IrpContext->Vcb->VolumeName�A13_WppCountedStringW( IrpContext->Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( IrpContext->Vcb->Vpb ) )TEMP��So����__��q��.����D�	EventDataA��u�oData]K�Name%A10_ScrubResumeContext.SystemScbIndex
A��k�oDataSK�Name A11_ScrubResumeContext.ResumeVcn
A��w�oData_K�Name&A12_ScrubResumeContext.ResumeVcnOffset
�0xPA10_ScrubResumeContext.SystemScbIndexHA11_ScrubResumeContext.ResumeVcnTA12_ScrubResumeContext.ResumeVcnOffsetTEMPlLN+f����WHt�1C��JD�	EventDataA��9�oData!K�NameA10_Scb
A��k�oDataSK�Name A11_ScrubResumeContext.ResumeVcn
A��w�oData_K�Name&A12_ScrubResumeContext.ResumeVcnOffset
���A10_ScbHA11_ScrubResumeContext.ResumeVcnTA12_ScrubResumeContext.ResumeVcnOffsetTEMP0
����̺[���������D�	EventDataA��u�oData]K�Name%A10_ScrubResumeContext.SystemScbIndex

PA10_ScrubResumeContext.SystemScbIndexTEMP		�	���@^h��Y�Ɯ���D�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��9�oData!K�NameA11_Vcb
A��S�oData;K�NameA12__Vcb->VolumeName
A����oData�K�NameXA13_WppCountedStringW( Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Vcb->Vpb ) )
A��G�oData/K�NameA14_TypeOfOpen
A��C�oData+K�NameA15_Scb->Fcb
A����oData}K�Name5A16_NtfsFullFileRefNumber( _Scb->Fcb->FileReference )
A��W�oData?K�NameA17__Ccb->FullFileName
A��S�oData;K�NameA18_Ccb->AccessFlags
4l��h��P8A10_PsGetCurrentThread()A11_Vcb0A12__Vcb->VolumeName�A13_WppCountedStringW( Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Vcb->Vpb ) )$A14_TypeOfOpen A15_Scb->FcbpA16_NtfsFullFileRefNumber( _Scb->Fcb->FileReference )4A17__Ccb->FullFileName0A18_Ccb->AccessFlagsTEMP@`�u��ΪZVB�|��7����D�	EventDataA��9�oData!K�NameA10_Scb
A��I�oData1K�NameA11_Scb->TxfScb
��A10_Scb$A11_Scb->TxfScbTEMP8Xl�k�3T�e����1��BD�	EventDataA��9�oData!K�NameA10_Scb
A��k�oDataSK�Name A11_ScrubContext.OperationStatus
A��w�oData_K�Name&A12_ScrubContext.NumberOfBytesRepaired
A��s�oData[K�Name$A13_ScrubContext.NumberOfBytesFailed
A��k�oDataSK�Name A14_ScrubContext.ErrorFileOffset
A��c�oDataKK�NameA15_ScrubContext.ErrorLength
A����oData�K�Name8A16_ScrubContext.ParityExtentData->NumberOfParityExtents
�� t�LA10_ScbHA11_ScrubContext.OperationStatusTA12_ScrubContext.NumberOfBytesRepairedPA13_ScrubContext.NumberOfBytesFailedHA14_ScrubContext.ErrorFileOffset@A15_ScrubContext.ErrorLengthxA16_ScrubContext.ParityExtentData->NumberOfParityExtentsTEMP 4I)��/G�Q��d\B���:D�	EventDataA��9�oData!K�NameA10_Scb
A��?�oData'K�Name
A11_Status
A��w�oData_K�Name&A12_ScrubContext.NumberOfBytesRepaired
A��s�oData[K�Name$A13_ScrubContext.NumberOfBytesFailed
A����oData�K�Name8A14_ScrubContext.ParityExtentData->NumberOfParityExtents
���lA10_ScbA11_StatusTA12_ScrubContext.NumberOfBytesRepairedPA13_ScrubContext.NumberOfBytesFailedxA14_ScrubContext.ParityExtentData->NumberOfParityExtentsTEMP�yLh�]]%L���!���~D�	EventDataA��]�oDataEK�NameA10_InternalFileReference
�8A10_InternalFileReferenceTEMP����E�sC^�L��8���D�	EventDataA��9�oData!K�NameA10_Scb
A��K�oData3K�NameA11_ScrubIoCount
A��I�oData1K�NameA12_Irp->Cancel
A����oData�K�Name8A13_ScrubContext.ParityExtentData->NumberOfParityExtents
  D h A10_Scb(A11_ScrubIoCount$A12_Irp->CancelxA13_ScrubContext.ParityExtentData->NumberOfParityExtentsTEMP`�!c����R�aTD�zU���D�	EventDataA��9�oData!K�NameA10_Scb
A��Y�oDataAK�NameA11__Scb->AttributeName
�!"A10_Scb4A11__Scb->AttributeNameTEMP@ #ƈ�=��_
�}X�(Of���D�	EventDataA��9�oData!K�NameA10_Scb
A��I�oData1K�NameA11_StartingVcn
	H#		\#A10_Scb$A11_StartingVcnTEMP��$=S��]Q�M��P����D�	EventDataA��9�oData!K�NameA10_Scb
A��Q�oData9K�NameA11_FileScrubOffset
A��S�oData;K�NameA12_SectorAlignedVdl
�$%<%A10_Scb,A11_FileScrubOffset0A12_SectorAlignedVdlTEMP@L&4~zE�'R%4K�TP����D�	EventDataA��9�oData!K�NameA10_Scb
A��I�oData1K�NameA11_StartingVcn
t&�&A10_Scb$A11_StartingVcnTEMP��'��m߼�_W�\�}�|u���D�	EventDataA��9�oData!K�NameA10_Scb
A��I�oData1K�NameA11_StartingVcn
A��K�oData3K�NameA12_ClusterCount
(,(P(A10_Scb$A11_StartingVcn(A12_ClusterCountTEMPt+;�����V�K���YK���D�	EventDataA��9�oData!K�NameA10_Scb
A��a�oDataIK�NameA11_DsmRange.StartingOffset
A����oData{K�Name4A12_DsmRange.StartingOffset + DsmRange.LengthInBytes
A��_�oDataGK�NameA13_DsmRange.LengthInBytes
A��I�oData1K�NameA14_StartingVcn
A��U�oData=K�NameA15_StartingVcnOffset
A��S�oData;K�NameA16_SectorAlignedVdl
,,P,�,�, -P-A10_Scb<A11_DsmRange.StartingOffsetpA12_DsmRange.StartingOffset + DsmRange.LengthInBytes<A13_DsmRange.LengthInBytes$A14_StartingVcn0A15_StartingVcnOffset0A16_SectorAlignedVdlTEMP��0�W���NP�
��U����FD�	EventDataA��9�oData!K�NameA10_Scb
A��I�oData1K�NameA11_StartingVcn
A��m�oDataUK�Name!A12_ScrubContext->ErrorFileOffset
A��O�oData7K�NameA13_ScrubbedLength
A��m�oDataUK�Name!A14_ScrubContext->OperationStatus
A��u�oData]K�Name%A15_ScrubContext->NumberOfBytesFailed
A��y�oDataaK�Name'A16_ScrubContext->NumberOfBytesRepaired
A��[�oDataCK�NameA17_NewParityExtentCount
�1�1�12H2�2�243A10_Scb$A11_StartingVcnHA12_ScrubContext->ErrorFileOffset,A13_ScrubbedLengthHA14_ScrubContext->OperationStatusPA15_ScrubContext->NumberOfBytesFailedTA16_ScrubContext->NumberOfBytesRepaired8A17_NewParityExtentCountTEMP,@4|��ϺR$j�)�n����D�	EventDataA��9�oData!K�NameA10_Scb
A��?�oData'K�Name
A11_Status
h4|4A10_ScbA11_StatusTEMP�p7�����?YR%>�#�#�;���D�	EventDataA��9�oData!K�NameA10_Scb
A��w�oData_K�Name&A11_RepairDataSetRange->StartingOffset
A����oData�K�NamebA12_RepairDataSetRange->StartingOffset +                         RepairDataSetRange->LengthInBytes
A��u�oData]K�Name%A13_RepairDataSetRange->LengthInBytes
A��S�oData;K�NameA14_RepairFileOffset
�7�7<89X9A10_ScbTA11_RepairDataSetRange->StartingOffset�A12_RepairDataSetRange->StartingOffset +                         RepairDataSetRange->LengthInBytesPA13_RepairDataSetRange->LengthInBytes0A14_RepairFileOffsetTEMP8d:FF�T�W�dF<\-����D�	EventDataA��9�oData!K�NameA10_Scb
A��E�oData-K�Name
A11_IrpStatus
�:�:A10_Scb A11_IrpStatusTEMP|�;w�).˵�^
	u�	�����D�	EventDataA��9�oData!K�NameA10_Scb
A��g�oDataOK�NameA11_RepairCopiesOutput->Status
�;�;A10_ScbDA11_RepairCopiesOutput->StatusTEMP�		�@��/b9��VO���G���:D�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��9�oData!K�NameA11_Vcb
A��S�oData;K�NameA12__Vcb->VolumeName
A����oData�K�NameXA13_WppCountedStringW( Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Vcb->Vpb ) )
A��G�oData/K�NameA14_TypeOfOpen
A��C�oData+K�NameA15_Scb->Fcb
A����oData}K�Name5A16_NtfsFullFileRefNumber( _Scb->Fcb->FileReference )
A����oDatamK�Name-A17_(Ccb != NULL) ? _Ccb->FullFileName : NULL
A��{�oDatacK�Name(A18_(Ccb != NULL) ? Ccb->AccessFlags : 0
`A�A�A�A�B�B�BHC�C8A10_PsGetCurrentThread()A11_Vcb0A12__Vcb->VolumeName�A13_WppCountedStringW( Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Vcb->Vpb ) )$A14_TypeOfOpen A15_Scb->FcbpA16_NtfsFullFileRefNumber( _Scb->Fcb->FileReference )`A17_(Ccb != NULL) ? _Ccb->FullFileName : NULLXA18_(Ccb != NULL) ? Ccb->AccessFlags : 0TEMP�		H�d�yzQZ�c�Lų���D�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��9�oData!K�NameA11_Vcb
A��S�oData;K�NameA12__Vcb->VolumeName
A����oData�K�NameXA13_WppCountedStringW( Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Vcb->Vpb ) )
A��9�oData!K�NameA14_Fcb
A����oDatasK�Name0A15_NtfsFullFileRefNumber( _Fcb->FileReference )
A��9�oData!K�NameA16_Scb
A��_�oDataGK�NameA17_Scb->AttributeTypeCode
A��Y�oDataAK�NameA18__Scb->AttributeName
�H�HI4I�IJhJ|J�J8A10_PsGetCurrentThread()A11_Vcb0A12__Vcb->VolumeName�A13_WppCountedStringW( Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Vcb->Vpb ) )A14_FcbhA15_NtfsFullFileRefNumber( _Fcb->FileReference )A16_Scb<A17_Scb->AttributeTypeCode4A18__Scb->AttributeNameTEMP|		8O�䂬��U��M7���D�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��9�oData!K�NameA11_Vcb
A��S�oData;K�NameA12__Vcb->VolumeName
A����oData�K�NameXA13_WppCountedStringW( Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Vcb->Vpb ) )
A��G�oData/K�NameA14_TypeOfOpen
A��C�oData+K�NameA15_Scb->Fcb
A����oData}K�Name5A16_NtfsFullFileRefNumber( _Scb->Fcb->FileReference )
A����oDatamK�Name-A17_(Ccb != NULL) ? _Ccb->FullFileName : NULL
A��W�oData?K�NameA18_Irp->RequestorMode
�O$P8PhP QDQdQ�Q4R8A10_PsGetCurrentThread()A11_Vcb0A12__Vcb->VolumeName�A13_WppCountedStringW( Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Vcb->Vpb ) )$A14_TypeOfOpen A15_Scb->FcbpA16_NtfsFullFileRefNumber( _Scb->Fcb->FileReference )`A17_(Ccb != NULL) ? _Ccb->FullFileName : NULL4A18_Irp->RequestorModeTEMPd		�VKe��}.�V�QK�����D�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��G�oData/K�NameA11_TypeOfOpen
A��9�oData!K�NameA12_Vcb
A��S�oData;K�NameA13__Vcb->VolumeName
A����oData�K�NameXA14_WppCountedStringW( Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Vcb->Vpb ) )
A��C�oData+K�NameA15_Scb->Fcb
A����oData}K�Name5A16_NtfsFullFileRefNumber( _Scb->Fcb->FileReference )
A����oDatamK�Name-A17_(Ccb != NULL) ? _Ccb->FullFileName : NULL
A��M�oData5K�NameA18_Vcb->VcbState
\W�W�W�W�W�X�XDY�Y8A10_PsGetCurrentThread()$A11_TypeOfOpenA12_Vcb0A13__Vcb->VolumeName�A14_WppCountedStringW( Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Vcb->Vpb ) ) A15_Scb->FcbpA16_NtfsFullFileRefNumber( _Scb->Fcb->FileReference )`A17_(Ccb != NULL) ? _Ccb->FullFileName : NULL(A18_Vcb->VcbStateTEMPx�^���M��\�T�Lp8N���D�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��9�oData!K�NameA11_Vcb
A��S�oData;K�NameA12__Vcb->VolumeName
A����oData�K�NameXA13_WppCountedStringW( Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Vcb->Vpb ) )
A��C�oData+K�NameA14_Scb->Fcb
A����oData}K�Name5A15_NtfsFullFileRefNumber( _Scb->Fcb->FileReference )
A��9�oData!K�NameA16_Scb
A��_�oDataGK�NameA17_Scb->AttributeTypeCode
A��Y�oDataAK�NameA18__Scb->AttributeName
A��K�oData3K�NameA19_Scb->Persist
	A��o�oDataWK�Name"A20_(Ccb != NULL) ? Ccb->Flags : 0
�_�_�_`�`�`La`a�a�a�a8A10_PsGetCurrentThread()A11_Vcb0A12__Vcb->VolumeName�A13_WppCountedStringW( Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Vcb->Vpb ) ) A14_Scb->FcbpA15_NtfsFullFileRefNumber( _Scb->Fcb->FileReference )A16_Scb<A17_Scb->AttributeTypeCode4A18__Scb->AttributeName(A19_Scb->PersistLA20_(Ccb != NULL) ? Ccb->Flags : 0TEMPtf�i4���X�c	}�'����D�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��9�oData!K�NameA11_Vcb
A��S�oData;K�NameA12__Vcb->VolumeName
A����oData�K�NameXA13_WppCountedStringW( Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Vcb->Vpb ) )
A��9�oData!K�NameA14_Fcb
A����oDatasK�Name0A15_NtfsFullFileRefNumber( _Fcb->FileReference )
A��c�oDataKK�NameA16_Fcb->Info.FileAttributes
A��K�oData3K�NameA17_IrpSp->Flags
�f�f�fg�g�gPh�h8A10_PsGetCurrentThread()A11_Vcb0A12__Vcb->VolumeName�A13_WppCountedStringW( Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Vcb->Vpb ) )A14_FcbhA15_NtfsFullFileRefNumber( _Fcb->FileReference )@A16_Fcb->Info.FileAttributes(A17_IrpSp->FlagsTEMP��lG�`�E[q�]�����D�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��9�oData!K�NameA11_Vcb
A��S�oData;K�NameA12__Vcb->VolumeName
A����oData�K�NameXA13_WppCountedStringW( Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Vcb->Vpb ) )
A��C�oData+K�NameA14_Scb->Fcb
A����oData}K�Name5A15_NtfsFullFileRefNumber( _Scb->Fcb->FileReference )
