DonatShell
Server IP : 180.180.241.3  /  Your IP : 216.73.216.252
Web Server : Microsoft-IIS/7.5
System : Windows NT NETWORK-NHRC 6.1 build 7601 (Windows Server 2008 R2 Standard Edition Service Pack 1) i586
User : IUSR ( 0)
PHP Version : 5.3.28
Disable Function : NONE
MySQL : ON  |  cURL : ON  |  WGET : OFF  |  Perl : OFF  |  Python : OFF  |  Sudo : OFF  |  Pkexec : OFF
Directory :  /Windows/System32/en-US/

Upload File :
current_dir [ Writeable ] document_root [ Writeable ]

 

Command :


[ HOME SHELL ]     

Current File : /Windows/System32/en-US/tdh.dll.mui
MZ@	!L!This program cannot be run in DOS mode.

$uEEELlDLl
DRichEPEL[J!	@T.rsrc@@@0H
0H`xHb x8	P	`	p											 	0H2|h 4)Xp/(6p	?BZL(fH|
H܉LC(@VfMUICOUNTERS.XSD
EVENTS.XSDWINMETA.XML%3
zT6f\ze|MUIen-US!Unrecognized attribute specified.Not found :  '%1'.+MessageId not found in string table : '%1'.%Duplicate string Id specified : '%1'.9For Provider '%1' attribute resourceFileName is required.8For Provider '%1' attribute messageFileName is required.SProvider '%1', parameter file name cannot be specified without a message file name.)Duplicate provider name specified : '%1'.0Duplicate provider GUID '%1' in provider : '%2'.+Duplicate provider symbol specified : '%1'.UInvalid value %1!u!(0x%1!x!) specified for level '%2'. Values 0 thru 15 are reserved.!Duplicate level name used : '%1'.:Duplicate level value %1!u!(0x%1!x!) used in level : '%2'.#Duplicate level symbol used : '%1'.KInvalid value %1!u!(0x%1!x!) specified for task '%2'. Value 0 is reserved.. Duplicate task name used : '%1'.PA8Duplicate task value %1!u!(0x%1!x!) used in task : '%2'."Duplicate task symbol used : '%1'.-Duplicate event guid '%1' used for task '%2'.cInvalid value %1!u!(0x%1!x!) specified for opcode '%2'. Opcode values should be between 10 and 239."Duplicate opcode name used : '%1'.<Duplicate opcode value %1!u!(0x%1!x!) used in opcode : '%2'.$Duplicate opcode symbol used : '%1'.wInvalid value %1!u!(0x%1!x!) specified for channel '%2'. Values for user-defined channels should be between 16 and 255.[Channel '%1' is the 9th channel for this provider.  On 8 channels allowed for one provider./Duplicate channel Id '%1' used in channel '%2'.GDuplicate channel name used : '%1'. Channel names are case-insensitive.<Duplicate channel value %1!u!(0x%1!x!) used in channel '%2'.4Duplicate channel symbol '%1' used for channel '%2'.@Duplicate property name : '%1' specified within template - '%2'.MFor property '%1', property '%2' referenced by attribute count was not found.OFor property '%1', property '%2' referenced by attribute length was not found..KFor property '%1', property '%2' referenced by attribute count is a struct.LFor property '%1', property '%2' referenced by attribute length is a struct.DFor property '%1', with inType win:Binary, length must be specified.>For property '%1', length is not allowed for the given inType.dFor event '%1', with Id %2!u!(0x%2!x!), too many keywords specified. Maximum keywords allowed is 48.LFor event '%1', Id %2!u!(0x%2!x!) was specified which is bigger than USHORT.FTwo events have the same Id %1!u!(0x%1!x!) and Version %2!u!(0x%2!x!).#Duplicate event symbol used : '%1'.jFor event '%1', with Id %2!u!(0x%2!x!), win:EventlogClassic keyword is not allowed with any other keyword.IFor event '%1', with Id %2!u!(0x%2!x!), version attribute is not allowed.IFor event '%1', with Id %2!u!(0x%2!x!), channel attribute is not allowed.HFor event '%1', with Id %2!u!(0x%2!x!), opcode attribute is not allowed.RFor keyword '%1', 'mask' attribute is invalid. One and only one bit should be set.TFor keyword '%1', with mask 0x%2!I64x!, mask bit can only be one of the low 48 bits."Duplicate keyword name used: '%1'.7Duplicate keyword mask 0x%1!I64x! used in keyword '%2'.3Duplicate keyword symbol '%1' used in keyword '%2'.!Duplicate template TId '%1' used.aFailed to load msxml6.dll. Please ensure that MSXML 6.0 is installed on the system and try again. Failed to CoCreate Schema cache.*Failed trying to add schema file to cache.*Failed to add schema to schema collection.,Failed to set async property on DOMDocument.*Failed to query IXMLDOMDocument interface.VFailed trying to parse file. %1(%2!d!): Error 0x%3!x!. At Line=%4!d!, Column=%5!d!, %6,OutType : '%1' is invalid for InType : '%2'.InType : '%1' not found.Duplicate map name used: '%1'.2Only one bit may be set in bit map : '%1' 0x%2!x!.*Only 16 providers allowed in one manifest.Duplicate message ID was specified - 0x%1!x!. This can happen when an auto-generated messageId conflicts with those explicitly specified using a <messageTable> or a .mc file.jFor provider '%1', ResourceBase value %2!u!(0x%2!x!) results in duplicate string Ids. Try different value.$Duplicate Filter Symbol used : '%1'.GTwo Filters have the same Id:%1!u!(0x%1!x!) and Version:%2!u!(0x%2!x!).OUserData not allowed for template with TId '%1', since it is a filter template.^Struct not allowed for property '%1' of template with TId '%2', since it is a filter template.]Array not allowed for property '%1' of template with TId '%2', since it is a filter template.PAJMap not allowed for template with TId '%1', since it is a filter template.iAttribute outType is required for property '%1' of template with TId '%2', since it is a filter template."Duplicate Filter Name used : '%1'.LRequired attribute 'chid' is missing for the channel element with name '%1'.OFor channel '%1', value of attribute 'access' is not a valid SDDL string: '%2'.IA <message> element has reference to a non-existent <string> entry: '%1'.7Two <message> entries have the same MId value: 0x%1!x!.AFor Template with TId '%1', only one <binary> element is allowed..Two <message> entries have the same MId: '%1'.dFor event '%1', with Id %2!u!(0x%2!x!), attribute 'message' is required, since it is an Admin event.For event '%1', with Id %2!u!(0x%2!x!), level must be specified and it should be one of Critical, Error, Warning, or Informational, since it is an Admin event.1Two <message> entries have the same symbol: '%1'.EThe instrumentation node is either missing or in the wrong namespace.LFor <data> element '%1', the prefix of '%2' is not in the winmeta namespace.For <counter> element with Id %1!u!(0x%1!x!), under <counterSet> '%2', attribute 'field' is not allowed, since provider is userMode.For <counter> element with Id %1!u!(0x%1!x!), under <counterSet> '%2', attribute 'struct' is required, since provider is kernelMode.For <counter> element with Id %1!u!(0x%1!x!), under <counterSet> '%2', attribute 'field' is required, since provider is kernelMode.xFor <counterSet> element '%1', under <provider> '%2', child element <structs> is required, since provider is kernelMode.yFor <counterSet> element '%1', under <provider> '%2', child element <structs> is not allowed, since provider is userMode.VFor <provider> element '%1', attribute symbol is required, since provider is userMode.[For <provider> element '%1', attribute symbol is not allowed, since provider is kernelMode.For <counter> element with Id %1!u!(0x%1!x!), under <counterSet> '%2', 'id' cannot be greater than 63 since provider is kernelMode.For <counter> element with Id %1!u!(0x%1!x!), under <counterSet> '%2', attribute 'aggregate' is not allowed since the parent counterSet has either single or multiple instances.For <counter> element with Id %1!u!(0x%1!x!), under <counterSet> '%2', attribute 'baseID' is required. Here is the list of counter types that require a baseID and the required types of their base counters:
                                      
                                                                                  perf_average_bulk
                                                               perf_average_timer
                                                                Base: perf_average_base
                                                     
                                                                                  perf_100nsec_multi_timer
                                                        perf_100nsec_multi_timer_inv
                                                    perf_counter_multi_timer
                                                        perf_counter_multi_timer_inv
                                                      Base: perf_counter_multi_base
                                               
                                                                                  perf_raw_fraction
                                                                 Base: perf_raw_base
                                                         
                                                                                  perf_large_raw_fraction
                                                           Base: perf_large_raw_base
                                                   
                                                                                  perf_sample_fraction
                                                              Base: perf_sample_base
QString table references not allowed. Please inline the value of the string: '%1'.7For Map '%1', duplicate value %2!u!(0x%2!x!) specified.5For Pattern Map '%1', duplicate value '%2' specified.For template '%1', invalid Custom Xml specified. Custom Xml must have a top-level element and it should be in its own namespace.  Also, the value of property inserts should not be greater than the number of top-level properties in the template : %2.The <events> node is either missing or in the wrong namespace. The <events> node must be present under <instrumentation> node and should be in the following namespace: 'http://schemas.microsoft.com/win/2004/08/events'.dFor property '%1', inType must be one of UInt8, UInt16, UInt32, or HexInt32, since map is specified.PAsFor property '%1', property '%2' referenced by attribute count must have inType UInt8, UInt16, UInt32, or HexInt32.[For property '%1', property '%2' referenced by attribute count cannot have attribute count.tFor property '%1', property '%2' referenced by attribute length must have inType UInt8, UInt16, UInt32, or HexInt32.]For property '%1', property '%2' referenced by attribute length cannot have attribute length.For event '%1', with Id %2!u!(0x%2!x!), a property insert in the event message is referencing a non-existent property. Event only has %3!u! properties: '%4'.nFor event '%1', with Id %2!u!(0x%2!x!), format specification fields are not allowed in property inserts: '%3'.BLength of Channel Name must be between 1 and 256 characters: '%1'.Invalid Channel Name: %1. Following characters are not allowed in a channel name: ascii value <31, double quote, '>','<','&','|','\',''',':','*', and '?'.CLength of Provider Name must be between 1 and 256 characters: '%1'.Invalid Provider Name: %1. Following characters are not allowed in a Provider name: ascii value <31, double quote, '>','<','&','|','\',''',':','*', and '?'.!Failed to set selection language."Failed to set selection namespace.JFailed trying to parse file %1, and failed to retrieve reason for failure.*Unknown error 0x%1!x! received from msxml._This element is referenced by %1!u! other element(s). Please remove references before deleting.Specify a name for the map.For <counter> element with Id %1!u!(0x%1!x!), under <counterSet> '%2', attributes 'perfTimeID' and 'perfFreqID' are required, and the counters referenced by those attributes should be of type perf_counter_large_rawcount. This rule applies to counters of following types:
                                                           
                                                                                   perf_counter_obj_time_queuelen_type
                                              perf_obj_time_timer
                                                              perf_elapsed_time
                                                                perf_precision_object_timer
WFor <counter> element with Id %1!u!(0x%1!x!), under <counterSet> '%2', attribute 'multiCounterID' is required, and the counter referenced by that attribute should be of type perf_counter_rawcount. This rule applies to following counter types: 

