SSCTL_SSR_EVENT_AFTER_SHUTDOWN
.ssr_event = SSCTL_SSR_EVENT_AFTER_SHUTDOWN
sysmon->state = SSCTL_SSR_EVENT_AFTER_SHUTDOWN;
[SSCTL_SSR_EVENT_AFTER_SHUTDOWN] = "after_shutdown",