A����oDatamK�Name-A16_(Ccb != NULL) ? _Ccb->FullFileName : NULL
A��W�oData?K�NameA17_Irp->RequestorMode
Tm�m�m�m�n�noxo8A10_PsGetCurrentThread()A11_Vcb0A12__Vcb->VolumeName�A13_WppCountedStringW( Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Vcb->Vpb ) ) A14_Scb->FcbpA15_NtfsFullFileRefNumber( _Scb->Fcb->FileReference )`A16_(Ccb != NULL) ? _Ccb->FullFileName : NULL4A17_Irp->RequestorModeTEMP��s�Xt��~PT)0x��wL���D�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��9�oData!K�NameA11_Vcb
A��S�oData;K�NameA12__Vcb->VolumeName
A����oData�K�NameXA13_WppCountedStringW( Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Vcb->Vpb ) )
A��C�oData+K�NameA14_Scb->Fcb
A����oData}K�Name5A15_NtfsFullFileRefNumber( _Scb->Fcb->FileReference )
A����oDatamK�Name-A16_(Ccb != NULL) ? _Ccb->FullFileName : NULL
A��M�oData5K�NameA17_Vcb->VcbState
@txt�t�ttu�uvdv8A10_PsGetCurrentThread()A11_Vcb0A12__Vcb->VolumeName�A13_WppCountedStringW( Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Vcb->Vpb ) ) A14_Scb->FcbpA15_NtfsFullFileRefNumber( _Scb->Fcb->FileReference )`A16_(Ccb != NULL) ? _Ccb->FullFileName : NULL(A17_Vcb->VcbStateTEMP�Xzm+;���S0�V!)9���D�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��9�oData!K�NameA11_Vcb
A��S�oData;K�NameA12__Vcb->VolumeName
A����oData�K�NameXA13_WppCountedStringW( Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Vcb->Vpb ) )
A����oDatasK�Name0A14_NtfsFullFileRefNumber( _Fcb->FileReference )
A����oDatamK�Name-A15_(Ccb != NULL) ? _Ccb->FullFileName : NULL
A��{�oDatacK�Name(A16_(Ccb != NULL) ? Ccb->AccessFlags : 0
�z{0{`{|�|�|8A10_PsGetCurrentThread()A11_Vcb0A12__Vcb->VolumeName�A13_WppCountedStringW( Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Vcb->Vpb ) )hA14_NtfsFullFileRefNumber( _Fcb->FileReference )`A15_(Ccb != NULL) ? _Ccb->FullFileName : NULLXA16_(Ccb != NULL) ? Ccb->AccessFlags : 0TEMP�	�*����d�Uv�)8��Wb��xD�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��G�oData/K�NameA11_TypeOfOpen
A��9�oData!K�NameA12_Vcb
A��S�oData;K�NameA13__Vcb->VolumeName
A����oData�K�NameXA14_WppCountedStringW( Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Vcb->Vpb ) )
A��C�oData+K�NameA15_Scb->Fcb
A����oData}K�Name5A16_NtfsFullFileRefNumber( _Scb->Fcb->FileReference )
A��_�oDataGK�NameA17_Scb->AttributeTypeCode
A��Y�oDataAK�NameA18_Scb->Fcb->FcbState2
A����oDatamK�Name-A19_(Ccb != NULL) ? _Ccb->FullFileName : NULL
	A��{�oDatacK�Name(A20_(Ccb != NULL) ? Ccb->AccessFlags : 0
A��q�oDataYK�Name#A21_(Ccb != NULL) ? Ccb->Flags2 : 0
ԃ�0�D�t�,�L�����,����8A10_PsGetCurrentThread()$A11_TypeOfOpenA12_Vcb0A13__Vcb->VolumeName�A14_WppCountedStringW( Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Vcb->Vpb ) ) A15_Scb->FcbpA16_NtfsFullFileRefNumber( _Scb->Fcb->FileReference )<A17_Scb->AttributeTypeCode4A18_Scb->Fcb->FcbState2`A19_(Ccb != NULL) ? _Ccb->FullFileName : NULLXA20_(Ccb != NULL) ? Ccb->AccessFlags : 0LA21_(Ccb != NULL) ? Ccb->Flags2 : 0TEMPx

�aê9�!_��3�O����D�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��G�oData/K�NameA11_TypeOfOpen
A��9�oData!K�NameA12_Vcb
A��S�oData;K�NameA13__Vcb->VolumeName
A����oData�K�NameXA14_WppCountedStringW( Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Vcb->Vpb ) )
A��C�oData+K�NameA15_Scb->Fcb
A����oData}K�Name5A16_NtfsFullFileRefNumber( _Scb->Fcb->FileReference )
A��_�oDataGK�NameA17_Scb->AttributeTypeCode
A����oDatamK�Name-A18_(Ccb != NULL) ? _Ccb->FullFileName : NULL
A��{�oDatacK�Name(A19_(Ccb != NULL) ? Ccb->AccessFlags : 0
	̌�(�<�l�$�D����P�8A10_PsGetCurrentThread()$A11_TypeOfOpenA12_Vcb0A13__Vcb->VolumeName�A14_WppCountedStringW( Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Vcb->Vpb ) ) A15_Scb->FcbpA16_NtfsFullFileRefNumber( _Scb->Fcb->FileReference )<A17_Scb->AttributeTypeCode`A18_(Ccb != NULL) ? _Ccb->FullFileName : NULLXA19_(Ccb != NULL) ? Ccb->AccessFlags : 0TEMP<ȓ���j�	�S���/ů<���D�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��9�oData!K�NameA11_Vcb
A��S�oData;K�NameA12__Vcb->VolumeName
A����oData�K�NameXA13_WppCountedStringW( Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Vcb->Vpb ) )
A��C�oData+K�NameA14_Scb->Fcb
A����oData}K�Name5A15_NtfsFullFileRefNumber( _Scb->Fcb->FileReference )
A����oDatamK�Name-A16_(Ccb != NULL) ? _Ccb->FullFileName : NULL
A��{�oDatacK�Name(A17_(Ccb != NULL) ? Ccb->AccessFlags : 0
h����������,���8A10_PsGetCurrentThread()A11_Vcb0A12__Vcb->VolumeName�A13_WppCountedStringW( Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Vcb->Vpb ) ) A14_Scb->FcbpA15_NtfsFullFileRefNumber( _Scb->Fcb->FileReference )`A16_(Ccb != NULL) ? _Ccb->FullFileName : NULLXA17_(Ccb != NULL) ? Ccb->AccessFlags : 0TEMPlp���)3Pq��x�Z���VD�	EventDataA��9�oData!K�NameA10_Vcb
A��[�oDataCK�NameA11_PsGetCurrentThread()
A��?�oData'K�Name
A12_Status
A��M�oData5K�NameA13__DeletedFiles
��Ԙ�(�A10_Vcb8A11_PsGetCurrentThread()A12_Status(A13__DeletedFilesTEMP�����W�n�Z����I���D�	EventDataA��9�oData!K�NameA10_Vcb
A��[�oDataCK�NameA11_PsGetCurrentThread()
A��?�oData'K�Name
A12_Status
Ěؚ�A10_Vcb8A11_PsGetCurrentThread()A12_StatusTEMP|���>xܲ�P�xi�‚���^D�	EventDataA��9�oData!K�NameA10_Vcb
A��[�oDataCK�NameA11_PsGetCurrentThread()
A��?�oData'K�Name
A12_Status
A��U�oData=K�NameA13__FileNameToDelete
�$�\�x�A10_Vcb8A11_PsGetCurrentThread()A12_Status0A13__FileNameToDeleteTEMPT

l���s(�:8_��'
������D�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��G�oData/K�NameA11_TypeOfOpen
A��9�oData!K�NameA12_Vcb
A��S�oData;K�NameA13__Vcb->VolumeName
A����oData�K�NameXA14_WppCountedStringW( Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Vcb->Vpb ) )
A��C�oData+K�NameA15_Scb->Fcb
A����oData}K�Name5A16_NtfsFullFileRefNumber( _Scb->Fcb->FileReference )
A����oDatamK�Name-A17_(Ccb != NULL) ? _Ccb->FullFileName : NULL
A��{�oDatacK�Name(A18_(Ccb != NULL) ? Ccb->AccessFlags : 0
A��M�oData5K�NameA19_EffectiveMode
	4�l�����ԣ�����|�ԥ8A10_PsGetCurrentThread()$A11_TypeOfOpenA12_Vcb0A13__Vcb->VolumeName�A14_WppCountedStringW( Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Vcb->Vpb ) ) A15_Scb->FcbpA16_NtfsFullFileRefNumber( _Scb->Fcb->FileReference )`A17_(Ccb != NULL) ? _Ccb->FullFileName : NULLXA18_(Ccb != NULL) ? Ccb->AccessFlags : 0(A19_EffectiveModeTEMP����ğp�lV��o!����D�	EventDataA��9�oData!K�NameA10_Scb
A��I�oData1K�NameA11_StartOffset
A��?�oData'K�Name
A12_Length
A��C�oData+K�NameA13_StartVcn
A��K�oData3K�NameA14_BeyondEndVcn
 �4�X�t���A10_Scb$A11_StartOffsetA12_Length A13_StartVcn(A14_BeyondEndVcnTEMPt��\�c�mYwF�ﳅ���D�	EventDataA��?�oData'K�Name
A10_Status
A��[�oDataCK�NameA11_Output->NumBadRanges
ܩ��A10_Status8A11_Output->NumBadRangesTEMP�����6��RU�*c�#���0D�	EventDataA��U�oData=K�NameA10_FsInputRangeIndex
A����oDataqK�Name/A11_FsInputRanges[FsInputRangeIndex].FileOffset
A����oDatauK�Name1A12_FsInputRanges[FsInputRangeIndex].VolumeOffset
A����oDatawK�Name2A13_FsInputRanges[FsInputRangeIndex].LengthInBytes
��x��0A10_FsInputRangeIndexdA11_FsInputRanges[FsInputRangeIndex].FileOffsethA12_FsInputRanges[FsInputRangeIndex].VolumeOffsetlA13_FsInputRanges[FsInputRangeIndex].LengthInBytesTEMP����
�7Q��*|������D�	EventDataA��9�oData!K�NameA10_Scb
A��?�oData'K�Name
A11_Status
A��o�oDataWK�Name"A12_(BOOLEAN)AbnormalTermination()
ԯ���A10_ScbA11_StatusLA12_(BOOLEAN)AbnormalTermination()TEMP���`�ƀ^C^��Q.a�����D�	EventDataA��=�oData%K�Name	A10_Table
A��E�oData-K�Name
A11_ParentScb
A����oDatakK�Name,A12__ParentScb->ScbType.Index.NormalizedName
A��M�oData5K�NameA13_RemainingName
\�t����A10_Table A11_ParentScb`A12__ParentScb->ScbType.Index.NormalizedName(A13_RemainingNameTEMP�0��q�NZ4���D|D����D�	EventDataA��C�oData+K�NameA10_FoundLcb
A��u�oData]K�Name%A11__FoundLcb->ExactCaseLink.LinkName
X�x� A10_FoundLcbPA11__FoundLcb->ExactCaseLink.LinkNameTEMP0���k�2�]�C��?/��2D�	EventDataA��=�oData%K�Name	A10_Table
A��a�oDataIK�NameA11_NewHashEntry->HashValue
A��k�oDataSK�Name A12_NewHashEntry->FullNameLength
A��]�oDataEK�NameA13_NewHashEntry->HashLcb
A����oDatawK�Name2A14__NewHashEntry->HashLcb->ExactCaseLink.LinkName
�����0�h�A10_Table<A11_NewHashEntry->HashValueHA12_NewHashEntry->FullNameLength8A13_NewHashEntry->HashLcblA14__NewHashEntry->HashLcb->ExactCaseLink.LinkNameTEMP�t���D>^�TSy�R�G��lD�	EventDataA��=�oData%K�Name	A10_Table
A��E�oData-K�Name
A11_HashValue
A��A�oData)K�NameA12_HashLcb
A��s�oData[K�Name$A13__HashLcb->ExactCaseLink.LinkName
ĺܺ���A10_Table A11_HashValueA12_HashLcbPA13__HashLcb->ExactCaseLink.LinkNameTEMP�l�<�_]�nR<l֪�Fu����D�	EventDataA��9�oData!K�NameA10_Vcb
A��m�oDataUK�Name!A11_Vcb->CheckpointInjectionCount
����A10_VcbHA11_Vcb->CheckpointInjectionCountTEMP0T��4n�%Q�\��;]��.D�	EventDataA��9�oData!K�NameA10_Vcb
A��I�oData1K�NameA11_PercentFull
A��}�oDataeK�Name)A12_Vcb->WaitForCcLoggedDataActivityCount
����ȾA10_Vcb$A11_PercentFullXA12_Vcb->WaitForCcLoggedDataActivityCountTEMPx��%�]��u�}
���D�	EventDataA��9�oData!K�NameA10_Vcb
A��e�oDataMK�NameA11_Vcb->CleanCheckpointCount
D�X�A10_Vcb@A11_Vcb->CleanCheckpointCountTEMPp��#K�1��Y��2=�WLN���D�	EventDataA��9�oData!K�NameA10_Vcb
A��a�oDataIK�NameA11_Vcb->OverflowedDPTCount
���A10_Vcb<A11_Vcb->OverflowedDPTCountTEMPx��Y�Ӆ|�^��r��"���D�	EventDataA��9�oData!K�NameA10_Vcb
A��e�oDataMK�NameA11_Vcb->FuzzyCheckpointCount
,�@�A10_Vcb@A11_Vcb->FuzzyCheckpointCountTEMPpx���T.��!X���ZN@����D�	EventDataA��9�oData!K�NameA10_Vcb
A��a�oDataIK�NameA11_Vcb->FlushOldestFOCount
����A10_Vcb<A11_Vcb->FlushOldestFOCountTEMP����\��}V�Z�.�2���D�	EventDataA��9�oData!K�NameA10_Vcb
A����oData}K�Name5A11_NtfsFullSegmentNumber( _Scb->Fcb->FileReference )
D�X�A10_VcbpA11_NtfsFullSegmentNumber( _Scb->Fcb->FileReference )TEMP���ǜ~m5��SK|�r#�����D�	EventDataA��9�oData!K�NameA10_Vcb
A��u�oData]K�Name%A11_DirtyPageContext.OldestFileObject
���A10_VcbPA11_DirtyPageContext.OldestFileObjectTEMP�h�&��Z�/[�r>��+{���D�	EventDataA��G�oData/K�NameA10_IrpContext
A��e�oDataMK�NameA11_IrpContext->TransactionId
����$A10_IrpContext@A11_IrpContext->TransactionIdTEMP����
���R�3ㅨP����D�	EventDataA��G�oData/K�NameA10_IrpContext
A��g�oDataOK�NameA11_IrpContext->OriginatingIrp
A��[�oDataCK�NameA12_PsGetCurrentThread()
A��i�oDataQK�NameA13_IrpContext->ExceptionStatus
 �D�����$A10_IrpContextDA11_IrpContext->OriginatingIrp8A12_PsGetCurrentThread()DA13_IrpContext->ExceptionStatusTEMP�<�~�&~އ_+�S������D�	EventDataA��G�oData/K�NameA10_IrpContext
A��g�oDataOK�NameA11_IrpContext->OriginatingIrp
A��[�oDataCK�NameA12_PsGetCurrentThread()
A��i�oDataQK�NameA13_IrpContext->ExceptionStatus
A��S�oData;K�NameA14_FailedFlushCount
�����@���$A10_IrpContextDA11_IrpContext->OriginatingIrp8A12_PsGetCurrentThread()DA13_IrpContext->ExceptionStatus0A14_FailedFlushCountTEMP�����f�Z�]ń��t-���D�	EventDataA��9�oData!K�NameA10_Vcb
A��Y�oDataAK�NameA11_ActiveLsn->QuadPart
A��C�oData+K�NameA12_ClearAll
(�<��p�A10_Vcb4A11_ActiveLsn->QuadPart A12_ClearAllTEMPl��Ћ_�dx`U�Wj��i����D�	EventDataA��9�oData!K�NameA10_Vcb
A��_�oDataGK�NameA11_Clusters->ClusterCount
����A10_Vcb<A11_Clusters->ClusterCountTEMP8��L��?�
RW�0Pm��~����D�	EventDataA��9�oData!K�NameA10_Vcb
A��C�oData+K�NameA11_Clusters