                                                                                  perf_counter_multi_timer
                                                        perf_counter_multi_timer_inv
                                                    perf_100nsec_multi_timer
                                                        perf_100nsec_multi_timer_inv
Two providers have defined a channel with duplicate name : '%1'. A given channel name can only be defined by one provider, other providers should use <importChannel> element to refer an existing channel.Two or more events logging to legacy 'System', 'Security' or 'Application' channels are referencing the same message string '%1'. Give each such event a unique message string.String '%1' is given Id %2!u!(0x%2!x!) in a .mc file. Change the Id of this string to be the same as that of the event referencing this string, since the event is logging to 'System', 'Security' or 'Application' channel.String '%1' is explicitly assigned Id %2!u!(0x%2!x!) using a <message> element. Change the Id of this string to be the same as that of the event referencing this string, since the event is logging to 'System', 'Security' or 'Application' channel.tFor event '%1', with Id %2!u!(0x%2!x!), since Opcode '%3' is local to Task '%4', event must reference the Task '%4'.nFor event '%1', with Id %2!u!(0x%2!x!), Opcode '%3' is local to Task '%4', but event is referencing Task '%5'.For event '%1', with Id %2!u!(0x%2!x!), Opcode '%3' is global, and its value collides with that of local Opcode '%4' of the Task '%5' that the event is referencing.3Duplicate Id %1!u!(0x%1!x!) used in Counter : '%2'.*Duplicate Uri '%1' used in Counter : '%2'.Duplicate Name used : '%1'.-Duplicate Symbol '%1' used in Counter : '%2'..Duplicate Guid '%1' used in CounterSet : '%2'.-Duplicate Uri '%1' used in CounterSet : '%2'.&Duplicate CounterSet Name used : '%1'.PA0Duplicate Symbol '%1' used in CounterSet : '%2'.,Duplicate Guid '%1' used in Provider : '%2'.$Duplicate Provider Name used : '%1'.Map '%1' cannot be empty.7Missing Attribute 'id' on one of the <string> elements.6For String with Id '%1', attribute 'value' is missing.*Duplicate Counter Struct Name used : '%1'.uFor <counter> element with Id %1!u!(0x%1!x!), under <counterSet> '%2', BaseId value refers to a non-existent counter.yFor <counter> element with Id %1!u!(0x%1!x!), under <counterSet> '%2', PerfTimeId value refers to a non-existent counter.yFor <counter> element with Id %1!u!(0x%1!x!), under <counterSet> '%2', PerfFreqId value refers to a non-existent counter.}For <counter> element with Id %1!u!(0x%1!x!), under <counterSet> '%2', MultiCounterId value refers to a non-existent counter.sFor <counter> element with Id %1!u!(0x%1!x!), under <counterSet> '%2', BaseId is not allowed for this counter type.wFor <counter> element with Id %1!u!(0x%1!x!), under <counterSet> '%2', PerfTimeId is not allowed for this counter type.wFor <counter> element with Id %1!u!(0x%1!x!), under <counterSet> '%2', PerfFreqId is not allowed for this counter type.{For <counter> element with Id %1!u!(0x%1!x!), under <counterSet> '%2', MultiCounterId is not allowed for this counter type.4VS_VERSION_INFO@@?StringFileInfo040904B0LCompanyNameMicrosoft Corporation^FileDescriptionEvent Trace Helper Libraryl&FileVersion6.1.7600.16385 (win7_rtm.090713-1255)0InternalNametdh.dll.LegalCopyright Microsoft Corporation. All rights reserved.@OriginalFilenametdh.dll.muij%ProductNameMicrosoft Windows Operating SystemBProductVersion6.1.7600.16385DVarFileInfo$Translation	<xs:schema targetNamespace="http://schemas.microsoft.com/win/2005/12/counters" elementFormDefault="qualified" xmlns:man="http://schemas.microsoft.com/win/2005/12/counters" xmlns:xs="http://www.w3.org/2001/XMLSchema">

  <xs:simpleType name="GUIDType">
    <xs:restriction base="xs:string">
      <xs:pattern value="\{[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}\}"/>
    </xs:restriction>
  </xs:simpleType>

  <xs:simpleType name="HexInt32Type">
    <xs:annotation>
      <xs:documentation>Hex 1-8 digits in size</xs:documentation>
    </xs:annotation>
    <xs:restriction base="xs:string">
      <xs:pattern value="0[xX][0-9A-Fa-f]{1,8}"/>
    </xs:restriction>
  </xs:simpleType>

  <xs:simpleType name="UInt32Type">
    <xs:annotation>
      <xs:documentation>Hex 1-8 digits in size or unsignedInt</xs:documentation>
    </xs:annotation>
    <xs:union memberTypes="xs:unsignedInt man:HexInt32Type"/>
  </xs:simpleType>

  <xs:simpleType name="CSymbolType">
    <xs:annotation>
      <xs:documentation>A Valid C Symbol or an empty string</xs:documentation>
    </xs:annotation>
    <xs:restriction base="xs:string">
      <xs:pattern value="()|([_a-zA-Z][_0-9a-zA-Z]*)"/>
    </xs:restriction>
  </xs:simpleType>

  <xs:complexType name="struct">
    <xs:simpleContent>
      <xs:extension base="xs:string">
        <xs:attribute name="name" type="man:CSymbolType" use="required"/>
        <xs:attribute name="type" type="man:CSymbolType" use="required"/>
      </xs:extension>
    </xs:simpleContent>
  </xs:complexType>

  <xs:complexType name="structs">
    <xs:choice minOccurs="1" maxOccurs="unbounded">
      <xs:element name="struct" type="man:struct"/>
    </xs:choice>
  </xs:complexType>
  
  <xs:complexType name="counterAttribute">
    <xs:simpleContent>
      <xs:extension base="xs:string">
        <xs:attribute name="name" use="required">
          <xs:simpleType>
            <xs:restriction base="xs:string">
              <xs:enumeration value="reference"/>
              <xs:enumeration value="noDisplay"/>
              <xs:enumeration value="noDigitGrouping"/>
              <xs:enumeration value="displayAsHex"/>
              <xs:enumeration value="displayAsReal"/>
            </xs:restriction>
          </xs:simpleType>
        </xs:attribute>
      </xs:extension>
    </xs:simpleContent>
  </xs:complexType>
  
  <xs:complexType name="counterAttributes">
    <xs:choice minOccurs="1" maxOccurs="5">
      <xs:element name="counterAttribute" type="man:counterAttribute"/>
    </xs:choice>
  </xs:complexType>
  
  <xs:complexType name="counter">
    <xs:choice minOccurs="0" maxOccurs="1">
      <xs:element name="counterAttributes" type="man:counterAttributes">
        <xs:key name="uniqueCounterAttributeName">
          <xs:annotation>
            <xs:documentation>
              Only five counterAttribute elements allowed, they should all be unique.
            </xs:documentation>
          </xs:annotation>
          <xs:selector xpath="./man:counterAttribute"/>
          <xs:field xpath="@name"/>
        </xs:key>
      </xs:element>
    </xs:choice>
    <xs:attribute name="symbol" type="man:CSymbolType" use="optional"/>
    <xs:attribute name="id" type="man:UInt32Type" use="required"/>
    <xs:attribute name="uri" type="xs:anyURI" use="required"/>
    <xs:attribute name="name" use="optional">
      <xs:simpleType>
        <xs:restriction base="xs:string">
          <xs:maxLength value="1023"/>
        </xs:restriction>
      </xs:simpleType>
    </xs:attribute>
    <xs:attribute name="description" type="xs:string" use="optional"/>
    <xs:attribute name="type" use="required">
      <xs:simpleType>
        <xs:restriction base="xs:string">
          <xs:enumeration value="perf_counter_counter"/>
          <xs:enumeration value="perf_counter_timer"/>
          <xs:enumeration value="perf_counter_queuelen_type"/>
          <xs:enumeration value="perf_counter_large_queuelen_type"/>
          <xs:enumeration value="perf_counter_100ns_queuelen_type"/>
          <xs:enumeration value="perf_counter_obj_time_queuelen_type"/>
          <xs:enumeration value="perf_counter_bulk_count"/>
          <xs:enumeration value="perf_counter_text"/>
          <xs:enumeration value="perf_counter_rawcount"/>
          <xs:enumeration value="perf_counter_large_rawcount"/>
          <xs:enumeration value="perf_counter_rawcount_hex"/>
          <xs:enumeration value="perf_counter_large_rawcount_hex"/>
          <xs:enumeration value="perf_sample_fraction"/>
          <xs:enumeration value="perf_sample_counter"/>
          <xs:enumeration value="perf_counter_timer_inv"/>
          <xs:enumeration value="perf_sample_base"/>
          <xs:enumeration value="perf_average_timer"/>
          <xs:enumeration value="perf_average_base"/>
          <xs:enumeration value="perf_average_bulk"/>
          <xs:enumeration value="perf_obj_time_timer"/>
          <xs:enumeration value="perf_100nsec_timer"/>
          <xs:enumeration value="perf_100nsec_timer_inv"/>
          <xs:enumeration value="perf_counter_multi_timer"/>
          <xs:enumeration value="perf_counter_multi_timer_inv"/>
          <xs:enumeration value="perf_counter_multi_base"/>
          <xs:enumeration value="perf_100nsec_multi_timer"/>
          <xs:enumeration value="perf_100nsec_multi_timer_inv"/>
          <xs:enumeration value="perf_raw_fraction"/>
          <xs:enumeration value="perf_large_raw_fraction"/>
          <xs:enumeration value="perf_raw_base"/>
          <xs:enumeration value="perf_large_raw_base"/>
          <xs:enumeration value="perf_elapsed_time"/>
          <xs:enumeration value="perf_counter_delta"/>
          <xs:enumeration value="perf_counter_large_delta"/>
          <xs:enumeration value="perf_precision_system_timer"/>
          <xs:enumeration value="perf_precision_100ns_timer"/>
          <xs:enumeration value="perf_precision_object_timer"/>
          <xs:enumeration value="perf_counter_composite"/>
        </xs:restriction>
      </xs:simpleType>
    </xs:attribute>
    <xs:attribute name="baseID" type="man:UInt32Type" use="optional"/>
    <xs:attribute name="detailLevel" use="required">
      <xs:simpleType>
        <xs:restriction base="xs:string">
          <xs:enumeration value="standard"/>
          <xs:enumeration value="advanced"/>
        </xs:restriction>
      </xs:simpleType>
    </xs:attribute>
    <xs:attribute name="defaultScale" use="optional" default="0">
      <xs:simpleType>
        <xs:restriction base="xs:integer">
          <xs:minInclusive value="-10"/>
          <xs:maxInclusive value="10"/>
        </xs:restriction>
      </xs:simpleType>
    </xs:attribute>
    <xs:attribute name="aggregate" use="optional">
      <xs:simpleType>
        <xs:restriction base="xs:string">
          <xs:enumeration value="sum"/>
          <xs:enumeration value="avg"/>
          <xs:enumeration value="max"/>
          <xs:enumeration value="min"/>
          <xs:enumeration value="undefined"/>
        </xs:restriction>
      </xs:simpleType>
    </xs:attribute>
    <xs:attribute name="perfTimeID" type="man:UInt32Type" use="optional"/>
    <xs:attribute name="perfFreqID" type="man:UInt32Type" use="optional"/>
    <xs:attribute name="multiCounterID" type="man:UInt32Type" use="optional"/>
    <xs:attribute name="struct" type="man:CSymbolType" use="optional">
      <xs:annotation>
        <xs:documentation>
          If providerType=userMode, required.
          If providerType=kernelMode, not allowed.
        </xs:documentation>
      </xs:annotation>
    </xs:attribute>
    <xs:attribute name="field" type="man:CSymbolType" use="optional">
      <xs:annotation>
        <xs:documentation>
          If providerType=userMode, required.
          If providerType=kernelMode, not allowed.
        </xs:documentation>
      </xs:annotation>
    </xs:attribute>
  </xs:complexType>

