Donat Was Here

DonatShell
Server IP : 180.180.241.3 / Your IP : 216.73.216.252
Web Server : Microsoft-IIS/7.5
System : Windows NT NETWORK-NHRC 6.1 build 7601 (Windows Server 2008 R2 Standard Edition Service Pack 1) i586
User : IUSR ( 0)
PHP Version : 5.3.28
Disable Function : NONE
MySQL : ON | cURL : ON | WGET : OFF | Perl : OFF | Python : OFF | Sudo : OFF | Pkexec : OFF
Directory : /ProgramData/Sophos/AutoUpdate/data/warehouse/
Upload File :
[ HOME SHELL ]
Current File : /ProgramData/Sophos/AutoUpdate/data/warehouse/cbc680e23fb0584d756939ed37da2407x000.dat
ÿş<?xml version="1.0" encoding="UTF-16"?>

<instrumentationManifest xsi:schemaLocation="http://schemas.microsoft.com/win/2004/08/events eventman.xsd" xmlns:win="http://manifests.microsoft.com/win/2004/08/windows/events" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:trace="http://schemas.microsoft.com/win/2004/08/events/trace" xmlns="http://schemas.microsoft.com/win/2004/08/events">

	<instrumentation>

		<events>

			<provider name="Sophos-AntiVirus-Perf" guid="{788A31A2-9D77-4994-A1C5-6C3036F56141}" symbol="SAVPerfProvider" resourceFileName="Instrumentation.dll" messageFileName="Instrumentation.dll">

				<events>

					<event symbol="etw_OnAcccess_CheckItem" value="1" version="0" channel="etw_OnAccessChannel" level="win:Verbose" task="OnAccessIntercept" opcode="win:Start" template="_template_savperf_oa_checkitem" keywords="File" message="$(string.SAVPerfProvider.event.etw_OnAcccess_CheckItem.message)">

					</event>

					<event symbol="etw_OnAcccess_CheckTimeO" value="2" version="0" channel="etw_OnAccessChannel" level="win:Verbose" task="OnAccessIntercept" opcode="win:Stop" template="_template_savperf_oa_checktime1" keywords="File">

					</event>

					<event symbol="etw_OnAcccess_CheckTime1" value="2" version="1" channel="etw_OnAccessChannel" level="win:Verbose" task="OnAccessIntercept" opcode="win:Stop" template="_template_savperf_oa_checktime2" keywords="File" message="$(string.SAVPerfProvider.event.etw_OnAcccess_CheckTime1.message)">

					</event>

					<event symbol="etw_OnAcccess_CheckTime" value="2" version="2" channel="etw_OnAccessChannel" level="win:Verbose" task="OnAccessIntercept" opcode="win:Stop" template="_template_savperf_oa_checktime3" keywords="File" message="$(string.SAVPerfProvider.event.etw_OnAcccess_CheckTime.message)">

					</event>

					<event symbol="etw_Intercept_OnSetRegKeyValueO" value="10" version="0" channel="etw_BehaviourInterceptChannel" task="OnSetRegKeyValueIntercep" opcode="win:Info" template="_template_savperf_onsetregkeyvalue1" keywords="Registry Process" message="$(string.SAVPerfProvider.event.etw_Intercept_OnSetRegKeyValueO.message)">

					</event>

					<event symbol="etw_Intercept_OnSetRegKeyValue1" value="10" version="1" channel="etw_BehaviourInterceptChannel" task="OnSetRegKeyValueIntercep" opcode="win:Info" template="_template_savperf_onsetregkeyvalue2" keywords="Registry Process" message="$(string.SAVPerfProvider.event.etw_Intercept_OnSetRegKeyValue1.message)">

					</event>

					<event symbol="etw_Intercept_OnSetRegKeyValue" value="10" version="2" channel="etw_BehaviourInterceptChannel" task="OnSetRegKeyValueIntercep" opcode="win:Info" template="_template_savperf_onsetregkeyvalue3" keywords="Registry Process" message="$(string.SAVPerfProvider.event.etw_Intercept_OnSetRegKeyValue.message)">

					</event>

					<event symbol="etw_Intercept_OnCreateOrDeleteRegKeyO" value="11" version="0" channel="etw_BehaviourInterceptChannel" task="OnCreateOrDeleteRegKeyIntercept" opcode="win:Info" template="_template_savperf_oncreateordeletekey1" keywords="Registry Process" message="$(string.SAVPerfProvider.event.etw_Intercept_OnCreateOrDeleteRegKeyO.message)">

					</event>

					<event symbol="etw_Intercept_OnCreateOrDeleteRegKey1" value="11" version="1" channel="etw_BehaviourInterceptChannel" task="OnCreateOrDeleteRegKeyIntercept" opcode="win:Info" template="_template_savperf_oncreateordeletekey2" keywords="Registry Process" message="$(string.SAVPerfProvider.event.etw_Intercept_OnCreateOrDeleteRegKey1.message)">

					</event>

					<event symbol="etw_Intercept_OnCreateOrDeleteRegKey" value="11" version="2" channel="etw_BehaviourInterceptChannel" task="OnCreateOrDeleteRegKeyIntercept" opcode="win:Info" template="_template_savperf_oncreateordeletekey3" keywords="Registry Process" message="$(string.SAVPerfProvider.event.etw_Intercept_OnCreateOrDeleteRegKey.message)">

					</event>

					<event symbol="etw_Intercept_OnCreateOrDeleteProcessO" value="12" version="0" channel="etw_BehaviourInterceptChannel" task="OnCreateOrDeleteProcessIntercept" opcode="win:Info" template="_template_savperf_oncreateordeleteprocess1" keywords="Process" message="$(string.SAVPerfProvider.event.etw_Intercept_OnCreateOrDeleteProcessO.message)">

					</event>

					<event symbol="etw_Intercept_OnCreateOrDeleteProcess1" value="12" version="1" channel="etw_BehaviourInterceptChannel" task="OnCreateOrDeleteProcessIntercept" opcode="win:Info" template="_template_savperf_oncreateordeleteprocess2" keywords="Process" message="$(string.SAVPerfProvider.event.etw_Intercept_OnCreateOrDeleteProcess1.message)">

					</event>

					<event symbol="etw_Intercept_OnCreateOrDeleteProcess" value="12" version="2" channel="etw_BehaviourInterceptChannel" task="OnCreateOrDeleteProcessIntercept" opcode="win:Info" template="_template_savperf_oncreateordeleteprocess3" keywords="Process" message="$(string.SAVPerfProvider.event.etw_Intercept_OnCreateOrDeleteProcess.message)">

					</event>

					<event symbol="etw_Intercept_OnModFile_LegacyO" value="13" version="0" channel="etw_BehaviourInterceptChannel" task="OnModFileIntercept" opcode="win:Info" template="_template_savperf_onfile1" keywords="File Process" message="$(string.SAVPerfProvider.event.etw_Intercept_OnModFile_LegacyO.message)">

					</event>

					<event symbol="etw_Intercept_OnModFile_Legacy" value="13" version="1" channel="etw_BehaviourInterceptChannel" task="OnModFileIntercept" opcode="win:Info" template="_template_savperf_onfile2" keywords="File Process" message="$(string.SAVPerfProvider.event.etw_Intercept_OnModFile_Legacy.message)">

					</event>

					<event symbol="etw_Intercept_OnCreateRemoteThreadO" value="14" version="0" channel="etw_BehaviourInterceptChannel" task="OnCreateRemoteThreadIntercept" opcode="win:Info" template="_template_savperf_createremotethread1" keywords="Process" message="$(string.SAVPerfProvider.event.etw_Intercept_OnCreateRemoteThreadO.message)">

					</event>

					<event symbol="etw_Intercept_OnCreateRemoteThread1" value="14" version="1" channel="etw_BehaviourInterceptChannel" task="OnCreateRemoteThreadIntercept" opcode="win:Info" template="_template_savperf_createremotethread2" keywords="Process" message="$(string.SAVPerfProvider.event.etw_Intercept_OnCreateRemoteThread1.message)">

					</event>

					<event symbol="etw_Intercept_OnCreateRemoteThread" value="14" version="2" channel="etw_BehaviourInterceptChannel" task="OnCreateRemoteThreadIntercept" opcode="win:Info" template="_template_savperf_createremotethread3" keywords="Process" message="$(string.SAVPerfProvider.event.etw_Intercept_OnCreateRemoteThread.message)">

					</event>

					<event symbol="etw_Intercept_OnModFileO" value="15" version="0" channel="etw_BehaviourInterceptChannel" task="OnModFileIntercept" opcode="win:Info" template="_template_savperf_onfile1" keywords="File Process" message="$(string.SAVPerfProvider.event.etw_Intercept_OnModFileO.message)">

					</event>

					<event symbol="etw_Intercept_OnModFile1" value="15" version="1" channel="etw_BehaviourInterceptChannel" task="OnModFileIntercept" opcode="win:Info" template="_template_savperf_onfile2" keywords="File Process" message="$(string.SAVPerfProvider.event.etw_Intercept_OnModFile1.message)">

					</event>

					<event symbol="etw_Intercept_OnModFile" value="15" version="2" channel="etw_BehaviourInterceptChannel" task="OnModFileIntercept" opcode="win:Info" template="_template_savperf_onfile3" keywords="File Process" message="$(string.SAVPerfProvider.event.etw_Intercept_OnModFile.message)">

					</event>

					<event symbol="etw_Intercept_OnIpConnectO" value="16" version="0" channel="etw_BehaviourInterceptChannel" task="OnIpConnectIntercept" opcode="win:Info" template="_template_savperf_basicintercept1" keywords="Process">

					</event>

					<event symbol="etw_Intercept_OnIpConnect1" value="16" version="1" channel="etw_BehaviourInterceptChannel" task="OnIpConnectIntercept" opcode="win:Info" template="_template_savperf_basicintercept2" keywords="Process" message="$(string.SAVPerfProvider.event.etw_Intercept_OnIpConnect1.message)">

					</event>

					<event symbol="etw_Intercept_OnIpConnect" value="16" version="2" channel="etw_BehaviourInterceptChannel" task="OnIpConnectIntercept" opcode="win:Info" template="_template_savperf_basicintercept3" keywords="Process" message="$(string.SAVPerfProvider.event.etw_Intercept_OnIpConnect.message)">

					</event>

					<event symbol="etw_Intercept_OnLoadDriverO" value="17" version="0" channel="etw_BehaviourInterceptChannel" task="OnLoadDriverIntercept" opcode="win:Info" template="_template_savperf_onfile1" keywords="Process" message="$(string.SAVPerfProvider.event.etw_Intercept_OnLoadDriverO.message)">

					</event>

					<event symbol="etw_Intercept_OnLoadDriver1" value="17" version="1" channel="etw_BehaviourInterceptChannel" task="OnLoadDriverIntercept" opcode="win:Info" template="_template_savperf_onfile2" keywords="Process" message="$(string.SAVPerfProvider.event.etw_Intercept_OnLoadDriver1.message)">

					</event>

					<event symbol="etw_Intercept_OnLoadDriver" value="17" version="2" channel="etw_BehaviourInterceptChannel" task="OnLoadDriverIntercept" opcode="win:Info" template="_template_savperf_onfile3" keywords="Process" message="$(string.SAVPerfProvider.event.etw_Intercept_OnLoadDriver.message)">

					</event>

					<event symbol="etw_Intercept_OnFileOpenForWriteO" value="18" version="0" channel="etw_BehaviourInterceptChannel" task="OnFileOpenForWriteIntercept" opcode="win:Info" template="_template_savperf_onfile1" keywords="File Process" message="$(string.SAVPerfProvider.event.etw_Intercept_OnFileOpenForWriteO.message)">

					</event>

					<event symbol="etw_Intercept_OnFileOpenForWrite1" value="18" version="1" channel="etw_BehaviourInterceptChannel" task="OnFileOpenForWriteIntercept" opcode="win:Info" template="_template_savperf_onfile2" keywords="File Process" message="$(string.SAVPerfProvider.event.etw_Intercept_OnFileOpenForWrite1.message)">

					</event>

					<event symbol="etw_Intercept_OnFileOpenForWrite" value="18" version="2" channel="etw_BehaviourInterceptChannel" task="OnFileOpenForWriteIntercept" opcode="win:Info" template="_template_savperf_onfile3" keywords="File Process" message="$(string.SAVPerfProvider.event.etw_Intercept_OnFileOpenForWrite.message)">

					</event>

					<event symbol="etw_Intercept_OnOpenProcessHandle1" value="19" version="0" channel="etw_BehaviourInterceptChannel" task="OnOpenProcessHandleIntercept" opcode="win:Info" template="_template_savperf_onopenprocesshandle1" keywords="Process" message="$(string.SAVPerfProvider.event.etw_Intercept_OnOpenProcessHandle1.message)">

					</event>

					<event symbol="etw_Intercept_OnOpenProcessHandleO" value="19" version="1" channel="etw_BehaviourInterceptChannel" task="OnOpenProcessHandleIntercept" opcode="win:Info" template="_template_savperf_onopenprocesshandle2" keywords="Process" message="$(string.SAVPerfProvider.event.etw_Intercept_OnOpenProcessHandleO.message)">

					</event>

					<event symbol="etw_Intercept_OnOpenProcessHandle" value="19" version="2" channel="etw_BehaviourInterceptChannel" task="OnOpenProcessHandleIntercept" opcode="win:Info" template="_template_savperf_onopenprocesshandle3" keywords="Process" message="$(string.SAVPerfProvider.event.etw_Intercept_OnOpenProcessHandle.message)">

					</event>

					<event symbol="etw_WebContent_Check" value="30" version="0" channel="etw_WebConnectChannel" task="WebContentIntercept" opcode="win:Start" template="_template_savperf_wc_check" message="$(string.SAVPerfProvider.event.etw_WebContent_Check.message)">

					</event>

					<event symbol="etw_WebContent_CheckedO" value="31" version="0" channel="etw_WebConnectChannel" task="WebContentIntercept" opcode="win:Stop" template="_template_savperf_wc_checked1" message="$(string.SAVPerfProvider.event.etw_WebContent_CheckedO.message)">

					</event>

					<event symbol="etw_WebContent_Checked" value="31" version="1" channel="etw_WebConnectChannel" task="WebContentIntercept" opcode="win:Stop" template="_template_savperf_wc_checked2" message="$(string.SAVPerfProvider.event.etw_WebContent_Checked.message)">

					</event>

					<event symbol="etw_VirusEngine_SweepObject_SweepO" value="40" version="0" channel="etw_ScanChannel" level="win:Informational" task="Sweep" opcode="Compute" template="_template_savperf_sweepobject1" keywords="File" message="$(string.SAVPerfProvider.event.etw_VirusEngine_SweepObject_SweepO.message)">

					</event>

					<event symbol="etw_VirusEngine_SweepObject_Sweep" value="40" version="1" channel="etw_ScanChannel" level="win:Informational" task="Sweep" opcode="Compute" template="_template_savperf_sweepobject2" keywords="File" message="$(string.SAVPerfProvider.event.etw_VirusEngine_SweepObject_Sweep.message)">

					</event>

					<event symbol="etw_VirusEngine_SweepObject_Resweep" value="41" version="0" channel="etw_ScanChannel" level="win:Informational" task="Sweep" opcode="Compute" template="_template_savperf_sweepobject1" keywords="File" message="$(string.SAVPerfProvider.event.etw_VirusEngine_SweepObject_Resweep.message)">

					</event>

					<event symbol="etw_VirusEngine_Scanning" value="42" version="0" channel="etw_ScanChannel" level="win:Informational" task="Sweep" opcode="Compute" template="_template_savperf_default" keywords="File" message="$(string.SAVPerfProvider.event.etw_VirusEngine_Scanning.message)">

					</event>

					<event symbol="etw_JournalCache_SkipSubfile" value="50" version="0" channel="etw_CacheChannel" task="Cache" opcode="SkipSubfile" message="$(string.SAVPerfProvider.event.etw_JournalCache_SkipSubfile.message)">