A��_�oDataGK�NameA12_Clusters->ClusterCount
A��_�oDataGK�NameA13_Clusters->Lsn.QuadPart
A��Q�oData9K�NameA14_Clusters->Flags
\�p������A10_Vcb A11_Clusters<A12_Clusters->ClusterCount<A13_Clusters->Lsn.QuadPart,A14_Clusters->FlagsTEMP����3��+g�V�o��e�0���D�	EventDataA��9�oData!K�NameA10_Vcb
A��C�oData+K�NameA11_Clusters
A��5�oDataK�NameA12_i
A��I�oData1K�NameA13_StartingLcn
A��K�oData3K�NameA14_ClusterCount
P�d�������A10_Vcb A11_ClustersA12_i$A13_StartingLcn(A14_ClusterCountTEMP� �Mh�j���W�h�3�����
D�	EventDataA��9�oData!K�NameA10_Vcb
A��I�oData1K�NameA11_StartingLcn
A��Y�oDataAK�NameA12_(ULONG)ClusterCount
\�p���A10_Vcb$A11_StartingLcn4A12_(ULONG)ClusterCountTEMP�|�Tt���[H���}���D�	EventDataA��9�oData!K�NameA10_Vcb
A��i�oDataQK�NameA11_StartingLcn + StartingIndex
A��E�oData-K�Name
A12_runLength
P�d���A10_VcbDA11_StartingLcn + StartingIndex A12_runLengthTEMP,����^�c��U��:c���D�	EventDataA��9�oData!K�NameA10_Vcb
A��?�oData'K�Name
A11_Status
����A10_VcbA11_StatusTEMP,`��ZD���x_�T����v���8D�	EventDataA��C�oData+K�NameA10_Mcb->Scb
A��9�oData!K�NameA11_Mcb
A��I�oData1K�NameA12_StartingVcn
A��=�oData%K�Name	A13_Count
������� A10_Mcb->ScbA11_Mcb$A12_StartingVcnA13_CountTEMP���
"�s�P0+�j=����ZD�	EventDataA��9�oData!K�NameA10_Mcb
��A10_McbTEMP�|�')�sU�tc��q���nD�	EventDataA��C�oData+K�NameA10_Mcb->Scb
A��9�oData!K�NameA11_Mcb
A��9�oData!K�NameA12_Vcn
A��9�oData!K�NameA13_Lcn
A��C�oData+K�NameA14_RunCount
����(�<� A10_Mcb->ScbA11_McbA12_VcnA13_Lcn A14_RunCountTEMP,0��q&jX7�]АXS�e-����D�	EventDataA��9�oData!K�NameA10_Mcb
A��?�oData'K�Name
A11_Result
X��l�A10_McbA11_ResultTEMP�P���Ќ�uX2���g7����D�	EventDataA��C�oData+K�NameA10_Mcb->Scb
A��9�oData!K�NameA11_Mcb
A��I�oData1K�NameA12_StartingVcn
A��E�oData-K�Name
A13_EndingVcn
A��K�oData3K�NameA14_TruncateOnly
��������,� A10_Mcb->ScbA11_Mcb$A12_StartingVcn A13_EndingVcn(A14_TruncateOnlyTEMP<0��z�v�S%Bj�0�����D�	EventDataA��9�oData!K�NameA10_Vcb
A��G�oData/K�NameA11_BootSector
X�l�A10_Vcb$A11_BootSectorTEMP����=>�٘$]�j��j�*���D�	EventDataA��9�oData!K�NameA10_Vcb
A��G�oData/K�NameA11_BootSector
A��I�oData1K�NameA12_CheckNumber
���0�A10_Vcb$A11_BootSector$A12_CheckNumberTEMP��ߙ��[�\��V�����D�	EventDataA��9�oData!K�NameA10_Vcb
A��G�oData/K�NameA11_IrpContext
A��i�oDataQK�NameA12_IrpContext->ExceptionStatus
�����A10_Vcb$A11_IrpContextDA12_IrpContext->ExceptionStatusTEMP����`=Z�]��,�Y�=��D�	EventDataA��9�oData!K�NameA10_Vcb
A��G�oData/K�NameA11_IrpContext
A��_�oDataGK�NameA12_AttrListAllocationSize
�����A10_Vcb$A11_IrpContext<A12_AttrListAllocationSizeTEMP\��j�˞m��Q>��B��ND�	EventDataA��9�oData!K�NameA10_Vcb
A��G�oData/K�NameA11_IrpContext
A��9�oData!K�NameA12_Scb
A��_�oDataGK�NameA13_AttrListAllocationSize
 �4�X�l�A10_Vcb$A11_IrpContextA12_Scb<A13_AttrListAllocationSizeTEMP�L�e��z�� Z,��m���]��nD�	EventDataA��M�oData5K�NameA10_ExceptionCode
`�(A10_ExceptionCodeTEMP<����ea�X��6��Ay|��D�	EventDataA��e�oDataMK�NameA10_IrpContext->LogFullReason
A��K�oData3K�NameA11_BackTrace[0]
A��K�oData3K�NameA12_BackTrace[1]
A��K�oData3K�NameA13_BackTrace[2]
A��K�oData3K�NameA14_BackTrace[3]
A��K�oData3K�NameA15_BackTrace[4]
A��K�oData3K�NameA16_BackTrace[5]
A��K�oData3K�NameA17_BackTrace[6]
A��K�oData3K�NameA18_BackTrace[7]
A��K�oData3K�NameA19_BackTrace[8]
	A��K�oData3K�NameA20_BackTrace[9]
A��M�oData5K�NameA21_BackTrace[10]
A��M�oData5K�NameA22_BackTrace[11]
A��M�oData5K�NameA23_BackTrace[12]

A��M�oData5K�NameA24_BackTrace[13]
A��M�oData5K�NameA25_BackTrace[14]
A��M�oData5K�NameA26_BackTrace[15]
A��M�oData5K�NameA27_BackTrace[16]
A��M�oData5K�NameA28_BackTrace[17]
A��M�oData5K�NameA29_BackTrace[18]
A��M�oData5K�NameA30_BackTrace[19]
d������D�l�������4�\��������$�L�t���@A10_IrpContext->LogFullReason(A11_BackTrace[0](A12_BackTrace[1](A13_BackTrace[2](A14_BackTrace[3](A15_BackTrace[4](A16_BackTrace[5](A17_BackTrace[6](A18_BackTrace[7](A19_BackTrace[8](A20_BackTrace[9](A21_BackTrace[10](A22_BackTrace[11](A23_BackTrace[12](A24_BackTrace[13](A25_BackTrace[14](A26_BackTrace[15](A27_BackTrace[16](A28_BackTrace[17](A29_BackTrace[18](A30_BackTrace[19]TEMPd������t�Y�?M��+���D�	EventDataA��G�oData/K�NameA10_IrpContext
A��M�oData5K�NameA11_ExceptionCode
�$A10_IrpContext(A11_ExceptionCodeTEMP,7(�=��YZ�ڤ���D�	EventDataA��G�oData/K�NameA10_IrpContext
A��9�oData!K�NameA11_Irp
A��Q�oData9K�NameA12_IrpContext->Vcb
A��S�oData;K�NameA13_NtfsFailedAborts
A��W�oData?K�NameA14_GetExceptionCode()
x���$A10_IrpContextA11_Irp,A12_IrpContext->Vcb0A13_NtfsFailedAborts4A14_GetExceptionCode()TEMPLHg;�uz%�Q��vJo7C����D�	EventDataA��G�oData/K�NameA10_IrpContext
A��9�oData!K�NameA11_Irp
A��Q�oData9K�NameA12_IrpContext->Vcb
A��A�oData)K�NameA13_NextScb
A����oDatamK�Name-A14_*(PULONGLONG)_NextScb->Fcb->FileReference
���,$A10_IrpContextA11_Irp,A12_IrpContext->VcbA13_NextScb`A14_*(PULONGLONG)_NextScb->Fcb->FileReferenceTEMP\�;�O߮U���V��8D�	EventDataA����oDataqK�Name/A10_IrpSp->Parameters.Write.ByteOffset.HighPart
A����oDataoK�Name.A11_IrpSp->Parameters.Write.ByteOffset.LowPart
 �dA10_IrpSp->Parameters.Write.ByteOffset.HighPartdA11_IrpSp->Parameters.Write.ByteOffset.LowPartTEMP��
�m�]�hU�k��ʼ:+���D�	EventDataA��M�oData5K�NameA10_ExceptionCode
A����oDataqK�Name/A11_IrpSp->Parameters.Write.ByteOffset.HighPart
A����oDataoK�Name.A12_IrpSp->Parameters.Write.ByteOffset.LowPart
�
p(A10_ExceptionCodedA11_IrpSp->Parameters.Write.ByteOffset.HighPartdA12_IrpSp->Parameters.Write.ByteOffset.LowPartTEMP�
�6չ��R��I��po���D�	EventDataA��[�oDataCK�NameA10_IrpSp->MajorFunction
A��[�oDataCK�NameA11_IrpSp->MinorFunction
A��9�oData!K�NameA12_Irp
A��G�oData/K�NameA13_IrpContext
A��?�oData'K�Name
A14_Status
 X���8A10_IrpSp->MajorFunction8A11_IrpSp->MinorFunctionA12_Irp$A13_IrpContextA14_StatusTEMP�����eT���{X@���tD�	EventDataA��S�oData;K�NameA10_MinTrimTotalSize
�0A10_MinTrimTotalSizeTEMP�x�]�7?�o['j�
���tD�	EventDataA��S�oData;K�NameA10_MaxTrimTotalSize
�0A10_MaxTrimTotalSizeTEMP�		�i�����ZBw��Y��� D�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��C�oData+K�NameA11_Scb->Vcb
A��]�oDataEK�NameA12__Scb->Vcb->VolumeName
A����oData�K�NamebA13_WppCountedStringW( Scb->Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Scb->Vcb->Vpb ) )
A��C�oData+K�NameA14_Scb->Fcb
A����oData}K�Name5A15_NtfsFullFileRefNumber( _Scb->Fcb->FileReference )
A��W�oData?K�NameA16__Ccb->FullFileName
A��S�oData;K�NameA17_Ccb->AccessFlags
A��[�oDataCK�NameA18_IrpSp->MinorFunction
��T @��8A10_PsGetCurrentThread() A11_Scb->Vcb8A12__Scb->Vcb->VolumeName�A13_WppCountedStringW( Scb->Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Scb->Vcb->Vpb ) ) A14_Scb->FcbpA15_NtfsFullFileRefNumber( _Scb->Fcb->FileReference )4A16__Ccb->FullFileName0A17_Ccb->AccessFlags8A18_IrpSp->MinorFunctionTEMPx��:�(�_d"�<fF&��PD�	EventDataA��K�oData3K�NameA10___FUNCTION__
A��k�oDataSK�Name A11_(PVOID)Vcb->TxfVcb.DefaultRm
A��k�oDataSK�Name A12__Vcb->TxfVcb.DefaultRm->RmId
4|(A10___FUNCTION__HA11_(PVOID)Vcb->TxfVcb.DefaultRmHA12__Vcb->TxfVcb.DefaultRm->RmIdTEMP�

,d�kJ�2Z���u��2D�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��G�oData/K�NameA11_TypeOfOpen
A��9�oData!K�NameA12_Vcb
A��S�oData;K�NameA13__Vcb->VolumeName
A����oData�K�NameXA14_WppCountedStringW( Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Vcb->Vpb ) )
A��C�oData+K�NameA15_Scb->Fcb
A����oData}K�Name5A16_NtfsFullFileRefNumber( _Scb->Fcb->FileReference )
A��W�oData?K�NameA17__Ccb->FullFileName
A��S�oData;K�NameA18_Ccb->AccessFlags
A��G�oData/K�NameA19_Ccb->Flags
	�, P d � L!l!�!"@"8A10_PsGetCurrentThread()$A11_TypeOfOpenA12_Vcb0A13__Vcb->VolumeName�A14_WppCountedStringW( Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Vcb->Vpb ) ) A15_Scb->FcbpA16_NtfsFullFileRefNumber( _Scb->Fcb->FileReference )4A17__Ccb->FullFileName0A18_Ccb->AccessFlags$A19_Ccb->FlagsTEMP��"���3"�\]~䞤����ZD�	EventDataA��9�oData!K�NameA10_Scb
#A10_ScbTEMP@		H'�n����Z�	�O������D�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��9�oData!K�NameA11_Vcb
A��S�oData;K�NameA12__Vcb->VolumeName
A����oData�K�NameXA13_WppCountedStringW( Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Vcb->Vpb ) )
A��9�oData!K�NameA14_Fcb
A����oDatasK�Name0A15_NtfsFullFileRefNumber( _Fcb->FileReference )
A��W�oData?K�NameA16__Ccb->FullFileName
A��S�oData;K�NameA17_Ccb->AccessFlags
A��o�oDataWK�Name"A18_IrpSp->FileObject->WriteAccess
�'4(H(x(0)D)�)�)*8A10_PsGetCurrentThread()A11_Vcb0A12__Vcb->VolumeName�A13_WppCountedStringW( Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Vcb->Vpb ) )A14_FcbhA15_NtfsFullFileRefNumber( _Fcb->FileReference )4A16__Ccb->FullFileName0A17_Ccb->AccessFlagsLA18_IrpSp->FileObject->WriteAccessTEMP��+{�!UU�hQ��ST���D�	EventDataA��9�oData!K�NameA10_Vcb
A��W�oData?K�NameA11_Vcb->LogFileObject
A��G�oData/K�NameA12_IrpContext
�+�+,A10_Vcb4A11_Vcb->LogFileObject$A12_IrpContextTEMP��."��,�[���K7���D�	EventDataA��G�oData/K�NameA10_IrpContext
A��u�oData]K�Name%A11_FileRecord->SegmentNumberHighPart
A��s�oData[K�Name$A12_FileRecord->SegmentNumberLowPart
A����oData�K�Name?A13_NtfsFullSegmentNumber( _FileRecord->BaseFileRecordSegment )
�.�.H/�/$A10_IrpContextPA11_FileRecord->SegmentNumberHighPartPA12_FileRecord->SegmentNumberLowPart�A13_NtfsFullSegmentNumber( _FileRecord->BaseFileRecordSegment )TEMP�l3�c�r
�Q��w�%,��D�	EventDataA��G�oData/K�NameA10_IrpContext
A��u�oData]K�Name%A11_FileRecord->SegmentNumberHighPart
A��s�oData[K�Name$A12_FileRecord->SegmentNumberLowPart
A����oData�K�Name?A13_NtfsFullSegmentNumber( _FileRecord->BaseFileRecordSegment )
A��Y�oDataAK�NameA14_Attribute->TypeCode
A��a�oDataIK�NameA15_LogRecord->RecordOffset
A��?�oData'K�Name
A16_Length
�34l4�4@5t5�5$A10_IrpContextPA11_FileRecord->SegmentNumberHighPartPA12_FileRecord->SegmentNumberLowPart�A13_NtfsFullSegmentNumber( _FileRecord->BaseFileRecordSegment )4A14_Attribute->TypeCode<A15_LogRecord->RecordOffsetA16_LengthTEMP��8�s+UKw[�.���D�	EventDataA��G�oData/K�NameA10_IrpContext
A��u�oData]K�Name%A11_FileRecord->SegmentNumberHighPart
A��s�oData[K�Name$A12_FileRecord->SegmentNumberLowPart
A����oData�K�Name?A13_NtfsFullSegmentNumber( _FileRecord->BaseFileRecordSegment )
A����oDataoK�Name.A14_((PATTRIBUTE_RECORD_HEADER)Data)->TypeCode
9$9t9�9H:$A10_IrpContextPA11_FileRecord->SegmentNumberHighPartPA12_FileRecord->SegmentNumberLowPart�A13_NtfsFullSegmentNumber( _FileRecord->BaseFileRecordSegment )dA14_((PATTRIBUTE_RECORD_HEADER)Data)->TypeCodeTEMP�x=����O#XQ���o���D�	EventDataA��G�oData/K�NameA10_IrpContext
A��u�oData]K�Name%A11_FileRecord->SegmentNumberHighPart
A��s�oData[K�Name$A12_FileRecord->SegmentNumberLowPart
A����oData�K�Name?A13_NtfsFullSegmentNumber( _FileRecord->BaseFileRecordSegment )
A����oDataiK�Name+A14_NtfsFullSegmentNumber( _FileReference )
�=>P>�>$?$A10_IrpContextPA11_FileRecord->SegmentNumberHighPartPA12_FileRecord->SegmentNumberLowPart�A13_NtfsFullSegmentNumber( _FileRecord->BaseFileRecordSegment )\A14_NtfsFullSegmentNumber( _FileReference )TEMP�
xE?���7a\E�z�{B����D�	EventDataA��G�oData/K�NameA10_IrpContext
A��u�oData]K�Name%A11_FileRecord->SegmentNumberHighPart
A��s�oData[K�Name$A12_FileRecord->SegmentNumberLowPart