  <xs:complexType name="counterSet">
    <xs:sequence>
      <xs:element name="structs" type="man:structs" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>
            If providerType=userMode, required.
            If providerType=kernelMode, not allowed.
          </xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="counter" type="man:counter" minOccurs="1" maxOccurs="unbounded"/>
    </xs:sequence>
    <xs:attribute name="symbol" type="man:CSymbolType" use="required"/>
    <xs:attribute name="guid" type="man:GUIDType" use="required"/>
    <xs:attribute name="uri" type="xs:anyURI" use="required"/>
    <xs:attribute name="name" use="required">
      <xs:simpleType>
        <xs:restriction base="xs:string">
          <xs:maxLength value="1023"/>
        </xs:restriction>
      </xs:simpleType>
    </xs:attribute>
    <xs:attribute name="description" use="required"/>
    <xs:attribute name="instances" use="optional" default="single">
      <xs:simpleType>
        <xs:restriction base="xs:string">
          <xs:enumeration value="single"/>
          <xs:enumeration value="multiple"/>
          <xs:enumeration value="globalAggregate"/>
          <xs:enumeration value="multipleAggregate"/>
          <xs:enumeration value="globalAggregateHistory"/>
        </xs:restriction>
      </xs:simpleType>
    </xs:attribute>
  </xs:complexType>
  
  <xs:complexType name="provider">
    <xs:choice minOccurs="0" maxOccurs="unbounded">
      <xs:element name="counterSet" type="man:counterSet">
        <xs:key name="uniqueCounterID">
          <xs:annotation>
            <xs:documentation>
              Counter Id should be unique within the counter set.
            </xs:documentation>
          </xs:annotation>
          <xs:selector xpath="./man:counter"/>
          <xs:field xpath="@id"/>
        </xs:key>
        <xs:unique name="uniqueCounterName">
          <xs:annotation>
            <xs:documentation>
              Counter Name must be unique within the Counter Set. The name is
              case-sensitive.
            </xs:documentation>
          </xs:annotation>
          <xs:selector xpath="./man:counter"/>
          <xs:field xpath="@name"/>
        </xs:unique>
        <xs:keyref name="existBaseID" refer="man:uniqueCounterID">
          <xs:annotation>
            <xs:documentation>
              A counter with this ID must exist within the same counter set.
            </xs:documentation>
          </xs:annotation>
          <xs:selector xpath="./man:counter"/>
          <xs:field xpath="@baseID"/>
        </xs:keyref>
        <xs:keyref name="existPerfTimeID" refer="man:uniqueCounterID">
          <xs:annotation>
            <xs:documentation>
              A counter with this ID must exist within the same counter set.
            </xs:documentation>
          </xs:annotation>
          <xs:selector xpath="./man:counter"/>
          <xs:field xpath="@perfTimeID"/>
        </xs:keyref>
        <xs:keyref name="existPerfFreqID" refer="man:uniqueCounterID">
          <xs:annotation>
            <xs:documentation>
              A counter with this ID must exist within the same counter set.
            </xs:documentation>
          </xs:annotation>
          <xs:selector xpath="./man:counter"/>
          <xs:field xpath="@perfFreqID"/>
        </xs:keyref>
        <xs:keyref name="existMultiCounterID" refer="man:uniqueCounterID">
          <xs:annotation>
            <xs:documentation>
              A counter with this ID must exist within the same counter set.
            </xs:documentation>
          </xs:annotation>
          <xs:selector xpath="./man:counter"/>
          <xs:field xpath="@multiCounterID"/>
        </xs:keyref>
        <xs:key name="uniqueStructNames">
          <xs:annotation>
            <xs:documentation>
              Since struct names map to function parameters in generated code,
              they should be unique.
            </xs:documentation>
          </xs:annotation>
          <xs:selector xpath="./man:structs/man:struct"/>
          <xs:field xpath="@name"/>
        </xs:key>
        <xs:keyref name="existCounterName" refer="man:uniqueStructNames">
          <xs:annotation>
            <xs:documentation>
              Counter name must exist.
            </xs:documentation>
          </xs:annotation>
          <xs:selector xpath="./man:counter"/>
          <xs:field xpath="@struct"/>
        </xs:keyref>
      </xs:element>
    </xs:choice>
    <xs:attribute name="symbol" type="man:CSymbolType" use="optional">
      <xs:annotation>
        <xs:documentation>
          Provider Symbol is required for User Mode providers.
        </xs:documentation>
      </xs:annotation>
    </xs:attribute>
    <xs:attribute name="callback" use="optional" default="default">
      <xs:simpleType>
        <xs:restriction base="xs:string">
          <xs:enumeration value="custom"/>
          <xs:enumeration value="default"/>
        </xs:restriction>
      </xs:simpleType>
    </xs:attribute>
    <xs:attribute name="providerGuid" type="man:GUIDType" use="required"/>
    <xs:attribute name="applicationIdentity" type="xs:string" use="required"/>
    <xs:attribute name="providerType" use="optional" default="userMode">
      <xs:simpleType>
        <xs:restriction base="xs:string">
          <xs:enumeration value="userMode"/>
          <xs:enumeration value="kernelMode"/>
        </xs:restriction>
      </xs:simpleType>
    </xs:attribute>
    <xs:attribute name="providerName" type="xs:string" use="optional" default="Counters"/>
    <xs:attribute name="resourceBase" type="man:UInt32Type" use="optional"/>
  </xs:complexType>
  
  <xs:complexType name="counters">
    <xs:choice minOccurs="1" maxOccurs="1">
      <xs:element name="provider" type="man:provider"/>
    </xs:choice>
    <xs:attribute name="schemaVersion" use="required">
      <xs:simpleType>
        <xs:restriction base="xs:string">
          <xs:enumeration value="1.1"/>
        </xs:restriction>
      </xs:simpleType>
    </xs:attribute>
  </xs:complexType>
  
  <xs:element name="counters" type="man:counters">
    <xs:key name="uniqueprovGUID">
      <xs:annotation>
        <xs:documentation>
          Provider GUID should be unique across the entire document.
        </xs:documentation>
      </xs:annotation>
      <xs:selector xpath="./man:provider"/>
      <xs:field xpath="@providerGuid"/>
    </xs:key>
    <xs:key name="uniqueCounterSetGUID">
      <xs:annotation>
        <xs:documentation>
          Counter Set GUID should be unique across the entire document. The
          counter set registration fails if the GUID is already registered.
          To update a counter set that is registered, you must first
          uninstall the counter set and register it again.
        </xs:documentation>
      </xs:annotation>
      <xs:selector xpath="./man:provider/man:counterSet"/>
      <xs:field xpath="@guid"/>
    </xs:key>
    <xs:key name="uniqueCounterSetURI">
      <xs:annotation>
        <xs:documentation>
          Counter Set URI should be unique across the entire document. The URI
          helps users access the counters in the counter set from any location.
        </xs:documentation>
      </xs:annotation>
      <xs:selector xpath="./man:provider/man:counterSet"/>
      <xs:field xpath="@uri"/>
    </xs:key>
    <xs:key name="uniqueCounterSetName">
      <xs:annotation>
        <xs:documentation>
          Counter Set Name should be unique across the entire document. The
          name is case-sensitive.
        </xs:documentation>
      </xs:annotation>
      <xs:selector xpath="./man:provider/man:counterSet"/>
      <xs:field xpath="@name"/>
    </xs:key>
    <xs:key name="uniqueCounterSetSymbol">
      <xs:annotation>
        <xs:documentation>
          Counter Set Symbol should be unique across the entire document. The
          Symbol is case-sensitive.
        </xs:documentation>
      </xs:annotation>
      <xs:selector xpath="./man:provider/man:counterSet"/>
      <xs:field xpath="@symbol"/>
    </xs:key>
    <xs:unique name="uniqueCounterSymbol">
      <xs:annotation>
        <xs:documentation>
          Counter Symbol should be unique across the entire document. The
          Symbol is case-sensitive.
        </xs:documentation>
      </xs:annotation>
      <xs:selector xpath="./man:provider/man:counterSet/man:counter"/>
      <xs:field xpath="@symbol"/>
    </xs:unique>
    <xs:key name="uniqueCounterURI">
      <xs:annotation>
        <xs:documentation>
          Counter URI must be unique across the entire document. This lets
          users retrieve the counter values from any location.
        </xs:documentation>
      </xs:annotation>
      <xs:selector xpath="./man:provider/man:counterSet/man:counter"/>
      <xs:field xpath="@uri"/>
    </xs:key>
  </xs:element>
  
</xs:schema>
<xs:schema targetNamespace="http://schemas.microsoft.com/win/2004/08/events" elementFormDefault="qualified" xmlns:man="http://schemas.microsoft.com/win/2004/08/events" xmlns:xs="http://www.w3.org/2001/XMLSchema">
  <xs:simpleType name="GUIDType">
    <xs:annotation>
      <xs:documentation>
        A globally unique identifier in Registry format.
        e.g. {12345678-4321-ABCD-1234-9ABCDEF012345678}.
        Use GUIDGen.exe or UUIDGen.exe to create a GUID.
      </xs:documentation>
    </xs:annotation>
    <xs:restriction base="xs:string">
      <xs:pattern value="\{[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}\}"/>
    </xs:restriction>
  </xs:simpleType>
  <xs:simpleType name="CSymbolType">
    <xs:annotation>
      <xs:documentation>
        Symbol is used for code-generation. It should be a valid C Symbol or an empty string.
      </xs:documentation>
    </xs:annotation>
    <xs:restriction base="xs:string">
      <xs:pattern value="()|([_a-zA-Z][_0-9a-zA-Z]*)"/>
    </xs:restriction>
  </xs:simpleType>
  <xs:simpleType name="HexInt8Type">
    <xs:annotation>
      <xs:documentation> Hex 1-2 digits in size</xs:documentation>
    </xs:annotation>
    <xs:restriction base="xs:string">
      <xs:pattern value="0[xX][0-9A-Fa-f]{1,2}"/>
    </xs:restriction>
  </xs:simpleType>
  <xs:simpleType name="HexInt16Type">
    <xs:annotation>
      <xs:documentation> Hex 1-4 digits in size</xs:documentation>
    </xs:annotation>
    <xs:restriction base="xs:string">
      <xs:pattern value="0[xX][0-9A-Fa-f]{1,4}"/>
    </xs:restriction>
  </xs:simpleType>
  <xs:simpleType name="HexInt32Type">
    <xs:annotation>
      <xs:documentation> Hex 1-8 digits in size</xs:documentation>
    </xs:annotation>
    <xs:restriction base="xs:string">
      <xs:pattern value="0[xX][0-9A-Fa-f]{1,8}"/>
    </xs:restriction>
  </xs:simpleType>
  <xs:simpleType name="HexInt64Type">
    <xs:annotation>
      <xs:documentation>Hex 1-16 digits in size.</xs:documentation>
    </xs:annotation>
    <xs:restriction base="xs:string">
      <xs:pattern value="0[xX][0-9A-Fa-f]{1,16}"/>
    </xs:restriction>
  </xs:simpleType>
  <xs:simpleType name="UInt8Type">
    <xs:annotation>
      <xs:documentation> Hex 1-2 digits in size or unsignedByte</xs:documentation>
    </xs:annotation>
    <xs:union memberTypes="xs:unsignedByte man:HexInt8Type"/>
  </xs:simpleType>
  <xs:simpleType name="UInt16Type">
    <xs:annotation>
      <xs:documentation> Hex 1-4 digits in size or unsignedShort</xs:documentation>
    </xs:annotation>
    <xs:union memberTypes="xs:unsignedShort man:HexInt16Type"/>
  </xs:simpleType>
  <xs:simpleType name="UInt32Type">
    <xs:annotation>
      <xs:documentation>UnsignedInt or Hex 1-8 digits in size.</xs:documentation>
    </xs:annotation>
    <xs:union memberTypes="xs:unsignedInt man:HexInt32Type"/>
  </xs:simpleType>
  <xs:simpleType name="UInt64Type">
    <xs:annotation>
      <xs:documentation> Hex 1-16 digits in size or unsignedLong</xs:documentation>
    </xs:annotation>
    <xs:union memberTypes="xs:unsignedLong man:HexInt64Type"/>
  </xs:simpleType>
  <xs:simpleType name="LengthType">
    <xs:annotation>
      <xs:documentation> Length property name string or unsignedShort</xs:documentation>
    </xs:annotation>
    <xs:union memberTypes="xs:unsignedShort xs:string"/>
  </xs:simpleType>
  <xs:simpleType name="CountType">
    <xs:annotation>
      <xs:documentation> Count property name string or unsignedShort</xs:documentation>
    </xs:annotation>
    <xs:union memberTypes="xs:unsignedShort xs:string"/>
  </xs:simpleType>