					</event>

					<event symbol="etw_JournalCache_SkipHIPS" value="51" version="0" channel="etw_CacheChannel" task="Cache" opcode="SkipHips" message="$(string.SAVPerfProvider.event.etw_JournalCache_SkipHIPS.message)">

					</event>

					<event symbol="etw_JournalCache_SkipManualCleanup" value="52" version="0" channel="etw_CacheChannel" task="Cache" opcode="SkipManualCleanup" message="$(string.SAVPerfProvider.event.etw_JournalCache_SkipManualCleanup.message)">

					</event>

					<event symbol="etw_JournalCache_SkipNoJournal" value="53" version="0" channel="etw_CacheChannel" task="Cache" opcode="NoJournal" message="$(string.SAVPerfProvider.event.etw_JournalCache_SkipNoJournal.message)">

					</event>

					<event symbol="etw_JournalCache_IgnoreCache" value="54" version="0" channel="etw_CacheChannel" task="Cache" opcode="Ignore" message="$(string.SAVPerfProvider.event.etw_JournalCache_IgnoreCache.message)">

					</event>

					<event symbol="etw_JournalCache_Golden" value="55" version="0" channel="etw_CacheChannel" task="Cache" opcode="Golden" message="$(string.SAVPerfProvider.event.etw_JournalCache_Golden.message)">

					</event>

					<event symbol="etw_JournalCache_Hit" value="56" version="0" channel="etw_CacheChannel" task="Cache" opcode="Hit" message="$(string.SAVPerfProvider.event.etw_JournalCache_Hit.message)">

					</event>

					<event symbol="etw_JournalCache_Miss" value="57" version="0" channel="etw_CacheChannel" task="Cache" opcode="Miss" template="_template_savperf_jc_miss" message="$(string.SAVPerfProvider.event.etw_JournalCache_Miss.message)">

					</event>

					<event symbol="etw_JournalCache_Exception" value="58" version="0" channel="etw_CacheChannel" level="win:Error" task="Cache" opcode="Error" message="$(string.SAVPerfProvider.event.etw_JournalCache_Exception.message)">

					</event>

					<event symbol="etw_JournalCache_PostSkipNoJournal" value="59" version="0" channel="etw_CacheChannel" level="win:Informational" task="Cache" opcode="NoJournal" message="$(string.SAVPerfProvider.event.etw_JournalCache_PostSkipNoJournal.message)">

					</event>

					<event symbol="etw_JournalCache_PostInvalidateMalicious" value="60" version="0" channel="etw_CacheChannel" level="win:Informational" task="Cache" opcode="InvalidateMalicious" message="$(string.SAVPerfProvider.event.etw_JournalCache_PostInvalidateMalicious.message)">

					</event>

					<event symbol="etw_JournalCache_PostInvalidate" value="61" version="0" channel="etw_CacheChannel" level="win:Informational" task="Cache" opcode="Invalidate" template="_template_savperf_default" message="$(string.SAVPerfProvider.event.etw_JournalCache_PostInvalidate.message)">

					</event>

					<event symbol="etw_JournalCache_PostSuccess" value="62" version="0" channel="etw_CacheChannel" level="win:Informational" task="Cache" opcode="win:Info" message="$(string.SAVPerfProvider.event.etw_JournalCache_PostSuccess.message)">

					</event>

					<event symbol="etw_JournalTracker_SignalShutdown" value="100" version="0" channel="etw_JournalTrackerChannel" level="win:Informational" task="CacheManagement" opcode="win:Info" template="_template_savperf_default" message="$(string.SAVPerfProvider.event.etw_JournalTracker_SignalShutdown.message)">

					</event>

					<event symbol="etw_Journal_Shutdown" value="101" version="0" channel="etw_CacheChannel" level="win:Informational" task="CacheManagement" opcode="win:Stop" template="_template_savperf_default" message="$(string.SAVPerfProvider.event.etw_Journal_Shutdown.message)">

					</event>

					<event symbol="etw_Journal_BeginFlushRecords" value="102" version="0" channel="etw_CacheChannel" level="win:Informational" task="CacheManagement" opcode="win:Start" template="_template_savperf_default" message="$(string.SAVPerfProvider.event.etw_Journal_BeginFlushRecords.message)">

					</event>

					<event symbol="etw_Journal_FlushError" value="103" version="0" channel="etw_CacheChannel" level="win:Error" task="CacheManagement" opcode="Error" template="_template_savperf_default" message="$(string.SAVPerfProvider.event.etw_Journal_FlushError.message)">

					</event>

					<event symbol="etw_Journal_EndFlushRecords" value="104" version="0" channel="etw_CacheChannel" level="win:Informational" task="CacheManagement" opcode="win:Stop" template="_template_savperf_default" message="$(string.SAVPerfProvider.event.etw_Journal_EndFlushRecords.message)">

					</event>

					<event symbol="etw_Journal_BeginSyncCache" value="105" version="0" channel="etw_CacheChannel" level="win:Informational" task="CacheManagement" opcode="win:Start" template="_template_savperf_default" message="$(string.SAVPerfProvider.event.etw_Journal_BeginSyncCache.message)">

					</event>

					<event symbol="etw_Journal_EndSyncCache" value="106" version="0" channel="etw_CacheChannel" level="win:Informational" task="CacheManagement" opcode="win:Stop" template="_template_savperf_default" message="$(string.SAVPerfProvider.event.etw_Journal_EndSyncCache.message)">

					</event>

					<event symbol="etw_JournalTracker_Invalidate" value="107" version="0" channel="etw_CacheChannel" level="win:Informational" task="CacheManagement" opcode="Invalidate" template="_templaet_savperf_jt_invalidate" message="$(string.SAVPerfProvider.event.etw_JournalTracker_Invalidate.message)">

					</event>

					<event symbol="etw_Journal_TrackerThreadStart" value="108" version="0" channel="etw_CacheChannel" level="win:Informational" task="CacheManagement" opcode="win:Start" template="_template_savperf_jt_threadstart" message="$(string.SAVPerfProvider.event.etw_Journal_TrackerThreadStart.message)">

					</event>

					<event symbol="etw_Journal_PurgeCacheKeyO" value="109" version="0" channel="etw_CacheChannel" level="win:Informational" task="CacheManagement" opcode="win:Info" template="_template_savperf_jt_purgecache1">

					</event>

					<event symbol="etw_Journal_PurgeCacheKey" value="109" version="1" channel="etw_CacheChannel" level="win:Informational" task="CacheManagement" opcode="win:Info" template="_template_savperf_jt_purgecache2" message="$(string.SAVPerfProvider.event.etw_Journal_PurgeCacheKey.message)">

					</event>

					<event symbol="etw_Journal_IODoneO" value="110" version="0" channel="etw_CacheChannel" level="win:Informational" task="ProcessJournal" opcode="win:Stop" template="_template_savperf_jt_iodone1">

					</event>

					<event symbol="etw_Journal_IODone" value="110" version="1" channel="etw_CacheChannel" level="win:Informational" task="ProcessJournal" opcode="win:Stop" template="_template_savperf_jt_iodone2" message="$(string.SAVPerfProvider.event.etw_Journal_IODone.message)">

					</event>

					<event symbol="etw_Journal_TrackerThreadExitO" value="111" version="0" channel="etw_JournalTrackerChannel" level="win:Informational" task="CacheManagement" opcode="win:Stop" template="_template_savperf_rawmicroseconds1">

					</event>

					<event symbol="etw_Journal_TrackerThreadExit" value="111" version="1" channel="etw_JournalTrackerChannel" level="win:Informational" task="CacheManagement" opcode="win:Stop" template="_template_savperf_rawmicroseconds2" message="$(string.SAVPerfProvider.event.etw_Journal_TrackerThreadExit.message)">

					</event>

					<event symbol="etw_JournalTracker_FaileToOpenVolume" value="112" version="0" channel="etw_JournalTrackerChannel" level="win:Error" task="CacheManagement" opcode="win:Info" template="_template_savperf_default" message="$(string.SAVPerfProvider.event.etw_JournalTracker_FaileToOpenVolume.message)">

					</event>

					<event symbol="etw_JournalTracker_UsingCache" value="113" version="0" channel="etw_JournalTrackerChannel" level="win:Informational" task="CacheManagement" opcode="win:Info" template="_template_savperf_default" message="$(string.SAVPerfProvider.event.etw_JournalTracker_UsingCache.message)">

					</event>

					<event symbol="etw_JournalTracker_UsingGoldenCache" value="114" version="0" channel="etw_JournalTrackerChannel" level="win:Informational" task="CacheManagement" opcode="win:Info" template="_template_savperf_jt_goldencache" message="$(string.SAVPerfProvider.event.etw_JournalTracker_UsingGoldenCache.message)">

					</event>

					<event symbol="etw_JournalTracker_ReplacingCache" value="115" version="0" channel="etw_JournalTrackerChannel" level="win:Informational" task="CacheManagement" opcode="win:Info" template="_template_savperf_default" message="$(string.SAVPerfProvider.event.etw_JournalTracker_ReplacingCache.message)">

					</event>

					<event symbol="etw_JournalTracker_CacheUnavailable" value="116" version="0" channel="etw_JournalTrackerChannel" level="win:Warning" task="CacheManagement" opcode="win:Info" template="_template_savperf_default" message="$(string.SAVPerfProvider.event.etw_JournalTracker_CacheUnavailable.message)">

					</event>

					<event symbol="etw_JournalTracker_GoldenCacheUnused" value="117" version="0" channel="etw_JournalTrackerChannel" level="win:Informational" task="CacheManagement" opcode="win:Info" template="_template_savperf_jt_goldencache" message="$(string.SAVPerfProvider.event.etw_JournalTracker_GoldenCacheUnused.message)">

					</event>

					<event symbol="etw_Journal_Halted" value="118" version="0" channel="etw_CacheChannel" level="win:Warning" task="CacheManagement" opcode="win:Info" template="_template_savperf_default" message="$(string.SAVPerfProvider.event.etw_Journal_Halted.message)">

					</event>

					<event symbol="etw_JournalTracker_UnsupportedFilesystem" value="119" version="0" channel="etw_JournalTrackerChannel" level="win:Warning" task="CacheManagement" opcode="win:Info" template="_template_savperf_unsupportedfilesystemtype" message="$(string.SAVPerfProvider.event.etw_JournalTracker_UnsupportedFilesystem.message)">

					</event>

					<event symbol="etw_JournalTracker_ReadOnlyVolume" value="120" version="0" channel="etw_JournalTrackerChannel" level="win:Informational" task="CacheManagement" opcode="win:Info" template="_template_savperf_default" message="$(string.SAVPerfProvider.event.etw_JournalTracker_ReadOnlyVolume.message)">

					</event>

					<event symbol="etw_JournalTracker_UnsupportedJournalVersion" value="121" version="0" channel="etw_JournalTrackerChannel" level="win:Warning" task="CacheManagement" opcode="win:Info" template="_template_savperf_jc_unsupportedjournalversion" message="$(string.SAVPerfProvider.event.etw_JournalTracker_UnsupportedJournalVersion.message)">

					</event>

					<event symbol="etw_JournalTracker_DebugError" value="122" version="0" channel="etw_JournalTrackerChannel" level="win:Error" task="CacheManagement" opcode="Log" template="_template_savperf_default" message="$(string.SAVPerfProvider.event.etw_JournalTracker_DebugError.message)">

					</event>

					<event symbol="etw_JournalTracker_DebugInfo" value="123" version="0" channel="etw_JournalTrackerChannel" level="win:Informational" task="CacheManagement" opcode="Log" template="_template_savperf_default" message="$(string.SAVPerfProvider.event.etw_JournalTracker_DebugInfo.message)">

					</event>

					<event symbol="etw_JournalTracker_DebugTrace" value="124" version="0" channel="etw_JournalTrackerChannel" level="win:Verbose" task="CacheManagement" opcode="Log" template="_template_savperf_default" message="$(string.SAVPerfProvider.event.etw_JournalTracker_DebugTrace.message)">

					</event>

					<event symbol="etw_JournalInfo_Start" value="125" version="0" channel="etw_CacheChannel" task="CacheManagement" opcode="win:Start" template="_template_savperf_jinfostart" message="$(string.SAVPerfProvider.event.etw_JournalInfo_Start.message)">

					</event>

					<event symbol="etw_Journal_QueryJournalInfo" value="126" version="0" channel="etw_CacheChannel" task="CacheManagement" opcode="win:Info" message="$(string.SAVPerfProvider.event.etw_Journal_QueryJournalInfo.message)">

					</event>

					<event symbol="etw_JournalTracker_NoPrerequisites" value="127" version="0" channel="etw_JournalTrackerChannel" level="win:Informational" task="CacheManagement" opcode="win:Info" template="_template_savperf_default" message="$(string.SAVPerfProvider.event.etw_JournalTracker_NoPrerequisites.message)">

					</event>

					<event symbol="etw_JournalTracker_InvalidHandles" value="128" version="0" channel="etw_JournalTrackerChannel" level="win:Warning" task="CacheManagement" opcode="win:Info" message="$(string.SAVPerfProvider.event.etw_JournalTracker_InvalidHandles.message)">

					</event>

					<event symbol="etw_Journal_ProcessJournalInfo" value="130" version="0" channel="etw_CacheChannel" level="win:Informational" task="ProcessJournal" opcode="win:Start" message="$(string.SAVPerfProvider.event.etw_Journal_ProcessJournalInfo.message)">

					</event>

					<event symbol="etw_Journal_UnsupportedJournalVersion" value="131" version="0" channel="etw_CacheChannel" level="win:Warning" task="CacheManagement" opcode="win:Info" message="$(string.SAVPerfProvider.event.etw_Journal_UnsupportedJournalVersion.message)">

					</event>

					<event symbol="etw_JournalTracker_ReadUSNJournalFailed" value="129" version="0" channel="etw_JournalTrackerChannel" level="win:Warning" task="CacheManagement" opcode="win:Info" template="_template_savperf_jc_readunjournalfailed" message="$(string.SAVPerfProvider.event.etw_JournalTracker_ReadUSNJournalFailed.message)">

					</event>

					<event symbol="etw_HIPS_SubmitI" value="200" version="0" channel="etw_BehaviourInterceptChannel" level="win:Informational" task="HIPSIntercept" opcode="win:Info" template="_template_savperf_HIPS_intercept" keywords="Process" message="$(string.SAVPerfProvider.event.etw_HIPS_SubmitI.message)">

					</event>

					<event symbol="etw_HIPS_Submit" value="201" version="0" channel="etw_BehaviourInterceptChannel" level="win:Informational" task="HIPSIntercept" opcode="win:Info" template="_template_savperf_HIPS_intercept" keywords="Process" message="$(string.SAVPerfProvider.event.etw_HIPS_Submit.message)">

					</event>

					<event symbol="etw_BHO_Scan" value="220" version="0" channel="etw_WebConnectChannel" level="win:Informational" task="WebIntercept" opcode="win:Info" template="_template_savperf_BHO_Scan" keywords="Process" message="$(string.SAVPerfProvider.event.etw_BHO_Scan.message)">

					</event>

					<event symbol="etw_ReputationScan" value="221" version="0" channel="etw_WebConnectChannel" level="win:Informational" task="WebIntercept" opcode="win:Info" template="_template_savperf_ReputationScan" keywords="File Process" message="$(string.SAVPerfProvider.event.etw_ReputationScan.message)">

					</event>

					<event symbol="etw_LUA_create_engine" value="300" version="0" channel="etw_ScanChannel" level="win:Informational" task="HIPSEvaluation" opcode="win:Info" template="_template_savperf_rawmicroseconds2" message="$(string.SAVPerfProvider.event.etw_LUA_create_engine.message)">

					</event>

					<event symbol="etw_LUA_destroy_engine" value="301" version="0" channel="etw_ScanChannel" level="win:Informational" task="HIPSEvaluation" opcode="win:Info" message="$(string.SAVPerfProvider.event.etw_LUA_destroy_engine.message)">

					</event>

					<event symbol="etw_LUA_checkProfileing" value="302" version="0" channel="etw_ScanChannel" level="win:Verbose" task="HIPSEvaluation" opcode="win:Info" template="_template_savperf_microseconds_bool" message="$(string.SAVPerfProvider.event.etw_LUA_checkProfileing.message)">

