<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v3" manifestVersion="1.0" copyright="Copyright (c) Microsoft Corporation. All Rights Reserved.">
  <assemblyIdentity name="Microsoft-Windows-System-Events" version="10.0.10586.103" processorArchitecture="amd64" language="neutral" buildType="release" publicKeyToken="31bf3856ad364e35" versionScope="nonSxS" />
  <registryKeys>
    <registryKey keyName="HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Security">
      <registryValue name="9c205a39-1250-487d-abd7-e831c6290539" valueType="REG_BINARY" value="01000480140000002400000000000000340000000102000000000005200000002002000001020000000000052000000020020000020048000300000000001400FF0F120001010000000000051200000000001800FF0F1200010200000000000520000000200200000000140080000000010100000000000513000000" />
      <registryValue name="5322d61a-9efa-4bc3-a3f9-14be95c144f8" valueType="REG_BINARY" value="01000480140000002400000000000000340000000102000000000005200000002002000001020000000000052000000020020000020048000300000000001400FF0F120001010000000000051200000000001800FF0F1200010200000000000520000000200200000000140080000000010100000000000513000000" />
      <registryValue name="3b9c9951-3480-4220-9377-9c8e5184f5cd" valueType="REG_BINARY" value="010004801400000024000000000000003400000001020000000000052000000020020000010200000000000520000000200200000200840004000000000014008800020001010000000000051200000000001800880002000102000000000005200000002002000000002800800000000106000000000005500000005EF30FB18164AE04B14CA22914B14C21A656865600002800800000000106000000000005500000006EBF1BBB45EFD2B14A3B45DB505B43270458D86B" />
      <registryValue name="7dd42a49-5329-4832-8dfd-43d979153a88" valueType="REG_BINARY" value="01000480140000002400000000000000340000000102000000000005200000002002000001020000000000052000000020020000020048000300000000001400FF0F1200010100000000000512000000000014008000000001010000000000051300000000001800FF07120001020000000000052000000020020000" />
      <registryValue name="c7bde69a-e1e0-4177-b6ef-283ad1525271" valueType="REG_BINARY" value="01000480140000002400000000000000340000000102000000000005200000002002000001020000000000052000000020020000020048000300000000001400FF0F1200010100000000000512000000000014008000000001010000000000051300000000001800FF07120001020000000000052000000020020000" />
      <registryValue name="edd08927-9cc4-4e65-b970-c2560fb5c289" valueType="REG_BINARY" value="01000480140000002400000000000000340000000102000000000005200000002002000001020000000000052000000020020000020048000300000000001400FF0F1200010100000000000512000000000014008000000001010000000000051300000000001800FF07120001020000000000052000000020020000" />
      <registryValue name="22fb2cd6-0e7b-422b-a0c7-2fad1fd0e716" valueType="REG_BINARY" value="01000480140000002400000000000000340000000102000000000005200000002002000001020000000000052000000020020000020048000300000000001400FF0F1200010100000000000512000000000014008000000001010000000000051300000000001800FF07120001020000000000052000000020020000" />
      <registryValue name="b675ec37-bdb6-4648-bc92-f3fdc74d3ca2" valueType="REG_BINARY" value="01000480140000002400000000000000340000000102000000000005200000002002000001020000000000052000000020020000020048000300000000001400FF0F120001010000000000051200000000001800FF0F1200010200000000000520000000200200000000140080000000010100000000000513000000" />
      <registryValue name="1a9443d4-b099-44d6-8eb1-829b9c2fe290" valueType="REG_BINARY" value="01000480140000002400000000000000340000000102000000000005200000002002000001020000000000052000000020020000020000020200000000001400FF0F120001010000000000051200000000001800FF0F12000102000000000005200000002002000001000000688308008CFA0600ACFA0600C0F90600010000003CFA060000000000CB94DF774CF0907C3CFA06000000000078010800680308000000000078010800E0810800A8FA060050550800B0F90600460F917C050000005055080000000800485108000000000084FA060048510800D4F90600460F917C8600000048510800000008002051080000000000A8FA060078010800A8FA0600910E917C080608006D05917CECFA060044FB06005CFD060000000000FFFFFFFF205108007801080000000800285108009B99807C4CF0907C0100000078010800B0830800A8830800A836917C6CFD060014FA060010000000B0FF0600F399837CA099807CB0830800280000000000080068830800B0FA0600FC92DF7700000000000000005CFD010186000000C8F9060000000800BCFA060018EE907C7005917C0000000000000000889901018B000000ECF906009B99807CB0FF060018EE907C7005917CFFFFFFFF6D05917CBC09917C000008000000000028510800CCFA06009209917C285108007609917C14FB06000FD5E077ECFA0600000000000100000000C0FD7F0E001000505108000000000000000000A0F7C577010000000000000018FB06007D62C4777D4D26004018000100C0FD7F" />
      <registryValue name="0bf2fb94-7b60-4b4d-9766-e82f658df540" valueType="REG_BINARY" value="01000480140000002400000000000000340000000102000000000005200000002002000001020000000000052000000020020000020000020200000000001400FF0F120001010000000000051200000000001800FF0F12000102000000000005200000002002000001000000688308008CFA0600ACFA0600C0F90600010000003CFA060000000000CB94DF774CF0907C3CFA06000000000078010800680308000000000078010800E0810800A8FA060050550800B0F90600460F917C050000005055080000000800485108000000000084FA060048510800D4F90600460F917C8600000048510800000008002051080000000000A8FA060078010800A8FA0600910E917C080608006D05917CECFA060044FB06005CFD060000000000FFFFFFFF205108007801080000000800285108009B99807C4CF0907C0100000078010800B0830800A8830800A836917C6CFD060014FA060010000000B0FF0600F399837CA099807CB0830800280000000000080068830800B0FA0600FC92DF7700000000000000005CFD010186000000C8F9060000000800BCFA060018EE907C7005917C0000000000000000889901018B000000ECF906009B99807CB0FF060018EE907C7005917CFFFFFFFF6D05917CBC09917C000008000000000028510800CCFA06009209917C285108007609917C14FB06000FD5E077ECFA0600000000000100000000C0FD7F0E001000505108000000000000000000A0F7C577010000000000000018FB06007D62C4777D4D26004018000100C0FD7F" />
      <registryValue name="E02A841C-75A3-4FA7-AFC8-AE09CF9B7F23" valueType="REG_BINARY" value="01000480140000002400000000000000340000000102000000000005200000002002000001020000000000052000000020020000020000020200000000001400FF0F120001010000000000051200000000001800FF0F12000102000000000005200000002002000001000000688308008CFA0600ACFA0600C0F90600010000003CFA060000000000CB94DF774CF0907C3CFA06000000000078010800680308000000000078010800E0810800A8FA060050550800B0F90600460F917C050000005055080000000800485108000000000084FA060048510800D4F90600460F917C8600000048510800000008002051080000000000A8FA060078010800A8FA0600910E917C080608006D05917CECFA060044FB06005CFD060000000000FFFFFFFF205108007801080000000800285108009B99807C4CF0907C0100000078010800B0830800A8830800A836917C6CFD060014FA060010000000B0FF0600F399837CA099807CB0830800280000000000080068830800B0FA0600FC92DF7700000000000000005CFD010186000000C8F9060000000800BCFA060018EE907C7005917C0000000000000000889901018B000000ECF906009B99807CB0FF060018EE907C7005917CFFFFFFFF6D05917CBC09917C000008000000000028510800CCFA06009209917C285108007609917C14FB06000FD5E077ECFA0600000000000100000000C0FD7F0E001000505108000000000000000000A0F7C577010000000000000018FB06007D62C4777D4D26004018000100C0FD7F" />
      <registryValue name="18f4a5fd-fd3b-40a5-8fc2-e5d261c5d02e" valueType="REG_BINARY" value="01000480300000003C000000000000001400000002001C000100000000001400FF0F1200010100000000000512000000010100000000000512000000010100000000000512000000" />
      <registryValue name="f5528ada-be5f-4f14-8aef-a95de7281161" valueType="REG_BINARY" value="01000480300000003C000000000000001400000002001C000100000000001400FF0F1200010100000000000512000000010100000000000512000000010100000000000512000000" />
      <registryValue name="3635d4b6-77e3-4375-8124-d545b7149337" valueType="REG_BINARY" value="01000480300000003C000000000000001400000002001C000100000000001400FF0F1200010100000000000512000000010100000000000512000000010100000000000512000000" />
    </registryKey>
    <registryKey keyName="HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\SQMLogger\{9c205a39-1250-487d-abd7-e831c6290539}">
      <registryValue name="LoggerName" valueType="REG_SZ" value="SQMLogger" />
      <registryValue name="Enabled" valueType="REG_DWORD" value="0x00000001" />
      <registryValue name="EnableLevel" valueType="REG_DWORD" value="0x00000004" />
      <registryValue name="MatchAnyKeyword" valueType="REG_QWORD" value="0000000000000800" />
      <registryValue name="EnableProperty" valueType="REG_DWORD" value="0x00000002" />
    </registryKey>
    <registryKey keyName="HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\SQMLogger\{a6ad76e3-867a-4635-91b3-4904ba6374d7}">
      <registryValue name="LoggerName" valueType="REG_SZ" value="SQMLogger" />
      <registryValue name="Enabled" valueType="REG_DWORD" value="0x00000001" />
      <registryValue name="EnableLevel" valueType="REG_DWORD" value="0x00000004" />
      <registryValue name="MatchAnyKeyword" valueType="REG_QWORD" value="0000000000000800" />
      <registryValue name="EnableProperty" valueType="REG_DWORD" value="0x00000002" />
    </registryKey>
    <registryKey keyName="HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\SQMLogger\{a0af438f-4431-41cb-a675-a265050ee947}">
      <registryValue name="LoggerName" valueType="REG_SZ" value="SQMLogger" />
      <registryValue name="Enabled" valueType="REG_DWORD" value="0x00000001" />
      <registryValue name="EnableLevel" valueType="REG_DWORD" value="0x00000004" />
      <registryValue name="MatchAnyKeyword" valueType="REG_QWORD" value="0000000000000800" />
      <registryValue name="EnableProperty" valueType="REG_DWORD" value="0x00000002" />
    </registryKey>
    <registryKey keyName="HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\SQMLogger\{15CA44FF-4D7A-4BAA-BBA5-0998955E531E}">
      <registryValue name="LoggerName" valueType="REG_SZ" value="SQMLogger" />
      <registryValue name="Enabled" valueType="REG_DWORD" value="0x00000001" />
      <registryValue name="EnableLevel" valueType="REG_DWORD" value="0x00000004" />
      <registryValue name="MatchAnyKeyword" valueType="REG_QWORD" value="0000000000000800" />
      <registryValue name="EnableProperty" valueType="REG_DWORD" value="0x00000002" />
    </registryKey>
    <registryKey keyName="HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\UBPM\{18f4a5fd-fd3b-40a5-8fc2-e5d261c5d02e}">
      <registryValue name="LoggerName" valueType="REG_SZ" value="UBPM" />
      <registryValue name="Enabled" valueType="REG_DWORD" value="0x00000001" />
      <registryValue name="EnableLevel" valueType="REG_DWORD" value="0x00000000" />
      <registryValue name="EnableFlags" valueType="REG_DWORD" value="0x00ffffff" />
    </registryKey>
    <registryKey keyName="HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\UBPM\{3635d4b6-77e3-4375-8124-d545b7149337}">
      <registryValue name="LoggerName" valueType="REG_SZ" value="UBPM" />
      <registryValue name="Enabled" valueType="REG_DWORD" value="0x00000001" />
      <registryValue name="EnableLevel" valueType="REG_DWORD" value="0x00000000" />
      <registryValue name="EnableFlags" valueType="REG_DWORD" value="0x00ffffff" />
    </registryKey>
  </registryKeys>
  <localization>
    <resources culture="en-US">
      <stringTable>
        <string id="Acpi.EventMap.ActiveCoolingDevicePower.Off" value="off" />
        <string id="Acpi.EventMap.ActiveCoolingDevicePower.On" value="on" />
        <string id="Acpi.EventMap.AmlMethodInvocationState.End" value="finished" />
        <string id="Acpi.EventMap.AmlMethodInvocationState.Start" value="started" />
        <string id="Acpi.EventMap.ResetType.FunctionLevelReset" value="Function-level Device Reset" />
        <string id="Acpi.EventMap.ResetType.PlatformLevelReset" value="Platform-level Device Reset" />
        <string id="Acpi.EventMessage.ActiveCoolingDevicePower" value="The active cooling device %6 has been turned %7.             %nThermal zone device instance: %2             %nActive cooling package: _AC%3             %nNamespace object: _AL%4" />
        <string id="Acpi.EventMessage.ActiveCoolingDevicePower_V0" value="The active cooling device %6 has been turned %8.             %nThermal zone device instance: %2             %nActive cooling package: _AC%3             %nNamespace object: _AL%4" />
        <string id="Acpi.EventMessage.AmlMethodTrace" value="ACPI method %2 evaluation has %3." />
        <string id="Acpi.EventMessage.DeviceActiveCooling" value="The active cooling device %2 has been turned %3." />
        <string id="Acpi.EventMessage.DeviceCoolingRundown" value="The device %2 has the following cooling state.             %nActive cooling: %3             %nPassive cooling: %4 percent" />
        <string id="Acpi.EventMessage.DevicePassiveCooling" value="The passive cooling device %2 throttle has changed to %3 percent." />
        <string id="Acpi.EventMessage.DeviceReset" value="ACPI device %2 is undergoing %3. Status %4." />
        <string id="Acpi.EventMessage.MemoryReserved" value="A memory range descriptor has been marked as reserved." />
        <string id="Acpi.EventMessage.TemperatureNotification" value="A temperature change notification (Notify(thermal_zone, 0x80)) for ACPI thermal zone %2 has been received.             %n_TMP = %3K             %n_PSV = %4K             %n_AC0 = %5K             %n_AC1 = %6K             %n_AC2 = %7K             %n_AC3 = %8K             %n_AC4 = %9K             %n_AC5 = %10K             %n_AC6 = %11K             %n_AC7 = %12K             %n_AC8 = %13K             %n_AC9 = %14K             %n_HOT = %15K             %n_CRT = %16K" />
        <string id="Acpi.EventMessage.TripPointNotification" value="A trip point change notification (Notify(thermal_zone, 0x81)) for ACPI thermal zone %2 has been received.             %n_TMP = %3K             %n_PSV = %4K             %n_AC0 = %5K             %n_AC1 = %6K             %n_AC2 = %7K             %n_AC3 = %8K             %n_AC4 = %9K             %n_AC5 = %10K             %n_AC6 = %11K             %n_AC7 = %12K             %n_AC8 = %13K             %n_AC9 = %14K             %n_HOT = %15K             %n_CRT = %16K" />
        <string id="Acpi.EventMessage.UnexpectedGpe" value="Unexpected GPE event was fired on GPE bits that should be disabled." />
        <string id="Acpi.ProviderName" value="Microsoft-Windows-Kernel-Acpi" />
        <string id="AeCache.ErrorMessage" value="%1" />
        <string id="AeCache.InfoMessage" value="%1" />
        <string id="AeCache.OperationalMessage" value="%1" />
        <string id="AeCache.ProviderName" value="Microsoft-Windows-Kernel-ApphelpCache" />
        <string id="AeLookupServiceTrigger.ProviderName" value="Microsoft-Windows-AeLookupServiceTrigger" />
        <string id="AeSwitchBack.ProviderName" value="Microsoft-Windows-AeSwitchBack" />
        <string id="AIT.ProviderName" value="Microsoft-Windows-AIT" />
        <string id="AppCompat.ProviderName" value="Microsoft-Windows-Kernel-AppCompat" />
        <string id="APPCOMPAT_REG_WRP_ACCESS_DENIED.EventMessage" value="The executable %2 received an access denied error when trying to modify the registry key %4." />
        <string id="AppModelRuntime.ChannelName" value="Microsoft-Windows-AppModel-Runtime/Analytic" />
        <string id="AppModelRuntime.Event.ActivationLogRemediationApplicationBinary" value="App %1 was terminated with error %2 because of an issue with application binary %3. This could be because the binary is unsigned, contains an untrusted signature, or has been corrupted or tampered with. Reinstall the application to fix this issue." />
        <string id="AppModelRuntime.Event.ActivationLogRemediationGenericErrorNoTermination" value="An app prevented the load of a binary due to error %1. This could be because the binary is unsigned, contains an untrusted signature, or has been corrupted or tampered with." />
        <string id="AppModelRuntime.Event.ActivationLogRemediationNgenBinary" value="App %1 prevented the load of generated binary %3 due to error %2. This could be because the binary is unsigned, contains an untrusted signature, or has been corrupted or tampered with." />
        <string id="AppModelRuntime.Event.ActivationLogRemediationSystemBinary" value="App %1 was terminated with error %2 because of an issue with Windows binary %3. This could be because the binary is unsigned, contains an untrusted signature, or has been corrupted or tampered with. Refresh your PC to fix this issue." />
        <string id="AppModelRuntime.Event.AppContainerAlreadyExists" value="AppContainer %1 was not created because it already exists." />
        <string id="AppModelRuntime.Event.AppContainerCreateFolderFailure" value="CreateAppContainerProfile failed with error %1 because it was unable to create folder %2." />
        <string id="AppModelRuntime.Event.AppContainerCreateRegistryKeyFailure" value="CreateAppContainerProfile failed with error %1 because it was unable to create registry key %2." />
        <string id="AppModelRuntime.Event.AppContainerCreationStart" value="Creating AppContainer %1." />
        <string id="AppModelRuntime.Event.AppContainerCreationStop" value="Finished creating AppContainer %2 with %1." />
        <string id="AppModelRuntime.Event.AppContainerCreationSuccess" value="Successfully created AppContainer %1." />
        <string id="AppModelRuntime.Event.AppContainerDeleteFolderFailure" value="AppContainer profile failed with error %1 because it was unable to delete folder %2 or its contents." />
        <string id="AppModelRuntime.Event.AppContainerDeletegistryKeyFailure" value="AppContainer profile failed with error %1 because it was unable to delete registry key %2." />
        <string id="AppModelRuntime.Event.AppContainerDeletionStart" value="Deleting AppContainer %1." />
        <string id="AppModelRuntime.Event.AppContainerDeletionStop" value="Finished deleting AppContainer %2 with %1." />
        <string id="AppModelRuntime.Event.AppContainerDeletionSuccess" value="Successfully deleted AppContainer %1." />
        <string id="AppModelRuntime.Event.AppContainerDisplayNameFailure" value="AppContainer profile failed with error %1 because it was unable to look up the AppContainer display name." />
        <string id="AppModelRuntime.Event.AppContainerGetAppDataFolderFailure" value="CreateAppContainerProfile failed with error %1 because it was unable to find the users local app data folder." />
        <string id="AppModelRuntime.Event.AppContainerNameFailure" value="AppContainer profile failed with error %1 because it was unable to look up the AppContainer name." />
        <string id="AppModelRuntime.Event.AppContainerRegisterFirewallFailure" value="CreateAppContainerProfile failed with error %1 because it was unable to register with the firewall." />
        <string id="AppModelRuntime.Event.AppContainerRegisterSidFailure" value="App Container profile failed with error %1 because it was unable to register the AppContainer SID." />
        <string id="AppModelRuntime.Event.AppContainerSetFolderAttributesFailure" value="CreateAppContainerProfile failed with error %1 because it was unable to set attributes on folder %2." />
        <string id="AppModelRuntime.Event.AppContainerSetRegistryKeySecurityFailure" value="CreateAppContainerProfile failed with error %1 because it was unable to set security on registry key %2." />
        <string id="AppModelRuntime.Event.AppContainerUnregisterFirewallFailure" value="DeleteAppContainerProfile failed with error %1 because it was unable to unregister with the firewall." />
        <string id="AppModelRuntime.Event.AppContainerUnregisterSidFailure" value="DeleteAppContainerProfile failed with error %1 because it was unable to unregister the AppContainer SID." />
        <string id="AppModelRuntime.Event.AppContainerUpdateStart" value="Updating AppContainer %1." />
        <string id="AppModelRuntime.Event.AppContainerUpdateStop" value="Finished updating AppContainer %2 with %1." />
        <string id="AppModelRuntime.Event.AppContainerUpdateSuccess" value="Successfully updated AppContainer %1." />
        <string id="AppModelRuntime.Event.AppContainerVerifyFolderFailure" value="CreateAppContainerProfile failed with error %1 because it was unable to verify the existence of folder %2." />
        <string id="AppModelRuntime.Event.AppContainerVerifyRegistryKeyFailure" value="CreateAppContainerProfile failed with error %1 because it was unable to verify the existence of registry key %2." />
        <string id="AppModelRuntime.Event.AppIntegrityAppTerminated" value="App Integrity terminated an application. Integrity check for %2 returned %1." />
        <string id="AppModelRuntime.Event.AppIntegrityCheckTimedOut" value="App Integrity check for %1 timed out." />
        <string id="AppModelRuntime.Event.AppIntegrityDependencyGraphCheckStart" value="Checking package graph for %1." />
        <string id="AppModelRuntime.Event.AppIntegrityDependencyGraphCheckStop" value="Package graph check for %2 finished with %1." />
        <string id="AppModelRuntime.Event.AppIntegrityFailedToQueryDirectoryTrustState" value="Failed with %1 to retrieve the trust state of the package %2 folder." />
        <string id="AppModelRuntime.Event.AppIntegrityInAppValidatePackageStart" value="Performing runtime app integrity check for package %1." />
        <string id="AppModelRuntime.Event.AppIntegrityInAppValidatePackageStop" value="Runtime app integrity check for package %2 finished with %1." />
        <string id="AppModelRuntime.Event.AppIntegrityInfrastructureFailure" value="App Integrity check failed with %1 while checking %2." />
        <string id="AppModelRuntime.Event.AppIntegrityPackageModified" value="Modification was detected in package %1." />
        <string id="AppModelRuntime.Event.AppIntegrityPackageValidationRequired" value="The package %1 requires validation." />
        <string id="AppModelRuntime.Event.AppIntegrityProcessCreationStart" value="Performing app integrity check for package %1." />
        <string id="AppModelRuntime.Event.AppIntegrityProcessCreationStop" value="App integrity check for package %2 finished with %1." />
        <string id="AppModelRuntime.Event.AppIntegrityProcessTerminationFailed" value="Failed to terminate app with package %1." />
        <string id="AppModelRuntime.Event.AppIntegrityValidationSuccessful" value="Validation of app with package %1 was successful." />
        <string id="AppModelRuntime.Event.CreateAppContainerFailure" value="CreateAppContainerProfile failed for AppContainer %2 with error %1." />
        <string id="AppModelRuntime.Event.CreateRestrictedCapabilitiesValueFailed" value="Failed to create the capabilities storage value for Restricted AppContainer %2 with %1." />
        <string id="AppModelRuntime.Event.DeleteAppContainerFailure" value="DeleteAppContainerProfile failed for AppContainer %2 with error %1." />
        <string id="AppModelRuntime.Event.DMRApplicationNotFound" value="%2: Package runtime information %1 is missing expected data (address=%4, size=%3, section=%5, processid=%6). Reinstall the package to fix this issue." />
        <string id="AppModelRuntime.Event.DMRCorrupt" value="%2: Package runtime information %1 is corrupted (address=%5, size=%3, offset=%4, section=%6, processid=%7). Reinstall the package to fix this issue." />
        <string id="AppModelRuntime.Event.DMRDuplicateSectionFound" value="%2: Package runtime information %1 contains conflicting data (address=%5, size=%3, offset=%4, section=%6, processid=%7). Reinstall the package to fix this issue." />
        <string id="AppModelRuntime.Event.DMRExceptionDuringLoad" value="Package runtime information %1 failed to load because exception %2 occurred." />
        <string id="AppModelRuntime.Event.DMRGetApplicationIdentityFailed" value="%2: Application identity not accessible while loading package runtime information %1 (address=%4, size=%3, processid=%5)." />
        <string id="AppModelRuntime.Event.DMROpenFailed" value="%2: Package runtime information %1 failed to load (processid=%3)." />
        <string id="AppModelRuntime.Event.DMRSectionNotFound" value="%2: Package runtime information %1 is missing expected data (address=%4, size=%3, section=%5, processid=%6). Reinstall the package to fix this issue." />
        <string id="AppModelRuntime.Event.DMRUnknownSectionFound" value="%2: Package runtime information %1 contains unexpected data (address=%5, size=%3, offset=%4, section=%6, processid=%7). Reinstall the package to fix this issue." />
        <string id="AppModelRuntime.Event.DynamicPropertiesInvalid" value="Failed with %1 validating AppModel Runtime group policy values." />
        <string id="AppModelRuntime.Event.DynamicPropertiesReadFailed" value="Failed with %1 retrieving AppModel Runtime group policy values." />
        <string id="AppModelRuntime.Event.FirewallAppContainerCreationStart" value="Creating firewall rules for AppContainer %1." />
        <string id="AppModelRuntime.Event.FirewallAppContainerCreationStop" value="Finished creating firewall rules for AppContainer %2 with %1." />
        <string id="AppModelRuntime.Event.FirewallAppContainerDeletionStart" value="Deleting firewall rules for AppContainer %1." />
        <string id="AppModelRuntime.Event.FirewallAppContainerDeletionStop" value="Finished deleting firewall rules for AppContainer %2 with %1." />
        <string id="AppModelRuntime.Event.IntegrityServerPackageValidationFailed" value="Deployment server integrity check of package %1 failed with %2." />
        <string id="AppModelRuntime.Event.PackageStatusGetFailed" value="Failed with %1 retrieving AppModel Runtime status for package %2." />
        <string id="AppModelRuntime.Event.PackageStatusGetForUserFailed" value="Failed with %1 retrieving AppModel Runtime status for package %2 for user %3." />
        <string id="AppModelRuntime.Event.PackageStatusUpdated" value="AppModel Runtime status for package %1 successfully updated to %2 (previous status = %3)." />
        <string id="AppModelRuntime.Event.PackageStatusUpdatedForUser" value="AppModel Runtime status for package %1 for user %2 successfully updated to %3 (previous status = %4)." />
        <string id="AppModelRuntime.Event.PackageStatusUpdateFailed" value="Failed with %1 modifying AppModel Runtime status for package %2 (current status = %4, desired status = %3)." />
        <string id="AppModelRuntime.Event.PackageStatusUpdateForUserFailed" value="Failed with %1 modifying AppModel Runtime status for package %2 for user %3 (current status = %5, desired status = %4)." />
        <string id="AppModelRuntime.Event.PackageStatusVersionIncremented" value="AppModel Runtime status version successfully updated." />
        <string id="AppModelRuntime.Event.PackageStatusVersionIncrementFailed" value="Failed with %1 modifying AppModel Runtime status version (context = %2)." />
        <string id="AppModelRuntime.Event.ProcessStart" value="Process %1 started at time %2 by parent %3 running as package %4 with executable %5 is application %6." />
        <string id="AppModelRuntime.Event.ProcessStartFailureCheckpointAppDataCreation" value="%2: Cannot create the process for package %1 because an error was encountered while performing the app data creation. %3" />
        <string id="AppModelRuntime.Event.ProcessStartFailureCheckpointAppIntegrityCheck" value="%2: Cannot create the process for package %1 because an error was encountered while performing the integrity check. %3" />
        <string id="AppModelRuntime.Event.ProcessStartFailureCheckpointLicenseCheck" value="%2: Cannot create the process for package %1 because an error was encountered while querying the fast cache. %3" />
        <string id="AppModelRuntime.Event.ProcessStartFailureCheckpointLoadPackageRuntimeInformation" value="%2: Cannot create the process for package %1 because an error was encountered while loading the runtime information. %3" />
        <string id="AppModelRuntime.Event.ProcessStartFailureCheckpointPackageStatusCheckMachine" value="%2: Cannot create the process for package %1 because an error was encountered while checking the machine-level package status. %3" />
        <string id="AppModelRuntime.Event.ProcessStartFailureCheckpointPackageStatusCheckUser" value="%2: Cannot create the process for package %1 because an error was encountered while checking the user-level package status. %3" />
        <string id="AppModelRuntime.Event.ProcessStartFailureCheckpointPreCreationExtension" value="%2: Cannot create the process for package %1 because an error was encountered while preparing the App credentials. %3" />
        <string id="AppModelRuntime.Event.ProcessStartFailureCheckpointStart" value="%2: Cannot create the process for package %1 because an error was encountered. %3" />
        <string id="AppModelRuntime.Event.ProcessStartFailureIsAppContainer" value="%2: Cannot create the process for package %1 because an error was encountered while verifying the App credentials. %3" />
        <string id="AppModelRuntime.Event.RestrictedAppContainerActivationFailed" value="Failed to activate Restricted AppContainer %2 with %1." />
        <string id="AppModelRuntime.Event.RestrictedAppContainerCreationStart" value="Creating Restricted AppContainer %1." />
        <string id="AppModelRuntime.Event.RestrictedAppContainerCreationStop" value="Finished creating Restricted AppContainer %2 with %1." />
        <string id="AppModelRuntime.Event.RestrictedAppContainerDeletionStart" value="Deleting Restricted AppContainer %1." />
        <string id="AppModelRuntime.Event.RestrictedAppContainerDeletionStop" value="Finished deleting Restricted AppContainer %2 with %1." />
        <string id="AppModelRuntime.Event.RestrictedAppContainerEventArgsCreationFailed" value="Failed to create shared context object for Restricted AppContainer %2 with %1." />
        <string id="AppModelRuntime.Event.RestrictedAppContainerFindAllStart" value="Enumerating all Restricted AppContainers for %1." />
        <string id="AppModelRuntime.Event.RestrictedAppContainerFindAllStop" value="Finished enumerating all Restricted AppContainers for AppContainer %2 with %1." />
        <string id="AppModelRuntime.Event.RestrictedAppContainerInvalidCapability" value="Creation of Restricted AppContainer %2 failed with %1 because an invalid capability was specified." />
        <string id="AppModelRuntime.Event.RestrictedAppContainerLaunchStart" value="Launching process in Restricted AppContainer %1." />
        <string id="AppModelRuntime.Event.RestrictedAppContainerLaunchStop" value="Finished launching process in Restricted AppContainer %2 with %1." />
        <string id="AppModelRuntime.Event.RestrictedAppContainerOpenStart" value="Opening Restricted AppContainer %1." />
        <string id="AppModelRuntime.Event.RestrictedAppContainerOpenStop" value="Finished opening Restricted AppContainer %2 with %1." />
        <string id="AppModelRuntime.Event.RestrictedAppContainerTerminateAllStart" value="Terminating all processes in Restricted AppContainer %1." />
        <string id="AppModelRuntime.Event.RestrictedAppContainerTerminateAllStop" value="Finished terminating all processes in Restricted AppContainer %2 with %1." />
        <string id="AppModelRuntime.Event.RestrictedCapabilitiesOpenFailed" value="Opening existing Restricted AppContainer %2 failed with %1 because the capabilities storage value could not be read." />
        <string id="AppModelRuntime.Event.RestrictedClientApplicationAllInfoRetrievalFailed" value="Failed with %1 while retrieving AppContainer information during interaction with Restricted AppContainer." />
        <string id="AppModelRuntime.Event.RestrictedClientApplicationInfoRetrievalFailed" value="Failed with %1 while retrieving AppContainer %2 information during interaction with Restricted AppContainer." />
        <string id="AppModelRuntime.Event.RestrictedClientApplicationInfoRetrievalFailedBadCaller" value="Failed with %1 while retrieving AppContainer information. Call invalid from this process type." />
        <string id="AppModelRuntime.Event.UpdateAppContainerFailure" value="UpdateAppContainerProfile failed for AppContainer %2 with error %1." />
        <string id="AppModelRuntime.Keyword.AppContainer" value="AppContainer" />
        <string id="AppModelRuntime.Keyword.Process" value="Process" />
        <string id="AppModelRuntime.ProviderName" value="Microsoft-Windows-AppModel-Runtime" />
        <string id="AppModelState.ChannelName.Debug" value="Microsoft-Windows-AppModel-State/Debug" />
        <string id="AppModelState.ChannelName.Perf" value="Microsoft-Windows-AppModel-State/Diagnostic" />
        <string id="AppModelState.Event.ApiSetError" value="ApiSet Function: %1 returned with Error Code: %2" />
        <string id="AppModelState.Event.AppHiveLoad.Error" value="Failure to load the application settings for package %1. Error Code: %2" />
        <string id="AppModelState.Event.DataStoreError" value="Low-level data store access error. Function: %1 returned with Error Code: %2" />
        <string id="AppModelState.Event.DeleteDirectoryError" value="Error while deleting directory: %1. Error Code: %2" />
        <string id="AppModelState.Event.DeleteFileError" value="Error while deleting file: %1. Error Code: %2" />
        <string id="AppModelState.Event.FixStateLocationsAccess.Failed" value="Failure to fix state locations for package %1. Error Code: %2" />
        <string id="AppModelState.Event.FixStateLocationsAccess.Succeeded" value="Succeeded to fix state locations for package %1." />
        <string id="AppModelState.Event.OutOfMemory" value="Error while allocating memory" />
        <string id="AppModelState.Event.ReadSetting.Error" value="Failure to read an application setting for package %1. Error Code: %2" />
        <string id="AppModelState.Event.StorageFolderInstantiation.Error" value="Failure to instantiate storage folder %1 for package %2 with Error Code: %3" />
        <string id="AppModelState.Event.TempCleanup.Aborted" value="Cleanup of temporary state has aborted unexpectedly." />
        <string id="AppModelState.Event.TempCleanup.Completed" value="Cleanup of temporary state has completed." />
        <string id="AppModelState.Event.TempCleanup.ProfileError" value="Cleanup of temporary state was unable to enumerate the user profiles.  Object: %1, Error Code: %2." />
        <string id="AppModelState.Event.TempCleanup.Skipped" value="Cleanup of temporary state has been skipped due to low disk usage." />
        <string id="AppModelState.Event.UpdateRequired.PackageNameChanged" value="Need to update state locations of package %1 for user %2 because the package full name has changed. Error Code: %3" />
        <string id="AppModelState.Event.UpdateRequired.PackageNotFound" value="Need to update state locations of package %1 for user %2 because the package is not found. Error Code: %3" />
        <string id="AppModelState.Event.UpdateRequired.SchemaChanged" value="Need to update state locations of package %1 for user %2 because the schema version has changed. Error Code: %3" />
        <string id="AppModelState.Event.UpdateRequired.SchemaNotFound" value="Need to update state locations of package %1 for user %2 because the schema is not found. Error Code: %3" />
        <string id="AppModelState.Event.WriteSetting.Error" value="Failure to write an application setting for package %1. Error Code: %2" />
        <string id="AppModelState.Keyword.ApiSetError" value="Apiset Error" />
        <string id="AppModelState.Keyword.DataStoreError" value="Low-level Data Store Error" />
        <string id="AppModelState.Keyword.OutOfMemory" value="Out Of Memory" />
        <string id="AppModelState.Keyword.Structured" value="Structured State" />
        <string id="AppModelState.Keyword.UnstructuredReset" value="Unstructured Reset" />
        <string id="AppModelState.Keyword.WinRT" value="WinRT" />
        <string id="AppModelState.ProviderName" value="Microsoft-Windows-AppModel-State" />
        <string id="BootEnv.AcpiFailure" value="Windows failed to initialize the ACPI with error status %1." />
        <string id="BootEnv.ApplicationExecutionTime" value="The time elapsed executing %1 was %2 ms." />
        <string id="BootEnv.ApplicationLoadTime" value="The time elapsed loading %1 was %2 ms." />
        <string id="BootEnv.BootAdvancedOptionsMenuInformation" value="The OS loader advanced options menu was displayed and the user selected option %1." />
        <string id="BootEnv.BootBadMemoryUsedByFirmware" value="The system firmware has allocated a memory region previously determined to be unreliable. This has the potential to cause system instability and/or data corruption." />
        <string id="BootEnv.BootBitTransferRate" value="Video bit transfer rate is %1 bytes per ms." />
        <string id="BootEnv.BootBootmgrMultiOsCount" value="There are %1 boot options on this system." />
        <string id="BootEnv.BootBootmgrMultiOsMenuDisplayed" value="The boot manager multi OS selection screen was displayed." />
        <string id="BootEnv.BootBootmgrMultiOsToolsCount" value="There are %1 boot tool options on this system." />
        <string id="BootEnv.BootDirtyBootShutdown" value="The last shutdown's success status was %1. The last boot's success status was %2." />
        <string id="BootEnv.BootEditOptionsMenuInformation" value="The OS loader edit options menu was displayed." />
        <string id="BootEnv.BootF8KeyPressed" value="The F8 key was pressed during boot." />
        <string id="BootEnv.BootFileAccess" value="Boot library accessed file %2 on Device %1. Read %3 bytes and wrote %4 bytes." />
        <string id="BootEnv.BootFirmwareResolution" value="System was booted in %1x%2@%3bpp." />
        <string id="BootEnv.BootFwBootPerfData" value="The firmware reported boot metrics." />
        <string id="BootEnv.BootFwCryptoHashProvider" value="Initialization of the firmware crypto hash provider resulted in status %1." />
        <string id="BootEnv.BootHiberbootFailure" value="Windows failed fast startup with error status %1." />
        <string id="BootEnv.BootImageHashCheck" value="Image %1 is not self-signed." />
        <string id="BootEnv.BootImageIntegrityCheck" value="Image %1 failed IntegrityCheck reason is %3. Image flags are %2. Error ignored due to debugger %4." />
        <string id="BootEnv.BootMenuPolicy" value="The boot menu policy was %1." />
        <string id="BootEnv.BootmgrTime" value="Bootmgr duration is %1 milliseconds." />
        <string id="BootEnv.BootNonexistentDisk" value="A device (%1) that was enumerated by the BIOS was inaccessible to the boot environment." />
        <string id="BootEnv.BootOsResolution" value="BootUX screen was displayed in %1x%2@%3bpp." />
        <string id="BootEnv.BootResumeFailure" value="Windows failed to resume from hibernate with error status %1." />
        <string id="BootEnv.BootSequence" value="A one-time boot sequence was used during this boot." />
        <string id="BootEnv.BootTotalIO" value="File IO for boot application %1: Total Bytes Read = %2, Total Bytes Written = %3." />
        <string id="BootEnv.BootType" value="The boot type was %1." />
        <string id="BootEnv.BootWindowsKeyPressed" value="The Windows key was pressed during boot." />
        <string id="BootEnv.BuildChunkTableFailure" value="Building chunk table for WIM compressed file %2 failed with status: %1" />
        <string id="BootEnv.FwUpdateBitlockerCheckStatus" value="Firmware update supported status is %3. The BitLocker device flags are %1 and the PCR bitmap is %2." />
        <string id="BootEnv.FwUpdateCodeIntegrityFailure" value="The firmware update capsule (%1) code integrity check failed with status %2." />
        <string id="BootEnv.FwUpdateImageLoadFailure" value="The firmware update capsule (%1) failed to load with status %2." />
        <string id="BootEnv.FwUpdatePeImageLoadFailure" value="The PE/COFF image firmware update capsule (%1) failed to load with status %2." />
        <string id="BootEnv.FwUpdateUpdateCapsuleFailure" value="The Efi UpdateCapsule failed to apply updates with status %1." />
        <string id="BootEnv.GeneralFailure" value="Windows failed to load with error status %1." />
        <string id="BootEnv.HiveLoadFailure" value="Windows failed to load the system registry file %1 with error status %2." />
        <string id="BootEnv.IdkProvisioningFailure" value="Windows failed to provision VSM Identity Key. Unsealing cached copy status: %1. New key generation status: %2. Measuring to PCR status: %3. Sealing and caching status: %4." />
        <string id="BootEnv.IdkProvisioningStatus" value="VSM Identity Key Provisioning. Unsealing cached copy status: %1. New key generation status: %2. Measuring to PCR status: %3. Sealing and caching status: %4." />
        <string id="BootEnv.ImageLoadFailure" value="Windows failed to load the required system file %1 with error status %2." />
        <string id="BootEnv.LKeyProvisioningFailure" value="Windows failed to provision VSM Master Encryption Key. Using cached copy status: %1. Unsealing cached copy status: %2. New key generation status: %3. Sealing status: %4. TPM PCR mask: %5." />
        <string id="BootEnv.LKeyProvisioningStatus" value="VSM Master Encryption Key Provisioning. Using cached copy status: %1. Unsealing cached copy status: %2. New key generation status: %3. Sealing status: %4. TPM PCR mask: %5." />
        <string id="BootEnv.LoadDriversTime" value="Loading the drivers took %1 milliseconds." />
        <string id="BootEnv.LoadHiveTime" value="Loading hive %1 took %2 milliseconds." />
        <string id="BootEnv.LoadImportFailure" value="Windows failed to import %2 from image %1 with error status %3." />
        <string id="BootEnv.LoadImportImageFailure" value="Windows failed to load image %2 imported from %1 with error status %3." />
        <string id="BootEnv.PreBootTime" value="The time elapsed before Bootmgr, based on the TSC, is %1 ms." />
        <string id="BootEnv.PrepareTargetFailure" value="Soft Restart failed to prepare target Operating System. Operation status: %1 failure point: %2" />
        <string id="BootEnv.ProcessPersistentDataFailure" value="Boot application failed to process persistent data with status: %1" />
        <string id="BootEnv.ProviderName" value="Microsoft-Windows-Kernel-Boot" />
        <string id="BootEnv.RetrieveDriverListTime" value="Retrieving the driver list took %1 milliseconds." />
        <string id="BootEnv.SecureBootBcdPolicyViolation" value="Element %2 of application %1 was not in policy." />
        <string id="BootEnv.SecureBootPolicyUpdate" value="A Secure Boot Policy update resulted in status %1." />
        <string id="BootEnv.SecureBootRevocationUpdate" value="A Secure Boot Revocation List update resulted in status %1." />
        <string id="BootEnv.SecureBootVariableUsage" value="Variable %1 requires %2 bytes and was set with status %3." />
        <string id="BootEnv.SiPolicyFailure" value="Windows system integrity policy does not allow to load the required system file %1 with error status %2." />
        <string id="BootEnv.UserInputTime" value="The bootmgr spent %1 ms waiting for user input." />
        <string id="BootEnv.VsmPolicyFailure" value="The Virtualization Based Security enablement policy check at phase %1 failed with status: %2" />
        <string id="CME_ETW_EVENT_ALTSORT_LOCALE_MISMATCH.EventMessage" value="&quot;%1&quot; is not a supported sort order for locale &quot;%2&quot;." />
        <string id="CME_ETW_EVENT_BAD_XML.EventMessage" value="The user tried to apply an unattended XML file (%1) in an unsupported format. Reason: %3 (Line %2). The system has not been changed." />
        <string id="CME_ETW_EVENT_CALENDAR.EventMessage" value="The user changed their calendar to &quot;%1&quot;." />
        <string id="CME_ETW_EVENT_CALENDAR_PERM.EventMessage" value="The user does not have permission to change the calendar." />
        <string id="CME_ETW_EVENT_CHANGED_ALTSORT.EventMessage" value="The user changed their alternate sort to &quot;%1&quot;." />
        <string id="CME_ETW_EVENT_COPY_PERM.EventMessage" value="The user does not have permission to copy current settings to the Default and/or System Account" />
        <string id="CME_ETW_EVENT_COPY_SETTINGS_DEF.EventMessage" value="The current user settings were copied to the default user account." />
        <string id="CME_ETW_EVENT_COPY_SETTINGS_SYS.EventMessage" value="The current user settings were copied to the system accounts." />
        <string id="CME_ETW_EVENT_FILE_NOT_FOUND.EventMessage" value="The user tried to apply an unattended XML file %1, but the file does not exist." />
        <string id="CME_ETW_EVENT_GEOID_CHANGED.EventMessage" value="The user changed their location preference (geoid) to %1." />
        <string id="CME_ETW_EVENT_GEOID_INVALID.EventMessage" value="Error while changing location preference (geoid): %1. This error may be caused by an unsupported location preference (geoid) or a Group Policy restriction. Error code is %2. Error message: %3" />
        <string id="CME_ETW_EVENT_INTERNAL.EventMessage" value="Failed when calling internal function. Error code is: %1" />
        <string id="CME_ETW_EVENT_INVALID_ALTSORT.EventMessage" value="Unsupported alternate sort &quot;%1&quot;." />
        <string id="CME_ETW_EVENT_INVALID_CALENDAR.EventMessage" value="The selected calendar &quot;%1;&quot; (specified by the Calendar element) is not a supported calendar. The user locale was not changed." />
        <string id="CME_ETW_EVENT_INVALID_FLAG.EventMessage" value="Unexpected failure. Unsupported flag" />
        <string id="CME_ETW_EVENT_INVALID_PARAM.EventMessage" value="Unexpected failure. Unsupported parameter" />
        <string id="CME_ETW_EVENT_INVALID_TWO_DIGIT_YEAR.EventMessage" value="The selected TwoDigitYearMax &quot;%1;&quot; (specified by the TwoDigitYearMax element) is not a supported value. The user locale was not changed." />
        <string id="CME_ETW_EVENT_INVALID_XML.EventMessage" value="Unsupported XML in function." />
        <string id="CME_ETW_EVENT_KB_ERR.EventMessage" value="Error while changing keyboard/input method for &quot;%1&quot;." />
        <string id="CME_ETW_EVENT_LOCALE_ERR.EventMessage" value="The user locale &quot;%1&quot; (specified by the UserLocale element) is not a supported locale name or is not installed on the system. The user locale was not changed." />
        <string id="CME_ETW_EVENT_MAXYEAR.EventMessage" value="The user changed their TwoDigitYearMax to %1." />
        <string id="CME_ETW_EVENT_MAXYEAR_PERM.EventMessage" value="The user does not have permission to change the TwoDigitYearMax setting" />
        <string id="CME_ETW_EVENT_MUI_FALLBACK_CHANGE.EventMessage" value="The user has changed their UI Language fallback order to &quot;%1&quot;." />
        <string id="CME_ETW_EVENT_MUI_FALLBACK_CHANGE_ERR.EventMessage" value="Failed to change UI Language fallback order to &quot;%1&quot;. Status code is: %2." />
        <string id="CME_ETW_EVENT_MUI_LANG_CHANGE.EventMessage" value="The user has changed their UI Language to &quot;%1&quot;." />
        <string id="CME_ETW_EVENT_MUI_LANG_CHANGE_ERR.EventMessage" value="Failed to change UI Language to &quot;%1&quot;. Status code is: %2." />
        <string id="CME_ETW_EVENT_OPERATION_TIMEOUT.EventMessage" value="The operation timed out." />
        <string id="CME_ETW_EVENT_SET_AS_CURRENT.EventMessage" value="The locale has to be changed to the current locale in order to make customizations." />
        <string id="CME_ETW_EVENT_SET_LOCALE_INFO_ERROR.EventMessage" value="Error while the user changed setting &quot;%1&quot; with value &quot;%2&quot; for the current user locale. Error code is: %3. Error message: %4" />
        <string id="CME_ETW_EVENT_STACK_OVERFLOW.EventMessage" value="Unexpected failure. Stack overflow" />
        <string id="CME_ETW_EVENT_SYS_CHANGE.EventMessage" value="The system locale (specified by the SystemLocale element) was changed to &quot;%1&quot;." />
        <string id="CME_ETW_EVENT_SYS_ERROR.EventMessage" value="Internal error while changing System locale (specified by the SystemLocale element)." />
        <string id="CME_ETW_EVENT_SYS_INVALID.EventMessage" value="The selected system locale (specified by the SystemLocale element) is not installed on the system. The system locale was not changed." />
        <string id="CME_ETW_EVENT_SYS_PERM.EventMessage" value="The user does not have permission to change the system locale (specified by the SystemLocale element)." />
        <string id="CME_ETW_EVENT_UNRECOVERABLE.EventMessage" value="Unexpected failure. Unrecoverable error." />
        <string id="CME_ETW_EVENT_USERLOCALE_CHANGE.EventMessage" value="The user changed their user locale (specified by the UserLocale element) to &quot;%1&quot;." />