  <xs:simpleType name="strTableRef">
    <xs:annotation>
      <xs:documentation>
        Value of this attribute should be of the form $(string.stringTableId),
        where stringTableId is the 'id' attribute of a &lt;string&gt; element
        defined in the &lt;stringTable&gt; section. Or it could be of the form
        $(mc.mcSymbolId), where mcSymbolId is the symbol of a message string
        defined in a .mc file.
      </xs:documentation>
    </xs:annotation>
    <xs:restriction base="xs:string">
      <xs:pattern value="(\$\([Ss]tring\..*\))|(\$\([Mm][Cc]\..*\))"/>
    </xs:restriction>
  </xs:simpleType>

  <xs:simpleType name="filePath">
    <xs:annotation>
      <xs:documentation>
        A fully-qualified path to a file. Standard Windows environment variables are
        allowed. Typically, the file is of type .exe, .dll, or .sys.
      </xs:documentation>
    </xs:annotation>
    <xs:restriction base="xs:string">
    </xs:restriction>
  </xs:simpleType>

  <xs:complexType name="FilterType" mixed="true">
    <xs:simpleContent>
      <xs:extension base="xs:string">
        <xs:attribute name="value" type="man:UInt8Type" use="required"/>
        <xs:attribute name="version" type="man:UInt8Type" use="optional"/>
        <xs:attribute name="name" type="xs:QName" use="required"/>
        <xs:attribute name="symbol" type="man:CSymbolType" use="optional"/>
        <xs:attribute name="message" type="man:strTableRef" use="optional"/>
        <xs:attribute name="tid" type="xs:token" use="optional"/>
      </xs:extension>
    </xs:simpleContent>
  </xs:complexType>
  <xs:complexType name="FilterListType" mixed="true">
    <xs:sequence>
      <xs:element name="filter" type="man:FilterType" minOccurs="0" maxOccurs="unbounded"/>
    </xs:sequence>
  </xs:complexType>

  <xs:complexType name="KeywordType" mixed="true">
    <xs:simpleContent>
      <xs:extension base="xs:string">
        <xs:attribute name="name" type="xs:QName" use="required">
          <xs:annotation>
            <xs:documentation>
              Each keyword must have a unique name, which is used to reference the keyword
              from the events section of the manifest.
            </xs:documentation>
          </xs:annotation>
        </xs:attribute>
        <xs:attribute name="symbol" type="man:CSymbolType" use="optional"/>
        <xs:attribute name="mask" type="man:HexInt64Type" use="required">
          <xs:annotation>
            <xs:documentation>
              Mask is a 64-bit value, in which, only one bit is set. Mask value cannot be zero.
              Leftmost 16 bits of the mask are reserved for use by winmeta.xml.
            </xs:documentation>
          </xs:annotation>
        </xs:attribute>
        <xs:attribute name="message" type="man:strTableRef" use="optional"/>
        <xs:anyAttribute namespace="##other" processContents="lax"/>
      </xs:extension>
    </xs:simpleContent>
  </xs:complexType>

  <xs:complexType name="KeywordListType">
    <xs:annotation>
      <xs:documentation>
        Use keywords to group events together. At run-time, it is possible to enable
        events belonging to only certain groups (i.e. keywords). This is one way to
        filter out unwanted events at the time of logging.
      </xs:documentation>
    </xs:annotation>
    <xs:sequence>
      <xs:element name="keyword" type="man:KeywordType" minOccurs="0" maxOccurs="unbounded"/>
    </xs:sequence>
  </xs:complexType>

  <xs:complexType name="OpcodeType" mixed="true">
    <xs:simpleContent>
      <xs:extension base="xs:string">
        <xs:attribute name="name" type="xs:QName" use="required"/>
        <xs:attribute name="symbol" type="man:CSymbolType" use="optional"/>
        <xs:attribute name="value" type="man:UInt8Type" use="required"/>
        <xs:attribute name="mofValue" type="man:UInt8Type" use="optional"/>
        <xs:attribute name="message" type="man:strTableRef" use="optional"/>
        <xs:anyAttribute namespace="##other" processContents="lax"/>
      </xs:extension>
    </xs:simpleContent>
  </xs:complexType>

  <xs:complexType name="OpcodeListType">
    <xs:annotation>
      <xs:documentation>
        Use opcodes, in conjunction with a task, to describe different milestones within
        an activity.
      </xs:documentation>
    </xs:annotation>
    <xs:sequence>
      <xs:element name="opcode" type="man:OpcodeType" minOccurs="0" maxOccurs="unbounded"/>
    </xs:sequence>
  </xs:complexType>

  <xs:complexType name="LevelType" mixed="true">
    <xs:simpleContent>
      <xs:extension base="xs:string">
        <xs:attribute name="name" type="xs:QName" use="required"/>
        <xs:attribute name="symbol" type="man:CSymbolType" use="optional"/>
        <xs:attribute name="value" type="man:UInt8Type" use="required"/>
        <xs:attribute name="message" type="man:strTableRef" use="optional"/>
        <xs:anyAttribute namespace="##other" processContents="lax"/>
      </xs:extension>
    </xs:simpleContent>
  </xs:complexType>
  <xs:complexType name="LevelListType">
    <xs:annotation>
      <xs:documentation>
        Use levels to control the verbosity of events during logging. At run-time,
        a provider can be enabled with a certain level value, and only events with
        a level value less than or equal to the specified value will get logged.
      </xs:documentation>
    </xs:annotation>
    <xs:sequence>
      <xs:element name="level" type="man:LevelType" minOccurs="0" maxOccurs="unbounded"/>
    </xs:sequence>
  </xs:complexType>

  <xs:complexType name="TaskType" mixed="true">
    <xs:sequence>
        <xs:element name="opcodes" type="man:OpcodeListType" minOccurs="0"/>
    </xs:sequence>
    <xs:attribute name="name" type="xs:QName" use="required"/>
    <xs:attribute name="symbol" type="man:CSymbolType" use="optional"/>
    <xs:attribute name="value" type="man:UInt16Type" use="required"/>
    <xs:attribute name="eventGUID" type="man:GUIDType" use="optional"/>
    <xs:attribute name="message" type="man:strTableRef" use="optional"/>
    <xs:anyAttribute namespace="##other" processContents="lax"/>
  </xs:complexType>
  <xs:complexType name="TaskListType">
    <xs:annotation>
      <xs:documentation>
        Use tasks to describe an activity. Use opcodes to describe each unit of work
        within an activity.
      </xs:documentation>
    </xs:annotation>
    <xs:sequence>
      <xs:element name="task" type="man:TaskType" minOccurs="0" maxOccurs="unbounded"/>
    </xs:sequence>
  </xs:complexType>

  <xs:complexType name="StringTableType">
    <xs:choice minOccurs="0" maxOccurs="unbounded">
      <xs:element name="string">
        <xs:complexType mixed="true">
          <xs:attribute name="id" type="xs:string" use="required"/>
          <xs:attribute name="value" type="xs:string" use="required"/>
          <xs:attribute name="stringType" type="xs:string" use="optional"/>
        </xs:complexType>
      </xs:element>
    </xs:choice>
    <xs:anyAttribute namespace="##other" processContents="lax"/>
  </xs:complexType>

  <xs:complexType name="ChannelLoggingType">
    <xs:annotation>
      <xs:documentation>Channel logging config</xs:documentation>
    </xs:annotation>
    <xs:sequence minOccurs="0">
      <xs:element name="autoBackup" type="xs:boolean" minOccurs="0"/>
      <xs:element name="retention" type="xs:boolean" default="false" minOccurs="0"/>
      <xs:element name="maxSize" type="man:UInt64Type" default="1048576" minOccurs="0"/>
      <xs:any namespace="##other" processContents="lax" minOccurs="0" maxOccurs="unbounded"/>
    </xs:sequence>
    <xs:anyAttribute namespace="##other" processContents="lax"/>
  </xs:complexType>

  <xs:complexType name="ChannelPublishingType">
    <xs:annotation>
      <xs:documentation>Channel publishing config</xs:documentation>
    </xs:annotation>
    <xs:sequence minOccurs="0">
      <xs:element name="level" type="man:UInt8Type" default="0" minOccurs="0"/>
      <xs:element name="keywords" type="man:UInt64Type" default="0" minOccurs="0"/>
      <xs:element name="controlGuid" type="man:GUIDType" minOccurs="0"/>
      <xs:element name="bufferSize" type="man:UInt32Type" minOccurs="0">
        <xs:annotation>
          <xs:documentation>Amount of memory allocated for the session buffers (KB)</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="fileMax" type="man:UInt32Type" minOccurs="0">
        <xs:annotation>
          <xs:documentation>Number of etl files to create across enablement</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="minBuffers" type="man:UInt32Type" minOccurs="0">
        <xs:annotation>
          <xs:documentation>Minimum number of session buffers</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="maxBuffers" type="man:UInt32Type" minOccurs="0">
        <xs:annotation>
          <xs:documentation>Maximum number of session buffers</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="latency" type="man:UInt32Type" minOccurs="0">
        <xs:annotation>
          <xs:documentation>Buffer flush interval (sec)</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="clockType" default="SystemTime" minOccurs="0">
        <xs:annotation>
          <xs:documentation>Clock resolution</xs:documentation>
        </xs:annotation>
        <xs:simpleType>
          <xs:restriction base="xs:string">
            <xs:enumeration value="SystemTime"/>
            <xs:enumeration value="QPC"/>
          </xs:restriction>
        </xs:simpleType>
      </xs:element>
      <xs:element name="sidType" minOccurs="0">
        <xs:simpleType>
          <xs:restriction base="xs:string">
            <xs:enumeration value="None"/>
            <xs:enumeration value="Publishing"/>
          </xs:restriction>
        </xs:simpleType>
      </xs:element>
      <xs:any namespace="##other" processContents="lax" minOccurs="0" maxOccurs="unbounded"/>
    </xs:sequence>
    <xs:anyAttribute namespace="##other" processContents="lax"/>
  </xs:complexType>