					</event>

					<event symbol="etw_LUA_doString" value="303" version="0" channel="etw_ScanChannel" level="win:Verbose" task="HIPSEvaluation" opcode="win:Info" template="_template_savperf_rawmicroseconds2" message="$(string.SAVPerfProvider.event.etw_LUA_doString.message)">

					</event>

					<event symbol="etw_LUA_assignGlobalConstants" value="304" version="0" channel="etw_ScanChannel" level="win:Verbose" task="HIPSEvaluation" opcode="win:Info" template="_template_savperf_rawmicroseconds2" message="$(string.SAVPerfProvider.event.etw_LUA_assignGlobalConstants.message)">

					</event>

					<event symbol="etw_LUA_exception" value="305" version="0" channel="etw_ScanChannel" level="win:Error" task="HIPSEvaluation" opcode="Log" template="_template_savperf_narrowStr" message="$(string.SAVPerfProvider.event.etw_LUA_exception.message)">

					</event>

					<event symbol="etw_LUA_wrapperException" value="307" version="0" channel="etw_ScanChannel" level="win:Error" task="HIPSEvaluation" opcode="Log" template="_template_savperf_narrowStr" message="$(string.SAVPerfProvider.event.etw_LUA_wrapperException.message)">

					</event>

					<event symbol="etw_LUA_logTrace" value="309" version="0" channel="etw_ScanChannel" level="win:Informational" task="HIPSEvaluation" opcode="Log" template="_template_savperf_microseconds_str" message="$(string.SAVPerfProvider.event.etw_LUA_logTrace.message)">

					</event>

					<event symbol="etw_LUA_queryProcessCacheHit" value="310" version="0" channel="etw_ScanChannel" level="win:Informational" task="HIPSEvaluation" opcode="Hit" template="_template_savperf_microseconds_pid_path" keywords="Process" message="$(string.SAVPerfProvider.event.etw_LUA_queryProcessCacheHit.message)">

					</event>

					<event symbol="etw_LUA_queryProcessCacheMissFound" value="311" version="0" channel="etw_ScanChannel" level="win:Informational" task="HIPSEvaluation" opcode="Miss" template="_template_savperf_microseconds_pid_path" keywords="Process" message="$(string.SAVPerfProvider.event.etw_LUA_queryProcessCacheMissFound.message)">

					</event>

					<event symbol="etw_LUA_queryProcessCacheMissEmpty" value="313" version="0" channel="etw_ScanChannel" level="win:Informational" task="HIPSEvaluation" opcode="Miss" template="_templaet_savperf_microseconds_pid" keywords="Process" message="$(string.SAVPerfProvider.event.etw_LUA_queryProcessCacheMissEmpty.message)">

					</event>

					<event symbol="etw_LUA_queryProcessCacheNotFound" value="312" version="0" channel="etw_ScanChannel" level="win:Informational" task="HIPSEvaluation" opcode="Miss" template="_templaet_savperf_microseconds_pid" keywords="Process" message="$(string.SAVPerfProvider.event.etw_LUA_queryProcessCacheNotFound.message)">

					</event>

					<event symbol="etw_LUA_reportBehaviour" value="314" version="0" channel="etw_ScanChannel" level="win:Informational" task="HIPSEvaluation" opcode="win:Info" template="_template_savperf_rawmicroseconds2" message="$(string.SAVPerfProvider.event.etw_LUA_reportBehaviour.message)">

					</event>

					<event symbol="etw_LUA_Phenotype" value="315" version="0" channel="etw_ScanChannel" level="win:Informational" task="HIPSEvaluation" opcode="win:Info" template="_template_savperf_rawmicroseconds2" message="$(string.SAVPerfProvider.event.etw_LUA_Phenotype.message)">

					</event>

					<event symbol="etw_LUA_reportPhenotypeURI" value="316" version="0" channel="etw_ScanChannel" level="win:Informational" task="HIPSEvaluation" opcode="win:Info" template="_template_savperf_rawmicroseconds2" message="$(string.SAVPerfProvider.event.etw_LUA_reportPhenotypeURI.message)">

					</event>

					<event symbol="etw_LUA_processPath" value="317" version="0" channel="etw_ScanChannel" level="win:Informational" task="HIPSEvaluation" opcode="Lookup" template="_template_savperf_rawmicroseconds2" keywords="Path" message="$(string.SAVPerfProvider.event.etw_LUA_processPath.message)">

					</event>

					<event symbol="etw_LUA_checksum" value="318" version="0" channel="etw_ScanChannel" level="win:Informational" task="HIPSEvaluation" opcode="Compute" template="_template_savperf_rawmicroseconds2" keywords="Checksum" message="$(string.SAVPerfProvider.event.etw_LUA_checksum.message)">

					</event>

					<event symbol="etw_LUA_comparePaths" value="319" version="0" channel="etw_ScanChannel" level="win:Informational" task="HIPSEvaluation" opcode="Compute" template="_template_savperf_microseconds_bool_str_str" keywords="Path" message="$(string.SAVPerfProvider.event.etw_LUA_comparePaths.message)">

					</event>

					<event symbol="etw_LUA_loadFile" value="320" version="0" channel="etw_ScanChannel" level="win:Informational" task="HIPSEvaluation" opcode="Load" template="_template_savperf_loadFile" keywords="File" message="$(string.SAVPerfProvider.event.etw_LUA_loadFile.message)">

					</event>

					<event symbol="etw_LUA_regQuery" value="322" version="0" channel="etw_ScanChannel" level="win:Informational" task="HIPSEvaluation" opcode="Load" template="_template_savperf_microseconds_path_keyname" keywords="Registry" message="$(string.SAVPerfProvider.event.etw_LUA_regQuery.message)">

					</event>

					<event symbol="etw_LUA_shGetFolderPath" value="321" version="0" channel="etw_ScanChannel" level="win:Informational" task="HIPSEvaluation" opcode="Lookup" template="_template_savperf_microseconds_str" keywords="Path" message="$(string.SAVPerfProvider.event.etw_LUA_shGetFolderPath.message)">

					</event>

					<event symbol="etw_LUA_getSID" value="323" version="0" channel="etw_ScanChannel" level="win:Verbose" task="HIPSEvaluation" opcode="Lookup" template="_template_savperf_rawmicroseconds2" message="$(string.SAVPerfProvider.event.etw_LUA_getSID.message)">

					</event>

					<event symbol="etw_LUA_windowsToObjectPath" value="324" version="0" channel="etw_ScanChannel" level="win:Informational" task="HIPSEvaluation" opcode="Lookup" template="_template_savperf_rawmicroseconds2" keywords="Path" message="$(string.SAVPerfProvider.event.etw_LUA_windowsToObjectPath.message)">

					</event>

					<event symbol="etw_LUA_objectToWindowsPath" value="325" version="0" channel="etw_ScanChannel" level="win:Informational" task="HIPSEvaluation" opcode="Lookup" template="_template_savperf_rawmicroseconds2" keywords="Path" message="$(string.SAVPerfProvider.event.etw_LUA_objectToWindowsPath.message)">

					</event>

					<event symbol="etw_LUA_shortToLongPath" value="327" version="0" channel="etw_ScanChannel" level="win:Informational" task="HIPSEvaluation" opcode="Lookup" template="_template_savperf_rawmicroseconds2" keywords="Path" message="$(string.SAVPerfProvider.event.etw_LUA_shortToLongPath.message)">

					</event>

					<event symbol="etw_LUA_longToShortPath" value="328" version="0" channel="etw_ScanChannel" level="win:Informational" task="HIPSEvaluation" opcode="Lookup" template="_template_savperf_rawmicroseconds2" keywords="Path" message="$(string.SAVPerfProvider.event.etw_LUA_longToShortPath.message)">

					</event>

					<event symbol="etw_LUA_debug" value="329" version="0" channel="etw_ScanChannel" level="win:Warning" task="HIPSEvaluation" opcode="Log" template="_template_savperf_rawmicroseconds2" message="$(string.SAVPerfProvider.event.etw_LUA_debug.message)">

					</event>

					<event symbol="etw_LUA_debugw" value="330" version="0" channel="etw_ScanChannel" level="win:Warning" task="HIPSEvaluation" opcode="Log" template="_template_savperf_microseconds_str" message="$(string.SAVPerfProvider.event.etw_LUA_debugw.message)">

					</event>

					<event symbol="etw_LUA_getDefaultToken" value="334" version="0" channel="etw_WebConnectChannel" level="win:Verbose" task="HIPSEvaluation" opcode="Lookup" template="_template_savperf_rawmicroseconds2" message="$(string.SAVPerfProvider.event.etw_LUA_getDefaultToken.message)">

					</event>

					<event symbol="etw_LUA_setDefaultToken" value="335" version="0" channel="etw_ScanChannel" level="win:Verbose" task="HIPSEvaluation" opcode="Lookup" template="_template_savperf_rawmicroseconds2" message="$(string.SAVPerfProvider.event.etw_LUA_setDefaultToken.message)">

					</event>

					<event symbol="etw_LUA_fileExists" value="336" version="0" channel="etw_WebConnectChannel" level="win:Informational" task="HIPSEvaluation" opcode="Lookup" template="_template_savperf_microseconds_str" keywords="File" message="$(string.SAVPerfProvider.event.etw_LUA_fileExists.message)">

					</event>

					<event symbol="etw_LUA_driveType" value="337" version="0" channel="etw_WebConnectChannel" level="win:Verbose" task="HIPSEvaluation" opcode="Lookup" template="_template_savperf_rawmicroseconds2" keywords="Path" message="$(string.SAVPerfProvider.event.etw_LUA_driveType.message)">

					</event>

					<event symbol="etw_LUA_saviScan" value="338" version="0" channel="etw_ScanChannel" level="win:Warning" task="HIPSEvaluation" opcode="Compute" template="_template_savperf_microseconds_path_genes_genes" keywords="File" message="$(string.SAVPerfProvider.event.etw_LUA_saviScan.message)">

					</event>

					<event symbol="etw_LUA_hasGene" value="346" version="0" channel="etw_ScanChannel" level="win:Verbose" task="HIPSEvaluation" opcode="Lookup" template="_template_savperf_microseconds_str" message="$(string.SAVPerfProvider.event.etw_LUA_hasGene.message)">

					</event>

					<event symbol="etw_LUA_setGene" value="339" version="0" channel="etw_ScanChannel" level="win:Informational" task="HIPSEvaluation" opcode="win:Info" template="_template_savperf_microseconds_str" message="$(string.SAVPerfProvider.event.etw_LUA_setGene.message)">

					</event>

					<event symbol="etw_LUA_setAction" value="340" version="0" channel="etw_ScanChannel" level="win:Verbose" task="HIPSEvaluation" opcode="win:Info" template="_template_savperf_rawmicroseconds2" message="$(string.SAVPerfProvider.event.etw_LUA_setAction.message)">

					</event>

					<event symbol="etw_LUA_diffTime" value="341" version="0" channel="etw_ScanChannel" level="win:Verbose" task="HIPSEvaluation" opcode="win:Info" template="_template_savperf_rawmicroseconds2" message="$(string.SAVPerfProvider.event.etw_LUA_diffTime.message)">

					</event>

					<event symbol="etw_LUA_checkPoint" value="342" version="0" channel="etw_ScanChannel" level="win:Verbose" task="HIPSEvaluation" opcode="Log" template="_template_savperf_rawmicroseconds2" message="$(string.SAVPerfProvider.event.etw_LUA_checkPoint.message)">

					</event>

					<event symbol="etw_LUA_startProcessing" value="348" version="0" channel="etw_ScanChannel" level="win:Informational" task="HIPSEvaluation" opcode="win:Start" message="$(string.SAVPerfProvider.event.etw_LUA_startProcessing.message)">

					</event>

					<event symbol="etw_LUA_stopProcessing" value="349" version="0" channel="etw_ScanChannel" level="win:Informational" task="HIPSEvaluation" opcode="win:Stop" message="$(string.SAVPerfProvider.event.etw_LUA_stopProcessing.message)">

					</event>

					<event symbol="etw_Intercept_start" value="20" version="0" channel="etw_OnAccessChannel" level="win:Verbose" task="Intercept" opcode="win:Start" message="$(string.SAVPerfProvider.event.etw_Intercept_start.message)">

					</event>

					<event symbol="etw_Intercept_stop" value="21" version="0" channel="etw_OnAccessChannel" level="win:Verbose" task="Intercept" opcode="win:Stop" template="_template_savperf_rawmicroseconds2" message="$(string.SAVPerfProvider.event.etw_Intercept_stop.message)">

					</event>

					<event symbol="etw_OnDemandScan_start" value="500" version="0" channel="etw_ScanChannel" level="win:Informational" task="OnDemand" opcode="win:Start" message="$(string.SAVPerfProvider.event.etw_OnDemandScan_start.message)">

					</event>

					<event symbol="etw_OnDemandScan_stop" value="501" version="0" channel="etw_ScanChannel" level="win:Informational" task="OnDemand" opcode="win:Stop" template="_template_savperf_rawmicroseconds2" message="$(string.SAVPerfProvider.event.etw_OnDemandScan_stop.message)">

					</event>

					<event symbol="etw_UpdateData_start" value="510" version="0" channel="etw_ScanChannel" level="win:Informational" task="UpdateData" opcode="win:Start" keywords="Update" message="$(string.SAVPerfProvider.event.etw_UpdateData_start.message)">

					</event>

					<event symbol="etw_UpdateData_stop" value="511" version="0" channel="etw_ScanChannel" level="win:Informational" task="UpdateData" opcode="win:Stop" template="_template_savperf_rawmicroseconds2" keywords="Update" message="$(string.SAVPerfProvider.event.etw_UpdateData_stop.message)">

					</event>

					<event symbol="etw_ICChecksum_start" value="550" version="0" channel="etw_CacheChannel" level="win:Verbose" task="ICChecksum" opcode="win:Start" keywords="File" message="$(string.SAVPerfProvider.event.etw_ICChecksum_start.message)">

					</event>

					<event symbol="etw_ICChecksum_stop" value="551" version="0" channel="etw_CacheChannel" level="win:Verbose" task="ICChecksum" opcode="win:Stop" template="_template_savperf_rawmicroseconds2" message="$(string.SAVPerfProvider.event.etw_ICChecksum_stop.message)">

					</event>

					<event symbol="etw_Safestore_Load" value="600" version="0" channel="etw_ScanChannel" level="win:Informational" task="Safestore" opcode="win:Start" keywords="Cleanup" message="$(string.SAVPerfProvider.event.etw_Safestore_Load.message)">

					</event>

					<event symbol="etw_Safestore_Unload" value="601" version="0" channel="etw_OnAccessChannel" level="win:Warning" task="Safestore" opcode="win:Stop" keywords="Cleanup" message="$(string.SAVPerfProvider.event.etw_Safestore_Unload.message)">

					</event>

					<event symbol="etw_Safestore_Initialised" value="602" version="0" channel="etw_OnAccessChannel" level="win:Warning" task="Safestore" opcode="win:Info" keywords="Cleanup" message="$(string.SAVPerfProvider.event.etw_Safestore_Initialised.message)">

					</event>

					<event symbol="etw_ThreatLifetime_Discovered" value="650" version="0" channel="_etw_Comms" level="win:Informational" task="Sweep" opcode="TheatDiscovered" template="_template_savperf_ThreatMetadata" keywords="ThreatLifetime" message="$(string.SAVPerfProvider.event.etw_ThreatLifetime_Discovered.message)">

					</event>

					<event symbol="etw_ThreatLifetime_Resolved" value="651" version="0" channel="_etw_Comms" level="win:Informational" task="Sweep" opcode="ThreatResolved" template="_template_savperf_ThreatMetadata" keywords="Cleanup ThreatLifetime" message="$(string.SAVPerfProvider.event.etw_ThreatLifetime_Resolved.message)">