        <string id="CME_ETW_EVENT_USERLOCALE_RESET.EventMessage" value="The user reset all customizations for their user locale &quot;%1&quot; (specified by the UserLocale element) to the system default." />
        <string id="CME_ETW_EVENT_USERLOCALE_SETTING.EventMessage" value="The user changed their user locale setting &quot;%1&quot; (specified by the UserLocale element) to &quot;%2&quot;." />
        <string id="CME_ETW_POLICY_SYSTEM_LOCALE.EventMessage" value="Group Policy has prevented the user from changing the system locale (specified by the SystemLocale element)." />
        <string id="COM.ProviderName" value="Microsoft-Windows-COM" />
        <string id="COM_CLASSNOTREG_ERROR.KeywordMessage" value="Deprecated COM interfaces" />
        <string id="COMClassNotReg.EventMessage" value="Deprecated COM CLSID %1." />
        <string id="ComponentOnDemand.EventMessage" value="Windows component on demand %1." />
        <string id="CurDirDllLoadFailureError.EventMessage" value="Loading dependency %2 from the current directory was not allowed when attempted by %1. No other DLL was found and the dependency resolution failed. For more information, see http://go.microsoft.com/fwlink/?LinkId=718136." />
        <string id="CurDirDllLoadFailureWarning.EventMessage" value="Loading dependency %2 from the current directory was not allowed when attempted by %1. Another DLL was found: %3. For more information, see http://go.microsoft.com/fwlink/?LinkId=718136." />
        <string id="DeprecatedDll.EventMessage" value="Deprecated module %1." />
        <string id="Disk.Flush.EventMessage" value="Buffers flushed to disk %1." />
        <string id="Disk.Read.EventMessage" value="%3 bytes read from disk %1 at %5." />
        <string id="Disk.Write.EventMessage" value="%3 bytes written to disk %1 at %5." />
        <string id="DllLoadFailure.EventMessage" value="Error status code %1 returned when %3 attempted to load dependency %2." />
        <string id="ETW.channel.admin.message" value="Microsoft-Windows-Kernel-EventTracing/Admin" />
        <string id="ETW.channel.analytic.message" value="Microsoft-Windows-Kernel-EventTracing/Analytic" />
        <string id="ETW.event.ETW_EVENT_BACKING_FILE_FULL.message" value="The backing-file for the real-time session &quot;%1&quot; has reached its maximum size. As a result, new events will not be logged to this session until space becomes available. This error is often caused by starting a trace session in real-time mode without having any real-time consumers." />
        <string id="ETW.event.ETW_EVENT_CHANGE_PROVIDER_SD.message" value="The security settings of provider %1 have been modified from %2 to %3." />
        <string id="ETW.event.ETW_EVENT_CHANGE_SESSION_SD.message" value="The security descriptor for session &quot;%3&quot; has been updated." />
        <string id="ETW.event.ETW_EVENT_FLUSH_TRACE.message" value="The events from session &quot;%3&quot; have been flushed." />
        <string id="ETW.event.ETW_EVENT_MAX_FILE_SIZE_REACHED.message" value="The maximum file size for session &quot;%1&quot; has been reached. As a result, events might be lost (not logged) to file &quot;%2&quot;. The maximum files size is currently set to %5 bytes." />
        <string id="ETW.event.ETW_EVENT_PROVIDER_DISABLED.message" value="Provider %1 is no longer enabled to session &quot;%2&quot;." />
        <string id="ETW.event.ETW_EVENT_PROVIDER_ENABLED.message" value="Provider %1 has been enabled to session &quot;%2&quot;." />
        <string id="ETW.event.ETW_EVENT_PROVIDER_REGISTER.message" value="Provider %1 was registered with Event Tracing for Windows." />
        <string id="ETW.event.ETW_EVENT_PROVIDER_UNREGISTERS.message" value="Provider %1 was unregistered from Event Tracing for Windows." />
        <string id="ETW.event.ETW_EVENT_SESSION_END_FAILED.message" value="Session &quot;%1&quot; stopped due to the following error: %3" />
        <string id="ETW.event.ETW_EVENT_SESSION_START_FAILED.message" value="Session &quot;%1&quot; failed to start with the following error: %3" />
        <string id="ETW.event.ETW_EVENT_START_TRACE.message" value="Session &quot;%3&quot; was started." />
        <string id="ETW.event.ETW_EVENT_STOP_TRACE.message" value="Session &quot;%3&quot; was stopped." />
        <string id="ETW.event.ETW_EVENT_SWITCH_TO_NEW_FILE_FAILED.message" value="An error was encountered while tracing session &quot;%2&quot; was switching to the &quot;%1&quot; event log file. Error: %3" />
        <string id="ETW.event.ETW_EVENT_UPDATE_TRACE.message" value="The configuration of session &quot;%3&quot; has been modified." />
        <string id="ETW.event.ETW_EVENT_USER_MODE_STACK_TRACE.message" value="Stack correlation event. This event contains a call stack which is associated with a prior event which is correlated by the MatchId." />
        <string id="ETW.event.ETW_EVENT_WRITE_FAILED.message" value="Session &quot;%1&quot; failed to write to log file &quot;%2&quot; with the following error: %3" />
        <string id="ETW.keyword.EVENT_TRACING_KEYWORD_LOST_EVENT.message" value="Lost Event" />
        <string id="ETW.keyword.EVENT_TRACING_KEYWORD_PROVIDER.message" value="Provider" />
        <string id="ETW.keyword.EVENT_TRACING_KEYWORD_SESSION.message" value="Session" />
        <string id="ETW.opcode.ETW_OPCODE_CONFIGURE.message" value="Configure" />
        <string id="ETW.opcode.ETW_OPCODE_DISABLE.message" value="Disable" />
        <string id="ETW.opcode.ETW_OPCODE_ENABLE.message" value="Enable" />
        <string id="ETW.opcode.ETW_OPCODE_FILE_SWITCH.message" value="File Switch" />
        <string id="ETW.opcode.ETW_OPCODE_FLUSH.message" value="Flush" />
        <string id="ETW.opcode.ETW_OPCODE_REGISTER.message" value="Register" />
        <string id="ETW.opcode.ETW_OPCODE_START.message" value="Start" />
        <string id="ETW.opcode.ETW_OPCODE_STOP.message" value="Stop" />
        <string id="ETW.opcode.ETW_OPCODE_UNREGISTER.message" value="Unregister" />
        <string id="ETW.opcode.ETW_OPCODE_USER_MODE_STACK_TRACE.message" value="User Mode Stack Trace" />
        <string id="ETW.opcode.ETW_OPCODE_WRITE_BUFFER.message" value="Write Buffer" />
        <string id="ETW.ProviderName" value="Microsoft-Windows-Kernel-EventTracing" />
        <string id="ETW.ReasonMap.AppendAutologgerBufferSizeMismatch.message" value="BufferSize mismatch" />
        <string id="ETW.ReasonMap.AppendBuffersWrittenZero.message" value="Number of buffers written is zero" />
        <string id="ETW.ReasonMap.AppendProcessorCountMismatch.message" value="Numberf of processors mismatch" />
        <string id="ETW.ReasonMap.FileSizeQueryFailed.message" value="File size query failed" />
        <string id="ETW.ReasonMap.MaxFileSizeReached.message" value="Maximum file size reached" />
        <string id="ETW.ReasonMap.UnsupportedAppendBufferSize.message" value="Unsupported BufferSize" />
        <string id="ETW.ReasonMap.UnsupportedAppendLoggerMode.message" value="Logger mode incompatible with Append mode" />
        <string id="ETW.ReasonMap.UnsupportedAppendOsVersion.message" value="OS version mismatch" />
        <string id="ETW.ReasonMap.UnsupportedAppendPointerSize.message" value="Pointer size mismatch" />
        <string id="ETW.ReasonMap.UnsupportedAppendPreallocateMode.message" value="Preallocate mode is incompatible with Append mode" />
        <string id="ETW.task.ETW_TASK_LOGGING.message" value="Logging" />
        <string id="ETW.task.ETW_TASK_LOST_EVENT.message" value="Lost Event" />
        <string id="ETW.task.ETW_TASK_PROVIDER.message" value="Provider" />
        <string id="ETW.task.ETW_TASK_SESSION.message" value="Session" />
        <string id="ETW.task.ETW_TASK_STACK_TRACE.message" value="Stack Trace" />
        <string id="FatalUserCallbackException.EventMessage" value="Process %2 encountered a fatal user callback exception." />
        <string id="ImageLoad.EventMessage" value="Process %3 had an image loaded with name %7." />
        <string id="ImageUnload.EventMessage" value="Process %3 had an image unloaded with name %7." />
        <string id="InternationalProviderName" value="Microsoft-Windows-International" />
        <string id="IoMgr.channel.operational.message" value="Microsoft-Windows-Kernel-IO/Operational" />
        <string id="IoMgr.ProviderName" value="Microsoft-Windows-Kernel-IO" />
        <string id="IoMgr_MountBegin.EventMessage" value="Windows has started processing the volume mount request.%n%n           Volume GUID: %1%n           Volume Name: %3%n" />
        <string id="IoMgr_MountFailed.EventMessage" value="Windows failed to mount the volume.%n%n           Status: %4%n           Volume GUID: %1%n           Volume Name: %3%n" />
        <string id="IoMgr_MountSucceeded.EventMessage" value="The volume has been successfully mounted.%n%n           Volume GUID: %1%n           Volume Name: %3%n" />
        <string id="JobStart.EventMessage" value="Job %1 started with status code %2." />
        <string id="JobTerminate.EventMessage" value="Job %1 terminated with status code %2." />
        <string id="KERNEL_GENERAL_KEYWORD_TIME.KeywordMessage" value="Time" />
        <string id="KERNEL_GENERAL_START.EventMessage" value="The operating system started at system time %7." />
        <string id="KERNEL_GENERAL_STOP.EventMessage" value="The operating system is shutting down at system time %1." />
        <string id="KERNEL_NETWORK_OPCODE_ACCEPT.OpcodeMessage" value="Connection accepted." />
        <string id="KERNEL_NETWORK_OPCODE_CONNECT.OpcodeMessage" value="Connection attempted." />
        <string id="KERNEL_NETWORK_OPCODE_DISCONNECT.OpcodeMessage" value="Disconnect issued." />
        <string id="KERNEL_NETWORK_OPCODE_FAIL.OpcodeMessage" value="TCP connection attempt failed." />
        <string id="KERNEL_NETWORK_OPCODE_FAILUDP.OpcodeMessage" value="UDP connection attempt failed." />
        <string id="KERNEL_NETWORK_OPCODE_RECONNECT.OpcodeMessage" value="Reconnect attempted." />
        <string id="KERNEL_NETWORK_OPCODE_RECV.OpcodeMessage" value="Data received." />
        <string id="KERNEL_NETWORK_OPCODE_RECVUDP.OpcodeMessage" value="Data received over UDP protocol." />
        <string id="KERNEL_NETWORK_OPCODE_RETRANSMIT.OpcodeMessage" value="Data retransmitted." />
        <string id="KERNEL_NETWORK_OPCODE_SEND.OpcodeMessage" value="Data sent." />
        <string id="KERNEL_NETWORK_OPCODE_SENDUDP.OpcodeMessage" value="Data sent over UDP protocol." />
        <string id="KERNEL_NETWORK_OPCODE_TCPCOPY.OpcodeMessage" value="Protocol copied data on behalf of user." />
        <string id="KernelAuditApiCalls.ProviderName" value="Microsoft-Windows-Kernel-Audit-API-Calls" />
        <string id="KernelBootDiagnosticsProviderName" value="Microsoft-Windows-Kernel-BootDiagnostics" />
        <string id="KernelDiskProviderName" value="Microsoft-Windows-Kernel-Disk" />
        <string id="KernelFileProviderName" value="Microsoft-Windows-Kernel-File" />
        <string id="KernelGeneralProviderName" value="Microsoft-Windows-Kernel-General" />
        <string id="KernelLicensingCacheCorrupt.EventMessage" value="License policy-cache corruption detected." />
        <string id="KernelLicensingCacheCorruptionFixed.EventMessage" value="License policy-cache corruption has been fixed." />
        <string id="KernelLicensingCacheExpired.EventMessage" value="License policy-cache has expired because it was not updated within expected duration." />
        <string id="KernelNetworkProviderName" value="Microsoft-Windows-Kernel-Network" />
        <string id="KernelProcessProviderName" value="Microsoft-Windows-Kernel-Process" />
        <string id="KernelRegistryProviderName" value="Microsoft-Windows-Kernel-Registry" />
        <string id="KernelShimEngineProviderName" value="Microsoft-Windows-Kernel-ShimEngine" />
        <string id="KernelSystemTimeChange.EventMessage" value="The system time has changed to %1 from %2." />
        <string id="KernelSystemTimeChange.Reason.Application.EventMessage" value="An application or system component changed the time" />
        <string id="KernelSystemTimeChange.Reason.Hardware.EventMessage" value="System time synchronized with the hardware clock" />
        <string id="KernelSystemTimeChange.Reason.Initialize.EventMessage" value="System time initialized during boot" />
        <string id="KernelSystemTimeChange.Reason.TimeZone.EventMessage" value="System time adjusted to the new time zone" />
        <string id="KernelSystemTimeChangeWithReason.EventMessage" value="The system time has changed to %1 from %2.%n%nChange Reason: %3." />
        <string id="KseFlagApplied.EventMessage" value="Flags [%4] were applied to device [%1] - class [%2].%n%nFlags source: %3." />
        <string id="KseFlagApplied.SourceMap.Registry" value="applied through registry" />
        <string id="KseFlagApplied.SourceMap.Sdb" value="applied through compatibility database" />
        <string id="KseOperationalChannel" value="Microsoft-Windows-Kernel-ShimEngine/Operational" />
        <string id="KseShimApplied.EventMessage" value="%3 shim(s) were applied to driver [%1].%n%nShim(s) source: %2.%n%nShim GUID(s): %4." />
        <string id="KseShimApplied.SourceMap.Registry" value="applied through registry" />
        <string id="KseShimApplied.SourceMap.Sdb" value="applied through compatibility database" />
        <string id="Launch16BitApp.EventMessage" value="The process launches a 16 bit process." />
        <string id="LdrFatalInitError.EventMessage" value="A fatal error occured during initalization of %1." />
        <string id="LicensingStartServiceTrigger.ProviderName" value="Microsoft-Windows-LicensingStartServiceTrigger" />
        <string id="LiveDump.channel.analytic.message" value="Microsoft-Windows-Kernel-LiveDump/Analytic" />
        <string id="LiveDump.event.LIVEDUMP_EVENT_CAPTURE_API_END.message" value="Live Dump Capture Dump Data API ended. NT Status: %1." />
        <string id="LiveDump.event.LIVEDUMP_EVENT_CAPTURE_API_START.message" value="Live Dump Capture Dump Data API started." />
        <string id="LiveDump.event.LIVEDUMP_EVENT_CAPTURE_PAGES_WORKFLOW_BUFFERING_END.message" value="Capture Pages Workflow: Copy memory pages ended." />
        <string id="LiveDump.event.LIVEDUMP_EVENT_CAPTURE_PAGES_WORKFLOW_BUFFERING_START.message" value="Capture Pages Workflow: Copy memory pages started." />
        <string id="LiveDump.event.LIVEDUMP_EVENT_CAPTURE_PAGES_WORKFLOW_MIRRORING_PHASE0_END.message" value="Capture Pages Workflow: Mirroring Phase 0 ended." />
        <string id="LiveDump.event.LIVEDUMP_EVENT_CAPTURE_PAGES_WORKFLOW_MIRRORING_PHASE1_END.message" value="Capture Pages Workflow: Mirroring Phase 1 ended." />
        <string id="LiveDump.event.LIVEDUMP_EVENT_CAPTURE_PAGES_WORKFLOW_MIRRORING_START.message" value="Capture Pages Workflow: Mirroring started." />
        <string id="LiveDump.event.LIVEDUMP_EVENT_CAPTURE_PAGES_WORKFLOW_SYSTEM_QUIESCE_END.message" value="Capture Pages Workflow: System Quiesce ended." />
        <string id="LiveDump.event.LIVEDUMP_EVENT_CAPTURE_PAGES_WORKFLOW_SYSTEM_QUIESCE_START.message" value="Capture Pages Workflow: System Quiesce started." />
        <string id="LiveDump.event.LIVEDUMP_EVENT_DISCARD_DEFERRED_DATA_API_END.message" value="Live Dump Discard Deferred Dump Data API ended. NT Status: %1." />
        <string id="LiveDump.event.LIVEDUMP_EVENT_DISCARD_DEFERRED_DATA_API_START.message" value="Live Dump Discard Deferred Dump Data API started." />
        <string id="LiveDump.event.LIVEDUMP_EVENT_MEMORY_PRESSURE_ABORT.message" value="Live Dump request aborted due to memory pressure on system" />
        <string id="LiveDump.event.LIVEDUMP_EVENT_SIZING_WORKFLOW_BUFFER_ALLOCATION.message" value="Sizing Workflow: Allocation. NT: %1 bytes. Hypervisor: Primary %2 bytes. Secondary %3 bytes." />
        <string id="LiveDump.event.LIVEDUMP_EVENT_SIZING_WORKFLOW_BUFFER_ESTIMATION.message" value="Sizing Workflow: Estimation. NT: %2 bytes (Minimum %1 bytes). Hypervisor: Primary %3 bytes. Secondary %4 bytes." />
        <string id="LiveDump.event.LIVEDUMP_EVENT_SIZING_WORKFLOW_MIRRORING_PHASE0_END.message" value="Sizing Workflow: Mirroring Phase 0 ended." />
        <string id="LiveDump.event.LIVEDUMP_EVENT_SIZING_WORKFLOW_MIRRORING_PHASE1_END.message" value="Sizing Workflow: Mirroring Phase 1 ended." />
        <string id="LiveDump.event.LIVEDUMP_EVENT_SIZING_WORKFLOW_MIRRORING_START.message" value="Sizing Workflow: Mirroring started." />
        <string id="LiveDump.event.LIVEDUMP_EVENT_SIZING_WORKFLOW_REMOVEPAGES_CALLBACK_END.message" value="Sizing Workflow: RemovePages Callback %1 ended." />
        <string id="LiveDump.event.LIVEDUMP_EVENT_SIZING_WORKFLOW_REMOVEPAGES_CALLBACK_FAILURE.message" value="Sizing Workflow: RemovePages Callback %1 failed. NT Status: %2." />
        <string id="LiveDump.event.LIVEDUMP_EVENT_SIZING_WORKFLOW_REMOVEPAGES_CALLBACK_START.message" value="Sizing Workflow: RemovePages Callback %1 started." />
        <string id="LiveDump.event.LIVEDUMP_EVENT_SIZING_WORKFLOW_REMOVEPAGES_CALLBACKS_END.message" value="Sizing Workflow: RemovePages Callbacks ended." />
        <string id="LiveDump.event.LIVEDUMP_EVENT_SIZING_WORKFLOW_REMOVEPAGES_CALLBACKS_START.message" value="Sizing Workflow: RemovePages Callbacks started." />
        <string id="LiveDump.event.LIVEDUMP_EVENT_SIZING_WORKFLOW_SYSTEM_QUIESCE_END.message" value="Sizing Workflow: System Quiesce ended." />
        <string id="LiveDump.event.LIVEDUMP_EVENT_SIZING_WORKFLOW_SYSTEM_QUIESCE_START.message" value="Sizing Workflow: System Quiesce started." />
        <string id="LiveDump.event.LIVEDUMP_EVENT_WRITE_DEFERRED_DATA_API_END.message" value="Live Dump Write Deferred Dump Data API ended. NT Status: %1." />
        <string id="LiveDump.event.LIVEDUMP_EVENT_WRITE_DEFERRED_DATA_API_START.message" value="Live Dump Write Deferred Dump Data API started." />
        <string id="LiveDump.event.LIVEDUMP_EVENT_WRITE_DEFERRED_DUMPDATA_TO_FILE_END.message" value="Write deferred dump data to file ended. NT Status: %1. Total %2 bytes (Header|Primary|Secondary: %3|%4|%5 bytes)." />
        <string id="LiveDump.event.LIVEDUMP_EVENT_WRITE_DEFERRED_DUMPDATA_TO_FILE_START.message" value="Write deferred dump data to file started." />
        <string id="LiveDump.event.LIVEDUMP_EVENT_WRITE_DUMPDATA_TO_FILE_END.message" value="Writing dump file ended. NT Status: %1. Total %2 bytes (Header|Primary|Secondary: %3|%4|%5 bytes)." />
        <string id="LiveDump.event.LIVEDUMP_EVENT_WRITE_DUMPDATA_TO_FILE_START.message" value="Writing dump file started." />
        <string id="LiveDump.opcode.LIVEDUMP_API_END.message" value="API End" />
        <string id="LiveDump.opcode.LIVEDUMP_API_START.message" value="API Start" />
        <string id="LiveDump.opcode.LIVEDUMP_BUFFER_ALLOCATION.message" value="Buffer Allocation Data" />
        <string id="LiveDump.opcode.LIVEDUMP_BUFFER_ESTIMATION.message" value="Buffer Estimation Data" />
        <string id="LiveDump.opcode.LIVEDUMP_DUMPFILE_WRITE_END.message" value="Dump File Write End" />
        <string id="LiveDump.opcode.LIVEDUMP_DUMPFILE_WRITE_START.message" value="Dump File Write Start" />
        <string id="LiveDump.opcode.LIVEDUMP_MIRRORING_PHASE0_END.message" value="Mirroring Phase 0 End" />
        <string id="LiveDump.opcode.LIVEDUMP_MIRRORING_PHASE1_END.message" value="Mirroring Phase 1 End" />
        <string id="LiveDump.opcode.LIVEDUMP_MIRRORING_START.message" value="Mirroring Start" />
        <string id="LiveDump.opcode.LIVEDUMP_PAGE_BUFFERING_END.message" value="Copying Memory Pages End" />
        <string id="LiveDump.opcode.LIVEDUMP_PAGE_BUFFERING_START.message" value="Copying Memory Pages Start" />
        <string id="LiveDump.opcode.LIVEDUMP_REMOVEPAGES.message" value="Remove Pages Callbacks" />
        <string id="LiveDump.opcode.LIVEDUMP_SYSTEM_QUIESCE_END.message" value="System Quiesce End" />
        <string id="LiveDump.opcode.LIVEDUMP_SYSTEM_QUIESCE_START.message" value="System Quiesce Start" />
        <string id="LiveDump.ProviderName" value="Microsoft-Windows-Kernel-LiveDump" />
        <string id="LiveDump.task.LIVEDUMP_TASK_CAPTURE_API.message" value="Live Dump Capture Dump Data API" />
        <string id="LiveDump.task.LIVEDUMP_TASK_CAPTURE_PAGES_WORKFLOW.message" value="Capture Pages Workflow" />
        <string id="LiveDump.task.LIVEDUMP_TASK_DISCARD_DEFERRED_DATA_API.message" value="Live Dump Discard Deferred Dump Data API" />
        <string id="LiveDump.task.LIVEDUMP_TASK_SIZING_WORKFLOW.message" value="Sizing Workflow" />
        <string id="LiveDump.task.LIVEDUMP_TASK_WRITE_DEFERRED_DATA_API.message" value="Live Dump Write Deferred Dump Data API" />
        <string id="LoaderFatalErrorProc.EventMessage" value="The Loader encountered a fatal error running process image name %1." />
        <string id="LoaderFatalErrorThread.EventMessage" value="The Loader encountered a fatal error while loading a thread from process image name %1." />
        <string id="MUI_ETW_CHANNEL_ADMIN.Description" value="This channel contains admin events about international functionality from MUI" />
        <string id="MUI_ETW_CHANNEL_ADMIN.Name" value="Microsoft-Windows-MUI/Admin" />
        <string id="MUI_ETW_CHANNEL_ANALYTIC.Description" value="This channel contains analytic events about international functionality from MUI" />
        <string id="MUI_ETW_CHANNEL_ANALYTIC.Name" value="Microsoft-Windows-MUI/Analytic" />
        <string id="MUI_ETW_CHANNEL_DEBUG.Description" value="This channel contains debug events about international functionality from MUI" />
        <string id="MUI_ETW_CHANNEL_DEBUG.Name" value="Microsoft-Windows-MUI/Debug" />
        <string id="MUI_ETW_CHANNEL_OPERATIONAL.Description" value="This channel contains operational events about international functionality from MUI" />
        <string id="MUI_ETW_CHANNEL_OPERATIONAL.Name" value="Microsoft-Windows-MUI/Operational" />
        <string id="MUI_ETW_EVENT_CALLBACK_DLL_LOAD_FAILURE.EventMessage" value="MUI Callback failed for file %1 because it can not be loaded. To correct this error, replace this file or repair your Windows installation." />
        <string id="MUI_ETW_EVENT_CALLBACK_DLL_NOT_FOUND.EventMessage" value="MUI Callback file %1 cannot be found. To correct this error, repair the registry or copy the file to the specified location." />
        <string id="MUI_ETW_EVENT_CALLBACK_DLL_NOT_SIGNED.EventMessage" value="MUI Callback failed for file %1 because it is not signed by Microsoft. To correct this error, replace with the original file that came with this Windows installation." />
        <string id="MUI_ETW_EVENT_CALLBACK_FUNCTION_NOT_FOUND.EventMessage" value="MUI Callback failed for file %1 registered as type %2 because the function %3 does not exist in the dll. To correct this error, replace the file or fix the registry entry." />
        <string id="MUI_ETW_EVENT_MCBUILDER_CACHEINSTALL_ERROR.EventMessage" value="Newly built resource cache could not be installed on the system." />
        <string id="MUI_ETW_EVENT_MCBUILDER_CACHEWRITE_ERROR.EventMessage" value="Resource cache cannot be opened in writable mode. New resource cache will not be built." />
        <string id="MUI_ETW_EVENT_MCBUILDER_CONFIGDATA_ERROR.EventMessage" value="Unable to parse the cacheable file list or write to the resource cache manifest. If configuration file was specified as command-line parameter, check that file exists and has correct format.  New resource cache will not be built." />
        <string id="MUI_ETW_EVENT_MCBUILDER_CONFIGPARAM.EventMessage" value="Unable to parse configuration parameters. The configuration parameters will be ignored." />
        <string id="MUI_ETW_EVENT_MCBUILDER_CREATEMANIFEST_ERROR.EventMessage" value="Resource cache manifest could not be created. New resource cache will not be built." />
        <string id="MUI_ETW_EVENT_MCBUILDER_DISABLECACHE_ERROR.EventMessage" value="Live resource cache could not be disabled." />
        <string id="MUI_ETW_EVENT_MCBUILDER_ENTRYNOTCACHED.EventMessage" value="Resource file %1 will not be cached since it is not used frequently in the system." />
        <string id="MUI_ETW_EVENT_MCBUILDER_INIT.EventMessage" value="MUI resource cache builder has been called with the following parameters: %1." />
        <string id="MUI_ETW_EVENT_MCBUILDER_INTERNAL_ERROR.EventMessage" value="New resource cache could not be built due to internal error: %1." />
        <string id="MUI_ETW_EVENT_MCBUILDER_MANIFESTENTRY.EventMessage" value="MUI resource cache manifest entry for file %1 has been updated. Affinity: '%2', Sequence: %3, and Priority: %4" />
        <string id="MUI_ETW_EVENT_MCBUILDER_MANIFESTWRITE_ERROR.EventMessage" value="Changes made to resource cache manifest cannot be written to disk. New resource cache will not be built." />
        <string id="MUI_ETW_EVENT_MCBUILDER_NEWCACHE.EventMessage" value="New resource cache built and installed on system. New cache index is %1, live cache index is %2 and config is set to %3." />
        <string id="MUI_ETW_EVENT_MCBUILDER_REDIRECTION_ERROR.EventMessage" value="Wow redirection could not be disabled. New resource cache will not be built." />
        <string id="MUI_ETW_EVENT_MCBUILDER_SYSTEM_CONSTRAINTS.EventMessage" value="The system is constrained in RAM, total disk space or free disk space, so the MUI resource cache will not be maintained." />
        <string id="MUI_ETW_EVENT_MCBUILDER_UILANG_ERROR.EventMessage" value="Unable to retrieve language settings from MUI API. New resource cache will not be built." />
        <string id="MUI_ETW_EVENT_NOTIFY_CALLBACK_RETURN_INFO.EventMessage" value="MUI notification callback API %2 in %1 returned with code %3." />
        <string id="MUI_ETW_EVENT_NOTIFY_ERROR.EventMessage" value="MUI notify operation failed with status code %1. No callbacks were invoked." />
        <string id="MUI_ETW_EVENT_NOTIFY_INIT_INFO.EventMessage" value="MUI notification for UI Language change has been invoked with flags set to %1 and the new languages set to %2 and the previous languages set to %3. The extended flags is set to %4" />
        <string id="MUI_ETW_EVENT_ROUTINE_END.EventMessage" value="End: %1" />
        <string id="MUI_ETW_EVENT_ROUTINE_START.EventMessage" value="Start: %1" />
        <string id="MUI_ETW_OP_ENTRY.OpcodeMessage" value="Start" />
        <string id="MUI_ETW_OP_EXIT.OpcodeMessage" value="End" />
        <string id="MUI_ETW_OP_INIT.OpcodeMessage" value="Start" />
        <string id="MUI_ETW_OP_MCBUILDER_BUILDCACHE.OpcodeMessage" value="Build resource cache" />
        <string id="MUI_ETW_OP_MCBUILDER_DISABLECACHE.OpcodeMessage" value="Disable live cache" />
        <string id="MUI_ETW_OP_MCBUILDER_UPDATEMANIFEST.OpcodeMessage" value="Update resource cache manifest" />
        <string id="MUI_ETW_OP_NOTIFY_OPERATION.OpcodeMessage" value="Invoke callback function" />
        <string id="MUI_ETW_TASK_NOTIFY_CHANGE.TaskMessage" value="MUI NotifyUILanguageChange task" />
        <string id="MUI_ETW_TASK_RESCACHE_BUILD.TaskMessage" value="MUI resource cache builder" />
        <string id="MUIEventProviderName" value="Microsoft-Windows-MUI" />
        <string id="Network.AcceptIPV4.EventMessage" value="TCPv4: Connection established between %4:%6 and %3:%5." />
        <string id="Network.AcceptIPV6.EventMessage" value="TCPv6: Connection established between %4:%6 and %3:%5." />
        <string id="Network.ConnectIPV4.EventMessage" value="TCPv4: Connection attempted between %4:%6 and %3:%5." />
        <string id="Network.ConnectIPV6.EventMessage" value="TCPv6: Connection attempted between %4:%6 and %3:%5." />
        <string id="Network.DisconnectIPV4.EventMessage" value="TCPv4: Connection closed between %4:%6 and %3:%5." />
        <string id="Network.DisconnectIPV6.EventMessage" value="TCPv6: Connection closed between %4:%6 and %3:%5." />
        <string id="Network.Fail.EventMessage" value="TCPv4: Connection attempt failed with error code %2." />
        <string id="Network.FailUdp.EventMessage" value="UDPv4: Connection attempt failed with error code %2." />
        <string id="Network.ReconnectIPV4.EventMessage" value="TCPv4: Reconnect attempt between %4:%6 and %3:%5." />
        <string id="Network.ReconnectIPV6.EventMessage" value="TCPv6: Reconnect attempt between %4:%6 and %3:%5." />
        <string id="Network.RecvIPV4.EventMessage" value="TCPv4: %2 bytes received from %4:%6 to %3:%5." />
        <string id="Network.RecvIPV4Udp.EventMessage" value="UDPv4: %2 bytes received from %4:%6 to %3:%5." />
        <string id="Network.RecvIPV6.EventMessage" value="TCPv6: %2 bytes received from %4:%6 to %3:%5." />
        <string id="Network.RecvIPV6Udp.EventMessage" value="UDPv6: %2 bytes received from %4:%6 to %3:%5." />
        <string id="Network.RetransmitIPV4.EventMessage" value="TCPv4: %2 bytes retransmitted from %4:%6 to %3:%5." />
        <string id="Network.RetransmitIPV6.EventMessage" value="TCPv6: %2 bytes retransmitted from %4:%6 to %3:%5." />
        <string id="Network.SendIPV4.EventMessage" value="TCPv4: %2 bytes transmitted from %4:%6 to %3:%5." />
        <string id="Network.SendIPV4Udp.EventMessage" value="UDPv4: %2 bytes transmitted from %4:%6 to %3:%5." />
        <string id="Network.SendIPV6.EventMessage" value="TCPv6: %2 bytes transmitted from %4:%6 to %3:%5." />
        <string id="Network.SendIPV6Udp.EventMessage" value="UDPv6: %2 bytes transmitted from %4:%6 to %3:%5." />
        <string id="Network.TcpCopyIPV4.EventMessage" value="TCPv4: %2 bytes copied in protocol on behalf of user for connection between %4:%6 and %3:%5." />
        <string id="Network.TcpCopyIPV6.EventMessage" value="TCPv6: %2 bytes copied in protocol on behalf of user for connection between %4:%6 and %3:%5." />
        <string id="NLS_ETW_CHANNEL_OPERATIONAL.Description" value="This channel contains operational events about international functionality from NLS" />
        <string id="NLS_ETW_CHANNEL_OPERATIONAL.Name" value="Microsoft-Windows-International/Operational" />
        <string id="NLS_ETW_EVENT_CODEPAGE_CORRUPT.EventMessage" value="NLS codepage operation failed for the codepage %1 because the file %2 is corrupted. To correct this error, replace this file or repair your Windows installation." />
        <string id="NLS_ETW_EVENT_CODEPAGE_MISSING.EventMessage" value="NLS codepage operation failed for the codepage %1 because the file %2 is missing.  To correct this error, replace this file or repair your Windows installation." />
        <string id="NLS_ETW_EVENT_HASH_TABLE_ERROR.EventMessage" value="Windows has detected inconsistencies in NLS internal data. To correct this problem, log off of Windows and log on again." />
        <string id="NLS_ETW_EVENT_LOCALE_FILE_CORRUPT.EventMessage" value="NLS operation failed for %1 locale because the file %2\globalization\%1.nlp is corrupted.  To fix this problem, reinstall this custom locale." />
        <string id="NLS_ETW_EVENT_LOCALE_FILE_MISSING.EventMessage" value="NLS operation failed for %1 locale because the file %2\globalization\%1.nlp is missing.  To fix this problem, reinstall this custom locale." />
        <string id="NLS_ETW_EVENT_POLICY_NO_CUSTOM_LOCALES.EventMessage" value="Group Policy does not allow custom user locales for standards and formats. The user was unable to select &quot;%1&quot; as their user locale." />
        <string id="NLS_ETW_EVENT_POLICY_NO_GEO_ID_CHANGE.EventMessage" value="Group Policy has prevented the geographical location from being changed." />
        <string id="NLS_ETW_EVENT_POLICY_NO_USER_OVERRIDE.EventMessage" value="Group Policy has prevented process number %1 (%2) from changing the standards and format information for the user." />
        <string id="NLS_ETW_EVENT_POLICY_RESTRICT_USER_LOCALES.EventMessage" value="Group Policy has prevented the user from changing their user locale to &quot;%1&quot;." />
        <string id="NLS_ETW_EVENT_REG_KEY_OPEN_FAILURE_NTSTATUS.EventMessage" value="The NLS operation failed because the registry key %1 cannot be opened. Status code is %2." />
        <string id="NLS_ETW_EVENT_REG_KEY_OPEN_FAILURE_WIN32_ERROR.EventMessage" value="The NLS operation failed because the registry key %1 cannot be opened. Error code is %2. Error message: %3" />
        <string id="NLS_ETW_EVENT_REG_KEY_OPEN_WARNING.EventMessage" value="NLS operation recreated the registry key %1." />
        <string id="NLS_ETW_EVENT_SET_CALENDAR_INFO.EventMessage" value="Process number %1 (%2) called SetCalendarInfo(%3, %4, %5, &quot;%6&quot;)  successfully." />
        <string id="NLS_ETW_EVENT_SET_LOCALE_INFO.EventMessage" value="Process number %1 (%2) called SetLocaleInfo(%3, %4, &quot;%5&quot;)  successfully." />
        <string id="NLS_ETW_EVENT_SET_USER_GEO_ID.EventMessage" value="Process number %1 (%2) called SetUserGeoID(%3) successfully." />
        <string id="NLS_ETW_EVENT_UPDATE_LOCALE.EventMessage" value="The system updated the locale &quot;%1&quot; with flag %2. Process number %3 (%4). Return code is %5." />
        <string id="NLS_ETW_OP_CLEANUP.OpcodeMessage" value="NLS clean-up operations" />
        <string id="NLS_ETW_OP_CONFIG_CHANGE.OpcodeMessage" value="NLS configuration changes" />
        <string id="NLS_ETW_OP_DATA_TABLE.OpcodeMessage" value="NLS data table operations" />
        <string id="NLS_ETW_OP_INIT.OpcodeMessage" value="NLS initialization" />
        <string id="NLS_ETW_OP_OPERATION.OpcodeMessage" value="NLS operations" />
        <string id="NLS_ETW_TASK_CME.TaskMessage" value="NLS Unattended Regional and Language Options" />
        <string id="NLS_ETW_TASK_CODEPAGE.TaskMessage" value="NLS code page functions" />
        <string id="NLS_ETW_TASK_DATETIME.TaskMessage" value="NLS date/time functions" />
        <string id="NLS_ETW_TASK_GROUP_POLICY.TaskMessage" value="NLS group policy" />
        <string id="NLS_ETW_TASK_LOCALE.TaskMessage" value="NLS locale functions" />
        <string id="PciProviderName" value="Microsoft-Windows-PCI" />
        <string id="ProcessFlags.PackageId" value="PackageId" />
        <string id="ProcessFreezeEvent.EventMessage" value="Execution of the process %1 has been suspended." />
        <string id="ProcessRundown.EventMessage" value="Enumerated process %1 had started at time %2 by parent %3 running in session %4 with name %6." />
        <string id="ProcessStart.EventMessage" value="Process %1 started at time %2 by parent %3 running in session %4 with name %6." />
        <string id="ProcessStart_V0.EventMessage" value="Process %1 started at time %2 by parent %3 running in session %4 with name %5." />
        <string id="ProcessStart_V1.EventMessage" value="Process %1 started at time %2 by parent %3 running in session %4 with name %6." />
        <string id="ProcessStop.EventMessage" value="Process %1 (which started at time %2) stopped at time %3 with exit code %4." />
        <string id="ProcessThawEvent.EventMessage" value="Execution of the process %1 has been resumed." />
        <string id="REG_EVENT_CLEAR_ACCESS.EventMessage" value="The access history in hive %2 was cleared updating %3 keys and creating %4 modified pages." />
        <string id="REG_EVENT_FLUSH_IO_FAIL.EventMessage" value="An I/O operation initiated by the Registry failed unrecoverably.The Registry could not flush hive (file): '%3'." />
        <string id="REG_EVENT_REORGANIZE.EventMessage" value="Hive %2 was reorganized with a starting size of %3 bytes and an ending size of %4 bytes." />
        <string id="REG_EVENT_SELFHEAL.EventMessage" value="{Registry Hive Recovered} Registry hive (file): '%3' was corrupted and it has been recovered. Some data might have been lost." />
        <string id="REG_EVENT_TXR_INIT.EventMessage" value="TxR init phase for hive %2 (TM: %3, RM: %4) finished with result=%5 (Internal code=%6)." />
        <string id="RegistryPerformance.TaskMessage.HiveFlush" value="This group of events tracks the performance of flushing hives." />
        <string id="RegistryPerformance.TaskMessage.HiveLoad" value="This group of events tracks the performance of loading hives." />
        <string id="RegistryPerformance.TaskMessage.HiveMount" value="This group of events tracks the performance of mounting hives from existing files." />
        <string id="RegistryPerformance.TaskMessage.HiveRestore" value="This group of events tracks the performance of restoring hives." />
        <string id="RegistryPerformance.TaskMessage.HiveSave" value="This group of events tracks the performance of exporting hives." />
        <string id="RegistryPerformance.TaskMessage.HiveUnload" value="This group of events tracks the performance of unloading hives." />
        <string id="RegistryPerformance.TaskMessage.Shutdown" value="This group of events tracks the performance of registry shutdown." />
        <string id="SrpEvt_AccessAuditByPolicy.EventMessage" value="Access to %1 is monitored by policy rule %2." />
        <string id="SrpEvt_AccessDisabledByPolicyDefault.EventMessage" value="Access to %1 has been restricted by your Administrator by the default software restriction policy level." />
        <string id="SrpEvt_AccessDisabledByPolicyOther.EventMessage" value="Access to %1 has been restricted by your Administrator by policy rule %2." />
        <string id="SrpEvt_AccessDisabledByPolicyPath.EventMessage" value="Access to %1 has been restricted by your Administrator by location with policy rule %2 placed on path %3." />
        <string id="SrpEvt_AccessDisabledByPolicyPublisher.EventMessage" value="Access to %1 has been restricted by your Administrator by software publisher policy." />
        <string id="SrpEvt_AccessDisabledNoSaferUIByPolicy.EventMessage" value="Access to %1 has been restricted by your Administrator by policy rule %2." />
        <string id="SrpEvtProviderName" value="Microsoft-Windows-SoftwareRestrictionPolicies" />
        <string id="StoreMgr.CacheTermination" value="%1%n%nDevice name: %4%nCache path: %6" />
        <string id="StoreMgr.CorruptFlash" value="A data corruption was detected and handled in a ReadyBoost cache. This corruption was most likely caused by faulty hardware. While ReadyBoost will always detect and handle these errors, seeing a lot of these may mean that the ReadyBoost device has worn out which reduces its performance. You should consider replacing the ReadyBoost cache device." />
        <string id="StoreMgr.CorruptPage" value="%5%n%nVirtual Address: %2%nPhysical Address: %3%nCorruption Window Size: %4" />
        <string id="StoreMgr.CorruptRAM" value="A memory corruption was detected and handled. Memory diagnostics should be run on this machine and, if necessary, memory chips should be replaced." />
        <string id="StoreMgr.CT_ReasonCorruption" value="A ReadyBoost cache was deleted due to repeated data corruption instances on the associated device that have been detected and handled. While ReadyBoost will always detect and handle these errors, repeated corruption instances may mean that the ReadyBoost device has worn out which reduces its performance. You should consider replacing the ReadyBoost device." />
        <string id="StoreMgr.CT_ReasonIoFailure" value="A ReadyBoost cache was deleted due to repeated I/O failures on the associated device. This typically happens when the device (e.g. an SD card) is removed, but it may also indicate faulty hardware." />
        <string id="StoreMgr.UnpersistFailure" value="A ReadyBoost cache failed to persist across boot. This may happen if the cache device was modified on another computer or if this computer was booted into another operating system." />
        <string id="StoreMgrOperationalChannelName" value="Microsoft-Windows-Kernel-StoreMgr/Operational" />
        <string id="StoreMgrProviderName" value="Microsoft-Windows-Kernel-StoreMgr" />
        <string id="ThreadCpuBasePriorityChange.EventMessage" value="Base CPU priority of thread %2 in process %1 was changed from %3 to %4." />
        <string id="ThreadCpuPriorityChange.EventMessage" value="CPU priority of thread %2 in process %1 was changed from %3 to %4." />
        <string id="ThreadIoPriorityChange.EventMessage" value="I/O priority of thread %2 in process %1 was changed from %3 to %4." />
        <string id="ThreadPagePriorityChange.EventMessage" value="Page priority of thread %2 in process %1 was changed from %3 to %4." />
        <string id="ThreadStart.EventMessage" value="Thread %2 (in Process %1) started." />
        <string id="ThreadStop.EventMessage" value="Thread %2 (in Process %1) stopped." />
        <string id="UAC.ChannelName" value="Microsoft-Windows-UAC/Operational" />
        <string id="UAC.EventMessage.ErrorElevationRequired" value="The process failed to handle ERROR_ELEVATION_REQUIRED during the creation of a child process." />
        <string id="UAC.ProviderName" value="Microsoft-Windows-UAC" />
        <string id="USER_LOADER_FATAL_CALLBACK_EXCEPTION.KeywordMessage" value="Fatal user callback exception" />
        <string id="USER_LOADER_KEYWORD_COMPONENT_ON_DEMAND.KeywordMessage" value="Windows component on demand." />
        <string id="USER_LOADER_KEYWORD_DEPRECATED_DLL.KeywordMessage" value="Deprecated dlls" />
        <string id="USER_LOADER_KEYWORD_LAUNCH_16BIT_APP.KeywordMessage" value="Launch 16bit application" />
        <string id="USER_LOADER_KEYWORD_LOAD_FAILURE.KeywordMessage" value="A dll failed to load." />
        <string id="USER_LOADER_KEYWORD_LOAD_FATAL_ERROR.KeywordMessage" value="The Loader encountered a fatal error." />
        <string id="UserLoaderProviderName" value="Microsoft-Windows-User-Loader" />
        <string id="WDI_SEM_EVENT_INIT_MISCONFIG.EventMessage" value="The Scenario Event Mapper is configured with an unsupported scenario. The scenario for provider %1 (event ID %2) encountered error code %3 and will be ignored." />
        <string id="WDI_SEM_EVENT_INIT_PROVIDER_MAX.EventMessage" value="The Scenario Event Mapper is configured with more than the maximum number of providers.  The provider %1 will be ignored." />
        <string id="WDI_SEM_EVENT_INIT_SCENARIO_CONTEXT_PROVIDER_MAX.EventMessage" value="The Scenario Event Mapper is configured with more than the maximum number of context providers for the scenario with provider %1 (event ID %2).  The scenario will be ignored." />
        <string id="WDI_SEM_EVENT_INIT_SCENARIO_END_EVENT_MAX.EventMessage" value="The Scenario Event Mapper is configured with more than the maximum number of end events for the scenario with provider %1 (event ID %2).  The scenario will be ignored." />
        <string id="WDI_SEM_EVENT_INIT_SCENARIO_MAX.EventMessage" value="The Scenario Event Mapper is configured with more than the maximum number of scenarios.  The scenario for provider %1 (event ID %2) will be ignored." />
        <string id="WDI_SEM_EVENT_SCENARIO_END.EventMessage" value="The Scenario Event Mapper stopped a scenario for provider %1 (event ID %2) with %4 context providers.  The context logger dropped event count was %3." />
        <string id="WDI_SEM_EVENT_SCENARIO_END_FAILED.EventMessage" value="The Scenario Event Mapper was unable to stop a scenario for provider %1 (event ID %2).  The error code was %3." />
        <string id="WDI_SEM_EVENT_SCENARIO_INFLIGHT_MAX.EventMessage" value="The Scenario Event Mapper was unable to start a new scenario for provider %1 (event ID %2) because the maximum number of scenarios are already in flight." />
        <string id="WDI_SEM_EVENT_SCENARIO_START.EventMessage" value="The Scenario Event Mapper started a scenario for provider %1 (event ID %2) with %4 context providers.  The context logger dropped event count was %3." />
        <string id="WDI_SEM_EVENT_SCENARIO_START_FAILED.EventMessage" value="The Scenario Event Mapper was unable to start a scenario for provider %1 (event ID %2).  The error code was %3." />
        <string id="WDI_SEM_EVENT_SCENARIO_TIMEOUT.EventMessage" value="An in-flight scenario from provider %1 (event ID %2) timed out and was stopped automatically by the Scenario Event Mapper." />
        <string id="WDI_SEM_KEYWORD_CONTEXT.KeywordMessage" value="Verbose context events" />
        <string id="WDI_SEM_KEYWORD_DIAG.KeywordMessage" value="Scenario trigger events" />
        <string id="WDI_SEM_TASK_INIT.TaskMessage" value="SEM Initialization" />
        <string id="WDI_SEM_TASK_INIT_OPCODE_MISCONFIG.OpcodeMessage" value="There is an invalid configuration parameter in the SEM registry namespace." />
        <string id="WDI_SEM_TASK_INIT_OPCODE_PROVIDER_MAX.OpcodeMessage" value="The number of providers specified across all scenarios is above the maximum allowed amount." />
        <string id="WDI_SEM_TASK_INIT_OPCODE_SCENARIO_CONTEXT_PROVIDER_MAX.OpcodeMessage" value="The SEM is configured with a scenario with too many context providers." />
        <string id="WDI_SEM_TASK_INIT_OPCODE_SCENARIO_END_EVENT_MAX.OpcodeMessage" value="The SEM is configured with a scenario that has too many end events." />
        <string id="WDI_SEM_TASK_INIT_OPCODE_SCENARIO_MAX.OpcodeMessage" value="The SEM is configured with more scenarios than the maximum allowed count." />
        <string id="WDI_SEM_TASK_SCENARIO.TaskMessage" value="SEM Scenario Lifecycle" />
        <string id="WDI_SEM_TASK_SCENARIO_OPCODE_END.OpcodeMessage" value="Scenario end disables context providers to the WDI context logger." />
        <string id="WDI_SEM_TASK_SCENARIO_OPCODE_END_FAILED.OpcodeMessage" value="A scenario end attempt failed in the SEM." />
        <string id="WDI_SEM_TASK_SCENARIO_OPCODE_INFLIGHT_MAX.OpcodeMessage" value="The SEM received a request to start a new scenario, but the maximum number of scenarios were already in-flight." />
        <string id="WDI_SEM_TASK_SCENARIO_OPCODE_START.OpcodeMessage" value="Scenario start enables context providers to the WDI context logger." />
        <string id="WDI_SEM_TASK_SCENARIO_OPCODE_START_FAILED.OpcodeMessage" value="A scenario start attempt failed in the SEM." />
        <string id="WDI_SEM_TASK_SCENARIO_OPCODE_TIMEOUT.OpcodeMessage" value="When a scenario has remained in-flight beyond the maximum time window it is automatically terminated by the SEM." />
        <string id="WdiSemAnalyticChannelName" value="Microsoft-Windows-Kernel-WDI/Analytic" />
        <string id="WdiSemDebugChannelName" value="Microsoft-Windows-Kernel-WDI/Debug" />
        <string id="WdiSemOperationalChannelName" value="Microsoft-Windows-Kernel-WDI/Operational" />
        <string id="WdiSemProviderName" value="Microsoft-Windows-Kernel-WDI" />
        <string id="WSServiceStartServiceTrigger.ProviderName" value="Microsoft-Windows-WSServiceStartServiceTrigger" />
      </stringTable>
    </resources>
  </localization>
  <instrumentation>
    <events xmlns="http://schemas.microsoft.com/win/2004/08/events">
      <provider guid="{2ff3e6b7-cb90-4700-9621-443f389734ed}" message="$(string.WdiSemProviderName)" messageFileName="%SystemRoot%\system32\Microsoft-Windows-System-Events.dll" name="Microsoft-Windows-Kernel-WDI" resourceFileName="%SystemRoot%\system32\Microsoft-Windows-System-Events.dll" symbol="WDI_SEM_PROVIDER">
        <channels>
          <channel chid="WDI_SEM_CHANNEL_ANALYTIC" isolation="System" message="$(string.WdiSemAnalyticChannelName)" name="Microsoft-Windows-Kernel-WDI/Analytic" symbol="WDI_SEM_CHANNEL_ANALYTIC" type="Analytic">This channel contains analytic events from the SEM.</channel>
          <channel chid="WDI_SEM_CHANNEL_DEBUG" isolation="System" message="$(string.WdiSemDebugChannelName)" name="Microsoft-Windows-Kernel-WDI/Debug" symbol="WDI_SEM_CHANNEL_DEBUG" type="Debug">This channel contains debug events from the SEM.</channel>
          <channel chid="WDI_SEM_CHANNEL_OPERATIONAL" enabled="true" isolation="System" message="$(string.WdiSemOperationalChannelName)" name="Microsoft-Windows-Kernel-WDI/Operational" symbol="WDI_SEM_CHANNEL_OPERATIONAL" type="Operational">This channel contains operational events from the SEM.</channel>
        </channels>
        <keywords>
          <keyword mask="0x200000000" message="$(string.WDI_SEM_KEYWORD_DIAG.KeywordMessage)" name="diag" symbol="WDI_SEM_KEYWORD_DIAG" />
          <keyword mask="0x100000000" message="$(string.WDI_SEM_KEYWORD_CONTEXT.KeywordMessage)" name="context" symbol="WDI_SEM_KEYWORD_CONTEXT" />
        </keywords>
        <opcodes>
          <opcode message="$(string.WDI_SEM_TASK_SCENARIO_OPCODE_START.OpcodeMessage)" name="WDI_SEM_TASK_SCENARIO_OPCODE_START" symbol="WDI_SEM_TASK_SCENARIO_OPCODE_START" value="10" />
          <opcode message="$(string.WDI_SEM_TASK_SCENARIO_OPCODE_END.OpcodeMessage)" name="WDI_SEM_TASK_SCENARIO_OPCODE_END" symbol="WDI_SEM_TASK_SCENARIO_OPCODE_END" value="11" />