  <xs:complexType name="ChannelType" mixed="true">
    <xs:sequence>
      <xs:element name="logging" type="man:ChannelLoggingType" minOccurs="0"/>
      <xs:element name="publishing" type="man:ChannelPublishingType" minOccurs="0"/>
      <xs:any namespace="##other" processContents="lax" minOccurs="0" maxOccurs="unbounded"/>
    </xs:sequence>
    <xs:attribute name="name" type="xs:anyURI" use="required"/>
    <xs:attribute name="chid" type="xs:token" use="optional"/>
    <xs:attribute name="type" use="required">
      <xs:simpleType>
        <xs:restriction base="xs:string">
          <xs:enumeration value="Admin"/>
          <xs:enumeration value="Operational"/>
          <xs:enumeration value="Analytic"/>
          <xs:enumeration value="Debug"/>
        </xs:restriction>
      </xs:simpleType>
    </xs:attribute>
    <xs:attribute name="symbol" type="man:CSymbolType" use="optional"/>
    <xs:attribute name="access" type="xs:string" use="optional"/>
    <xs:attribute name="isolation" use="optional">
      <xs:annotation>
        <xs:documentation>Default publishing session/security if not specified explicitly by the channel access attribute.</xs:documentation>
      </xs:annotation>
      <xs:simpleType>
        <xs:restriction base="xs:string">
          <xs:enumeration value="Application"/>
          <xs:enumeration value="System"/>
          <xs:enumeration value="Custom"/>
        </xs:restriction>
      </xs:simpleType>
    </xs:attribute>
    <xs:attribute name="enabled" type="xs:boolean" use="optional" default="false"/>
    <xs:attribute name="value" type="man:UInt8Type" use="optional"/>
    <xs:attribute name="message" type="man:strTableRef" use="optional"/>
    <xs:anyAttribute namespace="##other" processContents="lax"/>
  </xs:complexType>

  <xs:complexType name="ChannelListType">
    <xs:annotation>
      <xs:documentation>
        Use channels to describe the destinations for your events. Each channel you
        define here will show up in the Windows Event Viewer.
      </xs:documentation>
    </xs:annotation>
    <xs:choice minOccurs="0" maxOccurs="8">
      <xs:element name="importChannel" type="man:ImportChannelType"/>
      <xs:element name="channel" type="man:ChannelType"/>
      <xs:any namespace="##other" processContents="lax"/>
    </xs:choice>
    <xs:anyAttribute namespace="##other"/>
  </xs:complexType>

  <xs:complexType name="DataDefinitionType" mixed="true">
    <xs:simpleContent>
      <xs:extension base="xs:string">
        <xs:attribute name="name" type="xs:string" use="required"/>
        <xs:attribute name="inType" type="xs:QName" use="required"/>
        <xs:attribute name="outType" type="xs:QName" use="optional"/>
        <xs:attribute name="map" type="xs:string" use="optional"/>
        <xs:attribute name="length" type="man:LengthType" use="optional"/>
        <xs:attribute name="count" type="man:CountType" use="optional"/>
        <xs:anyAttribute namespace="##other" processContents="lax"/>
      </xs:extension>
    </xs:simpleContent>
  </xs:complexType>

  <xs:complexType name="StructDefinitionType" mixed="true">
    <xs:sequence>
      <xs:element name="data" type="man:DataDefinitionType" maxOccurs="unbounded"/>
    </xs:sequence>
    <xs:attribute name="name" type="xs:string" use="required"/>
    <xs:attribute name="count" type="man:CountType" use="optional"/>
    <xs:anyAttribute namespace="##other" processContents="lax"/>
  </xs:complexType>

  <xs:complexType name="XmlType">
    <xs:sequence>
      <xs:any namespace="##other" processContents="lax" minOccurs="0" maxOccurs="unbounded"/>
    </xs:sequence>
  </xs:complexType>

  <xs:complexType name="TemplateItemType">
    <xs:sequence maxOccurs="unbounded">
      <xs:choice minOccurs="0" maxOccurs="unbounded">
        <xs:element name="data" type="man:DataDefinitionType"/>
        <xs:element name="struct" type="man:StructDefinitionType"/>
      </xs:choice>
      <xs:element name="binary" minOccurs="0">
        <xs:annotation>
          <xs:documentation>Represents binary data in classic eventlog API</xs:documentation>
        </xs:annotation>
        <xs:complexType>
          <xs:attribute name="name" type="xs:string" use="optional"/>
        </xs:complexType>
      </xs:element>
      <xs:element name="UserData" type="man:XmlType" minOccurs="0"/>
    </xs:sequence>
    <xs:attribute name="tid" type="xs:token" use="required"/>
    <xs:attribute name="name" type="xs:string" use="optional"/>
    <xs:anyAttribute namespace="##other" processContents="lax"/>
  </xs:complexType>

  <xs:complexType name="TemplateListType">
    <xs:annotation>
      <xs:documentation>
        Use templates to describe the payload logged by an event. Different events can
        share a template.
      </xs:documentation>
    </xs:annotation>
    <xs:sequence>
      <xs:element name="template" type="man:TemplateItemType" minOccurs="0" maxOccurs="unbounded"/>
    </xs:sequence>
  </xs:complexType>

  <xs:complexType name="XmlTypeListType">
    <xs:sequence>
      <xs:element name="xmlType" minOccurs="0" maxOccurs="unbounded">
        <xs:complexType>
          <xs:complexContent>
            <xs:extension base="man:XmlType">
              <xs:attribute name="name" type="xs:QName" use="required"/>
              <xs:attribute name="value" type="xs:string" use="required"/>
              <xs:attribute name="symbol" type="man:CSymbolType" use="required"/>
            </xs:extension>
          </xs:complexContent>
        </xs:complexType>
      </xs:element>
    </xs:sequence>
  </xs:complexType>

  <xs:complexType name="OutputType">
    <xs:simpleContent>
      <xs:extension base="xs:string">
        <xs:attribute name="default" type="xs:boolean" use="optional"/>
        <xs:attribute name="xmlType" type="xs:QName" use="required"/>
      </xs:extension>
    </xs:simpleContent>
  </xs:complexType>

  <xs:complexType name="InputType">
    <xs:sequence>
      <xs:element name="description" type="xs:string"/>
      <xs:element name="outType" type="man:OutputType" minOccurs="0" maxOccurs="unbounded"/>
      <xs:any namespace="##other" processContents="lax" minOccurs="0" maxOccurs="unbounded"/>
    </xs:sequence>
    <xs:attribute name="name" type="xs:QName" use="required"/>
    <xs:attribute name="value" type="xs:string" use="required"/>
    <xs:attribute name="symbol" type="man:CSymbolType" use="required"/>
  </xs:complexType>

  <xs:complexType name="TypeListType">
    <xs:choice maxOccurs="unbounded">
      <xs:element name="xmlTypes" type="man:XmlTypeListType"/>
      <xs:element name="inTypes" type="man:InputTypeListType"/>
      <xs:any namespace="##other" processContents="lax" minOccurs="0"/>
    </xs:choice>
  </xs:complexType>

  <xs:complexType name="InputTypeListType">
    <xs:sequence>
      <xs:element name="inType" type="man:InputType" maxOccurs="unbounded"/>
    </xs:sequence>
  </xs:complexType>

  <xs:simpleType name="QNameList">
    <xs:list itemType="xs:QName"/>
  </xs:simpleType>

  <xs:complexType name="ImportChannelType" mixed="true">
    <xs:simpleContent>
      <xs:extension base="xs:string">
        <xs:attribute name="chid" type="xs:token" use="optional"/>
        <xs:attribute name="name" type="xs:anyURI" use="required"/>
        <xs:attribute name="symbol" type="man:CSymbolType" use="optional"/>
      </xs:extension>
    </xs:simpleContent>
  </xs:complexType>

  <xs:complexType name="EventDefinitionType">
    <xs:simpleContent>
      <xs:extension base="xs:string">
        <xs:attribute name="value" type="man:UInt32Type" use="required">
          <xs:annotation>
            <xs:documentation>
              Also referred to as the Event-Id. An ETW event is uniquely identified by the
              {Provider-Guid,Event-Id,Event-Version} tuple.
            </xs:documentation>
          </xs:annotation>
        </xs:attribute>
          <xs:attribute name="level" type="xs:QName" use="optional">
            <xs:annotation>
              <xs:documentation>
                Reference to a &lt;level&gt; element defined in the &lt;levels&gt; section.
                Refer to a level by its attribute 'name'.
              </xs:documentation>
            </xs:annotation>
          </xs:attribute>
          <xs:attribute name="template" type="xs:token" use="optional"/>
          <xs:attribute name="channel" type="xs:token" use="optional"/>
          <xs:attribute name="keywords" type="man:QNameList" use="optional"/>
          <xs:attribute name="task" type="xs:QName" use="optional"/>
          <xs:attribute name="opcode" type="xs:QName" use="optional"/>
          <xs:attribute name="symbol" type="man:CSymbolType" use="optional"/>
        <xs:attribute name="version" type="man:UInt8Type" use="optional">
          <xs:annotation>
            <xs:documentation>
              It is advisable to increment the version of an event if its template is modified
              between releases.
            </xs:documentation>
          </xs:annotation>
        </xs:attribute>
            <xs:attribute name="message" type="man:strTableRef" use="optional"/>
            <xs:attribute name="notLogged" type="xs:boolean" use="optional" default="false">
              <xs:annotation>
                <xs:documentation>
                  Use this to indicate that this event has been removed and will not be logged
                  by this version of the provider. The description of the event should be retained
                  in this manifest so that if an etl file collected from an older version of the
                  provider on a different machine is brought to this machine, it can be correctly
                  decoded on this machine.
                </xs:documentation>
              </xs:annotation>
            </xs:attribute>
          </xs:extension>
    </xs:simpleContent>
  </xs:complexType>

  <xs:complexType name="MapType">
    <xs:choice maxOccurs="unbounded">
      <xs:element name="valueMap" type="man:ValueMapType"/>
      <xs:element name="bitMap" type="man:BitMapType"/>
    </xs:choice>
  </xs:complexType>

  <xs:complexType name="ValueMapType">
    <xs:sequence>
      <xs:element name="map" type="man:ValueMapValueType" maxOccurs="unbounded"/>
    </xs:sequence>
    <xs:attribute name="name" type="xs:string" use="required"/>
    <xs:attribute name="symbol" type="man:CSymbolType" use="optional"/>
  </xs:complexType>

  <xs:complexType name="ValueMapValueType" mixed="true">
    <xs:simpleContent>
      <xs:extension base="xs:string">
        <xs:attribute name="value" type="man:UInt32Type" use="required"/>
        <xs:attribute name="message" type="man:strTableRef" use="required"/>
        <xs:attribute name="symbol" type="man:CSymbolType" use="optional"/>
      </xs:extension>
    </xs:simpleContent>
  </xs:complexType>

  <xs:complexType name="BitMapType">
    <xs:sequence>
      <xs:element name="map" type="man:BitMapValueType" maxOccurs="unbounded"/>
    </xs:sequence>
    <xs:attribute name="name" type="xs:string" use="required"/>
    <xs:attribute name="symbol" type="man:CSymbolType" use="optional"/>
  </xs:complexType>

  <xs:complexType name="BitMapValueType" mixed="true">
    <xs:simpleContent>
      <xs:extension base="xs:string">
        <xs:attribute name="value" type="man:HexInt32Type" use="required"/>
        <xs:attribute name="message" type="man:strTableRef" use="required"/>
        <xs:attribute name="symbol" type="man:CSymbolType" use="optional"/>
      </xs:extension>
    </xs:simpleContent>
  </xs:complexType>

  <xs:complexType name="NamedQueryType">
    <xs:sequence>
      <xs:element name="patternMaps" type="man:PatternMapListType" minOccurs="0"/>
      <xs:any namespace="##other" processContents="lax" minOccurs="0" maxOccurs="unbounded"/>
    </xs:sequence>
    <xs:anyAttribute namespace="##other" processContents="lax"/>
  </xs:complexType>