					</event>

					<event symbol="etw_ThreatLifetime_Notify_Event" value="670" version="0" channel="_etw_Comms" level="win:Informational" task="Sweep" template="_template_savperf_oncreateordeletekey1" keywords="ThreatLifetime" message="$(string.SAVPerfProvider.event.etw_ThreatLifetime_Notify_Event.message)">

					</event>

					<event symbol="etw_SSP_Beacon" value="680" version="0" channel="_etw_Comms" level="win:Informational" task="Beacon" opcode="SendBeacon" template="_template_savperf_default" message="$(string.SAVPerfProvider.event.etw_SSP_Beacon.message)">

					</event>

					<event symbol="etw_OnAccess_retry_deferred_scan" value="3" version="0" channel="etw_OnAccessChannel" level="win:Verbose" task="DeferredScan" opcode="win:Info" template="_template_savperf_oa_retry_deferred" keywords="File" message="$(string.SAVPerfProvider.event.etw_OnAccess_retry_deferred_scan.message)">

					</event>

					<event symbol="etw_OnAccess_add_deferred_item" value="4" version="0" channel="etw_OnAccessChannel" level="win:Verbose" task="DeferredScan" opcode="win:Info" template="_template_savperf_oa_add_deferred" keywords="File" message="$(string.SAVPerfProvider.event.etw_OnAccess_add_deferred_item.message)">

					</event>

					<event symbol="etw_OnAccess_deferred_queue_full" value="5" version="0" channel="etw_OnAccessChannel" level="win:Informational" task="DeferredScan" opcode="win:Info" template="_template_savperf_deferred_queue_full" keywords="File" message="$(string.SAVPerfProvider.event.etw_OnAccess_deferred_queue_full.message)">

					</event>

					<event symbol="etw_OnAccess_deferred_check_time" value="6" version="0" channel="etw_OnAccessChannel" level="win:Verbose" task="DeferredScan" opcode="win:Info" template="_template_savperf_oa_checktime2" keywords="File" message="$(string.SAVPerfProvider.event.etw_OnAccess_deferred_check_time.message)">

					</event>

					<event symbol="etw_OnAccess_oplock_timeout" value="7" version="0" channel="etw_OnAccessChannel" level="win:Informational" task="DeferredScan" opcode="win:Info" template="_template_savperf_oa_oplock_timeout" keywords="File" message="$(string.SAVPerfProvider.event.etw_OnAccess_oplock_timeout.message)">

					</event>

					<event symbol="etw_OnAccess_remove_deferred_item" value="8" version="0" channel="etw_OnAccessChannel" level="win:Verbose" task="DeferredScan" opcode="win:Info" template="_template_savperf_oa_remove_deferred" keywords="File" message="$(string.SAVPerfProvider.event.etw_OnAccess_remove_deferred_item.message)">

					</event>

					<event symbol="etw_OnAccess_max_deferred_retries" value="9" version="0" channel="etw_OnAccessChannel" level="win:Verbose" task="DeferredScan" opcode="win:Info" template="_template_savperf_on_max_deferred_retries" keywords="File" message="$(string.SAVPerfProvider.event.etw_OnAccess_max_deferred_retries.message)">

					</event>

					<event symbol="etw_ProcessFilter_Setup" value="70" version="0" channel="_etw_ProcessFilter" level="win:Informational" task="ProcessFilter" opcode="win:Info" template="_template_savperf_processfilter_setup" keywords="Path Process" message="$(string.SAVPerfProvider.event.etw_ProcessFilter_Setup.message)">

					</event>

					<event symbol="etw_ProcessFilter_State" value="71" version="0" channel="_etw_ProcessFilter" level="win:Informational" task="ProcessFilter" opcode="win:Info" template="_template_savperf_processfilter_change_state" message="$(string.SAVPerfProvider.event.etw_ProcessFilter_State.message)">

					</event>

					<event symbol="etw_ProcessFilter_Classification" value="72" version="0" channel="_etw_ProcessFilter" level="win:Verbose" task="ProcessFilter" opcode="win:Info" template="_template_savperf_processfilter_classification" keywords="Path Process" message="$(string.SAVPerfProvider.event.etw_ProcessFilter_Classification.message)">

					</event>

				</events>

				<channels>

					<channel name="Sophos-AntiVirus-Perf/OnAccess" chid="etw_OnAccessChannel" symbol="etw_OnAccessChannel" type="Debug" enabled="false" isolation="System" message="$(string.SAVPerfProvider.channel.etw_OnAccessChannel.message)">

					</channel>

					<channel name="Sophos-AntiVirus-Perf/Scan" chid="etw_ScanChannel" symbol="etw_ScanChannel" type="Analytic" enabled="false" isolation="System" message="$(string.SAVPerfProvider.channel.etw_ScanChannel.message)">

					</channel>

					<channel name="Sophos-AntiVirus-Perf/Web" chid="etw_WebConnectChannel" symbol="etw_WebConnectChannel" type="Debug" enabled="false" isolation="System" message="$(string.SAVPerfProvider.channel.etw_WebConnectChannel.message)">

					</channel>

					<channel name="Sophos-AntiVirus-Perf/BehaviourIntercept" chid="etw_BehaviourInterceptChannel" symbol="etw_BehaviourInterceptChannel" type="Debug" enabled="false" isolation="System" message="$(string.SAVPerfProvider.channel.etw_BehaviourInterceptChannel.message)">

					</channel>

					<channel name="Sophos-AntiVirus-Perf/Cache" chid="etw_CacheChannel" symbol="etw_CacheChannel" type="Debug" enabled="false" message="$(string.SAVPerfProvider.channel.etw_CacheChannel.message)">

					</channel>

					<channel name="Sophos-AntiVirus-Perf/JournalTracker" chid="etw_JournalTrackerChannel" symbol="etw_JournalTrackerChannel" type="Debug" enabled="false" message="$(string.SAVPerfProvider.channel.etw_JournalTrackerChannel.message)">

					</channel>

					<channel name="Sophos_AntiVirus-Perf/Comms" chid="_etw_Comms" symbol="_etw_Comms" type="Operational" enabled="false" message="$(string.SAVPerfProvider.channel._etw_Comms.message)">

					</channel>

					<channel name="Sophos-AntiVirus-Perf/ProcessFilter" chid="_etw_ProcessFilter" symbol="_etw_ProcessFilter" type="Debug" enabled="false" message="$(string.SAVPerfProvider.channel._etw_ProcessFilter.message)">

					</channel>

				</channels>

				<tasks>

					<task name="Intercept" symbol="etw_task_intercept" value="1" message="$(string.SAVPerfProvider.task.etw_task_intercept.message)">

					</task>

					<task name="Cache" symbol="_etw_task_cache" value="2" message="$(string.SAVPerfProvider.task._etw_task_cache.message)">

					</task>

					<task name="Sweep" symbol="_etw_task_scan" value="4" message="$(string.SAVPerfProvider.task._etw_task_scan.message)">

					</task>

					<task name="CacheManagement" symbol="_etw_task_CacheManagement" value="5" message="$(string.SAVPerfProvider.task._etw_task_CacheManagement.message)">

					</task>

					<task name="HIPSEvaluation" symbol="_etw_task_HIPS_Eval" value="7" message="$(string.SAVPerfProvider.task._etw_task_HIPS_Eval.message)">

					</task>

					<task name="OnDemand" symbol="_tmpl_etw_OnDemand" value="8" message="$(string.SAVPerfProvider.task._tmpl_etw_OnDemand.message)">

					</task>

					<task name="UpdateData" symbol="_etw_UpdateData" value="9" message="$(string.SAVPerfProvider.task._etw_UpdateData.message)">

					</task>

					<task name="OnAccessIntercept" symbol="_etw_OnAccessIntercept" value="10" message="$(string.SAVPerfProvider.task._etw_OnAccessIntercept.message)">

					</task>

					<task name="OnSetRegKeyValueIntercep" symbol="_etw_OnSetRegKeyValueIntercep" value="11" message="$(string.SAVPerfProvider.task._etw_OnSetRegKeyValueIntercep.message)">

					</task>

					<task name="OnCreateOrDeleteRegKeyIntercept" symbol="_etw_OnCreateOrDeleteRegKeyIntercept" value="12" message="$(string.SAVPerfProvider.task._etw_OnCreateOrDeleteRegKeyIntercept.message)">

					</task>

					<task name="OnCreateOrDeleteProcessIntercept" symbol="_etw_OnCreateOrDeleteProcessIntercept" value="13" message="$(string.SAVPerfProvider.task._etw_OnCreateOrDeleteProcessIntercept.message)">

					</task>

					<task name="OnCreateRemoteThreadIntercept" symbol="_etw_OnCreateRemoteThreadIntercept" value="14" message="$(string.SAVPerfProvider.task._etw_OnCreateRemoteThreadIntercept.message)">

					</task>

					<task name="OnModFileIntercept" symbol="_etw_OnModFileIntercept" value="15" message="$(string.SAVPerfProvider.task._etw_OnModFileIntercept.message)">

					</task>

					<task name="OnIpConnectIntercept" symbol="_etw_OnIpConnectIntercept" value="16" message="$(string.SAVPerfProvider.task._etw_OnIpConnectIntercept.message)">

					</task>

					<task name="OnLoadDriverIntercept" symbol="_etw_OnLoadDriverIntercept" value="17" message="$(string.SAVPerfProvider.task._etw_OnLoadDriverIntercept.message)">

					</task>

					<task name="OnFileOpenForWriteIntercept" symbol="_etw_OnFileOpenForWriteIntercept" value="18" message="$(string.SAVPerfProvider.task._etw_OnFileOpenForWriteIntercept.message)">

					</task>

					<task name="OnOpenProcessHandleIntercept" symbol="_etw_OnOpenProcessHandleIntercept" value="19" message="$(string.SAVPerfProvider.task._etw_OnOpenProcessHandleIntercept.message)">

					</task>

					<task name="WebContentIntercept" symbol="_etw_WebContentIntercept" value="20" message="$(string.SAVPerfProvider.task._etw_WebContentIntercept.message)">

					</task>

					<task name="HIPSIntercept" symbol="_etw_HIPSIntercept" value="21" message="$(string.SAVPerfProvider.task._etw_HIPSIntercept.message)">

					</task>

					<task name="WebIntercept" symbol="_etw_WebIntercept" value="22" message="$(string.SAVPerfProvider.task._etw_WebIntercept.message)">

					</task>

					<task name="ICChecksum" symbol="ICChecksum" value="25" message="$(string.SAVPerfProvider.task.ICChecksum.message)">

					</task>

					<task name="ProcessJournal" symbol="_etw_ProcessJournal" value="27" message="$(string.SAVPerfProvider.task._etw_ProcessJournal.message)">

					</task>

					<task name="Safestore" symbol="_etw_Safestore" value="31" message="$(string.SAVPerfProvider.task._etw_Safestore.message)">

					</task>

					<task name="Beacon" symbol="_etw_Beacon" value="32" message="$(string.SAVPerfProvider.task._etw_Beacon.message)">

					</task>

					<task name="DeferredScan" symbol="_etw_task_deferred_scan" value="40" message="$(string.SAVPerfProvider.task._etw_task_deferred_scan.message)">

					</task>

					<task name="ProcessFilter" symbol="_etw_task_processfilter" value="41" message="$(string.SAVPerfProvider.task._etw_task_processfilter.message)">

					</task>

				</tasks>

				<opcodes>

					<opcode name="Log" symbol="_etw_op_Log" value="10" message="$(string.SAVPerfProvider.opcode._etw_op_Log.message)">

					</opcode>

					<opcode name="Lookup" symbol="_etw_op_Crack" value="11" message="$(string.SAVPerfProvider.opcode._etw_op_Crack.message)">

					</opcode>

					<opcode name="Compute" symbol="_etw_op_Compute" value="13" message="$(string.SAVPerfProvider.opcode._etw_op_Compute.message)">

					</opcode>

					<opcode name="Load" symbol="_etw_op_Load" value="14" message="$(string.SAVPerfProvider.opcode._etw_op_Load.message)">

					</opcode>

					<opcode name="Hit" symbol="_etw_HIT" value="15" message="$(string.SAVPerfProvider.opcode._etw_HIT.message)">

					</opcode>

					<opcode name="Miss" symbol="_etw_Miss" value="16" message="$(string.SAVPerfProvider.opcode._etw_Miss.message)">

					</opcode>

					<opcode name="Hips" symbol="_etw_hips" value="17" message="$(string.SAVPerfProvider.opcode._etw_hips.message)">

					</opcode>

					<opcode name="SkipHips" symbol="_etw_Skip" value="18" message="$(string.SAVPerfProvider.opcode._etw_Skip.message)">

					</opcode>

					<opcode name="Golden" symbol="_etw_Golden" value="19" message="$(string.SAVPerfProvider.opcode._etw_Golden.message)">

					</opcode>

					<opcode name="NoJournal" symbol="_etw_NoJournal" value="21" message="$(string.SAVPerfProvider.opcode._etw_NoJournal.message)">

					</opcode>

					<opcode name="Invalidate" symbol="_etw_Invalidate" value="22" message="$(string.SAVPerfProvider.opcode._etw_Invalidate.message)">

					</opcode>

					<opcode name="InvalidateMalicious" symbol="_etw_InvalidateMalicious" value="23" message="$(string.SAVPerfProvider.opcode._etw_InvalidateMalicious.message)">

					</opcode>

					<opcode name="Error" symbol="_etw_Error" value="24" message="$(string.SAVPerfProvider.opcode._etw_Error.message)">

					</opcode>

					<opcode name="SkipManualCleanup" symbol="_etw_SkipManualCleanup" value="25" message="$(string.SAVPerfProvider.opcode._etw_SkipManualCleanup.message)">

					</opcode>

					<opcode name="Ignore" symbol="_etw_Ignore" value="26" message="$(string.SAVPerfProvider.opcode._etw_Ignore.message)">

					</opcode>

					<opcode name="SkipSubfile" symbol="_etw_SkipSubfile" value="27" message="$(string.SAVPerfProvider.opcode._etw_SkipSubfile.message)">

					</opcode>

					<opcode name="TheatDiscovered" symbol="_etw_ThreatDiscovered" value="28" message="$(string.SAVPerfProvider.opcode._etw_ThreatDiscovered.message)">

					</opcode>

					<opcode name="ThreatResolved" symbol="_etw_ThreatResolved" value="29" message="$(string.SAVPerfProvider.opcode._etw_ThreatResolved.message)">

					</opcode>

					<opcode name="HealthEventSent" symbol="_etw_HealthEventSent" value="30" message="$(string.SAVPerfProvider.opcode._etw_HealthEventSent.message)">

					</opcode>

					<opcode name="SendBeacon" symbol="etw_SendBeacon" value="32" message="$(string.SAVPerfProvider.opcode.etw_SendBeacon.message)">

					</opcode>

				</opcodes>

				<keywords>

					<keyword name="File" symbol="_etw_File" mask="0x1" message="$(string.SAVPerfProvider.keyword._etw_File.message)">

					</keyword>

					<keyword name="Registry" symbol="_etw_Registry" mask="0x2" message="$(string.SAVPerfProvider.keyword._etw_Registry.message)">

					</keyword>

					<keyword name="Path" symbol="_etw_path" mask="0x4" message="$(string.SAVPerfProvider.keyword._etw_path.message)">

					</keyword>

					<keyword name="Checksum" symbol="_etw_Checksum" mask="0x8" message="$(string.SAVPerfProvider.keyword._etw_Checksum.message)">

					</keyword>

					<keyword name="Process" symbol="_etw_Process" mask="0x10" message="$(string.SAVPerfProvider.keyword._etw_Process.message)">

					</keyword>

					<keyword name="Update" symbol="_etw_Update" mask="0x20" message="$(string.SAVPerfProvider.keyword._etw_Update.message)">

					</keyword>

					<keyword name="Cleanup" symbol="_etw_Cleanup" mask="0x80" message="$(string.SAVPerfProvider.keyword._etw_Cleanup.message)">

					</keyword>

					<keyword name="ThreatLifetime" symbol="_etw_ThreatLifetime" mask="0x100" message="$(string.SAVPerfProvider.keyword._etw_ThreatLifetime.message)">