          <opcode message="$(string.WDI_SEM_TASK_SCENARIO_OPCODE_TIMEOUT.OpcodeMessage)" name="WDI_SEM_TASK_SCENARIO_OPCODE_TIMEOUT" symbol="WDI_SEM_TASK_SCENARIO_OPCODE_TIMEOUT" value="12" />
          <opcode message="$(string.WDI_SEM_TASK_SCENARIO_OPCODE_START_FAILED.OpcodeMessage)" name="WDI_SEM_TASK_SCENARIO_OPCODE_START_FAILED" symbol="WDI_SEM_TASK_SCENARIO_OPCODE_START_FAILED" value="13" />
          <opcode message="$(string.WDI_SEM_TASK_SCENARIO_OPCODE_END_FAILED.OpcodeMessage)" name="WDI_SEM_TASK_SCENARIO_OPCODE_END_FAILED" symbol="WDI_SEM_TASK_SCENARIO_OPCODE_END_FAILED" value="14" />
          <opcode message="$(string.WDI_SEM_TASK_SCENARIO_OPCODE_INFLIGHT_MAX.OpcodeMessage)" name="WDI_SEM_TASK_SCENARIO_OPCODE_INFLIGHT_MAX" symbol="WDI_SEM_TASK_SCENARIO_OPCODE_INFLIGHT_MAX" value="15" />
          <opcode message="$(string.WDI_SEM_TASK_INIT_OPCODE_MISCONFIG.OpcodeMessage)" name="WDI_SEM_TASK_INIT_OPCODE_MISCONFIG" symbol="WDI_SEM_TASK_INIT_OPCODE_MISCONFIG" value="16" />
          <opcode message="$(string.WDI_SEM_TASK_INIT_OPCODE_SCENARIO_MAX.OpcodeMessage)" name="WDI_SEM_TASK_INIT_OPCODE_SCENARIO_MAX" symbol="WDI_SEM_TASK_INIT_OPCODE_SCENARIO_MAX" value="17" />
          <opcode message="$(string.WDI_SEM_TASK_INIT_OPCODE_SCENARIO_CONTEXT_PROVIDER_MAX.OpcodeMessage)" name="WDI_SEM_TASK_INIT_OPCODE_SCENARIO_CONTEXT_PROVIDER_MAX" symbol="WDI_SEM_TASK_INIT_OPCODE_SCENARIO_CONTEXT_PROVIDER_MAX" value="18" />
          <opcode message="$(string.WDI_SEM_TASK_INIT_OPCODE_SCENARIO_END_EVENT_MAX.OpcodeMessage)" name="WDI_SEM_TASK_INIT_OPCODE_SCENARIO_END_EVENT_MAX" symbol="WDI_SEM_TASK_INIT_OPCODE_SCENARIO_END_EVENT_MAX" value="19" />
          <opcode message="$(string.WDI_SEM_TASK_INIT_OPCODE_PROVIDER_MAX.OpcodeMessage)" name="WDI_SEM_TASK_INIT_OPCODE_PROVIDER_MAX" symbol="WDI_SEM_TASK_INIT_OPCODE_PROVIDER_MAX" value="20" />
        </opcodes>
        <tasks>
          <task message="$(string.WDI_SEM_TASK_SCENARIO.TaskMessage)" name="WDI_SEM_TASK_SCENARIO" symbol="WDI_SEM_TASK_SCENARIO" value="9" />
          <task message="$(string.WDI_SEM_TASK_INIT.TaskMessage)" name="WDI_SEM_TASK_INIT" symbol="WDI_SEM_TASK_INIT" value="10" />
        </tasks>
        <templates>
          <template tid="tid_WDI_SEM_TEMPLATE_ACTION_STATUS">
            <data inType="win:GUID" name="ProviderID" outType="xs:GUID" />
            <data inType="win:UInt16" name="EventID" outType="xs:unsignedShort" />
            <data inType="win:UInt32" name="DroppedEventCount" outType="xs:unsignedInt" />
            <data inType="win:UInt8" name="ActionCount" outType="xs:unsignedByte" />
            <struct count="ActionCount" name="SemActions">
              <data inType="win:GUID" name="ProviderID" outType="xs:GUID" />
              <data inType="win:UInt8" name="Level" outType="xs:unsignedByte" />
              <data count="7" inType="win:UInt8" name="Reserved" />
              <data inType="win:UInt64" name="Keyword" outType="xs:unsignedLong" />
              <data inType="win:UInt32" name="EnableProperty" outType="xs:unsignedInt" />
              <data inType="win:UInt32" name="NTStatus" outType="xs:unsignedInt" />
            </struct>
          </template>
          <template tid="tid_WDI_SEM_TEMPLATE_TIMEOUT">
            <data inType="win:GUID" name="ProviderID" outType="xs:GUID" />
            <data inType="win:UInt16" name="EventID" outType="xs:unsignedShort" />
          </template>
          <template tid="tid_WDI_SEM_TEMPLATE_FAILED">
            <data inType="win:GUID" name="ProviderID" outType="xs:GUID" />
            <data inType="win:UInt16" name="EventID" outType="xs:unsignedShort" />
            <data inType="win:UInt32" name="NTStatus" outType="xs:unsignedInt" />
          </template>
          <template tid="tid_WDI_SEM_TEMPLATE_INFLIGHT_MAX">
            <data inType="win:GUID" name="ProviderID" outType="xs:GUID" />
            <data inType="win:UInt16" name="EventID" outType="xs:unsignedShort" />
            <data inType="win:UInt8" name="ScenarioCount" outType="xs:unsignedByte" />
            <struct count="ScenarioCount" name="ScenarioInflightItems">
              <data inType="win:GUID" name="ProviderID" outType="xs:GUID" />
              <data inType="win:UInt32" name="EventID" outType="xs:unsignedInt" />
              <data inType="win:UInt16" name="Reserved" outType="xs:unsignedShort" />
              <data inType="win:UInt32" name="InflightCount" outType="xs:unsignedInt" />
            </struct>
          </template>
          <template tid="tid_WDI_SEM_TEMPLATE_DROPPED_SCENARIO">
            <data inType="win:GUID" name="ProviderID" outType="xs:GUID" />
            <data inType="win:UInt16" name="EventID" outType="xs:unsignedShort" />
          </template>
          <template tid="tid_WDI_SEM_TEMPLATE_PROVIDER_MAX">
            <data inType="win:GUID" name="ProviderID" outType="xs:GUID" />
          </template>
          <template tid="tid_WDI_SEM_TEMPLATE_MISCONFIG">
            <data inType="win:GUID" name="ProviderID" outType="xs:GUID" />
            <data inType="win:UInt16" name="EventID" outType="xs:unsignedShort" />
            <data inType="win:UInt32" name="NTStatus" outType="xs:unsignedInt" />
          </template>
          <template tid="tid_WDI_SEM_TEMPLATE_SQM_INIT">
            <data inType="win:UInt32" name="SqmType" outType="xs:unsignedInt" />
            <data inType="win:SID" name="SqmSid" outType="xs:string" />
          </template>
          <template tid="tid_WDI_SEM_TEMPLATE_SQM_DWORD_DATAPOINT">
            <data inType="win:GUID" name="SqmSessionGuid" outType="xs:GUID" />
            <data inType="win:UInt32" name="SqmID" outType="xs:unsignedInt" />
            <data inType="win:UInt32" name="SqmType" outType="xs:unsignedInt" />
            <data inType="win:UInt32" name="SqmDWORDDatapointValue" outType="xs:unsignedInt" />
          </template>
          <template tid="tid_WDI_SEM_TEMPLATE_SQM_STREAM_ROW">
            <data inType="win:GUID" name="SqmSessionGuid" outType="xs:GUID" />
            <data inType="win:UInt32" name="SqmID" outType="xs:unsignedInt" />
            <data inType="win:UInt32" name="SqmType" outType="xs:unsignedInt" />
            <data inType="win:UInt32" name="SqmStreamRowLength" outType="xs:unsignedInt" />
            <struct count="SqmStreamRowLength" name="SqmStreamRow">
              <data inType="win:UInt32" name="SqmTypeEntry" outType="xs:unsignedInt" />
              <data inType="win:UInt32" name="SqmDWORDEntry" outType="xs:unsignedInt" />
              <data inType="win:UnicodeString" name="SqmStringEntry" outType="xs:string" />
            </struct>
          </template>
        </templates>
        <events>
          <event channel="WDI_SEM_CHANNEL_ANALYTIC" keywords="context" level="win:Informational" message="$(string.WDI_SEM_EVENT_SCENARIO_START.EventMessage)" opcode="WDI_SEM_TASK_SCENARIO_OPCODE_START" symbol="WDI_SEM_EVENT_SCENARIO_START" task="WDI_SEM_TASK_SCENARIO" template="tid_WDI_SEM_TEMPLATE_ACTION_STATUS" value="32" />
          <event channel="WDI_SEM_CHANNEL_ANALYTIC" keywords="context" level="win:Informational" message="$(string.WDI_SEM_EVENT_SCENARIO_END.EventMessage)" opcode="WDI_SEM_TASK_SCENARIO_OPCODE_END" symbol="WDI_SEM_EVENT_SCENARIO_END" task="WDI_SEM_TASK_SCENARIO" template="tid_WDI_SEM_TEMPLATE_ACTION_STATUS" value="33" />
          <event channel="WDI_SEM_CHANNEL_ANALYTIC" keywords="diag" level="win:Warning" message="$(string.WDI_SEM_EVENT_SCENARIO_TIMEOUT.EventMessage)" opcode="WDI_SEM_TASK_SCENARIO_OPCODE_TIMEOUT" symbol="WDI_SEM_EVENT_SCENARIO_TIMEOUT" task="WDI_SEM_TASK_SCENARIO" template="tid_WDI_SEM_TEMPLATE_TIMEOUT" value="34" />
          <event channel="WDI_SEM_CHANNEL_DEBUG" level="win:Warning" message="$(string.WDI_SEM_EVENT_SCENARIO_INFLIGHT_MAX.EventMessage)" opcode="WDI_SEM_TASK_SCENARIO_OPCODE_INFLIGHT_MAX" symbol="WDI_SEM_EVENT_SCENARIO_INFLIGHT_MAX" task="WDI_SEM_TASK_SCENARIO" template="tid_WDI_SEM_TEMPLATE_INFLIGHT_MAX" value="35" />
          <event channel="WDI_SEM_CHANNEL_DEBUG" level="win:Warning" message="$(string.WDI_SEM_EVENT_SCENARIO_START_FAILED.EventMessage)" opcode="WDI_SEM_TASK_SCENARIO_OPCODE_START_FAILED" symbol="WDI_SEM_EVENT_SCENARIO_START_FAILED" task="WDI_SEM_TASK_SCENARIO" template="tid_WDI_SEM_TEMPLATE_FAILED" value="36" />
          <event channel="WDI_SEM_CHANNEL_DEBUG" level="win:Warning" message="$(string.WDI_SEM_EVENT_SCENARIO_END_FAILED.EventMessage)" opcode="WDI_SEM_TASK_SCENARIO_OPCODE_END_FAILED" symbol="WDI_SEM_EVENT_SCENARIO_END_FAILED" task="WDI_SEM_TASK_SCENARIO" template="tid_WDI_SEM_TEMPLATE_FAILED" value="37" />
          <event channel="WDI_SEM_CHANNEL_OPERATIONAL" level="win:Error" message="$(string.WDI_SEM_EVENT_INIT_SCENARIO_MAX.EventMessage)" opcode="WDI_SEM_TASK_INIT_OPCODE_SCENARIO_MAX" symbol="WDI_SEM_EVENT_INIT_SCENARIO_MAX" task="WDI_SEM_TASK_INIT" template="tid_WDI_SEM_TEMPLATE_DROPPED_SCENARIO" value="38" />
          <event channel="WDI_SEM_CHANNEL_OPERATIONAL" level="win:Error" message="$(string.WDI_SEM_EVENT_INIT_SCENARIO_CONTEXT_PROVIDER_MAX.EventMessage)" opcode="WDI_SEM_TASK_INIT_OPCODE_SCENARIO_CONTEXT_PROVIDER_MAX" symbol="WDI_SEM_EVENT_INIT_SCENARIO_CONTEXT_PROVIDER_MAX" task="WDI_SEM_TASK_INIT" template="tid_WDI_SEM_TEMPLATE_DROPPED_SCENARIO" value="39" />
          <event channel="WDI_SEM_CHANNEL_OPERATIONAL" level="win:Error" message="$(string.WDI_SEM_EVENT_INIT_SCENARIO_END_EVENT_MAX.EventMessage)" opcode="WDI_SEM_TASK_INIT_OPCODE_SCENARIO_END_EVENT_MAX" symbol="WDI_SEM_EVENT_INIT_SCENARIO_END_EVENT_MAX" task="WDI_SEM_TASK_INIT" template="tid_WDI_SEM_TEMPLATE_DROPPED_SCENARIO" value="40" />
          <event channel="WDI_SEM_CHANNEL_OPERATIONAL" level="win:Error" message="$(string.WDI_SEM_EVENT_INIT_PROVIDER_MAX.EventMessage)" opcode="WDI_SEM_TASK_INIT_OPCODE_PROVIDER_MAX" symbol="WDI_SEM_EVENT_INIT_PROVIDER_MAX" task="WDI_SEM_TASK_INIT" template="tid_WDI_SEM_TEMPLATE_PROVIDER_MAX" value="41" />
          <event channel="WDI_SEM_CHANNEL_OPERATIONAL" level="win:Error" message="$(string.WDI_SEM_EVENT_INIT_MISCONFIG.EventMessage)" opcode="WDI_SEM_TASK_INIT_OPCODE_MISCONFIG" symbol="WDI_SEM_EVENT_INIT_MISCONFIG" task="WDI_SEM_TASK_INIT" template="tid_WDI_SEM_TEMPLATE_MISCONFIG" value="42" />
          <event keywords="win:SQM" level="win:Informational" symbol="WDI_SEM_EVENT_SQM_INIT" template="tid_WDI_SEM_TEMPLATE_SQM_INIT" value="43" />
          <event keywords="win:SQM" level="win:Informational" symbol="WDI_SEM_EVENT_SQM_INCREMENT_DWORD" template="tid_WDI_SEM_TEMPLATE_SQM_DWORD_DATAPOINT" value="44" />
          <event keywords="win:SQM" level="win:Informational" symbol="WDI_SEM_EVENT_SQM_ADD_TO_STREAM" template="tid_WDI_SEM_TEMPLATE_SQM_STREAM_ROW" value="45" />
        </events>
      </provider>
      <provider guid="{A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D}" message="$(string.KernelGeneralProviderName)" messageFileName="%SystemRoot%\system32\Microsoft-Windows-System-Events.dll" name="Microsoft-Windows-Kernel-General" resourceFileName="%SystemRoot%\system32\Microsoft-Windows-System-Events.dll" symbol="KernelProvGuid">
        <channels>
          <importChannel chid="KERNEL_GENERAL_CHANNEL_SYSTEM" name="System" />
        </channels>
        <keywords>
          <keyword mask="0x10" message="$(string.KERNEL_GENERAL_KEYWORD_TIME.KeywordMessage)" name="KERNEL_GENERAL_KEYWORD_TIME" symbol="KERNEL_GENERAL_KEYWORD_TIME" />
          <keyword mask="0x20" name="KERNEL_GENERAL_SECURITY_ACCESSCHECK" symbol="KERNEL_GENERAL_SECURITY_ACCESSCHECK" />
          <keyword mask="0x40" name="KERNEL_GENERAL_TOKEN_SID_MANAGEMENT" symbol="KERNEL_GENERAL_TOKEN_SID_MANAGEMENT" />
        </keywords>
        <maps>
          <valueMap name="Ex:SystemTimeChange.ReasonMap">
            <map message="$(string.KernelSystemTimeChange.Reason.Initialize.EventMessage)" value="0" />
            <map message="$(string.KernelSystemTimeChange.Reason.Application.EventMessage)" value="1" />
            <map message="$(string.KernelSystemTimeChange.Reason.Hardware.EventMessage)" value="2" />
            <map message="$(string.KernelSystemTimeChange.Reason.TimeZone.EventMessage)" value="3" />
          </valueMap>
        </maps>
        <templates>
          <template tid="tid_SystemTimeChange">
            <data inType="win:FILETIME" name="NewTime" outType="xs:dateTime" />
            <data inType="win:FILETIME" name="OldTime" outType="xs:dateTime" />
          </template>
          <template tid="tid_SystemTimeChangeWithReason">
            <data inType="win:FILETIME" name="NewTime" outType="xs:dateTime" />
            <data inType="win:FILETIME" name="OldTime" outType="xs:dateTime" />
            <data inType="win:UInt32" map="Ex:SystemTimeChange.ReasonMap" name="Reason" />
          </template>
          <template tid="tid_LicensingCacheInfo" />
          <template tid="tid_RegSelfHealEvent">
            <data inType="win:HexInt32" name="FinalStatus" />
            <data inType="win:UInt16" name="ExtraStringLength" />
            <data inType="win:UnicodeString" length="ExtraStringLength" name="ExtraString" />
          </template>
          <template tid="tid_RegFlushIOFailureEvent">
            <data inType="win:HexInt32" name="FinalStatus" />
            <data inType="win:UInt16" name="ExtraStringLength" />
            <data inType="win:UnicodeString" length="ExtraStringLength" name="ExtraString" />
          </template>
          <template tid="tid_InitTxR">
            <data inType="win:UInt16" name="ExtraStringLength" />
            <data inType="win:UnicodeString" length="ExtraStringLength" name="ExtraString" />
            <data inType="win:GUID" name="TmId" outType="xs:GUID" />
            <data inType="win:GUID" name="RmId" outType="xs:GUID" />
            <data inType="win:HexInt32" name="Status" />
            <data inType="win:UInt32" name="InternalCode" />
          </template>
          <template tid="tid_RegReorganizeEvent">
            <data inType="win:UInt16" name="HiveNameLength" />
            <data inType="win:UnicodeString" length="HiveNameLength" name="HiveName" />
            <data inType="win:UInt32" name="OriginalSize" />
            <data inType="win:UInt32" name="NewSize" />
          </template>
          <template tid="tid_RegClearAccessEvent">
            <data inType="win:UInt16" name="HiveNameLength" />
            <data inType="win:UnicodeString" length="HiveNameLength" name="HiveName" />
            <data inType="win:UInt32" name="KeysUpdated" />
            <data inType="win:UInt32" name="DirtyPages" />
          </template>
          <template tid="tid_SystemStart">
            <data inType="win:UInt32" name="MajorVersion" outType="xs:unsignedInt" />
            <data inType="win:UInt32" name="MinorVersion" outType="xs:unsignedInt" />
            <data inType="win:UInt32" name="BuildVersion" outType="xs:unsignedInt" />
            <data inType="win:UInt32" name="QfeVersion" outType="xs:unsignedInt" />
            <data inType="win:UInt16" name="ServiceVersion" outType="xs:unsignedShort" />
            <data inType="win:UInt32" name="BootMode" outType="xs:unsignedInt" />
            <data inType="win:FILETIME" name="StartTime" outType="xs:dateTime" />
          </template>
          <template tid="tid_SystemStop">
            <data inType="win:FILETIME" name="StopTime" outType="xs:dateTime" />
          </template>
          <template tid="tid_AccessCheckLog">
            <data inType="win:UnicodeString" name="Mode" />
            <data inType="win:UnicodeString" name="ObjectType" />
            <data inType="win:UnicodeString" name="ObjectName" />
            <data inType="win:UnicodeString" name="ProcessName" />
            <data inType="win:UnicodeString" name="ObjectCreatorProcessName" />
            <data inType="win:HexInt32" name="AccessMask" />
            <data inType="win:UInt32" name="TokenType" />
            <data inType="win:UInt32" name="ImpersonationLevel" />
            <data inType="win:UInt32" name="SessionId" />
            <data inType="win:UInt32" name="LowBoxNumber" />
            <data inType="win:UInt32" name="TokenGroupsCount" />
            <struct count="TokenGroupsCount" name="TokenGroups">
              <data inType="win:HexInt32" name="GroupAttributes" />
              <data inType="win:SID" name="GroupSid" />
            </struct>
            <data inType="win:UInt32" name="TokenPackageCount" />
            <struct count="TokenPackageCount" name="TokenPackage">
              <data inType="win:SID" name="PackageSid" />
            </struct>
            <data inType="win:UInt32" name="TokenCapabilityCount" />
            <struct count="TokenCapabilityCount" name="TokenCapabilities">
              <data inType="win:HexInt32" name="CapabilityAttributes" />
              <data inType="win:SID" name="CapabilitySid" />
            </struct>
            <data inType="win:UInt32" name="TokenTrustLevelCount" />
            <struct count="TokenTrustLevelCount" name="TokenTrustLevel">
              <data inType="win:SID" name="TrustLevelSid" />
            </struct>
            <data inType="win:UInt8" name="SecurityDescriptorRevision" />
            <data inType="win:UInt16" name="SecurityDescriptorControl" outType="win:HexInt16" />
            <data inType="win:SID" name="SecurityDescriptorOwner" />
            <data inType="win:SID" name="SecurityDescriptorGroup" />
            <data inType="win:UInt8" name="DaclRevision" />
            <data inType="win:UInt16" name="DaclAceCount" />
            <struct count="DaclAceCount" name="DaclAce">
              <data inType="win:UInt32" name="AceType" />
              <data inType="win:HexInt32" name="AceFlags" />
              <data inType="win:HexInt32" name="AccessMask" />
              <data inType="win:SID" name="Sid" />
            </struct>
            <data inType="win:UInt8" name="SaclRevision" />
            <data inType="win:UInt16" name="SaclAceCount" />
            <struct count="SaclAceCount" name="SaclAce">
              <data inType="win:UInt32" name="AceType" />
              <data inType="win:HexInt32" name="AceFlags" />
              <data inType="win:HexInt32" name="AccessMask" />
              <data inType="win:SID" name="Sid" />
            </struct>
          </template>
          <template tid="tid_TokenSidManagementLog">
            <data inType="win:UnicodeString" name="ActionName" />
            <data inType="win:UnicodeString" name="ProcessName" />
            <data inType="win:UnicodeString" name="AccountName" />
            <data inType="win:UnicodeString" name="AuthorityName" />
            <data inType="win:HexInt64" name="TokenId" />
            <data inType="win:HexInt64" name="AuthenticationId" />
            <data inType="win:UInt32" name="TokenType" />
            <data inType="win:UInt32" name="ImpersonationLevel" />
            <data inType="win:HexInt32" name="TokenFlags" />
            <data inType="win:Int64" name="SidValuesReferenceCount" />
            <data inType="win:UInt32" name="SidValuesCount" />
            <struct count="SidValuesCount" name="SidValues">
              <data inType="win:SID" name="Sid" />
            </struct>
            <data inType="win:Int64" name="SharedSidValuesReferenceCount" />
            <data inType="win:UInt32" name="SharedSidValuesCount" />
            <struct count="SharedSidValuesCount" name="SharedSidValues">
              <data inType="win:SID" name="Sid" />
            </struct>
          </template>
        </templates>
        <events>
          <event channel="KERNEL_GENERAL_CHANNEL_SYSTEM" keywords="KERNEL_GENERAL_KEYWORD_TIME" level="win:Informational" message="$(string.KernelSystemTimeChange.EventMessage)" opcode="win:Info" symbol="KernelSystemTimeChange" template="tid_SystemTimeChange" value="1" />
          <event channel="KERNEL_GENERAL_CHANNEL_SYSTEM" keywords="KERNEL_GENERAL_KEYWORD_TIME" level="win:Informational" message="$(string.KernelSystemTimeChangeWithReason.EventMessage)" opcode="win:Info" symbol="KernelSystemTimeChangeWithReason" template="tid_SystemTimeChangeWithReason" value="1" version="1" />
          <event channel="KERNEL_GENERAL_CHANNEL_SYSTEM" level="win:Informational" message="$(string.KernelLicensingCacheCorrupt.EventMessage)" opcode="win:Info" symbol="KernelLicensingCacheCorrupt" template="tid_LicensingCacheInfo" value="2" />
          <event channel="KERNEL_GENERAL_CHANNEL_SYSTEM" level="win:Informational" message="$(string.KernelLicensingCacheCorruptionFixed.EventMessage)" opcode="win:Info" symbol="KernelLicensingCacheCorruptionFixed" template="tid_LicensingCacheInfo" value="3" />
          <event channel="KERNEL_GENERAL_CHANNEL_SYSTEM" level="win:Informational" message="$(string.KernelLicensingCacheExpired.EventMessage)" opcode="win:Info" symbol="KernelLicensingCacheExpired" template="tid_LicensingCacheInfo" value="4" />
          <event channel="KERNEL_GENERAL_CHANNEL_SYSTEM" level="win:Error" message="$(string.REG_EVENT_SELFHEAL.EventMessage)" symbol="REG_EVENT_SELFHEAL" template="tid_RegSelfHealEvent" value="5" />
          <event channel="KERNEL_GENERAL_CHANNEL_SYSTEM" level="win:Error" message="$(string.REG_EVENT_FLUSH_IO_FAIL.EventMessage)" symbol="REG_EVENT_FLUSH_IO_FAIL" template="tid_RegFlushIOFailureEvent" value="6" />
          <event channel="KERNEL_GENERAL_CHANNEL_SYSTEM" level="win:Informational" message="$(string.REG_EVENT_TXR_INIT.EventMessage)" opcode="win:Info" symbol="REG_EVENT_TXR_INIT" template="tid_InitTxR" value="11" />
          <event channel="KERNEL_GENERAL_CHANNEL_SYSTEM" level="win:Informational" message="$(string.KERNEL_GENERAL_START.EventMessage)" opcode="win:Info" symbol="KernelSystemStart" template="tid_SystemStart" value="12" />
          <event channel="KERNEL_GENERAL_CHANNEL_SYSTEM" level="win:Informational" message="$(string.KERNEL_GENERAL_STOP.EventMessage)" opcode="win:Info" symbol="KernelSystemStop" template="tid_SystemStop" value="13" />
          <event keywords="KERNEL_GENERAL_SECURITY_ACCESSCHECK" level="win:Error" symbol="AccessCheckLog" template="tid_AccessCheckLog" value="14" />
          <event channel="KERNEL_GENERAL_CHANNEL_SYSTEM" level="win:Informational" message="$(string.REG_EVENT_REORGANIZE.EventMessage)" opcode="win:Info" symbol="REG_EVENT_REORGANIZE" template="tid_RegReorganizeEvent" value="15" />
          <event channel="KERNEL_GENERAL_CHANNEL_SYSTEM" level="win:Informational" message="$(string.REG_EVENT_CLEAR_ACCESS.EventMessage)" opcode="win:Info" symbol="REG_EVENT_CLEAR_ACCESS" template="tid_RegClearAccessEvent" value="16" />
          <event keywords="KERNEL_GENERAL_TOKEN_SID_MANAGEMENT" level="win:Informational" symbol="TokenSidManagementLog" template="tid_TokenSidManagementLog" value="17" />
        </events>
      </provider>
      <provider guid="{22fb2cd6-0e7b-422b-a0c7-2fad1fd0e716}" message="$(string.KernelProcessProviderName)" messageFileName="%SystemRoot%\system32\Microsoft-Windows-System-Events.dll" name="Microsoft-Windows-Kernel-Process" resourceFileName="%SystemRoot%\system32\Microsoft-Windows-System-Events.dll" symbol="PsProvGuid">
        <channels>
          <channel chid="PSEvents" isolation="System" name="Microsoft-Windows-Kernel-Process/Analytic" symbol="PS_Events" type="Analytic">This channel contains Job start and terminate events, process start and stop events, thread start and stop events, and image load events.</channel>
        </channels>
        <keywords>
          <keyword mask="0x010" name="WINEVENT_KEYWORD_PROCESS" symbol="WINEVENT_KEYWORD_PROCESS" />
          <keyword mask="0x020" name="WINEVENT_KEYWORD_THREAD" symbol="WINEVENT_KEYWORD_THREAD" />
          <keyword mask="0x040" name="WINEVENT_KEYWORD_IMAGE" symbol="WINEVENT_KEYWORD_IMAGE" />
          <keyword mask="0x080" name="WINEVENT_KEYWORD_CPU_PRIORITY" symbol="WINEVENT_KEYWORD_CPU_PRIORITY" />
          <keyword mask="0x100" name="WINEVENT_KEYWORD_OTHER_PRIORITY" symbol="WINEVENT_KEYWORD_OTHER_PRIORITY" />
          <keyword mask="0x200" name="WINEVENT_KEYWORD_PROCESS_FREEZE" symbol="WINEVENT_KEYWORD_PROCESS_FREEZE" />
          <keyword mask="0x400" name="WINEVENT_KEYWORD_JOB" symbol="WINEVENT_KEYWORD_JOB" />
          <keyword mask="0x800" name="WINEVENT_KEYWORD_ENABLE_PROCESS_TRACING_CALLBACKS" symbol="WINEVENT_KEYWORD_ENABLE_PROCESS_TRACING_CALLBACKS" />
        </keywords>
        <tasks>
          <task name="ProcessStart" value="1" />
          <task name="ProcessStop" value="2" />
          <task name="ThreadStart" value="3" />
          <task name="ThreadStop" value="4" />
          <task name="ImageLoad" value="5" />
          <task name="ImageUnload" value="6" />
          <task name="CpuBasePriorityChange" value="7" />
          <task name="CpuPriorityChange" value="8" />
          <task name="PagePriorityChange" value="9" />
          <task name="IoPriorityChange" value="10" />
          <task name="ProcessFreeze" value="11" />
          <task name="JobStart" value="13" />
          <task name="JobTerminate" value="14" />
          <task name="ProcessRundown" value="15" />
        </tasks>
        <maps>
          <bitMap name="ProcessFlags">
            <map message="$(string.ProcessFlags.PackageId)" symbol="ProcessFlags_PackageId" value="0x1" />
          </bitMap>
        </maps>
        <templates>
          <template tid="tid_ProcessStart_V0">
            <data inType="win:UInt32" name="ProcessID" outType="win:PID" />
            <data inType="win:FILETIME" name="CreateTime" outType="xs:dateTime" />
            <data inType="win:UInt32" name="ParentProcessID" outType="win:PID" />
            <data inType="win:UInt32" name="SessionID" outType="xs:unsignedInt" />
            <data inType="win:UnicodeString" name="ImageName" outType="xs:string" />
          </template>
          <template tid="tid_ProcessStart_V1">
            <data inType="win:UInt32" name="ProcessID" outType="win:PID" />
            <data inType="win:FILETIME" name="CreateTime" outType="xs:dateTime" />
            <data inType="win:UInt32" name="ParentProcessID" outType="win:PID" />
            <data inType="win:UInt32" name="SessionID" outType="xs:unsignedInt" />
            <data inType="win:UInt32" map="ProcessFlags" name="Flags" />
            <data inType="win:UnicodeString" name="ImageName" outType="xs:string" />
          </template>
          <template tid="tid_ProcessStartAndRundown">
            <data inType="win:UInt32" name="ProcessID" outType="win:PID" />
            <data inType="win:FILETIME" name="CreateTime" outType="xs:dateTime" />
            <data inType="win:UInt32" name="ParentProcessID" outType="win:PID" />
            <data inType="win:UInt32" name="SessionID" outType="xs:unsignedInt" />
            <data inType="win:UInt32" map="ProcessFlags" name="Flags" />
            <data inType="win:UnicodeString" name="ImageName" outType="xs:string" />
            <data inType="win:UInt32" name="ImageChecksum" outType="win:HexInt32" />
            <data inType="win:UInt32" name="TimeDateStamp" outType="win:HexInt32" />
            <data inType="win:UnicodeString" name="PackageFullName" outType="xs:string" />
            <data inType="win:UnicodeString" name="PackageRelativeAppId" outType="xs:string" />
          </template>
          <template tid="tid_ProcessStop_V0">
            <data inType="win:UInt32" name="ProcessID" outType="win:PID" />
            <data inType="win:FILETIME" name="CreateTime" outType="xs:dateTime" />
            <data inType="win:FILETIME" name="ExitTime" outType="xs:dateTime" />
            <data inType="win:UInt32" name="ExitCode" outType="xs:unsignedInt" />
            <data inType="win:UInt32" name="TokenElevationType" outType="xs:unsignedInt" />
            <data inType="win:UInt32" name="HandleCount" outType="xs:unsignedInt" />
            <data inType="win:UInt64" name="CommitCharge" outType="xs:unsignedLong" />
            <data inType="win:UInt64" name="CommitPeak" outType="xs:unsignedLong" />
            <data inType="win:AnsiString" name="ImageName" outType="xs:string" />
          </template>
          <template tid="tid_ProcessStop">
            <data inType="win:UInt32" name="ProcessID" outType="win:PID" />
            <data inType="win:FILETIME" name="CreateTime" outType="xs:dateTime" />
            <data inType="win:FILETIME" name="ExitTime" outType="xs:dateTime" />
            <data inType="win:UInt32" name="ExitCode" outType="xs:unsignedInt" />
            <data inType="win:UInt32" name="TokenElevationType" outType="xs:unsignedInt" />
            <data inType="win:UInt32" name="HandleCount" outType="xs:unsignedInt" />
            <data inType="win:UInt64" name="CommitCharge" outType="xs:unsignedLong" />
            <data inType="win:UInt64" name="CommitPeak" outType="xs:unsignedLong" />
            <data inType="win:UInt64" name="CPUCycleCount" outType="xs:unsignedLong" />
            <data inType="win:UInt32" name="ReadOperationCount" outType="xs:unsignedInt" />
            <data inType="win:UInt32" name="WriteOperationCount" outType="xs:unsignedInt" />
            <data inType="win:UInt32" name="ReadTransferKiloBytes" outType="xs:unsignedInt" />
            <data inType="win:UInt32" name="WriteTransferKiloBytes" outType="xs:unsignedInt" />
            <data inType="win:UInt32" name="HardFaultCount" outType="xs:unsignedInt" />
            <data inType="win:AnsiString" name="ImageName" outType="xs:string" />
          </template>
          <template tid="tid_Thread_V0">
            <data inType="win:UInt32" name="ProcessID" outType="win:PID" />
            <data inType="win:UInt32" name="ThreadID" outType="win:TID" />
            <data inType="win:Pointer" name="StackBase" outType="win:HexInt64" />
            <data inType="win:Pointer" name="StackLimit" outType="win:HexInt64" />
            <data inType="win:Pointer" name="UserStackBase" outType="win:HexInt64" />
            <data inType="win:Pointer" name="UserStackLimit" outType="win:HexInt64" />
            <data inType="win:Pointer" name="StartAddr" outType="win:HexInt64" />
            <data inType="win:Pointer" name="Win32StartAddr" outType="win:HexInt64" />
            <data inType="win:Pointer" name="TebBase" outType="win:HexInt64" />
          </template>
          <template tid="tid_Thread">
            <data inType="win:UInt32" name="ProcessID" outType="win:PID" />
            <data inType="win:UInt32" name="ThreadID" outType="win:TID" />
            <data inType="win:Pointer" name="StackBase" outType="win:HexInt64" />
            <data inType="win:Pointer" name="StackLimit" outType="win:HexInt64" />
            <data inType="win:Pointer" name="UserStackBase" outType="win:HexInt64" />
            <data inType="win:Pointer" name="UserStackLimit" outType="win:HexInt64" />
            <data inType="win:Pointer" name="StartAddr" outType="win:HexInt64" />
            <data inType="win:Pointer" name="Win32StartAddr" outType="win:HexInt64" />
            <data inType="win:Pointer" name="TebBase" outType="win:HexInt64" />
            <data inType="win:UInt32" name="SubProcessTag" outType="xs:unsignedInt" />
          </template>
          <template tid="tid_ThreadStop">
            <data inType="win:UInt32" name="ProcessID" outType="win:PID" />
            <data inType="win:UInt32" name="ThreadID" outType="win:TID" />
            <data inType="win:Pointer" name="StackBase" outType="win:HexInt64" />
            <data inType="win:Pointer" name="StackLimit" outType="win:HexInt64" />
            <data inType="win:Pointer" name="UserStackBase" outType="win:HexInt64" />
            <data inType="win:Pointer" name="UserStackLimit" outType="win:HexInt64" />
            <data inType="win:Pointer" name="StartAddr" outType="win:HexInt64" />
            <data inType="win:Pointer" name="Win32StartAddr" outType="win:HexInt64" />
            <data inType="win:Pointer" name="TebBase" outType="win:HexInt64" />
            <data inType="win:UInt32" name="SubProcessTag" outType="xs:unsignedInt" />
            <data inType="win:UInt64" name="CycleTime" outType="win:HexInt64" />
          </template>
          <template tid="tid_ImageLoad">
            <data inType="win:Pointer" name="ImageBase" outType="win:HexInt64" />
            <data inType="win:Pointer" name="ImageSize" outType="win:HexInt64" />
            <data inType="win:UInt32" name="ProcessID" outType="win:PID" />
            <data inType="win:UInt32" name="ImageCheckSum" outType="xs:unsignedInt" />
            <data inType="win:UInt32" name="TimeDateStamp" outType="xs:unsignedInt" />
            <data inType="win:Pointer" name="DefaultBase" outType="win:HexInt64" />
            <data inType="win:UnicodeString" name="ImageName" outType="xs:string" />
          </template>
          <template tid="tid_ImageUnload">
            <data inType="win:Pointer" name="ImageBase" outType="win:HexInt64" />
            <data inType="win:Pointer" name="ImageSize" outType="win:HexInt64" />
            <data inType="win:UInt32" name="ProcessID" outType="win:PID" />
            <data inType="win:UInt32" name="ImageCheckSum" outType="xs:unsignedInt" />
            <data inType="win:UInt32" name="TimeDateStamp" outType="xs:unsignedInt" />
            <data inType="win:Pointer" name="DefaultBase" outType="win:HexInt64" />
            <data inType="win:UnicodeString" name="ImageName" outType="xs:string" />
          </template>
          <template tid="tid_PriorityChange">
            <data inType="win:UInt32" name="ProcessID" outType="win:PID" />
            <data inType="win:UInt32" name="ThreadID" outType="win:TID" />
            <data inType="win:UInt8" name="OldPriority" outType="xs:unsignedByte" />
            <data inType="win:UInt8" name="NewPriority" outType="xs:unsignedByte" />
          </template>
          <template tid="tid_ProcessFreeze_V0">
            <data inType="win:UInt32" name="FrozenProcessID" outType="win:PID" />
          </template>
          <template tid="tid_ProcessFreeze">
            <data inType="win:UInt32" name="FrozenProcessID" outType="win:PID" />
            <data inType="win:FILETIME" name="CreateTime" outType="xs:dateTime" />
          </template>
          <template tid="tid_JobStartStop">
            <data inType="win:GUID" name="Job ID" outType="xs:GUID" />
            <data inType="win:UInt32" name="JobHandle" />
            <data inType="win:UInt32" name="StatusCode" outType="xs:unsignedInt" />
          </template>
        </templates>
        <events>
          <event channel="PSEvents" keywords="WINEVENT_KEYWORD_PROCESS" level="win:Informational" message="$(string.ProcessStart_V0.EventMessage)" notLogged="true" opcode="win:Start" symbol="ProcessStart_V0" task="ProcessStart" template="tid_ProcessStart_V0" value="1" version="0" />
          <event channel="PSEvents" keywords="WINEVENT_KEYWORD_PROCESS" level="win:Informational" message="$(string.ProcessStart_V1.EventMessage)" opcode="win:Start" symbol="ProcessStart_V1" task="ProcessStart" template="tid_ProcessStart_V1" value="1" version="1" />
          <event channel="PSEvents" keywords="WINEVENT_KEYWORD_PROCESS" level="win:Informational" message="$(string.ProcessStart.EventMessage)" opcode="win:Start" symbol="ProcessStart" task="ProcessStart" template="tid_ProcessStartAndRundown" value="1" version="2" />
          <event channel="PSEvents" keywords="WINEVENT_KEYWORD_PROCESS" level="win:Informational" message="$(string.ProcessStop.EventMessage)" notLogged="true" opcode="win:Stop" symbol="ProcessStop_V0" task="ProcessStop" template="tid_ProcessStop_V0" value="2" version="0" />
          <event channel="PSEvents" keywords="WINEVENT_KEYWORD_PROCESS" level="win:Informational" message="$(string.ProcessStop.EventMessage)" opcode="win:Stop" symbol="ProcessStop" task="ProcessStop" template="tid_ProcessStop" value="2" version="1" />
          <event channel="PSEvents" keywords="WINEVENT_KEYWORD_THREAD" level="win:Informational" message="$(string.ThreadStart.EventMessage)" notLogged="true" opcode="win:Start" symbol="ThreadStart_V0" task="ThreadStart" template="tid_Thread_V0" value="3" version="0" />
          <event channel="PSEvents" keywords="WINEVENT_KEYWORD_THREAD" level="win:Informational" message="$(string.ThreadStart.EventMessage)" opcode="win:Start" symbol="ThreadStart" task="ThreadStart" template="tid_Thread" value="3" version="1" />
          <event channel="PSEvents" keywords="WINEVENT_KEYWORD_THREAD" level="win:Informational" message="$(string.ThreadStop.EventMessage)" notLogged="true" opcode="win:Stop" symbol="ThreadStop_V0" task="ThreadStop" template="tid_Thread_V0" value="4" version="0" />
          <event channel="PSEvents" keywords="WINEVENT_KEYWORD_THREAD" level="win:Informational" message="$(string.ThreadStop.EventMessage)" opcode="win:Stop" symbol="ThreadStop" task="ThreadStop" template="tid_ThreadStop" value="4" version="1" />
          <event channel="PSEvents" keywords="WINEVENT_KEYWORD_IMAGE" level="win:Informational" message="$(string.ImageLoad.EventMessage)" opcode="win:Info" symbol="ImageLoad" task="ImageLoad" template="tid_ImageLoad" value="5" />
          <event channel="PSEvents" keywords="WINEVENT_KEYWORD_IMAGE" level="win:Informational" message="$(string.ImageUnload.EventMessage)" opcode="win:Info" symbol="ImageUnload" task="ImageUnload" template="tid_ImageUnload" value="6" />
          <event channel="PSEvents" keywords="WINEVENT_KEYWORD_CPU_PRIORITY" level="win:Informational" message="$(string.ThreadCpuBasePriorityChange.EventMessage)" opcode="win:Info" symbol="ThreadCpuBasePriorityChange" task="CpuBasePriorityChange" template="tid_PriorityChange" value="7" />
          <event channel="PSEvents" keywords="WINEVENT_KEYWORD_CPU_PRIORITY" level="win:Informational" message="$(string.ThreadCpuPriorityChange.EventMessage)" opcode="win:Info" symbol="ThreadCpuPriorityChange" task="CpuPriorityChange" template="tid_PriorityChange" value="8" />
          <event channel="PSEvents" keywords="WINEVENT_KEYWORD_OTHER_PRIORITY" level="win:Informational" message="$(string.ThreadPagePriorityChange.EventMessage)" opcode="win:Info" symbol="ThreadPagePriorityChange" task="PagePriorityChange" template="tid_PriorityChange" value="9" />
          <event channel="PSEvents" keywords="WINEVENT_KEYWORD_OTHER_PRIORITY" level="win:Informational" message="$(string.ThreadIoPriorityChange.EventMessage)" opcode="win:Info" symbol="ThreadIoPriorityChange" task="IoPriorityChange" template="tid_PriorityChange" value="10" />
          <event channel="PSEvents" keywords="WINEVENT_KEYWORD_PROCESS_FREEZE" level="win:Informational" message="$(string.ProcessFreezeEvent.EventMessage)" notLogged="true" opcode="win:Start" symbol="ProcessFreezeEvent_V0" task="ProcessFreeze" template="tid_ProcessFreeze_V0" value="11" version="0" />
          <event channel="PSEvents" keywords="WINEVENT_KEYWORD_PROCESS_FREEZE" level="win:Informational" message="$(string.ProcessFreezeEvent.EventMessage)" opcode="win:Start" symbol="ProcessFreezeEvent" task="ProcessFreeze" template="tid_ProcessFreeze" value="11" version="1" />
          <event channel="PSEvents" keywords="WINEVENT_KEYWORD_PROCESS_FREEZE" level="win:Informational" message="$(string.ProcessThawEvent.EventMessage)" notLogged="true" opcode="win:Stop" symbol="ProcessThawEvent_V0" task="ProcessFreeze" template="tid_ProcessFreeze_V0" value="12" version="0" />
          <event channel="PSEvents" keywords="WINEVENT_KEYWORD_PROCESS_FREEZE" level="win:Informational" message="$(string.ProcessThawEvent.EventMessage)" opcode="win:Stop" symbol="ProcessThawEvent" task="ProcessFreeze" template="tid_ProcessFreeze" value="12" version="1" />
          <event channel="PSEvents" keywords="WINEVENT_KEYWORD_JOB" level="win:Informational" message="$(string.JobStart.EventMessage)" opcode="win:Start" symbol="JobStart" task="JobStart" template="tid_JobStartStop" value="13" />
          <event channel="PSEvents" keywords="WINEVENT_KEYWORD_JOB" level="win:Informational" message="$(string.JobTerminate.EventMessage)" opcode="win:Stop" symbol="JobTerminate" task="JobTerminate" template="tid_JobStartStop" value="14" />
          <event channel="PSEvents" keywords="WINEVENT_KEYWORD_PROCESS" level="win:Informational" message="$(string.ProcessRundown.EventMessage)" opcode="win:Info" symbol="ProcessRundown" task="ProcessRundown" template="tid_ProcessStartAndRundown" value="15" />
          <event keywords="WINEVENT_KEYWORD_ENABLE_PROCESS_TRACING_CALLBACKS" level="win:Informational" opcode="win:Info" symbol="EnableProcessTracingCallbacks" value="16" />
        </events>
      </provider>
      <provider guid="{70eb4f03-c1de-4f73-a051-33d13d5413bd}" message="$(string.KernelRegistryProviderName)" messageFileName="%SystemRoot%\system32\Microsoft-Windows-System-Events.dll" name="Microsoft-Windows-Kernel-Registry" resourceFileName="%SystemRoot%\system32\Microsoft-Windows-System-Events.dll" symbol="RegistryProvGuid">
        <channels>
          <channel chid="RegistryEvents" isolation="System" name="Microsoft-Windows-Kernel-Registry/Analytic" symbol="REG_Events" type="Analytic">This channel contains registry events.</channel>
          <channel chid="RegistryPerformance" isolation="System" name="Microsoft-Windows-Kernel-Registry/Performance" symbol="RegistryPerfEvents" type="Analytic">This channel contains events that describe registry performance.</channel>
        </channels>
        <tasks>
          <task message="$(string.RegistryPerformance.TaskMessage.HiveMount)" name="RegPerfTaskHiveMount" symbol="REG_PERF_TASK_HIVE_MOUNT" value="1">
            <opcodes>
              <opcode name="RegPerfOpHiveMountBaseFileMounted" symbol="REG_PERF_OP_HIVE_MOUNT_BASE_FILE_MOUNTED" value="10" />
              <opcode name="RegPerfOpHiveMountLogEntryApplied" symbol="REG_PERF_OP_HIVE_MOUNT_LOG_ENTRY_APPLIED" value="11" />
            </opcodes>
          </task>
          <task message="$(string.RegistryPerformance.TaskMessage.HiveUnload)" name="RegPerfTaskHiveUnload" symbol="REG_PERF_TASK_HIVE_UNLOAD" value="2" />
          <task message="$(string.RegistryPerformance.TaskMessage.HiveFlush)" name="RegPerfTaskHiveFlush" symbol="REG_PERF_TASK_HIVE_FLUSH" value="3">
            <opcodes>
              <opcode name="RegPerfOpHiveFlushBecameActiveFlusher" symbol="REG_PERF_OP_HIVE_FLUSH_BECAME_ACTIVE_FLUSHER" value="10" />
              <opcode name="RegPerfOpHiveFlushGatheredLogData" symbol="REG_PERF_OP_HIVE_FLUSH_GATHERED_LOG_DATA" value="11" />
              <opcode name="RegPerfOpHiveFlushGatheredPrimaryData" symbol="REG_PERF_OP_HIVE_FLUSH_GATHERED_PRIMARY_DATA" value="12" />
              <opcode name="RegPerfOpHiveFlushWroteLogFile" symbol="REG_PERF_OP_HIVE_FLUSH_WROTE_LOG_FILE" value="13" />
              <opcode name="RegPerfOpHiveFlushWrotePrimaryFile" symbol="REG_PERF_OP_HIVE_FLUSH_WROTE_PRIMARY_FILE" value="14" />
              <opcode name="RegPerfOpHiveFlushBoostedActiveFlusher" symbol="REG_PERF_OP_HIVE_FLUSH_BOOSTED_ACTIVE_FLUSHER" value="15" />
              <opcode name="RegPerfOpHiveFlushStartWaitForActive" symbol="REG_PERF_OP_HIVE_FLUSH_START_WAIT_FOR_ACTIVE" value="16" />
              <opcode name="RegPerfOpHiveFlushFinishWaitForActive" symbol="REG_PERF_OP_HIVE_FLUSH_FINISH_WAIT_FOR_ACTIVE" value="17" />
            </opcodes>
          </task>
          <task message="$(string.RegistryPerformance.TaskMessage.Shutdown)" name="RegPerfTaskShutdown" symbol="REG_PERF_TASK_SHUTDOWN" value="4">
            <opcodes>
              <opcode name="RegPerfOpShutdownRundownComplete" symbol="REG_PERF_OP_SHUTDOWN_RUNDOWN_COMPLETE" value="10" />
              <opcode name="RegPerfOpShutdownFlushStart" symbol="REG_PERF_OP_SHUTDOWN_FLUSH_START" value="11" />
              <opcode name="RegPerfOpShutdownFlushStop" symbol="REG_PERF_OP_SHUTDOWN_FLUSH_STOP" value="12" />
            </opcodes>
          </task>
          <task message="$(string.RegistryPerformance.TaskMessage.HiveLoad)" name="RegPerfTaskHiveLoad" value="5" />
          <task message="$(string.RegistryPerformance.TaskMessage.HiveRestore)" name="RegPerfTaskHiveRestore" value="6" />
          <task message="$(string.RegistryPerformance.TaskMessage.HiveSave)" name="RegPerfTaskHiveSave" value="7">
            <opcodes>
              <opcode name="RegPerfOpSaveFileCopied" symbol="REG_PERF_OP_HIVE_SAVE_FILE_COPIED" value="10" />
              <opcode name="RegPerfOpSaveTreeCopied" symbol="REG_PERF_OP_HIVE_SAVE_TREE_COPIED" value="11" />
              <opcode name="RegPerfOpSaveFileWritten" symbol="REG_PERF_OP_HIVE_SAVE_FILE_WRITTEN" value="12" />
            </opcodes>
          </task>
        </tasks>
        <opcodes>
          <opcode name="CreateKey" value="32" />
          <opcode name="OpenKey" value="33" />
          <opcode name="DeleteKey" value="34" />
          <opcode name="QueryKey" value="35" />
          <opcode name="SetValueKey" value="36" />
          <opcode name="DeleteValueKey" value="37" />
          <opcode name="QueryValueKey" value="38" />
          <opcode name="EnumerateKey" value="39" />
          <opcode name="EnumerateValueKey" value="40" />
          <opcode name="QueryMultipleValueKey" value="41" />
          <opcode name="SetInformationKey" value="42" />
          <opcode name="FlushKey" value="43" />
          <opcode name="CloseKey" value="44" />
          <opcode name="QuerySecurityKey" value="45" />
          <opcode name="SetSecurityKey" value="46" />
        </opcodes>
        <keywords>
          <keyword mask="0x1000" name="CreateKey" />
          <keyword mask="0x2000" name="OpenKey" />
          <keyword mask="0x4000" name="DeleteKey" />
          <keyword mask="0x8000" name="QueryKey" />
          <keyword mask="0x0100" name="SetValueKey" />
          <keyword mask="0x0200" name="DeleteValueKey" />
          <keyword mask="0x0400" name="QueryValueKey" />
          <keyword mask="0x0800" name="EnumerateKey" />
          <keyword mask="0x0010" name="EnumerateValueKey" />
          <keyword mask="0x0020" name="QueryMultipleValueKey" />
          <keyword mask="0x0040" name="SetInformationKey" />
          <keyword mask="0x0080" name="FlushKey" />
          <keyword mask="0x0001" name="CloseKey" />
          <keyword mask="0x0002" name="QuerySecurityKey" />
          <keyword mask="0x0004" name="SetSecurityKey" />
        </keywords>
        <templates>
          <template tid="tid_RegOpenCreate">
            <data inType="win:Pointer" name="BaseObject" outType="win:HexInt64" />
            <data inType="win:Pointer" name="KeyObject" outType="win:HexInt64" />
            <data inType="win:UInt32" name="Status" outType="win:HexInt32" />
            <data inType="win:UInt32" name="Disposition" />
            <data inType="win:UnicodeString" name="BaseName" outType="xs:string" />
            <data inType="win:UnicodeString" name="RelativeName" outType="xs:string" />
          </template>
          <template tid="tid_RegDeleteFlushClose">
            <data inType="win:Pointer" name="KeyObject" outType="win:HexInt64" />
            <data inType="win:UInt32" name="Status" outType="win:HexInt32" />
            <data inType="win:UnicodeString" name="KeyName" outType="xs:string" />
          </template>
          <template tid="tid_RegQuery">
            <data inType="win:Pointer" name="KeyObject" outType="win:HexInt64" />
            <data inType="win:UInt32" name="Status" outType="win:HexInt32" />
            <data inType="win:UInt32" name="InfoClass" />
            <data inType="win:UInt32" name="DataSize" />
            <data inType="win:UnicodeString" name="KeyName" outType="xs:string" />
            <data inType="win:UInt16" name="CapturedDataSize" />
            <data inType="win:Binary" length="CapturedDataSize" name="CapturedData" />
          </template>
          <template tid="tid_RegSetValue">
            <data inType="win:Pointer" name="KeyObject" outType="win:HexInt64" />
            <data inType="win:UInt32" name="Status" outType="win:HexInt32" />
            <data inType="win:UInt32" name="Type" />
            <data inType="win:UInt32" name="DataSize" />
            <data inType="win:UnicodeString" name="KeyName" outType="xs:string" />
            <data inType="win:UnicodeString" name="ValueName" outType="xs:string" />
            <data inType="win:UInt16" name="CapturedDataSize" />
            <data inType="win:Binary" length="CapturedDataSize" name="CapturedData" />
            <data inType="win:UInt32" name="PreviousDataType" />
            <data inType="win:UInt32" name="PreviousDataSize" />
            <data inType="win:UInt16" name="PreviousDataCapturedSize" />
            <data inType="win:Binary" length="PreviousDataCapturedSize" name="PreviousData" />
          </template>
          <template tid="tid_RegDeleteValue">
            <data inType="win:Pointer" name="KeyObject" outType="win:HexInt64" />
            <data inType="win:UInt32" name="Status" outType="win:HexInt32" />
            <data inType="win:UnicodeString" name="KeyName" outType="xs:string" />