  <xs:complexType name="PatternMapListType">
    <xs:sequence>
      <xs:element name="patternMap" type="man:PatternMapType" maxOccurs="unbounded"/>
    </xs:sequence>
  </xs:complexType>

  <xs:complexType name="PatternMapType">
    <xs:sequence>
      <xs:element name="map" type="man:PatternMapValueType" maxOccurs="unbounded"/>
    </xs:sequence>
    <xs:attribute name="name" type="xs:QName" use="required"/>
    <xs:attribute name="format" type="xs:anyURI" use="required"/>
    <xs:attribute name="symbol" type="man:CSymbolType" use="optional"/>
  </xs:complexType>

  <xs:complexType name="PatternMapValueType">
    <xs:simpleContent>
      <xs:extension base="xs:string">
        <xs:attribute name="name" type="xs:string" use="required"/>
        <xs:attribute name="value" type="xs:string" use="required"/>
      </xs:extension>
    </xs:simpleContent>
  </xs:complexType>

  <xs:complexType name="DefinitionType">
    <xs:annotation>
      <xs:documentation>
        List all events logged by the provider in this section.
      </xs:documentation>
    </xs:annotation>
    <xs:choice minOccurs="0" maxOccurs="unbounded">
      <xs:element name="event" type="man:EventDefinitionType"/>
    </xs:choice>
  </xs:complexType>

  <xs:complexType name="ProviderType">
    <xs:choice minOccurs="0" maxOccurs="unbounded">
      <xs:element name="channels" type="man:ChannelListType"/>
      <xs:element name="levels" type="man:LevelListType"/>
      <xs:element name="tasks" type="man:TaskListType"/>
      <xs:element name="opcodes" type="man:OpcodeListType"/>
      <xs:element name="keywords" type="man:KeywordListType"/>
      <xs:element name="maps" type="man:MapType"/>
      <xs:element name="namedQueries" type="man:NamedQueryType"/>
      <xs:element name="templates" type="man:TemplateListType"/>
      <xs:element name="events" type="man:DefinitionType"/>
      <xs:element name="filters" type="man:FilterListType"/>
      <xs:any namespace="##other" processContents="lax"/>
    </xs:choice>
    <xs:attribute name="name" type="xs:anyURI" use="required"/>
    <xs:attribute name="guid" type="man:GUIDType" use="required"/>
    <xs:attribute name="resourceFileName" type="man:filePath" use="optional">
      <xs:annotation>
        <xs:documentation>
          Name of the executable file to which the provider's metadata resource is linked,
          usually the same as the provider's binary.
        </xs:documentation>
      </xs:annotation>
    </xs:attribute>
    <xs:attribute name="messageFileName" type="man:filePath" use="optional">
      <xs:annotation>
        <xs:documentation>
          Name of the executable file to which the provider's localizable message resource
          is linked, usually the same as the provider's binary.
        </xs:documentation>
      </xs:annotation>
    </xs:attribute>
    <xs:attribute name="parameterFileName" type="man:filePath" use="optional"/>
    <xs:attribute name="helpLink" type="xs:anyURI" use="optional"/>
    <xs:attribute name="symbol" type="man:CSymbolType" use="required"/>
    <xs:attribute name="message" type="man:strTableRef" use="optional"/>
    <xs:attribute name="source" use="optional" default="Xml">
      <xs:annotation>
        <xs:documentation>
            Only the export manifest created by traceRpt.exe should use this attribute to describe
            whether the provider was a MOF-based legacy provider or a Vista+ manifest-based provider.
        </xs:documentation>
      </xs:annotation>
      <xs:simpleType>
        <xs:restriction base="xs:string">
          <xs:enumeration value="Xml"/>
          <xs:enumeration value="Wbem"/>
        </xs:restriction>
      </xs:simpleType>
    </xs:attribute>
    <xs:attribute name="warnOnApplicationCompatibilityError" type="xs:boolean" use="optional" default="false">
      <xs:annotation>
        <xs:documentation>
          This is a temporary attribute to turn off application compatibility
          checks on ETW manifests in the Windows source. A value of 'true' means
          mc will generate warnings instead of errors, thereby not breaking the
          build. Feature teams in Windows should not use this attribute without
          permission from the ETW team.
        </xs:documentation>
      </xs:annotation>
    </xs:attribute>
    <xs:anyAttribute namespace="##other" processContents="lax"/>
  </xs:complexType>

  <xs:complexType name="MetadataType">
    <xs:sequence>
      <xs:element name="channels" type="man:ChannelListType"/>
      <xs:element name="levels" type="man:LevelListType"/>
      <xs:element name="tasks" type="man:TaskListType"/>
      <xs:element name="opcodes" type="man:OpcodeListType" minOccurs="0"/>
      <xs:element name="keywords" type="man:KeywordListType" minOccurs="0"/>
      <xs:element name="types" type="man:TypeListType" minOccurs="0"/>
      <xs:element name="namedQueries" type="man:NamedQueryType" minOccurs="0"/>
      <xs:element name="messageTable" minOccurs="0">
        <xs:complexType>
          <xs:sequence>
            <xs:element name="message" minOccurs="0" maxOccurs="unbounded">
              <xs:complexType>
                <xs:attribute name="value" type="man:UInt32Type" use="required"/>
                <xs:attribute name="mid" type="xs:string" use="optional"/>
                <xs:attribute name="message" type="man:strTableRef" use="required"/>
                <xs:attribute name="symbol" type="man:CSymbolType" use="optional"/>
              </xs:complexType>
            </xs:element>
          </xs:sequence>
        </xs:complexType>
      </xs:element>
      <xs:any namespace="##other" processContents="lax" minOccurs="0" maxOccurs="unbounded"/>
    </xs:sequence>
    <xs:attribute name="name" type="xs:anyURI" use="required"/>
    <xs:anyAttribute namespace="##other" processContents="lax"/>
  </xs:complexType>
  <xs:complexType name="LocalizationType">
    <xs:choice minOccurs="0" maxOccurs="unbounded">
      <xs:element name="resources">
        <xs:complexType>
          <xs:choice minOccurs="0" maxOccurs="unbounded">
            <xs:element name="stringTable" type="man:StringTableType"/>
          </xs:choice>
          <xs:attribute name="culture" type="xs:string" use="required"/>
          <xs:anyAttribute namespace="##other" processContents="lax"/>
        </xs:complexType>
      </xs:element>
      <xs:any namespace="##other" processContents="lax"/>
    </xs:choice>
    <xs:attribute name="fallbackCulture" type="xs:string" use="optional" default="en-us"/>
    <xs:anyAttribute namespace="##other" processContents="lax"/>
  </xs:complexType>
  <xs:complexType name="EventsType">
    <xs:choice maxOccurs="unbounded">
      <xs:element name="provider" type="man:ProviderType"/>
      <xs:element name="messageTable" minOccurs="0">
        <xs:complexType>
          <xs:sequence>
            <xs:element name="message" minOccurs="0" maxOccurs="unbounded">
              <xs:complexType>
                <xs:attribute name="value" type="xs:string" use="required"/>
                <xs:attribute name="mid" type="xs:string" use="optional"/>
                <xs:attribute name="message" type="man:strTableRef" use="required"/>
                <xs:attribute name="symbol" type="man:CSymbolType" use="optional"/>
              </xs:complexType>
            </xs:element>
          </xs:sequence>
        </xs:complexType>
      </xs:element>
      <xs:any namespace="##other" processContents="lax" minOccurs="0"/>
    </xs:choice>
    <xs:anyAttribute namespace="##other"/>
  </xs:complexType>
  <xs:complexType name="InstrumentationType">
    <xs:choice minOccurs="0" maxOccurs="unbounded">
      <xs:element name="events" type="man:EventsType"/>
      <xs:any namespace="##other" processContents="lax" minOccurs="0" maxOccurs="unbounded"/>
    </xs:choice>
    <xs:anyAttribute namespace="##other" processContents="lax"/>
  </xs:complexType>
  <xs:complexType name="InstrumentationManifestType"/>
  <xs:element name="instrumentationManifest">
    <xs:complexType>
      <xs:complexContent>
        <xs:extension base="man:InstrumentationManifestType">
          <xs:choice maxOccurs="3">
            <xs:choice>
              <xs:element name="metadata" type="man:MetadataType"/>
              <xs:element name="instrumentation" type="man:InstrumentationType"/>
            </xs:choice>
            <xs:element name="localization" type="man:LocalizationType"/>
            <xs:any namespace="##other" processContents="lax" minOccurs="0" maxOccurs="unbounded"/>
          </xs:choice>
        </xs:extension>
      </xs:complexContent>
    </xs:complexType>
  </xs:element>
  <xs:element name="events" type="man:EventsType"/>

</xs:schema>
P<instrumentationManifest xmlns="http://schemas.microsoft.com/win/2004/08/events" xmlns:win="http://manifests.microsoft.com/win/2004/08/windows/events" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://schemas.microsoft.com/win/2004/08/events eventman.xsd">
    <metadata name="evt:meta/winTypes">
        <channels>
            <channel name="TraceClassic" type="Debug" symbol="WINEVENT_CHANNEL_CLASSIC_TRACE" value="0" message="$(string.channel.TraceClassic)">
              Events for Classic ETW tracing.
            </channel>
            <channel name="System" type="Admin" symbol="WINEVENT_CHANNEL_GLOBAL_SYSTEM" isolation="System" value="8" message="$(string.channel.System)">
              Events for all installed system services.  This channel is secured to applications running under
              system service accounts or user applications running under local adminstrator privileges.
            </channel>
            <channel name="Application" type="Admin" symbol="WINEVENT_CHANNEL_GLOBAL_APPLICATION" isolation="Application" value="9" message="$(string.channel.Application)">
              Events for all user-level applications.  This channel is not secured and open to any applications.
              Applications which log extensive information should define an application-specific channel.
            </channel>
            <channel name="Security" type="Admin" symbol="WINEVENT_CHANNEL_GLOBAL_SECURITY" isolation="System" value="10" message="$(string.channel.Security)">
              The Windows Audit Log.  For exclusive use of the Windows Local Security Authority.  User events
              may appear as audits if supported by the underlying application.
            </channel>
        </channels>

        <!-- Standard Windows system reporting levels -->
        <levels>
            <level name="win:LogAlways" symbol="WINEVENT_LEVEL_LOG_ALWAYS" value="0" message="$(string.level.LogAlways)"> Log Always </level>
            <level name="win:Critical" symbol="WINEVENT_LEVEL_CRITICAL" value="1" message="$(string.level.Critical)"> Only critical errors </level>
            <level name="win:Error" symbol="WINEVENT_LEVEL_ERROR" value="2" message="$(string.level.Error)"> All errors, includes win:Critical </level>
            <level name="win:Warning" symbol="WINEVENT_LEVEL_WARNING" value="3" message="$(string.level.Warning)"> All warnings, includes win:Error </level>
            <level name="win:Informational" symbol="WINEVENT_LEVEL_INFO" value="4" message="$(string.level.Informational)"> All informational content, including win:Warning </level>
            <level name="win:Verbose" symbol="WINEVENT_LEVEL_VERBOSE" value="5" message="$(string.level.Verbose)"> All tracing, including previous levels </level>