					</keyword>

				</keywords>

				<maps>

					<valueMap name="savperf_decision">

						<map value="0" message="$(string.SAVPerfProvider.map.savperf_decision.0.message)">

						</map>

						<map value="1" message="$(string.SAVPerfProvider.map.savperf_decision.1.message)">

						</map>

						<map value="2" message="$(string.SAVPerfProvider.map.savperf_decision.2.message)">

						</map>

						<map value="3" message="$(string.SAVPerfProvider.map.savperf_decision.3.message)">

						</map>

						<map value="4" message="$(string.SAVPerfProvider.map.savperf_decision.4.message)">

						</map>

						<map value="5" message="$(string.SAVPerfProvider.map.savperf_decision.5.message)">

						</map>

						<map value="6" message="$(string.SAVPerfProvider.map.savperf_decision.6.message)">

						</map>

					</valueMap>

					<valueMap name="savperf_ThreatDetectionType">

						<map value="0" message="$(string.SAVPerfProvider.map.savperf_ThreatDetectionType.0.message)">

						</map>

						<map value="1" message="$(string.SAVPerfProvider.map.savperf_ThreatDetectionType.1.message)">

						</map>

						<map value="2" message="$(string.SAVPerfProvider.map.savperf_ThreatDetectionType.2.message)">

						</map>

						<map value="3" message="$(string.SAVPerfProvider.map.savperf_ThreatDetectionType.3.message)">

						</map>

						<map value="4" message="$(string.SAVPerfProvider.map.savperf_ThreatDetectionType.4.message)">

						</map>

					</valueMap>

					<valueMap name="savperf_filtering_reason">

						<map value="0" message="$(string.SAVPerfProvider.map.savperf_filtering_reason.0.message)">

						</map>

						<map value="1" message="$(string.SAVPerfProvider.map.savperf_filtering_reason.1.message)">

						</map>

						<map value="2" message="$(string.SAVPerfProvider.map.savperf_filtering_reason.2.message)">

						</map>

						<map value="3" message="$(string.SAVPerfProvider.map.savperf_filtering_reason.3.message)">

						</map>

					</valueMap>

					<valueMap name="savperf_per_process_event_filtering_level">

						<map value="0" message="$(string.SAVPerfProvider.map.savperf_per_process_event_filtering_level.0.message)">

						</map>

						<map value="1" message="$(string.SAVPerfProvider.map.savperf_per_process_event_filtering_level.1.message)">