            <data inType="win:UnicodeString" name="ValueName" outType="xs:string" />
          </template>
          <template tid="tid_RegQueryValue">
            <data inType="win:Pointer" name="KeyObject" outType="win:HexInt64" />
            <data inType="win:UInt32" name="Status" outType="win:HexInt32" />
            <data inType="win:UInt32" name="InfoClass" />
            <data inType="win:UInt32" name="DataSize" />
            <data inType="win:UnicodeString" name="KeyName" outType="xs:string" />
            <data inType="win:UnicodeString" name="ValueName" outType="xs:string" />
            <data inType="win:UInt16" name="CapturedDataSize" />
            <data inType="win:Binary" length="CapturedDataSize" name="CapturedData" />
          </template>
          <template tid="tid_RegEnum">
            <data inType="win:Pointer" name="KeyObject" outType="win:HexInt64" />
            <data inType="win:UInt32" name="Status" outType="win:HexInt32" />
            <data inType="win:UInt32" name="Index" />
            <data inType="win:UInt32" name="InfoClass" />
            <data inType="win:UInt32" name="DataSize" />
            <data inType="win:UnicodeString" name="KeyName" outType="xs:string" />
            <data inType="win:UInt16" name="CapturedDataSize" />
            <data inType="win:Binary" length="CapturedDataSize" name="CapturedData" />
          </template>
          <template tid="tid_RegQueryMultiple">
            <data inType="win:Pointer" name="KeyObject" outType="win:HexInt64" />
            <data inType="win:UInt32" name="Status" outType="win:HexInt32" />
            <data inType="win:UInt32" name="EntryCount" />
            <data inType="win:UInt32" name="DataSize" />
            <data inType="win:UnicodeString" name="KeyName" outType="xs:string" />
          </template>
          <template tid="tid_RegSetInformation">
            <data inType="win:Pointer" name="KeyObject" outType="win:HexInt64" />
            <data inType="win:UInt32" name="Status" outType="win:HexInt32" />
            <data inType="win:UInt32" name="InfoClass" />
            <data inType="win:UInt32" name="DataSize" />
            <data inType="win:UnicodeString" name="KeyName" outType="xs:string" />
            <data inType="win:UInt16" name="CapturedDataSize" />
            <data inType="win:Binary" length="CapturedDataSize" name="CapturedData" />
          </template>
          <template tid="tid_RegPerfEventHiveMountBaseFileMounted">
            <data inType="win:UnicodeString" name="HiveFilePath" outType="xs:string" />
            <data inType="win:UInt32" name="FileSize" />
          </template>
          <template tid="tid_RegPerfEventHiveMountLogEntryApplied">
            <data inType="win:UInt32" name="TotalEntrySize" />
            <data inType="win:UInt32" name="BytesRecovered" />
          </template>
          <template tid="tid_RegPerfEventHiveMountStop">
            <data inType="win:HexInt32" name="StatusCode" outType="xs:HexInt32" />
          </template>
          <template tid="tid_RegPerfEventHiveUnloadStart">
            <data inType="win:UnicodeString" name="HiveFilePath" outType="xs:string" />
            <data inType="win:UnicodeString" name="HiveMountPoint" outType="xs:string" />
          </template>
          <template tid="tid_RegPerfEventHiveUnloadStop">
            <data inType="win:HexInt32" name="StatusCode" outType="xs:HexInt32" />
          </template>
          <template tid="tid_RegPerfEventHiveFlushStart">
            <data inType="win:UnicodeString" name="HiveFilePath" outType="xs:string" />
            <data inType="win:UnicodeString" name="HiveMountPoint" outType="xs:string" />
            <data inType="win:HexInt32" name="FlushFlags" outType="xs:HexInt32" />
          </template>
          <template tid="tid_RegPerfEventHiveFlushGatheredLogData">
            <data inType="win:UInt32" name="BytesGathered" />
          </template>
          <template tid="tid_RegPerfEventHiveFlushGatheredPrimaryData">
            <data inType="win:UInt32" name="BytesGathered" />
          </template>
          <template tid="tid_RegPerfEventHiveFlushWroteLogFile">
            <data inType="win:UInt32" name="WritesIssued" />
            <data inType="win:UInt32" name="BytesWritten" />
          </template>
          <template tid="tid_RegPerfEventHiveFlushWrotePrimaryFile">
            <data inType="win:UInt32" name="WritesIssued" />
            <data inType="win:UInt32" name="BytesWritten" />
          </template>
          <template tid="tid_RegPerfEventHiveFlushStop">
            <data inType="win:HexInt32" name="StatusCode" outType="xs:HexInt32" />
          </template>
          <template tid="tid_RegPerfEventHiveLoadStart">
            <data inType="win:UnicodeString" name="SourceFile" outType="xs:string" />
            <data inType="win:HexInt32" name="Flags" outType="xs:HexInt32" />
          </template>
          <template tid="tid_RegPerfEventHiveLoadStop">
            <data inType="win:HexInt32" name="StatusCode" outType="xs:HexInt32" />
          </template>
          <template tid="tid_RegPerfEventHiveRestoreStart">
            <data inType="win:UnicodeString" name="SourceFile" outType="xs:string" />
            <data inType="win:HexInt32" name="Flags" outType="xs:HexInt32" />
          </template>
          <template tid="tid_RegPerfEventHiveRestoreStop">
            <data inType="win:HexInt32" name="StatusCode" outType="xs:HexInt32" />
          </template>
          <template tid="tid_RegPerfEventHiveSaveStart">
            <data inType="win:UnicodeString" name="SourceKeyPath" outType="xs:string" />
          </template>
          <template tid="tid_RegPerfEventHiveSaveStop">
            <data inType="win:HexInt32" name="StatusCode" outType="xs:HexInt32" />
          </template>
        </templates>
        <events>
          <event channel="RegistryEvents" keywords="CreateKey" level="win:Informational" opcode="CreateKey" symbol="ETW_REGISTRY_EVENT_CREATE_KEY" template="tid_RegOpenCreate" value="1" />
          <event channel="RegistryEvents" keywords="OpenKey" level="win:Informational" opcode="OpenKey" symbol="ETW_REGISTRY_EVENT_OPEN_KEY" template="tid_RegOpenCreate" value="2" />
          <event channel="RegistryEvents" keywords="DeleteKey" level="win:Informational" opcode="DeleteKey" symbol="ETW_REGISTRY_EVENT_DELETE_KEY" template="tid_RegDeleteFlushClose" value="3" />
          <event channel="RegistryEvents" keywords="QueryKey" level="win:Informational" opcode="QueryKey" symbol="ETW_REGISTRY_EVENT_QUERY_KEY" template="tid_RegQuery" value="4" />
          <event channel="RegistryEvents" keywords="SetValueKey" level="win:Informational" opcode="SetValueKey" symbol="ETW_REGISTRY_EVENT_SET_VALUE_KEY" template="tid_RegSetValue" value="5" />
          <event channel="RegistryEvents" keywords="DeleteValueKey" level="win:Informational" opcode="DeleteValueKey" symbol="ETW_REGISTRY_EVENT_DELETE_VALUE_KEY" template="tid_RegDeleteValue" value="6" />
          <event channel="RegistryEvents" keywords="QueryValueKey" level="win:Informational" opcode="QueryValueKey" symbol="ETW_REGISTRY_EVENT_QUERY_VALUE_KEY" template="tid_RegQueryValue" value="7" />
          <event channel="RegistryEvents" keywords="EnumerateKey" level="win:Informational" opcode="EnumerateKey" symbol="ETW_REGISTRY_EVENT_ENUMERATE_KEY" template="tid_RegEnum" value="8" />
          <event channel="RegistryEvents" keywords="EnumerateValueKey" level="win:Informational" opcode="EnumerateValueKey" symbol="ETW_REGISTRY_EVENT_ENUMERATE_VALUE_KEY" template="tid_RegEnum" value="9" />
          <event channel="RegistryEvents" keywords="QueryMultipleValueKey" level="win:Informational" opcode="QueryMultipleValueKey" symbol="ETW_REGISTRY_EVENT_QUERY_MULTIPLE_VALUE_KEY" template="tid_RegQueryMultiple" value="10" />
          <event channel="RegistryEvents" keywords="SetInformationKey" level="win:Informational" opcode="SetInformationKey" symbol="ETW_REGISTRY_EVENT_SET_INFORMATION_KEY" template="tid_RegSetInformation" value="11" />
          <event channel="RegistryEvents" keywords="FlushKey" level="win:Informational" opcode="FlushKey" symbol="ETW_REGISTRY_EVENT_FLUSH_KEY" template="tid_RegDeleteFlushClose" value="12" />
          <event channel="RegistryEvents" keywords="CloseKey" level="win:Informational" opcode="CloseKey" symbol="ETW_REGISTRY_EVENT_CLOSE_KEY" template="tid_RegDeleteFlushClose" value="13" />
          <event channel="RegistryEvents" keywords="QuerySecurityKey" level="win:Informational" opcode="QuerySecurityKey" symbol="ETW_REGISTRY_EVENT_QUERY_SECURITY_KEY" template="tid_RegDeleteFlushClose" value="14" />
          <event channel="RegistryEvents" keywords="SetSecurityKey" level="win:Informational" opcode="SetSecurityKey" symbol="ETW_REGISTRY_EVENT_SET_SECURITY_KEY" template="tid_RegDeleteFlushClose" value="15" />
          <event channel="RegistryPerformance" level="win:Informational" opcode="win:Start" symbol="REGISTRY_PERF_EVENT_HIVE_MOUNT_START" task="RegPerfTaskHiveMount" value="16" />
          <event channel="RegistryPerformance" level="win:Informational" opcode="RegPerfOpHiveMountBaseFileMounted" symbol="REGISTRY_PERF_EVENT_HIVE_MOUNT_BASE_FILE_MOUNTED" task="RegPerfTaskHiveMount" template="tid_RegPerfEventHiveMountBaseFileMounted" value="17" />
          <event channel="RegistryPerformance" level="win:Informational" opcode="RegPerfOpHiveMountLogEntryApplied" symbol="REGISTRY_PERF_EVENT_HIVE_MOUNT_LOG_ENTRY_APPLIED" task="RegPerfTaskHiveMount" template="tid_RegPerfEventHiveMountLogEntryApplied" value="18" />
          <event channel="RegistryPerformance" level="win:Informational" opcode="win:Stop" symbol="REGISTRY_PERF_EVENT_HIVE_MOUNT_STOP" task="RegPerfTaskHiveMount" template="tid_RegPerfEventHiveMountStop" value="19" />
          <event channel="RegistryPerformance" level="win:Informational" opcode="win:Start" symbol="REGISTRY_PERF_EVENT_HIVE_UNLOAD_START" task="RegPerfTaskHiveUnload" template="tid_RegPerfEventHiveUnloadStart" value="20" />
          <event channel="RegistryPerformance" level="win:Informational" opcode="win:Stop" symbol="REGISTRY_PERF_EVENT_HIVE_UNLOAD_STOP" task="RegPerfTaskHiveUnload" template="tid_RegPerfEventHiveUnloadStop" value="21" />
          <event channel="RegistryPerformance" level="win:Informational" opcode="win:Start" symbol="REGISTRY_PERF_EVENT_HIVE_FLUSH_START" task="RegPerfTaskHiveFlush" template="tid_RegPerfEventHiveFlushStart" value="22" />
          <event channel="RegistryPerformance" level="win:Informational" opcode="RegPerfOpHiveFlushBecameActiveFlusher" symbol="REGISTRY_PERF_EVENT_HIVE_FLUSH_BECAME_ACTIVE_FLUSHER" task="RegPerfTaskHiveFlush" value="23" />
          <event channel="RegistryPerformance" level="win:Informational" opcode="RegPerfOpHiveFlushGatheredLogData" symbol="REGISTRY_PERF_EVENT_HIVE_FLUSH_GATHERED_LOG_DATA" task="RegPerfTaskHiveFlush" template="tid_RegPerfEventHiveFlushGatheredLogData" value="24" />
          <event channel="RegistryPerformance" level="win:Informational" opcode="RegPerfOpHiveFlushGatheredPrimaryData" symbol="REGISTRY_PERF_EVENT_HIVE_FLUSH_GATHERED_PRIMARY_DATA" task="RegPerfTaskHiveFlush" template="tid_RegPerfEventHiveFlushGatheredPrimaryData" value="25" />
          <event channel="RegistryPerformance" level="win:Informational" opcode="RegPerfOpHiveFlushWroteLogFile" symbol="REGISTRY_PERF_EVENT_HIVE_FLUSH_WROTE_LOG_FILE" task="RegPerfTaskHiveFlush" template="tid_RegPerfEventHiveFlushWroteLogFile" value="26" />
          <event channel="RegistryPerformance" level="win:Informational" opcode="RegPerfOpHiveFlushWrotePrimaryFile" symbol="REGISTRY_PERF_EVENT_HIVE_FLUSH_WROTE_PRIMARY_FILE" task="RegPerfTaskHiveFlush" template="tid_RegPerfEventHiveFlushWroteLogFile" value="27" />
          <event channel="RegistryPerformance" level="win:Informational" opcode="RegPerfOpHiveFlushBoostedActiveFlusher" symbol="REGISTRY_PERF_EVENT_HIVE_FLUSH_BOOSTED_ACTIVE_FLUSHER" task="RegPerfTaskHiveFlush" value="28" />
          <event channel="RegistryPerformance" level="win:Informational" opcode="RegPerfOpHiveFlushStartWaitForActive" symbol="REGISTRY_PERF_EVENT_HIVE_FLUSH_START_WAIT_FOR_ACTIVE" task="RegPerfTaskHiveFlush" value="29" />
          <event channel="RegistryPerformance" level="win:Informational" opcode="RegPerfOpHiveFlushFinishWaitForActive" symbol="REGISTRY_PERF_EVENT_HIVE_FLUSH_FINISH_WAIT_FOR_ACTIVE" task="RegPerfTaskHiveFlush" value="30" />
          <event channel="RegistryPerformance" level="win:Informational" opcode="win:Stop" symbol="REGISTRY_PERF_EVENT_HIVE_FLUSH_STOP" task="RegPerfTaskHiveFlush" template="tid_RegPerfEventHiveFlushStop" value="31" />
          <event channel="RegistryPerformance" level="win:Informational" opcode="win:Start" symbol="REGISTRY_PERF_EVENT_SHUTDOWN_START" task="RegPerfTaskShutdown" value="32" />
          <event channel="RegistryPerformance" level="win:Informational" opcode="win:Start" symbol="REGISTRY_PERF_EVENT_SHUTDOWN_RUNDOWN_COMPLETE" task="RegPerfTaskShutdown" value="33" />
          <event channel="RegistryPerformance" level="win:Informational" opcode="RegPerfOpShutdownFlushStart" symbol="REGISTRY_PERF_EVENT_SHUTDOWN_FLUSH_START" task="RegPerfTaskShutdown" value="34" />
          <event channel="RegistryPerformance" level="win:Informational" opcode="RegPerfOpShutdownFlushStop" symbol="REGISTRY_PERF_EVENT_SHUTDOWN_FLUSH_STOP" task="RegPerfTaskShutdown" value="35" />
          <event channel="RegistryPerformance" level="win:Informational" opcode="win:Stop" symbol="REGISTRY_PERF_EVENT_SHUTDOWN_STOP" task="RegPerfTaskShutdown" value="36" />
          <event channel="RegistryPerformance" level="win:Informational" opcode="win:Start" symbol="REGISTRY_PERF_EVENT_HIVE_LOAD_START" task="RegPerfTaskHiveLoad" template="tid_RegPerfEventHiveLoadStart" value="37" />
          <event channel="RegistryPerformance" level="win:Informational" opcode="win:Stop" symbol="REGISTRY_PERF_EVENT_HIVE_LOAD_STOP" task="RegPerfTaskHiveLoad" template="tid_RegPerfEventHiveLoadStop" value="38" />
          <event channel="RegistryPerformance" level="win:Informational" opcode="win:Start" symbol="REGISTRY_PERF_EVENT_HIVE_RESTORE_START" task="RegPerfTaskHiveRestore" template="tid_RegPerfEventHiveRestoreStart" value="39" />
          <event channel="RegistryPerformance" level="win:Informational" opcode="win:Stop" symbol="REGISTRY_PERF_EVENT_HIVE_RESTORE_STOP" task="RegPerfTaskHiveRestore" template="tid_RegPerfEventHiveRestoreStop" value="40" />
          <event channel="RegistryPerformance" level="win:Informational" opcode="win:Start" symbol="REGISTRY_PERF_EVENT_HIVE_SAVE_START" task="RegPerfTaskHiveSave" template="tid_RegPerfEventHiveSaveStart" value="41" />
          <event channel="RegistryPerformance" level="win:Informational" opcode="RegPerfOpSaveFileCopied" symbol="REGISTRY_PERF_EVENT_HIVE_SAVE_FILE_COPIED" task="RegPerfTaskHiveSave" value="42" />
          <event channel="RegistryPerformance" level="win:Informational" opcode="RegPerfOpSaveTreeCopied" symbol="REGISTRY_PERF_EVENT_HIVE_SAVE_TREE_COPIED" task="RegPerfTaskHiveSave" value="43" />
          <event channel="RegistryPerformance" level="win:Informational" opcode="RegPerfOpSaveFileWritten" symbol="REGISTRY_PERF_EVENT_HIVE_SAVE_FILE_WRITTEN" task="RegPerfTaskHiveSave" value="44" />
          <event channel="RegistryPerformance" level="win:Informational" opcode="win:Stop" symbol="REGISTRY_PERF_EVENT_HIVE_SAVE_STOP" task="RegPerfTaskHiveSave" template="tid_RegPerfEventHiveSaveStop" value="45" />
        </events>
      </provider>
      <provider xmlns:acpi="http://manifests.microsoft.com/windows/kernel/acpi" guid="{C514638F-7723-485b-BCFC-96565D735D4A}" message="$(string.Acpi.ProviderName)" messageFileName="%SystemRoot%\system32\Microsoft-Windows-System-Events.dll" name="Microsoft-Windows-Kernel-Acpi" resourceFileName="%SystemRoot%\system32\Microsoft-Windows-System-Events.dll" symbol="ACPI_ETW_PROVIDER">
        <channels>
          <channel chid="chidAcpi" name="Microsoft-Windows-Kernel-Acpi/Diagnostic" type="Analytic" />
        </channels>
        <keywords>
          <keyword mask="0x1" name="acpi:Diagnostic" symbol="ACPI_ETW_KEYWORD_DIAGNOSTIC" />
          <keyword mask="0x2" name="acpi:Thermal" symbol="ACPI_ETW_KEYWORD_THERMAL" />
        </keywords>
        <maps>
          <valueMap name="MapActiveCoolingDevicePowerState">
            <map message="$(string.Acpi.EventMap.ActiveCoolingDevicePower.On)" value="1" />
            <map message="$(string.Acpi.EventMap.ActiveCoolingDevicePower.Off)" value="0" />
          </valueMap>
          <valueMap name="MapAmlMethodInvocationState">
            <map message="$(string.Acpi.EventMap.AmlMethodInvocationState.Start)" value="1" />
            <map message="$(string.Acpi.EventMap.AmlMethodInvocationState.End)" value="0" />
          </valueMap>
          <valueMap name="MapResetType">
            <map message="$(string.Acpi.EventMap.ResetType.PlatformLevelReset)" value="1" />
            <map message="$(string.Acpi.EventMap.ResetType.FunctionLevelReset)" value="0" />
          </valueMap>
        </maps>
        <tasks>
          <task name="ResourceTranslation" symbol="ACPI_ETW_TASK_RESOURCETRANSLATION" value="100" />
          <task name="GpeEventHandling" symbol="ACPI_ETW_TASK_GPEEVENTHANDLING" value="101" />
          <task name="TemperatureNotification" symbol="ACPI_ETW_TASK_TEMPERATURE_NOTIFICATION" value="102" />
          <task name="TripPointNotification" symbol="ACPI_ETW_TASK_TRIP_POINT_NOTIFICATION" value="103" />
          <task name="ActiveCoolingDevicePower" symbol="ACPI_ETW_TASK_COOLING_DEVICE_POWER" value="104" />
          <task name="AmlMethodTrace" symbol="ACPI_ETW_TASK_AML_METHOD_TRACE" value="105" />
          <task name="DeviceActiveCooling" symbol="ACPI_ETW_TASK_DEVICE_ACTIVE_COOLING" value="106" />
          <task name="DevicePassiveCooling" symbol="ACPI_ETW_TASK_DEVICE_PASSIVE_COOLING" value="107" />
          <task name="DeviceCoolingRundown" symbol="ACPI_ETW_TASK_DEVICE_COOLING_RUNDOWN" value="108" />
          <task name="TemperatureChange" symbol="ACPI_ETW_TASK_TEMPERATURE_CHANGE" value="109" />
          <task name="ThermalZoneRundown" symbol="ACPI_ETW_TASK_THERMAL_ZONE_RUNDOWN" value="110" />
          <task name="FanRundown" symbol="ACPI_ETW_TASK_FAN_RUNDOWN" value="111" />
          <task name="FanPowerStateChange" symbol="ACPI_ETW_TASK_FAN_POWER_STATE_CHANGE" value="112" />
          <task name="FanStatusChange" symbol="ACPI_ETW_TASK_FAN_STATUS_CHANGE" value="113" />
          <task name="ActiveCoolingConstraint" symbol="ACPI_ETW_TASK_ACTIVE_CONSTRAINT_CHANGE" value="114" />
          <task name="ActiveCoolingConstraintRundown" symbol="ACPI_ETW_TASK_ACTIVE_CONSTRAINT_RUNDOWN" value="115" />
          <task name="PassiveCoolingConstraint" symbol="ACPI_ETW_TASK_PASSIVE_CONSTRAINT_CHANGE" value="116" />
          <task name="PassiveCoolingConstraintRundown" symbol="ACPI_ETW_TASK_PASSIVE_CONSTRAINT_RUNDOWN" value="117" />
          <task name="DeviceReset" symbol="ACPI_ETW_TASK_DEVICE_RESET" value="118" />
        </tasks>
        <templates>
          <template tid="tidAddressDescriptor">
            <data inType="win:UInt8" name="ResourceFlag" outType="xs:unsignedByte" />
            <data inType="win:UInt8" name="GeneralFlag" outType="xs:unsignedByte" />
            <data inType="win:UInt8" name="TypeSpecificFlag" outType="xs:unsignedByte" />
            <data inType="win:UInt64" name="Granularity" outType="win:HexInt64" />
            <data inType="win:UInt64" name="AddressMin" outType="win:HexInt64" />
            <data inType="win:UInt64" name="AddressMax" outType="win:HexInt64" />
            <data inType="win:UInt64" name="AddressTranslation" outType="win:HexInt64" />
            <data inType="win:UInt64" name="AddressLength" outType="win:HexInt64" />
          </template>
          <template tid="tidGpeRegisterEvent">
            <data inType="win:UInt32" name="GpeRegister" outType="win:HexInt32" />
            <data inType="win:UInt8" name="UnexpectedEventMap" outType="xs:unsignedByte" />
          </template>
          <template tid="tidThermalNotification">
            <data inType="win:UInt16" name="ThermalZoneDeviceInstanceLength" />
            <data inType="win:UnicodeString" length="ThermalZoneDeviceInstanceLength" name="ThermalZoneDeviceInstance" />
            <data inType="win:UInt32" name="_TMP" />
            <data inType="win:UInt32" name="_PSV" />
            <data inType="win:UInt32" name="_AC0" />
            <data inType="win:UInt32" name="_AC1" />
            <data inType="win:UInt32" name="_AC2" />
            <data inType="win:UInt32" name="_AC3" />
            <data inType="win:UInt32" name="_AC4" />
            <data inType="win:UInt32" name="_AC5" />
            <data inType="win:UInt32" name="_AC6" />
            <data inType="win:UInt32" name="_AC7" />
            <data inType="win:UInt32" name="_AC8" />
            <data inType="win:UInt32" name="_AC9" />
            <data inType="win:UInt32" name="_HOT" />
            <data inType="win:UInt32" name="_CRT" />
          </template>
          <template tid="tidActiveCoolingDevicePower_V0">
            <data inType="win:UInt16" name="ThermalZoneDeviceInstanceLength" />
            <data inType="win:UnicodeString" length="ThermalZoneDeviceInstanceLength" name="ThermalZoneDeviceInstance" />
            <data inType="win:UInt32" name="ActiveCoolingLevel" />
            <data inType="win:UInt32" name="ActiveCoolingDeviceIndex" />
            <data inType="win:UInt16" name="FanDeviceInstanceLength" />
            <data inType="win:UnicodeString" length="FanDeviceInstanceLength" name="FanDeviceInstance" />
            <data inType="win:UInt16" name="PowerStateLength" />
            <data inType="win:UnicodeString" length="PowerStateLength" name="PowerState" />
          </template>
          <template tid="tidActiveCoolingDevicePower">
            <data inType="win:UInt16" name="ThermalZoneDeviceInstanceLength" />
            <data inType="win:UnicodeString" length="ThermalZoneDeviceInstanceLength" name="ThermalZoneDeviceInstance" />
            <data inType="win:UInt32" name="ActiveCoolingLevel" />
            <data inType="win:UInt32" name="ActiveCoolingDeviceIndex" />
            <data inType="win:UInt16" name="FanDeviceInstanceLength" />
            <data inType="win:UnicodeString" length="FanDeviceInstanceLength" name="FanDeviceInstance" />
            <data inType="win:UInt16" map="MapActiveCoolingDevicePowerState" name="PowerState" />
          </template>
          <template tid="tidDeviceActiveCooling">
            <data inType="win:UInt16" name="DeviceInstanceLength" />
            <data inType="win:UnicodeString" length="DeviceInstanceLength" name="DeviceInstance" />
            <data inType="win:UInt16" map="MapActiveCoolingDevicePowerState" name="PowerState" />
          </template>
          <template tid="tidDevicePassiveCooling">
            <data inType="win:UInt16" name="DeviceInstanceLength" />
            <data inType="win:UnicodeString" length="DeviceInstanceLength" name="DeviceInstance" />
            <data inType="win:UInt8" name="Throttle" />
          </template>
          <template tid="tidDeviceCoolingRundown">
            <data inType="win:UInt16" name="DeviceInstanceLength" />
            <data inType="win:UnicodeString" length="DeviceInstanceLength" name="DeviceInstance" />
            <data inType="win:UInt16" map="MapActiveCoolingDevicePowerState" name="PowerState" />
            <data inType="win:UInt8" name="Throttle" />
          </template>
          <template tid="tidTemperatureChange">
            <data inType="win:UInt16" name="ThermalZoneDeviceInstanceLength" />
            <data inType="win:UnicodeString" length="ThermalZoneDeviceInstanceLength" name="ThermalZoneDeviceInstance" />
            <data inType="win:UInt32" name="Temperature" />
          </template>
          <template tid="tidAmlMethodTrace">
            <data inType="win:UInt16" name="AmlMethodNameLength" />
            <data inType="win:UnicodeString" length="AmlMethodNameLength" name="AmlMethodName" />
            <data inType="win:UInt16" map="MapAmlMethodInvocationState" name="AmlMethodState" />
          </template>
          <template tid="tidThermalZoneRundownWin8">
            <data inType="win:UInt16" name="ThermalZoneBiosNameLength" />
            <data inType="win:UnicodeString" length="ThermalZoneBiosNameLength" name="ThermalZoneBiosName" />
            <data inType="win:UInt32" name="_TMP" />
            <data inType="win:UInt32" name="_PSV" />
            <data inType="win:UInt32" name="_TC1" />
            <data inType="win:UInt32" name="_TC2" />
            <data inType="win:UInt32" name="_TSP" />
            <data inType="win:UInt32" name="_AC0" />
            <data inType="win:UInt32" name="_AC1" />
            <data inType="win:UInt32" name="_AC2" />
            <data inType="win:UInt32" name="_AC3" />
            <data inType="win:UInt32" name="_AC4" />
            <data inType="win:UInt32" name="_AC5" />
            <data inType="win:UInt32" name="_AC6" />
            <data inType="win:UInt32" name="_AC7" />
            <data inType="win:UInt32" name="_AC8" />
            <data inType="win:UInt32" name="_AC9" />
            <data inType="win:UInt32" name="_HOT" />
            <data inType="win:UInt32" name="_CRT" />
            <data inType="win:UInt32" name="_NTT" />
            <data inType="win:UInt32" name="_PSLCount" />
            <data count="_PSLCount" inType="win:AnsiString" name="_PSLEntries" />
            <data inType="win:UInt32" name="_TZDCount" />
            <data count="_TZDCount" inType="win:AnsiString" name="_TZDEntries" />
            <data inType="win:UInt32" name="_AL0Count" />
            <data count="_AL0Count" inType="win:AnsiString" name="_AL0Entries" />
            <data inType="win:UInt32" name="_AL1Count" />
            <data count="_AL1Count" inType="win:AnsiString" name="_AL1Entries" />
            <data inType="win:UInt32" name="_AL2Count" />
            <data count="_AL2Count" inType="win:AnsiString" name="_AL2Entries" />
            <data inType="win:UInt32" name="_AL3Count" />
            <data count="_AL3Count" inType="win:AnsiString" name="_AL3Entries" />
            <data inType="win:UInt32" name="_AL4Count" />
            <data count="_AL4Count" inType="win:AnsiString" name="_AL4Entries" />
            <data inType="win:UInt32" name="_AL5Count" />
            <data count="_AL5Count" inType="win:AnsiString" name="_AL5Entries" />
            <data inType="win:UInt32" name="_AL6Count" />
            <data count="_AL6Count" inType="win:AnsiString" name="_AL6Entries" />
            <data inType="win:UInt32" name="_AL7Count" />
            <data count="_AL7Count" inType="win:AnsiString" name="_AL7Entries" />
            <data inType="win:UInt32" name="_AL8Count" />
            <data count="_AL8Count" inType="win:AnsiString" name="_AL8Entries" />
            <data inType="win:UInt32" name="_AL9Count" />
            <data count="_AL9Count" inType="win:AnsiString" name="_AL9Entries" />
          </template>
          <template tid="tidThermalZoneRundown_v1">
            <data inType="win:UInt16" name="ThermalZoneBiosNameLength" />
            <data inType="win:UnicodeString" length="ThermalZoneBiosNameLength" name="ThermalZoneBiosName" />
            <data inType="win:UInt32" name="_TMP" />
            <data inType="win:UInt32" name="_PSV" />
            <data inType="win:UInt32" name="_TC1" />
            <data inType="win:UInt32" name="_TC2" />
            <data inType="win:UInt32" name="_TSP" />
            <data inType="win:UInt32" name="_AC0" />
            <data inType="win:UInt32" name="_AC1" />
            <data inType="win:UInt32" name="_AC2" />
            <data inType="win:UInt32" name="_AC3" />
            <data inType="win:UInt32" name="_AC4" />
            <data inType="win:UInt32" name="_AC5" />
            <data inType="win:UInt32" name="_AC6" />
            <data inType="win:UInt32" name="_AC7" />
            <data inType="win:UInt32" name="_AC8" />
            <data inType="win:UInt32" name="_AC9" />
            <data inType="win:UInt32" name="_HOT" />
            <data inType="win:UInt32" name="_CRT" />
            <data inType="win:UInt32" name="_NTT" />
            <data inType="win:UInt32" name="_PSLCount" />
            <data count="_PSLCount" inType="win:AnsiString" name="_PSLEntries" />
            <data inType="win:UInt32" name="_TZDCount" />
            <data count="_TZDCount" inType="win:AnsiString" name="_TZDEntries" />
            <data inType="win:UInt32" name="_AL0Count" />
            <data count="_AL0Count" inType="win:AnsiString" name="_AL0Entries" />
            <data inType="win:UInt32" name="_AL1Count" />
            <data count="_AL1Count" inType="win:AnsiString" name="_AL1Entries" />
            <data inType="win:UInt32" name="_AL2Count" />
            <data count="_AL2Count" inType="win:AnsiString" name="_AL2Entries" />
            <data inType="win:UInt32" name="_AL3Count" />
            <data count="_AL3Count" inType="win:AnsiString" name="_AL3Entries" />
            <data inType="win:UInt32" name="_AL4Count" />
            <data count="_AL4Count" inType="win:AnsiString" name="_AL4Entries" />
            <data inType="win:UInt32" name="_AL5Count" />
            <data count="_AL5Count" inType="win:AnsiString" name="_AL5Entries" />
            <data inType="win:UInt32" name="_AL6Count" />
            <data count="_AL6Count" inType="win:AnsiString" name="_AL6Entries" />
            <data inType="win:UInt32" name="_AL7Count" />
            <data count="_AL7Count" inType="win:AnsiString" name="_AL7Entries" />
            <data inType="win:UInt32" name="_AL8Count" />
            <data count="_AL8Count" inType="win:AnsiString" name="_AL8Entries" />
            <data inType="win:UInt32" name="_AL9Count" />
            <data count="_AL9Count" inType="win:AnsiString" name="_AL9Entries" />
            <data inType="win:UInt32" name="MinimumThrottle" />
          </template>
          <template tid="tidThermalZoneRundown_v2">
            <data inType="win:UInt16" name="ThermalZoneBiosNameLength" />
            <data inType="win:UnicodeString" length="ThermalZoneBiosNameLength" name="ThermalZoneBiosName" />
            <data inType="win:UInt32" name="_TMP" />
            <data inType="win:UInt32" name="_PSV" />
            <data inType="win:UInt32" name="_TC1" />
            <data inType="win:UInt32" name="_TC2" />
            <data inType="win:UInt32" name="_TSP" />
            <data inType="win:UInt32" name="_AC0" />
            <data inType="win:UInt32" name="_AC1" />
            <data inType="win:UInt32" name="_AC2" />
            <data inType="win:UInt32" name="_AC3" />
            <data inType="win:UInt32" name="_AC4" />
            <data inType="win:UInt32" name="_AC5" />
            <data inType="win:UInt32" name="_AC6" />
            <data inType="win:UInt32" name="_AC7" />
            <data inType="win:UInt32" name="_AC8" />
            <data inType="win:UInt32" name="_AC9" />
            <data inType="win:UInt32" name="_HOT" />
            <data inType="win:UInt32" name="_CRT" />
            <data inType="win:UInt32" name="_NTT" />
            <data inType="win:UInt32" name="_PSLCount" />
            <data count="_PSLCount" inType="win:AnsiString" name="_PSLEntries" />
            <data inType="win:UInt32" name="_TZDCount" />
            <data count="_TZDCount" inType="win:AnsiString" name="_TZDEntries" />
            <data inType="win:UInt32" name="_AL0Count" />
            <data count="_AL0Count" inType="win:AnsiString" name="_AL0Entries" />
            <data inType="win:UInt32" name="_AL1Count" />
            <data count="_AL1Count" inType="win:AnsiString" name="_AL1Entries" />
            <data inType="win:UInt32" name="_AL2Count" />
            <data count="_AL2Count" inType="win:AnsiString" name="_AL2Entries" />
            <data inType="win:UInt32" name="_AL3Count" />
            <data count="_AL3Count" inType="win:AnsiString" name="_AL3Entries" />
            <data inType="win:UInt32" name="_AL4Count" />
            <data count="_AL4Count" inType="win:AnsiString" name="_AL4Entries" />
            <data inType="win:UInt32" name="_AL5Count" />
            <data count="_AL5Count" inType="win:AnsiString" name="_AL5Entries" />
            <data inType="win:UInt32" name="_AL6Count" />
            <data count="_AL6Count" inType="win:AnsiString" name="_AL6Entries" />
            <data inType="win:UInt32" name="_AL7Count" />
            <data count="_AL7Count" inType="win:AnsiString" name="_AL7Entries" />
            <data inType="win:UInt32" name="_AL8Count" />
            <data count="_AL8Count" inType="win:AnsiString" name="_AL8Entries" />
            <data inType="win:UInt32" name="_AL9Count" />
            <data count="_AL9Count" inType="win:AnsiString" name="_AL9Entries" />
            <data inType="win:UInt32" name="MinimumThrottle" />
            <data inType="win:UInt32" name="_CR3" />
            <data inType="win:UInt32" name="_TFP" />
            <data inType="win:UInt32" name="OverThrottleThreshold" />
          </template>
          <template tid="tidThermalZoneRundown">
            <data inType="win:UInt16" name="ThermalZoneBiosNameLength" />
            <data inType="win:UnicodeString" length="ThermalZoneBiosNameLength" name="ThermalZoneBiosName" />
            <data inType="win:UInt32" name="_TMP" />
            <data inType="win:UInt32" name="_PSV" />
            <data inType="win:UInt32" name="_TC1" />
            <data inType="win:UInt32" name="_TC2" />
            <data inType="win:UInt32" name="_TSP" />
            <data inType="win:UInt32" name="_AC0" />
            <data inType="win:UInt32" name="_AC1" />
            <data inType="win:UInt32" name="_AC2" />
            <data inType="win:UInt32" name="_AC3" />
            <data inType="win:UInt32" name="_AC4" />
            <data inType="win:UInt32" name="_AC5" />
            <data inType="win:UInt32" name="_AC6" />
            <data inType="win:UInt32" name="_AC7" />
            <data inType="win:UInt32" name="_AC8" />
            <data inType="win:UInt32" name="_AC9" />
            <data inType="win:UInt32" name="_HOT" />
            <data inType="win:UInt32" name="_CRT" />
            <data inType="win:UInt32" name="_NTT" />
            <data inType="win:UInt32" name="_PSLCount" />
            <data count="_PSLCount" inType="win:AnsiString" name="_PSLEntries" />
            <data inType="win:UInt32" name="_TZDCount" />
            <data count="_TZDCount" inType="win:AnsiString" name="_TZDEntries" />
            <data inType="win:UInt32" name="_AL0Count" />
            <data count="_AL0Count" inType="win:AnsiString" name="_AL0Entries" />
            <data inType="win:UInt32" name="_AL1Count" />
            <data count="_AL1Count" inType="win:AnsiString" name="_AL1Entries" />
            <data inType="win:UInt32" name="_AL2Count" />
            <data count="_AL2Count" inType="win:AnsiString" name="_AL2Entries" />
            <data inType="win:UInt32" name="_AL3Count" />
            <data count="_AL3Count" inType="win:AnsiString" name="_AL3Entries" />
            <data inType="win:UInt32" name="_AL4Count" />
            <data count="_AL4Count" inType="win:AnsiString" name="_AL4Entries" />
            <data inType="win:UInt32" name="_AL5Count" />
            <data count="_AL5Count" inType="win:AnsiString" name="_AL5Entries" />
            <data inType="win:UInt32" name="_AL6Count" />
            <data count="_AL6Count" inType="win:AnsiString" name="_AL6Entries" />
            <data inType="win:UInt32" name="_AL7Count" />
            <data count="_AL7Count" inType="win:AnsiString" name="_AL7Entries" />
            <data inType="win:UInt32" name="_AL8Count" />
            <data count="_AL8Count" inType="win:AnsiString" name="_AL8Entries" />
            <data inType="win:UInt32" name="_AL9Count" />
            <data count="_AL9Count" inType="win:AnsiString" name="_AL9Entries" />
            <data inType="win:UInt32" name="MinimumThrottle" />
            <data inType="win:UInt32" name="_CR3" />
            <data inType="win:UInt32" name="_TFP" />
            <data inType="win:UInt32" name="OverThrottleThreshold" />
            <data inType="win:UInt16" name="DescriptionLength" />
            <data inType="win:UnicodeString" length="DescriptionLength" name="Description" />
          </template>
          <template tid="tidFanRundown">
            <data inType="win:UInt16" name="FanBiosNameLength" />
            <data inType="win:UnicodeString" length="FanBiosNameLength" name="FanBiosName" />
            <data inType="win:Boolean" name="FstSupported" />
            <data inType="win:UInt16" map="MapActiveCoolingDevicePowerState" name="PowerState" />
            <data inType="win:UInt32" name="Control" />
          </template>
          <template tid="tidFanPowerStateChange">
            <data inType="win:UInt16" name="FanBiosNameLength" />
            <data inType="win:UnicodeString" length="FanBiosNameLength" name="FanBiosName" />
            <data inType="win:UInt16" map="MapActiveCoolingDevicePowerState" name="PowerState" />
          </template>
          <template tid="tidFanStatusChange">
            <data inType="win:UInt16" name="FanBiosNameLength" />
            <data inType="win:UnicodeString" length="FanBiosNameLength" name="FanBiosName" />
            <data inType="win:UInt32" name="Control" />
          </template>
          <template tid="tidActiveCoolingConstraint">
            <data inType="win:UInt16" name="ThermalZoneDeviceInstanceLength" />
            <data inType="win:UnicodeString" length="ThermalZoneDeviceInstanceLength" name="ThermalZoneDeviceInstance" />
            <data inType="win:UInt16" name="DeviceInstanceLength" />
            <data inType="win:UnicodeString" length="DeviceInstanceLength" name="DeviceInstance" />
            <data inType="win:UInt16" map="MapActiveCoolingDevicePowerState" name="PowerState" />
          </template>
          <template tid="tidPassiveCoolingConstraint">
            <data inType="win:UInt16" name="ThermalZoneDeviceInstanceLength" />
            <data inType="win:UnicodeString" length="ThermalZoneDeviceInstanceLength" name="ThermalZoneDeviceInstance" />
            <data inType="win:UInt16" name="DeviceInstanceLength" />
            <data inType="win:UnicodeString" length="DeviceInstanceLength" name="DeviceInstance" />
            <data inType="win:UInt8" name="ThrottleLimit" />
          </template>
          <template tid="tidDeviceResetTrace">
            <data inType="win:UInt16" name="DeviceBiosNameLength" />
            <data inType="win:UnicodeString" length="DeviceBiosNameLength" name="DeviceBiosName" />
            <data inType="win:UInt16" map="MapResetType" name="DeviceResetType" />
            <data inType="win:UInt32" name="Status" />
          </template>
        </templates>
        <events>
          <event channel="chidAcpi" keywords="acpi:Diagnostic" level="win:Informational" message="$(string.Acpi.EventMessage.MemoryReserved)" symbol="ACPI_ETW_EVENT_MEMORY_RESERVED" task="ResourceTranslation" template="tidAddressDescriptor" value="1" />
          <event channel="chidAcpi" keywords="acpi:Diagnostic" level="win:Informational" message="$(string.Acpi.EventMessage.UnexpectedGpe)" symbol="ACPI_ETW_EVENT_UNEXPECTED_GPE" task="GpeEventHandling" template="tidGpeRegisterEvent" value="2" />
          <event channel="chidAcpi" keywords="acpi:Thermal" level="win:Informational" message="$(string.Acpi.EventMessage.TemperatureNotification)" symbol="ACPI_ETW_EVENT_TEMPERATURE_NOTIFICATION" task="TemperatureNotification" template="tidThermalNotification" value="3" />
          <event channel="chidAcpi" keywords="acpi:Thermal" level="win:Informational" message="$(string.Acpi.EventMessage.TripPointNotification)" symbol="ACPI_ETW_EVENT_TRIP_POINT_NOTIFICATION" task="TripPointNotification" template="tidThermalNotification" value="4" />
          <event channel="chidAcpi" keywords="acpi:Thermal" level="win:Informational" message="$(string.Acpi.EventMessage.ActiveCoolingDevicePower_V0)" notLogged="true" symbol="ACPI_ETW_EVENT_ACTIVE_COOLING_DEVICE_POWER_V0" task="ActiveCoolingDevicePower" template="tidActiveCoolingDevicePower_V0" value="5" />
          <event channel="chidAcpi" keywords="acpi:Thermal" level="win:Informational" message="$(string.Acpi.EventMessage.ActiveCoolingDevicePower)" symbol="ACPI_ETW_EVENT_ACTIVE_COOLING_DEVICE_POWER" task="ActiveCoolingDevicePower" template="tidActiveCoolingDevicePower" value="6" />
          <event channel="chidAcpi" keywords="acpi:Diagnostic" level="win:Informational" message="$(string.Acpi.EventMessage.AmlMethodTrace)" symbol="ACPI_ETW_EVENT_AML_METHOD_TRACE" task="AmlMethodTrace" template="tidAmlMethodTrace" value="7" />
          <event channel="chidAcpi" keywords="acpi:Thermal" level="win:Informational" message="$(string.Acpi.EventMessage.DeviceActiveCooling)" symbol="ACPI_ETW_EVENT_DEVICE_ACTIVE_COOLING" task="DeviceActiveCooling" template="tidDeviceActiveCooling" value="8" />
          <event channel="chidAcpi" keywords="acpi:Thermal" level="win:Informational" message="$(string.Acpi.EventMessage.DevicePassiveCooling)" symbol="ACPI_ETW_EVENT_DEVICE_PASSIVE_COOLING" task="DevicePassiveCooling" template="tidDevicePassiveCooling" value="9" />
          <event channel="chidAcpi" keywords="acpi:Thermal" level="win:Informational" message="$(string.Acpi.EventMessage.DeviceCoolingRundown)" symbol="ACPI_ETW_EVENT_DEVICE_COOLING_RUNDOWN" task="DeviceCoolingRundown" template="tidDeviceCoolingRundown" value="10" />
          <event channel="chidAcpi" keywords="acpi:Thermal" level="win:Informational" symbol="ACPI_ETW_EVENT_TEMPERATURE_CHANGE" task="TemperatureChange" template="tidTemperatureChange" value="11" />
          <event channel="chidAcpi" keywords="acpi:Thermal" level="win:Informational" symbol="ACPI_ETW_EVENT_THERMAL_ZONE_RUNDOWN_WIN8" task="ThermalZoneRundown" template="tidThermalZoneRundownWin8" value="12" />
          <event channel="chidAcpi" keywords="acpi:Thermal" level="win:Informational" symbol="ACPI_ETW_EVENT_THERMAL_ZONE_RUNDOWN_V1" task="ThermalZoneRundown" template="tidThermalZoneRundown_v1" value="12" version="1" />
          <event channel="chidAcpi" keywords="acpi:Thermal" level="win:Informational" symbol="ACPI_ETW_EVENT_THERMAL_ZONE_RUNDOWN_V2" task="ThermalZoneRundown" template="tidThermalZoneRundown_v2" value="12" version="2" />
          <event channel="chidAcpi" keywords="acpi:Thermal" level="win:Informational" symbol="ACPI_ETW_EVENT_THERMAL_ZONE_RUNDOWN" task="ThermalZoneRundown" template="tidThermalZoneRundown" value="12" version="3" />
          <event channel="chidAcpi" keywords="acpi:Thermal" level="win:Informational" symbol="ACPI_ETW_EVENT_FAN_RUNDOWN" task="FanRundown" template="tidFanRundown" value="13" />
          <event channel="chidAcpi" keywords="acpi:Thermal" level="win:Informational" symbol="ACPI_ETW_EVENT_FAN_POWER_STATE_CHANGE" task="FanPowerStateChange" template="tidFanPowerStateChange" value="14" />
          <event channel="chidAcpi" keywords="acpi:Thermal" level="win:Informational" symbol="ACPI_ETW_EVENT_FAN_STATUS_CHANGE" task="FanStatusChange" template="tidFanStatusChange" value="15" />
          <event channel="chidAcpi" keywords="acpi:Thermal" level="win:Informational" symbol="ACPI_ETW_EVENT_ACTIVE_CONSTRAINT_CHANGE" task="ActiveCoolingConstraint" template="tidActiveCoolingConstraint" value="16" />
          <event channel="chidAcpi" keywords="acpi:Thermal" level="win:Informational" symbol="ACPI_ETW_EVENT_ACTIVE_CONSTRAINT_RUNDOWN" task="ActiveCoolingConstraintRundown" template="tidActiveCoolingConstraint" value="17" />
          <event channel="chidAcpi" keywords="acpi:Thermal" level="win:Informational" symbol="ACPI_ETW_EVENT_PASSIVE_CONSTRAINT_CHANGE" task="PassiveCoolingConstraint" template="tidPassiveCoolingConstraint" value="18" />
          <event channel="chidAcpi" keywords="acpi:Thermal" level="win:Informational" symbol="ACPI_ETW_EVENT_PASSIVE_CONSTRAINT_RUNDOWN" task="PassiveCoolingConstraintRundown" template="tidPassiveCoolingConstraint" value="19" />
          <event channel="chidAcpi" keywords="acpi:Diagnostic ms:Telemetry" level="win:Informational" message="$(string.Acpi.EventMessage.DeviceReset)" symbol="ACPI_ETW_EVENT_DEVICE_RESET" task="DeviceReset" template="tidDeviceResetTrace" value="20" />
        </events>
      </provider>
      <provider guid="{3aa52b8b-6357-4c18-a92e-b53fb177853b}" message="$(string.InternationalProviderName)" messageFileName="%SystemRoot%\system32\Microsoft-Windows-System-Events.dll" name="Microsoft-Windows-International" resourceFileName="%SystemRoot%\system32\Microsoft-Windows-System-Events.dll" symbol="NLS_ETW_PROVIDER">
        <channels>
          <channel chid="NLS_ETW_CHANNEL_OPERATIONAL" enabled="true" isolation="Application" message="$(string.NLS_ETW_CHANNEL_OPERATIONAL.Name)" name="Microsoft-Windows-International/Operational" symbol="NLS_ETW_CHANNEL_OPERATIONAL" type="Operational">$(string.NLS_ETW_CHANNEL_OPERATIONAL.Description)</channel>
        </channels>
        <opcodes>
          <opcode message="$(string.NLS_ETW_OP_DATA_TABLE.OpcodeMessage)" name="DataTable" symbol="NLS_ETW_OP_DATA_TABLE" value="30" />
          <opcode message="$(string.NLS_ETW_OP_INIT.OpcodeMessage)" name="Initialize" symbol="NLS_ETW_OP_INIT" value="31" />
          <opcode message="$(string.NLS_ETW_OP_CONFIG_CHANGE.OpcodeMessage)" name="ConfigurationChange" symbol="NLS_ETW_OP_CONFIG_CHANGE" value="32" />
          <opcode message="$(string.NLS_ETW_OP_OPERATION.OpcodeMessage)" name="Operation" symbol="NLS_ETW_OP_OPERATION" value="33" />
          <opcode message="$(string.NLS_ETW_OP_CLEANUP.OpcodeMessage)" name="Cleanup" symbol="NLS_ETW_OP_CLEANUP" value="34" />
        </opcodes>
        <tasks>
          <task message="$(string.NLS_ETW_TASK_CODEPAGE.TaskMessage)" name="CharacterEncoding" symbol="NLS_ETW_TASK_CODEPAGE" value="30" />
          <task message="$(string.NLS_ETW_TASK_DATETIME.TaskMessage)" name="DateTimeCalendar" symbol="NLS_ETW_TASK_DATETIME" value="32" />
          <task message="$(string.NLS_ETW_TASK_CME.TaskMessage)" name="CME" symbol="NLS_ETW_TASK_CME" value="33" />
          <task message="$(string.NLS_ETW_TASK_GROUP_POLICY.TaskMessage)" name="GroupPolicy" symbol="NLS_ETW_TASK_GROUP_POLICY" value="34" />
          <task message="$(string.NLS_ETW_TASK_LOCALE.TaskMessage)" name="Locale" symbol="NLS_ETW_TASK_LOCALE" value="35" />
        </tasks>
        <templates>
          <template tid="tid_NLS_ETW_EVENT_REG_KEY_OPEN_FAILURE_WIN32_ERROR">
            <data inType="win:UnicodeString" name="RegistryKey" outType="xs:string" />
            <data inType="win:UInt32" name="ErrorCode" outType="xs:unsignedInt" />
            <data inType="win:UnicodeString" name="Message" outType="xs:string" />
          </template>
          <template tid="tid_NLS_ETW_EVENT_REG_KEY_OPEN_FAILURE_NTSTATUS">
            <data inType="win:UnicodeString" name="RegistryKey" outType="xs:string" />
            <data inType="win:UInt32" name="StatusCode" outType="xs:unsignedInt" />
          </template>
          <template tid="tid_NLS_ETW_EVENT_REG_KEY_OPEN_WARNING">
            <data inType="win:UnicodeString" name="RegistryKey" outType="xs:string" />
          </template>
          <template tid="tid_NLS_ETW_EVENT_CODEPAGE_MISSING">
            <data inType="win:UInt32" name="CodePage" outType="xs:unsignedInt" />
            <data inType="win:UnicodeString" name="FileName" outType="xs:string" />
          </template>
          <template tid="tid_NLS_ETW_EVENT_LOCALE_FILE_MISSING">
            <data inType="win:UnicodeString" name="LocaleName" outType="xs:string" />
            <data inType="win:UnicodeString" name="WinDir" outType="xs:string" />
          </template>
          <template tid="tid_NLS_ETW_EVENT_SET_LOCALE_INFO">
            <data inType="win:UInt32" name="ProcessId" outType="xs:unsignedInt" />
            <data inType="win:UnicodeString" name="ProdessName" outType="xs:string" />
            <data inType="win:UInt32" name="Locale" outType="xs:unsignedInt" />
            <data inType="win:UInt32" name="LCType" outType="xs:unsignedInt" />
            <data inType="win:UnicodeString" name="lpLCData" outType="xs:string" />
          </template>
          <template tid="tid_NLS_ETW_EVENT_SET_CALENDAR_INFO">
            <data inType="win:UInt32" name="ProcessId" outType="xs:unsignedInt" />
            <data inType="win:UnicodeString" name="ProdessName" outType="xs:string" />
            <data inType="win:UInt32" name="Locale" outType="xs:unsignedInt" />
            <data inType="win:UInt32" name="Calendar" outType="xs:unsignedInt" />