A����oData�K�Name?A13_NtfsFullSegmentNumber( _FileRecord->BaseFileRecordSegment )
A����oDataqK�Name/A14_Attribute->Form.Nonresident.AllocatedLength
A��{�oDatacK�Name(A15_Attribute->Form.Nonresident.FileSize
A����oDataqK�Name/A16_Attribute->Form.Nonresident.ValidDataLength
A����oDataoK�Name.A17_Attribute->Form.Nonresident.TotalAllocated
A��]�oDataEK�NameA18_Sizes->AllocationSize
A��Q�oData9K�NameA19_Sizes->FileSize
	A��_�oDataGK�NameA20_Sizes->ValidDataLength
A��]�oDataEK�NameA21_Sizes->TotalAllocated
hF�F�F,G�GHlH�H4IlI�I�I$A10_IrpContextPA11_FileRecord->SegmentNumberHighPartPA12_FileRecord->SegmentNumberLowPart�A13_NtfsFullSegmentNumber( _FileRecord->BaseFileRecordSegment )dA14_Attribute->Form.Nonresident.AllocatedLengthXA15_Attribute->Form.Nonresident.FileSizedA16_Attribute->Form.Nonresident.ValidDataLengthdA17_Attribute->Form.Nonresident.TotalAllocated8A18_Sizes->AllocationSize,A19_Sizes->FileSize<A20_Sizes->ValidDataLength8A21_Sizes->TotalAllocatedTEMP�0Kք�u�GRS�5����kl���D�	EventDataA��G�oData/K�NameA10_IrpContext
A��9�oData!K�NameA11_Vcb
A��A�oData)K�NameA12__Bitmap
lK�K�K$A10_IrpContextA11_VcbA12__BitmapTEMPx�Nzg�t�S]5$��7����D�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��C�oData+K�NameA11_Fcb->Vcb
A��]�oDataEK�NameA12__Fcb->Vcb->VolumeName
A����oData�K�NamebA13_WppCountedStringW( Fcb->Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Fcb->Vcb->Vpb ) )
A��9�oData!K�NameA14_Fcb
A����oDatasK�Name0A15_NtfsFullFileRefNumber( _Fcb->FileReference )
`O�O�O�O�P�P8A10_PsGetCurrentThread() A11_Fcb->Vcb8A12__Fcb->Vcb->VolumeName�A13_WppCountedStringW( Fcb->Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Fcb->Vcb->Vpb ) )A14_FcbhA15_NtfsFullFileRefNumber( _Fcb->FileReference )TEMP�U����[�R�t-uk�{����D�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��C�oData+K�NameA11_Fcb->Vcb
A��]�oDataEK�NameA12__Fcb->Vcb->VolumeName
A����oData�K�NamebA13_WppCountedStringW( Fcb->Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Fcb->Vcb->Vpb ) )
A��9�oData!K�NameA14_Fcb
A����oDatasK�Name0A15_NtfsFullFileRefNumber( _Fcb->FileReference )
A��W�oData?K�NameA16__Ccb->FullFileName
A��S�oData;K�NameA17_Ccb->AccessFlags
�U�UVHVW(W�W�W8A10_PsGetCurrentThread() A11_Fcb->Vcb8A12__Fcb->Vcb->VolumeName�A13_WppCountedStringW( Fcb->Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Fcb->Vcb->Vpb ) )A14_FcbhA15_NtfsFullFileRefNumber( _Fcb->FileReference )4A16__Ccb->FullFileName0A17_Ccb->AccessFlagsTEMPx[�l��o]��/�y�6���PD�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��C�oData+K�NameA11_Fcb->Vcb
A��]�oDataEK�NameA12__Fcb->Vcb->VolumeName
A����oData�K�NamebA13_WppCountedStringW( Fcb->Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Fcb->Vcb->Vpb ) )
A��9�oData!K�NameA14_Fcb
A����oDatasK�Name0A15_NtfsFullFileRefNumber( _Fcb->FileReference )
A��W�oData?K�NameA16__Ccb->FullFileName
\<\\\�\`]t]�]8A10_PsGetCurrentThread() A11_Fcb->Vcb8A12__Fcb->Vcb->VolumeName�A13_WppCountedStringW( Fcb->Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Fcb->Vcb->Vpb ) )A14_FcbhA15_NtfsFullFileRefNumber( _Fcb->FileReference )4A16__Ccb->FullFileNameTEMP��a����dT���0�df����D�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��K�oData3K�NameA11_ThisFcb->Vcb
A��e�oDataMK�NameA12__ThisFcb->Vcb->VolumeName
A����oData�K�NamejA13_WppCountedStringW( ThisFcb->Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( ThisFcb->Vcb->Vpb ) )
A��A�oData)K�NameA14_ThisFcb
A����oData{K�Name4A15_NtfsFullFileRefNumber( _ThisFcb->FileReference )
A��o�oDataWK�Name"A16_ThisFcb->TxfFcb->TxfNumWriters
hb�b�bc�cdpd8A10_PsGetCurrentThread()(A11_ThisFcb->Vcb@A12__ThisFcb->Vcb->VolumeName�A13_WppCountedStringW( ThisFcb->Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( ThisFcb->Vcb->Vpb ) )A14_ThisFcbpA15_NtfsFullFileRefNumber( _ThisFcb->FileReference )LA16_ThisFcb->TxfFcb->TxfNumWritersTEMPLXh�P���Ɗ^�V�5vr���hD�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��K�oData3K�NameA11_ThisFcb->Vcb
A��e�oDataMK�NameA12__ThisFcb->Vcb->VolumeName
A����oData�K�NamejA13_WppCountedStringW( ThisFcb->Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( ThisFcb->Vcb->Vpb ) )
A��A�oData)K�NameA14_ThisFcb
A����oData{K�Name4A15_NtfsFullFileRefNumber( _ThisFcb->FileReference )
A��?�oData'K�Name
A16_Status
�hiDi�i`j|j�j8A10_PsGetCurrentThread()(A11_ThisFcb->Vcb@A12__ThisFcb->Vcb->VolumeName�A13_WppCountedStringW( ThisFcb->Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( ThisFcb->Vcb->Vpb ) )A14_ThisFcbpA15_NtfsFullFileRefNumber( _ThisFcb->FileReference )A16_StatusTEMP��n�l��O�X��V���HE���D�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��K�oData3K�NameA11_ThisFcb->Vcb
A��e�oDataMK�NameA12__ThisFcb->Vcb->VolumeName
A����oData�K�NamejA13_WppCountedStringW( ThisFcb->Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( ThisFcb->Vcb->Vpb ) )
A��A�oData)K�NameA14_ThisFcb
A����oData{K�Name4A15_NtfsFullFileRefNumber( _ThisFcb->FileReference )
A��k�oDataSK�Name A16_ThisFcb->Info.FileAttributes
\o�o�o�o�p�pdq8A10_PsGetCurrentThread()(A11_ThisFcb->Vcb@A12__ThisFcb->Vcb->VolumeName�A13_WppCountedStringW( ThisFcb->Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( ThisFcb->Vcb->Vpb ) )A14_ThisFcbpA15_NtfsFullFileRefNumber( _ThisFcb->FileReference )HA16_ThisFcb->Info.FileAttributesTEMP�u�¬80�eV3`vF�t�(��"D�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��K�oData3K�NameA11_ThisFcb->Vcb
A��e�oDataMK�NameA12__ThisFcb->Vcb->VolumeName
A����oData�K�NamejA13_WppCountedStringW( ThisFcb->Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( ThisFcb->Vcb->Vpb ) )
A��A�oData)K�NameA14_ThisFcb
A����oData{K�Name4A15_NtfsFullFileRefNumber( _ThisFcb->FileReference )
|u�u�uv�vw8A10_PsGetCurrentThread()(A11_ThisFcb->Vcb@A12__ThisFcb->Vcb->VolumeName�A13_WppCountedStringW( ThisFcb->Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( ThisFcb->Vcb->Vpb ) )A14_ThisFcbpA15_NtfsFullFileRefNumber( _ThisFcb->FileReference )TEMP4�{�[��\Uh��4N6 ���D�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��K�oData3K�NameA11_ThisFcb->Vcb
A��e�oDataMK�NameA12__ThisFcb->Vcb->VolumeName
A����oData�K�NamejA13_WppCountedStringW( ThisFcb->Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( ThisFcb->Vcb->Vpb ) )
A��A�oData)K�NameA14_ThisFcb
A����oData{K�Name4A15_NtfsFullFileRefNumber( _ThisFcb->FileReference )
A��k�oDataSK�Name A16_ThisFcb->Info.FileAttributes
A��K�oData3K�NameA17_IrpSp->Flags
@|x|�|�|�}�}H~�~8A10_PsGetCurrentThread()(A11_ThisFcb->Vcb@A12__ThisFcb->Vcb->VolumeName�A13_WppCountedStringW( ThisFcb->Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( ThisFcb->Vcb->Vpb ) )A14_ThisFcbpA15_NtfsFullFileRefNumber( _ThisFcb->FileReference )HA16_ThisFcb->Info.FileAttributes(A17_IrpSp->FlagsTEMP��b����Ȋ[�k�	f3����D�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��K�oData3K�NameA11_ThisFcb->Vcb
A��e�oDataMK�NameA12__ThisFcb->Vcb->VolumeName
A����oData�K�NamejA13_WppCountedStringW( ThisFcb->Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( ThisFcb->Vcb->Vpb ) )
A��A�oData)K�NameA14_ThisFcb
A����oData{K�Name4A15_NtfsFullFileRefNumber( _ThisFcb->FileReference )
A��S�oData;K�NameA16_Ccb->AccessFlags
A��K�oData3K�NameA17_AccessStatus
\�������؄�d���8A10_PsGetCurrentThread()(A11_ThisFcb->Vcb@A12__ThisFcb->Vcb->VolumeName�A13_WppCountedStringW( ThisFcb->Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( ThisFcb->Vcb->Vpb ) )A14_ThisFcbpA15_NtfsFullFileRefNumber( _ThisFcb->FileReference )0A16_Ccb->AccessFlags(A17_AccessStatusTEMP�		0�%�Ε
��X��h�����@D�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��K�oData3K�NameA11_ThisFcb->Vcb
A��e�oDataMK�NameA12__ThisFcb->Vcb->VolumeName
A����oData�K�NamejA13_WppCountedStringW( ThisFcb->Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( ThisFcb->Vcb->Vpb ) )
A��A�oData)K�NameA14_ThisFcb
A����oData{K�Name4A15_NtfsFullFileRefNumber( _ThisFcb->FileReference )
A��A�oData)K�NameA16_NextScb
A��g�oDataOK�NameA17_NextScb->AttributeTypeCode
A��a�oDataIK�NameA18__NextScb->AttributeName
��D���`�|���L�8A10_PsGetCurrentThread()(A11_ThisFcb->Vcb@A12__ThisFcb->Vcb->VolumeName�A13_WppCountedStringW( ThisFcb->Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( ThisFcb->Vcb->Vpb ) )A14_ThisFcbpA15_NtfsFullFileRefNumber( _ThisFcb->FileReference )A16_NextScbDA17_NextScb->AttributeTypeCode<A18__NextScb->AttributeNameTEMP(����֎CQE�M:��$���D�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��9�oData!K�NameA11_Vcb
A��S�oData;K�NameA12__Vcb->VolumeName
A����oData�K�NameXA13_WppCountedStringW( Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Vcb->Vpb ) )
A��9�oData!K�NameA14_Fcb
A����oData}K�Name5A15_NtfsFullFileRefNumber( _Scb->Fcb->FileReference )
A����oDatamK�Name-A16_(Ccb != NULL) ? _Ccb->FullFileName : NULL
A��{�oDatacK�Name(A17_(Ccb != NULL) ? Ccb->AccessFlags : 0
@�x�����t�����X�8A10_PsGetCurrentThread()A11_Vcb0A12__Vcb->VolumeName�A13_WppCountedStringW( Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Vcb->Vpb ) )A14_FcbpA15_NtfsFullFileRefNumber( _Scb->Fcb->FileReference )`A16_(Ccb != NULL) ? _Ccb->FullFileName : NULLXA17_(Ccb != NULL) ? Ccb->AccessFlags : 0TEMP�		�R�p���W��E�m9
��0D�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��G�oData/K�NameA11_TypeOfOpen
A��9�oData!K�NameA12_Vcb
A��S�oData;K�NameA13__Vcb->VolumeName
A����oData�K�NameXA14_WppCountedStringW( Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Vcb->Vpb ) )
A��9�oData!K�NameA15_Fcb
A����oData}K�Name5A16_NtfsFullFileRefNumber( _Scb->Fcb->FileReference )
A����oDatamK�Name-A17_(Ccb != NULL) ? _Ccb->FullFileName : NULL
A��{�oDatacK�Name(A18_(Ccb != NULL) ? Ccb->AccessFlags : 0
ș�$�8�h� �4����8A10_PsGetCurrentThread()$A11_TypeOfOpenA12_Vcb0A13__Vcb->VolumeName�A14_WppCountedStringW( Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Vcb->Vpb ) )A15_FcbpA16_NtfsFullFileRefNumber( _Scb->Fcb->FileReference )`A17_(Ccb != NULL) ? _Ccb->FullFileName : NULLXA18_(Ccb != NULL) ? Ccb->AccessFlags : 0TEMPd�^��pSHU�#��z�(���D�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��C�oData+K�NameA11_Fcb->Vcb
A��]�oDataEK�NameA12__Fcb->Vcb->VolumeName
A����oData�K�NamebA13_WppCountedStringW( Fcb->Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Fcb->Vcb->Vpb ) )
A��9�oData!K�NameA14_Fcb
A����oDatasK�Name0A15_NtfsFullFileRefNumber( _Fcb->FileReference )
A��M�oData5K�NameA16_Fcb->FcbState
A����oDatamK�Name-A17_(Ccb != NULL) ? _Ccb->FullFileName : NULL
�<�\���`�t�ܢ�8A10_PsGetCurrentThread() A11_Fcb->Vcb8A12__Fcb->Vcb->VolumeName�A13_WppCountedStringW( Fcb->Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Fcb->Vcb->Vpb ) )A14_FcbhA15_NtfsFullFileRefNumber( _Fcb->FileReference )(A16_Fcb->FcbState`A17_(Ccb != NULL) ? _Ccb->FullFileName : NULLTEMPd��� XM��].�UC�����D�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��C�oData+K�NameA11_Fcb->Vcb
A��]�oDataEK�NameA12__Fcb->Vcb->VolumeName
A����oData�K�NamebA13_WppCountedStringW( Fcb->Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Fcb->Vcb->Vpb ) )
A��9�oData!K�NameA14_Fcb
A����oDatasK�Name0A15_NtfsFullFileRefNumber( _Fcb->FileReference )