						</map>

					</valueMap>

				</maps>

				<templates>

					<template tid="_template_savperf_default">

						<data name="data" inType="win:UnicodeString" outType="xs:string">

						</data>

					</template>

					<template tid="_template_savperf_oa_checktime1">

						<data name="checkfilemilliseconds" inType="win:Double" outType="xs:double">

						</data>

						<data name="milliseconds" inType="win:Double" outType="xs:double">

						</data>

						<data name="decision" inType="win:UInt32" map="savperf_decision">

						</data>

						<data name="returncode" inType="win:UInt32" outType="win:ErrorCode">

						</data>

					</template>

					<template tid="_template_savperf_onsetregkeyvalue1">

						<data name="milliseconds" inType="win:Double" outType="xs:double">

						</data>

						<data name="processName" inType="win:UnicodeString" outType="xs:string">

						</data>

						<data name="action" inType="win:UInt32" outType="win:HexInt32">

						</data>

						<data name="keyName" inType="win:UnicodeString" outType="xs:string">

						</data>

						<data name="valueName" inType="win:UnicodeString" outType="xs:string">

						</data>

						<data name="processId" inType="win:UInt32" outType="win:HexInt32">

						</data>

						<data name="threadId" inType="win:UInt32" outType="win:HexInt32">

						</data>

						<data name="timeStamp" inType="win:UInt64" outType="win:HexInt64">

						</data>

					</template>

					<template tid="_template_savperf_oncreateordeletekey1">

						<data name="milliseconds" inType="win:Double" outType="xs:double">

						</data>

						<data name="processname" inType="win:UnicodeString" outType="xs:string">

						</data>

						<data name="action" inType="win:UInt32" outType="win:HexInt32">

						</data>

						<data name="keyname" inType="win:UnicodeString" outType="xs:string">

						</data>

						<data name="createflags" inType="win:UInt8" outType="win:HexInt8">

						</data>

						<data name="processId" inType="win:UInt32" outType="win:HexInt32">

						</data>

						<data name="threadId" inType="win:UInt32" outType="win:HexInt32">

						</data>

						<data name="timeStamp" inType="win:UInt64" outType="win:HexInt64">

						</data>

					</template>

					<template tid="_template_savperf_oncreateordeleteprocess1">

						<data name="milliseconds" inType="win:Double" outType="xs:double">

						</data>

						<data name="parentprocessname" inType="win:UnicodeString" outType="xs:string">

						</data>

						<data name="action" inType="win:UInt32" outType="win:HexInt32">

						</data>

						<data name="childprocessname" inType="win:UnicodeString" outType="xs:string">

						</data>

						<data name="createflags" inType="win:UInt8" outType="win:HexInt8">

						</data>

						<data name="processId" inType="win:UInt32" outType="win:HexInt32">

						</data>

						<data name="parentProcessId" inType="win:UInt32" outType="win:HexInt32">

						</data>

						<data name="threadId" inType="win:UInt32" outType="win:HexInt32">

						</data>

						<data name="timeStamp" inType="win:UInt64" outType="win:HexInt64">

						</data>

						<data name="commandLine" inType="win:UnicodeString" outType="xs:string">

						</data>

					</template>

					<template tid="_template_savperf_onfile1">

						<data name="milliseconds" inType="win:Double" outType="xs:double">

						</data>

						<data name="processname" inType="win:UnicodeString" outType="xs:string">

						</data>

						<data name="action" inType="win:UInt32" outType="win:HexInt32">

						</data>

						<data name="filename" inType="win:UnicodeString" outType="xs:string">

						</data>

						<data name="processId" inType="win:UInt32" outType="win:HexInt32">

						</data>

						<data name="threadId" inType="win:UInt32" outType="win:HexInt32">

						</data>

						<data name="timeStamp" inType="win:UInt64" outType="win:HexInt64">

						</data>

					</template>

					<template tid="_template_savperf_createremotethread1">

						<data name="milliseconds" inType="win:Double" outType="xs:double">

						</data>

						<data name="process" inType="win:UnicodeString" outType="xs:string">

						</data>

						<data name="action" inType="win:UInt32" outType="win:HexInt32">

						</data>

						<data name="targetprocess" inType="win:UnicodeString" outType="xs:string">

						</data>

						<data name="processId" inType="win:UInt32" outType="win:HexInt32">

						</data>

						<data name="threadId" inType="win:UInt32" outType="win:HexInt32">

						</data>

						<data name="timeStamp" inType="win:UInt64" outType="win:HexInt64">

						</data>

					</template>

					<template tid="_template_savperf_onopenprocesshandle1">

						<data name="milliseconds" inType="win:Double" outType="xs:double">

						</data>

						<data name="processname" inType="win:UnicodeString" outType="xs:string">

						</data>

						<data name="action" inType="win:UInt32" outType="win:HexInt32">

						</data>

						<data name="processId" inType="win:UInt32" outType="win:HexInt32">

						</data>

						<data name="threadId" inType="win:UInt32" outType="win:HexInt32">

						</data>

						<data name="timeStamp" inType="win:UInt64" outType="win:HexInt64">

						</data>

						<data name="targetProcessId" inType="win:UInt32" outType="win:HexInt32">

						</data>

						<data name="desiredAccess" inType="win:UInt32" outType="win:HexInt32">

						</data>

						<data name="flags" inType="win:UInt32" outType="win:HexInt32">

						</data>

					</template>

					<template tid="_template_savperf_basicintercept1">

						<data name="milliseconds" inType="win:Double" outType="xs:double">

						</data>

						<data name="processname" inType="win:UnicodeString" outType="xs:string">

						</data>

						<data name="action" inType="win:UInt32" outType="win:HexInt32">

						</data>

					</template>

					<template tid="_template_savperf_wc_check">

						<data name="url" inType="win:UnicodeString" outType="xs:string">

						</data>

						<data name="lendata" inType="win:UInt32" outType="xs:unsignedInt">

						</data>

					</template>

					<template tid="_template_savperf_wc_checked1">

						<data name="milliseconds" inType="win:Double" outType="xs:double">

						</data>

					</template>

					<template tid="_template_savperf_sweepobject1">

						<data name="pass" inType="win:UInt32" outType="xs:unsignedInt">

						</data>

						<data name="sweeptime" inType="win:Double" outType="xs:double">

						</data>

					</template>

					<template tid="_template_savperf_oa_checkitem">

						<data name="filename" inType="win:UnicodeString" outType="xs:string">

						</data>

						<data name="processname" inType="win:UnicodeString" outType="xs:string">

						</data>

						<data name="scantype" inType="win:UInt32" outType="win:HexInt32">

						</data>

					</template>

					<template tid="_template_savperf_oa_checktime2">

						<data name="microseconds" inType="win:UInt64" outType="xs:unsignedLong">

						</data>

						<data name="decision" inType="win:UInt32" map="savperf_decision">

						</data>

						<data name="returncode" inType="win:UInt32" outType="win:ErrorCode">

						</data>

						<data name="filename" inType="win:UnicodeString" outType="xs:string">

						</data>

						<data name="processName" inType="win:UnicodeString" outType="xs:string">

						</data>

						<data name="scanType" inType="win:UInt32" outType="win:HexInt32">

						</data>

						<data name="processID" inType="win:UInt32" outType="win:PID">

						</data>

					</template>

					<template tid="_template_savperf_onsetregkeyvalue2">

						<data name="microseconds" inType="win:UInt64" outType="xs:unsignedLong">

						</data>

						<data name="processName" inType="win:UnicodeString" outType="xs:string">

						</data>

						<data name="action" inType="win:UInt32" outType="win:HexInt32">

						</data>

						<data name="keyName" inType="win:UnicodeString" outType="xs:string">

						</data>

						<data name="valueName" inType="win:UnicodeString" outType="xs:string">

						</data>

						<data name="processId" inType="win:UInt32" outType="win:HexInt32">

						</data>

						<data name="threadId" inType="win:UInt32" outType="win:HexInt32">

						</data>

						<data name="timeStamp" inType="win:UInt64" outType="win:HexInt64">

						</data>

					</template>

					<template tid="_template_savperf_oncreateordeletekey2">

						<data name="microseconds" inType="win:UInt64" outType="xs:unsignedLong">

						</data>

						<data name="processname" inType="win:UnicodeString" outType="xs:string">

						</data>

						<data name="action" inType="win:UInt32" outType="win:HexInt32">

						</data>

						<data name="keyname" inType="win:UnicodeString" outType="xs:string">

						</data>

						<data name="createflags" inType="win:UInt8" outType="win:HexInt8">

						</data>

						<data name="processId" inType="win:UInt32" outType="win:HexInt32">

						</data>

						<data name="threadId" inType="win:UInt32" outType="win:HexInt32">

						</data>

						<data name="timeStamp" inType="win:UInt64" outType="win:HexInt64">

						</data>

					</template>

					<template tid="_template_savperf_oncreateordeleteprocess2">

						<data name="microseconds" inType="win:UInt64" outType="xs:unsignedLong">

						</data>

						<data name="parentprocessname" inType="win:UnicodeString" outType="xs:string">

						</data>

						<data name="action" inType="win:UInt32" outType="win:HexInt32">

						</data>

						<data name="childprocessname" inType="win:UnicodeString" outType="xs:string">

						</data>

						<data name="createflags" inType="win:UInt8" outType="win:HexInt8">

						</data>

						<data name="processId" inType="win:UInt32" outType="win:HexInt32">

						</data>

						<data name="parentProcessId" inType="win:UInt32" outType="win:HexInt32">

						</data>

						<data name="threadId" inType="win:UInt32" outType="win:HexInt32">

						</data>

						<data name="timeStamp" inType="win:UInt64" outType="win:HexInt64">

						</data>

						<data name="commandLine" inType="win:UnicodeString" outType="xs:string">

						</data>

					</template>

					<template tid="_template_savperf_onfile2">

						<data name="microseconds" inType="win:UInt64" outType="xs:unsignedLong">

						</data>

						<data name="processname" inType="win:UnicodeString" outType="xs:string">

						</data>

						<data name="action" inType="win:UInt32" outType="win:HexInt32">

						</data>

						<data name="filename" inType="win:UnicodeString" outType="xs:string">

						</data>

						<data name="processId" inType="win:UInt32" outType="win:HexInt32">

						</data>

						<data name="threadId" inType="win:UInt32" outType="win:HexInt32">

						</data>

						<data name="timeStamp" inType="win:UInt64" outType="win:HexInt64">

						</data>

					</template>

					<template tid="_template_savperf_createremotethread2">

						<data name="microseconds" inType="win:UInt64" outType="xs:unsignedLong">

						</data>

						<data name="process" inType="win:UnicodeString" outType="xs:string">

						</data>

						<data name="action" inType="win:UInt32" outType="win:HexInt32">

						</data>

						<data name="targetprocess" inType="win:UnicodeString" outType="xs:string">

						</data>

						<data name="processId" inType="win:UInt32" outType="win:HexInt32">

						</data>

						<data name="threadId" inType="win:UInt32" outType="win:HexInt32">

						</data>

						<data name="timeStamp" inType="win:UInt64" outType="win:HexInt64">

						</data>

					</template>

					<template tid="_template_savperf_onopenprocesshandle2">

						<data name="microseconds" inType="win:UInt64" outType="xs:unsignedLong">

						</data>

						<data name="processname" inType="win:UnicodeString" outType="xs:string">

						</data>

						<data name="action" inType="win:UInt32" outType="win:HexInt32">

						</data>

						<data name="processId" inType="win:UInt32" outType="win:HexInt32">

						</data>

						<data name="threadId" inType="win:UInt32" outType="win:HexInt32">

						</data>

						<data name="timeStamp" inType="win:UInt64" outType="win:HexInt64">

						</data>

						<data name="targetProcessId" inType="win:UInt32" outType="win:HexInt32">

						</data>

						<data name="desiredAccess" inType="win:UInt32" outType="win:HexInt32">

						</data>

						<data name="flags" inType="win:UInt32" outType="win:HexInt32">

						</data>

					</template>

					<template tid="_template_savperf_basicintercept2">

						<data name="microseconds" inType="win:UInt64" outType="xs:unsignedLong">

						</data>

						<data name="processname" inType="win:UnicodeString" outType="xs:string">

						</data>

						<data name="action" inType="win:UInt32" outType="win:HexInt32">

						</data>

					</template>

					<template tid="_template_savperf_wc_checked2">

						<data name="microseconds" inType="win:UInt64" outType="xs:unsignedLong">

						</data>

					</template>

					<template tid="_template_savperf_sweepobject2">

						<data name="microseconds" inType="win:UInt64" outType="xs:unsignedLong">

						</data>

						<data name="itemName" inType="win:UnicodeString" outType="xs:string">

						</data>

					</template>

					<template tid="_template_savperf_jc_miss">

						<data name="misstype" inType="win:UnicodeString" outType="xs:string">

						</data>

						<data name="current" inType="win:UInt32" outType="win:HexInt32">

						</data>

						<data name="alternate" inType="win:UInt32" outType="win:HexInt32">

						</data>

						<data name="cookie" inType="win:UInt32" outType="win:HexInt32">

						</data>

					</template>

					<template tid="_templaet_savperf_jt_invalidate">

						<data name="filename" inType="win:UnicodeString" outType="xs:string">

						</data>

						<data name="volumename" inType="win:UnicodeString" outType="xs:string">

						</data>

					</template>

					<template tid="_template_savperf_jt_threadstart">

						<data name="volumename" inType="win:UnicodeString" outType="xs:string">

						</data>

						<data name="volumedispname" inType="win:UnicodeString" outType="xs:string">

						</data>

						<data name="flags" inType="win:UInt32" outType="win:HexInt32">

						</data>

						<data name="serial" inType="win:UInt32" outType="win:HexInt32">

						</data>

						<data name="fstype" inType="win:UnicodeString" outType="xs:string">

						</data>

						<data name="running" inType="win:Boolean" outType="xs:boolean">

						</data>

					</template>

					<template tid="_template_savperf_jt_purgecache1">

						<data name="milliseconds" inType="win:Double" outType="xs:double">

						</data>

						<data name="newkey" inType="win:UInt32" outType="xs:unsignedInt">

						</data>

					</template>

					<template tid="_template_savperf_jt_iodone1">

						<data name="milliseconds" inType="win:Double" outType="xs:double">

						</data>

						<data name="ok" inType="win:Boolean" outType="xs:boolean">

						</data>

					</template>

					<template tid="_template_savperf_rawmicroseconds1">

						<data name="milliseconds" inType="win:Double" outType="xs:double">

						</data>

					</template>

					<template tid="_template_savperf_jt_purgecache2">

						<data name="microseconds" inType="win:UInt64" outType="xs:unsignedLong">

						</data>

						<data name="newkey" inType="win:UInt32" outType="xs:unsignedInt">

						</data>

					</template>

					<template tid="_template_savperf_jt_iodone2">

						<data name="microseconds" inType="win:UInt64" outType="xs:unsignedLong">

						</data>

						<data name="ok" inType="win:Boolean" outType="xs:boolean">

						</data>

					</template>

					<template tid="_template_savperf_rawmicroseconds2">

						<data name="microseconds" inType="win:UInt64" outType="xs:unsignedLong">

						</data>

					</template>

					<template tid="_template_savperf_jt_goldencache">

						<data name="volume" inType="win:UnicodeString" outType="xs:string">

						</data>

						<data name="cachetext" inType="win:UnicodeString" outType="xs:string">

						</data>

					</template>

					<template tid="_template_savperf_unsupportedfilesystemtype">

						<data name="vol" inType="win:UnicodeString" outType="xs:string">

						</data>

						<data name="why" inType="win:UnicodeString" outType="xs:string">

						</data>

					</template>

					<template tid="_template_savperf_jc_unsupportedjournalversion">

						<data name="volumen" inType="win:UnicodeString" outType="xs:string">

						</data>

						<data name="major" inType="win:UInt32" outType="win:HexInt32">

						</data>

						<data name="minor" inType="win:UInt32" outType="win:HexInt32">

						</data>

					</template>

					<template tid="_template_savperf_jc_readunjournalfailed">

						<data name="errorcode" inType="win:UInt32" outType="win:ErrorCode">

						</data>

					</template>

					<template tid="_template_savperf_jinfostart">

						<data name="err" inType="win:UInt32" outType="win:ErrorCode">

						</data>

					</template>

					<template tid="_template_savperf_HIPS_intercept">

						<data name="microseconds" inType="win:UInt64" outType="xs:unsignedLong">

						</data>

						<data name="proc_path" inType="win:UnicodeString" outType="xs:string">

						</data>

						<data name="function" inType="win:UnicodeString" outType="xs:string">

						</data>

						<data name="returncode" inType="win:UInt32" outType="xs:unsignedInt">

						</data>

					</template>

					<template tid="_template_savperf_BHO_Scan">

						<data name="microseconds" inType="win:UInt64" outType="xs:unsignedLong">

						</data>

						<data name="location" inType="win:UnicodeString" outType="xs:string">

						</data>

						<data name="flags" inType="win:UInt32" outType="xs:unsignedInt">

						</data>

					</template>

					<template tid="_template_savperf_ReputationScan">

						<data name="microseconds" inType="win:UInt64" outType="xs:unsignedLong">

						</data>

						<data name="url" inType="win:UnicodeString" outType="xs:string">

						</data>

						<data name="path" inType="win:UnicodeString" outType="xs:string">

						</data>

						<data name="return" inType="win:HexInt32" outType="win:ErrorCode">

						</data>

					</template>

					<template tid="_template_savperf_microseconds_bool">

						<data name="microseconds" inType="win:UInt64" outType="xs:unsignedLong">

						</data>

						<data name="res" inType="win:Boolean" outType="xs:boolean">

						</data>

					</template>

					<template tid="_template_savperf_narrowStr">

						<data name="data" inType="win:AnsiString" outType="xs:string">

						</data>

					</template>

					<template tid="_template_savperf_microseconds_str">

						<data name="microseconds" inType="win:UInt64" outType="xs:unsignedLong">

						</data>

						<data name="data" inType="win:UnicodeString" outType="xs:string">

						</data>

					</template>

					<template tid="_template_savperf_microseconds_pid_path">

						<data name="microseconds" inType="win:UInt64" outType="xs:unsignedLong">

						</data>

						<data name="PID" inType="win:UInt32" outType="win:PID">

						</data>

						<data name="path" inType="win:UnicodeString" outType="xs:string">

						</data>

					</template>

					<template tid="_templaet_savperf_microseconds_pid">

						<data name="microseconds" inType="win:UInt64" outType="xs:unsignedLong">

						</data>

						<data name="PID" inType="win:UInt32" outType="win:PID">

						</data>

					</template>

					<template tid="_template_savperf_microseconds_bool_str_str">

						<data name="microseconds" inType="win:UInt64" outType="xs:unsignedLong">

						</data>

						<data name="res" inType="win:Boolean" outType="xs:boolean">

						</data>

						<data name="a" inType="win:UnicodeString" outType="xs:string">

						</data>

						<data name="b" inType="win:UnicodeString" outType="xs:string">

						</data>

					</template>

					<template tid="_template_savperf_loadFile">

						<data name="microseconds" inType="win:UInt64" outType="xs:unsignedLong">

						</data>

						<data name="path" inType="win:UnicodeString" outType="xs:string">

						</data>

						<data name="extent" inType="win:UInt32" outType="xs:unsignedInt">

						</data>

					</template>

					<template tid="_template_savperf_microseconds_path_keyname">

						<data name="microseconds" inType="win:UInt64" outType="xs:unsignedLong">

						</data>

						<data name="path" inType="win:UnicodeString" outType="xs:string">

						</data>

						<data name="keyname" inType="win:UnicodeString" outType="xs:string">

						</data>

					</template>

					<template tid="_template_savperf_microseconds_path_genes_genes">

						<data name="microseconds" inType="win:UInt64" outType="xs:unsignedLong">

						</data>

						<data name="path" inType="win:UnicodeString" outType="xs:string">

						</data>

						<data name="genes" inType="win:UnicodeString" outType="xs:string">

						</data>

						<data name="genesout" inType="win:UnicodeString" outType="xs:string">

						</data>

					</template>

					<template tid="_template_savperf_ThreatMetadata">

						<data name="ThreatName" inType="win:UnicodeString" outType="xs:string">

						</data>

						<data name="threatLocation" inType="win:UnicodeString" outType="xs:string">

						</data>

						<data name="threatType" inType="win:UInt32" map="savperf_ThreatDetectionType">

						</data>

						<data name="safestoreID" inType="win:GUID" outType="xs:GUID">

						</data>

						<data name="rebootNeededToResolve" inType="win:Boolean" outType="xs:boolean">

						</data>

						<data name="cleanupFailed" inType="win:Boolean" outType="xs:boolean">

						</data>

					</template>

					<template tid="_template_savperf_oa_retry_deferred">

						<data name="filename" inType="win:UnicodeString" outType="xs:string">

						</data>

						<data name="tries_left" inType="win:Int32" outType="xs:int">

						</data>

					</template>

					<template tid="_template_savperf_oa_add_deferred">

						<data name="filename" inType="win:UnicodeString" outType="xs:string">

						</data>

						<data name="num_queued" inType="win:Int32" outType="xs:int">

						</data>

						<data name="check_type" inType="win:UInt32" outType="xs:unsignedInt">

						</data>

					</template>

					<template tid="_template_savperf_oa_oplock_timeout">

						<data name="filename" inType="win:UnicodeString" outType="xs:string">

						</data>

						<data name="processName" inType="win:UnicodeString" outType="xs:string">

						</data>

						<data name="scanType" inType="win:UInt32" outType="win:HexInt32">

						</data>

						<data name="processID" inType="win:UInt32" outType="win:PID">

						</data>

					</template>

					<template tid="_template_savperf_oa_remove_deferred">

						<data name="filename" inType="win:UnicodeString" outType="xs:string">

						</data>

					</template>

					<template tid="_template_savperf_on_max_deferred_retries">

						<data name="filename" inType="win:UnicodeString" outType="xs:string">

						</data>

					</template>

					<template tid="_template_savperf_oa_checktime3">

						<data name="microseconds" inType="win:UInt64" outType="xs:unsignedLong">

						</data>

						<data name="decision" inType="win:UInt32" map="savperf_decision">

						</data>

						<data name="returncode" inType="win:UInt32" outType="win:ErrorCode">

						</data>

						<data name="filename" inType="win:UnicodeString" outType="xs:string">

						</data>

						<data name="processName" inType="win:UnicodeString" outType="xs:string">

						</data>

						<data name="scanType" inType="win:UInt32" outType="win:HexInt32">

						</data>

						<data name="processID" inType="win:UInt32" outType="win:PID">

						</data>

						<data name="filteringReason" inType="win:UInt32" map="savperf_filtering_reason">

						</data>

					</template>

					<template tid="_template_savperf_onsetregkeyvalue3">

						<data name="microseconds" inType="win:UInt64" outType="xs:unsignedLong">

						</data>

						<data name="processName" inType="win:UnicodeString" outType="xs:string">

						</data>

						<data name="action" inType="win:UInt32" outType="win:HexInt32">

						</data>

						<data name="keyName" inType="win:UnicodeString" outType="xs:string">

						</data>

						<data name="valueName" inType="win:UnicodeString" outType="xs:string">

						</data>

						<data name="processId" inType="win:UInt32" outType="win:HexInt32">

						</data>

						<data name="threadId" inType="win:UInt32" outType="win:HexInt32">

						</data>

						<data name="timeStamp" inType="win:UInt64" outType="win:HexInt64">

						</data>

						<data name="filteringReason" inType="win:UInt32" map="savperf_filtering_reason">

						</data>

					</template>

					<template tid="_template_savperf_oncreateordeletekey3">

						<data name="microseconds" inType="win:UInt64" outType="xs:unsignedLong">

						</data>

						<data name="processname" inType="win:UnicodeString" outType="xs:string">

						</data>

						<data name="action" inType="win:UInt32" outType="win:HexInt32">

						</data>

						<data name="keyname" inType="win:UnicodeString" outType="xs:string">

						</data>

						<data name="createflags" inType="win:UInt8" outType="win:HexInt8">

						</data>

						<data name="processId" inType="win:UInt32" outType="win:HexInt32">

						</data>

						<data name="threadId" inType="win:UInt32" outType="win:HexInt32">

						</data>

						<data name="timeStamp" inType="win:UInt64" outType="win:HexInt64">

						</data>

						<data name="filteringReason" inType="win:UInt32" map="savperf_filtering_reason">

						</data>

					</template>

					<template tid="_template_savperf_oncreateordeleteprocess3">

						<data name="microseconds" inType="win:UInt64" outType="xs:unsignedLong">

						</data>

						<data name="parentprocessname" inType="win:UnicodeString" outType="xs:string">

						</data>

						<data name="action" inType="win:UInt32" outType="win:HexInt32">

						</data>

						<data name="childprocessname" inType="win:UnicodeString" outType="xs:string">

						</data>

						<data name="createflags" inType="win:UInt8" outType="win:HexInt8">

						</data>

						<data name="processId" inType="win:UInt32" outType="win:HexInt32">

						</data>

						<data name="parentProcessId" inType="win:UInt32" outType="win:HexInt32">

						</data>

						<data name="threadId" inType="win:UInt32" outType="win:HexInt32">

						</data>

						<data name="timeStamp" inType="win:UInt64" outType="win:HexInt64">

						</data>

						<data name="commandLine" inType="win:UnicodeString" outType="xs:string">

						</data>

						<data name="filteringReason" inType="win:UInt32" map="savperf_filtering_reason">

						</data>

					</template>

					<template tid="_template_savperf_onfile3">

						<data name="microseconds" inType="win:UInt64" outType="xs:unsignedLong">

						</data>

						<data name="processname" inType="win:UnicodeString" outType="xs:string">

						</data>

						<data name="action" inType="win:UInt32" outType="win:HexInt32">

						</data>

						<data name="filename" inType="win:UnicodeString" outType="xs:string">

						</data>

						<data name="processId" inType="win:UInt32" outType="win:HexInt32">

						</data>

						<data name="threadId" inType="win:UInt32" outType="win:HexInt32">

						</data>

						<data name="timeStamp" inType="win:UInt64" outType="win:HexInt64">

						</data>

						<data name="filteringReason" inType="win:UInt32" map="savperf_filtering_reason">

						</data>

					</template>

					<template tid="_template_savperf_basicintercept3">

						<data name="microseconds" inType="win:UInt64" outType="xs:unsignedLong">

						</data>

						<data name="processname" inType="win:UnicodeString" outType="xs:string">

						</data>

						<data name="action" inType="win:UInt32" outType="win:HexInt32">

						</data>

						<data name="filteringReason" inType="win:UInt32" map="savperf_filtering_reason">

						</data>

					</template>

					<template tid="_template_savperf_onopenprocesshandle3">

						<data name="microseconds" inType="win:UInt64" outType="xs:unsignedLong">

						</data>

						<data name="processname" inType="win:UnicodeString" outType="xs:string">

						</data>

						<data name="action" inType="win:UInt32" outType="win:HexInt32">

						</data>

						<data name="processId" inType="win:UInt32" outType="win:HexInt32">

						</data>

						<data name="threadId" inType="win:UInt32" outType="win:HexInt32">

						</data>

						<data name="timeStamp" inType="win:UInt64" outType="win:HexInt64">

						</data>

						<data name="targetProcessId" inType="win:UInt32" outType="win:HexInt32">

						</data>

						<data name="desiredAccess" inType="win:UInt32" outType="win:HexInt32">

						</data>

						<data name="flags" inType="win:UInt32" outType="win:HexInt32">

						</data>

						<data name="filteringReason" inType="win:UInt32" map="savperf_filtering_reason">

						</data>

					</template>

					<template tid="_template_savperf_createremotethread3">

						<data name="microseconds" inType="win:UInt64" outType="xs:unsignedLong">

						</data>

						<data name="process" inType="win:UnicodeString" outType="xs:string">

						</data>

						<data name="action" inType="win:UInt32" outType="win:HexInt32">

						</data>

						<data name="targetprocess" inType="win:UnicodeString" outType="xs:string">

						</data>

						<data name="processId" inType="win:UInt32" outType="win:HexInt32">

						</data>

						<data name="threadId" inType="win:UInt32" outType="win:HexInt32">

						</data>

						<data name="timeStamp" inType="win:UInt64" outType="win:HexInt64">

						</data>

						<data name="filteringReason" inType="win:UInt32" map="savperf_filtering_reason">

						</data>

					</template>

					<template tid="_template_savperf_processfilter_setup">

						<data name="count" inType="win:UInt32" outType="xs:unsignedInt">

						</data>

						<data name="paths" inType="win:UnicodeString" outType="xs:string">

						</data>

					</template>

					<template tid="_template_savperf_processfilter_change_state">

						<data name="state" inType="win:Boolean" outType="xs:boolean">

						</data>

					</template>

					<template tid="_template_savperf_processfilter_classification">

						<data name="processId" inType="win:UInt32" outType="win:HexInt32">

						</data>

						<data name="path" inType="win:UnicodeString" outType="xs:string">

						</data>

						<data name="result" inType="win:UInt32" map="savperf_per_process_event_filtering_level">

						</data>

					</template>

					<template tid="_template_savperf_deferred_queue_full">

						<data name="filename" inType="win:UnicodeString" outType="xs:string">

						</data>

					</template>

				</templates>

			</provider>

		</events>

		<counters xmlns:auto-ns1="http://schemas.microsoft.com/win/2004/08/events" xmlns="http://schemas.microsoft.com/win/2005/12/counters">