            <data inType="win:UInt32" name="CalType" outType="xs:unsignedInt" />
            <data inType="win:UnicodeString" name="lpLCalData" outType="xs:string" />
          </template>
          <template tid="tid_NLS_ETW_EVENT_SET_USER_GEO_ID">
            <data inType="win:UInt32" name="ProcessId" outType="xs:unsignedInt" />
            <data inType="win:UnicodeString" name="ProdessName" outType="xs:string" />
            <data inType="win:UInt32" name="GeoId" outType="xs:unsignedInt" />
          </template>
          <template tid="tid_NLS_ETW_EVENT_UPDATE_LOCALE">
            <data inType="win:UnicodeString" name="LocaleName" outType="xs:string" />
            <data inType="win:UInt32" name="Flags" outType="xs:unsignedInt" />
            <data inType="win:UInt32" name="ProcessId" outType="xs:unsignedInt" />
            <data inType="win:UnicodeString" name="ProdessName" outType="xs:string" />
            <data inType="win:UInt32" name="ReturnCode" outType="xs:unsignedInt" />
          </template>
          <template tid="tid_NLS_ETW_EVENT_PROCESS_INFO">
            <data inType="win:UInt32" name="ProcessId" outType="xs:unsignedInt" />
            <data inType="win:UnicodeString" name="ProdessName" outType="xs:string" />
          </template>
          <template tid="tid_CME_ETW_EVENT_FILENAME_LINE">
            <data inType="win:UnicodeString" name="FileName" outType="xs:string" />
            <data inType="win:UInt32" name="LineNumber" outType="xs:unsignedInt" />
            <data inType="win:UnicodeString" name="Reason" outType="xs:string" />
          </template>
          <template tid="tid_CME_ETW_EVENT_FILENAME">
            <data inType="win:UnicodeString" name="FileName" outType="xs:string" />
          </template>
          <template tid="tid_NLS_ETW_EVENT_STATUS_CODE">
            <data inType="win:UInt32" name="StatusCode" outType="win:HexInt32" />
          </template>
          <template tid="tid_NLS_ETW_EVENT_LOCALENAME">
            <data inType="win:UnicodeString" name="LocaleName" outType="xs:string" />
          </template>
          <template tid="tid_NLS_ETW_EVENT_LOCALENAME_STATUS">
            <data inType="win:UnicodeString" name="LocaleName" outType="xs:string" />
            <data inType="win:UInt32" name="StatusCode" outType="win:HexInt32" />
          </template>
          <template tid="tid_NLS_ETW_EVENT_VALUE">
            <data inType="win:UInt32" name="Value" outType="xs:unsignedInt" />
          </template>
          <template tid="tid_NLS_ETW_EVENT_VALUE_ERRORCODE_MESSAGE">
            <data inType="win:UInt32" name="Value" outType="xs:unsignedInt" />
            <data inType="win:UInt32" name="Win32ErrorCode" outType="win:HexInt32" />
            <data inType="win:UnicodeString" name="Win32ErrorMessage" outType="xs:string" />
          </template>
          <template tid="tid_NLS_ETW_EVENT_STRING_VALUE">
            <data inType="win:UnicodeString" name="String" outType="xs:string" />
          </template>
          <template tid="tid_CME_ETW_EVENT_ALTSORT_LOCALE">
            <data inType="win:UnicodeString" name="AltSort" outType="xs:string" />
            <data inType="win:UnicodeString" name="Locale" outType="xs:string" />
          </template>
          <template tid="tid_CME_ETW_EVENT_SET_LOCALE_INFO_ERROR">
            <data inType="win:UnicodeString" name="LCType" outType="xs:string" />
            <data inType="win:UnicodeString" name="Value" outType="xs:string" />
            <data inType="win:UInt32" name="Win32ErrorCode" outType="win:HexInt32" />
            <data inType="win:UnicodeString" name="Win32ErrorMessage" outType="xs:string" />
          </template>
          <template tid="tid_CME_ETW_EVENT_USERLOCALE_SETTING">
            <data inType="win:UnicodeString" name="LCType" outType="xs:string" />
            <data inType="win:UnicodeString" name="Value" outType="xs:string" />
          </template>
        </templates>
        <events>
          <event channel="NLS_ETW_CHANNEL_OPERATIONAL" level="win:Critical" message="$(string.NLS_ETW_EVENT_REG_KEY_OPEN_FAILURE_WIN32_ERROR.EventMessage)" opcode="Initialize" symbol="NLS_ETW_EVENT_REG_KEY_OPEN_FAILURE_WIN32_ERROR" task="Locale" template="tid_NLS_ETW_EVENT_REG_KEY_OPEN_FAILURE_WIN32_ERROR" value="1001" version="0" />
          <event channel="NLS_ETW_CHANNEL_OPERATIONAL" level="win:Critical" message="$(string.NLS_ETW_EVENT_REG_KEY_OPEN_FAILURE_NTSTATUS.EventMessage)" opcode="Initialize" symbol="NLS_ETW_EVENT_REG_KEY_OPEN_FAILURE_NTSTATUS" task="Locale" template="tid_NLS_ETW_EVENT_REG_KEY_OPEN_FAILURE_NTSTATUS" value="1002" version="0" />
          <event channel="NLS_ETW_CHANNEL_OPERATIONAL" level="win:Critical" message="$(string.NLS_ETW_EVENT_CODEPAGE_MISSING.EventMessage)" opcode="DataTable" symbol="NLS_ETW_EVENT_CODEPAGE_MISSING" task="CharacterEncoding" template="tid_NLS_ETW_EVENT_CODEPAGE_MISSING" value="1003" version="0" />
          <event channel="NLS_ETW_CHANNEL_OPERATIONAL" level="win:Critical" message="$(string.NLS_ETW_EVENT_CODEPAGE_CORRUPT.EventMessage)" opcode="DataTable" symbol="NLS_ETW_EVENT_CODEPAGE_CORRUPT" task="CharacterEncoding" template="tid_NLS_ETW_EVENT_CODEPAGE_MISSING" value="1004" version="0" />
          <event channel="NLS_ETW_CHANNEL_OPERATIONAL" level="win:Critical" message="$(string.NLS_ETW_EVENT_LOCALE_FILE_MISSING.EventMessage)" opcode="DataTable" symbol="NLS_ETW_EVENT_LOCALE_FILE_MISSING" task="Locale" template="tid_NLS_ETW_EVENT_LOCALE_FILE_MISSING" value="1005" version="0" />
          <event channel="NLS_ETW_CHANNEL_OPERATIONAL" level="win:Critical" message="$(string.NLS_ETW_EVENT_LOCALE_FILE_CORRUPT.EventMessage)" opcode="DataTable" symbol="NLS_ETW_EVENT_LOCALE_FILE_CORRUPT" task="Locale" template="tid_NLS_ETW_EVENT_LOCALE_FILE_MISSING" value="1006" version="0" />
          <event channel="NLS_ETW_CHANNEL_OPERATIONAL" level="win:Warning" message="$(string.NLS_ETW_EVENT_POLICY_NO_USER_OVERRIDE.EventMessage)" opcode="Operation" symbol="NLS_ETW_EVENT_POLICY_NO_USER_OVERRIDE" task="GroupPolicy" template="tid_NLS_ETW_EVENT_PROCESS_INFO" value="1500" version="0" />
          <event channel="NLS_ETW_CHANNEL_OPERATIONAL" level="win:Warning" message="$(string.NLS_ETW_EVENT_POLICY_NO_GEO_ID_CHANGE.EventMessage)" opcode="Operation" symbol="NLS_ETW_EVENT_POLICY_NO_GEO_ID_CHANGE" task="GroupPolicy" value="1501" version="0" />
          <event channel="NLS_ETW_CHANNEL_OPERATIONAL" level="win:Warning" message="$(string.NLS_ETW_EVENT_POLICY_RESTRICT_USER_LOCALES.EventMessage)" opcode="Operation" symbol="NLS_ETW_EVENT_POLICY_RESTRICT_USER_LOCALES" task="GroupPolicy" template="tid_NLS_ETW_EVENT_LOCALENAME" value="1502" version="0" />
          <event channel="NLS_ETW_CHANNEL_OPERATIONAL" level="win:Warning" message="$(string.NLS_ETW_EVENT_POLICY_NO_CUSTOM_LOCALES.EventMessage)" opcode="Operation" symbol="NLS_ETW_EVENT_POLICY_NO_CUSTOM_LOCALES" task="GroupPolicy" template="tid_NLS_ETW_EVENT_LOCALENAME" value="1503" version="0" />
          <event channel="NLS_ETW_CHANNEL_OPERATIONAL" level="win:Warning" message="$(string.NLS_ETW_EVENT_REG_KEY_OPEN_WARNING.EventMessage)" opcode="Initialize" symbol="NLS_ETW_EVENT_REG_KEY_OPEN_WARNING" task="Locale" template="tid_NLS_ETW_EVENT_REG_KEY_OPEN_WARNING" value="2000" version="0" />
          <event channel="NLS_ETW_CHANNEL_OPERATIONAL" level="win:Verbose" message="$(string.NLS_ETW_EVENT_HASH_TABLE_ERROR.EventMessage)" opcode="Initialize" symbol="NLS_ETW_EVENT_HASH_TABLE_ERROR" task="Locale" value="2500" version="0" />
          <event channel="NLS_ETW_CHANNEL_OPERATIONAL" level="win:Informational" message="$(string.NLS_ETW_EVENT_SET_LOCALE_INFO.EventMessage)" opcode="Operation" symbol="NLS_ETW_EVENT_SET_LOCALE_INFO" task="Locale" template="tid_NLS_ETW_EVENT_SET_LOCALE_INFO" value="3000" version="0" />
          <event channel="NLS_ETW_CHANNEL_OPERATIONAL" level="win:Informational" message="$(string.NLS_ETW_EVENT_SET_CALENDAR_INFO.EventMessage)" opcode="Operation" symbol="NLS_ETW_EVENT_SET_CALENDAR_INFO" task="DateTimeCalendar" template="tid_NLS_ETW_EVENT_SET_CALENDAR_INFO" value="3001" version="0" />
          <event channel="NLS_ETW_CHANNEL_OPERATIONAL" level="win:Informational" message="$(string.NLS_ETW_EVENT_SET_USER_GEO_ID.EventMessage)" opcode="Operation" symbol="NLS_ETW_EVENT_SET_USER_GEO_ID" task="Locale" template="tid_NLS_ETW_EVENT_SET_USER_GEO_ID" value="3002" version="0" />
          <event channel="NLS_ETW_CHANNEL_OPERATIONAL" level="win:Informational" message="$(string.NLS_ETW_EVENT_UPDATE_LOCALE.EventMessage)" opcode="Operation" symbol="NLS_ETW_EVENT_UPDATE_LOCALE" task="Locale" template="tid_NLS_ETW_EVENT_UPDATE_LOCALE" value="3003" version="0" />
          <event channel="NLS_ETW_CHANNEL_OPERATIONAL" level="win:Error" message="$(string.CME_ETW_EVENT_BAD_XML.EventMessage)" opcode="Operation" symbol="CME_ETW_EVENT_BAD_XML" task="CME" template="tid_CME_ETW_EVENT_FILENAME_LINE" value="10000" version="0" />
          <event channel="NLS_ETW_CHANNEL_OPERATIONAL" level="win:Error" message="$(string.CME_ETW_EVENT_INVALID_XML.EventMessage)" opcode="Operation" symbol="CME_ETW_EVENT_INVALID_XML" task="CME" value="10001" version="0" />
          <event channel="NLS_ETW_CHANNEL_OPERATIONAL" level="win:Error" message="$(string.CME_ETW_EVENT_LOCALE_ERR.EventMessage)" opcode="Operation" symbol="CME_ETW_EVENT_LOCALE_ERR" task="CME" template="tid_NLS_ETW_EVENT_LOCALENAME" value="10003" version="0" />
          <event channel="NLS_ETW_CHANNEL_OPERATIONAL" level="win:Error" message="$(string.CME_ETW_EVENT_INVALID_ALTSORT.EventMessage)" opcode="Operation" symbol="CME_ETW_EVENT_INVALID_ALTSORT" task="CME" template="tid_NLS_ETW_EVENT_LOCALENAME" value="10004" version="0" />
          <event channel="NLS_ETW_CHANNEL_OPERATIONAL" level="win:Error" message="$(string.CME_ETW_EVENT_ALTSORT_LOCALE_MISMATCH.EventMessage)" opcode="Operation" symbol="CME_ETW_EVENT_ALTSORT_LOCALE_MISMATCH" task="CME" template="tid_CME_ETW_EVENT_ALTSORT_LOCALE" value="10005" version="0" />
          <event channel="NLS_ETW_CHANNEL_OPERATIONAL" level="win:Error" message="$(string.CME_ETW_EVENT_SYS_INVALID.EventMessage)" opcode="Operation" symbol="CME_ETW_EVENT_SYS_INVALID" task="CME" value="10006" version="0" />
          <event channel="NLS_ETW_CHANNEL_OPERATIONAL" level="win:Error" message="$(string.CME_ETW_EVENT_SYS_ERROR.EventMessage)" opcode="Operation" symbol="CME_ETW_EVENT_SYS_ERROR" task="CME" template="tid_NLS_ETW_EVENT_STATUS_CODE" value="10007" version="0" />
          <event channel="NLS_ETW_CHANNEL_OPERATIONAL" level="win:Error" message="$(string.CME_ETW_EVENT_KB_ERR.EventMessage)" opcode="Operation" symbol="CME_ETW_EVENT_KB_ERR" task="CME" template="tid_NLS_ETW_EVENT_LOCALENAME" value="10008" version="0" />
          <event channel="NLS_ETW_CHANNEL_OPERATIONAL" level="win:Error" message="$(string.CME_ETW_EVENT_GEOID_INVALID.EventMessage)" opcode="Operation" symbol="CME_ETW_EVENT_GEOID_INVALID" task="CME" template="tid_NLS_ETW_EVENT_VALUE_ERRORCODE_MESSAGE" value="10009" version="0" />
          <event channel="NLS_ETW_CHANNEL_OPERATIONAL" level="win:Error" message="$(string.CME_ETW_EVENT_MUI_LANG_CHANGE_ERR.EventMessage)" opcode="Operation" symbol="CME_ETW_EVENT_MUI_LANG_CHANGE_ERR" task="CME" template="tid_NLS_ETW_EVENT_LOCALENAME_STATUS" value="10010" version="0" />
          <event channel="NLS_ETW_CHANNEL_OPERATIONAL" level="win:Error" message="$(string.CME_ETW_EVENT_MUI_FALLBACK_CHANGE_ERR.EventMessage)" opcode="Operation" symbol="CME_ETW_EVENT_MUI_FALLBACK_CHANGE_ERR" task="CME" template="tid_NLS_ETW_EVENT_LOCALENAME_STATUS" value="10011" version="0" />
          <event channel="NLS_ETW_CHANNEL_OPERATIONAL" level="win:Error" message="$(string.CME_ETW_EVENT_FILE_NOT_FOUND.EventMessage)" opcode="Operation" symbol="CME_ETW_EVENT_FILE_NOT_FOUND" task="CME" template="tid_CME_ETW_EVENT_FILENAME" value="10012" version="0" />
          <event channel="NLS_ETW_CHANNEL_OPERATIONAL" level="win:Error" message="$(string.CME_ETW_EVENT_SET_LOCALE_INFO_ERROR.EventMessage)" opcode="Operation" symbol="CME_ETW_EVENT_SET_LOCALE_INFO_ERROR" task="CME" template="tid_CME_ETW_EVENT_SET_LOCALE_INFO_ERROR" value="10013" version="0" />
          <event channel="NLS_ETW_CHANNEL_OPERATIONAL" level="win:Error" message="$(string.CME_ETW_EVENT_INVALID_CALENDAR.EventMessage)" opcode="Operation" symbol="CME_ETW_EVENT_INVALID_CALENDAR" task="CME" template="tid_NLS_ETW_EVENT_STRING_VALUE" value="10014" version="0" />
          <event channel="NLS_ETW_CHANNEL_OPERATIONAL" level="win:Error" message="$(string.CME_ETW_EVENT_INVALID_TWO_DIGIT_YEAR.EventMessage)" opcode="Operation" symbol="CME_ETW_EVENT_INVALID_TWO_DIGIT_YEAR" task="CME" template="tid_NLS_ETW_EVENT_STRING_VALUE" value="10015" version="0" />
          <event channel="NLS_ETW_CHANNEL_OPERATIONAL" level="win:Error" message="$(string.CME_ETW_EVENT_MAXYEAR_PERM.EventMessage)" opcode="Operation" symbol="CME_ETW_EVENT_MAXYEAR_PERM" task="CME" template="tid_NLS_ETW_EVENT_STATUS_CODE" value="10111" version="0" />
          <event channel="NLS_ETW_CHANNEL_OPERATIONAL" level="win:Error" message="$(string.CME_ETW_EVENT_COPY_PERM.EventMessage)" opcode="Operation" symbol="CME_ETW_EVENT_COPY_PERM" task="CME" value="10112" version="0" />
          <event channel="NLS_ETW_CHANNEL_OPERATIONAL" level="win:Error" message="$(string.CME_ETW_EVENT_SYS_PERM.EventMessage)" opcode="Operation" symbol="CME_ETW_EVENT_SYS_PERM" task="CME" value="10113" version="0" />
          <event channel="NLS_ETW_CHANNEL_OPERATIONAL" level="win:Error" message="$(string.CME_ETW_EVENT_CALENDAR_PERM.EventMessage)" opcode="Operation" symbol="CME_ETW_EVENT_CALENDAR_PERM" task="CME" value="10115" version="0" />
          <event channel="NLS_ETW_CHANNEL_OPERATIONAL" level="win:Verbose" message="$(string.CME_ETW_EVENT_STACK_OVERFLOW.EventMessage)" opcode="Operation" symbol="CME_ETW_EVENT_STACK_OVERFLOW" task="CME" value="10216" version="0" />
          <event channel="NLS_ETW_CHANNEL_OPERATIONAL" level="win:Verbose" message="$(string.CME_ETW_EVENT_INVALID_FLAG.EventMessage)" opcode="Operation" symbol="CME_ETW_EVENT_INVALID_FLAG" task="CME" value="10218" version="0" />
          <event channel="NLS_ETW_CHANNEL_OPERATIONAL" level="win:Verbose" message="$(string.CME_ETW_EVENT_INVALID_PARAM.EventMessage)" opcode="Operation" symbol="CME_ETW_EVENT_INVALID_PARAM" task="CME" value="10219" version="0" />
          <event channel="NLS_ETW_CHANNEL_OPERATIONAL" level="win:Verbose" message="$(string.CME_ETW_EVENT_UNRECOVERABLE.EventMessage)" opcode="Operation" symbol="CME_ETW_EVENT_UNRECOVERABLE" task="CME" value="10220" version="0" />
          <event channel="NLS_ETW_CHANNEL_OPERATIONAL" level="win:Verbose" message="$(string.CME_ETW_EVENT_INTERNAL.EventMessage)" opcode="Operation" symbol="CME_ETW_EVENT_INTERNAL" task="CME" template="tid_NLS_ETW_EVENT_STATUS_CODE" value="10221" version="0" />
          <event channel="NLS_ETW_CHANNEL_OPERATIONAL" level="win:Verbose" message="$(string.CME_ETW_EVENT_OPERATION_TIMEOUT.EventMessage)" opcode="Operation" symbol="CME_ETW_EVENT_OPERATION_TIMEOUT" task="CME" value="10222" version="0" />
          <event channel="NLS_ETW_CHANNEL_OPERATIONAL" level="win:Warning" message="$(string.CME_ETW_POLICY_SYSTEM_LOCALE.EventMessage)" opcode="Operation" symbol="CME_ETW_POLICY_SYSTEM_LOCALE" task="CME" value="10300" version="0" />
          <event channel="NLS_ETW_CHANNEL_OPERATIONAL" level="win:Informational" message="$(string.CME_ETW_EVENT_USERLOCALE_CHANGE.EventMessage)" opcode="Operation" symbol="CME_ETW_EVENT_USERLOCALE_CHANGE" task="CME" template="tid_NLS_ETW_EVENT_LOCALENAME" value="13000" version="0" />
          <event channel="NLS_ETW_CHANNEL_OPERATIONAL" level="win:Informational" message="$(string.CME_ETW_EVENT_USERLOCALE_RESET.EventMessage)" opcode="Operation" symbol="CME_ETW_EVENT_USERLOCALE_RESET" task="CME" template="tid_NLS_ETW_EVENT_LOCALENAME" value="13001" version="0" />
          <event channel="NLS_ETW_CHANNEL_OPERATIONAL" level="win:Informational" message="$(string.CME_ETW_EVENT_USERLOCALE_SETTING.EventMessage)" opcode="Operation" symbol="CME_ETW_EVENT_USERLOCALE_SETTING" task="CME" template="tid_CME_ETW_EVENT_USERLOCALE_SETTING" value="13002" version="0" />
          <event channel="NLS_ETW_CHANNEL_OPERATIONAL" level="win:Informational" message="$(string.CME_ETW_EVENT_SET_AS_CURRENT.EventMessage)" opcode="Operation" symbol="CME_ETW_EVENT_SET_AS_CURRENT" task="CME" value="13003" version="0" />
          <event channel="NLS_ETW_CHANNEL_OPERATIONAL" level="win:Informational" message="$(string.CME_ETW_EVENT_CHANGED_ALTSORT.EventMessage)" opcode="Operation" symbol="CME_ETW_EVENT_CHANGED_ALTSORT" task="CME" template="tid_NLS_ETW_EVENT_LOCALENAME" value="13004" version="0" />
          <event channel="NLS_ETW_CHANNEL_OPERATIONAL" level="win:Informational" message="$(string.CME_ETW_EVENT_CALENDAR.EventMessage)" opcode="Operation" symbol="CME_ETW_EVENT_CALENDAR" task="CME" template="tid_NLS_ETW_EVENT_STRING_VALUE" value="13005" version="0" />
          <event channel="NLS_ETW_CHANNEL_OPERATIONAL" level="win:Informational" message="$(string.CME_ETW_EVENT_MAXYEAR.EventMessage)" opcode="Operation" symbol="CME_ETW_EVENT_MAXYEAR" task="CME" template="tid_NLS_ETW_EVENT_STRING_VALUE" value="13006" version="0" />
          <event channel="NLS_ETW_CHANNEL_OPERATIONAL" level="win:Informational" message="$(string.CME_ETW_EVENT_GEOID_CHANGED.EventMessage)" opcode="Operation" symbol="CME_ETW_EVENT_GEOID_CHANGED" task="CME" template="tid_NLS_ETW_EVENT_VALUE" value="13007" version="0" />
          <event channel="NLS_ETW_CHANNEL_OPERATIONAL" level="win:Informational" message="$(string.CME_ETW_EVENT_SYS_CHANGE.EventMessage)" opcode="Operation" symbol="CME_ETW_EVENT_SYS_CHANGE" task="CME" template="tid_NLS_ETW_EVENT_LOCALENAME" value="13008" version="0" />
          <event channel="NLS_ETW_CHANNEL_OPERATIONAL" level="win:Informational" message="$(string.CME_ETW_EVENT_COPY_SETTINGS_DEF.EventMessage)" opcode="Operation" symbol="CME_ETW_EVENT_COPY_SETTINGS_DEF" task="CME" value="13009" version="0" />
          <event channel="NLS_ETW_CHANNEL_OPERATIONAL" level="win:Informational" message="$(string.CME_ETW_EVENT_COPY_SETTINGS_SYS.EventMessage)" opcode="Operation" symbol="CME_ETW_EVENT_COPY_SETTINGS_SYS" task="CME" value="13010" version="0" />
          <event channel="NLS_ETW_CHANNEL_OPERATIONAL" level="win:Informational" message="$(string.CME_ETW_EVENT_MUI_LANG_CHANGE.EventMessage)" opcode="Operation" symbol="CME_ETW_EVENT_MUI_LANG_CHANGE" task="CME" template="tid_NLS_ETW_EVENT_LOCALENAME" value="13011" version="0" />
          <event channel="NLS_ETW_CHANNEL_OPERATIONAL" level="win:Informational" message="$(string.CME_ETW_EVENT_MUI_FALLBACK_CHANGE.EventMessage)" opcode="Operation" symbol="CME_ETW_EVENT_MUI_FALLBACK_CHANGE" task="CME" template="tid_NLS_ETW_EVENT_LOCALENAME" value="13012" version="0" />
        </events>
      </provider>
      <provider guid="{b059b83f-d946-4b13-87ca-4292839dc2f2}" message="$(string.UserLoaderProviderName)" messageFileName="%SystemRoot%\system32\Microsoft-Windows-System-Events.dll" name="Microsoft-Windows-User-Loader" resourceFileName="%SystemRoot%\system32\Microsoft-Windows-System-Events.dll" symbol="UserLoaderGuid">
        <channels>
          <importChannel chid="GLOBAL_APPLICATION_CHANNEL" name="Application" />
          <channel chid="USER_LOADER_GENERAL_OPERATIONAL" enabled="true" name="Microsoft-Windows-User-Loader/Operational" type="Operational" />
          <channel chid="USER_LOADER_GENERAL" name="Microsoft-Windows-User-Loader/Analytic" type="Analytic" />
        </channels>
        <keywords>
          <keyword mask="0x10" message="$(string.USER_LOADER_KEYWORD_DEPRECATED_DLL.KeywordMessage)" name="USER_LOADER_KEYWORD_DEPRECATED_DLL" symbol="USER_LOADER_KEYWORD_DEPRECATED_DLL" />
          <keyword mask="0x20" message="$(string.USER_LOADER_FATAL_CALLBACK_EXCEPTION.KeywordMessage)" name="USER_LOADER_FATAL_CALLBACK_EXCEPTION" symbol="USER_LOADER_FATAL_CALLBACK_EXCEPTION" />
          <keyword mask="0x40" message="$(string.USER_LOADER_KEYWORD_LOAD_FAILURE.KeywordMessage)" name="USER_LOADER_KEYWORD_LOAD_FAILURE" symbol="USER_LOADER_KEYWORD_LOAD_FAILURE" />
          <keyword mask="0x80" message="$(string.USER_LOADER_KEYWORD_LAUNCH_16BIT_APP.KeywordMessage)" name="USER_LOADER_LAUNCH_16BIT_APP" symbol="USER_LOADER_LAUNCH_16BIT_APP" />
          <keyword mask="0x100" message="$(string.USER_LOADER_KEYWORD_COMPONENT_ON_DEMAND.KeywordMessage)" name="USER_LOADER_KEYWORD_COMPONENT_ON_DEMAND" symbol="USER_LOADER_KEYWORD_COMPONENT_ON_DEMAND" />
          <keyword mask="0x200" message="$(string.USER_LOADER_KEYWORD_LOAD_FATAL_ERROR.KeywordMessage)" name="USER_LOADER_KEYWORD_LOAD_FATAL_ERROR" symbol="USER_LOADER_KEYWORD_LOAD_FATAL_ERROR" />
        </keywords>
        <templates>
          <template tid="tid_UString">
            <data inType="win:UnicodeString" name="FileName" outType="xs:string" />
          </template>
          <template tid="tid_DllLoaded">
            <data inType="win:UnicodeString" name="DllName" outType="xs:string" />
          </template>
          <template tid="tid_FatalUserCallback">
            <data inType="win:UInt16" name="ProcessFileNamePathLength" />
            <data inType="win:UnicodeString" length="ProcessFileNamePathLength" name="ProcessFileNamePath" />
          </template>
          <template tid="tid_32UIntUStringUString_2">
            <data inType="win:UInt32" name="FailureReason" outType="win:HexInt32" />
            <data inType="win:UnicodeString" name="ImportDllName" outType="xs:string" />
            <data inType="win:UnicodeString" name="ExportModule" outType="xs:string" />
          </template>
          <template tid="tid_32UIntUStringUStringEx">
            <data inType="win:UInt32" name="FailureReason" outType="win:HexInt32" />
            <data inType="win:UnicodeString" name="ImportDllName" outType="xs:string" />
            <data inType="win:UnicodeString" name="ProcessImagePath" outType="xs:string" />
            <UserData>
              <EventXML xmlns="User-Loader">
                <FailureReason>%1</FailureReason>
                <ImportDllName>%2</ImportDllName>
                <ProcessImagePath>%3</ProcessImagePath>
              </EventXML>
            </UserData>
          </template>
          <template tid="tid_CurDirDllLoadFailureErrorEx">
            <data inType="win:UnicodeString" name="ProcessImagePath" outType="xs:string" />
            <data inType="win:UnicodeString" name="CurDirDllPath" outType="xs:string" />
            <UserData>
              <EventXML xmlns="User-Loader">
                <ProcessImagePath>%1</ProcessImagePath>
                <CurDirDllPath>%2</CurDirDllPath>
              </EventXML>
            </UserData>
          </template>
          <template tid="tid_CurDirDllLoadFailureWarningEx">
            <data inType="win:UnicodeString" name="ProcessImagePath" outType="xs:string" />
            <data inType="win:UnicodeString" name="CurDirDllPath" outType="xs:string" />
            <data inType="win:UnicodeString" name="FoundDllPath" outType="xs:string" />
            <UserData>
              <EventXML xmlns="User-Loader">
                <ProcessImagePath>%1</ProcessImagePath>
                <CurDirDllPath>%2</CurDirDllPath>
                <FoundDllPath>%3</FoundDllPath>
              </EventXML>
            </UserData>
          </template>
          <template tid="tid_32UIntUStringUString">
            <data inType="win:UInt32" name="FailureReason" outType="win:HexInt32" />
            <data inType="win:UnicodeString" name="ImportDllName" outType="xs:string" />
            <data inType="win:UnicodeString" name="ProcessImagePath" outType="xs:string" />
          </template>
          <template tid="tid_Launch16bitApp">
            <data inType="win:UnicodeString" name="FileName" outType="xs:string" />
          </template>
          <template tid="tid_ComponentOnDemand">
            <data inType="win:UInt32" name="ProcessId" />
            <data inType="win:UInt32" name="SuspendProcessRequest" />
            <data inType="win:UnicodeString" name="DLLName" outType="xs:string" />
          </template>
        </templates>
        <events>
          <event channel="USER_LOADER_GENERAL" keywords="USER_LOADER_KEYWORD_DEPRECATED_DLL" level="win:Informational" message="$(string.DeprecatedDll.EventMessage)" opcode="win:Info" symbol="DeprecatedDll" template="tid_UString" value="1" />
          <event channel="USER_LOADER_GENERAL" keywords="USER_LOADER_FATAL_CALLBACK_EXCEPTION" level="win:Informational" message="$(string.FatalUserCallbackException.EventMessage)" opcode="win:Info" symbol="FatalUserCallbackException" template="tid_FatalUserCallback" value="2" />
          <event channel="USER_LOADER_GENERAL" keywords="USER_LOADER_KEYWORD_LOAD_FAILURE" level="win:Informational" message="$(string.DllLoadFailure.EventMessage)" opcode="win:Info" symbol="LoadFailure" template="tid_32UIntUStringUString" value="3" />
          <event channel="USER_LOADER_GENERAL" keywords="USER_LOADER_LAUNCH_16BIT_APP" level="win:Informational" message="$(string.Launch16BitApp.EventMessage)" opcode="win:Info" symbol="Launch16BitApp" template="tid_Launch16bitApp" value="4" />
          <event channel="USER_LOADER_GENERAL" keywords="USER_LOADER_KEYWORD_COMPONENT_ON_DEMAND" level="win:Informational" message="$(string.ComponentOnDemand.EventMessage)" opcode="win:Info" symbol="ComponentOnDemand" template="tid_ComponentOnDemand" value="5" />
          <event channel="USER_LOADER_GENERAL" keywords="USER_LOADER_KEYWORD_LOAD_FATAL_ERROR" level="win:Warning" message="$(string.LoaderFatalErrorThread.EventMessage)" opcode="win:Info" symbol="LoaderFatalErrorThread" template="tid_UString" value="6" />
          <event channel="USER_LOADER_GENERAL" keywords="USER_LOADER_KEYWORD_LOAD_FATAL_ERROR" level="win:Warning" message="$(string.LdrFatalInitError.EventMessage)" opcode="win:Info" symbol="LdrFatalInitError" template="tid_UString" value="7" />
          <event channel="USER_LOADER_GENERAL" level="win:Informational" message="$(string.DllLoadFailure.EventMessage)" opcode="win:Info" symbol="LoadFailureOperational" template="tid_32UIntUStringUString_2" value="8" />
          <event channel="USER_LOADER_GENERAL" keywords="USER_LOADER_KEYWORD_LOAD_FATAL_ERROR" level="win:Critical" message="$(string.LoaderFatalErrorProc.EventMessage)" opcode="win:Info" symbol="LoaderFatalErrorProc" template="tid_UString" value="9" />
          <event channel="GLOBAL_APPLICATION_CHANNEL" level="win:Informational" message="$(string.DllLoadFailure.EventMessage)" opcode="win:Info" symbol="DllLoadFailure" template="tid_32UIntUStringUStringEx" value="10" />
          <event channel="GLOBAL_APPLICATION_CHANNEL" level="win:Warning" message="$(string.CurDirDllLoadFailureWarning.EventMessage)" opcode="win:Info" symbol="CurDirDllLoadFailureWarning" template="tid_CurDirDllLoadFailureWarningEx" value="11" />
          <event channel="GLOBAL_APPLICATION_CHANNEL" level="win:Error" message="$(string.CurDirDllLoadFailureError.EventMessage)" opcode="win:Info" symbol="CurDirDllLoadFailureError" template="tid_CurDirDllLoadFailureErrorEx" value="12" />
        </events>
      </provider>
      <provider guid="{96ac7637-5950-4a30-b8f7-e07e8e5734c1}" message="$(string.KernelBootDiagnosticsProviderName)" messageFileName="%SystemRoot%\system32\Microsoft-Windows-System-Events.dll" name="Microsoft-Windows-Kernel-BootDiagnostics" resourceFileName="%SystemRoot%\system32\Microsoft-Windows-System-Events.dll" symbol="MS_Kernel_BootDiagnostics_Provider">
        <channels>
          <channel chid="defch" name="Microsoft-Windows-Kernel-BootDiagnostics/Diagnostic" type="Analytic" />
        </channels>
        <tasks>
          <task name="SystemBoot" value="501" />
        </tasks>
        <events>
          <event channel="defch" keywords="win:ResponseTime" level="win:Informational" opcode="win:Start" symbol="KMBootEvt_SystemBoot_Start" task="SystemBoot" value="501" />
        </events>
      </provider>
      <provider guid="{5322d61a-9efa-4bc3-a3f9-14be95c144f8}" messageFileName="%SystemRoot%\system32\Microsoft-Windows-System-Events.dll" name="Microsoft-Windows-Kernel-Prefetch" resourceFileName="%SystemRoot%\system32\Microsoft-Windows-System-Events.dll" symbol="MS_Kernel_Prefetch_Provider">
        <channels>
          <channel chid="defch" name="Microsoft-Windows-Kernel-Prefetch/Diagnostic" type="Analytic" />
        </channels>
        <keywords>
          <keyword mask="0x20" name="BasicInformation" />
        </keywords>
        <tasks>
          <task name="PrefetchSections" value="1" />
          <task name="PrefetchMetadata" value="3" />
          <task name="OpenVolumes" value="5" />
          <task name="EndTrace" value="7" />
          <task name="ScenarioDecision" value="8" />
          <task name="GetReadLists" value="9" />
          <task name="AsyncWorker" value="10" />
        </tasks>
        <templates>
          <template tid="PrefetchDefault">
            <data inType="win:UInt16" name="ScenarioNameLength" />
            <data inType="win:UnicodeString" length="ScenarioNameLength" name="ScenarioName" />
            <data inType="win:UInt32" name="ScenarioHashId" outType="win:HexInt32" />
            <data inType="win:UInt32" name="ScenarioType" />
          </template>
          <template tid="PrefetchSectionsStart_v0">
            <data inType="win:UInt16" name="ScenarioNameLength" />
            <data inType="win:UnicodeString" length="ScenarioNameLength" name="ScenarioName" />
            <data inType="win:UInt32" name="ScenarioHashId" outType="win:HexInt32" />
            <data inType="win:UInt32" name="ScenarioType" />
            <data inType="win:UInt32" name="PrefetchPhase" />
            <data inType="win:UInt32" name="PrefetchType" />
            <data inType="win:UInt8" name="IsTricklePhase" />
          </template>
          <template tid="PrefetchSectionsStart">
            <data inType="win:UInt16" name="ScenarioNameLength" />
            <data inType="win:UnicodeString" length="ScenarioNameLength" name="ScenarioName" />
            <data inType="win:UInt32" name="ScenarioHashId" outType="win:HexInt32" />
            <data inType="win:UInt32" name="ScenarioType" />
            <data inType="win:UInt32" name="PrefetchPhaseMask" outType="win:HexInt32" />
            <data inType="win:UInt32" name="PrefetchType" />
            <data inType="win:UInt8" name="IsTricklePhase" />
          </template>
          <template tid="PrefetchSectionsStop_v0">
            <data inType="win:UInt16" name="ScenarioNameLength" />
            <data inType="win:UnicodeString" length="ScenarioNameLength" name="ScenarioName" />
            <data inType="win:UInt32" name="ScenarioHashId" outType="win:HexInt32" />
            <data inType="win:UInt32" name="ScenarioType" />
            <data inType="win:UInt32" name="PrefetchPhase" />
            <data inType="win:UInt32" name="PrefetchType" />
            <data inType="win:UInt8" name="IsTricklePhase" />
            <data inType="win:UInt64" name="NumPagesPrefetched" />
            <data inType="win:UInt32" name="NumReadLists" />
          </template>
          <template tid="PrefetchSectionsStop">
            <data inType="win:UInt16" name="ScenarioNameLength" />
            <data inType="win:UnicodeString" length="ScenarioNameLength" name="ScenarioName" />
            <data inType="win:UInt32" name="ScenarioHashId" outType="win:HexInt32" />
            <data inType="win:UInt32" name="ScenarioType" />
            <data inType="win:UInt32" name="PrefetchPhaseMask" outType="win:HexInt32" />
            <data inType="win:UInt32" name="PrefetchType" />
            <data inType="win:UInt8" name="IsTricklePhase" />
            <data inType="win:UInt64" name="NumPagesPrefetched" />
            <data inType="win:UInt32" name="NumReadLists" />
          </template>
          <template tid="PrefetchMetadata_v0">
            <data inType="win:UInt16" name="ScenarioNameLength" />
            <data inType="win:UnicodeString" length="ScenarioNameLength" name="ScenarioName" />
            <data inType="win:UInt32" name="ScenarioHashId" outType="win:HexInt32" />
            <data inType="win:UInt32" name="ScenarioType" />
            <data inType="win:UInt32" name="PrefetchPhase" />
          </template>
          <template tid="PrefetchMetadata">
            <data inType="win:UInt16" name="ScenarioNameLength" />
            <data inType="win:UnicodeString" length="ScenarioNameLength" name="ScenarioName" />
            <data inType="win:UInt32" name="ScenarioHashId" outType="win:HexInt32" />
            <data inType="win:UInt32" name="ScenarioType" />
            <data inType="win:UInt32" name="PrefetchPhaseMask" outType="win:HexInt32" />
          </template>
          <template tid="OpenVolumes">
            <data inType="win:UInt16" name="ScenarioNameLength" />
            <data inType="win:UnicodeString" length="ScenarioNameLength" name="ScenarioName" />
            <data inType="win:UInt32" name="ScenarioHashId" outType="win:HexInt32" />
            <data inType="win:UInt32" name="ScenarioType" />
          </template>
          <template tid="EndTrace">
            <data inType="win:UInt16" name="ScenarioNameLength" />
            <data inType="win:UnicodeString" length="ScenarioNameLength" name="ScenarioName" />
            <data inType="win:UInt32" name="ScenarioHashId" outType="win:HexInt32" />
            <data inType="win:UInt32" name="ScenarioType" />
            <data inType="win:UInt32" name="EndReason" />
          </template>
          <template tid="ScenarioDecision_v0">
            <data inType="win:UInt16" name="ScenarioNameLength" />
            <data inType="win:UnicodeString" length="ScenarioNameLength" name="ScenarioName" />
            <data inType="win:UInt32" name="ScenarioHashId" outType="win:HexInt32" />
            <data inType="win:UInt32" name="ScenarioType" />
            <data inType="win:UInt16" name="ActionFlags" />
            <data inType="win:UInt8" name="TraceReason" />
            <data inType="win:UInt8" name="PrefetchReason" />
          </template>
          <template tid="ScenarioDecision">
            <data inType="win:UInt16" name="ScenarioNameLength" />
            <data inType="win:UnicodeString" length="ScenarioNameLength" name="ScenarioName" />
            <data inType="win:UInt32" name="ScenarioHashId" outType="win:HexInt32" />
            <data inType="win:UInt32" name="ScenarioType" />
            <data inType="win:UInt16" name="ActionFlags" />
            <data inType="win:UInt8" name="TraceReason" />
            <data inType="win:UInt8" name="PrefetchReason" />
            <data inType="win:UInt32" name="NumLaunches" />
            <data inType="win:UInt32" name="TimeSinceLastLaunchInS" />
          </template>
          <template tid="GetReadListsStart">
            <data inType="win:UInt16" name="ScenarioNameLength" />
            <data inType="win:UnicodeString" length="ScenarioNameLength" name="ScenarioName" />
            <data inType="win:UInt32" name="ScenarioHashId" outType="win:HexInt32" />
            <data inType="win:UInt32" name="ScenarioType" />
            <data inType="win:UInt32" name="WorkItemsCount" />
          </template>
          <template tid="AsyncWorkerStart">
            <data inType="win:UInt16" name="ScenarioNameLength" />
            <data inType="win:UnicodeString" length="ScenarioNameLength" name="ScenarioName" />
            <data inType="win:UInt32" name="ScenarioHashId" outType="win:HexInt32" />
            <data inType="win:UInt32" name="ScenarioType" />
            <data inType="win:UInt32" name="NumPhases" />
          </template>
        </templates>
        <events>
          <event channel="defch" keywords="BasicInformation" level="win:Informational" opcode="win:Start" symbol="PfSnEvt_PrefetchSections_Start_v0" task="PrefetchSections" template="PrefetchSectionsStart_v0" value="1" version="0" />
          <event channel="defch" keywords="BasicInformation" level="win:Informational" opcode="win:Start" symbol="PfSnEvt_PrefetchSections_Start" task="PrefetchSections" template="PrefetchSectionsStart" value="1" version="1" />
          <event channel="defch" keywords="BasicInformation" level="win:Informational" opcode="win:Stop" symbol="PfSnEvt_PrefetchSections_Stop_v0" task="PrefetchSections" template="PrefetchSectionsStop_v0" value="2" version="0" />
          <event channel="defch" keywords="BasicInformation" level="win:Informational" opcode="win:Stop" symbol="PfSnEvt_PrefetchSections_Stop" task="PrefetchSections" template="PrefetchSectionsStop" value="2" version="1" />
          <event channel="defch" keywords="BasicInformation" level="win:Informational" opcode="win:Start" symbol="PfSnEvt_PrefetchMetadata_Start_v0" task="PrefetchMetadata" template="PrefetchMetadata_v0" value="3" version="0" />
          <event channel="defch" keywords="BasicInformation" level="win:Informational" opcode="win:Start" symbol="PfSnEvt_PrefetchMetadata_Start" task="PrefetchMetadata" template="PrefetchMetadata" value="3" version="1" />
          <event channel="defch" keywords="BasicInformation" level="win:Informational" opcode="win:Stop" symbol="PfSnEvt_PrefetchMetadata_Stop_v0" task="PrefetchMetadata" template="PrefetchMetadata_v0" value="4" version="0" />
          <event channel="defch" keywords="BasicInformation" level="win:Informational" opcode="win:Stop" symbol="PfSnEvt_PrefetchMetadata_Stop" task="PrefetchMetadata" template="PrefetchMetadata" value="4" version="1" />
          <event channel="defch" keywords="BasicInformation" level="win:Informational" opcode="win:Start" symbol="PfSnEvt_OpenVolumes_Start" task="OpenVolumes" template="OpenVolumes" value="5" />
          <event channel="defch" keywords="BasicInformation" level="win:Informational" opcode="win:Stop" symbol="PfSnEvt_OpenVolumes_Stop" task="OpenVolumes" template="OpenVolumes" value="6" />
          <event channel="defch" keywords="BasicInformation" level="win:Informational" opcode="win:Info" symbol="PfSnEvt_EndTrace_Info" task="EndTrace" template="EndTrace" value="7" />
          <event channel="defch" keywords="BasicInformation" level="win:Informational" opcode="win:Info" symbol="PfSnEvt_ScenarioDecision_Info_v0" task="ScenarioDecision" template="ScenarioDecision_v0" value="8" version="0" />
          <event channel="defch" keywords="BasicInformation" level="win:Informational" opcode="win:Info" symbol="PfSnEvt_ScenarioDecision_Info" task="ScenarioDecision" template="ScenarioDecision" value="8" version="1" />
          <event channel="defch" keywords="BasicInformation" level="win:Informational" opcode="win:Start" symbol="PfSnEvt_GetReadLists_Start" task="GetReadLists" template="GetReadListsStart" value="9" version="1" />
          <event channel="defch" keywords="BasicInformation" level="win:Informational" opcode="win:Stop" symbol="PfSnEvt_GetReadLists_Stop" task="GetReadLists" template="PrefetchDefault" value="10" version="1" />
          <event channel="defch" keywords="BasicInformation" level="win:Informational" opcode="win:Start" symbol="PfSnEvt_AsyncWorker_Start" task="AsyncWorker" template="AsyncWorkerStart" value="11" version="0" />
          <event channel="defch" keywords="BasicInformation" level="win:Informational" opcode="win:Stop" symbol="PfSnEvt_AsyncWorker_Stop" task="AsyncWorker" template="PrefetchDefault" value="12" version="0" />
          <event channel="defch" keywords="BasicInformation" level="win:Informational" opcode="win:Info" symbol="PfSnEvt_SyncPrefetchingDone_Info" task="AsyncWorker" template="PrefetchDefault" value="13" version="0" />
        </events>
      </provider>
      <provider guid="{E7558269-3FA5-46ed-9F4D-3C6E282DDE55}" message="$(string.UAC.ProviderName)" messageFileName="%systemroot%\system32\Microsoft-Windows-System-Events.dll" name="Microsoft-Windows-UAC" resourceFileName="%systemroot%\system32\Microsoft-Windows-System-Events.dll" symbol="MS_Windows_UAC_Provider">
        <channels>
          <channel chid="Operational" enabled="true" isolation="Application" message="$(string.UAC.ChannelName)" name="Microsoft-Windows-UAC/Operational" type="Operational" />
        </channels>
        <templates>
          <template tid="NoData" />
        </templates>
        <tasks>
          <task name="CreateProcess" value="1" />
        </tasks>
        <events>
          <event channel="Operational" level="win:Error" message="$(string.UAC.EventMessage.ErrorElevationRequired)" symbol="UACUnhandledErrorElevationRequired" task="CreateProcess" template="NoData" value="1" />
        </events>
      </provider>
      <provider guid="{d4263c98-310c-4d97-ba39-b55354f08584}" message="$(string.COM.ProviderName)" messageFileName="%systemroot%\system32\Microsoft-Windows-System-Events.dll" name="Microsoft-Windows-COM" resourceFileName="%systemroot%\system32\Microsoft-Windows-System-Events.dll" symbol="COMProviderGuid">
        <channels>
          <channel chid="COM_GENERAL" name="Microsoft-Windows-COM/Analytic" type="Analytic" />
        </channels>
        <keywords>
          <keyword mask="0x10" message="$(string.COM_CLASSNOTREG_ERROR.KeywordMessage)" name="COM_CLASSNOTREG_ERROR" symbol="COM_CLASSNOTREG_ERROR" />
        </keywords>
        <templates>
          <template tid="tid_ClassNotRegError">
            <data inType="win:GUID" name="CLSID" outType="xs:GUID" />
          </template>
        </templates>
        <events>
          <event channel="COM_GENERAL" keywords="COM_CLASSNOTREG_ERROR" level="win:Informational" message="$(string.COMClassNotReg.EventMessage)" opcode="win:Info" symbol="ClassNotRegError" template="tid_ClassNotRegError" value="1" />
        </events>
      </provider>
      <provider guid="{7D29D58A-931A-40ac-8743-48C733045548}" message="$(string.SrpEvtProviderName)" messageFileName="%SystemRoot%\system32\Microsoft-Windows-System-Events.dll" name="Microsoft-Windows-SoftwareRestrictionPolicies" resourceFileName="%SystemRoot%\system32\Microsoft-Windows-System-Events.dll" symbol="MS_Software_Restriction_Policies_Provider">
        <channels>
          <importChannel chid="c1" name="Application" />
        </channels>
        <templates>
          <template tid="Path">
            <data inType="win:UnicodeString" name="AttemptedPath" />
            <UserData>
              <Path xmlns="http://schemas.microsoft.com/schemas/event/Microsoft.Windows/1.0.0.0">
                <AttemptedPath>%1</AttemptedPath>
              </Path>
            </UserData>
          </template>
          <template tid="PathAndGuid">
            <data inType="win:UnicodeString" name="AttemptedPath" />
            <data inType="win:GUID" name="SrpRuleGuid" />
            <UserData>
              <PathAndGuid xmlns="http://schemas.microsoft.com/schemas/event/Microsoft.Windows/1.0.0.0">
                <AttemptedPath>%1</AttemptedPath>
                <SrpRuleGuid>%2</SrpRuleGuid>
              </PathAndGuid>
            </UserData>
          </template>
          <template tid="PathGuidAndRule">
            <data inType="win:UnicodeString" name="AttemptedPath" />
            <data inType="win:GUID" name="SrpRuleGuid" />
            <data inType="win:UnicodeString" name="RulePath" />
            <UserData>
              <PathGuidAndRule xmlns="http://schemas.microsoft.com/schemas/event/Microsoft.Windows/1.0.0.0">
                <AttemptedPath>%1</AttemptedPath>
                <SrpRuleGuid>%2</SrpRuleGuid>
                <RulePath>%3</RulePath>
              </PathGuidAndRule>
            </UserData>
          </template>
        </templates>
        <events>
          <event channel="c1" level="win:Warning" message="$(string.SrpEvt_AccessDisabledByPolicyDefault.EventMessage)" symbol="SrpEvt_AccessDisabledByPolicyDefault" template="Path" value="0x361" />
          <event channel="c1" level="win:Warning" message="$(string.SrpEvt_AccessDisabledByPolicyPublisher.EventMessage)" symbol="SrpEvt_AccessDisabledByPolicyPublisher" template="Path" value="0x363" />
          <event channel="c1" level="win:Warning" message="$(string.SrpEvt_AccessDisabledNoSaferUIByPolicy.EventMessage)" symbol="SrpEvt_AccessDisabledNoSaferUIByPolicy" template="PathAndGuid" value="0x372" />
          <event channel="c1" level="win:Informational" message="$(string.SrpEvt_AccessAuditByPolicy.EventMessage)" symbol="SrpEvt_AccessAuditByPolicy" template="PathAndGuid" value="0x032" />
          <event channel="c1" level="win:Warning" message="$(string.SrpEvt_AccessDisabledByPolicyOther.EventMessage)" symbol="SrpEvt_AccessDisabledByPolicyOther" template="PathAndGuid" value="0x364" />
          <event channel="c1" level="win:Warning" message="$(string.SrpEvt_AccessDisabledByPolicyPath.EventMessage)" symbol="SrpEvt_AccessDisabledByPolicyPath" template="PathGuidAndRule" value="0x362" />
        </events>
      </provider>
      <provider guid="{a8a1f2f6-a13a-45e9-b1fe-3419569e5ef2}" message="$(string.MUIEventProviderName)" messageFileName="%SystemRoot%\system32\Microsoft-Windows-System-Events.dll" name="Microsoft-Windows-MUI" resourceFileName="%SystemRoot%\system32\Microsoft-Windows-System-Events.dll" symbol="MUI_ETW_PROVIDER">
        <channels>
          <channel chid="MUI_ETW_CHANNEL_OPERATIONAL" enabled="true" isolation="System" message="$(string.MUI_ETW_CHANNEL_OPERATIONAL.Name)" name="Microsoft-Windows-MUI/Operational" symbol="MUI_ETW_CHANNEL_OPERATIONAL" type="Operational">$(string.MUI_ETW_CHANNEL_OPERATIONAL.Description)</channel>
          <channel chid="MUI_ETW_CHANNEL_ADMIN" enabled="true" isolation="System" message="$(string.MUI_ETW_CHANNEL_ADMIN.Name)" name="Microsoft-Windows-MUI/Admin" symbol="MUI_ETW_CHANNEL_ADMIN" type="Admin">$(string.MUI_ETW_CHANNEL_ADMIN.Description)</channel>
          <channel chid="MUI_ETW_CHANNEL_ANALYTIC" enabled="false" isolation="System" message="$(string.MUI_ETW_CHANNEL_ANALYTIC.Name)" name="Microsoft-Windows-MUI/Analytic" symbol="MUI_ETW_CHANNEL_ANALYTIC" type="Analytic">$(string.MUI_ETW_CHANNEL_ANALYTIC.Description)</channel>
          <channel chid="MUI_ETW_CHANNEL_DEBUG" enabled="false" isolation="System" message="$(string.MUI_ETW_CHANNEL_DEBUG.Name)" name="Microsoft-Windows-MUI/Debug" symbol="MUI_ETW_CHANNEL_DEBUG" type="Debug">$(string.MUI_ETW_CHANNEL_DEBUG.Description)</channel>
        </channels>
        <opcodes>
          <opcode message="$(string.MUI_ETW_OP_INIT.OpcodeMessage)" name="Initialize" symbol="MUI_ETW_OP_INIT" value="30" />
          <opcode message="$(string.MUI_ETW_OP_NOTIFY_OPERATION.OpcodeMessage)" name="InvokeCallback" symbol="MUI_ETW_OP_NOTIFY_OPERATION" value="31" />
          <opcode message="$(string.MUI_ETW_OP_MCBUILDER_DISABLECACHE.OpcodeMessage)" name="DisableCache" symbol="MUI_ETW_OP_MCBUILDER_DISABLECACHE" value="32" />
          <opcode message="$(string.MUI_ETW_OP_MCBUILDER_UPDATEMANIFEST.OpcodeMessage)" name="UpdateManifest" symbol="MUI_ETW_OP_MCBUILDER_UPDATEMANIFEST" value="33" />
          <opcode message="$(string.MUI_ETW_OP_MCBUILDER_BUILDCACHE.OpcodeMessage)" name="BuildCache" symbol="MUI_ETW_OP_MCBUILDER_BUILDCACHE" value="34" />
          <opcode message="$(string.MUI_ETW_OP_ENTRY.OpcodeMessage)" name="Entry" symbol="MUI_ETW_OP_ENTRY" value="35" />
          <opcode message="$(string.MUI_ETW_OP_EXIT.OpcodeMessage)" name="Exit" symbol="MUI_ETW_OP_EXIT" value="36" />
        </opcodes>
        <tasks>
          <task message="$(string.MUI_ETW_TASK_NOTIFY_CHANGE.TaskMessage)" name="NotifyLanguageChange" symbol="MUI_ETW_TASK_NOTIFY_CHANGE" value="30" />
          <task message="$(string.MUI_ETW_TASK_RESCACHE_BUILD.TaskMessage)" name="RescacheBuild" symbol="MUI_ETW_TASK_RESCACHE_BUILD" value="31" />
        </tasks>
        <templates>
          <template tid="tid_MUI_ETW_EVENT_NOTIFY_ERROR">
            <data inType="win:UInt32" name="Status" outType="win:HexInt32" />
          </template>
          <template tid="tid_MUI_ETW_EVENT_CALLBACK_DLL_LOAD_FAILURE">
            <data inType="win:UnicodeString" name="FileName" outType="xs:string" />
          </template>
          <template tid="tid_MUI_ETW_EVENT_CALLBACK_FUNCTION_NOT_FOUND">
            <data inType="win:UnicodeString" name="FileName" outType="xs:string" />
            <data inType="win:UInt32" name="Type" outType="xs:unsignedInt" />
            <data inType="win:AnsiString" name="FunctionName" outType="xs:string" />
          </template>
          <template tid="tid_MUI_ETW_EVENT_CALLBACK_DLL_NOT_SIGNED_OR_FOUND">
            <data inType="win:UnicodeString" name="FileName" outType="xs:string" />
          </template>
          <template tid="tid_MUI_ETW_EVENT_NOTIFY_INIT_INFO">
            <data inType="win:UInt32" name="Flags" outType="xs:unsignedInt" />
            <data inType="win:UnicodeString" name="NewLanguage" outType="xs:string" />