A����oDatamK�Name-A16_(Ccb != NULL) ? _Ccb->FullFileName : NULL
A��{�oDatacK�Name(A17_(Ccb != NULL) ? Ccb->AccessFlags : 0
8�p���Ȩ�����p�8A10_PsGetCurrentThread() A11_Fcb->Vcb8A12__Fcb->Vcb->VolumeName�A13_WppCountedStringW( Fcb->Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Fcb->Vcb->Vpb ) )A14_FcbhA15_NtfsFullFileRefNumber( _Fcb->FileReference )`A16_(Ccb != NULL) ? _Ccb->FullFileName : NULLXA17_(Ccb != NULL) ? Ccb->AccessFlags : 0TEMP�		��VIo�?�R�k㷑tJ��D�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��9�oData!K�NameA11_Vcb
A��S�oData;K�NameA12__Vcb->VolumeName
A����oData�K�NameXA13_WppCountedStringW( Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Vcb->Vpb ) )
A��9�oData!K�NameA14_Fcb
A����oDatasK�Name0A15_NtfsFullFileRefNumber( _Fcb->FileReference )
A����oDatamK�Name-A16_(Ccb != NULL) ? _Ccb->FullFileName : NULL
A��{�oDatacK�Name(A17_(Ccb != NULL) ? Ccb->AccessFlags : 0
A��=�oData%K�Name	A18_Flags
̯��H���|�ܱ4�8A10_PsGetCurrentThread()A11_Vcb0A12__Vcb->VolumeName�A13_WppCountedStringW( Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Vcb->Vpb ) )A14_FcbhA15_NtfsFullFileRefNumber( _Fcb->FileReference )`A16_(Ccb != NULL) ? _Ccb->FullFileName : NULLXA17_(Ccb != NULL) ? Ccb->AccessFlags : 0A18_FlagsTEMPX��P��?�RC���OIs���D�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��9�oData!K�NameA11_Vcb
A��S�oData;K�NameA12__Vcb->VolumeName
A����oData�K�NameXA13_WppCountedStringW( Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Vcb->Vpb ) )
A��9�oData!K�NameA14_Fcb
A����oDatasK�Name0A15_NtfsFullFileRefNumber( _Fcb->FileReference )
A����oDatamK�Name-A16_(Ccb != NULL) ? _Ccb->FullFileName : NULL
A��{�oDatacK�Name(A17_(Ccb != NULL) ? Ccb->AccessFlags : 0
��0�D�t�,�@����8A10_PsGetCurrentThread()A11_Vcb0A12__Vcb->VolumeName�A13_WppCountedStringW( Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Vcb->Vpb ) )A14_FcbhA15_NtfsFullFileRefNumber( _Fcb->FileReference )`A16_(Ccb != NULL) ? _Ccb->FullFileName : NULLXA17_(Ccb != NULL) ? Ccb->AccessFlags : 0TEMP,4���^�c��U��:c���D�	EventDataA��9�oData!K�NameA10_Vcb
A��?�oData'K�Name
A11_Status
\�p�A10_VcbA11_StatusTEMP`|��s68%
X��c
�4h���D�	EventDataA��9�oData!K�NameA10_Scb
A��Y�oDataAK�NameA11_Scb->TotalAllocated
����A10_Scb4A11_Scb->TotalAllocatedTEMP���8�p���W�=�"������D�	EventDataA��Q�oData9K�NameA10_CurrentClusters
A��m�oDataUK�Name!A11_CurrentClusters->Lsn.QuadPart
0�\�,A10_CurrentClustersHA11_CurrentClusters->Lsn.QuadPartTEMP��N\]�A\S��r�A���D�	EventDataA��W�oData?K�NameA10_ClustersLinkAsHead
A��K�oData3K�NameA11_FlagsToMatch
A��I�oData1K�NameA12_InsertAfter
0�d����4A10_ClustersLinkAsHead(A11_FlagsToMatch$A12_InsertAfterTEMPd���"Ne�^�6eV�b����D�	EventDataA��C�oData+K�NameA10_Clusters
A��Q�oData9K�NameA11_Clusters->Flags
�� A10_Clusters,A11_Clusters->FlagsTEMP\��
4r+�]s�ݹE�����D�	EventDataA��C�oData+K�NameA10_Clusters
A��K�oData3K�NameA11_NumberOfRuns
(�H� A10_Clusters(A11_NumberOfRunsTEMP��x�AZr�QY:_#�R��dD�	EventDataA��C�oData+K�NameA10_Clusters
� A10_ClustersTEMP4,��^�^�Y�����p����D�	EventDataA����oData�K�NameIA10_!FlagOn( Clusters->Flags, DEALLOCATED_CLUSTERS_FLAG_NO_DANGLING_MDL )
A��C�oData+K�NameA11_Clusters
A��9�oData!K�NameA12_Lcn
A��K�oData3K�NameA13_ClusterCount
�|��4�H��A10_!FlagOn( Clusters->Flags, DEALLOCATED_CLUSTERS_FLAG_NO_DANGLING_MDL ) A11_ClustersA12_Lcn(A13_ClusterCountTEMP�L��~���~�_������
���D�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��C�oData+K�NameA11_Scb->Vcb
A��]�oDataEK�NameA12__Scb->Vcb->VolumeName
A����oData�K�NamebA13_WppCountedStringW( Scb->Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Scb->Vcb->Vpb ) )
A��C�oData+K�NameA14_Scb->Fcb
A����oData}K�Name5A15_NtfsFullFileRefNumber( _Scb->Fcb->FileReference )
A��M�oData5K�NameA16_TxfFcb->Flags
A��E�oData-K�Name
A17_ShareMode
��$�D�|�H�h����8A10_PsGetCurrentThread() A11_Scb->Vcb8A12__Scb->Vcb->VolumeName�A13_WppCountedStringW( Scb->Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Scb->Vcb->Vpb ) ) A14_Scb->FcbpA15_NtfsFullFileRefNumber( _Scb->Fcb->FileReference )(A16_TxfFcb->Flags A17_ShareModeTEMP0��ᄃ�iB;Y�S�Ѳߒ��ZD�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��C�oData+K�NameA11_Scb->Vcb
A��]�oDataEK�NameA12__Scb->Vcb->VolumeName
A����oData�K�NamebA13_WppCountedStringW( Scb->Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Scb->Vcb->Vpb ) )
A��C�oData+K�NameA14_Scb->Fcb
A����oData}K�Name5A15_NtfsFullFileRefNumber( _Scb->Fcb->FileReference )
A��M�oData5K�NameA16_GrantedAccess
<�t���������(�8A10_PsGetCurrentThread() A11_Scb->Vcb8A12__Scb->Vcb->VolumeName�A13_WppCountedStringW( Scb->Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Scb->Vcb->Vpb ) ) A14_Scb->FcbpA15_NtfsFullFileRefNumber( _Scb->Fcb->FileReference )(A16_GrantedAccessTEMPX�i��O=�SR�J��9�+���D�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��C�oData+K�NameA11_Scb->Vcb
A��]�oDataEK�NameA12__Scb->Vcb->VolumeName
A����oData�K�NamebA13_WppCountedStringW( Scb->Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Scb->Vcb->Vpb ) )
A��C�oData+K�NameA14_Scb->Fcb
A����oData}K�Name5A15_NtfsFullFileRefNumber( _Scb->Fcb->FileReference )
A��M�oData5K�NameA16_GrantedAccess
A��q�oDataYK�Name#A17_NextTxfVscb->ReaderCleanupCount
��0�P���T�t����8A10_PsGetCurrentThread() A11_Scb->Vcb8A12__Scb->Vcb->VolumeName�A13_WppCountedStringW( Scb->Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Scb->Vcb->Vpb ) ) A14_Scb->FcbpA15_NtfsFullFileRefNumber( _Scb->Fcb->FileReference )(A16_GrantedAccessLA17_NextTxfVscb->ReaderCleanupCountTEMP�		��L�����]���߰�����&D�	EventDataA��K�oData3K�NameA10___FUNCTION__
A��O�oData7K�NameA11_CallerFunction
A��G�oData/K�NameA12_CallerFile
A��S�oData;K�NameA13_CallerLineNumber
A��O�oData7K�NameA14_(PVOID)TxfRmcb
A��O�oData7K�NameA15__TxfRmcb->RmId
A��Q�oData9K�NameA16_(PVOID)TxfTrans
A��U�oData=K�NameA17__TxfTrans->KtmUow
A��U�oData=K�NameA18_AbortReasonStatus
h��������<�h�����(A10___FUNCTION__,A11_CallerFunction$A12_CallerFile0A13_CallerLineNumber,A14_(PVOID)TxfRmcb,A15__TxfRmcb->RmId,A16_(PVOID)TxfTrans0A17__TxfTrans->KtmUow0A18_AbortReasonStatusTEMPp		8�X��JCDhS��>oH���D�	EventDataA��K�oData3K�NameA10___FUNCTION__
A��O�oData7K�NameA11_CallerFunction
A��G�oData/K�NameA12_CallerFile
A��S�oData;K�NameA13_CallerLineNumber
A��O�oData7K�NameA14_(PVOID)TxfRmcb
A��O�oData7K�NameA15__TxfRmcb->RmId
A��Q�oData9K�NameA16_(PVOID)TxfTrans
A��U�oData=K�NameA17__TxfTrans->KtmUow
A��?�oData'K�Name
A18_Status
���@�d��������H�(A10___FUNCTION__,A11_CallerFunction$A12_CallerFile0A13_CallerLineNumber,A14_(PVOID)TxfRmcb,A15__TxfRmcb->RmId,A16_(PVOID)TxfTrans0A17__TxfTrans->KtmUowA18_StatusTEMP(X���e"^�D'�����D�	EventDataA��K�oData3K�NameA10___FUNCTION__
A��O�oData7K�NameA11_(PVOID)TxfRmcb
A��O�oData7K�NameA12__TxfRmcb->RmId
A��C�oData+K�NameA13_TxfTrans
A��U�oData=K�NameA14__TxfTrans->KtmUow
�����<�\�(A10___FUNCTION__,A11_(PVOID)TxfRmcb,A12__TxfRmcb->RmId A13_TxfTrans0A14__TxfTrans->KtmUowTEMP�����KῠP��u��w3����D�	EventDataA��K�oData3K�NameA10___FUNCTION__
A����oDataoK�Name.A11_(PVOID)CalloutParameters->TxfFlush.TxfRmcb
A����oDataoK�Name.A12__CalloutParameters->TxfFlush.TxfRmcb->RmId
A��W�oData?K�NameA13_GetExceptionCode()
�� �����(A10___FUNCTION__dA11_(PVOID)CalloutParameters->TxfFlush.TxfRmcbdA12__CalloutParameters->TxfFlush.TxfRmcb->RmId4A13_GetExceptionCode()TEMP���7P�]�&�ZV�r�����lD�	EventDataA��K�oData3K�NameA10___FUNCTION__
��(A10___FUNCTION__TEMPl��GC��Z�^�P\��YZc���D�	EventDataA��K�oData3K�NameA10___FUNCTION__
A��M�oData5K�NameA11_FailureStatus
�<�(A10___FUNCTION__(A11_FailureStatusTEMPTL����}�T0�	�������D�	EventDataA��K�oData3K�NameA10___FUNCTION__
A��?�oData'K�Name
A11_Status
t���(A10___FUNCTION__A11_StatusTEMPP@�#��u=@\������TD�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��9�oData!K�NameA11_Vcb
A��S�oData;K�NameA12__Vcb->VolumeName
A����oData�K�NameXA13_WppCountedStringW( Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Vcb->Vpb ) )
A��U�oData=K�NameA14_Vcb->TxfVcb.Flags
������ ���8A10_PsGetCurrentThread()A11_Vcb0A12__Vcb->VolumeName�A13_WppCountedStringW( Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Vcb->Vpb ) )0A14_Vcb->TxfVcb.FlagsTEMP�D���6���U|�����n��D�	EventDataA��K�oData3K�NameA10___FUNCTION__
A��G�oData/K�NameA11_TempStatus
A��G�oData/K�NameA12_(PVOID)Vcb
�����(A10___FUNCTION__$A11_TempStatus$A12_(PVOID)VcbTEMP���T1�i��eQ�t��(4��^D�	EventDataA��K�oData3K�NameA10___FUNCTION__
A��W�oData?K�NameA11_GetExceptionCode()
A��?�oData'K�Name
A12_Status
A��G�oData/K�NameA13_(PVOID)Vcb
���0�L�(A10___FUNCTION__4A11_GetExceptionCode()A12_Status$A13_(PVOID)VcbTEMP�$�D_c�ڌX�u$����~D�	EventDataA��K�oData3K�NameA10___FUNCTION__
A��G�oData/K�NameA11_(PVOID)Vcb
A��q�oDataYK�Name#A12_TXF_MAX_RESET_ATTEMPTS_ON_MOUNT
A��E�oData-K�Name
A13_OldStatus
t������(A10___FUNCTION__$A11_(PVOID)VcbLA12_TXF_MAX_RESET_ATTEMPTS_ON_MOUNT A13_OldStatusTEMPx�u�3��ӾS��]�ʴ��D�	EventDataA��K�oData3K�NameA10___FUNCTION__
A��W�oData?K�NameA11_GetExceptionCode()
A��G�oData/K�NameA12_(PVOID)Vcb
����(A10___FUNCTION__4A11_GetExceptionCode()$A12_(PVOID)VcbTEMP�`��Sͪt^.ra;+�$����D�	EventDataA��K�oData3K�NameA10___FUNCTION__
A����oDatayK�Name3A11_(NT_SUCCESS( Status ) ? 'Succeeded' : 'FAILED')
A��O�oData7K�NameA12_(PVOID)TxfRmcb
A��O�oData7K�NameA13__TxfRmcb->RmId
A��?�oData'K�Name
A14_Status
��X��(A10___FUNCTION__lA11_(NT_SUCCESS( Status ) ? 'Succeeded' : 'FAILED'),A12_(PVOID)TxfRmcb,A13__TxfRmcb->RmIdA14_StatusTEMP�"l)��X_��\��D�	EventDataA��K�oData3K�NameA10___FUNCTION__
A��O�oData7K�NameA11_(PVOID)TxfRmcb
A��O�oData7K�NameA12__TxfRmcb->RmId
T|�(A10___FUNCTION__,A11_(PVOID)TxfRmcb,A12__TxfRmcb->RmIdTEMP@�r�:X"qjX��ڳ��e���D�	EventDataA��K�oData3K�NameA10___FUNCTION__
A��O�oData7K�NameA11_(PVOID)TxfRmcb
A��O�oData7K�NameA12__TxfRmcb->RmId
A��Q�oData9K�NameA13_LogNestingLevel
A��S�oData;K�NameA14_DiskNestingLevel
8`���(A10___FUNCTION__,A11_(PVOID)TxfRmcb,A12__TxfRmcb->RmId,A13_LogNestingLevel0A14_DiskNestingLevelTEMP���f���]xC��֤��~D�	EventDataA��K�oData3K�NameA10___FUNCTION__
A��O�oData7K�NameA11_(PVOID)TxfRmcb
A��O�oData7K�NameA12__TxfRmcb->RmId
A��_�oDataGK�NameA13__ClfsRestartArea->RmId
@l�(A10___FUNCTION__,A11_(PVOID)TxfRmcb,A12__TxfRmcb->RmId<A13__ClfsRestartArea->RmIdTEMP�h
���^���-��l��^D�	EventDataA��K�oData3K�NameA10___FUNCTION__
A��?�oData'K�Name
A11_Status
A��O�oData7K�NameA12_(PVOID)TxfRmcb
A��O�oData7K�NameA13__TxfRmcb->RmId
�
�
�
((A10___FUNCTION__A11_Status,A12_(PVOID)TxfRmcb,A13__TxfRmcb->RmIdTEMP��
�����U�I��&�|��D�	EventDataA��K�oData3K�NameA10___FUNCTION__
A��O�oData7K�NameA11_(PVOID)TxfRmcb
A��O�oData7K�NameA12__TxfRmcb->RmId
A��?�oData'K�Name
A13_Status
A����oData�K�Name9A14_AbnormalTermination() ? '(abnormal termination)' : ''
�
Dp�(A10___FUNCTION__,A11_(PVOID)TxfRmcb,A12__TxfRmcb->RmIdA13_StatusxA14_AbnormalTermination() ? '(abnormal termination)' : ''TEMP@���-(�׏T�AR.���JD�	EventDataA��K�oData3K�NameA10___FUNCTION__
A����oData�K�Name9A11_(TxfIsDefaultRm( TxfRmcb ) ? 'default' : 'secondary')
A��O�oData7K�NameA12_(PVOID)TxfRmcb
A��O�oData7K�NameA13__TxfRmcb->RmId
A����oDataoK�Name.A14_(ForceDirtyShutdown ? 'DIRTY!' : 'CLEAN.')
