Well Portmon was able to capture all the messages sent/received to the oscilloscope, looks like data is sent. I setup a filter to include only IRP_MJ_READ and IRP_MJ_WRITE message types only. Here are the "good" messages that need to be deciphered or at least understood as a pattern.

******** SEND DATA REQUEST START ******
IRP_MJ_WRITE Length 1: AA
IRP_MJ_WRITE Length 1: 52
IRP_MJ_WRITE Length 1: F3
IRP_MJ_WRITE Length 1: 14
IRP_MJ_WRITE Length 1: 00
IRP_MJ_WRITE Length 1: 91
IRP_MJ_WRITE Length 1: 07
IRP_MJ_WRITE Length 1: 2D
IRP_MJ_WRITE Length 1: 05
******** SEND DATA REQUEST DONE ******

******** RECV ???ACCEPTED CMD??? ******
IRP_MJ_READ Length 1: 55

******** RECV DATA FROM SCOPE START ******
IRP_MJ_READ Length 1500: 7E 7E 7E 7E 7E 7E 7E 7E 7E .... (ch1 data)
IRP_MJ_READ Length 1500: 7E 7E 7D 7E 7E 7E 7E 7F 7E ....(ch2 data)
******** RECV DATA FROM SCOPE END ******

Above sequence loops until "STOP" button is pressed which shows up as a
IRP_MJ_WRITE Length 1: FF

Will decypher the data section tomorrow and post an excel file of results.