            <data inType="win:UnicodeString" name="PrevLanguage" outType="xs:string" />
            <data inType="win:UInt32" name="ExtendedFlag" outType="xs:unsignedInt" />
          </template>
          <template tid="tid_MUI_ETW_EVENT_NOTIFY_CALLBACK_RETURN_INFO">
            <data inType="win:UnicodeString" name="FileName" outType="xs:string" />
            <data inType="win:AnsiString" name="FunctionName" outType="xs:string" />
            <data inType="win:UInt32" name="ReturnValue" outType="xs:unsignedInt" />
          </template>
          <template tid="tid_MUI_ETW_EVENT_MCBUILDER_INIT">
            <data inType="win:UnicodeString" name="Parameter" outType="xs:string" />
          </template>
          <template tid="tid_MUI_ETW_EVENT_MCBUILDER_ERROR" />
          <template tid="tid_MUI_ETW_EVENT_MCBUILDER_EMPTY" />
          <template tid="tid_MUI_ETW_EVENT_ENTRYEXIT">
            <data inType="win:UnicodeString" name="Name" outType="xs:string" />
          </template>
          <template tid="tid_MUI_ETW_EVENT_MCBUILDER_NEWCACHE">
            <data inType="win:UInt32" name="NewCacheIndex" outType="xs:unsignedInt" />
            <data inType="win:UInt32" name="LiveCacheIndex" outType="xs:unsignedInt" />
            <data inType="win:UInt32" name="Config" outType="xs:unsignedInt" />
          </template>
          <template tid="tid_MUI_ETW_EVENT_MCBUILDER_INTERNAL_ERROR">
            <data inType="win:UInt32" name="ErrorCode" outType="xs:unsignedInt" />
          </template>
          <template tid="tid_MUI_ETW_EVENT_MCBUILDER_MANIFESTENTRY">
            <data inType="win:UnicodeString" name="FileName" outType="xs:string" />
            <data inType="win:UnicodeString" name="Affinity" outType="xs:string" />
            <data inType="win:Int32" name="Sequence" outType="xs:int" />
            <data inType="win:Int32" name="Priority" outType="xs:int" />
          </template>
          <template tid="tid_MUI_ETW_EVENT_MCBUILDER_ENTRYNOTCACHED">
            <data inType="win:UnicodeString" name="FileName" outType="xs:string" />
          </template>
        </templates>
        <events>
          <event channel="MUI_ETW_CHANNEL_OPERATIONAL" level="win:Error" message="$(string.MUI_ETW_EVENT_NOTIFY_ERROR.EventMessage)" opcode="InvokeCallback" symbol="MUI_ETW_EVENT_NOTIFY_ERROR" task="NotifyLanguageChange" template="tid_MUI_ETW_EVENT_NOTIFY_ERROR" value="2000" version="0" />
          <event channel="MUI_ETW_CHANNEL_ADMIN" level="win:Error" message="$(string.MUI_ETW_EVENT_CALLBACK_DLL_LOAD_FAILURE.EventMessage)" opcode="InvokeCallback" symbol="MUI_ETW_EVENT_CALLBACK_DLL_LOAD_FAILURE" task="NotifyLanguageChange" template="tid_MUI_ETW_EVENT_CALLBACK_DLL_LOAD_FAILURE" value="2001" version="0" />
          <event channel="MUI_ETW_CHANNEL_ADMIN" level="win:Error" message="$(string.MUI_ETW_EVENT_CALLBACK_FUNCTION_NOT_FOUND.EventMessage)" opcode="InvokeCallback" symbol="MUI_ETW_EVENT_CALLBACK_FUNCTION_NOT_FOUND" task="NotifyLanguageChange" template="tid_MUI_ETW_EVENT_CALLBACK_FUNCTION_NOT_FOUND" value="2002" version="0" />
          <event channel="MUI_ETW_CHANNEL_ADMIN" level="win:Error" message="$(string.MUI_ETW_EVENT_CALLBACK_DLL_NOT_SIGNED.EventMessage)" opcode="InvokeCallback" symbol="MUI_ETW_EVENT_CALLBACK_DLL_NOT_SIGNED" task="NotifyLanguageChange" template="tid_MUI_ETW_EVENT_CALLBACK_DLL_NOT_SIGNED_OR_FOUND" value="2003" version="0" />
          <event channel="MUI_ETW_CHANNEL_ADMIN" level="win:Error" message="$(string.MUI_ETW_EVENT_CALLBACK_DLL_NOT_FOUND.EventMessage)" opcode="InvokeCallback" symbol="MUI_ETW_EVENT_CALLBACK_DLL_NOT_FOUND" task="NotifyLanguageChange" template="tid_MUI_ETW_EVENT_CALLBACK_DLL_NOT_SIGNED_OR_FOUND" value="2004" version="0" />
          <event channel="MUI_ETW_CHANNEL_OPERATIONAL" level="win:Error" message="$(string.MUI_ETW_EVENT_MCBUILDER_REDIRECTION_ERROR.EventMessage)" opcode="Initialize" symbol="MUI_ETW_EVENT_MCBUILDER_REDIRECTION_ERROR" task="RescacheBuild" template="tid_MUI_ETW_EVENT_MCBUILDER_ERROR" value="2006" version="0" />
          <event channel="MUI_ETW_CHANNEL_OPERATIONAL" level="win:Error" message="$(string.MUI_ETW_EVENT_MCBUILDER_CACHEWRITE_ERROR.EventMessage)" opcode="Initialize" symbol="MUI_ETW_EVENT_MCBUILDER_CACHEWRITE_ERROR" task="RescacheBuild" template="tid_MUI_ETW_EVENT_MCBUILDER_ERROR" value="2007" version="0" />
          <event channel="MUI_ETW_CHANNEL_OPERATIONAL" level="win:Error" message="$(string.MUI_ETW_EVENT_MCBUILDER_DISABLECACHE_ERROR.EventMessage)" opcode="DisableCache" symbol="MUI_ETW_EVENT_MCBUILDER_DISABLECACHE_ERROR" task="RescacheBuild" template="tid_MUI_ETW_EVENT_MCBUILDER_ERROR" value="2008" version="0" />
          <event channel="MUI_ETW_CHANNEL_OPERATIONAL" level="win:Error" message="$(string.MUI_ETW_EVENT_MCBUILDER_UILANG_ERROR.EventMessage)" opcode="Initialize" symbol="MUI_ETW_EVENT_MCBUILDER_UILANG_ERROR" task="RescacheBuild" template="tid_MUI_ETW_EVENT_MCBUILDER_ERROR" value="2009" version="0" />
          <event channel="MUI_ETW_CHANNEL_ADMIN" level="win:Error" message="$(string.MUI_ETW_EVENT_MCBUILDER_CONFIGDATA_ERROR.EventMessage)" opcode="UpdateManifest" symbol="MUI_ETW_EVENT_MCBUILDER_CONFIGDATA_ERROR" task="RescacheBuild" template="tid_MUI_ETW_EVENT_MCBUILDER_ERROR" value="2010" version="0" />
          <event channel="MUI_ETW_CHANNEL_OPERATIONAL" level="win:Error" message="$(string.MUI_ETW_EVENT_MCBUILDER_MANIFESTWRITE_ERROR.EventMessage)" opcode="UpdateManifest" symbol="MUI_ETW_EVENT_MCBUILDER_MANIFESTWRITE_ERROR" task="RescacheBuild" template="tid_MUI_ETW_EVENT_MCBUILDER_ERROR" value="2011" version="0" />
          <event channel="MUI_ETW_CHANNEL_OPERATIONAL" level="win:Error" message="$(string.MUI_ETW_EVENT_MCBUILDER_INTERNAL_ERROR.EventMessage)" opcode="BuildCache" symbol="MUI_ETW_EVENT_MCBUILDER_INTERNAL_ERROR" task="RescacheBuild" template="tid_MUI_ETW_EVENT_MCBUILDER_INTERNAL_ERROR" value="2012" version="0" />
          <event channel="MUI_ETW_CHANNEL_OPERATIONAL" level="win:Error" message="$(string.MUI_ETW_EVENT_MCBUILDER_CACHEINSTALL_ERROR.EventMessage)" opcode="BuildCache" symbol="MUI_ETW_EVENT_MCBUILDER_CACHEINSTALL_ERROR" task="RescacheBuild" template="tid_MUI_ETW_EVENT_MCBUILDER_ERROR" value="2013" version="0" />
          <event channel="MUI_ETW_CHANNEL_OPERATIONAL" level="win:Error" message="$(string.MUI_ETW_EVENT_MCBUILDER_CREATEMANIFEST_ERROR.EventMessage)" opcode="Initialize" symbol="MUI_ETW_EVENT_MCBUILDER_CREATEMANIFEST_ERROR" task="RescacheBuild" template="tid_MUI_ETW_EVENT_MCBUILDER_ERROR" value="2014" version="0" />
          <event channel="MUI_ETW_CHANNEL_OPERATIONAL" level="win:Informational" message="$(string.MUI_ETW_EVENT_NOTIFY_INIT_INFO.EventMessage)" opcode="Initialize" symbol="MUI_ETW_EVENT_NOTIFY_INIT_INFO" task="NotifyLanguageChange" template="tid_MUI_ETW_EVENT_NOTIFY_INIT_INFO" value="3000" version="0" />
          <event channel="MUI_ETW_CHANNEL_OPERATIONAL" level="win:Informational" message="$(string.MUI_ETW_EVENT_NOTIFY_CALLBACK_RETURN_INFO.EventMessage)" opcode="InvokeCallback" symbol="MUI_ETW_EVENT_NOTIFY_CALLBACK_RETURN_INFO" task="NotifyLanguageChange" template="tid_MUI_ETW_EVENT_NOTIFY_CALLBACK_RETURN_INFO" value="3002" version="0" />
          <event channel="MUI_ETW_CHANNEL_OPERATIONAL" level="win:Informational" message="$(string.MUI_ETW_EVENT_MCBUILDER_INIT.EventMessage)" opcode="Initialize" symbol="MUI_ETW_EVENT_MCBUILDER_INIT" task="RescacheBuild" template="tid_MUI_ETW_EVENT_MCBUILDER_INIT" value="3003" version="0" />
          <event channel="MUI_ETW_CHANNEL_DEBUG" level="win:Informational" message="$(string.MUI_ETW_EVENT_MCBUILDER_MANIFESTENTRY.EventMessage)" opcode="UpdateManifest" symbol="MUI_ETW_EVENT_MCBUILDER_MANIFESTENTRY" task="RescacheBuild" template="tid_MUI_ETW_EVENT_MCBUILDER_MANIFESTENTRY" value="3004" version="0" />
          <event channel="MUI_ETW_CHANNEL_ANALYTIC" level="win:Informational" message="$(string.MUI_ETW_EVENT_ROUTINE_START.EventMessage)" opcode="BuildCache" symbol="MUI_ETW_EVENT_MCBUILDER_CACHEREBUILD_START" task="RescacheBuild" template="tid_MUI_ETW_EVENT_ENTRYEXIT" value="3005" version="0" />
          <event channel="MUI_ETW_CHANNEL_ANALYTIC" level="win:Informational" message="$(string.MUI_ETW_EVENT_ROUTINE_END.EventMessage)" opcode="BuildCache" symbol="MUI_ETW_EVENT_MCBUILDER_CACHEREBUILD_END" task="RescacheBuild" template="tid_MUI_ETW_EVENT_ENTRYEXIT" value="3006" version="0" />
          <event channel="MUI_ETW_CHANNEL_OPERATIONAL" level="win:Informational" message="$(string.MUI_ETW_EVENT_MCBUILDER_NEWCACHE.EventMessage)" opcode="BuildCache" symbol="MUI_ETW_EVENT_MCBUILDER_NEWCACHE" task="RescacheBuild" template="tid_MUI_ETW_EVENT_MCBUILDER_NEWCACHE" value="3007" version="0" />
          <event channel="MUI_ETW_CHANNEL_ANALYTIC" level="win:Informational" message="$(string.MUI_ETW_EVENT_ROUTINE_START.EventMessage)" opcode="Entry" symbol="MUI_ETW_EVENT_MCBUILDER_START" task="RescacheBuild" template="tid_MUI_ETW_EVENT_ENTRYEXIT" value="3008" version="0" />
          <event channel="MUI_ETW_CHANNEL_ANALYTIC" level="win:Informational" message="$(string.MUI_ETW_EVENT_ROUTINE_END.EventMessage)" opcode="Exit" symbol="MUI_ETW_EVENT_MCBUILDER_END" task="RescacheBuild" template="tid_MUI_ETW_EVENT_ENTRYEXIT" value="3009" version="0" />
          <event channel="MUI_ETW_CHANNEL_ANALYTIC" level="win:Informational" message="$(string.MUI_ETW_EVENT_ROUTINE_START.EventMessage)" opcode="Entry" symbol="MUI_ETW_EVENT_NOTIFY_START" task="RescacheBuild" template="tid_MUI_ETW_EVENT_ENTRYEXIT" value="3010" version="0" />
          <event channel="MUI_ETW_CHANNEL_ANALYTIC" level="win:Informational" message="$(string.MUI_ETW_EVENT_ROUTINE_END.EventMessage)" opcode="Exit" symbol="MUI_ETW_EVENT_NOTIFY_END" task="RescacheBuild" template="tid_MUI_ETW_EVENT_ENTRYEXIT" value="3011" version="0" />
          <event channel="MUI_ETW_CHANNEL_DEBUG" level="win:Informational" message="$(string.MUI_ETW_EVENT_MCBUILDER_ENTRYNOTCACHED.EventMessage)" opcode="UpdateManifest" symbol="MUI_ETW_EVENT_MCBUILDER_ENTRYNOTCACHED" task="RescacheBuild" template="tid_MUI_ETW_EVENT_MCBUILDER_ENTRYNOTCACHED" value="3012" version="0" />
          <event channel="MUI_ETW_CHANNEL_OPERATIONAL" level="win:Informational" message="$(string.MUI_ETW_EVENT_MCBUILDER_SYSTEM_CONSTRAINTS.EventMessage)" opcode="Initialize" symbol="MUI_ETW_EVENT_MCBUILDER_SYSTEM_CONSTRAINTS" task="RescacheBuild" template="tid_MUI_ETW_EVENT_MCBUILDER_EMPTY" value="3013" version="0" />
          <event channel="MUI_ETW_CHANNEL_ANALYTIC" level="win:Warning" message="$(string.MUI_ETW_EVENT_MCBUILDER_CONFIGPARAM.EventMessage)" opcode="BuildCache" symbol="MUI_ETW_EVENT_MCBUILDER_CONFIGPARAM" task="RescacheBuild" template="tid_MUI_ETW_EVENT_MCBUILDER_ERROR" value="4000" version="0" />
        </events>
      </provider>
      <provider guid="{16A1ADC1-9B7F-4CD9-94B3-D8296AB1B130}" message="$(string.AppCompat.ProviderName)" messageFileName="%systemroot%\system32\Microsoft-Windows-System-Events.dll" name="Microsoft-Windows-Kernel-AppCompat" resourceFileName="%systemroot%\system32\Microsoft-Windows-System-Events.dll" symbol="MS_Windows_Kernel_AppCompat_Provider">
        <channels>
          <channel chid="APPCOMPAT_GENERAL" name="Microsoft-Windows-Kernel-AppCompat/General" type="Analytic" />
          <channel chid="APPCOMPAT_PERFORMANCE" name="Microsoft-Windows-Kernel-AppCompat/Performance" type="Analytic" />
        </channels>
        <tasks>
          <task name="CompatCacheInit" value="1" />
          <task name="CompatCacheQuery" value="2" />
          <task name="CompatCdbQuery" value="3" />
          <task name="CompatMapQuirks" value="4" />
          <task name="CompatCacheUpdate" value="5" />
          <task name="CompatUserModeQuery" value="6" />
          <task name="CompatSdbQuery" value="7" />
        </tasks>
        <keywords>
          <keyword mask="0x0008" name="RegWrpAccessDenied" />
        </keywords>
        <templates>
          <template tid="tid_RegWrpAccessDenied">
            <data inType="win:UInt16" name="ExecutablePathLength" />
            <data inType="win:UnicodeString" length="ExecutablePathLength" name="ExecutablePath" />
            <data inType="win:UInt16" name="RegistryPathLength" />
            <data inType="win:UnicodeString" length="RegistryPathLength" name="RegistryPath" />
          </template>
          <template tid="tid_CompatOperationStatus">
            <data inType="win:HexInt32" name="StatusCode" outType="xs:HexInt32" />
          </template>
        </templates>
        <events>
          <event channel="APPCOMPAT_GENERAL" keywords="RegWrpAccessDenied" level="win:Informational" message="$(string.APPCOMPAT_REG_WRP_ACCESS_DENIED.EventMessage)" opcode="win:Info" symbol="APPCOMPAT_REG_WRP_ACCESS_DENIED" template="tid_RegWrpAccessDenied" value="1" />
          <event channel="APPCOMPAT_PERFORMANCE" level="win:Informational" opcode="win:Start" symbol="CompatCacheInitializeStart" task="CompatCacheInit" value="2" />
          <event channel="APPCOMPAT_PERFORMANCE" level="win:Informational" opcode="win:Stop" symbol="CompatCacheInitializeStop" task="CompatCacheInit" template="tid_CompatOperationStatus" value="3" />
          <event channel="APPCOMPAT_PERFORMANCE" level="win:Informational" opcode="win:Start" symbol="CompatCacheUpdateStart" task="CompatCacheUpdate" value="4" />
          <event channel="APPCOMPAT_PERFORMANCE" level="win:Informational" opcode="win:Stop" symbol="CompatCacheUpdateStop" task="CompatCacheUpdate" template="tid_CompatOperationStatus" value="5" />
          <event channel="APPCOMPAT_PERFORMANCE" level="win:Informational" opcode="win:Start" symbol="CompatCacheQueryStart" task="CompatCacheQuery" value="6" />
          <event channel="APPCOMPAT_PERFORMANCE" level="win:Informational" opcode="win:Stop" symbol="CompatCacheQueryStop" task="CompatCacheQuery" template="tid_CompatOperationStatus" value="7" />
          <event channel="APPCOMPAT_PERFORMANCE" level="win:Informational" opcode="win:Start" symbol="CompatCdbQueryStart" task="CompatCdbQuery" value="8" />
          <event channel="APPCOMPAT_PERFORMANCE" level="win:Informational" opcode="win:Stop" symbol="CompatCdbQueryStop" task="CompatCdbQuery" template="tid_CompatOperationStatus" value="9" />
          <event channel="APPCOMPAT_PERFORMANCE" level="win:Informational" opcode="win:Start" symbol="CompatMapQuirksStart" task="CompatMapQuirks" value="10" />
          <event channel="APPCOMPAT_PERFORMANCE" level="win:Informational" opcode="win:Stop" symbol="CompatMapQuirksStop" task="CompatMapQuirks" template="tid_CompatOperationStatus" value="11" />
          <event channel="APPCOMPAT_PERFORMANCE" level="win:Informational" opcode="win:Start" symbol="CompatUserModeQueryStart" task="CompatUserModeQuery" value="12" />
          <event channel="APPCOMPAT_PERFORMANCE" level="win:Informational" opcode="win:Stop" symbol="CompatUserModeQueryStop" task="CompatUserModeQuery" template="tid_CompatOperationStatus" value="13" />
          <event channel="APPCOMPAT_PERFORMANCE" level="win:Informational" opcode="win:Start" symbol="CompatSdbQueryStart" task="CompatSdbQuery" value="14" />
          <event channel="APPCOMPAT_PERFORMANCE" level="win:Informational" opcode="win:Stop" symbol="CompatSdbQueryStop" task="CompatSdbQuery" template="tid_CompatOperationStatus" value="15" />
        </events>
      </provider>
      <provider guid="{6ADDABF4-8C54-4eab-BF4F-FBEF61B62EB0}" message="$(string.AIT.ProviderName)" messageFileName="%systemroot%\system32\Microsoft-Windows-System-Events.dll" name="Microsoft-Windows-AIT" resourceFileName="%systemroot%\system32\Microsoft-Windows-System-Events.dll" symbol="MS_Windows_AIT_Provider">
        <templates>
          <template tid="tid_AitAppInfo">
            <data inType="win:UInt16" name="cchAppPathIncludingNull" />
            <data inType="win:Binary" length="21" name="ApplicationImageHeaderHash" />
            <data inType="win:UnicodeString" length="cchAppPathIncludingNull" name="AppPath" outType="xs:string" />
          </template>
          <template tid="tid_AitFeature">
            <data inType="win:GUID" name="FeatureGuid" />
            <data inType="win:Binary" length="21" name="ApplicationImageHeaderHash" />
          </template>
          <template tid="tid_KitFeature">
            <data inType="win:GUID" name="FeatureGuid" />
            <data inType="win:UInt32" name="CallerIdType" />
            <data inType="win:UInt16" name="cchImagePath" />
            <data inType="win:UnicodeString" length="cchImagePath" name="ImagePath" />
          </template>
          <template tid="tid_AitParentAitFeature">
            <data inType="win:UInt16" name="cchParentImagePathIncludingNull" />
            <data inType="win:GUID" name="FeatureGuid" />
            <data inType="win:Binary" length="21" name="ParentProcessImageHeaderHash" />
            <data inType="win:UnicodeString" length="cchParentImagePathIncludingNull" name="ParentImagePath" />
          </template>
          <template tid="tid_AitSystemUsageByDll">
            <data inType="win:Binary" length="1" name="Flags" />
            <data inType="win:UInt16" name="cchIdStringIncludingNull" />
            <data inType="win:UInt16" name="cchDllPathIncludingNull" />
            <data inType="win:UInt32" name="Category" />
            <data inType="win:UInt32" name="ManifestVersion" />
            <data inType="win:Binary" length="21" name="DllHeaderHash" />
            <data inType="win:Binary" length="21" name="ApplicationImageHeaderHash" />
            <data inType="win:AnsiString" length="cchIdStringIncludingNull" name="IdString" outType="xs:string" />
            <data inType="win:UnicodeString" length="cchDllPathIncludingNull" name="DllPath" outType="xs:string" />
          </template>
          <template tid="tid_AitSystemUsageByExe">
            <data inType="win:Binary" length="1" name="Flags" />
            <data inType="win:UInt16" name="cchIdStringIncludingNull" />
            <data inType="win:UInt32" name="Category" />
            <data inType="win:UInt32" name="ManifestVersion" />
            <data inType="win:Binary" length="21" name="ApplicationImageHeaderHash" />
            <data inType="win:AnsiString" length="cchIdStringIncludingNull" name="IdString" outType="xs:string" />
          </template>
        </templates>
        <tasks>
          <task name="AitFeature" value="1" />
          <task name="AitParentAitFeature" value="2" />
          <task name="AitAppInfo" value="3" />
          <task name="AitSystemUsageByDll" value="4" />
          <task name="AitSystemUsageByExe" value="5" />
          <task name="AitProcessEnd" value="6" />
          <task name="KitFeature" value="7" />
        </tasks>
        <events>
          <event level="win:Informational" symbol="AitFeatureIdUsedEvent" task="AitFeature" template="tid_AitFeature" value="1" />
          <event level="win:Informational" symbol="AitParentAitFeatureEvent" task="AitParentAitFeature" template="tid_AitParentAitFeature" value="2" />
          <event level="win:Informational" symbol="AitAppInfoEvent" task="AitAppInfo" template="tid_AitAppInfo" value="3" />
          <event level="win:Informational" symbol="AitSystemUsageByDllEvent" task="AitSystemUsageByDll" template="tid_AitSystemUsageByDll" value="4" />
          <event level="win:Informational" symbol="AitSystemUsageByExeEvent" task="AitSystemUsageByExe" template="tid_AitSystemUsageByExe" value="5" />
          <event level="win:Informational" symbol="AitProcessEndEvent" task="AitProcessEnd" value="6" />
          <event level="win:Informational" symbol="KitFeatureIdUsedEvent" task="KitFeature" template="tid_KitFeature" value="7" />
        </events>
      </provider>
      <provider guid="{18f4a5fd-fd3b-40a5-8fc2-e5d261c5d02e}" message="$(string.AeLookupServiceTrigger.ProviderName)" messageFileName="%systemroot%\system32\Microsoft-Windows-System-Events.dll" name="Microsoft-Windows-ApplicationExperience-LookupServiceTrigger" resourceFileName="%systemroot%\system32\Microsoft-Windows-System-Events.dll" symbol="MS_Windows_AeLookupServiceTrigger_Provider">
        <templates>
          <template tid="tid_AeLookupServiceTrigger">
            <data inType="win:GUID" name="AeLookupServieTrigger" />
          </template>
        </templates>
        <events>
          <event level="win:Informational" symbol="AeLookupServiceTriggerEvent" template="tid_AeLookupServiceTrigger" value="1" />
        </events>
      </provider>
      <provider guid="{6d8a3a60-40af-445a-98ca-99359e500146}" message="$(string.AeCache.ProviderName)" messageFileName="%systemroot%\system32\Microsoft-Windows-System-Events.dll" name="Microsoft-Windows-ApplicationExperience-Cache" resourceFileName="%systemroot%\system32\Microsoft-Windows-System-Events.dll" symbol="MS_Windows_AeCache_Provider">
        <channels>
          <channel chid="AE_CACHE_OPERATIONAL" enabled="true" name="Microsoft-Windows-Kernel-ApphelpCache/Operational" type="Operational" />
          <channel chid="AE_CACHE_DEBUG" enabled="false" name="Microsoft-Windows-Kernel-ApphelpCache/Debug" type="Debug" />
          <channel chid="AE_CACHE_ANALYTIC" enabled="false" name="Microsoft-Windows-Kernel-ApphelpCache/Analytic" type="Analytic" />
        </channels>
        <templates>
          <template tid="tid_AeCacheOperationalMessage">
            <data inType="win:AnsiString" name="OperationalMessage" outType="xs:string" />
          </template>
          <template tid="tid_AeCacheInfoMessage">
            <data inType="win:AnsiString" name="InfoMessage" outType="xs:string" />
          </template>
          <template tid="tid_AeCacheDebugMessage">
            <data inType="win:AnsiString" name="DebugMessage" outType="xs:string" />
          </template>
          <template tid="tid_SdbApiMatchMessageStringA">
            <data inType="win:Boolean" name="Matches" />
            <data inType="win:UnicodeString" name="CheckerName" outType="xs:string" />
            <data inType="win:UnicodeString" name="AttributeName" outType="xs:string" />
            <data inType="win:AnsiString" name="AttributeExpectedValue" outType="xs:string" />
          </template>
          <template tid="tid_SdbApiMatchMessageStringW">
            <data inType="win:Boolean" name="Matches" />
            <data inType="win:UnicodeString" name="CheckerName" outType="xs:string" />
            <data inType="win:UnicodeString" name="AttributeName" outType="xs:string" />
            <data inType="win:UnicodeString" name="AttributeExpectedValue" outType="xs:string" />
          </template>
          <template tid="tid_SdbApiMatchMessageDWord">
            <data inType="win:Boolean" name="Matches" />
            <data inType="win:UnicodeString" name="CheckerName" outType="xs:string" />
            <data inType="win:UnicodeString" name="AttributeName" outType="xs:string" />
            <data inType="win:UInt32" name="AttributeExpectedValue" outType="xs:unsignedInt" />
          </template>
          <template tid="tid_SdbApiMatchMessageQWord">
            <data inType="win:Boolean" name="Matches" />
            <data inType="win:UnicodeString" name="CheckerName" outType="xs:string" />
            <data inType="win:UnicodeString" name="AttributeName" outType="xs:string" />
            <data inType="win:UInt64" name="AttributeExpectedValue" outType="xs:unsignedLong" />
          </template>
        </templates>
        <events>
          <event channel="AE_CACHE_OPERATIONAL" level="win:Informational" message="$(string.AeCache.OperationalMessage)" symbol="AhCacheOperationalMessage" template="tid_AeCacheOperationalMessage" value="3" />
          <event channel="AE_CACHE_ANALYTIC" level="win:Informational" message="$(string.AeCache.InfoMessage)" symbol="AhCacheInfoMessage" template="tid_AeCacheInfoMessage" value="4" />
          <event channel="AE_CACHE_DEBUG" level="win:Error" message="$(string.AeCache.ErrorMessage)" symbol="AhcacheErrorMessage" template="tid_AeCacheDebugMessage" value="5" />
          <event channel="AE_CACHE_DEBUG" level="win:Informational" message="$(string.AeCache.InfoMessage)" symbol="SdbApiMatchMessageStringA" template="tid_SdbApiMatchMessageStringA" value="6" />
          <event channel="AE_CACHE_DEBUG" level="win:Informational" message="$(string.AeCache.InfoMessage)" symbol="SdbApiMatchMessageStringW" template="tid_SdbApiMatchMessageStringW" value="7" />
          <event channel="AE_CACHE_DEBUG" level="win:Informational" message="$(string.AeCache.InfoMessage)" symbol="SdbApiMatchMessageDWord" template="tid_SdbApiMatchMessageDWord" value="8" />
          <event channel="AE_CACHE_DEBUG" level="win:Informational" message="$(string.AeCache.InfoMessage)" symbol="SdbApiMatchMessageQWord" template="tid_SdbApiMatchMessageQWord" value="9" />
        </events>
      </provider>
      <provider guid="{17d6e590-f5fe-11dc-95ff-0800200c9a66}" message="$(string.AeSwitchBack.ProviderName)" messageFileName="%systemroot%\system32\Microsoft-Windows-System-Events.dll" name="Microsoft-Windows-ApplicationExperience-SwitchBack" resourceFileName="%systemroot%\system32\Microsoft-Windows-System-Events.dll" symbol="MS_Windows_AeSwitchBack_Provider">
        <templates>
          <template tid="tid_AeSbCall">
            <data inType="win:GUID" name="SwitchBranchGuid" />
            <data inType="win:UInt16" name="SwitchBranchNameLength" />
            <data inType="win:UnicodeString" length="SwitchBranchNameLength" name="SwitchBranchName" />
            <data inType="win:UInt16" name="SwitchBranchDescriptionLength" />
            <data inType="win:UnicodeString" length="SwitchBranchDescriptionLength" name="SwitchBranchDescription" />
          </template>
          <template tid="tid_AeSbImpl">
            <data inType="win:GUID" name="SwitchBranchImplGuid" />
            <data inType="win:UInt16" name="SwitchBranchImplNameLength" />
            <data inType="win:UnicodeString" length="SwitchBranchImplNameLength" name="SwitchBranchImplName" />
            <data inType="win:UInt16" name="SwitchBranchImplDescriptionLength" />
            <data inType="win:UnicodeString" length="SwitchBranchImplDescriptionLength" name="SwitchBranchImplDescription" />
          </template>
          <template tid="tid_AeSbContextUpdate">
            <data inType="win:GUID" name="TargetContextGuid" />
            <data inType="win:UInt16" name="TargetContextType" />
            <data inType="win:UInt16" name="ModuleNameLength" />
            <data inType="win:UnicodeString" length="ModuleNameLength" name="ModuleName" />
          </template>
          <template tid="tid_AeSbContextReadRetry">
            <data inType="win:UInt64" name="ContextUpdateCounter" />
          </template>
        </templates>
        <tasks>
          <task name="AeSbCall" value="1" />
          <task name="AeSbImpl" value="2" />
          <task name="AeSbContextUpdate" value="3" />
          <task name="AeSbContextReadRetry" value="4" />
        </tasks>
        <events>
          <event level="win:Informational" symbol="AeSbCallEvent" task="AeSbCall" template="tid_AeSbCall" value="1" />
          <event level="win:Informational" symbol="AeSbImplEvent" task="AeSbImpl" template="tid_AeSbImpl" value="2" />
          <event level="win:Informational" symbol="AeSbContextUpdateEvent" task="AeSbContextUpdate" template="tid_AeSbContextUpdate" value="3" />
          <event level="win:Informational" symbol="AeSbContextReadRetryEvent" task="AeSbContextReadRetry" template="tid_AeSbContextReadRetry" value="4" />
        </events>
      </provider>
      <provider guid="{7dd42a49-5329-4832-8dfd-43d979153a88}" message="$(string.KernelNetworkProviderName)" messageFileName="%SystemRoot%\system32\Microsoft-Windows-System-Events.dll" name="Microsoft-Windows-Kernel-Network" resourceFileName="%SystemRoot%\system32\Microsoft-Windows-System-Events.dll" symbol="NetProvGuid">
        <channels>
          <channel chid="NetEvents" isolation="System" name="Microsoft-Windows-Kernel-Network/Analytic" symbol="KERNEL_NETWORK_CHANNEL_ANALYTIC" type="Analytic">This channel contains Send, Receive, Connect, Disconnect, Retransmit, Accept, Reconnect, Fail, TcpCopy events for TcpIp protocol and Send, Receive, Fail events for UdpIp protocol. Both for IPV4 and IPV6.</channel>
        </channels>
        <tasks>
          <task name="KERNEL_NETWORK_TASK_TCPIP" symbol="KERNEL_NETWORK_TASK_TCPIP" value="10" />
          <task name="KERNEL_NETWORK_TASK_UDPIP" symbol="KERNEL_NETWORK_TASK_UDPIP" value="11" />
        </tasks>
        <keywords>
          <keyword mask="0x10" name="KERNEL_NETWORK_KEYWORD_IPV4" symbol="KERNEL_NETWORK_KEYWORD_IPV4" />
          <keyword mask="0x20" name="KERNEL_NETWORK_KEYWORD_IPV6" symbol="KERNEL_NETWORK_KEYWORD_IPV6" />
        </keywords>
        <opcodes>
          <opcode message="$(string.KERNEL_NETWORK_OPCODE_SEND.OpcodeMessage)" name="KERNEL_NETWORK_OPCODE_SEND" symbol="KERNEL_NETWORK_OPCODE_SEND" value="10" />
          <opcode message="$(string.KERNEL_NETWORK_OPCODE_RECV.OpcodeMessage)" name="KERNEL_NETWORK_OPCODE_RECV" symbol="KERNEL_NETWORK_OPCODE_RECV" value="11" />
          <opcode message="$(string.KERNEL_NETWORK_OPCODE_CONNECT.OpcodeMessage)" name="KERNEL_NETWORK_OPCODE_CONNECT" symbol="KERNEL_NETWORK_OPCODE_CONNECT" value="12" />
          <opcode message="$(string.KERNEL_NETWORK_OPCODE_DISCONNECT.OpcodeMessage)" name="KERNEL_NETWORK_OPCODE_DISCONNECT" symbol="KERNEL_NETWORK_OPCODE_DISCONNECT" value="13" />
          <opcode message="$(string.KERNEL_NETWORK_OPCODE_RETRANSMIT.OpcodeMessage)" name="KERNEL_NETWORK_OPCODE_RETRANSMIT" symbol="KERNEL_NETWORK_OPCODE_RETRANSMIT" value="14" />
          <opcode message="$(string.KERNEL_NETWORK_OPCODE_ACCEPT.OpcodeMessage)" name="KERNEL_NETWORK_OPCODE_ACCEPT" symbol="KERNEL_NETWORK_OPCODE_ACCEPT" value="15" />
          <opcode message="$(string.KERNEL_NETWORK_OPCODE_RECONNECT.OpcodeMessage)" name="KERNEL_NETWORK_OPCODE_RECONNECT" symbol="KERNEL_NETWORK_OPCODE_RECONNECT" value="16" />
          <opcode message="$(string.KERNEL_NETWORK_OPCODE_FAIL.OpcodeMessage)" name="KERNEL_NETWORK_OPCODE_FAIL" symbol="KERNEL_NETWORK_OPCODE_FAIL" value="17" />
          <opcode message="$(string.KERNEL_NETWORK_OPCODE_TCPCOPY.OpcodeMessage)" name="KERNEL_NETWORK_OPCODE_TCPCOPY" symbol="KERNEL_NETWORK_OPCODE_TCPCOPY" value="18" />
          <opcode message="$(string.KERNEL_NETWORK_OPCODE_SENDUDP.OpcodeMessage)" name="KERNEL_NETWORK_OPCODE_SENDUDP" symbol="KERNEL_NETWORK_OPCODE_SENDUDP" value="42" />
          <opcode message="$(string.KERNEL_NETWORK_OPCODE_RECVUDP.OpcodeMessage)" name="KERNEL_NETWORK_OPCODE_RECVUDP" symbol="KERNEL_NETWORK_OPCODE_RECVUDP" value="43" />
          <opcode message="$(string.KERNEL_NETWORK_OPCODE_FAILUDP.OpcodeMessage)" name="KERNEL_NETWORK_OPCODE_FAILUDP" symbol="KERNEL_NETWORK_OPCODE_FAILUDP" value="49" />
        </opcodes>
        <templates>
          <template tid="tid_SendIPV4">
            <data inType="win:UInt32" name="PID" outType="xs:unsignedInt" />
            <data inType="win:UInt32" name="size" outType="xs:unsignedInt" />
            <data inType="win:UInt32" name="daddr" outType="win:IPv4" />
            <data inType="win:UInt32" name="saddr" outType="win:IPv4" />
            <data inType="win:UInt16" name="dport" outType="win:Port" />
            <data inType="win:UInt16" name="sport" outType="win:Port" />
            <data inType="win:UInt32" name="startime" outType="xs:unsignedInt" />
            <data inType="win:UInt32" name="endtime" outType="xs:unsignedInt" />
            <data inType="win:UInt32" name="seqnum" outType="xs:unsignedInt" />
            <data inType="win:UInt32" name="connid" outType="xs:unsignedInt" />
          </template>
          <template tid="tid_GenericIPV4">
            <data inType="win:UInt32" name="PID" outType="xs:unsignedInt" />
            <data inType="win:UInt32" name="size" outType="xs:unsignedInt" />
            <data inType="win:UInt32" name="daddr" outType="win:IPv4" />
            <data inType="win:UInt32" name="saddr" outType="win:IPv4" />
            <data inType="win:UInt16" name="dport" outType="win:Port" />
            <data inType="win:UInt16" name="sport" outType="win:Port" />
            <data inType="win:UInt32" name="seqnum" outType="xs:unsignedInt" />
            <data inType="win:UInt32" name="connid" outType="xs:unsignedInt" />
          </template>
          <template tid="tid_ConnectAcceptIPV4">
            <data inType="win:UInt32" name="PID" outType="xs:unsignedInt" />
            <data inType="win:UInt32" name="size" outType="xs:unsignedInt" />
            <data inType="win:UInt32" name="daddr" outType="win:IPv4" />
            <data inType="win:UInt32" name="saddr" outType="win:IPv4" />
            <data inType="win:UInt16" name="dport" outType="win:Port" />
            <data inType="win:UInt16" name="sport" outType="win:Port" />
            <data inType="win:UInt16" name="mss" outType="xs:unsignedShort" />
            <data inType="win:UInt16" name="sackopt" outType="xs:unsignedShort" />
            <data inType="win:UInt16" name="tsopt" outType="xs:unsignedShort" />
            <data inType="win:UInt16" name="wsopt" outType="xs:unsignedShort" />
            <data inType="win:UInt32" name="rcvwin" outType="xs:unsignedInt" />
            <data inType="win:UInt16" name="rcvwinscale" outType="xs:unsignedShort" />
            <data inType="win:UInt16" name="sndwinscale" outType="xs:unsignedShort" />
            <data inType="win:UInt32" name="seqnum" outType="xs:unsignedInt" />
            <data inType="win:UInt32" name="connid" outType="xs:unsignedInt" />
          </template>
          <template tid="tid_Fail">
            <data inType="win:UInt16" name="Proto" outType="xs:unsignedShort" />
            <data inType="win:UInt16" name="FailureCode" outType="xs:unsignedShort" />
          </template>
          <template tid="tid_SendIPV6">
            <data inType="win:UInt32" name="PID" outType="xs:unsignedInt" />
            <data inType="win:UInt32" name="size" outType="xs:unsignedInt" />
            <data inType="win:Binary" length="16" name="daddr" outType="win:IPv6" />
            <data inType="win:Binary" length="16" name="saddr" outType="win:IPv6" />
            <data inType="win:UInt16" name="dport" outType="win:Port" />
            <data inType="win:UInt16" name="sport" outType="win:Port" />
            <data inType="win:UInt32" name="startime" outType="xs:unsignedInt" />
            <data inType="win:UInt32" name="endtime" outType="xs:unsignedInt" />
            <data inType="win:UInt32" name="seqnum" outType="xs:unsignedInt" />
            <data inType="win:UInt32" name="connid" outType="xs:unsignedInt" />
          </template>
          <template tid="tid_GenericIPV6">
            <data inType="win:UInt32" name="PID" outType="xs:unsignedInt" />
            <data inType="win:UInt32" name="size" outType="xs:unsignedInt" />
            <data inType="win:Binary" length="16" name="daddr" outType="win:IPv6" />
            <data inType="win:Binary" length="16" name="saddr" outType="win:IPv6" />
            <data inType="win:UInt16" name="dport" outType="win:Port" />
            <data inType="win:UInt16" name="sport" outType="win:Port" />
            <data inType="win:UInt32" name="seqnum" outType="xs:unsignedInt" />
            <data inType="win:UInt32" name="connid" outType="xs:unsignedInt" />
          </template>
          <template tid="tid_ConnectAcceptIPV6">
            <data inType="win:UInt32" name="PID" outType="xs:unsignedInt" />
            <data inType="win:UInt32" name="size" outType="xs:unsignedInt" />
            <data inType="win:Binary" length="16" name="daddr" outType="win:IPv6" />
            <data inType="win:Binary" length="16" name="saddr" outType="win:IPv6" />
            <data inType="win:UInt16" name="dport" outType="win:Port" />
            <data inType="win:UInt16" name="sport" outType="win:Port" />
            <data inType="win:UInt16" name="mss" outType="xs:unsignedShort" />
            <data inType="win:UInt16" name="sackopt" outType="xs:unsignedShort" />
            <data inType="win:UInt16" name="tsopt" outType="xs:unsignedShort" />
            <data inType="win:UInt16" name="wsopt" outType="xs:unsignedShort" />
            <data inType="win:UInt32" name="rcvwin" outType="xs:unsignedInt" />
            <data inType="win:UInt16" name="rcvwinscale" outType="xs:unsignedShort" />
            <data inType="win:UInt16" name="sndwinscale" outType="xs:unsignedShort" />
            <data inType="win:UInt32" name="seqnum" outType="xs:unsignedInt" />
            <data inType="win:UInt32" name="connid" outType="xs:unsignedInt" />
          </template>
        </templates>
        <events>
          <event channel="NetEvents" keywords="KERNEL_NETWORK_KEYWORD_IPV4" level="win:Informational" message="$(string.Network.SendIPV4.EventMessage)" opcode="KERNEL_NETWORK_OPCODE_SEND" symbol="KNetEvt_SendIPV4" task="KERNEL_NETWORK_TASK_TCPIP" template="tid_SendIPV4" value="10" />
          <event channel="NetEvents" keywords="KERNEL_NETWORK_KEYWORD_IPV4" level="win:Informational" message="$(string.Network.RecvIPV4.EventMessage)" opcode="KERNEL_NETWORK_OPCODE_RECV" symbol="KNetEvt_RecvIPV4" task="KERNEL_NETWORK_TASK_TCPIP" template="tid_GenericIPV4" value="11" />
          <event channel="NetEvents" keywords="KERNEL_NETWORK_KEYWORD_IPV4" level="win:Informational" message="$(string.Network.ConnectIPV4.EventMessage)" opcode="KERNEL_NETWORK_OPCODE_CONNECT" symbol="KNetEvt_ConnectIPV4" task="KERNEL_NETWORK_TASK_TCPIP" template="tid_ConnectAcceptIPV4" value="12" />
          <event channel="NetEvents" keywords="KERNEL_NETWORK_KEYWORD_IPV4" level="win:Informational" message="$(string.Network.DisconnectIPV4.EventMessage)" opcode="KERNEL_NETWORK_OPCODE_DISCONNECT" symbol="KNetEvt_DisconnectIPV4" task="KERNEL_NETWORK_TASK_TCPIP" template="tid_GenericIPV4" value="13" />
          <event channel="NetEvents" keywords="KERNEL_NETWORK_KEYWORD_IPV4" level="win:Informational" message="$(string.Network.RetransmitIPV4.EventMessage)" opcode="KERNEL_NETWORK_OPCODE_RETRANSMIT" symbol="KNetEvt_RetransmitIPV4" task="KERNEL_NETWORK_TASK_TCPIP" template="tid_GenericIPV4" value="14" />
          <event channel="NetEvents" keywords="KERNEL_NETWORK_KEYWORD_IPV4" level="win:Informational" message="$(string.Network.AcceptIPV4.EventMessage)" opcode="KERNEL_NETWORK_OPCODE_ACCEPT" symbol="KNetEvt_AcceptIPV4" task="KERNEL_NETWORK_TASK_TCPIP" template="tid_ConnectAcceptIPV4" value="15" />
          <event channel="NetEvents" keywords="KERNEL_NETWORK_KEYWORD_IPV4" level="win:Informational" message="$(string.Network.ReconnectIPV4.EventMessage)" opcode="KERNEL_NETWORK_OPCODE_RECONNECT" symbol="KNetEvt_ReconnectIPV4" task="KERNEL_NETWORK_TASK_TCPIP" template="tid_GenericIPV4" value="16" />
          <event channel="NetEvents" keywords="KERNEL_NETWORK_KEYWORD_IPV4 KERNEL_NETWORK_KEYWORD_IPV6" level="win:Informational" message="$(string.Network.Fail.EventMessage)" opcode="KERNEL_NETWORK_OPCODE_FAIL" symbol="KNetEvt_Fail" task="KERNEL_NETWORK_TASK_TCPIP" template="tid_Fail" value="17" />
          <event channel="NetEvents" keywords="KERNEL_NETWORK_KEYWORD_IPV4" level="win:Informational" message="$(string.Network.TcpCopyIPV4.EventMessage)" opcode="KERNEL_NETWORK_OPCODE_TCPCOPY" symbol="KNetEvt_TcpCopyIPV4" task="KERNEL_NETWORK_TASK_TCPIP" template="tid_GenericIPV4" value="18" />
          <event channel="NetEvents" keywords="KERNEL_NETWORK_KEYWORD_IPV4" level="win:Informational" message="$(string.Network.SendIPV4Udp.EventMessage)" opcode="KERNEL_NETWORK_OPCODE_SENDUDP" symbol="KNetEvt_SendIPV4Udp" task="KERNEL_NETWORK_TASK_UDPIP" template="tid_GenericIPV4" value="42" />
          <event channel="NetEvents" keywords="KERNEL_NETWORK_KEYWORD_IPV4" level="win:Informational" message="$(string.Network.RecvIPV4Udp.EventMessage)" opcode="KERNEL_NETWORK_OPCODE_RECVUDP" symbol="KNetEvt_RecvIPV4Udp" task="KERNEL_NETWORK_TASK_UDPIP" template="tid_GenericIPV4" value="43" />
          <event channel="NetEvents" keywords="KERNEL_NETWORK_KEYWORD_IPV4 KERNEL_NETWORK_KEYWORD_IPV6" level="win:Informational" message="$(string.Network.FailUdp.EventMessage)" opcode="KERNEL_NETWORK_OPCODE_FAILUDP" symbol="KNetEvt_FailUdp" task="KERNEL_NETWORK_TASK_UDPIP" template="tid_Fail" value="49" />
          <event channel="NetEvents" keywords="KERNEL_NETWORK_KEYWORD_IPV6" level="win:Informational" message="$(string.Network.SendIPV6.EventMessage)" opcode="KERNEL_NETWORK_OPCODE_SEND" symbol="KNetEvt_SendIPV6" task="KERNEL_NETWORK_TASK_TCPIP" template="tid_SendIPV6" value="26" />
          <event channel="NetEvents" keywords="KERNEL_NETWORK_KEYWORD_IPV6" level="win:Informational" message="$(string.Network.RecvIPV6.EventMessage)" opcode="KERNEL_NETWORK_OPCODE_RECV" symbol="KNetEvt_RecvIPV6" task="KERNEL_NETWORK_TASK_TCPIP" template="tid_GenericIPV6" value="27" />
          <event channel="NetEvents" keywords="KERNEL_NETWORK_KEYWORD_IPV6" level="win:Informational" message="$(string.Network.ConnectIPV6.EventMessage)" opcode="KERNEL_NETWORK_OPCODE_CONNECT" symbol="KNetEvt_ConnectIPV6" task="KERNEL_NETWORK_TASK_TCPIP" template="tid_ConnectAcceptIPV6" value="28" />
          <event channel="NetEvents" keywords="KERNEL_NETWORK_KEYWORD_IPV6" level="win:Informational" message="$(string.Network.DisconnectIPV6.EventMessage)" opcode="KERNEL_NETWORK_OPCODE_DISCONNECT" symbol="KNetEvt_DisconnectIPV6" task="KERNEL_NETWORK_TASK_TCPIP" template="tid_GenericIPV6" value="29" />
          <event channel="NetEvents" keywords="KERNEL_NETWORK_KEYWORD_IPV6" level="win:Informational" message="$(string.Network.RetransmitIPV6.EventMessage)" opcode="KERNEL_NETWORK_OPCODE_RETRANSMIT" symbol="KNetEvt_RetransmitIPV6" task="KERNEL_NETWORK_TASK_TCPIP" template="tid_GenericIPV6" value="30" />
          <event channel="NetEvents" keywords="KERNEL_NETWORK_KEYWORD_IPV6" level="win:Informational" message="$(string.Network.AcceptIPV6.EventMessage)" opcode="KERNEL_NETWORK_OPCODE_ACCEPT" symbol="KNetEvt_AcceptIPV6" task="KERNEL_NETWORK_TASK_TCPIP" template="tid_ConnectAcceptIPV6" value="31" />
          <event channel="NetEvents" keywords="KERNEL_NETWORK_KEYWORD_IPV6" level="win:Informational" message="$(string.Network.ReconnectIPV6.EventMessage)" opcode="KERNEL_NETWORK_OPCODE_RECONNECT" symbol="KNetEvt_ReconnectIPV6" task="KERNEL_NETWORK_TASK_TCPIP" template="tid_GenericIPV6" value="32" />
          <event channel="NetEvents" keywords="KERNEL_NETWORK_KEYWORD_IPV6" level="win:Informational" message="$(string.Network.TcpCopyIPV6.EventMessage)" opcode="KERNEL_NETWORK_OPCODE_TCPCOPY" symbol="KNetEvt_TcpCopyIPV6" task="KERNEL_NETWORK_TASK_TCPIP" template="tid_GenericIPV6" value="34" />
          <event channel="NetEvents" keywords="KERNEL_NETWORK_KEYWORD_IPV6" level="win:Informational" message="$(string.Network.SendIPV6Udp.EventMessage)" opcode="KERNEL_NETWORK_OPCODE_SENDUDP" symbol="KNetEvt_SendIPV6Udp" task="KERNEL_NETWORK_TASK_UDPIP" template="tid_GenericIPV6" value="58" />
          <event channel="NetEvents" keywords="KERNEL_NETWORK_KEYWORD_IPV6" level="win:Informational" message="$(string.Network.RecvIPV6Udp.EventMessage)" opcode="KERNEL_NETWORK_OPCODE_RECVUDP" symbol="KNetEvt_RecvIPV6Udp" task="KERNEL_NETWORK_TASK_UDPIP" template="tid_GenericIPV6" value="59" />
        </events>
      </provider>
      <provider guid="{c7bde69a-e1e0-4177-b6ef-283ad1525271}" message="$(string.KernelDiskProviderName)" messageFileName="%SystemRoot%\system32\Microsoft-Windows-System-Events.dll" name="Microsoft-Windows-Kernel-Disk" resourceFileName="%SystemRoot%\system32\Microsoft-Windows-System-Events.dll" symbol="DiskProvGuid">
        <channels>
          <channel chid="DiskEvents" isolation="System" name="Microsoft-Windows-Kernel-Disk/Analytic" symbol="KERNEL_DISK_CHANNEL_ANALYTIC" type="Analytic">This channel contains disk read, write and flush events.</channel>
        </channels>
        <templates>
          <template tid="tid_ReadWrite">
            <data inType="win:UInt32" name="DiskNumber" outType="xs:unsignedInt" />
            <data inType="win:HexInt32" name="IrpFlags" outType="win:HexInt32" />
            <data inType="win:UInt32" name="TransferSize" outType="xs:unsignedInt" />
            <data inType="win:UInt32" name="Reserved" outType="xs:unsignedInt" />
            <data inType="win:UInt64" name="ByteOffset" outType="xs:unsignedLong" />
            <data inType="win:Pointer" name="FileObject" outType="win:HexInt64" />
            <data inType="win:Pointer" name="IORequestPacket" outType="win:HexInt64" />
            <data inType="win:UInt64" name="HighResResponseTime" outType="xs:unsignedLong" />
          </template>
          <template tid="tid_Flush">
            <data inType="win:UInt32" name="DiskNumber" outType="xs:unsignedInt" />
            <data inType="win:HexInt32" name="IrpFlags" outType="win:HexInt32" />
            <data inType="win:UInt64" name="HighResResponseTime" outType="xs:unsignedLong" />
            <data inType="win:Pointer" name="IORequestPacket" outType="win:HexInt64" />
          </template>
        </templates>
        <events>
          <event channel="DiskEvents" level="win:Informational" message="$(string.Disk.Read.EventMessage)" symbol="KDskEvt_Read" template="tid_ReadWrite" value="10" />
          <event channel="DiskEvents" level="win:Informational" message="$(string.Disk.Write.EventMessage)" symbol="KDskEvt_Write" template="tid_ReadWrite" value="11" />
          <event channel="DiskEvents" level="win:Informational" message="$(string.Disk.Flush.EventMessage)" symbol="KDskEvt_Flush" template="tid_Flush" value="14" />
        </events>
      </provider>
      <provider guid="{b675ec37-bdb6-4648-bc92-f3fdc74d3ca2}" message="$(string.ETW.ProviderName)" messageFileName="%systemroot%\system32\Microsoft-Windows-System-Events.dll" name="Microsoft-Windows-Kernel-EventTracing" resourceFileName="%systemroot%\system32\Microsoft-Windows-System-Events.dll" symbol="EventTracingProvGuid">
        <maps>
          <valueMap name="StopReasonMap">
            <map message="$(string.ETW.ReasonMap.UnsupportedAppendLoggerMode.message)" value="1" />
            <map message="$(string.ETW.ReasonMap.UnsupportedAppendOsVersion.message)" value="2" />
            <map message="$(string.ETW.ReasonMap.UnsupportedAppendPointerSize.message)" value="3" />
            <map message="$(string.ETW.ReasonMap.UnsupportedAppendBufferSize.message)" value="4" />
            <map message="$(string.ETW.ReasonMap.AppendAutologgerBufferSizeMismatch.message)" value="5" />
            <map message="$(string.ETW.ReasonMap.UnsupportedAppendPreallocateMode.message)" value="6" />
            <map message="$(string.ETW.ReasonMap.FileSizeQueryFailed.message)" value="7" />
            <map message="$(string.ETW.ReasonMap.MaxFileSizeReached.message)" value="8" />
            <map message="$(string.ETW.ReasonMap.AppendBuffersWrittenZero.message)" value="9" />
            <map message="$(string.ETW.ReasonMap.AppendProcessorCountMismatch.message)" value="10" />
          </valueMap>
        </maps>
        <events>
          <event channel="ETW_CHANNEL_ADMIN" keywords="ETW_KEYWORD_SESSION" level="win:Error" message="$(string.ETW.event.ETW_EVENT_WRITE_FAILED.message)" opcode="ETW_OPCODE_WRITE_BUFFER" symbol="ETW_EVENT_WRITE_FAILED" task="ETW_TASK_LOGGING" template="tid_ETW_TEMPLATE_ADMIN" value="0" version="0" />
          <event channel="ETW_CHANNEL_ADMIN" keywords="ETW_KEYWORD_SESSION" level="win:Warning" message="$(string.ETW.event.ETW_EVENT_BACKING_FILE_FULL.message)" opcode="ETW_OPCODE_WRITE_BUFFER" symbol="ETW_EVENT_BACKING_FILE_FULL" task="ETW_TASK_LOGGING" template="tid_ETW_TEMPLATE_BACKING" value="1" version="0" />
          <event channel="ETW_CHANNEL_ADMIN" keywords="ETW_KEYWORD_SESSION" level="win:Error" message="$(string.ETW.event.ETW_EVENT_SESSION_START_FAILED.message)" opcode="ETW_OPCODE_START" symbol="ETW_EVENT_SESSION_START_FAILED" task="ETW_TASK_SESSION" template="tid_ETW_TEMPLATE_ADMIN" value="2" version="0" />
          <event channel="ETW_CHANNEL_ADMIN" keywords="ETW_KEYWORD_SESSION" level="win:Error" message="$(string.ETW.event.ETW_EVENT_SESSION_END_FAILED.message)" notLogged="true" opcode="ETW_OPCODE_STOP" symbol="ETW_EVENT_SESSION_END_FAILED_V0" task="ETW_TASK_SESSION" template="tid_ETW_TEMPLATE_ADMIN" value="3" version="0" />
          <event channel="ETW_CHANNEL_ADMIN" keywords="ETW_KEYWORD_SESSION" level="win:Error" message="$(string.ETW.event.ETW_EVENT_SESSION_END_FAILED.message)" opcode="ETW_OPCODE_STOP" symbol="ETW_EVENT_SESSION_END_FAILED" task="ETW_TASK_SESSION" template="tid_ETW_TEMPLATE_SESSION_STOP" value="3" version="1" />