����(A10___FUNCTION__xA11_(TxfIsDefaultRm( TxfRmcb ) ? 'default' : 'secondary'),A12_(PVOID)TxfRmcb,A13__TxfRmcb->RmIddA14_(ForceDirtyShutdown ? 'DIRTY!' : 'CLEAN.')TEMP���z�8Xb��X�I;��ND�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��C�oData+K�NameA11_Fcb->Vcb
A��]�oDataEK�NameA12__Fcb->Vcb->VolumeName
A����oData�K�NamebA13_WppCountedStringW( Fcb->Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Fcb->Vcb->Vpb ) )
A��9�oData!K�NameA14_Fcb
A����oDatasK�Name0A15_NtfsFullFileRefNumber( _Fcb->FileReference )
A��U�oData=K�NameA16_Fcb->CleanupCount
T�����,8A10_PsGetCurrentThread() A11_Fcb->Vcb8A12__Fcb->Vcb->VolumeName�A13_WppCountedStringW( Fcb->Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Fcb->Vcb->Vpb ) )A14_FcbhA15_NtfsFullFileRefNumber( _Fcb->FileReference )0A16_Fcb->CleanupCountTEMP���]�Ŗ8�]��Jó����D�	EventDataA��q�oDataYK�Name#A10_FILEID_FROM_SOURCE( FileNLine )
A��s�oData[K�Name$A11_LINENUM_FROM_SOURCE( FileNLine )
A��A�oData)K�NameA12_TxfRmcb
A��O�oData7K�NameA13__TxfRmcb->RmId
A��?�oData'K�Name
A14_Status
�0���LA10_FILEID_FROM_SOURCE( FileNLine )PA11_LINENUM_FROM_SOURCE( FileNLine )A12_TxfRmcb,A13__TxfRmcb->RmIdA14_StatusTEMP�|2g�-�(_i�`������bD�	EventDataA��K�oData3K�NameA10___FUNCTION__
A��O�oData7K�NameA11_(PVOID)TxfRmcb
A��C�oData+K�NameA12__OldGuid
A��O�oData7K�NameA13__TxfRmcb->RmId
�� @(A10___FUNCTION__,A11_(PVOID)TxfRmcb A12__OldGuid,A13__TxfRmcb->RmIdTEMP��!�'5"�tZP��`ҧ�\��D�	EventDataA��K�oData3K�NameA10___FUNCTION__
A��O�oData7K�NameA11_(PVOID)TxfRmcb
A��O�oData7K�NameA12__TxfRmcb->RmId
A��Q�oData9K�NameA13_(PVOID)TxfTrans
A��U�oData=K�NameA14__TxfTrans->KtmUow
A��?�oData'K�Name
A15_Status
,"T"�"�"�"#(A10___FUNCTION__,A11_(PVOID)TxfRmcb,A12__TxfRmcb->RmId,A13_(PVOID)TxfTrans0A14__TxfTrans->KtmUowA15_StatusTEMP��%Fؿ5[�S\���f1^���D�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��O�oData7K�NameA11_RmRootFcb->Vcb
A��i�oDataQK�NameA12__RmRootFcb->Vcb->VolumeName
A���oData�K�NamenA13_WppCountedStringW( RmRootFcb->Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( RmRootFcb->Vcb->Vpb ) )
A��E�oData-K�Name
A14_RmRootFcb
X&�&�&'�'8A10_PsGetCurrentThread(),A11_RmRootFcb->VcbDA12__RmRootFcb->Vcb->VolumeName�A13_WppCountedStringW( RmRootFcb->Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( RmRootFcb->Vcb->Vpb ) ) A14_RmRootFcbTEMP��*�dE�	R
[I�UcR��|D�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��C�oData+K�NameA11_Fcb->Vcb
A��]�oDataEK�NameA12__Fcb->Vcb->VolumeName
A����oData�K�NamebA13_WppCountedStringW( Fcb->Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Fcb->Vcb->Vpb ) )
A��U�oData=K�NameA14_BackupInfo->Flags
+P+p+�+t,8A10_PsGetCurrentThread() A11_Fcb->Vcb8A12__Fcb->Vcb->VolumeName�A13_WppCountedStringW( Fcb->Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Fcb->Vcb->Vpb ) )0A14_BackupInfo->FlagsTEMP��-���;%wV�� ��"���D�	EventDataA��K�oData3K�NameA10___FUNCTION__
A��?�oData'K�Name
A11_Status
A��U�oData=K�NameA12_(PVOID)FileObject
$.L.h.(A10___FUNCTION__A11_Status0A12_(PVOID)FileObjectTEMP�

$3<\۩裁R7�F�D�a��XD�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��C�oData+K�NameA11_Scb->Vcb
A��]�oDataEK�NameA12__Scb->Vcb->VolumeName
A����oData�K�NamebA13_WppCountedStringW( Scb->Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Scb->Vcb->Vpb ) )
A��C�oData+K�NameA14_Scb->Fcb
A����oData}K�Name5A15_NtfsFullFileRefNumber( _Scb->Fcb->FileReference )
A��9�oData!K�NameA16_Scb
A��_�oDataGK�NameA17_Scb->AttributeTypeCode
A��W�oData?K�NameA18__Ccb->FullFileName
A��G�oData/K�NameA19_Ccb->Flags
	�3$4D4|4H5h5�5�5(6\68A10_PsGetCurrentThread() A11_Scb->Vcb8A12__Scb->Vcb->VolumeName�A13_WppCountedStringW( Scb->Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Scb->Vcb->Vpb ) ) A14_Scb->FcbpA15_NtfsFullFileRefNumber( _Scb->Fcb->FileReference )A16_Scb<A17_Scb->AttributeTypeCode4A18__Ccb->FullFileName$A19_Ccb->FlagsTEMP�p;�*K�"�X����)���D�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��C�oData+K�NameA11_Scb->Vcb
A��]�oDataEK�NameA12__Scb->Vcb->VolumeName
A����oData�K�NamebA13_WppCountedStringW( Scb->Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Scb->Vcb->Vpb ) )
A��C�oData+K�NameA14_Scb->Fcb
A����oData}K�Name5A15_NtfsFullFileRefNumber( _Scb->Fcb->FileReference )
A��9�oData!K�NameA16_Scb
A��G�oData/K�NameA17_Ccb->TxfFo
A��[�oDataCK�NameA18_Ccb->TxfFo->KtmTrans
A��U�oData=K�NameA19_Scb->Fcb->TxfRmcb
	A��c�oDataKK�NameA20_Ccb->FullFileName.Buffer
L<�<�<�<�=�=8>L>p>�>�>8A10_PsGetCurrentThread() A11_Scb->Vcb8A12__Scb->Vcb->VolumeName�A13_WppCountedStringW( Scb->Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Scb->Vcb->Vpb ) ) A14_Scb->FcbpA15_NtfsFullFileRefNumber( _Scb->Fcb->FileReference )A16_Scb$A17_Ccb->TxfFo8A18_Ccb->TxfFo->KtmTrans0A19_Scb->Fcb->TxfRmcb@A20_Ccb->FullFileName.BufferTEMP�D
��Q}R'Ae�"�=���D�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��C�oData+K�NameA11_Scb->Vcb
A��]�oDataEK�NameA12__Scb->Vcb->VolumeName
A����oData�K�NamebA13_WppCountedStringW( Scb->Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Scb->Vcb->Vpb ) )
A��C�oData+K�NameA14_Scb->Fcb
A����oData}K�Name5A15_NtfsFullFileRefNumber( _Scb->Fcb->FileReference )
A��9�oData!K�NameA16_Scb
A��W�oData?K�NameA17__Ccb->FullFileName
A��S�oData;K�NameA18_Ccb->AccessFlags
A��a�oDataIK�NameA19_FileObject->WriteAccess
	A��c�oDataKK�NameA20_FileObject->DeleteAccess
�D0EPE�ETFtF�F�F,G\G�G8A10_PsGetCurrentThread() A11_Scb->Vcb8A12__Scb->Vcb->VolumeName�A13_WppCountedStringW( Scb->Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Scb->Vcb->Vpb ) ) A14_Scb->FcbpA15_NtfsFullFileRefNumber( _Scb->Fcb->FileReference )A16_Scb4A17__Ccb->FullFileName0A18_Ccb->AccessFlags<A19_FileObject->WriteAccess@A20_FileObject->DeleteAccessTEMP�xI���dw	]�~T�Q��$��lD�	EventDataA��K�oData3K�NameA10___FUNCTION__
A��O�oData7K�NameA11_(PVOID)TxfRmcb
A��O�oData7K�NameA12__TxfRmcb->RmId
A��M�oData5K�NameA13_ExceptionCode
�I�IJHJ(A10___FUNCTION__,A11_(PVOID)TxfRmcb,A12__TxfRmcb->RmId(A13_ExceptionCodeTEMPlM��k���Y�}q�ᤖ���D�	EventDataA��K�oData3K�NameA10___FUNCTION__
A��a�oDataIK�NameA11_TransactionNotification
A����oData�K�Name9A12_(TransactionAlreadyPrepared ? ' **PREPARED** ' : ' ')
A��U�oData=K�NameA13__TxfTrans->KtmUow
A��O�oData7K�NameA14_(PVOID)TxfRmcb
A��O�oData7K�NameA15__TxfRmcb->RmId
A��?�oData'K�Name
A16_Status
�M N\N�NO0O\O(A10___FUNCTION__<A11_TransactionNotificationxA12_(TransactionAlreadyPrepared ? ' **PREPARED** ' : ' ')0A13__TxfTrans->KtmUow,A14_(PVOID)TxfRmcb,A15__TxfRmcb->RmIdA16_StatusTEMP�0Q�=�hv�[�4��x�<����D�	EventDataA��K�oData3K�NameA10___FUNCTION__
A��]�oDataEK�NameA11_(PVOID)Trans->TxfRmcb
A��]�oDataEK�NameA12__Trans->TxfRmcb->RmId
A��I�oData1K�NameA13_FlushStatus
�Q�Q�QR(A10___FUNCTION__8A11_(PVOID)Trans->TxfRmcb8A12__Trans->TxfRmcb->RmId$A13_FlushStatusTEMP$T�fR�k\7cO
'&~����D�	EventDataA��K�oData3K�NameA10___FUNCTION__
A��O�oData7K�NameA11_(PVOID)TxfRmcb
A��O�oData7K�NameA12__TxfRmcb->RmId
A��=�oData%K�Name	A13_Trans
A��O�oData7K�NameA14__Trans->KtmUow
�T�T�TU U(A10___FUNCTION__,A11_(PVOID)TxfRmcb,A12__TxfRmcb->RmIdA13_Trans,A14__Trans->KtmUowTEMP��W]��$�Y�*�5�F��D�	EventDataA��K�oData3K�NameA10___FUNCTION__
A��K�oData3K�NameA11_CallStack[0]
A��K�oData3K�NameA12_CallStack[1]
A��K�oData3K�NameA13_CallStack[2]
A��K�oData3K�NameA14_CallStack[3]
A��K�oData3K�NameA15_CallStack[4]
X(XPXxX�X�X(A10___FUNCTION__(A11_CallStack[0](A12_CallStack[1](A13_CallStack[2](A14_CallStack[3](A15_CallStack[4]TEMP�,[�pY��XX�)�>����D�	EventDataA��K�oData3K�NameA10___FUNCTION__
A��?�oData'K�Name
A11_Status
A��K�oData3K�NameA12_(PVOID)Trans
A��O�oData7K�NameA13__Trans->KtmUow
A��O�oData7K�NameA14_(PVOID)TxfRmcb
A��O�oData7K�NameA15__TxfRmcb->RmId
�[�[�[\<\h\(A10___FUNCTION__A11_Status(A12_(PVOID)Trans,A13__Trans->KtmUow,A14_(PVOID)TxfRmcb,A15__TxfRmcb->RmIdTEMP��^4	���U�mN�h}�"��D�	EventDataA��K�oData3K�NameA10___FUNCTION__
A��?�oData'K�Name
A11_Status
A��O�oData7K�NameA12_(PVOID)TxfRmcb
A��O�oData7K�NameA13__TxfRmcb->RmId
A��K�oData3K�NameA14_(PVOID)Trans
A��O�oData7K�NameA15__Trans->KtmUow
H_p_�_�_�_`(A10___FUNCTION__A11_Status,A12_(PVOID)TxfRmcb,A13__TxfRmcb->RmId(A14_(PVOID)Trans,A15__Trans->KtmUowTEMP@8b��M�w�Y��Y�F����D�	EventDataA��K�oData3K�NameA10___FUNCTION__
A��O�oData7K�NameA11_(PVOID)TxfRmcb
A��O�oData7K�NameA12__TxfRmcb->RmId
A��I�oData1K�NameA13_OldestTrans
A��[�oDataCK�NameA14__OldestTrans->KtmUow
�b�b�bc@c(A10___FUNCTION__,A11_(PVOID)TxfRmcb,A12__TxfRmcb->RmId$A13_OldestTrans8A14__OldestTrans->KtmUowTEMP��e�{y�A]\�m�����D�	EventDataA��K�oData3K�NameA10___FUNCTION__
A��O�oData7K�NameA11_(PVOID)TxfRmcb
A��O�oData7K�NameA12__TxfRmcb->RmId
A��?�oData'K�Name
A13_Status
A��I�oData1K�NameA14_OldestTrans
A��[�oDataCK�NameA15__OldestTrans->KtmUow
4f\f�f�f�f�f(A10___FUNCTION__,A11_(PVOID)TxfRmcb,A12__TxfRmcb->RmIdA13_Status$A14_OldestTrans8A15__OldestTrans->KtmUowTEMP�í�dh_X�P��Z��:D�	EventDataA��K�oData3K�NameA10___FUNCTION__
A��O�oData7K�NameA11_(PVOID)TxfRmcb
A��O�oData7K�NameA12__TxfRmcb->RmId
A��e�oDataMK�NameA13_(PVOID)TransToDereference
A��i�oDataQK�NameA14__TransToDereference->KtmUow
A��?�oData'K�Name
A15_Status
j<jhj�j�jk(A10___FUNCTION__,A11_(PVOID)TxfRmcb,A12__TxfRmcb->RmId@A13_(PVOID)TransToDereferenceDA14__TransToDereference->KtmUowA15_StatusTEMPm�_Cnw�^�2���Z�X���D�	EventDataA��K�oData3K�NameA10___FUNCTION__
A��K�oData3K�NameA11_PinnedStatus
A��O�oData7K�NameA12_(PVOID)TxfRmcb
A��O�oData7K�NameA13__TxfRmcb->RmId
A��?�oData'K�Name
A14_Status
|m�m�m�m$n(A10___FUNCTION__(A11_PinnedStatus,A12_(PVOID)TxfRmcb,A13__TxfRmcb->RmIdA14_StatusTEMPX@p�f��P]gu�f������D�	EventDataA��K�oData3K�NameA10___FUNCTION__
A��O�oData7K�NameA11_(PVOID)TxfRmcb
A��O�oData7K�NameA12__TxfRmcb->RmId
A����oData�K�Name@A13_(IsEncrypted( _TopsFcb->Info ) ? 'encrypted' : 'compressed')
�p�p�pq(A10___FUNCTION__,A11_(PVOID)TxfRmcb,A12__TxfRmcb->RmId�A13_(IsEncrypted( _TopsFcb->Info ) ? 'encrypted' : 'compressed')TEMP��t5�`��R�V�,��S��D�	EventDataA��9�oData!K�NameA10_Vcb
A��G�oData/K�NameA11_IrpContext
A��W�oData?K�NameA12_Vcb->FirstValidUsn
A��M�oData5K�NameA13_FirstValidUsn
A��a�oDataIK�NameA14_TrackUsnJournalFileSize
A��m�oDataUK�Name!A15_TrackUsnJournalAllocationSize
A��_�oDataGK�NameA16_TrackUsnJournalMaxSize
A��o�oDataWK�Name"A17_TrackUsnJournalDeltaAllocation
�u�u�u�uvPv�v�vA10_Vcb$A11_IrpContext4A12_Vcb->FirstValidUsn(A13_FirstValidUsn<A14_TrackUsnJournalFileSizeHA15_TrackUsnJournalAllocationSize<A16_TrackUsnJournalMaxSizeLA17_TrackUsnJournalDeltaAllocationTEMPy�8�T;�iW��F�5&����D�	EventDataA��9�oData!K�NameA10_Vcb
A��G�oData/K�NameA11_IrpContext
A��U�oData=K�NameA12_FirstValidUsn - 1
A��M�oData5K�NameA13_SavedReserved
A��S�oData;K�NameA14_RequiredReserved
ly�y�y�y�yA10_Vcb$A11_IrpContext0A12_FirstValidUsn - 1(A13_SavedReserved0A14_RequiredReservedTEMP}�B]i� �Zմ�4p�����D�	EventDataA��9�oData!K�NameA10_Vcb
A��G�oData/K�NameA11_IrpContext
A����oDataoK�Name.A12_UsnJournal->Header.AllocationSize.QuadPart
A��{�oDatacK�Name(A13_UsnJournal->Header.FileSize.QuadPart
A����oDataqK�Name/A14_UsnJournal->Header.ValidDataLength.QuadPart
A��g�oDataOK�NameA15_UsnJournal->TotalAllocated
�}�}�},~�~�~A10_Vcb$A11_IrpContextdA12_UsnJournal->Header.AllocationSize.QuadPartXA13_UsnJournal->Header.FileSize.QuadPartdA14_UsnJournal->Header.ValidDataLength.QuadPartDA15_UsnJournal->TotalAllocatedTEMP������XJD[膐[;K���"D�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��G�oData/K�NameA11_TypeOfOpen
A��9�oData!K�NameA12_Vcb
A��S�oData;K�NameA13__Vcb->VolumeName
A����oData�K�NameXA14_WppCountedStringW( Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Vcb->Vpb ) )
A��9�oData!K�NameA15_Fcb
A����oData}K�Name5A16_NtfsFullFileRefNumber( _Scb->Fcb->FileReference )
�H�l�����h�|�8A10_PsGetCurrentThread()$A11_TypeOfOpenA12_Vcb0A13__Vcb->VolumeName�A14_WppCountedStringW( Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Vcb->Vpb ) )A15_FcbpA16_NtfsFullFileRefNumber( _Scb->Fcb->FileReference )TEMP