            <!-- The following are unused.  They are place holders so that users dont accidentally use those values in their own definitions -->
            <level name="win:ReservedLevel6" symbol="WINEVENT_LEVEL_RESERVED_6" value="6"/>
            <level name="win:ReservedLevel7" symbol="WINEVENT_LEVEL_RESERVED_7" value="7"/>
            <level name="win:ReservedLevel8" symbol="WINEVENT_LEVEL_RESERVED_8" value="8"/>
            <level name="win:ReservedLevel9" symbol="WINEVENT_LEVEL_RESERVED_9" value="9"/>
            <level name="win:ReservedLevel10" symbol="WINEVENT_LEVEL_RESERVED_10" value="10"/>
            <level name="win:ReservedLevel11" symbol="WINEVENT_LEVEL_RESERVED_11" value="11"/>
            <level name="win:ReservedLevel12" symbol="WINEVENT_LEVEL_RESERVED_12" value="12"/>
            <level name="win:ReservedLevel13" symbol="WINEVENT_LEVEL_RESERVED_13" value="13"/>
            <level name="win:ReservedLevel14" symbol="WINEVENT_LEVEL_RESERVED_14" value="14"/>
            <level name="win:ReservedLevel15" symbol="WINEVENT_LEVEL_RESERVED_15" value="15"/>
            <!-- End of reserved values -->
        </levels>

        <!-- Standard Windows system tasks -->
        <tasks>
            <task name="win:None" value="0" symbol="WINEVENT_TASK_NONE" message="$(string.task.None)"> undefined task </task>
        </tasks>

        <!-- Standard Windows system opcodes -->
        <opcodes>    
            <opcode name="win:Info" value="0" symbol="WINEVENT_OPCODE_INFO" message="$(string.opcode.Info)"> An informational event </opcode>
            <opcode name="win:Start" value="1" symbol="WINEVENT_OPCODE_START" message="$(string.opcode.Start)"> An activity start event </opcode>
            <opcode name="win:Stop" value="2" symbol="WINEVENT_OPCODE_STOP" message="$(string.opcode.Stop)"> An activity end event </opcode>
            <opcode name="win:DC_Start" value="3" symbol="WINEVENT_OPCODE_DC_START" message="$(string.opcode.DCStart)"> A trace collection start event </opcode>
            <opcode name="win:DC_Stop" value="4" symbol="WINEVENT_OPCODE_DC_STOP" message="$(string.opcode.DCStop)"> A trace collection end event </opcode>
            <opcode name="win:Extension" value="5" symbol="WINEVENT_OPCODE_EXTENSION" message="$(string.opcode.Extension)"> An extensional event </opcode>
            <opcode name="win:Reply" value="6" symbol="WINEVENT_OPCODE_REPLY" message="$(string.opcode.Reply)"> A reply event </opcode>
            <opcode name="win:Resume" value="7" symbol="WINEVENT_OPCODE_RESUME" message="$(string.opcode.Resume)"> An event representing the activity resuming from the suspension </opcode>
            <opcode name="win:Suspend" value="8" symbol="WINEVENT_OPCODE_SUSPEND" message="$(string.opcode.Suspend)"> An event representing the activity is suspended, pending another activity's completion </opcode>
            <opcode name="win:Send" value="9" symbol="WINEVENT_OPCODE_SEND" message="$(string.opcode.Send)"> An event representing the activity is transferred to another component, and can continue to work </opcode>
            
            <!-- The following are unused.  They are place holders so that users dont accidentally use those values in their own definitions -->
            <opcode name="win:Receive" value="240" symbol="WINEVENT_OPCODE_RECEIVE" message="$(string.opcode.Receive)"> An event representing receiving an activity transfer from another component </opcode>
            <opcode name="win:ReservedOpcode241" symbol="WINEVENT_OPCODE_RESERVED_241" value="241"/>
            <opcode name="win:ReservedOpcode242" symbol="WINEVENT_OPCODE_RESERVED_242" value="242"/>
            <opcode name="win:ReservedOpcode243" symbol="WINEVENT_OPCODE_RESERVED_243" value="243"/>
            <opcode name="win:ReservedOpcode244" symbol="WINEVENT_OPCODE_RESERVED_244" value="244"/>
            <opcode name="win:ReservedOpcode245" symbol="WINEVENT_OPCODE_RESERVED_245" value="245"/>
            <opcode name="win:ReservedOpcode246" symbol="WINEVENT_OPCODE_RESERVED_246" value="246"/>
            <opcode name="win:ReservedOpcode247" symbol="WINEVENT_OPCODE_RESERVED_247" value="247"/>
            <opcode name="win:ReservedOpcode248" symbol="WINEVENT_OPCODE_RESERVED_248" value="248"/>
            <opcode name="win:ReservedOpcode249" symbol="WINEVENT_OPCODE_RESERVED_249" value="249"/>
            <opcode name="win:ReservedOpcode250" symbol="WINEVENT_OPCODE_RESERVED_250" value="250"/>
            <opcode name="win:ReservedOpcode251" symbol="WINEVENT_OPCODE_RESERVED_251" value="251"/>
            <opcode name="win:ReservedOpcode252" symbol="WINEVENT_OPCODE_RESERVED_252" value="252"/>
            <opcode name="win:ReservedOpcode253" symbol="WINEVENT_OPCODE_RESERVED_253" value="253"/>
            <opcode name="win:ReservedOpcode254" symbol="WINEVENT_OPCODE_RESERVED_254" value="254"/>
            <opcode name="win:ReservedOpcode255" symbol="WINEVENT_OPCODE_RESERVED_255" value="255"/> 
            <!-- End of reserved values -->
        </opcodes>

        <!-- Standard Windows system keywords -->
        <keywords>
            <keyword name="win:AnyKeyword" mask="0x0" symbol="WINEVT_KEYWORD_ANY" message="$(string.keyword.AnyKeyword)">
                 Wild card value
            </keyword>

            <keyword name="win:ResponseTime" mask="0x1000000000000" symbol="WINEVENT_KEYWORD_RESPONSE_TIME" message="$(string.keyword.ResponseTime)">
                 Attached to all events providing response time information
            </keyword>
            <keyword name="win:WDIContext" mask="0x2000000000000" symbol="WINEVENT_KEYWORD_WDI_CONTEXT" message="$(string.keyword.WDIContext)">
                 Attached to all WDI context events
            </keyword>
            <keyword name="win:WDIDiag" mask="0x4000000000000" symbol="WINEVENT_KEYWORD_WDI_DIAG" message="$(string.keyword.WDIDiag)">
                 Attached to all WDI diag events
            </keyword>
            <keyword name="win:SQM" mask="0x8000000000000" symbol="WINEVENT_KEYWORD_SQM" message="$(string.keyword.SQM)">
                 Attached to all SQM events
            </keyword>
            <keyword name="win:AuditFailure" mask="0x10000000000000" symbol="WINEVENT_KEYWORD_AUDIT_FAILURE" message="$(string.keyword.AuditFailure)">
                 Attached to all failed security audits
            </keyword>
            <keyword name="win:AuditSuccess" mask="0x20000000000000" symbol="WINEVENT_KEYWORD_AUDIT_SUCCESS" message="$(string.keyword.AuditSuccess)">
                 Attached to all successful security audits
            </keyword>
            <keyword name="win:CorrelationHint" mask="0x40000000000000" symbol="WINEVENT_KEYWORD_CORRELATION_HINT" message="$(string.keyword.CorrelationHint)">
                 Attached to transfer events where the related Activity ID is a computed value and not a GUID
            </keyword>
            <keyword name="win:EventlogClassic" mask="0x80000000000000" symbol="WINEVENT_KEYWORD_EVENTLOG_CLASSIC" message="$(string.keyword.Classic)">
                 Attached to events raised using classic eventlog API
            </keyword>

            <!-- The following are used to pass channel information.  They are place holders so that users dont accidentally use those values in their own definitions -->
            <keyword name="win:ReservedKeyword56" mask="0x100000000000000" symbol="WINEVENT_KEYWORD_RESERVED_56"/>
            <keyword name="win:ReservedKeyword57" mask="0x200000000000000" symbol="WINEVENT_KEYWORD_RESERVED_57"/>
            <keyword name="win:ReservedKeyword58" mask="0x400000000000000" symbol="WINEVENT_KEYWORD_RESERVED_58"/>
            <keyword name="win:ReservedKeyword59" mask="0x800000000000000" symbol="WINEVENT_KEYWORD_RESERVED_59"/>
            <keyword name="win:ReservedKeyword60" mask="0x1000000000000000" symbol="WINEVENT_KEYWORDE_RESERVED_60"/>
            <keyword name="win:ReservedKeyword61" mask="0x2000000000000000" symbol="WINEVENT_KEYWORD_RESERVED_61"/>
            <keyword name="win:ReservedKeyword62" mask="0x4000000000000000" symbol="WINEVENT_KEYWORD_RESERVED_62"/>
            <keyword name="win:ReservedKeyword63" mask="0x8000000000000000" symbol="WINEVENT_KEYWORD_RESERVED_63"/>
            <!-- End of reserved values -->
        </keywords>
        