		</counters>

	</instrumentation>

	<localization>

		<resources culture="en-US">

			<stringTable>

				<string id="SAVPerfProvider.event.etw_ProcessFilter_Classification.message" value="Process %1 (%2) has been classified as %3.">

				</string>

				<string id="SAVPerfProvider.event.etw_ProcessFilter_State.message" value="Process filter enabled state has been set to %1">

				</string>

				<string id="SAVPerfProvider.event.etw_ProcessFilter_Setup.message" value="Process filter set up with %1 paths:%n%2">

				</string>

				<string id="SAVPerfProvider.event.etw_OnAccess_max_deferred_retries.message" value="OnAccess - Failed to scan %1 deferred after maximum retries">

				</string>

				<string id="SAVPerfProvider.event.etw_OnAccess_remove_deferred_item.message" value="OnAccess - Removing %1 from deferred queue.">

				</string>

				<string id="SAVPerfProvider.event.etw_OnAccess_oplock_timeout.message" value="OnAccess - failed to get oplock for %1">

				</string>

				<string id="SAVPerfProvider.event.etw_OnAccess_deferred_check_time.message" value="OnAccess - Deferred check finished (%1)ms, decision (%2) -&gt; %3">

				</string>

				<string id="SAVPerfProvider.event.etw_OnAccess_deferred_queue_full.message" value="OnAccess - Unable to queue %1: the deferred scanning queue is full">

				</string>

				<string id="SAVPerfProvider.event.etw_OnAccess_add_deferred_item.message" value="OnAccess - Adding %1 (check type: %3), current queue size is %2">

				</string>

				<string id="SAVPerfProvider.event.etw_OnAccess_retry_deferred_scan.message" value="OnAccess - Retry deferred scan %1, remaining retries=%2">

				</string>

				<string id="SAVPerfProvider.event.etw_SSP_Beacon.message" value="Beacon has been sent to SSP">

				</string>

				<string id="SAVPerfProvider.event.etw_ThreatLifetime_Notify_Event.message" value="An notification was sent to the health event store. ">

				</string>

				<string id="SAVPerfProvider.event.etw_ThreatLifetime_Resolved.message" value="Threat notification">

				</string>

				<string id="SAVPerfProvider.event.etw_ThreatLifetime_Discovered.message" value="A threat has been discovered">

				</string>

				<string id="SAVPerfProvider.event.etw_Safestore_Initialised.message" value="Safestore has been successfully initalised. ">

				</string>

				<string id="SAVPerfProvider.event.etw_Safestore_Unload.message" value="Unloading safestore after disinfection">

				</string>

				<string id="SAVPerfProvider.event.etw_Safestore_Load.message" value="Loading safestore for disinfection">

				</string>

				<string id="SAVPerfProvider.event.etw_ICChecksum_stop.message" value="IC Checksum stop 

(%1)us">

				</string>

				<string id="SAVPerfProvider.event.etw_ICChecksum_start.message" value="IC Checksum start">

				</string>

				<string id="SAVPerfProvider.event.etw_UpdateData_stop.message" value="Data update stop

(%1)us">

				</string>

				<string id="SAVPerfProvider.event.etw_UpdateData_start.message" value="Data update start">

				</string>

				<string id="SAVPerfProvider.event.etw_OnDemandScan_stop.message" value="On Demand Scan - Stop

(%1)us">

				</string>

				<string id="SAVPerfProvider.event.etw_OnDemandScan_start.message" value="On Demand Scan - Start">

				</string>

				<string id="SAVPerfProvider.event.etw_Intercept_stop.message" value="Intercept Stop">

				</string>

				<string id="SAVPerfProvider.event.etw_Intercept_start.message" value="Intercept Start">

				</string>

				<string id="SAVPerfProvider.event.etw_LUA_stopProcessing.message" value="LUA -Stop Processing">

				</string>

				<string id="SAVPerfProvider.event.etw_LUA_startProcessing.message" value="LUA - Start processing

">

				</string>

				<string id="SAVPerfProvider.event.etw_LUA_checkPoint.message" value="LUA - Checkpoint

(%1)us">

				</string>

				<string id="SAVPerfProvider.event.etw_LUA_diffTime.message" value="LUA - Diff time

(%1)us">

				</string>

				<string id="SAVPerfProvider.event.etw_LUA_setAction.message" value="LUA - Set Action

(%1)us">

				</string>

				<string id="SAVPerfProvider.event.etw_LUA_setGene.message" value="LUA - Set Gene %2

(%1)us">

				</string>

				<string id="SAVPerfProvider.event.etw_LUA_hasGene.message" value="LUA - Has Gene %2

(%1)us">

				</string>

				<string id="SAVPerfProvider.event.etw_LUA_saviScan.message" value="LUA - SAVI Scan %2

(%1)us

in: %3

out: %4">

				</string>

				<string id="SAVPerfProvider.event.etw_LUA_driveType.message" value="LUA - Drive type

(%1)us">

				</string>

				<string id="SAVPerfProvider.event.etw_LUA_fileExists.message" value="LUA - File exists %2

(%1)us">

				</string>

				<string id="SAVPerfProvider.event.etw_LUA_setDefaultToken.message" value="LUA - Set Default token

(%1)us">

				</string>

				<string id="SAVPerfProvider.event.etw_LUA_getDefaultToken.message" value="LUA - Get Default token

(%1)us">

				</string>

				<string id="SAVPerfProvider.event.etw_LUA_debugw.message" value="LUA - %2

(%1)us">

				</string>

				<string id="SAVPerfProvider.event.etw_LUA_debug.message" value="LUA - Debug

(%1)us">

				</string>

				<string id="SAVPerfProvider.event.etw_LUA_longToShortPath.message" value="LUA - Long to short path

(%1)us">

				</string>

				<string id="SAVPerfProvider.event.etw_LUA_shortToLongPath.message" value="LUA - Short to long path

(%1)us">

				</string>

				<string id="SAVPerfProvider.event.etw_LUA_objectToWindowsPath.message" value="LUA - Path to object

(%1)us">

				</string>

				<string id="SAVPerfProvider.event.etw_LUA_windowsToObjectPath.message" value="LUA - Object to path

(%1)us">

				</string>

				<string id="SAVPerfProvider.event.etw_LUA_getSID.message" value="LUA - Get SID

(%1)us">

				</string>

				<string id="SAVPerfProvider.event.etw_LUA_shGetFolderPath.message" value="LUA - SHGetFolderPath %2

(%1)us">

				</string>

				<string id="SAVPerfProvider.event.etw_LUA_regQuery.message" value="LUA - Reg Query %2 %3

(%1)us">

				</string>

				<string id="SAVPerfProvider.event.etw_LUA_loadFile.message" value="LUA - Load file %2 - %3

(%1)us">

				</string>

				<string id="SAVPerfProvider.event.etw_LUA_comparePaths.message" value="LUA - Compare Paths %3 - %4 -&gt; %2

(%1)us">

				</string>

				<string id="SAVPerfProvider.event.etw_LUA_checksum.message" value="LUA - Checksum file

(%1)us">

				</string>

				<string id="SAVPerfProvider.event.etw_LUA_processPath.message" value="LUA - Process Path

(%1)us">

				</string>

				<string id="SAVPerfProvider.event.etw_LUA_reportPhenotypeURI.message" value="LUA - Report Phenotype URI

(%1)us">

				</string>

				<string id="SAVPerfProvider.event.etw_LUA_Phenotype.message" value="LUA - Phenotype

(%1)us">

				</string>

				<string id="SAVPerfProvider.event.etw_LUA_reportBehaviour.message" value="LUA - Report Behaviour

(%1)us">

				</string>

				<string id="SAVPerfProvider.event.etw_LUA_queryProcessCacheNotFound.message" value="LUA - Not found in cache PID %2

(%1)us">

				</string>

				<string id="SAVPerfProvider.event.etw_LUA_queryProcessCacheMissEmpty.message" value="LUA - Cache miss PID %2 

(%1)us">

				</string>

				<string id="SAVPerfProvider.event.etw_LUA_queryProcessCacheMissFound.message" value="LUA -  PID %2 at %3 not found

(%1)us">

				</string>

				<string id="SAVPerfProvider.event.etw_LUA_queryProcessCacheHit.message" value="LUA - Looking up PID %2 at %3

(%1)us">

				</string>

				<string id="SAVPerfProvider.event.etw_LUA_logTrace.message" value="LUA - %2

(%1)us">

				</string>

				<string id="SAVPerfProvider.event.etw_LUA_wrapperException.message" value="LUA - Wrapper Exception %1">

				</string>

				<string id="SAVPerfProvider.event.etw_LUA_exception.message" value="LUA - Exception %1">

				</string>

				<string id="SAVPerfProvider.event.etw_LUA_assignGlobalConstants.message" value="LUA - assign global constrants

(%1)us">

				</string>

				<string id="SAVPerfProvider.event.etw_LUA_doString.message" value="LUA - Run

(%1)us">

				</string>

				<string id="SAVPerfProvider.event.etw_LUA_checkProfileing.message" value="LUA - Check Profiling 

(%1)us">

				</string>

				<string id="SAVPerfProvider.event.etw_LUA_destroy_engine.message" value="Destroyed a LUA engine">

				</string>

				<string id="SAVPerfProvider.event.etw_LUA_create_engine.message" value="Created a new lua engine

(%1)us">

				</string>

				<string id="SAVPerfProvider.event.etw_ReputationScan.message" value="Reputation lookup for %3 connecting to %2 -&gt; %4

(%1)us">

				</string>

				<string id="SAVPerfProvider.event.etw_BHO_Scan.message" value="BHO scanning %2:%3

(%1)us">

				</string>

				<string id="SAVPerfProvider.event.etw_HIPS_Submit.message" value="HIPS intercept for process %2-%3 -&gt; %4

(%1)us">

				</string>

				<string id="SAVPerfProvider.event.etw_HIPS_SubmitI.message" value="HIPS intercept for process %2-%3 -&gt; %4

(%1)us">

				</string>

				<string id="SAVPerfProvider.event.etw_JournalTracker_ReadUSNJournalFailed.message" value="Journal Tracker - Read USN journal failed %1">

				</string>

				<string id="SAVPerfProvider.event.etw_Journal_UnsupportedJournalVersion.message" value="Journal version unsupported">

				</string>

				<string id="SAVPerfProvider.event.etw_Journal_ProcessJournalInfo.message" value="Journal - Process Journal Info">

				</string>

				<string id="SAVPerfProvider.event.etw_JournalTracker_InvalidHandles.message" value="Journal Tracker - Invalidate Handles">

				</string>

				<string id="SAVPerfProvider.event.etw_JournalTracker_NoPrerequisites.message" value="Journal Tracker - No Prerequisites %1">

				</string>

				<string id="SAVPerfProvider.event.etw_Journal_QueryJournalInfo.message" value="Journal Query Journal Info">

				</string>

				<string id="SAVPerfProvider.event.etw_JournalInfo_Start.message" value="Journal Info Start %1">

				</string>

				<string id="SAVPerfProvider.event.etw_JournalTracker_DebugTrace.message" value="Journal Tracker - Debug: %1">

				</string>

				<string id="SAVPerfProvider.event.etw_JournalTracker_DebugInfo.message" value="Journal Tracker - Info: %1">

				</string>

				<string id="SAVPerfProvider.event.etw_JournalTracker_DebugError.message" value="Journal Tracker - Error: %1">

				</string>

				<string id="SAVPerfProvider.event.etw_JournalTracker_UnsupportedJournalVersion.message" value="Journal Tracker The journal version %2.%3 on %1 is unsupported">

				</string>

				<string id="SAVPerfProvider.event.etw_JournalTracker_ReadOnlyVolume.message" value="Journal Tracker - %1 is readonly">

				</string>

				<string id="SAVPerfProvider.event.etw_JournalTracker_UnsupportedFilesystem.message" value="Journal Tracker Filesystem on %1 unsupported - %2">

				</string>

				<string id="SAVPerfProvider.event.etw_Journal_Halted.message" value="Journal Halted %1">

				</string>

				<string id="SAVPerfProvider.event.etw_JournalTracker_GoldenCacheUnused.message" value="Journal Tracker - Golden cache for %1 unused %2">

				</string>

				<string id="SAVPerfProvider.event.etw_JournalTracker_CacheUnavailable.message" value="Journal Tracker Cache %1 unavailable">

				</string>

				<string id="SAVPerfProvider.event.etw_JournalTracker_ReplacingCache.message" value="Journal Tracker - Replacing Cache %1">

				</string>

				<string id="SAVPerfProvider.event.etw_JournalTracker_UsingGoldenCache.message" value="Journal Tracker - Using golden cache for %1 - %2">

				</string>

				<string id="SAVPerfProvider.event.etw_JournalTracker_UsingCache.message" value="Journal Tracker - Using cache %1">

				</string>

				<string id="SAVPerfProvider.event.etw_JournalTracker_FaileToOpenVolume.message" value="Journal Tracker - Failed to open the volumr %1">

				</string>

				<string id="SAVPerfProvider.event.etw_Journal_TrackerThreadExit.message" value="Journal Tracker - Thread shutdown 

(%1)us">

				</string>

				<string id="SAVPerfProvider.event.etw_Journal_IODone.message" value="Journa IO Done  - %2

(%1)us">

				</string>

				<string id="SAVPerfProvider.event.etw_Journal_PurgeCacheKey.message" value="Purged cacge %2

(%1)us">

				</string>

				<string id="SAVPerfProvider.event.etw_Journal_TrackerThreadStart.message" value="Starting journal tracker for %1 - %2

Flags %3

Serial No %4

Filesystem %5

isRunning %6">

				</string>

				<string id="SAVPerfProvider.event.etw_JournalTracker_Invalidate.message" value="Journal Tracker - Invalidaing record for %1 on %2">

				</string>

				<string id="SAVPerfProvider.event.etw_Journal_EndSyncCache.message" value="Finished synchronizing cache %1">

				</string>

				<string id="SAVPerfProvider.event.etw_Journal_BeginSyncCache.message" value="Begin Syncronizing cache %1">

				</string>

				<string id="SAVPerfProvider.event.etw_Journal_EndFlushRecords.message" value="Finished flushing records %1">

				</string>

				<string id="SAVPerfProvider.event.etw_Journal_FlushError.message" value="Error flushing journal records %1">

				</string>

				<string id="SAVPerfProvider.event.etw_Journal_BeginFlushRecords.message" value="Beginning record flush %1">

				</string>

				<string id="SAVPerfProvider.event.etw_Journal_Shutdown.message" value="Journal Shutting down %1">

				</string>

				<string id="SAVPerfProvider.event.etw_JournalTracker_SignalShutdown.message" value="Sutting down journal tracker %1">

				</string>

				<string id="SAVPerfProvider.event.etw_JournalCache_PostSuccess.message" value="Journal cache decision - Post Success">

				</string>

				<string id="SAVPerfProvider.event.etw_JournalCache_PostInvalidate.message" value="Journal cache decision - Post Invalidate">

				</string>

				<string id="SAVPerfProvider.event.etw_JournalCache_PostInvalidateMalicious.message" value="Journal cache decision - Post Invalidate Malicious">

				</string>

				<string id="SAVPerfProvider.event.etw_JournalCache_PostSkipNoJournal.message" value="Journal cache decision - Post Skip (No Journal)">

				</string>

				<string id="SAVPerfProvider.event.etw_JournalCache_Exception.message" value="Journal cache decision - Exception">

				</string>

				<string id="SAVPerfProvider.event.etw_JournalCache_Miss.message" value="Journal cache decision - Miss">

				</string>

				<string id="SAVPerfProvider.event.etw_JournalCache_Hit.message" value="Journal cache decision - Hit">

				</string>

				<string id="SAVPerfProvider.event.etw_JournalCache_Golden.message" value="Journal cache decision - Golden File">

				</string>

				<string id="SAVPerfProvider.event.etw_JournalCache_IgnoreCache.message" value="Journal cache decision - Ignore Cache">

				</string>

				<string id="SAVPerfProvider.event.etw_JournalCache_SkipNoJournal.message" value="Journal cache decision - Skip cache (NoJournal)">