��t�i��[�I�CQ����hD�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��C�oData+K�NameA11_Scb->Vcb
A��]�oDataEK�NameA12__Scb->Vcb->VolumeName
A����oData�K�NamebA13_WppCountedStringW( Scb->Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Scb->Vcb->Vpb ) )
A��C�oData+K�NameA14_Scb->Fcb
A����oData}K�Name5A15_NtfsFullFileRefNumber( _Scb->Fcb->FileReference )
A��9�oData!K�NameA16_Scb
A��_�oDataGK�NameA17_Scb->AttributeTypeCode
A��Y�oDataAK�NameA18__Scb->AttributeName
A��U�oData=K�NameA19_Scb->CleanupCount
	P��������̋<�P�����8A10_PsGetCurrentThread() A11_Scb->Vcb8A12__Scb->Vcb->VolumeName�A13_WppCountedStringW( Scb->Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Scb->Vcb->Vpb ) ) A14_Scb->FcbpA15_NtfsFullFileRefNumber( _Scb->Fcb->FileReference )A16_Scb<A17_Scb->AttributeTypeCode4A18__Scb->AttributeName0A19_Scb->CleanupCountTEMP�p�5�[���T�hK�iv���JD�	EventDataA��9�oData!K�NameA10_Vcb
A��G�oData/K�NameA11_IrpContext
A��g�oDataOK�NameA12_IrpContext->OriginatingIrp
A��[�oDataCK�NameA13_PsGetCurrentThread()
A��y�oDataaK�Name'A14_Scb->Header.AllocationSize.QuadPart
A��m�oDataUK�Name!A15_Scb->Header.FileSize.QuadPart
A��{�oDatacK�Name(A16_Scb->Header.ValidDataLength.QuadPart
A��U�oData=K�NameA17_NewAllocationSize
�$�H���đ�`���A10_Vcb$A11_IrpContextDA12_IrpContext->OriginatingIrp8A13_PsGetCurrentThread()TA14_Scb->Header.AllocationSize.QuadPartHA15_Scb->Header.FileSize.QuadPartXA16_Scb->Header.ValidDataLength.QuadPart0A17_NewAllocationSizeTEMPl�[�����]� �9�8��ND�	EventDataA��9�oData!K�NameA10_Vcb
A��G�oData/K�NameA11_IrpContext
A��g�oDataOK�NameA12_IrpContext->OriginatingIrp
A��[�oDataCK�NameA13_PsGetCurrentThread()
A��y�oDataaK�Name'A14_Scb->Header.AllocationSize.QuadPart
A��m�oDataUK�Name!A15_Scb->Header.FileSize.QuadPart
A��{�oDatacK�Name(A16_Scb->Header.ValidDataLength.QuadPart
A��Y�oDataAK�NameA17_Scb->TotalAllocated
� �D������\���A10_Vcb$A11_IrpContextDA12_IrpContext->OriginatingIrp8A13_PsGetCurrentThread()TA14_Scb->Header.AllocationSize.QuadPartHA15_Scb->Header.FileSize.QuadPartXA16_Scb->Header.ValidDataLength.QuadPart4A17_Scb->TotalAllocatedTEMP�����}��^vQ�Hz���)��xD�	EventDataA��9�oData!K�NameA10_Vcb
A��G�oData/K�NameA11_IrpContext
A��g�oDataOK�NameA12_IrpContext->OriginatingIrp
A��[�oDataCK�NameA13_PsGetCurrentThread()
����`�A10_Vcb$A11_IrpContextDA12_IrpContext->OriginatingIrp8A13_PsGetCurrentThread()TEMP�\�}2�����_�o�wF?J}���D�	EventDataA��]�oDataEK�NameA10_RemainingClusterCount
A��9�oData!K�NameA11_Scb
A��9�oData!K�NameA12_Vcn
A��9�oData!K�NameA13_Lcn
A��K�oData3K�NameA14_ClusterCount
����� �4�8A10_RemainingClusterCountA11_ScbA12_VcnA13_Lcn(A14_ClusterCountTEMPp���@$ѣ;UZ�x�p�+����D�	EventDataA��G�oData/K�NameA10_IrpContext
A��?�oData'K�Name
A11_Status
A��M�oData5K�NameA12_FileReference
A��9�oData!K�NameA13_Fcb
A��?�oData'K�Name
A14_Source
A��a�oDataIK�NameA15_TopLevelExceptionStatus
���8�`�t���$A10_IrpContextA11_Status(A12_FileReferenceA13_FcbA14_Source<A15_TopLevelExceptionStatusTEMP���0�v���R��qWC�����D�	EventDataA��9�oData!K�NameA10_Vcb
A��C�oData+K�NameA11_WasDirty
A����oDatayK�Name3A12_NtfsFullSegmentNumber( _BugCheckFileReference )
A��?�oData'K�Name
A13_Source
ԣ��t�A10_Vcb A11_WasDirtylA12_NtfsFullSegmentNumber( _BugCheckFileReference )A13_SourceTEMP�		���?��!�*Q�lK��2�w���D�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��G�oData/K�NameA11_TypeOfOpen
A��9�oData!K�NameA12_Vcb
A��S�oData;K�NameA13__Vcb->VolumeName
A����oData�K�NameXA14_WppCountedStringW( Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Vcb->Vpb ) )
A��9�oData!K�NameA15_Fcb
A����oData}K�Name5A16_NtfsFullFileRefNumber( _Scb->Fcb->FileReference )
A��W�oData?K�NameA17_FsInformationClass
A��9�oData!K�NameA18_Scb
8�p�����ة�����H�8A10_PsGetCurrentThread()$A11_TypeOfOpenA12_Vcb0A13__Vcb->VolumeName�A14_WppCountedStringW( Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Vcb->Vpb ) )A15_FcbpA16_NtfsFullFileRefNumber( _Scb->Fcb->FileReference )4A17_FsInformationClassA18_ScbTEMPt`�FPS���^���s�B�����D�	EventDataA����oDataqK�Name/A10_IrpSp->Parameters.Write.ByteOffset.HighPart
A����oDataoK�Name.A11_IrpSp->Parameters.Write.ByteOffset.LowPart
A����oDatayK�Name3A12_IrpContext->TopLevelIrpContext->ExceptionStatus
���d�dA10_IrpSp->Parameters.Write.ByteOffset.HighPartdA11_IrpSp->Parameters.Write.ByteOffset.LowPartlA12_IrpContext->TopLevelIrpContext->ExceptionStatusTEMP�,�B�;���P��K����&D�	EventDataA��[�oDataCK�NameA10_PsGetCurrentThread()
A��9�oData!K�NameA11_Vcb
A��S�oData;K�NameA12__Vcb->VolumeName
A����oData�K�NameXA13_WppCountedStringW( Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Vcb->Vpb ) )
A��E�oData-K�Name
A14_ByteRange
A����oData�K�NameXA15_HIGHEST_WRITABLE_SECTOR_ON_ACTIVE_VOLUME * Vcb->SectorSizeInfo.LogicalBytesPerSector
��ܲ� �س��8A10_PsGetCurrentThread()A11_Vcb0A12__Vcb->VolumeName�A13_WppCountedStringW( Vcb->Vpb->VolumeLabel, SAFE_VPB_VOLUME_LABEL_LENGTH( Vcb->Vpb ) ) A14_ByteRange�A15_HIGHEST_WRITABLE_SECTOR_ON_ACTIVE_VOLUME * Vcb->SectorSizeInfo.LogicalBytesPerSectorTEMP\(�`�����[��nr��6���DD�	EventDataA��I�oData1K�NameA10_StartingVbo
A��{�oDatacK�Name(A11_Scb->Header.ValidDataLength.QuadPart
A��Q�oData9K�NameA12_(ptrdiff_t) Scb
d����$A10_StartingVboXA11_Scb->Header.ValidDataLength.QuadPart,A12_(ptrdiff_t) ScbTEMPX�3���l�^y�W�_ԡ���D�	EventDataA��E�oData-K�Name
A10_ByteRange
A��S�oData;K�NameA11_SectorAlignedVdl
A��Q�oData9K�NameA12_(ptrdiff_t) Scb
����� A10_ByteRange0A11_SectorAlignedVdl,A12_(ptrdiff_t) ScbPRVA�,� ��Microsoft-Windows-NtfsLog_0b26db43373d38de0bf1aa2232dcbc08���A)M�;�n���]OPCOLEVL�P�P(�P@�P\�P�� win:Criticalwin:Errorwin:Warning(win:Informationalwin:VerboseTASKKEYW�&���������(�����D�����P�����`� ����p�@�����������������������������н����������� �����@����$������@�����P�����d�����|������������� ����ľ@����ؾ���������������������@�����d������� ������@�����������������ؿ�������������������8� ����`�DUMMYHASH_TABLEDAXREADWRITECOMPRESSEDEFSMFTVOLBITMAPCREATEALTSTREAMSOBJIDINDEXESTXFKTMTXFRECOVERYTXFRMTXFFCBSELFHEALHEALBITMAPUSNJRNLDELNOTIFYLOGFILEFLUSHSCRUB STATUS_DEBUG(FRSCONSOLIDATION$ALLOC_FREE_CLUSOPERATIONSHOTFIXVOLUMECACHESUPDEVIOSUPFSCTRL MFT_ATTR_LISTMOUNTCACHEDRUNS(SHARING_VIOLATION ACCESS_DENIEDEVNT��

�عPE�L�TE���XE

���\E��ع`E�عdE���hE��عlE��عpE�H�tE�<�xE�X�|E�X��E����E�X��E�@&��E��)��E��)��E��-��E��2��E��7��E��;��E  ��?��E!!��B��E""�G��E##��M��E$$��M��E%%��T��E&&�X��E''�X��E((��[��E))��[��E**��[��E++��[��E,,�p`��E--�@d��E..��m��E//�<r��E00��u��E11�}��E2 2�Ԅ��E3 3�Ѕ��E44�����E55�č��E66�č�F77�H��F88����F99����F::���F;;�č�F<<���F==�č�F>>�č� F??���$F@@�Ȭ�(FAA�ذ�,FBB�ܴ�0FCC�|��4FDC�|��8FEE����<FFF����@FGG����DFHG����HFII����LFJJ�(��PFKI����TFLL����XFMM����\FNN�D��`FOO����dFPP�`��hFQQ�h��lFRR����pFSR����tFTT�X��xFUU����|FVV����FWW�h���FXX�����FYY����FZZ�h���F[[�����F\\�p���F]]�<���F^^�����F__���ع�F``����Faa�����Fbb�,����Fcc�����Fdd�����Fee����Fff�@��Fgg���Fhh����Fii�����Fjj��
��Fkk�����Fll����Fmm��ع�Fnn� ̹�Foo�0��Fpp���Fqq���Frr����Fss����Ftt����Fuu�|!��Fvv�`#�Gww��&�Gxx�t(�Gyy��*�Gzs��-�G{{���G||��/�G}{���G~@~�5� G@�L7�$G��� 8̹(G����8ع,G����9ع0G����9ع4G���|:�8G���@D�<G� ��N�@G� ��DR�DG� ��N�HG����S�LG� ��N�PG���Z�TG����`�XG���h�\G����n�`G� ��8u�dG� ���~�hG� ��@��lG� �����pG� ��8u�tG� ����xG� �����|G� ��T���G� ������G� ��h���G� ��p���G� ������G� ������G� ��0���G� ��4���G� ��p���G� ��`���G� ��,���G� ������G� ������G���8���G� �����G������G� ��0��G���,#��G� ��-��G���,#��G� ���4��G� ��|<��G� ���D��G� ��tL��G���$T��G� ��H\��G����_��G����k��G���xy��G���h���G���ȝ���G���ȝ��G���ȝ�H���ȝعH���Р�H������H������H�����H������H���̪�H������ H������$H���D��(H�����,H���t��0H���̺�4H������8H������<H�����@H�����DH�������HH������LH�������PH�������TH������XH�����\H�����`H���\���dH�����hH������lH�����pH�����tH������xH�����|H������H������H������H���`���H�������H�������H�������H�������H�������H�������H���X���H���`���H���D���H��� ���H��������H��������H��������H������H������H������H���H���H�������H�������H���0���H��������H��������H��������H�������H���@����H���@����H���t���H��������H������I������I� ����I�����I���̹I���̹I���̹I�����I����	� I����
�$I�P�(I��,I��0I�� �4I����8I���8�<I�� �@I����DI���8�HI	 	�H�LI

����PI����TI 	�H�XI

���\I��"�`I�8*�dI�h.�hI�3�lI��9�pI �>�tI ��D�xI����|I�����I �8M��I�V��I�|Z��I���I�x_��I��a��I�d��I�d��I��e��I  ��h��I!!��j��I""��j��I# #�8l��I$ $��s��I% %��}��I& &�����I' '����I( (�8���I) )����I* *�4���I+ +����I, ,����I- -����I. .�d���I/ /�����I0 0����I1 1�����I2 2�����I3 3�|���I4 4�p���I5 5�����I6 6����J7 7���J8 8��
�J9 9�p�J: :�(�J; ;��!�J< <�)�J= =��1�J>>��9� J??�@<�$J@@��=�(JAA��?�,JBB�A�0JC@C�LB�4JD@D�D�8JE@E��<JF@F��@JGG�G�DJH H�J�HJI I�N�LJJ J���PJK K���TJL L�DR�XJM M��W�\JN N��\�`JO�O�|a�dJP P��W�hJQQ��e�lJR R��W�pJS S�N�tJT T�h�xJUU�N�|JV V��W��JW W��W��JX X�Xn��JY Y�Xn��JZ Z�Xn��J[ [��r��J\ \��w��J] ]��W��J^ ^��W��J_ _�}��J` `����Ja a�Ї��Jb b����Jc c�P���Jdd�t���Jee�P���Jf f�̛��Jg g�8���Jh h��W��Ji i��W��Jj j��W��Jkk�����Jll�����Jm m�����Jn n�İ��Jo o�����Jp p�����Jq q�|���Jr r�����Jss�����Jtt�����Ju u�����Jv v����Kw w��W�Kxx���عKy y��W�Kz y��W�K{ {�(��K| |��W�K}}�0��K~ |��W� K ��W�$K� ��x��(K������,K������0K����8	�4K� ��h
�8K������<K�����@K������DK������HK������LK������PK������TK����� �XK����� �\K����@"�`K�����#�dK����l%�hK�����&�lK����l%�pK����x(�tK����-عxK����l3�|K����l3��K�������K����� ��K����� ��K������K������K����l%��K����l%��K�����&��K�����4��K����l3��K�����9��K�����:��K� ��h
��K� ��<<��K� ��<<��K� ��<<��K���D��K� ���J��K� ��hR��K� ���Y��K� ��Db��K� ���h��K� ���o��K� ���Y��K� ��Db��K� ���v��K� ��8}��K� ��0���K� ������K������K���P���K���,��L���P��L���P��L� �����L������L������L���0��L���L��L���l3� L� ��x��$L���̹(L���P��,L����0L�����4L����8L���ȴ�<L���Ը�@L� ��h��DL� ����HL� �����LL� �����PL� �����TL� �� ��XL� �����\L� ����`L� �����dL� �����hL� �����lL� ��N�pL� �����tL� �����xL���`��|L���`���L�������L�������L������L�������L�������L���`���L���`���L��������L��������L��������L�������L��������L��������L�������L���4����L������L����8��L����8��L����8��L����8��L������L�������L�������L�����ع�L������L��������L�������L��� ���L�������L���\���L�������L��� ��M���T��M������M���T��M����e�M������M������M������M���X�� M���L��$M���̹(M���̹,M���̹0M����4M���̹8M���<M���@M�(�DM�@�HM	�	���LM
�
���PM���TM���XM

�̹\M�ع`M���dM���hM ���lM ���pM ���tM�O�L�xM �x��|M ����M�d"ع�M �#��M �#��M �#��M �\*��M �����M �\*��M�`���M�`���M  �@,��M!!�@,��M""�0��M##��5��M$$��:��M%%��?��M&&�J��M''�J��M( (��K��M) )�8Q��M* *��W��M+ +�^��M, ,��d��M- -�k��M. .�k��M/ /��q��M0 0��w��M1 1��~��M2 2�����M3 3�����M4 4�N��M5 5�����M6 6����N77�عN8 8����N9 9����N: :����N; ;�\��N< <�d��N= =�Ȫ�N> >�L�� N??�`��$N@@�`��(NAA����,NBB����0NCC�����4NDD�����8NEE����<NFF�p���@NGG���DNHH�<���HNII�<���LNJJ�p��PNKK� ��TNLL� ��XNMM�P��\NN�N�X��`NO�N����dNP�P�d��hNQ�P�d��lNRR���̹pNS�S���tNT�T���xNU�U���|NV�V����NW�W����NX�X����NY�Y����NZ�Z�����N[�[�����N\�\�d���N] ]�����N^�^����N_�_����N`�`�p���Na�a�,���Nb�b�4���Nc�c����Nd�d����Ne�e����Nf f�����Ng�g����Nh f�����Ni�i����Nj�j����Nk�k����Nl�k����Nm�m���Nn�n����No�o����Np�p����Nq�q����Nr�r�T��Ns�s���Nt�t����Nuu�D��Nv�v�\�Ow�w���Ox�x�l�Oy�w���Oz z�$#�O{ {�(�O|�|���O}�}��,�O~�~��� O ��.�$O� ���6�(O� ��?�,O�����G�0O����pJ�4O����d��8O����d��<O����xO�@O����<R�DO����LU�HO��P�<R�LO�����X�PO�����\�TO������XO������\O������`O������dO����8`�hO����xc�lO������pO������tO����,g�xO������|O�������O����4k��O�������O�������O�������O�������O�������O�������O�������O�������O�������O�������O����@n��O�������O�������O�������O�������O�������O�������O�������O�������O�������O� ������O����q��O��� w��O���,z��O���,z��O�������O�������O� ��,��O� ������O� ������O�����P�����P�����P�����P�����P������P������P������P������ P������$P������(P������,P������0P������4P����e�8P���\��<P���̡ع@P� �����DP� �����HP����\��LP���d"عPP� ��Ю�TP������XP�����\P��ȼX�ȼغغȼ����ȼH�H�H�H�H�H�ȼȼH�H�ȼȼȼȼH�H�H�H�H�H�H�H�H�H�H�H�H�H�H�H���H�H�H�H�H�H�H�H�H�H�H�H�H�H�H�X�ȼX�X�X�ȼX���ȼ������X�X���X�ȼX�X�X�X�X�X�X�X�X�X�X����������8�����������8���غغغغغغغغغغغغغغغ������������h�h�������������������������������������������������������������8�8�8�8������������������������������������������������������������������������������������������������������������������������������������������X�x�x�x�x�x��������������������������������������غغغغغغغغغغغ���������������������������غغغX�X�����h�����������h����ؼ��������������h�h�����������������������������8����(�(�(��(�(�(�(�(�(�(�(�(�(�(�(�(�(�(���(�(�(�(�(�(�(�(�(�(�(�(�(�(������������������������������غغغغغ���ȺȺȺȺȺȺ��������������X�ȼ����������X�ȼ��������������غغغغغغغ����������X�X�X�X�X�X�ؼؼȼh�غغȼȼȼ����������X�ȼ��������h�h����������������غ���������X�ȼȼȼȼȼȼȼX�X�������������������������غغX�غغغغغغغغ��������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������غغغغ��������h���������غ�����EVTAHj�
�|
 ��|x��|x�
�|
̎�|x��|���|v��|R��|���|���|���|���|и�|��| ��|4��|���|��|���|܈�|���|�� �| Ɣ!�|!�"�|"��#�|#J�$�|$t�%�|%��&�|&ʜ'�|'��(�|(�)�|)8�*�|*b�+�|+��,�|,��-�|-��.�|.�/�|/&�0�|0|�1�|1��2�|2��3�|3�4�|4&�5�|5<�6�|6R�7�|7|�8�|8�9�|9<�:�|:h�;�|;��<�|<��=�|=֠>�|>�?�|?�@�|@,�A�|AX�B�|B��C}C�D}Dj�E}Et�F}F��G}Gh�H}H��I}I��J}JƢK}K�L}L�M}MT�N}N��O}O�P}P4�Q}Qv�R}R��S}SڧT}T�U}U��V}V\�W}Wp�X}X��Y}Y��Z}ZJ�[}[6�\}\l�]}]��^}^��_}_�`}`2�a}aH�b}br�c}cڐd}d�e}en�f}f��g}g4�h}h��i}i��j}jĕk}kڕl}l�m}mD�n.}n<�o.}o@�p.}p��q.}qΓr.}r�s.}sJ�t.}tB�u.}u0�v.}vܘw.}wx�x.}x8�y.}yL�z.}z��{.}{�|.}|d�}.}}�~.}~r�.}���N}���N}�İ�N}����N}�r��l}�"��l}����l}�8��l}�J��l}�^��l}����l}����l}�Բ�l}� ��l}�4��l}�H��l}���l}�ҷ�l}���l}�H��l}����l}����l}�`��l}�`��l}���l}���l}�f��l}����l}�΅�l}����l}�`��l}�v��l}����l}����l}���l}���l}�b��l}����l}�N��l}����l}����l}�"��l}�N��l}�d��l}�.��l}�’�l}�ؒ�l}�*��l}����l}�ʚ�l}���l}����l}�����}�����}�~���}� ���}�����}�����}�����}�`���}�ب��}�Ԭ��}�d���}�8���}�����}�Z���}����}�̂��}�ʃ��}�>���}�|���}�z���}�"���}�·��}�b���}�v���}�V���}�(���}�h���}�����}�P���}�����}�ޏ��}�����}�D���}�����}�T���}� ���}�����}�.���}�Z���}�4���}�J���}����}�����}�̛��}� ���}�����}�����}�П��}�����}�����}� ���}�6���}�����}����}�����}�Ĩ��}�����}�n���}�����}�����}����}�J���}�����}����}�0���}�n���}�(���}�~���}�����}����}����}����}����}�L���}�
���}�<���}����}ҍ�}���}��}���}��}��}8��}N��}d�	�}	��
�}
��}��}��
�}
X��}���}đ�}��}��}0��}F��}���}V��}l��}���}��}4��}���}��}F��}\��}r��}�� �} ��!�}!�"�}"b�#~#$�$~$�%~%L�&~&\�'~'��(~(ι)~)0�*~*V�+~+~�,~, �-~-��.~.��/~/ �0~0J�1~1v�2~2��3~3�4~4�5~58�6~6N�7~7d�8~8��9~9��:~:R�;~;|�<~<Đ=~=�>"~>�?"~?ʏ@"~@2�A"~A��B"~BԯC"~C�D"~DH�E"~E�F"~F�G<~G"�H<~H`�I<~IN�J<~J�K<~K��L<~L�M<~M��N<~N�O<~O,�P<~P�Q<~QF�R<~RZ�S<~SҪT<~T �U<~U��V<~V��W<~WF�X<~X�Y<~Y��Z<~Z�[<~[j�\<~\6�]<~]�^<~^�_<~_Z�`<~`��a<~a��b<~b��c<~c6�d<~d6�e<~eL�f<~f��g<~g��h<~h��i<~i��j<~jp�k<~kܔl<~l�m<~mH�n<~n^�o<~o��p<~p��q<~qʗr<~rƘs<~s�t<~t0�u<~u6�v<~v"�w<~w`�x<~xv�y<~y��z<~z�{<~{��|<~|�}<~}"�~<~~��<~���<~����<~����<~�̤�<~���<~����<~�"��<~�8��<~�N��<~�x��<~����<~�̥�<~���<~�\��<~�r��<~����<~����<~����<~�ʦ�<~���<~����<~� ��<~�J��<~�`��<~�ħ�<~���<~���<~�B��<~�X��<~�n��<~����<~����<~���<~�(��<~�>��<~�T��<~����<~����<~�4��<~�r��<~����<~�ګ�<~���<~���<~�D��<~����<~����<~���<~����<~���<~�<��<~�R��<~�h��<~����<~�Э�<~����<~���<~�&��<~�<��<~����<~����<~���<~����<~� ��<~�6��X~����v~�n��v~�ʣ�v~���v~����v~����v~�L���~�p���~�����~����~�����~����~�h���~�����~����~�h���~�����~����~�ƫ��~�����~����~����~����~�$���~�8���~�����~����~�(���~�<���~�P���~�����~�Ҵ��~�����~�"���~�^���~�r���~�����~�����~�����~�Ե��~�����~�r���~�����~�����~����~�4���~�H���~�����~����~�2���~�„��~�����~�����~�����~�(���~�����~� ���~�j���~�����~�����~�ҳ��~�n���~�����~����~\��~��~ ��~��~��~J��~���~���~�	�~	��
�~
��~���~ذ
�~
�� �4�&&�&f�&ȈF��v~�\���F����ر�
��B��Љ����L���� � .�!�!�"�"��#�#�$�$�%�%^�&�&̮'�'��(�($�)�)��*�*|�+�+��,�,�-�-,�.�.T�/�/��0�0��1�1��2�2�3�3"�4.�4�5.�5@�6.�6Z�7N�7^�8n�8��9n�9��:n�:z�;n�;z�<n�<ܣ=n�=��>n�>H�?��?6�@��@�A��A��B��BP�C��Cf�D��D|�E��E��F��F��G��GҌH��H�I��I��J��JڑK��Kp�L��L�M��M�N��N\�O��O��P��P
�Q��Q��R��R��S��Sn�T��T��U��U��V��V��W��WƖX��XܖY��Y�Z��Z�[��[�\��\��]��]�^��^^�_��_ʙ`��`��a��a�b��bL�c��c��d��d�e��e4�f��fx�g��gНh��h<�i��iR�j��jОk��k��l��l��m��m�n��n&�o��oR�p��p~�q��q��r��rB�s��sҡt��tr�u��uڢv��vΩwЀw��xЀxd�yЀy��zЀzR�{Ѐ{v�|�|<�}�|}��~�~��4����4�����4����4�����4��p��4�����4�����4��6��4��J��4��^��4�����4��Զ�4����4��L��4�����4�����4��Ί�4����4����4��$��4��x��4��΋�4����4�����4����4��&��T��Ʊ�T����T�����T����T�����T��"��T��\��T�����T��ք�T�����T��І�T����T�����T��.��T�����T��8��T��:��T�����T��d��v��h��v��^��v��`��v��t��v�����v����v����v�����v����v��2�����|�����p�����D���������������������ރ����������������$�����^���������������������t�����������$��ҁ�d��ҁ������*����L����T����@����h�FILE=TxfRebuild.cFILE=allocsup.cFILE=attrsup.cFILE=bitmpsup.cFILE=cachesup.cFILE=cleanup.cFILE=create.cFILE=debug.cFILE=delnotify.cFILE=devctrl.cFILE=deviosup.cFILE=fileinfo.cFILE=flush.cFILE=fsctrl.cFILE=fspdisp.cFILE=hashsup.cFILE=logsup.cFILE=mcbsup.cFILE=mount.cFILE=ntfsdata.cFILE=ntfsinit.cFILE=objidsup.cFILE=pnp.cFILE=quota.cFILE=quotasup.cFILE=read.cFILE=reparsup.cFILE=resrcsup.cFILE=restrsup.cFILE=secursup.cFILE=selfheal.cFILE=shutdown.cFILE=srsup.cFILE=strucsup.cFILE=txfcallbacks.cFILE=txfctrl.cFILE=txfidsup.cFILE=txfrecovery.cFILE=txftrans.cFILE=txftxfdir.cFILE=usnsup.cFILE=vattrsup.cFILE=verfysup.cFILE=volinfo.cFILE=write.cLINE=10102LINE=10103LINE=10175LINE=1023LINE=10258LINE=10390LINE=10484LINE=1050LINE=10511LINE=1053LINE=10539LINE=10565LINE=1069LINE=10695LINE=1072LINE=10732LINE=10774LINE=10975LINE=10995LINE=1119LINE=1120LINE=1127LINE=1134LINE=1140LINE=11470LINE=11474LINE=1156LINE=1164LINE=11861LINE=1188LINE=1202LINE=12066LINE=1216LINE=1229LINE=1235LINE=12361LINE=1237LINE=12437LINE=1246LINE=1251LINE=1266LINE=12768LINE=1279LINE=1284LINE=1292LINE=12948LINE=12976LINE=12989LINE=1303LINE=13049LINE=1314LINE=13146LINE=13242LINE=13268LINE=1337LINE=13637LINE=13674LINE=13717LINE=1378LINE=13825LINE=1390LINE=1391LINE=1395LINE=14188LINE=1423LINE=14306LINE=14332LINE=14460LINE=14550LINE=14582LINE=1459LINE=1470LINE=14759LINE=14781LINE=1481LINE=14887LINE=15002LINE=1505LINE=1514LINE=15200LINE=1533LINE=1535LINE=1566LINE=15736LINE=1586LINE=1587LINE=1589LINE=1590LINE=1596LINE=1600LINE=1605LINE=1606LINE=1622LINE=16330LINE=1635LINE=1649LINE=16513LINE=1652LINE=16575LINE=1666LINE=1667LINE=16682LINE=16713LINE=1672LINE=16734LINE=16740LINE=16782LINE=16800LINE=16823LINE=1689LINE=16896LINE=16917LINE=1692LINE=16930LINE=1700LINE=17017LINE=1704LINE=17108LINE=17154LINE=17181LINE=17264LINE=17304LINE=17407LINE=17465LINE=1751LINE=17527LINE=17618LINE=17632LINE=17643LINE=1765LINE=17659LINE=17699LINE=17709LINE=17738LINE=1776LINE=1807LINE=18107LINE=18207LINE=1822LINE=18327LINE=1845LINE=18589LINE=18593LINE=18635LINE=1864LINE=18688LINE=18823LINE=1883LINE=1885LINE=1886LINE=1906LINE=1915LINE=19192LINE=1920LINE=19251LINE=1928LINE=19319LINE=19321LINE=19360LINE=19362LINE=19407LINE=19465LINE=19504LINE=1958LINE=196LINE=19890LINE=2005LINE=2016LINE=2018LINE=2025LINE=20351LINE=20366LINE=20473LINE=20543LINE=2055LINE=20567LINE=206LINE=20657LINE=2066LINE=20662LINE=20672LINE=2069LINE=20708LINE=2073LINE=20787LINE=2083LINE=20866LINE=20868LINE=20941LINE=20950LINE=2096LINE=20996LINE=2102LINE=21052LINE=21094LINE=21096LINE=21175LINE=21437LINE=2155LINE=2160LINE=21629LINE=2163LINE=2170LINE=21753LINE=21781LINE=2187LINE=2189LINE=2190LINE=22109LINE=2225LINE=2236LINE=2237LINE=2241LINE=2262LINE=2274LINE=22767LINE=2282LINE=2295LINE=23011LINE=2303LINE=2309LINE=23094LINE=2313LINE=232LINE=23214LINE=23438LINE=23443LINE=2355LINE=23642LINE=23647LINE=23656LINE=237LINE=2370LINE=2373LINE=2379LINE=23807LINE=23822LINE=23927LINE=24210LINE=24232LINE=24245LINE=24265LINE=24276LINE=2433LINE=24529LINE=2463LINE=24663LINE=2490LINE=25060LINE=25068LINE=25076LINE=25084LINE=25092LINE=25100LINE=25108LINE=25116LINE=25129LINE=2513LINE=25156LINE=25220LINE=2526LINE=25305LINE=25323LINE=25355LINE=25388LINE=2540LINE=25409LINE=2543LINE=25439LINE=25508LINE=2551LINE=25510LINE=2553LINE=25535LINE=2558LINE=2563LINE=25654LINE=2568LINE=2569LINE=25691LINE=25749LINE=25796LINE=25819LINE=25845LINE=25856LINE=25885LINE=25890LINE=25901LINE=25941LINE=25982LINE=25989LINE=26007LINE=2601LINE=26026LINE=26037LINE=26044LINE=2605LINE=2608LINE=26162LINE=2618LINE=26350LINE=26373LINE=26403LINE=26463LINE=26491LINE=2651LINE=2669LINE=26750LINE=26779LINE=2679LINE=26870LINE=26920LINE=2694LINE=26954LINE=27027LINE=2703LINE=2705LINE=27154LINE=27178LINE=2718LINE=27249LINE=2730LINE=27341LINE=27348LINE=27378LINE=27383LINE=27395LINE=27416LINE=27427LINE=27431LINE=2745LINE=27450LINE=27451LINE=27466LINE=27489LINE=27548LINE=27554LINE=2764LINE=27671LINE=27689LINE=27707LINE=27756LINE=27825LINE=2788LINE=27914LINE=2797LINE=2801LINE=28010LINE=28055LINE=2806LINE=28165LINE=28229LINE=28293LINE=28322LINE=28347LINE=2837LINE=28429LINE=2843LINE=2846LINE=28504LINE=2858LINE=28619LINE=28626LINE=28661LINE=28702LINE=28725LINE=28727LINE=28746LINE=28749LINE=28763LINE=28779LINE=28884LINE=28888LINE=2890LINE=28947LINE=28959LINE=28971LINE=28980LINE=29026LINE=292LINE=2947LINE=29549LINE=2965LINE=3003LINE=30060LINE=3029LINE=30615LINE=3077LINE=308LINE=3094LINE=3096LINE=312LINE=31219LINE=31446LINE=3150LINE=3184LINE=3196LINE=32039LINE=3207LINE=3232LINE=3312LINE=3345LINE=3348LINE=3355LINE=336LINE=3361LINE=3372LINE=3373LINE=3376LINE=338LINE=3386LINE=3402LINE=3417LINE=3421LINE=3425LINE=3451LINE=3452LINE=3473LINE=348LINE=3484LINE=35146LINE=3515LINE=35156LINE=35179LINE=35208LINE=3523LINE=35286LINE=35327LINE=35440LINE=3545LINE=35455LINE=3548LINE=35482LINE=3558LINE=35670LINE=35678LINE=3569LINE=3575LINE=3585LINE=3586LINE=3592LINE=35928LINE=35957LINE=35974LINE=36021LINE=36091LINE=36114LINE=36133LINE=36188LINE=3620LINE=36244LINE=3630LINE=36440LINE=36474LINE=3667LINE=3670LINE=368LINE=3688LINE=36922LINE=3697LINE=3714LINE=37262LINE=37288LINE=3732LINE=37390LINE=37416LINE=37447LINE=3747LINE=37484LINE=37516LINE=3759LINE=376LINE=37613LINE=3763LINE=3764LINE=37692LINE=37735LINE=37781LINE=3780LINE=379LINE=37902LINE=3816LINE=3845LINE=38471LINE=3861LINE=3873LINE=3880LINE=390LINE=3930LINE=3953LINE=3968LINE=3999LINE=4010LINE=40175LINE=402LINE=4022LINE=4046LINE=4049LINE=407LINE=4073LINE=4074LINE=40852LINE=4092LINE=4102LINE=41114LINE=4121LINE=4126LINE=41544LINE=4155LINE=41666LINE=4171LINE=41800LINE=41865LINE=4187LINE=41918LINE=4196LINE=4203LINE=4207LINE=424LINE=42497LINE=42658LINE=427LINE=42721LINE=42774LINE=43045LINE=4313LINE=43313LINE=43421LINE=43614LINE=4375LINE=4385LINE=44007LINE=4404LINE=44043LINE=4411LINE=44119LINE=44132LINE=44150LINE=44285LINE=4435LINE=445LINE=4474LINE=45018LINE=45092LINE=4510LINE=4513LINE=45165LINE=45270LINE=4550LINE=45603LINE=45676LINE=459LINE=4626LINE=4636LINE=466LINE=4673LINE=4681LINE=4690LINE=4711LINE=4746LINE=4750LINE=4753LINE=4812LINE=4845LINE=4854LINE=4861LINE=4883LINE=4975LINE=4981LINE=4982LINE=4990LINE=4993LINE=4998LINE=5012LINE=5014LINE=5034LINE=5086LINE=5093LINE=510LINE=5100LINE=5157LINE=5190LINE=5249LINE=530LINE=538LINE=5477LINE=5568LINE=557LINE=5585LINE=559LINE=5634LINE=5752LINE=5766LINE=577LINE=5916LINE=6022LINE=6025LINE=6111LINE=616LINE=629LINE=6347LINE=6374LINE=6395LINE=6403LINE=6424LINE=6464LINE=651LINE=6515LINE=6563LINE=6601LINE=6638LINE=6647LINE=6678LINE=669LINE=6727LINE=6752LINE=6776LINE=6814LINE=6864LINE=706LINE=7073LINE=7158LINE=7171LINE=7185LINE=7194LINE=7205LINE=7222LINE=7257LINE=7262LINE=7270LINE=7272LINE=7287LINE=731LINE=7326LINE=7349LINE=7372LINE=7397LINE=741LINE=7415LINE=7438LINE=7449LINE=7450LINE=7454LINE=7472LINE=7474LINE=7497LINE=750LINE=7525LINE=7548LINE=7552LINE=7559LINE=763LINE=7651LINE=766LINE=7707LINE=7826LINE=786LINE=7907LINE=7910LINE=7950LINE=7973LINE=8036LINE=8122LINE=8135LINE=815LINE=8192LINE=826LINE=8277LINE=8295LINE=838LINE=8423LINE=8557LINE=8576LINE=8584LINE=8603LINE=8621LINE=8650LINE=8855LINE=8893LINE=8917LINE=8977LINE=9018LINE=9067LINE=916LINE=9189LINE=921LINE=9234LINE=924LINE=9255LINE=9273LINE=9467LINE=9568LINE=957LINE=9720LINE=975LINE=9757LINE=9922LINE=9948LINE=9973

Anon7 - 2021