          <event channel="ETW_CHANNEL_ADMIN" keywords="ETW_KEYWORD_SESSION" level="win:Warning" message="$(string.ETW.event.ETW_EVENT_MAX_FILE_SIZE_REACHED.message)" opcode="ETW_OPCODE_WRITE_BUFFER" symbol="ETW_EVENT_MAX_FILE_SIZE_REACHED" task="ETW_TASK_LOGGING" template="tid_ETW_TEMPLATE_MAX_FILE_SIZE" value="4" version="0" />
          <event channel="ETW_CHANNEL_ADMIN" keywords="ETW_KEYWORD_SESSION" level="win:Error" message="$(string.ETW.event.ETW_EVENT_SWITCH_TO_NEW_FILE_FAILED.message)" opcode="ETW_OPCODE_FILE_SWITCH" symbol="ETW_EVENT_SWITCH_TO_NEW_FILE_FAILED" task="ETW_TASK_LOGGING" template="tid_ETW_TEMPLATE_ADMIN" value="5" version="0" />
          <event channel="ETW_CHANNEL_ANALYTIC" keywords="ETW_KEYWORD_PROVIDER" level="win:Verbose" message="$(string.ETW.event.ETW_EVENT_PROVIDER_REGISTER.message)" opcode="ETW_OPCODE_REGISTER" symbol="ETW_EVENT_PROVIDER_REGISTER" task="ETW_TASK_PROVIDER" template="tid_ETW_TEMPLATE_PROVIDER" value="8" version="0" />
          <event channel="ETW_CHANNEL_ANALYTIC" keywords="ETW_KEYWORD_PROVIDER" level="win:Verbose" message="$(string.ETW.event.ETW_EVENT_PROVIDER_UNREGISTERS.message)" opcode="ETW_OPCODE_UNREGISTER" symbol="ETW_EVENT_PROVIDER_UNREGISTERS" task="ETW_TASK_PROVIDER" template="tid_ETW_TEMPLATE_PROVIDER" value="9" version="0" />
          <event channel="ETW_CHANNEL_ANALYTIC" keywords="ETW_KEYWORD_SESSION" level="win:Verbose" message="$(string.ETW.event.ETW_EVENT_START_TRACE.message)" notLogged="true" opcode="ETW_OPCODE_START" symbol="ETW_EVENT_START_TRACE_V0" task="ETW_TASK_SESSION" template="tid_ETW_TEMPLATE_SESSION" value="10" version="0" />
          <event channel="ETW_CHANNEL_ANALYTIC" keywords="ETW_KEYWORD_SESSION" level="win:Verbose" message="$(string.ETW.event.ETW_EVENT_START_TRACE.message)" opcode="ETW_OPCODE_START" symbol="ETW_EVENT_START_TRACE" task="ETW_TASK_SESSION" template="tid_ETW_TEMPLATE_SESSION_INFO" value="10" version="1" />
          <event channel="ETW_CHANNEL_ANALYTIC" keywords="ETW_KEYWORD_SESSION" level="win:Verbose" message="$(string.ETW.event.ETW_EVENT_STOP_TRACE.message)" notLogged="true" opcode="ETW_OPCODE_STOP" symbol="ETW_EVENT_STOP_TRACE_V0" task="ETW_TASK_SESSION" template="tid_ETW_TEMPLATE_SESSION" value="11" version="0" />
          <event channel="ETW_CHANNEL_ANALYTIC" keywords="ETW_KEYWORD_SESSION" level="win:Verbose" message="$(string.ETW.event.ETW_EVENT_STOP_TRACE.message)" opcode="ETW_OPCODE_STOP" symbol="ETW_EVENT_STOP_TRACE" task="ETW_TASK_SESSION" template="tid_ETW_TEMPLATE_SESSION_INFO" value="11" version="1" />
          <event channel="ETW_CHANNEL_ANALYTIC" keywords="ETW_KEYWORD_SESSION" level="win:Verbose" message="$(string.ETW.event.ETW_EVENT_UPDATE_TRACE.message)" opcode="ETW_OPCODE_CONFIGURE" symbol="ETW_EVENT_UPDATE_TRACE" task="ETW_TASK_SESSION" template="tid_ETW_TEMPLATE_SESSION" value="12" version="0" />
          <event channel="ETW_CHANNEL_ANALYTIC" keywords="ETW_KEYWORD_SESSION" level="win:Verbose" message="$(string.ETW.event.ETW_EVENT_FLUSH_TRACE.message)" opcode="ETW_OPCODE_FLUSH" symbol="ETW_EVENT_FLUSH_TRACE" task="ETW_TASK_SESSION" template="tid_ETW_TEMPLATE_SESSION" value="13" version="0" />
          <event channel="ETW_CHANNEL_ANALYTIC" keywords="ETW_KEYWORD_PROVIDER" level="win:Verbose" message="$(string.ETW.event.ETW_EVENT_PROVIDER_ENABLED.message)" opcode="ETW_OPCODE_ENABLE" symbol="ETW_EVENT_PROVIDER_ENABLED" task="ETW_TASK_PROVIDER" template="tid_ETW_TEMPLATE_PROVIDER_SESSION" value="14" version="0" />
          <event channel="ETW_CHANNEL_ANALYTIC" keywords="ETW_KEYWORD_PROVIDER" level="win:Verbose" message="$(string.ETW.event.ETW_EVENT_PROVIDER_DISABLED.message)" opcode="ETW_OPCODE_DISABLE" symbol="ETW_EVENT_PROVIDER_DISABLED" task="ETW_TASK_PROVIDER" template="tid_ETW_TEMPLATE_PROVIDER_SESSION" value="15" version="0" />
          <event channel="ETW_CHANNEL_ANALYTIC" keywords="ETW_KEYWORD_SESSION" level="win:Verbose" message="$(string.ETW.event.ETW_EVENT_CHANGE_SESSION_SD.message)" opcode="ETW_OPCODE_CONFIGURE" symbol="ETW_EVENT_CHANGE_SESSION_SD" task="ETW_TASK_SESSION" template="tid_ETW_TEMPLATE_SESSION" value="17" version="0" />
          <event level="win:Informational" message="$(string.ETW.event.ETW_EVENT_USER_MODE_STACK_TRACE.message)" opcode="ETW_OPCODE_USER_MODE_STACK_TRACE" symbol="ETW_EVENT_USER_STACK_TRACE" task="ETW_TASK_STACK_TRACE" value="18" version="0" />
          <event keywords="ETW_KEYWORD_LOST_EVENT" level="win:Error" opcode="win:Info" symbol="ETW_EVENT_LOST_EVENT" task="ETW_TASK_LOST_EVENT" template="tid_ETW_TEMPLATE_EVENT_LOST" value="19" version="0" />
          <event keywords="ETW_KEYWORD_SESSION" level="win:Verbose" opcode="win:Info" symbol="ETW_EVENT_SESSION_INFO" task="ETW_TASK_SESSION" template="tid_ETW_TEMPLATE_SESSION_INFO" value="20" version="0" />
        </events>
        <channels>
          <channel chid="ETW_CHANNEL_ADMIN" enabled="true" isolation="System" message="$(string.ETW.channel.admin.message)" name="Microsoft-Windows-Kernel-EventTracing/Admin" symbol="ETW_CHANNEL_ADMIN" type="Admin" />
          <channel chid="ETW_CHANNEL_ANALYTIC" enabled="false" isolation="System" message="$(string.ETW.channel.analytic.message)" name="Microsoft-Windows-Kernel-EventTracing/Analytic" symbol="ETW_CHANNEL_ANALYTIC" type="Analytic" />
        </channels>
        <tasks>
          <task message="$(string.ETW.task.ETW_TASK_LOGGING.message)" name="ETW_TASK_LOGGING" symbol="ETW_TASK_LOGGING" value="1" />
          <task message="$(string.ETW.task.ETW_TASK_SESSION.message)" name="ETW_TASK_SESSION" symbol="ETW_TASK_SESSION" value="2" />
          <task message="$(string.ETW.task.ETW_TASK_PROVIDER.message)" name="ETW_TASK_PROVIDER" symbol="ETW_TASK_PROVIDER" value="3" />
          <task message="$(string.ETW.task.ETW_TASK_STACK_TRACE.message)" name="ETW_TASK_STACK_TRACE" symbol="ETW_TASK_STACK_TRACE" value="6" />
          <task message="$(string.ETW.task.ETW_TASK_LOST_EVENT.message)" name="ETW_TASK_LOST_EVENT" symbol="ETW_TASK_LOST_EVENT" value="7" />
        </tasks>
        <opcodes>
          <opcode message="$(string.ETW.opcode.ETW_OPCODE_WRITE_BUFFER.message)" name="ETW_OPCODE_WRITE_BUFFER" symbol="ETW_OPCODE_WRITE_BUFFER" value="10" />
          <opcode message="$(string.ETW.opcode.ETW_OPCODE_FILE_SWITCH.message)" name="ETW_OPCODE_FILE_SWITCH" symbol="ETW_OPCODE_FILE_SWITCH" value="11" />
          <opcode message="$(string.ETW.opcode.ETW_OPCODE_START.message)" name="ETW_OPCODE_START" symbol="ETW_OPCODE_START" value="12" />
          <opcode message="$(string.ETW.opcode.ETW_OPCODE_STOP.message)" name="ETW_OPCODE_STOP" symbol="ETW_OPCODE_STOP" value="14" />
          <opcode message="$(string.ETW.opcode.ETW_OPCODE_FLUSH.message)" name="ETW_OPCODE_FLUSH" symbol="ETW_OPCODE_FLUSH" value="15" />
          <opcode message="$(string.ETW.opcode.ETW_OPCODE_REGISTER.message)" name="ETW_OPCODE_REGISTER" symbol="ETW_OPCODE_REGISTER" value="16" />
          <opcode message="$(string.ETW.opcode.ETW_OPCODE_UNREGISTER.message)" name="ETW_OPCODE_UNREGISTER" symbol="ETW_OPCODE_UNREGISTER" value="17" />
          <opcode message="$(string.ETW.opcode.ETW_OPCODE_ENABLE.message)" name="ETW_OPCODE_ENABLE" symbol="ETW_OPCODE_ENABLE" value="18" />
          <opcode message="$(string.ETW.opcode.ETW_OPCODE_DISABLE.message)" name="ETW_OPCODE_DISABLE" symbol="ETW_OPCODE_DISABLE" value="19" />
          <opcode message="$(string.ETW.opcode.ETW_OPCODE_CONFIGURE.message)" name="ETW_OPCODE_CONFIGURE" symbol="ETW_OPCODE_CONFIGURE" value="20" />
          <opcode message="$(string.ETW.opcode.ETW_OPCODE_USER_MODE_STACK_TRACE.message)" name="ETW_OPCODE_USER_MODE_STACK_TRACE" symbol="ETW_OPCODE_USER_MODE_STACK_TRACE" value="24" />
        </opcodes>
        <keywords>
          <keyword mask="0x10" message="$(string.ETW.keyword.EVENT_TRACING_KEYWORD_SESSION.message)" name="ETW_KEYWORD_SESSION" symbol="EVENT_TRACING_KEYWORD_SESSION" />
          <keyword mask="0x20" message="$(string.ETW.keyword.EVENT_TRACING_KEYWORD_PROVIDER.message)" name="ETW_KEYWORD_PROVIDER" symbol="EVENT_TRACING_KEYWORD_PROVIDER" />
          <keyword mask="0x40" message="$(string.ETW.keyword.EVENT_TRACING_KEYWORD_LOST_EVENT.message)" name="ETW_KEYWORD_LOST_EVENT" symbol="EVENT_TRACING_KEYWORD_LOST_EVENT" />
        </keywords>
        <templates>
          <template tid="tid_ETW_TEMPLATE_ADMIN">
            <data inType="win:UnicodeString" name="SessionName" outType="xs:string" />
            <data inType="win:UnicodeString" name="FileName" outType="xs:string" />
            <data inType="win:UInt32" name="ErrorCode" outType="win:HexInt32" />
            <data inType="win:UInt32" name="LoggingMode" outType="win:HexInt32" />
          </template>
          <template tid="tid_ETW_TEMPLATE_SESSION_STOP">
            <data inType="win:UnicodeString" name="SessionName" outType="xs:string" />
            <data inType="win:UnicodeString" name="FileName" outType="xs:string" />
            <data inType="win:UInt32" name="ErrorCode" outType="win:HexInt32" />
            <data inType="win:UInt32" name="LoggingMode" outType="win:HexInt32" />
            <data inType="win:UInt32" map="StopReasonMap" name="FailureReason" />
          </template>
          <template tid="tid_ETW_TEMPLATE_MAX_FILE_SIZE">
            <data inType="win:UnicodeString" name="SessionName" outType="xs:string" />
            <data inType="win:UnicodeString" name="FileName" outType="xs:string" />
            <data inType="win:UInt32" name="ErrorCode" outType="win:HexInt32" />
            <data inType="win:UInt32" name="LoggingMode" outType="win:HexInt32" />
            <data inType="win:UInt64" name="MaxFileSize" outType="xs:unsignedLong" />
          </template>
          <template tid="tid_ETW_TEMPLATE_BACKING">
            <data inType="win:UnicodeString" name="SessionName" outType="xs:string" />
            <data inType="win:UInt32" name="ErrorCode" outType="win:HexInt32" />
            <data inType="win:UInt32" name="LoggingMode" outType="win:HexInt32" />
          </template>
          <template tid="tid_ETW_TEMPLATE_PROVIDER_SESSION">
            <data inType="win:GUID" name="ProviderName" outType="xs:GUID" />
            <data inType="win:UnicodeString" name="SessionName" outType="xs:string" />
          </template>
          <template tid="tid_ETW_TEMPLATE_PROVIDER">
            <data inType="win:GUID" name="ProviderName" outType="xs:GUID" />
          </template>
          <template tid="tid_ETW_TEMPLATE_SESSION">
            <data inType="win:GUID" name="SessionGuid" outType="xs:GUID" />
            <data inType="win:UInt32" name="LoggerMode" outType="win:HexInt32" />
            <data inType="win:UnicodeString" name="SessionName" outType="xs:string" />
            <data inType="win:UnicodeString" name="LogFileName" outType="xs:string" />
          </template>
          <template tid="tid_ETW_TEMPLATE_SESSION_INFO">
            <data inType="win:GUID" name="SessionGuid" outType="xs:GUID" />
            <data inType="win:UInt32" name="LoggerMode" outType="win:HexInt32" />
            <data inType="win:UnicodeString" name="SessionName" outType="xs:string" />
            <data inType="win:UnicodeString" name="LogFileName" outType="xs:string" />
            <data inType="win:UInt32" name="MinimumBuffers" outType="win:HexInt32" />
            <data inType="win:UInt32" name="MaximumBuffers" outType="win:HexInt32" />
            <data inType="win:UInt32" name="BufferSize" outType="win:HexInt32" />
            <data inType="win:UInt32" name="PeakBuffersCount" outType="win:HexInt32" />
            <data inType="win:UInt32" name="CurrentBuffersCount" outType="win:HexInt32" />
            <data inType="win:UInt32" name="FlushThreshold" outType="win:HexInt32" />
          </template>
          <template tid="tid_ETW_TEMPLATE_SESSION_SD">
            <data inType="win:UnicodeString" name="SessionName" outType="xs:string" />
            <data inType="win:UnicodeString" name="SecurityDescOld" outType="xs:string" />
            <data inType="win:UnicodeString" name="SecurityDescNew" outType="xs:string" />
          </template>
          <template tid="tid_ETW_TEMPLATE_EVENT_LOST">
            <data inType="win:GUID" name="ProviderId" outType="xs:GUID" />
            <data inType="win:UInt32" name="StatusCode" outType="win:HexInt32" />
            <data inType="win:UInt16" name="EventId" />
            <data inType="win:UnicodeString" name="SessionName" outType="xs:string" />
          </template>
        </templates>
      </provider>
      <provider guid="{15CA44FF-4D7A-4BAA-BBA5-0998955E531E}" message="$(string.BootEnv.ProviderName)" messageFileName="%SystemRoot%\system32\Microsoft-Windows-System-Events.dll" name="Microsoft-Windows-Kernel-Boot" resourceFileName="%SystemRoot%\system32\Microsoft-Windows-System-Events.dll" symbol="BOOTENV_ETW_PROVIDER">
        <channels>
          <importChannel chid="BootSystem" name="System" />
          <channel chid="BootEvents" name="Microsoft-Windows-Kernel-Boot/Analytic" symbol="BOOT_ENVIRONMENT_CHANNEL_ANALYTIC" type="Analytic" />
          <channel chid="BootMessages" enabled="true" isolation="System" name="Microsoft-Windows-Kernel-Boot/Operational" symbol="BOOT_ENVIRONMENT_CHANNEL_OPERATIONAL" type="Operational" />
        </channels>
        <tasks>
          <task name="InitializeLibrary" value="1" />
          <task name="PrepareTarget" value="2" />
          <task name="RebuildKernelMemoryMap" value="3" />
          <task name="FatalError" value="4" />
          <task name="PersistMemory" value="5" />
          <task name="ClaimPersistedMemory" value="6" />
          <task name="FreePersistedMemory" value="7" />
          <task name="CleanupPageDatabase" value="8" />
          <task name="CancelBoot" value="9" />
          <task name="AttachPersistentPageDatabase" value="10" />
          <task name="MemoryBlockRundown" value="11" />
          <task name="BuildKernelMemoryMap" value="12" />
          <task name="GetMemoryMap" value="13" />
          <task name="AllocatePhysicalPagesForMdl" value="14" />
        </tasks>
        <keywords>
          <keyword mask="0x00000001" name="SoftRestart" />
          <keyword mask="0x00000002" name="MemoryPreservation" />
          <keyword mask="0x00000004" name="MemoryBlockRundown" />
          <keyword mask="0x00000008" name="PhysicalMemory" />
        </keywords>
        <templates>
          <template tid="SqmStreamRow">
            <data inType="win:UInt32" name="SqmType" outType="xs:unsignedInt" />
            <data inType="win:GUID" name="SqmSessionGuid" outType="xs:GUID" />
            <data inType="win:UInt32" name="SqmID" outType="xs:unsignedInt" />
            <data inType="win:UInt32" name="SqmStreamRowLength" outType="xs:unsignedInt" />
            <struct count="SqmStreamRowLength" name="SqmStreamRow">
              <data inType="win:UInt32" name="SqmTypeEntry" outType="xs:unsignedInt" />
              <data inType="win:UInt32" name="SqmDWORDEntry" outType="xs:unsignedInt" />
              <data inType="win:UnicodeString" name="SqmStringEntry" outType="xs:string" />
            </struct>
          </template>
          <template tid="tidResolution">
            <data inType="win:UInt32" name="Width" outType="xs:unsignedInt" />
            <data inType="win:UInt32" name="Height" outType="xs:unsignedInt" />
            <data inType="win:UInt32" name="BitsPerPixel" outType="xs:unsignedInt" />
          </template>
          <template tid="tidBltRate">
            <data inType="win:UInt32" name="BytesPerMs" outType="xs:unsignedInt" />
          </template>
          <template tid="tidBootFileAccess">
            <data inType="win:UInt32" name="DeviceID" outType="xs:HexInt32" />
            <data inType="win:UnicodeString" name="FileName" outType="xs:string" />
            <data inType="win:UInt64" name="BytesRead" outType="xs:unsignedLong" />
            <data inType="win:UInt64" name="BytesWritten" outType="xs:unsignedLong" />
          </template>
          <template tid="tidTotalIO">
            <data inType="win:GUID" name="ApplicationGuid" outType="xs:GUID" />
            <data inType="win:UInt64" name="BytesRead" outType="xs:unsignedLong" />
            <data inType="win:UInt64" name="BytesWritten" outType="xs:unsignedLong" />
          </template>
          <template tid="tidImageCheck">
            <data inType="win:UnicodeString" name="ImageName" outType="xs:string" />
            <data inType="win:UInt32" name="ImageFlags" outType="xs:HexInt32" />
            <data inType="win:UInt32" name="Reason" outType="xs:HexInt32" />
            <data inType="win:UInt32" name="ErrorIgnored" outType="xs:HexInt32" />
          </template>
          <template tid="tidBootmgrTime">
            <data inType="win:UInt64" name="BootmgrTime" outType="xs:unsignedLong" />
          </template>
          <template tid="tidImageHashCheck">
            <data inType="win:UnicodeString" name="ImageName" outType="xs:string" />
          </template>
          <template tid="tidNonexistentDisk">
            <data inType="win:UInt32" name="DriveNumber" outType="xs:HexInt32" />
          </template>
          <template tid="tidBadMemoryUsedByFirmware">
            <data inType="win:UInt64" name="FwStartPage" outType="xs:HexInt64" />
            <data inType="win:UInt64" name="FwPageCount" outType="xs:HexInt64" />
            <data inType="win:UInt32" name="FwMemoryType" outType="xs:HexInt32" />
            <data inType="win:UInt32" name="FwMemoryAttributes" outType="xs:HexInt32" />
            <data inType="win:UInt64" name="BlStartPage" outType="xs:HexInt64" />
            <data inType="win:UInt64" name="BlPageCount" outType="xs:HexInt64" />
            <data inType="win:UInt32" name="BlMemoryType" outType="xs:HexInt32" />
            <data inType="win:UInt32" name="BlMemoryAttributes" outType="xs:HexInt32" />
          </template>
          <template tid="tidPreBootTime">
            <data inType="win:UInt64" name="PreBootMgrTime" outType="xs:unsignedLong" />
          </template>
          <template tid="tidSecureBootVariableUsage">
            <data inType="win:UnicodeString" name="UefiVariableName" outType="xs:string" />
            <data inType="win:UInt32" name="Size" outType="xs:HexInt32" />
            <data inType="win:UInt32" name="Status" outType="xs:HexInt32" />
          </template>
          <template tid="tidSecureBootBcdPolicyViolation">
            <data inType="win:GUID" name="ApplicationGuid" outType="xs:GUID" />
            <data inType="win:UInt32" name="Element" outType="xs:HexInt32" />
          </template>
          <template tid="tidSecureBootPolicyUpdate">
            <data inType="win:UInt32" name="Status" outType="xs:HexInt32" />
          </template>
          <template tid="tidSecureBootRevocationUpdate">
            <data inType="win:UInt32" name="Status" outType="xs:HexInt32" />
          </template>
          <template tid="tidResumeFailure">
            <data inType="win:UInt64" name="FailureStatus" outType="win:HexInt64" />
            <data inType="win:UInt64" name="FailureMsgId" outType="win:HexInt64" />
          </template>
          <template tid="tidBootmgrMultiOsMenuDisplayed" />
          <template tid="tidBootmgrMultiOsCount">
            <data inType="win:UInt32" name="EntryCount" outType="xs:HexInt32" />
          </template>
          <template tid="tidBootmgrMultiOsToolsCount">
            <data inType="win:UInt32" name="ToolsCount" outType="xs:HexInt32" />
          </template>
          <template tid="tidDirtyBootShutdown">
            <data inType="win:Boolean" name="LastShutdownGood" />
            <data inType="win:Boolean" name="LastBootGood" />
          </template>
          <template tid="tidBootAdvancedOptionsMenuInformation">
            <data inType="win:UInt32" name="OptionSelected" outType="xs:HexInt32" />
          </template>
          <template tid="tidBootEditOptionsMenuInformation" />
          <template tid="tidBootWindowsKeyPressed" />
          <template tid="tidBootF8KeyPressed" />
          <template tid="tidBootMenuPolicy">
            <data inType="win:UInt32" name="BootMenuPolicy" outType="xs:HexInt32" />
          </template>
          <template tid="tidBootSequence" />
          <template tid="tidBootType">
            <data inType="win:UInt32" name="BootType" outType="xs:HexInt32" />
          </template>
          <template tid="tidFwBootPerfData">
            <data inType="win:UInt64" name="ResetEndStart" outType="xs:unsignedLong" />
            <data inType="win:UInt64" name="LoadOSImageStart" outType="xs:unsignedLong" />
            <data inType="win:UInt64" name="StartOSImageStart" outType="xs:unsignedLong" />
            <data inType="win:UInt64" name="ExitBootServicesEntry" outType="xs:unsignedLong" />
            <data inType="win:UInt64" name="ExitBootServicesExit" outType="xs:unsignedLong" />
          </template>
          <template tid="tidFwCryptoHashProvider">
            <data inType="win:UInt32" name="Status" outType="xs:HexInt32" />
          </template>
          <template tid="tidBootUserInputTime">
            <data inType="win:UInt64" name="BitlockerUserInputTime" outType="xs:unsignedLong" />
          </template>
          <template tid="tidFwUpdateImageLoadFailure">
            <data inType="win:UnicodeString" name="ImageName" outType="xs:string" />
            <data inType="win:UInt32" name="ImageLoadStatus" outType="xs:HexInt32" />
          </template>
          <template tid="tidFwUpdatePeImageLoadFailure">
            <data inType="win:UnicodeString" name="PeImageName" outType="xs:string" />
            <data inType="win:UInt32" name="PeImageLoadStatus" outType="xs:HexInt32" />
          </template>
          <template tid="tidFwUpdateUpdateCapsuleFailure">
            <data inType="win:UInt32" name="UpdateCapsuleStatus" outType="xs:HexInt32" />
          </template>
          <template tid="tidFwUpdateBitlockerCheckStatus">
            <data inType="win:UInt32" name="DeviceFlags" outType="xs:HexInt32" />
            <data inType="win:UInt32" name="PcrBitmap" outType="xs:HexInt32" />
            <data inType="win:UInt32" name="UpdateSupportedStatus" outType="xs:HexInt32" />
          </template>
          <template tid="tidFwUpdateCodeIntegrityFailure">
            <data inType="win:UnicodeString" name="ImageName" outType="xs:string" />
            <data inType="win:UInt32" name="ImageLoadStatus" outType="xs:HexInt32" />
          </template>
          <template tid="tidBootImageLoadFailure">
            <data inType="win:UnicodeString" name="ImageName" outType="xs:string" />
            <data inType="win:UInt32" name="ImageLoadStatus" outType="xs:HexInt32" />
          </template>
          <template tid="tidBootSiPolicyFailure">
            <data inType="win:UnicodeString" name="ImageName" outType="xs:string" />
            <data inType="win:UInt32" name="SiPolicyStatus" outType="xs:HexInt32" />
          </template>
          <template tid="tidBootHiveLoadFailure">
            <data inType="win:UnicodeString" name="HiveName" outType="xs:string" />
            <data inType="win:UInt32" name="HiveLoadStatus" outType="xs:HexInt32" />
          </template>
          <template tid="tidBootAcpiFailure">
            <data inType="win:UInt32" name="Status" outType="xs:HexInt32" />
          </template>
          <template tid="tidBootGeneralFailure">
            <data inType="win:UInt32" name="Status" outType="xs:HexInt32" />
          </template>
          <template tid="tidBootLoadImportImageFailure">
            <data inType="win:UnicodeString" name="Path" outType="xs:string" />
            <data inType="win:UnicodeString" name="FailedPath" outType="xs:string" />
            <data inType="win:UInt32" name="Status" outType="xs:HexInt32" />
          </template>
          <template tid="tidBootLoadImportFailure">
            <data inType="win:UnicodeString" name="Path" outType="xs:string" />
            <data inType="win:AnsiString" name="Import" outType="xs:string" />
            <data inType="win:UInt32" name="Status" outType="xs:HexInt32" />
          </template>
          <template tid="tidVsmIdkProvisioningResults">
            <data inType="win:UInt32" name="CachedCopyStatus" outType="xs:HexInt32" />
            <data inType="win:UInt32" name="IdkGenerationStatus" outType="xs:HexInt32" />
            <data inType="win:UInt32" name="MeasuringStatus" outType="xs:HexInt32" />
            <data inType="win:UInt32" name="SealingAndCachingStatus" outType="xs:HexInt32" />
          </template>
          <template tid="tidVsmLKeyProvisioningResults">
            <data inType="win:UInt32" name="CachedCopyStatus" outType="xs:HexInt32" />
            <data inType="win:UInt32" name="UnsealingCachedCopyStatus" outType="xs:HexInt32" />
            <data inType="win:UInt32" name="LKeyGenerationStatus" outType="xs:HexInt32" />
            <data inType="win:UInt32" name="SealingStatus" outType="xs:HexInt32" />
            <data inType="win:UInt32" name="TpmPcrMask" outType="xs:HexInt32" />
          </template>
          <template tid="tidRetrieveDriverListTime">
            <data inType="win:UInt64" name="RetrieveDriverListTime" outType="xs:unsignedLong" />
          </template>
          <template tid="tidLoadDriversTime">
            <data inType="win:UInt64" name="LoadDriversTime" outType="xs:unsignedLong" />
          </template>
          <template tid="tidLoadHiveTime">
            <data inType="win:UnicodeString" name="Path" outType="xs:string" />
            <data inType="win:UInt64" name="LoadHiveTime" outType="xs:unsignedLong" />
          </template>
          <template tid="tidApplicationLoadTime">
            <data inType="win:GUID" name="ApplicationIdentifier" outType="xs:GUID" />
            <data inType="win:UInt64" name="ApplicationLoadTime" outType="xs:unsignedLong" />
          </template>
          <template tid="tidApplicationExecutionTime">
            <data inType="win:GUID" name="ApplicationIdentifier" outType="xs:GUID" />
            <data inType="win:UInt64" name="ApplicationExecutionTime" outType="xs:unsignedLong" />
          </template>
          <template tid="tidBuildChunkTableFailure">
            <data inType="win:UInt32" name="Status" outType="win:NTSTATUS" />
            <data inType="win:UnicodeString" name="FileName" outType="xs:string" />
          </template>
          <template tid="tidPrepareTargetFailure">
            <data inType="win:UInt32" name="Status" outType="win:NTSTATUS" />
            <data inType="win:UInt32" name="FailurePoint" outType="xs:unsignedInt" />
          </template>
          <template tid="tidNtStatus">
            <data inType="win:UInt32" name="Status" outType="win:NTSTATUS" />
          </template>
          <template tid="tidRebuildKernelMemoryMapStart">
            <data inType="win:UInt32" name="ReserveDescriptors" outType="xs:unsignedInt" />
          </template>
          <template tid="tidPersistMemoryStart">
            <data inType="win:GUID" name="ApplicationId" outType="xs:GUID" />
            <data inType="win:UInt32" name="RunCount" outType="xs:unsignedInt" />
            <data inType="win:UInt64" name="PageCount" outType="xs:unsignedLong" />
          </template>
          <template tid="tidPersistMemoryStop">
            <data inType="win:UInt32" name="Status" outType="win:NTSTATUS" />
            <data inType="win:UInt64" name="BlockId" outType="win:HexInt64" />
          </template>
          <template tid="tidCleanupPageDatabaseStart">
            <data inType="win:Boolean" name="FreePersistentPages" />
          </template>
          <template tid="tidFreePersistedMemoryStart">
            <data inType="win:GUID" name="ApplicationId" outType="xs:GUID" />
            <data inType="win:Boolean" name="FreePersistentPages" />
          </template>
          <template tid="tidClaimPersistedMemoryStart">
            <data inType="win:GUID" name="ApplicationId" outType="xs:GUID" />
            <data inType="win:UInt64" name="BlockId" outType="xs:unsignedLong" />
            <data inType="win:UInt32" name="Flags" outType="win:HexInt32" />
          </template>
          <template tid="tidClaimPersistedMemoryStop">
            <data inType="win:UInt32" name="Status" outType="win:NTSTATUS" />
            <data inType="win:UInt32" name="RunsClaimed" outType="xs:unsignedInt" />
            <data inType="win:UInt64" name="PageCount" outType="xs:unsignedLong" />
          </template>
          <template tid="tidCancelBootStart">
            <data inType="win:Boolean" name="FreePersistentPages" />
          </template>
          <template tid="tidMemoryBlockRundown">
            <data inType="win:GUID" name="ApplicationId" outType="xs:GUID" />
            <data inType="win:UInt64" name="BlockId" outType="xs:unsignedLong" />
          </template>
          <template tid="tidGetMemoryMapStart">
            <data inType="win:UInt32" name="Type" outType="win:HexInt32" />
            <data inType="win:UInt32" name="Flags" outType="xs:unsignedInt" />
            <data inType="win:UInt32" name="BufferSize" outType="xs:unsignedInt" />
          </template>
          <template tid="tidGetMemoryMapStop">
            <data inType="win:UInt32" name="Status" outType="win:NTSTATUS" />
            <data inType="win:UInt32" name="DataSize" outType="xs:unsignedInt" />
            <data inType="win:UInt32" name="BufferSize" outType="xs:unsignedInt" />
          </template>
          <template tid="tidVsmPolicyFailure">
            <data inType="win:UInt8" name="Phase" />
            <data inType="win:UInt32" name="Status" outType="win:NTSTATUS" />
          </template>
          <template tid="tidAllocatePhysicalPagesForMdlStart">
            <data inType="win:UInt64" name="LowAddress" outType="win:HexInt64" />
            <data inType="win:UInt64" name="HighAddress" outType="win:HexInt64" />
            <data inType="win:UInt64" name="SkipBytes" outType="win:HexInt64" />
            <data inType="win:UInt64" name="TotalBytes" outType="xs:unsignedLong" />
            <data inType="win:UInt32" name="CacheType" outType="win:HexInt32" />
            <data inType="win:UInt32" name="Flags" outType="win:HexInt32" />
          </template>
          <template tid="tidAllocatePhysicalPagesForMdlStop">
            <data inType="win:Pointer" name="Mdl" outType="win:HexInt64" />
          </template>
        </templates>
        <events>
          <event channel="BootEvents" level="win:Informational" message="$(string.BootEnv.BootFirmwareResolution)" symbol="BOOT_ENVIRONMENT_FIRMWARE_RESOLUTION" template="tidResolution" value="1" />
          <event channel="BootEvents" level="win:Informational" message="$(string.BootEnv.BootOsResolution)" symbol="BOOT_ENVIRONMENT_OS_RESOLUTION" template="tidResolution" value="2" />
          <event channel="BootEvents" level="win:Informational" message="$(string.BootEnv.BootBitTransferRate)" symbol="BOOT_ENVIRONMENT_BLT_RATE" template="tidBltRate" value="3" />
          <event channel="BootEvents" level="win:Informational" message="$(string.BootEnv.BootFileAccess)" symbol="BOOT_FILE_ACCESS" template="tidBootFileAccess" value="4" />
          <event channel="BootEvents" keywords="ms:Telemetry" level="win:Informational" message="$(string.BootEnv.BootTotalIO)" symbol="BOOT_TOTAL_IO" template="tidTotalIO" value="5" />
          <event channel="BootEvents" keywords="ms:Telemetry" level="win:Error" message="$(string.BootEnv.BootImageIntegrityCheck)" symbol="BOOT_IMAGE_INTEGRITY_CHECK" template="tidImageCheck" value="6" />
          <event channel="BootEvents" keywords="ms:Telemetry" level="win:Informational" message="$(string.BootEnv.BootmgrTime)" symbol="BOOT_BOOTMGR_TIME" template="tidBootmgrTime" value="7" />
          <event channel="BootEvents" keywords="ms:Telemetry" level="win:Warning" message="$(string.BootEnv.BootImageHashCheck)" symbol="BOOT_IMAGE_HASH_CHECK" template="tidImageHashCheck" value="8" />
          <event channel="BootEvents" keywords="ms:Telemetry" level="win:Warning" message="$(string.BootEnv.BootNonexistentDisk)" symbol="BOOT_NONEXISTENT_DISK" template="tidNonexistentDisk" value="9" />
          <event channel="BootSystem" keywords="ms:Telemetry" level="win:Error" message="$(string.BootEnv.BootBadMemoryUsedByFirmware)" symbol="BOOT_BAD_MEMORY_USED_BY_FIRMWARE" template="tidBadMemoryUsedByFirmware" value="10" />
          <event channel="BootEvents" level="win:Informational" message="$(string.BootEnv.PreBootTime)" symbol="BOOT_PRE_BOOT_TIME" template="tidPreBootTime" value="11" />
          <event channel="BootEvents" level="win:Informational" message="$(string.BootEnv.SecureBootVariableUsage)" symbol="BOOT_PRE_SECURE_BOOT_VARIABLE_USAGE" template="tidSecureBootVariableUsage" value="12" />
          <event channel="BootEvents" keywords="ms:Telemetry" level="win:Warning" message="$(string.BootEnv.SecureBootBcdPolicyViolation)" symbol="BOOT_PRE_SECURE_BOOT_BCD_POLICY_VIOLATION" template="tidSecureBootBcdPolicyViolation" value="13" />
          <event channel="BootEvents" level="win:Informational" message="$(string.BootEnv.SecureBootPolicyUpdate)" symbol="BOOT_PRE_SECURE_BOOT_POLICY_UPDATE" template="tidSecureBootPolicyUpdate" value="14" />
          <event channel="BootEvents" level="win:Informational" message="$(string.BootEnv.SecureBootRevocationUpdate)" symbol="BOOT_PRE_SECURE_BOOT_REVOCATION_UPDATE" template="tidSecureBootRevocationUpdate" value="15" />
          <event channel="BootSystem" level="win:Error" message="$(string.BootEnv.BootResumeFailure)" symbol="BOOT_RESUME_FAILURE" template="tidResumeFailure" value="16" />
          <event channel="BootSystem" level="win:Informational" message="$(string.BootEnv.BootBootmgrMultiOsMenuDisplayed)" symbol="BOOT_BOOTMGR_MULTI_OS_MENU_DISPLAYED" template="tidBootmgrMultiOsMenuDisplayed" value="17" />
          <event channel="BootSystem" level="win:Informational" message="$(string.BootEnv.BootBootmgrMultiOsCount)" symbol="BOOT_BOOTMGR_MULTI_OS_COUNT" template="tidBootmgrMultiOsCount" value="18" />
          <event channel="BootSystem" level="win:Informational" message="$(string.BootEnv.BootBootmgrMultiOsToolsCount)" symbol="BOOT_BOOTMGR_MULTI_OS_TOOLS_COUNT" template="tidBootmgrMultiOsToolsCount" value="19" />
          <event channel="BootSystem" level="win:Informational" message="$(string.BootEnv.BootDirtyBootShutdown)" symbol="BOOT_DIRTY_BOOT_SHUTDOWN" template="tidDirtyBootShutdown" value="20" />
          <event channel="BootSystem" level="win:Informational" message="$(string.BootEnv.BootAdvancedOptionsMenuInformation)" symbol="BOOT_ADVANCED_OPTIONS_MENU_INFORMATION" template="tidBootAdvancedOptionsMenuInformation" value="21" />
          <event channel="BootSystem" level="win:Informational" message="$(string.BootEnv.BootEditOptionsMenuInformation)" symbol="BOOT_EDIT_OPTIONS_MENU_INFORMATION" template="tidBootEditOptionsMenuInformation" value="22" />
          <event channel="BootSystem" level="win:Informational" message="$(string.BootEnv.BootWindowsKeyPressed)" symbol="BOOT_WINDOWS_KEY_PRESSED" template="tidBootWindowsKeyPressed" value="23" />
          <event channel="BootSystem" level="win:Informational" message="$(string.BootEnv.BootF8KeyPressed)" symbol="BOOT_F8_KEY_PRESSED" template="tidBootF8KeyPressed" value="24" />
          <event channel="BootSystem" level="win:Informational" message="$(string.BootEnv.BootMenuPolicy)" symbol="BOOT_MENU_POLICY" template="tidBootMenuPolicy" value="25" />
          <event channel="BootSystem" level="win:Informational" message="$(string.BootEnv.BootSequence)" symbol="BOOT_SEQUENCE" template="tidBootSequence" value="26" />
          <event channel="BootSystem" level="win:Informational" message="$(string.BootEnv.BootType)" symbol="BOOT_TYPE" template="tidBootType" value="27" />
          <event keywords="win:SQM" level="win:Informational" symbol="BootEnvSqm_Add_StreamRow" template="SqmStreamRow" value="28" />
          <event channel="BootSystem" level="win:Error" message="$(string.BootEnv.BootHiberbootFailure)" symbol="BOOT_HIBERBOOT_FAILURE" template="tidResumeFailure" value="29" />
          <event channel="BootSystem" level="win:Informational" message="$(string.BootEnv.BootFwBootPerfData)" symbol="BOOT_FW_BOOT_PERF_DATA" template="tidFwBootPerfData" value="30" />
          <event channel="BootEvents" level="win:Informational" message="$(string.BootEnv.BootFwCryptoHashProvider)" symbol="BOOT_FW_CRYPTO_HASH_PROVIDER" template="tidFwCryptoHashProvider" value="31" />
          <event channel="BootSystem" level="win:Informational" message="$(string.BootEnv.UserInputTime)" symbol="BOOT_USER_INPUT_TIME" template="tidBootUserInputTime" value="32" />
          <event channel="BootEvents" keywords="ms:Telemetry" level="win:Error" message="$(string.BootEnv.FwUpdateImageLoadFailure)" symbol="BOOT_FW_UPDATE_IMAGE_LOAD_FAILURE" template="tidFwUpdateImageLoadFailure" value="33" />
          <event channel="BootEvents" keywords="ms:Telemetry" level="win:Error" message="$(string.BootEnv.FwUpdatePeImageLoadFailure)" symbol="BOOT_FW_UPDATE_PE_IMAGE_LOAD_FAILURE" template="tidFwUpdatePeImageLoadFailure" value="34" />
          <event channel="BootEvents" keywords="ms:Telemetry" level="win:Error" message="$(string.BootEnv.FwUpdateUpdateCapsuleFailure)" symbol="BOOT_FW_UPDATE_UPDATE_CAPSULE_FAILURE" template="tidFwUpdateUpdateCapsuleFailure" value="35" />
          <event channel="BootEvents" level="win:Informational" message="$(string.BootEnv.FwUpdateBitlockerCheckStatus)" symbol="BOOT_FW_UPDATE_BITLOCKER_CHECK_STATUS" template="tidFwUpdateBitlockerCheckStatus" value="36" />
          <event channel="BootEvents" keywords="ms:Telemetry" level="win:Error" message="$(string.BootEnv.FwUpdateCodeIntegrityFailure)" symbol="BOOT_FW_UPDATE_CODE_INTEGRITY_FAILURE" template="tidFwUpdateCodeIntegrityFailure" value="37" />
          <event channel="BootMessages" keywords="ms:Telemetry" level="win:Error" message="$(string.BootEnv.ImageLoadFailure)" symbol="BOOT_IMAGE_LOAD_FAILURE" template="tidBootImageLoadFailure" value="38" />
          <event channel="BootMessages" keywords="ms:Telemetry" level="win:Error" message="$(string.BootEnv.HiveLoadFailure)" symbol="BOOT_HIVE_LOAD_FAILURE" template="tidBootHiveLoadFailure" value="39" />
          <event channel="BootMessages" keywords="ms:Telemetry" level="win:Error" message="$(string.BootEnv.AcpiFailure)" symbol="BOOT_ACPI_FAILURE" template="tidBootAcpiFailure" value="40" />
          <event channel="BootMessages" keywords="ms:Telemetry" level="win:Error" message="$(string.BootEnv.GeneralFailure)" symbol="BOOT_GENERAL_FAILURE" template="tidBootGeneralFailure" value="41" />
          <event channel="BootMessages" keywords="ms:Telemetry" level="win:Error" message="$(string.BootEnv.LoadImportImageFailure)" symbol="BOOT_LOAD_IMPORT_IMAGE_FAILURE" template="tidBootLoadImportImageFailure" value="42" />
          <event channel="BootMessages" keywords="ms:Telemetry" level="win:Error" message="$(string.BootEnv.LoadImportFailure)" symbol="BOOT_LOAD_IMPORT_FAILURE" template="tidBootLoadImportFailure" value="43" />
          <event channel="BootMessages" level="win:Error" message="$(string.BootEnv.IdkProvisioningFailure)" symbol="BOOT_IDK_PROVISION_FAILURE" template="tidVsmIdkProvisioningResults" value="44" />
          <event channel="BootMessages" level="win:Informational" message="$(string.BootEnv.IdkProvisioningStatus)" symbol="BOOT_IDK_PROVISION_STATUS" template="tidVsmIdkProvisioningResults" value="45" />
          <event channel="BootEvents" level="win:Informational" message="$(string.BootEnv.RetrieveDriverListTime)" symbol="BOOT_RETRIEVE_DRIVERS_LIST_TIME" template="tidRetrieveDriverListTime" value="46" />
          <event channel="BootEvents" level="win:Informational" message="$(string.BootEnv.LoadDriversTime)" symbol="BOOT_LOAD_DRIVERS_TIME" template="tidLoadDriversTime" value="47" />
          <event channel="BootEvents" level="win:Informational" message="$(string.BootEnv.LoadHiveTime)" symbol="BOOT_LOAD_HIVE_TIME" template="tidLoadHiveTime" value="48" />
          <event channel="BootMessages" level="win:Error" message="$(string.BootEnv.SiPolicyFailure)" symbol="BOOT_SI_POLICY_FAILURE" template="tidBootSiPolicyFailure" value="49" />
          <event channel="BootMessages" level="win:Error" message="$(string.BootEnv.LKeyProvisioningFailure)" symbol="BOOT_LKEY_PROVISION_FAILURE" template="tidVsmLKeyProvisioningResults" value="50" />
          <event channel="BootMessages" level="win:Informational" message="$(string.BootEnv.LKeyProvisioningStatus)" symbol="BOOT_LKEY_PROVISION_STATUS" template="tidVsmLKeyProvisioningResults" value="51" />
          <event channel="BootEvents" level="win:Informational" message="$(string.BootEnv.ApplicationLoadTime)" symbol="BOOT_APPLICATION_LOAD_TIME" template="tidApplicationLoadTime" value="52" />
          <event channel="BootEvents" level="win:Informational" message="$(string.BootEnv.ApplicationExecutionTime)" symbol="BOOT_APPLICATION_EXECUTION_TIME" template="tidApplicationExecutionTime" value="53" />
          <event channel="BootEvents" level="win:Error" message="$(string.BootEnv.BuildChunkTableFailure)" symbol="BOOT_BUILD_CHUNK_TABLE_FAILURE" template="tidBuildChunkTableFailure" value="54" />
          <event channel="BootEvents" level="win:Error" message="$(string.BootEnv.PrepareTargetFailure)" symbol="PrepareTargetFailure" template="tidPrepareTargetFailure" value="55" />
          <event channel="BootEvents" level="win:Error" message="$(string.BootEnv.ProcessPersistentDataFailure)" symbol="BOOT_PROCESS_PERSISTENT_DATA_FAILURE" template="tidNtStatus" value="56" />
          <event keywords="SoftRestart" level="win:Informational" opcode="win:Start" symbol="InitializeLibraryStart" task="InitializeLibrary" value="100" />
          <event keywords="SoftRestart" level="win:Informational" opcode="win:Stop" symbol="InitializeLibraryStop" task="InitializeLibrary" template="tidNtStatus" value="101" />
          <event keywords="SoftRestart" level="win:Informational" opcode="win:Start" symbol="PrepareTargetStart" task="PrepareTarget" value="102" />
          <event keywords="SoftRestart" level="win:Informational" opcode="win:Stop" symbol="PrepareTargetStop" task="PrepareTarget" template="tidNtStatus" value="103" />
          <event keywords="SoftRestart" level="win:Informational" opcode="win:Start" symbol="RebuildKernelMemoryMapStart" task="RebuildKernelMemoryMap" template="tidRebuildKernelMemoryMapStart" value="104" />
          <event keywords="SoftRestart" level="win:Informational" opcode="win:Stop" symbol="RebuildKernelMemoryMapStop" task="RebuildKernelMemoryMap" template="tidNtStatus" value="105" />
          <event keywords="MemoryPreservation" level="win:Informational" opcode="win:Start" symbol="PersistMemoryStart" task="PersistMemory" template="tidPersistMemoryStart" value="106" />
          <event keywords="MemoryPreservation" level="win:Informational" opcode="win:Stop" symbol="PersistMemoryStop" task="PersistMemory" template="tidPersistMemoryStop" value="107" />
          <event keywords="MemoryPreservation SoftRestart" level="win:Error" opcode="win:Info" symbol="FatalError" task="FatalError" template="tidNtStatus" value="108" />
          <event keywords="MemoryPreservation SoftRestart" level="win:Informational" opcode="win:Start" symbol="CleanupPageDatabaseStart" task="CleanupPageDatabase" template="tidCleanupPageDatabaseStart" value="109" />
          <event keywords="MemoryPreservation SoftRestart" level="win:Informational" opcode="win:Stop" symbol="CleanupPageDatabaseStop" task="CleanupPageDatabase" template="tidNtStatus" value="110" />
          <event keywords="MemoryPreservation" level="win:Informational" opcode="win:Start" symbol="FreePersistedMemoryStart" task="FreePersistedMemory" template="tidFreePersistedMemoryStart" value="111" />
          <event keywords="MemoryPreservation" level="win:Informational" opcode="win:Stop" symbol="FreePersistedMemoryStop" task="FreePersistedMemory" template="tidNtStatus" value="112" />
          <event keywords="MemoryPreservation" level="win:Informational" opcode="win:Start" symbol="ClaimPersistedMemoryStart" task="ClaimPersistedMemory" template="tidClaimPersistedMemoryStart" value="113" />
          <event keywords="MemoryPreservation" level="win:Informational" opcode="win:Stop" symbol="ClaimPersistedMemoryStop" task="ClaimPersistedMemory" template="tidClaimPersistedMemoryStop" value="114" />
          <event keywords="SoftRestart" level="win:Warning" opcode="win:Start" symbol="CancelBootStart" task="CancelBoot" template="tidCancelBootStart" value="115" />
          <event keywords="SoftRestart" level="win:Warning" opcode="win:Stop" symbol="CancelBootStop" task="CancelBoot" template="tidNtStatus" value="116" />
          <event keywords="MemoryPreservation SoftRestart" level="win:Informational" opcode="win:Start" symbol="AttachPersistentPageDatabaseStart" task="AttachPersistentPageDatabase" value="117" />
          <event keywords="MemoryPreservation SoftRestart" level="win:Informational" opcode="win:Stop" symbol="AttachPersistentPageDatabaseStop" task="AttachPersistentPageDatabase" template="tidNtStatus" value="118" />
          <event keywords="MemoryBlockRundown" level="win:Informational" opcode="win:Info" symbol="MemoryBlockRundown" task="MemoryBlockRundown" template="tidMemoryBlockRundown" value="119" />
          <event keywords="SoftRestart" level="win:Informational" opcode="win:Start" symbol="BuildKernelMemoryMapStart" task="BuildKernelMemoryMap" value="120" />
          <event keywords="SoftRestart" level="win:Informational" opcode="win:Stop" symbol="BuildKernelMemoryMapStop" task="BuildKernelMemoryMap" template="tidNtStatus" value="121" />
          <event keywords="SoftRestart" level="win:Informational" opcode="win:Start" symbol="GetMemoryMapStart" task="GetMemoryMap" template="tidGetMemoryMapStart" value="122" />
          <event keywords="SoftRestart" level="win:Informational" opcode="win:Stop" symbol="GetMemoryMapStop" task="GetMemoryMap" template="tidGetMemoryMapStop" value="123" />
          <event channel="BootSystem" keywords="ms:Measures" level="win:Error" message="$(string.BootEnv.VsmPolicyFailure)" symbol="BOOT_ENVIRONMENT_VSM_POLICY_FAILURE" template="tidVsmPolicyFailure" value="124" />
          <event keywords="PhysicalMemory SoftRestart" level="win:Informational" opcode="win:Start" symbol="AllocatePhysicalPagesForMdlStart" task="AllocatePhysicalPagesForMdl" template="tidAllocatePhysicalPagesForMdlStart" value="126" />
          <event keywords="PhysicalMemory SoftRestart" level="win:Informational" opcode="win:Stop" symbol="AllocatePhysicalPagesForMdlStop" task="AllocatePhysicalPagesForMdl" template="tidAllocatePhysicalPagesForMdlStop" value="127" />
        </events>
      </provider>
      <provider guid="{edd08927-9cc4-4e65-b970-c2560fb5c289}" message="$(string.KernelFileProviderName)" messageFileName="%SystemRoot%\system32\Microsoft-Windows-System-Events.dll" name="Microsoft-Windows-Kernel-File" resourceFileName="%SystemRoot%\system32\Microsoft-Windows-System-Events.dll" symbol="FileProvGuid">
        <channels>
          <channel chid="FileEvents" isolation="System" name="Microsoft-Windows-Kernel-File/Analytic" symbol="KERNEL_FILE_CHANNEL_ANALYTIC" type="Analytic">This channel contains file name and operation events.</channel>
        </channels>
        <keywords>
          <keyword mask="0x00000010" name="KERNEL_FILE_KEYWORD_FILENAME" symbol="KERNEL_FILE_KEYWORD_FILENAME" />
          <keyword mask="0x00000020" name="KERNEL_FILE_KEYWORD_FILEIO" symbol="KERNEL_FILE_KEYWORD_FILEIO" />
          <keyword mask="0x00000040" name="KERNEL_FILE_KEYWORD_OP_END" symbol="KERNEL_FILE_KEYWORD_OP_END" />
          <keyword mask="0x00000080" name="KERNEL_FILE_KEYWORD_CREATE" symbol="KERNEL_FILE_KEYWORD_CREATE" />
          <keyword mask="0x00000100" name="KERNEL_FILE_KEYWORD_READ" symbol="KERNEL_FILE_KEYWORD_READ" />
          <keyword mask="0x00000200" name="KERNEL_FILE_KEYWORD_WRITE" symbol="KERNEL_FILE_KEYWORD_WRITE" />
          <keyword mask="0x00000400" name="KERNEL_FILE_KEYWORD_DELETE_PATH" symbol="KERNEL_FILE_KEYWORD_DELETE_PATH" />
          <keyword mask="0x00000800" name="KERNEL_FILE_KEYWORD_RENAME_SETLINK_PATH" symbol="KERNEL_FILE_KEYWORD_RENAME_SETLINK_PATH" />
          <keyword mask="0x00001000" name="KERNEL_FILE_KEYWORD_CREATE_NEW_FILE" symbol="KERNEL_FILE_KEYWORD_CREATE_NEW_FILE" />
        </keywords>
        <tasks>
          <task name="NameCreate" value="10" />
          <task name="NameDelete" value="11" />
          <task name="Create" value="12" />
          <task name="Cleanup" value="13" />
          <task name="Close" value="14" />
          <task name="Read" value="15" />
          <task name="Write" value="16" />
          <task name="SetInformation" value="17" />
          <task name="SetDelete" value="18" />
          <task name="Rename" value="19" />
