Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\VSS]
"DisplayName"="@%systemroot%\\system32\\vssvc.exe,-102"
"ImagePath"=hex(2):25,00,73,00,79,00,73,00,74,00,65,00,6d,00,72,00,6f,00,6f,00,\
74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,76,\
00,73,00,73,00,76,00,63,00,2e,00,65,00,78,00,65,00,00,00
"Description"="@%systemroot%\\system32\\vssvc.exe,-101"
"ObjectName"="LocalSystem"
"ErrorControl"=dword:00000001
"Start"=dword:00000003
"Type"=dword:00000010
"DependOnService"=hex(7):52,00,50,00,43,00,53,00,53,00,00,00,00,00
"ServiceSidType"=dword:00000001
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\VSS\Diag]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\VSS\Diag\SPP]
"SppGetSnapshots (Enter)"=hex:40,00,00,00,00,00,00,00,df,5f,ce,1a,ea,f1,cf,01,\
64,0f,00,00,c0,05,00,00,d2,07,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00
"SppGetSnapshots (Leave)"=hex:40,00,00,00,00,00,00,00,61,e5,d7,1a,ea,f1,cf,01,\
64,0f,00,00,c0,05,00,00,d2,07,00,00,01,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00
"SppEnumGroups (Enter)"=hex:40,00,00,00,00,00,00,00,61,e5,d7,1a,ea,f1,cf,01,64,\
0f,00,00,c0,05,00,00,d1,07,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00
"SppEnumGroups (Leave)"=hex:40,00,00,00,00,00,00,00,61,e5,d7,1a,ea,f1,cf,01,64,\
0f,00,00,c0,05,00,00,d1,07,00,00,01,00,00,00,00,00,00,00,01,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00
"SppCreate (Enter)"=hex:40,00,00,00,00,00,00,00,86,18,96,4f,4f,d4,cf,01,dc,03,\
00,00,4c,09,00,00,d0,07,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00
"SppGatherWriterMetadata (Enter)"=hex:40,00,00,00,00,00,00,00,b4,5d,04,ef,fb,\
00,d1,01,04,0f,00,00,24,05,00,00,d3,07,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00
"SppGatherWriterMetadata (Leave)"=hex:40,00,00,00,00,00,00,00,fc,0a,4f,f0,fb,\
00,d1,01,04,0f,00,00,24,05,00,00,d3,07,00,00,01,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00
"SppAddInterestingComponents (Enter)"=hex:40,00,00,00,00,00,00,00,8d,ba,e5,50,\
4f,d4,cf,01,dc,03,00,00,4c,09,00,00,d4,07,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00
"SppAddInterestingComponents (Leave)"=hex:40,00,00,00,00,00,00,00,8f,c5,f8,50,\
4f,d4,cf,01,dc,03,00,00,4c,09,00,00,d4,07,00,00,01,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00
"SppCreate (Leave)"=hex:40,00,00,00,00,00,00,00,42,c7,a1,51,4f,d4,cf,01,dc,03,\
00,00,4c,09,00,00,d0,07,00,00,01,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\VSS\Diag\SystemRestore]
"SrCreateRp (Enter)"=hex:40,00,00,00,00,00,00,00,86,18,96,4f,4f,d4,cf,01,dc,03,\
00,00,4c,09,00,00,d5,07,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00
"SrCreateRp (Leave)"=hex:40,00,00,00,00,00,00,00,42,c7,a1,51,4f,d4,cf,01,dc,03,\
00,00,4c,09,00,00,d5,07,00,00,01,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\VSS\Diag\ASR Writer]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\VSS\Diag\COM+ REGDB Writer]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\VSS\Diag\MSSearch Service Writer]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\VSS\Diag\Registry Writer]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\VSS\Diag\Shadow Copy Optimization Writer]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\VSS\Diag\System Writer]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\VSS\Diag\VolSnap]
"Volume{77a72a4e-4032-11e4-a5ab-806e6f6e6963}DiscoverSnapshots (Enter)"=hex:40,\
00,00,00,00,00,00,00,8a,24,69,bb,21,1a,d1,01,00,00,00,00,00,00,00,00,20,00,\
00,00,01,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00
"Volume{77a72a4e-4032-11e4-a5ab-806e6f6e6963}DiscoverSnapshots (Leave)"=hex:40,\
00,00,00,00,00,00,00,8a,24,69,bb,21,1a,d1,01,00,00,00,00,00,00,00,00,21,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00
"Volume{77a72a4f-4032-11e4-a5ab-806e6f6e6963}DiscoverSnapshots (Enter)"=hex:40,\
00,00,00,00,00,00,00,4b,e7,6d,bb,21,1a,d1,01,00,00,00,00,00,00,00,00,20,00,\
00,00,01,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00
"Volume{77a72a4f-4032-11e4-a5ab-806e6f6e6963}DiscoverSnapshots (Leave)"=hex:40,\
00,00,00,00,00,00,00,4b,e7,6d,bb,21,1a,d1,01,00,00,00,00,00,00,00,00,21,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00
"Volume{77a72a50-4032-11e4-a5ab-806e6f6e6963}DiscoverSnapshots (Enter)"=hex:40,\
00,00,00,00,00,00,00,ab,48,70,bb,21,1a,d1,01,00,00,00,00,00,00,00,00,20,00,\
00,00,01,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00
"Volume{77a72a50-4032-11e4-a5ab-806e6f6e6963}DiscoverSnapshots (Leave)"=hex:40,\
00,00,00,00,00,00,00,ab,48,70,bb,21,1a,d1,01,00,00,00,00,00,00,00,00,21,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00
"VolumesSafeForWrite (Enter)"=hex:40,00,00,00,00,00,00,00,aa,79,8c,be,21,1a,d1,\
01,00,00,00,00,00,00,00,00,1e,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00
"VolumesSafeForWrite (Leave)"=hex:40,00,00,00,00,00,00,00,aa,79,8c,be,21,1a,d1,\
01,00,00,00,00,00,00,00,00,1f,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\VSS\Diag\WMI Writer]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\VSS\Providers]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\VSS\Providers\{b5946137-7b9f-4925-af80-51abd60b20d5}]
@="Microsoft Software Shadow Copy provider 1.0"
"Type"=dword:00000001
"Version"="1.0.0.7"
"VersionId"="{00000001-0000-0000-0007-000000000001}"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\VSS\Providers\{b5946137-7b9f-4925-af80-51abd60b20d5}\CLSID]
@="{65EE1DBA-8FF4-4a58-AC1C-3470EE2F376A}"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\VSS\Settings]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\VSS\Settings\WritersBlockingRevert]
"{2707761B-2324-473D-88EB-EB007A359533}"="DFS-R Writer"
"{D76F5A28-3092-4589-BA48-2958FB88CE29}"="FRS Writer"
"{B2014C9E-8711-4C5C-A5A9-3CF384484757}"="AD Writer"
"{DD846AAA-A1B6-42a8-AAF8-03DCB6114BFD}"="ADAM Writer"
"TornComponentsBlockRevert"=dword:00000001
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\VSS\VssAccessControl]
"NT Authority\\NetworkService"=dword:00000001