        <!-- Standard Windows & CLR system types -->
        <types xmlns:xs="http://www.w3.org/2001/XMLSchema">
            <xmlTypes>
                 <xmlType name="xs:string" value="1" symbol="WINEVENT_OUT_TYPE_STRING"/>
                 <xmlType name="xs:dateTime" value="2" symbol="WINEVENT_OUT_TYPE_DATE_TIME"/>
                 <xmlType name="xs:byte" value="3" symbol="WINEVENT_OUT_TYPE_BYTE"/>
                 <xmlType name="xs:unsignedByte" value="4" symbol="WINEVENT_OUT_TYPE_UNSIGNED_BYTE"/>
                 <xmlType name="xs:short" value="5" symbol="WINEVENT_OUT_TYPE_SHORT"/>
                 <xmlType name="xs:unsignedShort" value="6" symbol="WINEVENT_OUT_TYPE_UNSIGNED_SHORT"/>
                 <xmlType name="xs:int" value="7" symbol="WINEVENT_OUT_TYPE_INT"/>
                 <xmlType name="xs:unsignedInt" value="8" symbol="WINEVENT_OUT_TYPE_UNSIGNED_INT"/>
                 <xmlType name="xs:long" value="9" symbol="WINEVENT_OUT_TYPE_LONG"/>
                 <xmlType name="xs:unsignedLong" value="10" symbol="WINEVENT_OUT_TYPE_UNSIGNED_LONG"/>
                 <xmlType name="xs:float" value="11" symbol="WINEVENT_OUT_TYPE_FLOAT"/>
                 <xmlType name="xs:double" value="12" symbol="WINEVENT_OUT_TYPE_DOUBLE"/>
                 <xmlType name="xs:boolean" value="13" symbol="WINEVENT_OUT_TYPE_BOOLEAN"/>
                 <xmlType name="xs:GUID" value="14" symbol="WINEVENT_OUT_TYPE_GUID"/>
                 <xmlType name="xs:hexBinary" value="15" symbol="WINEVENT_OUT_TYPE_HEXBINARY"/>
                 <xmlType name="win:HexInt8" value="16" symbol="WINEVENT_OUT_TYPE_HEX_INT8"/>
                 <xmlType name="win:HexInt16" value="17" symbol="WINEVENT_OUT_TYPE_HEX_INT16"/>
                 <xmlType name="win:HexInt32" value="18" symbol="WINEVENT_OUT_TYPE_HEX_INT32"/>
                 <xmlType name="win:HexInt64" value="19" symbol="WINEVENT_OUT_TYPE_HEX_INT64"/>
                 <xmlType name="win:PID" value="20" symbol="WINEVENT_OUT_TYPE_PID"/>
                 <xmlType name="win:TID" value="21" symbol="WINEVENT_OUT_TYPE_TID"/>
                 <xmlType name="win:Port" value="22" symbol="WINEVENT_OUT_TYPE_PORT"/>            
                 <xmlType name="win:IPv4" value="23" symbol="WINEVENT_OUT_TYPE_IPV4"/>
                 <xmlType name="win:IPv6" value="24" symbol="WINEVENT_OUT_TYPE_IPV6"/>             
                 <xmlType name="win:SocketAddress" value="25" symbol="WINEVENT_OUT_TYPE_SOCKET_ADDRESS"/>    
                 <xmlType name="win:CIMDateTime" value="26" symbol="WINEVENT_OUT_TYPE_CIMDATETIME"/>    
                 <xmlType name="win:ETWTIME" value="27" symbol="WINEVENT_OUT_TYPE_ETWTIME"/>
                 <xmlType name="win:Xml" value="28" symbol="WINEVENT_OUT_TYPE_XML"/>
                 <xmlType name="win:ErrorCode" value="29" symbol="WINEVENT_OUT_TYPE_ERROR_CODE"/>
                 <xmlType name="win:Win32Error" value="30" symbol="WINEVENT_OUT_TYPE_WIN32_ERROR"/>
                 <xmlType name="win:NTSTATUS" value="31" symbol="WINEVENT_OUT_TYPE_NTSTATUS_ERROR"/>
                 <xmlType name="win:HResult" value="32" symbol="WINEVENT_OUT_TYPE_HRESULT_ERROR"/>
                 <xmlType name="win:DateTimeCultureInsensitive" value="33" symbol="WINEVENT_OUT_TYPE_DATE_TIME_CULTURE_INSENSITIVE"/>
            </xmlTypes>
            <inTypes>
                <inType name="win:UnicodeString" value="1" symbol="WINEVENT_TYPE_NULL_TERMINATED_STRING">
                    <description> A NULL-terminated UNICODE string. </description>
                    <outType default="true" xmlType="xs:string"/>
                    <outType xmlType="win:Xml"/>
                </inType>
                <inType name="win:AnsiString" value="2" symbol="WINEVENT_TYPE_NULL_TERMINATED_ANSI_STRING">
                    <description> A NULL-terminated ANSI string. </description>
                    <outType default="true" xmlType="xs:string"/>
                    <outType xmlType="win:Xml"/>                
                </inType>
                <inType name="win:Int8" value="3" symbol="WINEVENT_TYPE_INT8">
                    <description> A signed 8-bit integer. </description>
                    <outType default="true" xmlType="xs:byte"/>
                </inType>
                <inType name="win:UInt8" value="4" symbol="WINEVENT_TYPE_UINT8">
                    <description> An unsigned 8-bit integer. </description>
                    <outType default="true" xmlType="xs:unsignedByte"/>
                    <outType xmlType="win:HexInt8">An integer in hex format</outType>
                </inType>
                <inType name="win:Int16" value="5" symbol="WINEVENT_TYPE_INT16">
                    <description> A signed 16-bit integer.</description>
                    <outType default="true" xmlType="xs:short"/>
                </inType>
                <inType name="win:UInt16" value="6" symbol="WINEVENT_TYPE_UINT16">
                    <description> An unsigned 16-bit integer </description>
                    <outType default="true" xmlType="xs:unsignedShort"/>
                    <outType xmlType="win:Port"/>
                    <outType xmlType="win:HexInt16">An integer in hex format</outType>
                </inType>
                <inType name="win:Int32" value="7" symbol="WINEVENT_TYPE_INT32">
                    <description> A signed 32-bit integer. </description>
                    <outType default="true" xmlType="xs:int"/>
                    <outType xmlType="win:HResult"> A message string corresponding to system HResult error code. </outType>
                </inType>
                <inType name="win:UInt32" value="8" symbol="WINEVENT_TYPE_UINT32">
                    <description> An unsigned 32-bit integer. </description>
                    <outType default="true" xmlType="xs:unsignedInt"/>
                    <outType xmlType="win:PID"/>
                    <outType xmlType="win:TID"/>
                    <outType xmlType="win:IPv4"/>
                    <outType xmlType="win:ETWTIME"/>
                    <outType xmlType="win:ErrorCode"> Deprecated, same as win:HexInt32. </outType>
                    <outType xmlType="win:Win32Error"> A message string corresponding to system win32 error code. </outType>
                    <outType xmlType="win:NTSTATUS"> A message string corresponding to system NTSTATUS error code. </outType>
                    <outType xmlType="win:HexInt32">An integer in hex format</outType>
                </inType>
                <inType name="win:Int64" value="9" symbol="WINEVENT_TYPE_INT64">
                    <description> A signed 64-bit integer. </description>
                    <outType default="true" xmlType="xs:long"/>
                </inType>
                <inType name="win:UInt64" value="10" symbol="WINEVENT_TYPE_UINT64">
                    <description> An unsigned 64-bit integer. </description>
                    <outType default="true" xmlType="xs:unsignedLong"/>
                    <outType xmlType="win:ETWTIME"/>
                    <outType xmlType="win:HexInt64">An integer in hex format</outType>
                </inType>
                <inType name="win:Float" value="11" symbol="WINEVENT_TYPE_FLOAT">
                    <description> An IEEE 4-byte floating-point value </description>
                    <outType default="true" xmlType="xs:float"/>
                </inType>
                <inType name="win:Double" value="12" symbol="WINEVENT_TYPE_DOUBLE">
                    <description> An IEEE 8-byte floating-point value </description>
                    <outType default="true" xmlType="xs:double"/>
                </inType>
                <inType name="win:Boolean" value="13" symbol="WINEVENT_TYPE_BOOL">
                    <description> A 32-bit value where 0 is false, 1 is true. </description>
                    <outType default="true" xmlType="xs:boolean"/>
                </inType>            
                <inType name="win:Binary" value="14" symbol="WINEVENT_TYPE_BINARY">
                    <description>Variable size binary data.</description>
                    <outType default="true" xmlType="xs:hexBinary"/>
                    <outType xmlType="win:IPv6"/>
                    <outType xmlType="win:SocketAddress"/>
                </inType>            
                <inType name="win:GUID" value="15" symbol="WINEVENT_TYPE_GUID">
                    <description> A DCE-compliant 128-bit UUID. XML spec: {12345678-1234-4667-1234-123456789abc}</description>
                    <outType default="true" xmlType="xs:GUID"/>
                </inType>
                <inType name="win:Pointer" value="16" symbol="WINEVENT_TYPE_POINTER">
                    <description> A pointer; sized to the current platform (32-bit or 64-bit). XML spec: hex representation of a pointer</description>
                    <outType default="true" xmlType="win:HexInt64"/>
                </inType>
                <inType name="win:FILETIME" value="17" symbol="WINEVENT_TYPE_FILETIME">
                    <description> A Windows FILETIME struct. </description>
                    <outType default="true" xmlType="xs:dateTime"/>
                    <outType xmlType="win:DateTimeCultureInsensitive"> DateTime string without any marker related with culture. Ex) Left-To-Right</outType>
                </inType>
                <inType name="win:SYSTEMTIME" value="18" symbol="WINEVENT_TYPE_SYSTEMTIME">
                    <description> A Windows SYSTEMTIME struct.</description>
                    <outType default="true" xmlType="xs:dateTime"/>
                    <outType xmlType="win:DateTimeCultureInsensitive"> DateTime string without any marker related with culture. Ex) Left-To-Right</outType>
                </inType>
                <inType name="win:SID" value="19" symbol="WINEVENT_TYPE_SID">
                    <description> A self-relative Windows SID structure. XML spec: S-1-0-0.</description>
                    <outType default="true" xmlType="xs:string"/>
                </inType>            
                <inType name="win:HexInt32" value="20" symbol="WINEVENT_TYPE_HEXINT32">
                    <description> A hexidecimal representation of an unsigned 32-bit integer. </description>
                    <outType default="true" xmlType="win:HexInt32"/>
                    <outType xmlType="win:ErrorCode"> Deprecated, same as win:HexInt32. </outType>
                    <outType xmlType="win:Win32Error"> A message string corresponding to system win32 error code. </outType>
                    <outType xmlType="win:NTSTATUS"> A message string corresponding to system NTSTATUS error code. </outType>
                </inType>
                <inType name="win:HexInt64" value="21" symbol="WINEVENT_TYPE_HEXINT64">
                    <description> A hexidecimal representation of an unsigned 64-bit integer. </description>
                    <outType default="true" xmlType="win:HexInt64"/>
                </inType>
            </inTypes>
        </types>

        <messageTable>
            <!-- Categories for classic publishers -->
            <message value="1" message="$(string.category.Devices)"/>
            <message value="2" message="$(string.category.Disk)"/>
            <message value="3" message="$(string.category.Printers)"/>
            <message value="4" message="$(string.category.Services)"/>
            <message value="5" message="$(string.category.Shell)"/>
            <message value="6" message="$(string.category.SystemEvent)"/>
            <message value="7" message="$(string.category.Network)"/>

            <!-- Channel names for classic global logs -->
            <message value="256" message="$(string.channel.Application)"/>
            <message value="257" message="$(string.channel.Security)"/>
            <message value="258" message="$(string.channel.System)"/>
        </messageTable>

    </metadata>
    
    <localization>
        <resources culture="en-US">
            <stringTable>
                <!-- Categories for classic publishers.  THESE MUST START AT ENTRY 0! -->
                <string id="category.Reserved" value="Reserved"/>
                <string id="category.Devices" value="Devices"/>
                <string id="category.Disk" value="Disk"/>
                <string id="category.Printers" value="Printers"/>
                <string id="category.Services" value="Services"/>
                <string id="category.Shell" value="Shell"/>
                <string id="category.SystemEvent" value="System Event"/>
                <string id="category.Network" value="Network"/>

                <string id="level.LogAlways" value="Log Always"/>
                <string id="level.Critical" value="Critical"/>
                <string id="level.Error" value="Error"/>
                <string id="level.Warning" value="Warning"/>
                <string id="level.Informational" value="Information"/>
                <string id="level.Verbose" value="Verbose"/>

                <string id="opcode.Info" value="Info"/>
                <string id="opcode.Start" value="Start"/>
                <string id="opcode.Stop" value="Stop"/>
                <string id="opcode.DCStart" value="DCStart"/>
                <string id="opcode.DCStop" value="DCStop"/>
                <string id="opcode.Extension" value="Extension"/>
                <string id="opcode.Reply" value="Reply"/>
                <string id="opcode.Resume" value="Resume"/>
                <string id="opcode.Suspend" value="Suspend"/>
                <string id="opcode.Send" value="Send"/>
                <string id="opcode.Receive" value="Receive"/>
 
                <string id="task.None" value="None"/>

                <string id="keyword.AnyKeyword" value="AnyKeyword"/>
                <string id="keyword.ResponseTime" value="Response Time"/>
                <string id="keyword.WDIContext" value="WDI Context"/>
                <string id="keyword.WDIDiag" value="WDI Diag"/>
                <string id="keyword.SQM" value="SQM"/>
                <string id="keyword.AuditFailure" value="Audit Failure"/>
                <string id="keyword.AuditSuccess" value="Audit Success"/>
                <string id="keyword.CorrelationHint" value="Correlation Hint"/>
                <string id="keyword.Classic" value="Classic"/>

                <string id="channel.TraceClassic" value="TraceClassic"/>
                <string id="channel.System" value="System"/>
                <string id="channel.Application" value="Application"/>
                <string id="channel.Security" value="Security"/>
            </stringTable>
        </resources>
    </localization>

</instrumentationManifest>
PAPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPAD

Anon7 - 2022
AnonSec Team