				</string>

				<string id="SAVPerfProvider.event.etw_JournalCache_SkipManualCleanup.message" value="Journal cache decision - Skip cache (ManualCleanup)">

				</string>

				<string id="SAVPerfProvider.event.etw_JournalCache_SkipHIPS.message" value="Journal cache decision - Skip cache (HIPS)">

				</string>

				<string id="SAVPerfProvider.event.etw_JournalCache_SkipSubfile.message" value="Journal cache decision - Skip cache (Sub File)">

				</string>

				<string id="SAVPerfProvider.event.etw_VirusEngine_Scanning.message" value="Passing file %1 to be scanned to the virus engine. ">

				</string>

				<string id="SAVPerfProvider.event.etw_VirusEngine_SweepObject_Resweep.message" value="Resweeping object">

				</string>

				<string id="SAVPerfProvider.event.etw_VirusEngine_SweepObject_Sweep.message" value="Sweeping %2

(%1)us">

				</string>

				<string id="SAVPerfProvider.event.etw_VirusEngine_SweepObject_SweepO.message" value="Sweeping Object">

				</string>

				<string id="SAVPerfProvider.event.etw_WebContent_Checked.message" value="Web content has been checked

(%1)us">

				</string>

				<string id="SAVPerfProvider.event.etw_WebContent_CheckedO.message" value="Web content has been checked">

				</string>

				<string id="SAVPerfProvider.event.etw_WebContent_Check.message" value="Recieved %2 bytes of data web content to be scanned. URL: %1">

				</string>

				<string id="SAVPerfProvider.event.etw_Intercept_OnOpenProcessHandle.message" value="Intercepted %2 opening process handle to %7%nTime: %1 usec">

				</string>

				<string id="SAVPerfProvider.event.etw_Intercept_OnOpenProcessHandleO.message" value="Intercept OpenProcessHandle">

				</string>

				<string id="SAVPerfProvider.event.etw_Intercept_OnOpenProcessHandle1.message" value="Intercepted %2 Opening %7 Process Handle

(%1)us">

				</string>

				<string id="SAVPerfProvider.event.etw_Intercept_OnFileOpenForWrite.message" value="Intercepted %2 opening %4 for write%nTime: %1 usec">

				</string>

				<string id="SAVPerfProvider.event.etw_Intercept_OnFileOpenForWrite1.message" value="Intercepted %2 opening %4 for write

(%1)us">

				</string>

				<string id="SAVPerfProvider.event.etw_Intercept_OnFileOpenForWriteO.message" value="Intercept a file has been opened for write">

				</string>

				<string id="SAVPerfProvider.event.etw_Intercept_OnLoadDriver.message" value="Intercepted %2 loading driver %4%nTime: %1 usec">

				</string>

				<string id="SAVPerfProvider.event.etw_Intercept_OnLoadDriver1.message" value="Interceped %2 loading driver %4

(%1)us">

				</string>

				<string id="SAVPerfProvider.event.etw_Intercept_OnLoadDriverO.message" value="Intercept a driver had been loaded">

				</string>

				<string id="SAVPerfProvider.event.etw_Intercept_OnIpConnect.message" value="Intercepted %2 making an IP connection%nTime: %1 usec">

				</string>

				<string id="SAVPerfProvider.event.etw_Intercept_OnIpConnect1.message" value="Intercepted %2 making an ip connection

(%1)us">

				</string>

				<string id="SAVPerfProvider.event.etw_Intercept_OnModFile.message" value="Intercepted %2 modifying file %4%nTime: %1 usec">

				</string>

				<string id="SAVPerfProvider.event.etw_Intercept_OnModFile1.message" value="Intercepted %4 modiying %4

(%1)us">

				</string>

				<string id="SAVPerfProvider.event.etw_Intercept_OnModFileO.message" value="Intercepted File Modification

">

				</string>

				<string id="SAVPerfProvider.event.etw_Intercept_OnCreateRemoteThread.message" value="Intercepted %2 creating remote thread in %4%nTime: %1 usec">

				</string>

				<string id="SAVPerfProvider.event.etw_Intercept_OnCreateRemoteThread1.message" value="Intercept %2 creating remote thread in %4

(%1)us">

				</string>

				<string id="SAVPerfProvider.event.etw_Intercept_OnCreateRemoteThreadO.message" value="Intercept create remote thread">

				</string>

				<string id="SAVPerfProvider.event.etw_Intercept_OnModFile_Legacy.message" value="Intercept%2 File Modified %4

(%1)us">

				</string>

				<string id="SAVPerfProvider.event.etw_Intercept_OnModFile_LegacyO.message" value="Intercept File Modified">

				</string>

				<string id="SAVPerfProvider.event.etw_Intercept_OnCreateOrDeleteProcess.message" value="Intercepted %2 creating or deleting process %4, command line: %10%nTime: %1 usec">

				</string>

				<string id="SAVPerfProvider.event.etw_Intercept_OnCreateOrDeleteProcess1.message" value="Intercepted %2 Creating or Deleting a Process %4

Commandline %9

(%1)us">

				</string>

				<string id="SAVPerfProvider.event.etw_Intercept_OnCreateOrDeleteProcessO.message" value="Intercepted Create or Delete Process">

				</string>

				<string id="SAVPerfProvider.event.etw_Intercept_OnCreateOrDeleteRegKey.message" value="Intercepted %2 creating or deleting Registry key %4%nTime: %1 usec">

				</string>

				<string id="SAVPerfProvider.event.etw_Intercept_OnCreateOrDeleteRegKey1.message" value="Intercepted %2 Create or Delete Registry Key %4

(%1)us">

				</string>

				<string id="SAVPerfProvider.event.etw_Intercept_OnCreateOrDeleteRegKeyO.message" value="Intercepted Create or Delete Registry Key">

				</string>

				<string id="SAVPerfProvider.event.etw_Intercept_OnSetRegKeyValue.message" value="Intercepted %2 setting Registry key %4, value %5%nTime: %1 usec">

				</string>

				<string id="SAVPerfProvider.event.etw_Intercept_OnSetRegKeyValue1.message" value="Intercepted %2 setting registry value %4 %5

T(%1)us">

				</string>

				<string id="SAVPerfProvider.event.etw_Intercept_OnSetRegKeyValueO.message" value="Intercepted %2 setting registry value %4 %5

T(%1)ms">

				</string>

				<string id="SAVPerfProvider.event.etw_OnAcccess_CheckTime.message" value="OnAccess - %4 checked, decision: %2%nTime: %1 usec">

				</string>

				<string id="SAVPerfProvider.event.etw_OnAcccess_CheckTime1.message" value="OnAccess - Checkfinished (%1)ms (%2)ms, decision (%3) -&gt; %4">

				</string>

				<string id="SAVPerfProvider.event.etw_OnAcccess_CheckItem.message" value="OnAccess - Checking %1 opened by%2  scantype %3">

				</string>

				<string id="SAVPerfProvider.channel._etw_ProcessFilter.message" value="Process filter">

				</string>

				<string id="SAVPerfProvider.channel._etw_Comms.message" value="Communications">

				</string>

				<string id="SAVPerfProvider.channel.etw_JournalTrackerChannel.message" value="Journal Tracking">

				</string>

				<string id="SAVPerfProvider.channel.etw_CacheChannel.message" value="Result caching">

				</string>

				<string id="SAVPerfProvider.channel.etw_BehaviourInterceptChannel.message" value="Behavioiur Monitoring">

				</string>

				<string id="SAVPerfProvider.channel.etw_WebConnectChannel.message" value="Web protection">

				</string>

				<string id="SAVPerfProvider.channel.etw_ScanChannel.message" value="Engine Scanning">

				</string>

				<string id="SAVPerfProvider.channel.etw_OnAccessChannel.message" value="OnAccess Detection">

				</string>

				<string id="SAVPerfProvider.task._etw_task_processfilter.message" value="Process filter">

				</string>

				<string id="SAVPerfProvider.task._etw_task_deferred_scan.message" value="Deferred scan">

				</string>

				<string id="SAVPerfProvider.task._etw_Beacon.message" value="Sending a notification to SSP">

				</string>

				<string id="SAVPerfProvider.task._etw_Safestore.message" value="Safestore">

				</string>

				<string id="SAVPerfProvider.task._etw_ProcessJournal.message" value="ProcessJournal">

				</string>

				<string id="SAVPerfProvider.task.ICChecksum.message" value="ICChecksum">

				</string>

				<string id="SAVPerfProvider.task._etw_WebIntercept.message" value="WebIntercept">

				</string>

				<string id="SAVPerfProvider.task._etw_HIPSIntercept.message" value="HIPSIntercept">

				</string>

				<string id="SAVPerfProvider.task._etw_WebContentIntercept.message" value="WebContentIntercept">

				</string>

				<string id="SAVPerfProvider.task._etw_OnOpenProcessHandleIntercept.message" value="OnOpenProcessHandleIntercept">

				</string>

				<string id="SAVPerfProvider.task._etw_OnFileOpenForWriteIntercept.message" value="OnFileOpenForWriteIntercept">

				</string>

				<string id="SAVPerfProvider.task._etw_OnLoadDriverIntercept.message" value="OnLoadDriverIntercept">

				</string>

				<string id="SAVPerfProvider.task._etw_OnIpConnectIntercept.message" value="OnIpConnectIntercept">

				</string>

				<string id="SAVPerfProvider.task._etw_OnModFileIntercept.message" value="OnModFileIntercept">

				</string>

				<string id="SAVPerfProvider.task._etw_OnCreateRemoteThreadIntercept.message" value="OnCreateRemoteThreadIntercept">

				</string>

				<string id="SAVPerfProvider.task._etw_OnCreateOrDeleteProcessIntercept.message" value="OnCreateOrDeleteProcessIntercept">

				</string>

				<string id="SAVPerfProvider.task._etw_OnCreateOrDeleteRegKeyIntercept.message" value="OnCreateOrDeleteRegKeyIntercept">

				</string>

				<string id="SAVPerfProvider.task._etw_OnSetRegKeyValueIntercep.message" value="OnSetRegKeyValueIntercep">

				</string>

				<string id="SAVPerfProvider.task._etw_OnAccessIntercept.message" value="On Access">

				</string>

				<string id="SAVPerfProvider.task._etw_UpdateData.message" value="Data update">

				</string>

				<string id="SAVPerfProvider.task._tmpl_etw_OnDemand.message" value="On Deman Scan">

				</string>

				<string id="SAVPerfProvider.task._etw_task_HIPS_Eval.message" value="HIPS processing">

				</string>

				<string id="SAVPerfProvider.task._etw_task_CacheManagement.message" value="Cache Management">

				</string>

				<string id="SAVPerfProvider.task._etw_task_scan.message" value="Sweep">

				</string>

				<string id="SAVPerfProvider.task._etw_task_cache.message" value="Cache">

				</string>

				<string id="SAVPerfProvider.task.etw_task_intercept.message" value="Intercept">

				</string>

				<string id="SAVPerfProvider.opcode.etw_SendBeacon.message" value="SendBeacon">

				</string>

				<string id="SAVPerfProvider.opcode._etw_HealthEventSent.message" value="HealthEventSent">

				</string>

				<string id="SAVPerfProvider.opcode._etw_ThreatResolved.message" value="Process threat resolution">

				</string>

				<string id="SAVPerfProvider.opcode._etw_ThreatDiscovered.message" value="Process threat discovery lifetime">

				</string>

				<string id="SAVPerfProvider.opcode._etw_SkipSubfile.message" value="SkipSubfile">

				</string>

				<string id="SAVPerfProvider.opcode._etw_Ignore.message" value="Ignore">

				</string>

				<string id="SAVPerfProvider.opcode._etw_SkipManualCleanup.message" value="SkipManualCleanup">

				</string>

				<string id="SAVPerfProvider.opcode._etw_Error.message" value="Error">

				</string>

				<string id="SAVPerfProvider.opcode._etw_InvalidateMalicious.message" value="InvalidateMalicious">

				</string>

				<string id="SAVPerfProvider.opcode._etw_Invalidate.message" value="Invalidate">

				</string>

				<string id="SAVPerfProvider.opcode._etw_NoJournal.message" value="NoJournal">

				</string>

				<string id="SAVPerfProvider.opcode._etw_Golden.message" value="Golden">

				</string>

				<string id="SAVPerfProvider.opcode._etw_Skip.message" value="SkipHips">

				</string>

				<string id="SAVPerfProvider.opcode._etw_hips.message" value="Hips">

				</string>

				<string id="SAVPerfProvider.opcode._etw_Miss.message" value="Miss">

				</string>

				<string id="SAVPerfProvider.opcode._etw_HIT.message" value="Hit">

				</string>

				<string id="SAVPerfProvider.opcode._etw_op_Load.message" value="Load">

				</string>

				<string id="SAVPerfProvider.opcode._etw_op_Compute.message" value="Compute">

				</string>

				<string id="SAVPerfProvider.opcode._etw_op_Crack.message" value="Lookup">

				</string>

				<string id="SAVPerfProvider.opcode._etw_op_Log.message" value="Log">

				</string>

				<string id="SAVPerfProvider.keyword._etw_ThreatLifetime.message" value="Events to do with management of threats and tracking there lifetime">

				</string>

				<string id="SAVPerfProvider.keyword._etw_Cleanup.message" value="Operation to do with cleanup">

				</string>

				<string id="SAVPerfProvider.keyword._etw_Update.message" value="Operations to do with updates">

				</string>

				<string id="SAVPerfProvider.keyword._etw_Process.message" value="Operations to do with processes">

				</string>

				<string id="SAVPerfProvider.keyword._etw_Checksum.message" value="Operations to do with checksums">

				</string>

				<string id="SAVPerfProvider.keyword._etw_path.message" value="Operations to do with paths">

				</string>

				<string id="SAVPerfProvider.keyword._etw_Registry.message" value="Operations to do with registry">

				</string>

				<string id="SAVPerfProvider.keyword._etw_File.message" value="Operations to do with files">

				</string>

				<string id="SAVPerfProvider.map.savperf_per_process_event_filtering_level.0.message" value="Generic">

				</string>

				<string id="SAVPerfProvider.map.savperf_per_process_event_filtering_level.1.message" value="File manipulator">

				</string>

				<string id="SAVPerfProvider.map.savperf_filtering_reason.0.message" value="Not filtered">

				</string>

				<string id="SAVPerfProvider.map.savperf_filtering_reason.1.message" value="Process filter">

				</string>

				<string id="SAVPerfProvider.map.savperf_filtering_reason.2.message" value="Global exclusion">

				</string>

				<string id="SAVPerfProvider.map.savperf_filtering_reason.3.message" value="Per-process exclusion">

				</string>

				<string id="SAVPerfProvider.map.savperf_ThreatDetectionType.0.message" value="StaticVirus">

				</string>

				<string id="SAVPerfProvider.map.savperf_ThreatDetectionType.1.message" value="RuntimeVirus">

				</string>

				<string id="SAVPerfProvider.map.savperf_ThreatDetectionType.2.message" value="Behaviour">

				</string>

				<string id="SAVPerfProvider.map.savperf_ThreatDetectionType.3.message" value="ControlledApplication">

				</string>

				<string id="SAVPerfProvider.map.savperf_ThreatDetectionType.4.message" value="BufferOverflow">

				</string>

				<string id="SAVPerfProvider.map.savperf_decision.0.message" value="Infected">

				</string>

				<string id="SAVPerfProvider.map.savperf_decision.1.message" value="Action Pending">

				</string>

				<string id="SAVPerfProvider.map.savperf_decision.2.message" value="Disinfected">

				</string>

				<string id="SAVPerfProvider.map.savperf_decision.3.message" value="Clean">

				</string>

				<string id="SAVPerfProvider.map.savperf_decision.4.message" value="Exempt">

				</string>

				<string id="SAVPerfProvider.map.savperf_decision.5.message" value="Error">

				</string>

				<string id="SAVPerfProvider.map.savperf_decision.6.message" value="Threat Neutralised">

				</string>

			</stringTable>

		</resources>

	</localization>

</instrumentationManifest>
Anon7 - 2022
AnonSec Team