          <task name="DirEnum" value="20" />
          <task name="Flush" value="21" />
          <task name="QueryInformation" value="22" />
          <task name="FSCTL" value="23" />
          <task name="OperationEnd" value="24" />
          <task name="DirNotify" value="25" />
          <task name="DeletePath" value="26" />
          <task name="RenamePath" value="27" />
          <task name="SetLinkPath" value="28" />
          <task name="SetLink" value="29" />
          <task name="CreateNewFile" value="30" />
        </tasks>
        <templates>
          <template tid="tid_FileEventCreate_V0">
            <data inType="win:Pointer" name="Irp" outType="win:HexInt64" />
            <data inType="win:Pointer" name="ThreadId" outType="win:HexInt64" />
            <data inType="win:Pointer" name="FileObject" outType="win:HexInt64" />
            <data inType="win:UInt32" name="CreateOptions" outType="win:HexInt32" />
            <data inType="win:UInt32" name="CreateAttributes" outType="win:HexInt32" />
            <data inType="win:UInt32" name="ShareAccess" outType="win:HexInt32" />
            <data inType="win:UnicodeString" name="FileName" outType="xs:string" />
          </template>
          <template tid="tid_FileEventReadWrite_V0">
            <data inType="win:UInt64" name="ByteOffset" outType="win:HexInt64" />
            <data inType="win:Pointer" name="Irp" outType="win:HexInt64" />
            <data inType="win:Pointer" name="ThreadId" outType="win:HexInt64" />
            <data inType="win:Pointer" name="FileObject" outType="win:HexInt64" />
            <data inType="win:Pointer" name="FileKey" outType="win:HexInt64" />
            <data inType="win:UInt32" name="IOSize" outType="win:HexInt32" />
            <data inType="win:UInt32" name="IOFlags" outType="win:HexInt32" />
          </template>
          <template tid="tid_FileEventInformation_V0">
            <data inType="win:Pointer" name="Irp" outType="win:HexInt64" />
            <data inType="win:Pointer" name="ThreadId" outType="win:HexInt64" />
            <data inType="win:Pointer" name="FileObject" outType="win:HexInt64" />
            <data inType="win:Pointer" name="FileKey" outType="win:HexInt64" />
            <data inType="win:Pointer" name="ExtraInformation" outType="win:HexInt64" />
            <data inType="win:UInt32" name="InfoClass" outType="xs:unsignedInt" />
          </template>
          <template tid="tid_FileEventPathOperation_V0">
            <data inType="win:Pointer" name="Irp" outType="win:HexInt64" />
            <data inType="win:Pointer" name="ThreadId" outType="win:HexInt64" />
            <data inType="win:Pointer" name="FileObject" outType="win:HexInt64" />
            <data inType="win:Pointer" name="FileKey" outType="win:HexInt64" />
            <data inType="win:Pointer" name="ExtraInformation" outType="win:HexInt64" />
            <data inType="win:UInt32" name="InfoClass" outType="xs:unsignedInt" />
            <data inType="win:UnicodeString" name="FilePath" outType="xs:string" />
          </template>
          <template tid="tid_FileEventDirEnum_V0">
            <data inType="win:Pointer" name="Irp" outType="win:HexInt64" />
            <data inType="win:Pointer" name="ThreadId" outType="win:HexInt64" />
            <data inType="win:Pointer" name="FileObject" outType="win:HexInt64" />
            <data inType="win:Pointer" name="FileKey" outType="win:HexInt64" />
            <data inType="win:UInt32" name="Length" outType="xs:unsignedInt" />
            <data inType="win:UInt32" name="InfoClass" outType="xs:unsignedInt" />
            <data inType="win:UInt32" name="FileIndex" outType="xs:unsignedInt" />
            <data inType="win:UnicodeString" name="FileName" outType="xs:string" />
          </template>
          <template tid="tid_FileEventSimpleOperation_V0">
            <data inType="win:Pointer" name="Irp" outType="win:HexInt64" />
            <data inType="win:Pointer" name="ThreadId" outType="win:HexInt64" />
            <data inType="win:Pointer" name="FileObject" outType="win:HexInt64" />
            <data inType="win:Pointer" name="FileKey" outType="win:HexInt64" />
          </template>
          <template tid="tid_FileEventCreate">
            <data inType="win:Pointer" name="Irp" outType="win:HexInt64" />
            <data inType="win:Pointer" name="FileObject" outType="win:HexInt64" />
            <data inType="win:UInt32" name="IssuingThreadId" outType="xs:unsignedInt" />
            <data inType="win:UInt32" name="CreateOptions" outType="win:HexInt32" />
            <data inType="win:UInt32" name="CreateAttributes" outType="win:HexInt32" />
            <data inType="win:UInt32" name="ShareAccess" outType="win:HexInt32" />
            <data inType="win:UnicodeString" name="FileName" outType="xs:string" />
          </template>
          <template tid="tid_FileEventReadWrite">
            <data inType="win:UInt64" name="ByteOffset" outType="win:HexInt64" />
            <data inType="win:Pointer" name="Irp" outType="win:HexInt64" />
            <data inType="win:Pointer" name="FileObject" outType="win:HexInt64" />
            <data inType="win:Pointer" name="FileKey" outType="win:HexInt64" />
            <data inType="win:UInt32" name="IssuingThreadId" outType="xs:unsignedInt" />
            <data inType="win:UInt32" name="IOSize" outType="win:HexInt32" />
            <data inType="win:UInt32" name="IOFlags" outType="win:HexInt32" />
            <data inType="win:UInt32" name="ExtraFlags" outType="win:HexInt32" />
          </template>
          <template tid="tid_FileEventInformation">
            <data inType="win:Pointer" name="Irp" outType="win:HexInt64" />
            <data inType="win:Pointer" name="FileObject" outType="win:HexInt64" />
            <data inType="win:Pointer" name="FileKey" outType="win:HexInt64" />
            <data inType="win:Pointer" name="ExtraInformation" outType="win:HexInt64" />
            <data inType="win:UInt32" name="IssuingThreadId" outType="xs:unsignedInt" />
            <data inType="win:UInt32" name="InfoClass" outType="xs:unsignedInt" />
          </template>
          <template tid="tid_FileEventPathOperation">
            <data inType="win:Pointer" name="Irp" outType="win:HexInt64" />
            <data inType="win:Pointer" name="FileObject" outType="win:HexInt64" />
            <data inType="win:Pointer" name="FileKey" outType="win:HexInt64" />
            <data inType="win:Pointer" name="ExtraInformation" outType="win:HexInt64" />
            <data inType="win:UInt32" name="IssuingThreadId" outType="xs:unsignedInt" />
            <data inType="win:UInt32" name="InfoClass" outType="xs:unsignedInt" />
            <data inType="win:UnicodeString" name="FilePath" outType="xs:string" />
          </template>
          <template tid="tid_FileEventDirEnum">
            <data inType="win:Pointer" name="Irp" outType="win:HexInt64" />
            <data inType="win:Pointer" name="FileObject" outType="win:HexInt64" />
            <data inType="win:Pointer" name="FileKey" outType="win:HexInt64" />
            <data inType="win:UInt32" name="IssuingThreadId" outType="xs:unsignedInt" />
            <data inType="win:UInt32" name="Length" outType="xs:unsignedInt" />
            <data inType="win:UInt32" name="InfoClass" outType="xs:unsignedInt" />
            <data inType="win:UInt32" name="FileIndex" outType="xs:unsignedInt" />
            <data inType="win:UnicodeString" name="FileName" outType="xs:string" />
          </template>
          <template tid="tid_FileEventSimpleOperation">
            <data inType="win:Pointer" name="Irp" outType="win:HexInt64" />
            <data inType="win:Pointer" name="FileObject" outType="win:HexInt64" />
            <data inType="win:Pointer" name="FileKey" outType="win:HexInt64" />
            <data inType="win:UInt32" name="IssuingThreadId" outType="xs:unsignedInt" />
          </template>
          <template tid="tid_FileEventOperationEnd">
            <data inType="win:Pointer" name="Irp" outType="win:HexInt64" />
            <data inType="win:Pointer" name="ExtraInformation" outType="win:HexInt64" />
            <data inType="win:UInt32" name="Status" outType="win:HexInt32" />
          </template>
          <template tid="tid_FileEventName">
            <data inType="win:Pointer" name="FileKey" outType="win:HexInt64" />
            <data inType="win:UnicodeString" name="FileName" outType="xs:string" />
          </template>
        </templates>
        <events>
          <event channel="FileEvents" keywords="KERNEL_FILE_KEYWORD_FILEIO KERNEL_FILE_KEYWORD_CREATE" level="win:Informational" notLogged="true" opcode="win:Info" symbol="KFileEvt_Create_V0" task="Create" template="tid_FileEventCreate_V0" value="12" />
          <event channel="FileEvents" keywords="KERNEL_FILE_KEYWORD_FILEIO" level="win:Informational" notLogged="true" opcode="win:Info" symbol="KFileEvt_Cleanup_V0" task="Cleanup" template="tid_FileEventSimpleOperation_V0" value="13" />
          <event channel="FileEvents" keywords="KERNEL_FILE_KEYWORD_FILEIO" level="win:Informational" notLogged="true" opcode="win:Info" symbol="KFileEvt_Close_V0" task="Close" template="tid_FileEventSimpleOperation_V0" value="14" />
          <event channel="FileEvents" keywords="KERNEL_FILE_KEYWORD_FILEIO KERNEL_FILE_KEYWORD_READ" level="win:Informational" notLogged="true" opcode="win:Info" symbol="KFileEvt_Read_V0" task="Read" template="tid_FileEventReadWrite_V0" value="15" />
          <event channel="FileEvents" keywords="KERNEL_FILE_KEYWORD_FILEIO KERNEL_FILE_KEYWORD_WRITE" level="win:Informational" notLogged="true" opcode="win:Info" symbol="KFileEvt_Write_V0" task="Write" template="tid_FileEventReadWrite_V0" value="16" />
          <event channel="FileEvents" keywords="KERNEL_FILE_KEYWORD_FILEIO" level="win:Informational" notLogged="true" opcode="win:Info" symbol="KFileEvt_SetInformation_V0" task="SetInformation" template="tid_FileEventInformation_V0" value="17" />
          <event channel="FileEvents" keywords="KERNEL_FILE_KEYWORD_FILEIO" level="win:Informational" notLogged="true" opcode="win:Info" symbol="KFileEvt_Delete_V0" task="SetDelete" template="tid_FileEventInformation_V0" value="18" />
          <event channel="FileEvents" keywords="KERNEL_FILE_KEYWORD_FILEIO" level="win:Informational" notLogged="true" opcode="win:Info" symbol="KFileEvt_Rename_V0" task="Rename" template="tid_FileEventInformation_V0" value="19" />
          <event channel="FileEvents" keywords="KERNEL_FILE_KEYWORD_FILEIO" level="win:Informational" notLogged="true" opcode="win:Info" symbol="KFileEvt_DirEnum_V0" task="DirEnum" template="tid_FileEventDirEnum_V0" value="20" />
          <event channel="FileEvents" keywords="KERNEL_FILE_KEYWORD_FILEIO" level="win:Informational" notLogged="true" opcode="win:Info" symbol="KFileEvt_Flush_V0" task="Flush" template="tid_FileEventSimpleOperation_V0" value="21" />
          <event channel="FileEvents" keywords="KERNEL_FILE_KEYWORD_FILEIO" level="win:Informational" notLogged="true" opcode="win:Info" symbol="KFileEvt_QueryInformation_V0" task="QueryInformation" template="tid_FileEventInformation_V0" value="22" />
          <event channel="FileEvents" keywords="KERNEL_FILE_KEYWORD_FILEIO" level="win:Informational" notLogged="true" opcode="win:Info" symbol="KFileEvt_FSCTL_V0" task="FSCTL" template="tid_FileEventInformation_V0" value="23" />
          <event channel="FileEvents" keywords="KERNEL_FILE_KEYWORD_FILEIO" level="win:Informational" notLogged="true" opcode="win:Info" symbol="KFileEvt_DirNotify_V0" task="DirNotify" template="tid_FileEventDirEnum_V0" value="25" />
          <event channel="FileEvents" keywords="KERNEL_FILE_KEYWORD_DELETE_PATH" level="win:Informational" notLogged="true" opcode="win:Info" symbol="KFileEvt_DeletePath_V0" task="DeletePath" template="tid_FileEventPathOperation_V0" value="26" />
          <event channel="FileEvents" keywords="KERNEL_FILE_KEYWORD_RENAME_SETLINK_PATH" level="win:Informational" notLogged="true" opcode="win:Info" symbol="KFileEvt_RenamePath_V0" task="RenamePath" template="tid_FileEventPathOperation_V0" value="27" />
          <event channel="FileEvents" keywords="KERNEL_FILE_KEYWORD_RENAME_SETLINK_PATH" level="win:Informational" notLogged="true" opcode="win:Info" symbol="KFileEvt_SetLinkPath_V0" task="SetLinkPath" template="tid_FileEventPathOperation_V0" value="28" />
          <event channel="FileEvents" keywords="KERNEL_FILE_KEYWORD_FILEIO" level="win:Informational" notLogged="true" opcode="win:Info" symbol="KFileEvt_SetLink_V0" task="Rename" template="tid_FileEventInformation_V0" value="29" />
          <event channel="FileEvents" keywords="KERNEL_FILE_KEYWORD_CREATE_NEW_FILE" level="win:Informational" notLogged="true" opcode="win:Info" symbol="KFileEvt_CreateNewFile_V0" task="CreateNewFile" template="tid_FileEventCreate_V0" value="30" />
          <event channel="FileEvents" keywords="KERNEL_FILE_KEYWORD_FILENAME" level="win:Informational" opcode="win:Info" symbol="KFileEvt_NameCreate" task="NameCreate" template="tid_FileEventName" value="10" />
          <event channel="FileEvents" keywords="KERNEL_FILE_KEYWORD_FILENAME" level="win:Informational" opcode="win:Info" symbol="KFileEvt_NameDelete" task="NameDelete" template="tid_FileEventName" value="11" />
          <event channel="FileEvents" keywords="KERNEL_FILE_KEYWORD_FILEIO KERNEL_FILE_KEYWORD_CREATE" level="win:Informational" opcode="win:Info" symbol="KFileEvt_Create" task="Create" template="tid_FileEventCreate" value="12" version="1" />
          <event channel="FileEvents" keywords="KERNEL_FILE_KEYWORD_FILEIO" level="win:Informational" opcode="win:Info" symbol="KFileEvt_Cleanup" task="Cleanup" template="tid_FileEventSimpleOperation" value="13" version="1" />
          <event channel="FileEvents" keywords="KERNEL_FILE_KEYWORD_FILEIO" level="win:Informational" opcode="win:Info" symbol="KFileEvt_Close" task="Close" template="tid_FileEventSimpleOperation" value="14" version="1" />
          <event channel="FileEvents" keywords="KERNEL_FILE_KEYWORD_FILEIO KERNEL_FILE_KEYWORD_READ" level="win:Informational" opcode="win:Info" symbol="KFileEvt_Read" task="Read" template="tid_FileEventReadWrite" value="15" version="1" />
          <event channel="FileEvents" keywords="KERNEL_FILE_KEYWORD_FILEIO KERNEL_FILE_KEYWORD_WRITE" level="win:Informational" opcode="win:Info" symbol="KFileEvt_Write" task="Write" template="tid_FileEventReadWrite" value="16" version="1" />
          <event channel="FileEvents" keywords="KERNEL_FILE_KEYWORD_FILEIO" level="win:Informational" opcode="win:Info" symbol="KFileEvt_SetInformation" task="SetInformation" template="tid_FileEventInformation" value="17" version="1" />
          <event channel="FileEvents" keywords="KERNEL_FILE_KEYWORD_FILEIO" level="win:Informational" opcode="win:Info" symbol="KFileEvt_Delete" task="SetDelete" template="tid_FileEventInformation" value="18" version="1" />
          <event channel="FileEvents" keywords="KERNEL_FILE_KEYWORD_FILEIO" level="win:Informational" opcode="win:Info" symbol="KFileEvt_Rename" task="Rename" template="tid_FileEventInformation" value="19" version="1" />
          <event channel="FileEvents" keywords="KERNEL_FILE_KEYWORD_FILEIO" level="win:Informational" opcode="win:Info" symbol="KFileEvt_DirEnum" task="DirEnum" template="tid_FileEventDirEnum" value="20" version="1" />
          <event channel="FileEvents" keywords="KERNEL_FILE_KEYWORD_FILEIO" level="win:Informational" opcode="win:Info" symbol="KFileEvt_Flush" task="Flush" template="tid_FileEventSimpleOperation" value="21" version="1" />
          <event channel="FileEvents" keywords="KERNEL_FILE_KEYWORD_FILEIO" level="win:Informational" opcode="win:Info" symbol="KFileEvt_QueryInformation" task="QueryInformation" template="tid_FileEventInformation" value="22" version="1" />
          <event channel="FileEvents" keywords="KERNEL_FILE_KEYWORD_FILEIO" level="win:Informational" opcode="win:Info" symbol="KFileEvt_FSCTL" task="FSCTL" template="tid_FileEventInformation" value="23" version="1" />
          <event channel="FileEvents" keywords="KERNEL_FILE_KEYWORD_FILEIO KERNEL_FILE_KEYWORD_OP_END" level="win:Informational" opcode="win:Info" symbol="KFileEvt_OperationEnd" task="OperationEnd" template="tid_FileEventOperationEnd" value="24" />
          <event channel="FileEvents" keywords="KERNEL_FILE_KEYWORD_FILEIO" level="win:Informational" opcode="win:Info" symbol="KFileEvt_DirNotify" task="DirNotify" template="tid_FileEventDirEnum" value="25" version="1" />
          <event channel="FileEvents" keywords="KERNEL_FILE_KEYWORD_DELETE_PATH" level="win:Informational" opcode="win:Info" symbol="KFileEvt_DeletePath" task="DeletePath" template="tid_FileEventPathOperation" value="26" version="1" />
          <event channel="FileEvents" keywords="KERNEL_FILE_KEYWORD_RENAME_SETLINK_PATH" level="win:Informational" opcode="win:Info" symbol="KFileEvt_RenamePath" task="RenamePath" template="tid_FileEventPathOperation" value="27" version="1" />
          <event channel="FileEvents" keywords="KERNEL_FILE_KEYWORD_RENAME_SETLINK_PATH" level="win:Informational" opcode="win:Info" symbol="KFileEvt_SetLinkPath" task="SetLinkPath" template="tid_FileEventPathOperation" value="28" version="1" />
          <event channel="FileEvents" keywords="KERNEL_FILE_KEYWORD_FILEIO" level="win:Informational" opcode="win:Info" symbol="KFileEvt_SetLink" task="Rename" template="tid_FileEventInformation" value="29" version="1" />
          <event channel="FileEvents" keywords="KERNEL_FILE_KEYWORD_CREATE_NEW_FILE" level="win:Informational" opcode="win:Info" symbol="KFileEvt_CreateNewFile" task="CreateNewFile" template="tid_FileEventCreate" value="30" version="1" />
        </events>
      </provider>
      <provider guid="{1a9443d4-b099-44d6-8eb1-829b9c2fe290}" message="$(string.PciProviderName)" messageFileName="%SystemRoot%\system32\Microsoft-Windows-System-Events.dll" name="Microsoft-Windows-PCI" resourceFileName="%SystemRoot%\system32\Microsoft-Windows-System-Events.dll" symbol="PCI_ETW_PROVIDER">
        <channels>
          <channel chid="chidPCI" name="Microsoft-Windows-PCI/Diagnostic" type="Analytic" />
        </channels>
        <keywords>
          <keyword mask="0x1" name="Diag" symbol="PCI_ETW_KEYWORD_DIAG" />
        </keywords>
        <tasks>
          <task name="AspmErrataRundown" value="10" />
        </tasks>
        <events>
          <event channel="chidPCI" keywords="Diag" level="win:Informational" opcode="win:Info" symbol="PCI_ETW_EVENT_ASPM_ERRATA_RUNDOWN" task="AspmErrataRundown" value="10" />
        </events>
      </provider>
      <provider guid="{a6ad76e3-867a-4635-91b3-4904ba6374d7}" message="$(string.StoreMgrProviderName)" messageFileName="%SystemRoot%\system32\Microsoft-Windows-System-Events.dll" name="Microsoft-Windows-Kernel-StoreMgr" resourceFileName="%SystemRoot%\system32\Microsoft-Windows-System-Events.dll" symbol="SmEventProvider">
        <channels>
          <channel chid="StoreMgrEvents" name="Microsoft-Windows-Kernel-StoreMgr/Analytic" type="Analytic" />
          <channel chid="StoreMgrEventLog" enabled="true" isolation="System" message="$(string.StoreMgrOperationalChannelName)" name="Microsoft-Windows-Kernel-StoreMgr/Operational" type="Operational" />
        </channels>
        <keywords>
          <keyword mask="0x10" name="StoreOps" />
          <keyword mask="0x40" name="StoreDiag" />
          <keyword mask="0x80" name="StoreContentsRundown" />
        </keywords>
        <maps>
          <valueMap name="StoreMgrCorruptPageMsgMap">
            <map message="$(string.StoreMgr.CorruptRAM)" value="0" />
            <map message="$(string.StoreMgr.CorruptFlash)" value="1" />
          </valueMap>
          <valueMap name="CacheTerminationMsgMap">
            <map message="$(string.StoreMgr.CT_ReasonCorruption)" value="0" />
            <map message="$(string.StoreMgr.CT_ReasonIoFailure)" value="1" />
          </valueMap>
        </maps>
        <templates>
          <template tid="StoreAdd">
            <data inType="win:UInt32" name="DataKey" outType="win:HexInt32" />
            <data inType="win:Pointer" name="DataMgr" />
            <data inType="win:UInt32" name="StoreOffset" outType="win:HexInt32" />
            <data inType="win:UInt16" name="CompressedSize" />
            <data inType="win:UInt16" name="Flags" outType="win:HexInt16" />
          </template>
          <template tid="StoreRemove">
            <data inType="win:UInt32" name="DataKey" outType="win:HexInt32" />
            <data inType="win:Pointer" name="DataMgr" />
            <data inType="win:UInt32" name="StoreOffset" outType="win:HexInt32" />
          </template>
          <template tid="StoreCreate">
            <data inType="win:Pointer" name="StoreKey" />
            <data inType="win:Pointer" name="StoreFileKey" />
            <data inType="win:Pointer" name="UserDataMgr" />
            <data inType="win:Pointer" name="MetadataMgr" />
            <data inType="win:UInt32" name="RegionSize" />
            <data inType="win:UInt32" name="RegionCount" />
            <data inType="win:UInt32" name="BlockSize" />
            <data inType="win:UInt32" name="SectorSize" />
            <data inType="win:UInt32" name="EncryptionStrength" />
            <data inType="win:UInt16" name="StoreType" />
            <data inType="win:UInt16" name="StoreId" />
            <data inType="win:UInt32" name="BlocksStored" />
            <data inType="win:UInt32" name="RegionsInUse" />
            <data inType="win:UInt32" name="TotalSpaceUsed" />
            <data inType="win:UInt32" name="Flags" outType="win:HexInt32" />
            <data inType="win:UInt32" name="MetaRegionCount" />
            <data inType="win:UInt32" name="MetaRegionsInUse" />
            <data inType="win:UInt32" name="MetaRegionsSpaceUsed" />
            <data inType="win:UInt32" name="StoreTime" />
          </template>
          <template tid="StoreDelete">
            <data inType="win:Pointer" name="StoreKey" />
          </template>
          <template tid="CorruptPage">
            <data inType="win:Pointer" name="DataMgr" />
            <data inType="win:Pointer" name="VirtualAddress" />
            <data inType="win:UInt64" name="PhysicalAddress" outType="win:HexInt64" />
            <data inType="win:UInt16" name="Size" />
            <data inType="win:UInt8" map="StoreMgrCorruptPageMsgMap" name="FileBacked" />
            <data inType="win:UInt8" name="CorruptionType" />
            <data inType="win:UInt32" name="Flags" />
          </template>
          <template tid="RegionOperation">
            <data inType="win:Pointer" name="DataMgr" />
            <data inType="win:UInt32" name="RegionIndex" />
            <data inType="win:UInt32" name="Status" outType="win:HexInt32" />
            <data inType="win:UInt16" name="SpaceUsed" />
            <data inType="win:UInt16" name="LastAccessTime" />
          </template>
          <template tid="UnpersistFailure">
            <data inType="win:UInt32" name="FailReason" />
            <data inType="win:HexInt32" name="FailStatus" />
            <data inType="win:UInt16" name="ObjectPathLength" />
            <data inType="win:UnicodeString" length="ObjectPathLength" name="ObjectPath" />
          </template>
          <template tid="BinaryBlob">
            <data inType="win:UInt32" name="Size" />
            <data inType="win:Binary" length="Size" name="Data" />
          </template>
          <template tid="StoreBinaryBlob">
            <data inType="win:Pointer" name="StoreKey" />
            <data inType="win:UInt32" name="Size" />
            <data inType="win:Binary" length="Size" name="Data" />
          </template>
          <template tid="StoreParam">
            <data inType="win:Pointer" name="StoreKey" />
            <data inType="win:Pointer" name="Param" />
          </template>
          <template tid="CacheTermination">
            <data inType="win:UInt8" map="CacheTerminationMsgMap" name="Reason" />
            <data inType="win:HexInt32" name="FailStatus" />
            <data inType="win:UInt16" name="DeviceDescLength" />
            <data inType="win:UnicodeString" length="DeviceDescLength" name="DeviceDescription" />
            <data inType="win:UInt16" name="ObjectPathLength" />
            <data inType="win:UnicodeString" length="ObjectPathLength" name="ObjectPath" />
          </template>
          <template tid="SQMStreamRow">
            <data inType="win:UInt32" name="SqmType" outType="xs:unsignedInt" />
            <data inType="win:GUID" name="SqmSessionGuid" outType="xs:GUID" />
            <data inType="win:UInt32" name="SqmID" outType="xs:unsignedInt" />
            <data inType="win:UInt32" name="SqmStreamRowLength" outType="xs:unsignedInt" />
            <struct count="SqmStreamRowLength" name="SqmStreamRow">
              <data inType="win:UInt32" name="SqmTypeEntry" outType="xs:unsignedInt" />
              <data inType="win:UInt32" name="SqmDWORDEntry" outType="xs:unsignedInt" />
              <data inType="win:UnicodeString" name="SqmStringEntry" outType="xs:string" />
            </struct>
          </template>
        </templates>
        <tasks>
          <task name="StoreAdd" value="1" />
          <task name="StoreRemove" value="2" />
          <task name="StoreCreate" value="3" />
          <task name="StoreDelete" value="4" />
          <task name="StoreRundown" value="5" />
          <task name="StoreCorruption" value="6" />
          <task name="StorePageRundown" value="7" />
          <task name="RegionEvict" value="8" />
          <task name="RegionWrite" value="9" />
          <task name="UnpersistFailure" value="10" />
          <task name="StoreIoStats" value="11" />
          <task name="GlobalStats" value="12" />
          <task name="StoreEmpty" value="13" />
          <task name="RegionRelease" value="14" />
          <task name="RegionCompact" value="15" />
          <task name="RegionRundown" value="16" />
          <task name="CacheTermination" value="17" />
        </tasks>
        <events>
          <event channel="StoreMgrEvents" keywords="StoreOps" level="win:Informational" opcode="win:Info" symbol="StEventStoreAdd" task="StoreAdd" template="StoreAdd" value="1" version="2" />
          <event channel="StoreMgrEvents" keywords="StoreOps" level="win:Informational" opcode="win:Info" symbol="StEventStoreRemove" task="StoreRemove" template="StoreRemove" value="2" version="1" />
          <event channel="StoreMgrEvents" keywords="StoreOps" level="win:Informational" opcode="win:Info" symbol="SmEventStoreCreate" task="StoreCreate" template="StoreCreate" value="3" version="3" />
          <event channel="StoreMgrEvents" keywords="StoreOps" level="win:Informational" opcode="win:Info" symbol="SmEventStoreDelete" task="StoreDelete" template="StoreDelete" value="4" version="1" />
          <event channel="StoreMgrEvents" keywords="StoreOps" level="win:Informational" opcode="win:Info" symbol="SmEventStoreRundown" task="StoreRundown" template="StoreCreate" value="5" version="3" />
          <event channel="StoreMgrEventLog" keywords="StoreOps StoreDiag" level="win:Informational" message="$(string.StoreMgr.CorruptPage)" opcode="win:Info" symbol="StEventStoreCorruption" task="StoreCorruption" template="CorruptPage" value="6" version="1" />
          <event channel="StoreMgrEvents" keywords="StoreContentsRundown" level="win:Informational" opcode="win:Info" symbol="StEventStorePageRundown" task="StorePageRundown" template="StoreAdd" value="7" version="1" />
          <event channel="StoreMgrEvents" keywords="StoreOps" level="win:Informational" opcode="win:Info" symbol="StEventRegionEvict" task="RegionEvict" template="RegionOperation" value="8" version="2" />
          <event channel="StoreMgrEvents" keywords="StoreOps" level="win:Informational" opcode="win:Info" symbol="StEventRegionWrite" task="RegionWrite" template="RegionOperation" value="9" version="2" />
          <event channel="StoreMgrEventLog" keywords="StoreOps StoreDiag" level="win:Informational" message="$(string.StoreMgr.UnpersistFailure)" opcode="win:Info" symbol="SmEventUnpersistFailure" task="UnpersistFailure" template="UnpersistFailure" value="10" version="1" />
          <event channel="StoreMgrEvents" keywords="StoreOps" level="win:Informational" opcode="win:Info" symbol="SmEventStoreIoStats" task="StoreIoStats" template="StoreBinaryBlob" value="11" version="1" />
          <event channel="StoreMgrEvents" keywords="StoreOps" level="win:Informational" opcode="win:Info" symbol="SmEventGlobalStats" task="GlobalStats" template="BinaryBlob" value="12" version="1" />
          <event channel="StoreMgrEvents" keywords="StoreOps" level="win:Informational" opcode="win:Info" symbol="StEventStoreEmpty" task="StoreEmpty" template="StoreParam" value="13" version="1" />
          <event channel="StoreMgrEvents" keywords="StoreOps" level="win:Informational" opcode="win:Info" symbol="StEventRegionRelease" task="RegionRelease" template="RegionOperation" value="14" version="1" />
          <event channel="StoreMgrEvents" keywords="StoreOps" level="win:Informational" opcode="win:Start" symbol="StEventRegionCompactStart" task="RegionCompact" template="RegionOperation" value="15" version="1" />
          <event channel="StoreMgrEvents" keywords="StoreOps" level="win:Informational" opcode="win:Stop" symbol="StEventRegionCompactEnd" task="RegionCompact" template="RegionOperation" value="16" version="1" />
          <event channel="StoreMgrEvents" keywords="StoreContentsRundown" level="win:Informational" opcode="win:Info" symbol="StEventRegionRundown" task="RegionRundown" template="RegionOperation" value="17" version="1" />
          <event channel="StoreMgrEventLog" keywords="StoreOps StoreDiag" level="win:Informational" message="$(string.StoreMgr.CacheTermination)" opcode="win:Info" symbol="SmEventCacheTermination" task="CacheTermination" template="CacheTermination" value="18" version="1" />
          <event keywords="win:SQM" level="win:Informational" symbol="SmEventSQMStreamRow" template="SQMStreamRow" value="19" />
        </events>
      </provider>
      <provider guid="{a0af438f-4431-41cb-a675-a265050ee947}" messageFileName="%SystemRoot%\system32\Microsoft-Windows-System-Events.dll" name="Microsoft-Windows-Kernel-LicensingSqm" resourceFileName="%SystemRoot%\system32\Microsoft-Windows-System-Events.dll" symbol="LicensingSqmProvider">
        <templates>
          <template tid="tid_SqmDWORDDatapoint">
            <data inType="win:UInt32" name="SqmType" outType="xs:unsignedInt" />
            <data inType="win:GUID" name="SqmSessionGuid" outType="xs:GUID" />
            <data inType="win:UInt32" name="SqmID" outType="xs:unsignedInt" />
            <data inType="win:UInt32" name="SqmDWORDDatapointValue" outType="xs:unsignedInt" />
          </template>
        </templates>
        <events>
          <event keywords="win:SQM" level="win:Informational" symbol="LICENSING_SQM_INCREMENT_DWORD" template="tid_SqmDWORDDatapoint" value="6" />
        </events>
      </provider>
      <provider guid="{D1D93EF7-E1F2-4f45-9943-03D245FE6C00}" messageFileName="%SystemRoot%\system32\Microsoft-Windows-System-Events.dll" name="Microsoft-Windows-Kernel-Memory" resourceFileName="%SystemRoot%\system32\Microsoft-Windows-System-Events.dll" symbol="MemoryProvGuid">
        <channels>
          <channel chid="defch" name="Microsoft-Windows-Kernel-Memory/Analytic" type="Analytic" />
        </channels>
        <keywords>
          <keyword mask="0x20" name="KERNEL_MEM_KEYWORD_MEMINFO" symbol="KERNEL_MEM_KEYWORD_MEMINFO" />
          <keyword mask="0x40" name="KERNEL_MEM_KEYWORD_MEMINFO_EX" symbol="KERNEL_MEM_KEYWORD_MEMINFO_EX" />
          <keyword mask="0x80" name="KERNEL_MEM_KEYWORD_WS_SWAP" symbol="KERNEL_MEM_KEYWORD_WS_SWAP" />
          <keyword mask="0x100" name="KERNEL_MEM_KEYWORD_ACG" symbol="KERNEL_MEM_KEYWORD_ACG" />
        </keywords>
        <tasks>
          <task name="MemInfo" value="1" />
          <task name="MemInfoWS" value="2" />
          <task name="MemInfoSessionWS" value="3" />
          <task name="WorkingSetOutSwap" value="4" />
          <task name="WorkingSetInSwap" value="5" />
          <task name="Acg" value="6" />
        </tasks>
        <templates>
          <template tid="MemInfo">
            <data inType="win:UInt8" name="PriorityLevels" />
            <data inType="win:Pointer" name="ZeroPageCount" />
            <data inType="win:Pointer" name="FreePageCount" />
            <data inType="win:Pointer" name="ModifiedPageCount" />
            <data inType="win:Pointer" name="ModifiedNoWritePageCount" />
            <data inType="win:Pointer" name="BadPageCount" />
            <data count="PriorityLevels" inType="win:Pointer" name="StandbyPageCounts" />
            <data count="PriorityLevels" inType="win:Pointer" name="RepurposedPageCounts" />
            <data inType="win:Pointer" name="ModifiedPageCountPageFile" />
            <data inType="win:Pointer" name="PagedPoolPageCount" />
            <data inType="win:Pointer" name="NonPagedPoolPageCount" />
            <data inType="win:Pointer" name="MdlPageCount" />
            <data inType="win:Pointer" name="CommitPageCount" />
          </template>
          <template tid="MemInfoWS_v0">
            <data inType="win:UInt32" name="Count" />
            <struct count="Count" name="WSCommitInfo">
              <data inType="win:UInt32" name="ProcessID" />
              <data inType="win:Pointer" name="WorkingSetPageCount" />
              <data inType="win:Pointer" name="CommitPageCount" />
              <data inType="win:Pointer" name="VirtualSizeInPages" />
              <data inType="win:Pointer" name="PrivateWorkingSetPageCount" />
            </struct>
          </template>
          <template tid="MemInfoWS_v1">
            <data inType="win:UInt32" name="Count" />
            <struct count="Count" name="WSCommitInfo">
              <data inType="win:UInt32" name="ProcessID" />
              <data inType="win:Pointer" name="WorkingSetPageCount" />
              <data inType="win:Pointer" name="CommitPageCount" />
              <data inType="win:Pointer" name="VirtualSizeInPages" />
              <data inType="win:Pointer" name="PrivateWorkingSetPageCount" />
              <data inType="win:Pointer" name="StoreSizePageCount" />
              <data inType="win:Pointer" name="StoredPageCount" />
              <data inType="win:Pointer" name="CommitDebtInPages" />
            </struct>
          </template>
          <template tid="MemInfoWS">
            <data inType="win:UInt32" name="Count" />
            <struct count="Count" name="WSCommitInfo">
              <data inType="win:UInt32" name="ProcessID" />
              <data inType="win:Pointer" name="WorkingSetPageCount" />
              <data inType="win:Pointer" name="CommitPageCount" />
              <data inType="win:Pointer" name="VirtualSizeInPages" />
              <data inType="win:Pointer" name="PrivateWorkingSetPageCount" />
              <data inType="win:Pointer" name="StoreSizePageCount" />
              <data inType="win:Pointer" name="StoredPageCount" />
              <data inType="win:Pointer" name="CommitDebtInPages" />
              <data inType="win:Pointer" name="SharedCommitInPages" />
            </struct>
          </template>
          <template tid="MemInfoSessionWS_v0">
            <data inType="win:UInt32" name="Count" />
            <struct count="Count" name="SessionWSCommitInfo">
              <data inType="win:UInt32" name="SessionId" />
              <data inType="win:Pointer" name="WorkingSetPageCount" />
              <data inType="win:Pointer" name="CommitPageCount" />
              <data inType="win:Pointer" name="PagedPoolPageCount" />
              <data inType="win:Pointer" name="PrivateWorkingSetPageCount" />
            </struct>
          </template>
          <template tid="MemInfoSessionWS_v1">
            <data inType="win:UInt32" name="Count" />
            <struct count="Count" name="SessionWSCommitInfo">
              <data inType="win:UInt32" name="SessionId" />
              <data inType="win:Pointer" name="WorkingSetPageCount" />
              <data inType="win:Pointer" name="CommitPageCount" />
              <data inType="win:Pointer" name="PagedPoolPageCount" />
              <data inType="win:Pointer" name="PrivateWorkingSetPageCount" />
              <data inType="win:Pointer" name="StoreSizePageCount" />
              <data inType="win:Pointer" name="StoredPageCount" />
              <data inType="win:Pointer" name="CommitDebtInPages" />
            </struct>
          </template>
          <template tid="MemInfoSessionWS">
            <data inType="win:UInt32" name="Count" />
            <struct count="Count" name="SessionWSCommitInfo">
              <data inType="win:UInt32" name="SessionId" />
              <data inType="win:Pointer" name="WorkingSetPageCount" />
              <data inType="win:Pointer" name="CommitPageCount" />
              <data inType="win:Pointer" name="PagedPoolPageCount" />
              <data inType="win:Pointer" name="PrivateWorkingSetPageCount" />
              <data inType="win:Pointer" name="StoreSizePageCount" />
              <data inType="win:Pointer" name="StoredPageCount" />
              <data inType="win:Pointer" name="CommitDebtInPages" />
              <data inType="win:Pointer" name="SharedCommitInPages" />
            </struct>
          </template>
          <template tid="WorkingSetSwapStart_v0">
            <data inType="win:UInt32" name="ProcessId" />
          </template>
          <template tid="WorkingSetSwapStart">
            <data inType="win:UInt32" name="ProcessId" />
            <data inType="win:HexInt32" name="Flags" />
          </template>
          <template tid="WorkingSetOutSwapStop_v0">
            <data inType="win:UInt32" name="ProcessId" />
            <data inType="win:HexInt32" name="Status" />
            <data inType="win:UInt32" name="PagesProcessed" />
          </template>
          <template tid="WorkingSetOutSwapStop">
            <data inType="win:UInt32" name="ProcessId" />
            <data inType="win:HexInt32" name="Status" />
            <data inType="win:Pointer" name="PagesProcessed" />
            <data inType="win:Pointer" name="WriteCombinePagesProcessed" />
            <data inType="win:Pointer" name="UncachedPagesProcessed" />
            <data inType="win:Pointer" name="CleanPagesProcessed" />
          </template>
          <template tid="WorkingSetInSwapStop">
            <data inType="win:UInt32" name="ProcessId" />
            <data inType="win:HexInt32" name="Status" />
          </template>
          <template tid="Acg">
            <data inType="win:UInt32" name="AcgFlag" />
          </template>
        </templates>
        <events>
          <event channel="defch" keywords="KERNEL_MEM_KEYWORD_MEMINFO" level="win:Informational" opcode="win:Info" symbol="KERNEL_MEM_EVENT_MEMINFO" task="MemInfo" template="MemInfo" value="1" version="1" />
          <event channel="defch" keywords="KERNEL_MEM_KEYWORD_MEMINFO_EX" level="win:Informational" opcode="win:Info" symbol="KERNEL_MEM_EVENT_MEMINFO_WS_V0" task="MemInfoWS" template="MemInfoWS_v0" value="2" version="0" />
          <event channel="defch" keywords="KERNEL_MEM_KEYWORD_MEMINFO_EX" level="win:Informational" opcode="win:Info" symbol="KERNEL_MEM_EVENT_MEMINFO_WS_V1" task="MemInfoWS" template="MemInfoWS_v1" value="2" version="1" />
          <event channel="defch" keywords="KERNEL_MEM_KEYWORD_MEMINFO_EX" level="win:Informational" opcode="win:Info" symbol="KERNEL_MEM_EVENT_MEMINFO_WS" task="MemInfoWS" template="MemInfoWS" value="2" version="2" />
          <event channel="defch" keywords="KERNEL_MEM_KEYWORD_MEMINFO_EX" level="win:Informational" opcode="win:Info" symbol="KERNEL_MEM_EVENT_MEMINFO_SESSIONWS_V0" task="MemInfoSessionWS" template="MemInfoSessionWS_v0" value="3" version="0" />
          <event channel="defch" keywords="KERNEL_MEM_KEYWORD_MEMINFO_EX" level="win:Informational" opcode="win:Info" symbol="KERNEL_MEM_EVENT_MEMINFO_SESSIONWS_V1" task="MemInfoSessionWS" template="MemInfoSessionWS_v1" value="3" version="1" />
          <event channel="defch" keywords="KERNEL_MEM_KEYWORD_MEMINFO_EX" level="win:Informational" opcode="win:Info" symbol="KERNEL_MEM_EVENT_MEMINFO_SESSIONWS" task="MemInfoSessionWS" template="MemInfoSessionWS" value="3" version="2" />
          <event channel="defch" keywords="KERNEL_MEM_KEYWORD_WS_SWAP" level="win:Informational" opcode="win:Start" symbol="KERNEL_MEM_EVENT_WS_OUTSWAP_START_V0" task="WorkingSetOutSwap" template="WorkingSetSwapStart_v0" value="4" version="0" />
          <event channel="defch" keywords="KERNEL_MEM_KEYWORD_WS_SWAP" level="win:Informational" opcode="win:Start" symbol="KERNEL_MEM_EVENT_WS_OUTSWAP_START" task="WorkingSetOutSwap" template="WorkingSetSwapStart" value="4" version="1" />
          <event channel="defch" keywords="KERNEL_MEM_KEYWORD_WS_SWAP" level="win:Informational" opcode="win:Stop" symbol="KERNEL_MEM_EVENT_WS_OUTSWAP_STOP_V0" task="WorkingSetOutSwap" template="WorkingSetOutSwapStop_v0" value="5" version="0" />
          <event channel="defch" keywords="KERNEL_MEM_KEYWORD_WS_SWAP" level="win:Informational" opcode="win:Stop" symbol="KERNEL_MEM_EVENT_WS_OUTSWAP_STOP" task="WorkingSetOutSwap" template="WorkingSetOutSwapStop" value="5" version="1" />
          <event channel="defch" keywords="KERNEL_MEM_KEYWORD_WS_SWAP" level="win:Informational" opcode="win:Start" symbol="KERNEL_MEM_EVENT_WS_INSWAP_START_V0" task="WorkingSetInSwap" template="WorkingSetSwapStart_v0" value="6" version="0" />
          <event channel="defch" keywords="KERNEL_MEM_KEYWORD_WS_SWAP" level="win:Informational" opcode="win:Start" symbol="KERNEL_MEM_EVENT_WS_INSWAP_START" task="WorkingSetInSwap" template="WorkingSetSwapStart" value="6" version="1" />
          <event channel="defch" keywords="KERNEL_MEM_KEYWORD_WS_SWAP" level="win:Informational" opcode="win:Stop" symbol="KERNEL_MEM_EVENT_WS_INSWAP_STOP" task="WorkingSetInSwap" template="WorkingSetInSwapStop" value="7" />
          <event channel="defch" keywords="KERNEL_MEM_KEYWORD_ACG" level="win:Informational" opcode="win:Info" symbol="KERNEL_MEM_EVENT_ACG" task="Acg" template="Acg" value="8" />
          <event channel="defch" keywords="KERNEL_MEM_KEYWORD_WS_SWAP" level="win:Informational" opcode="win:Info" symbol="KERNEL_MEM_EVENT_WS_INSWAP_STORE_FAIL" task="WorkingSetInSwap" template="WorkingSetInSwapStop" value="9" />
        </events>
      </provider>
      <provider guid="{0BF2FB94-7B60-4B4D-9766-E82F658DF540}" message="$(string.KernelShimEngineProviderName)" messageFileName="%SystemRoot%\system32\Microsoft-Windows-System-Events.dll" name="Microsoft-Windows-Kernel-ShimEngine" resourceFileName="%SystemRoot%\system32\Microsoft-Windows-System-Events.dll" symbol="KernelShimEngineProvider">
        <channels>
          <channel chid="KSHIM_DEBUG_CHANNEL" name="Microsoft-Windows-Kernel-ShimEngine/Debug" type="Debug" />
          <channel chid="KSHIM_OPERATIONAL_CHANNEL" enabled="true" isolation="System" message="$(string.KseOperationalChannel)" name="Microsoft-Windows-Kernel-ShimEngine/Operational" symbol="KSHIM_OPERATIONAL_CHANNEL" type="Operational" />
          <channel chid="KSHIM_DRIVERSCOPE_CHANNEL" name="Microsoft-Windows-Kernel-ShimEngine/Diagnostic" type="Analytic" />
        </channels>
        <keywords>
          <keyword mask="0x00001" name="ShimEngineEvents" />
          <keyword mask="0x00002" name="ShimEngineMessages" />
          <keyword mask="0x00100" name="DriverScopeGeneral" />
          <keyword mask="0x00200" name="DriverScopePnp" />
          <keyword mask="0x00400" name="DriverScopePower" />
          <keyword mask="0x00800" name="DriverScopeIrps" />
          <keyword mask="0x01000" name="DriverScopePool" />
          <keyword mask="0x02000" name="SkipDriverUnloadGeneral" />
        </keywords>
        <maps>
          <valueMap name="KSE:DriverShimApplied.ShimSourceMap">
            <map message="$(string.KseShimApplied.SourceMap.Registry)" value="0" />
            <map message="$(string.KseShimApplied.SourceMap.Sdb)" value="1" />
          </valueMap>
          <valueMap name="KSE:DeviceFlagApplied.FlagSourceMap">
            <map message="$(string.KseFlagApplied.SourceMap.Registry)" value="0" />
            <map message="$(string.KseFlagApplied.SourceMap.Sdb)" value="1" />
          </valueMap>
        </maps>
        <templates>
          <template tid="tid_KShimDebugMessage">
            <data inType="win:UInt32" name="EventId" />
            <data inType="win:AnsiString" name="DebugMessage" outType="xs:string" />
          </template>
          <template tid="tid_KSEShimAppliedEvent">
            <data inType="win:UnicodeString" name="DriverName" outType="xs:string" />
            <data inType="win:UInt32" map="KSE:DriverShimApplied.ShimSourceMap" name="ShimSource" />
            <data inType="win:UInt32" name="ShimCount" />
            <data inType="win:UnicodeString" name="AppliedGuids" outType="xs:string" />
          </template>
          <template tid="tid_KSEFlagAppliedEvent">
            <data inType="win:UnicodeString" name="DeviceName" outType="xs:string" />
            <data inType="win:UnicodeString" name="DeviceClass" outType="xs:string" />
            <data inType="win:UInt32" map="KSE:DeviceFlagApplied.FlagSourceMap" name="FlagSource" />
            <data inType="win:UInt64" name="Flags" />
          </template>
          <template tid="tid_KseDsEventDriverLoad">
            <data inType="win:UnicodeString" name="DriverName" outType="xs:string" />
            <data inType="win:Pointer" name="DriverBase" outType="win:HexInt64" />
            <data inType="win:UInt32" name="DriverSize" outType="xs:unsignedInt" />
            <data inType="win:UInt32" name="DriverTimeStamp" outType="xs:unsignedInt" />
            <data inType="win:UInt32" name="DriverCheckSum" outType="xs:unsignedInt" />
          </template>
          <template tid="tid_KseDsEventDriverUnload">
            <data inType="win:Pointer" name="DriverObject" outType="win:HexInt64" />
            <data inType="win:Pointer" name="DriverBase" outType="win:HexInt64" />
          </template>
          <template tid="tid_KseDsEventAddDevice">
            <data inType="win:Pointer" name="DriverBase" outType="win:HexInt64" />
            <data inType="win:UInt32" name="DriverSize" outType="xs:unsignedInt" />
            <data inType="win:Pointer" name="DriverObject" outType="win:HexInt64" />
            <data inType="win:Pointer" name="Pdo" outType="win:HexInt64" />
            <data inType="win:UInt32" name="Status" outType="xs:unsignedInt" />
            <data inType="win:UnicodeString" name="ServiceName" outType="xs:string" />
            <data inType="win:UnicodeString" name="HardwareId" outType="xs:string" />
          </template>
          <template tid="tid_KseDsEventPoolAllocate">
            <data inType="win:Pointer" name="Address" outType="win:HexInt64" />
            <data inType="win:Pointer" name="Caller" outType="win:HexInt64" />
            <data inType="win:UInt32" name="Type" outType="xs:unsignedInt" />
            <data inType="win:Pointer" name="Size" outType="win:HexInt64" />
            <data inType="win:UInt32" name="Tag" outType="xs:unsignedInt" />
          </template>
          <template tid="tid_KseDsEventPoolFree">
            <data inType="win:Pointer" name="Address" outType="win:HexInt64" />
            <data inType="win:Pointer" name="Caller" outType="win:HexInt64" />
            <data inType="win:UInt32" name="Tag" outType="xs:unsignedInt" />
          </template>
          <template tid="tid_KseDsEventStartIo">
            <data inType="win:Pointer" name="DriverObject" outType="win:HexInt64" />
            <data inType="win:Pointer" name="Fdo" outType="win:HexInt64" />
            <data inType="win:Pointer" name="Irp" outType="win:HexInt64" />
          </template>
          <template tid="tid_KseDsEventCreateDevice">
            <data inType="win:Pointer" name="DriverObject" outType="win:HexInt64" />
            <data inType="win:Pointer" name="Fdo" outType="win:HexInt64" />
            <data inType="win:UInt32" name="DeviceType" outType="xs:unsignedInt" />
            <data inType="win:UInt32" name="DeviceCharacteristics" outType="xs:unsignedInt" />
            <data inType="win:UInt32" name="Exclusive" outType="xs:unsignedInt" />
            <data inType="win:UInt32" name="Status" outType="xs:unsignedInt" />
          </template>
          <template tid="tid_KseDsEventDataIrp">
            <data inType="win:Pointer" name="DriverObject" outType="win:HexInt64" />
            <data inType="win:Pointer" name="Fdo" outType="win:HexInt64" />
            <data inType="win:Pointer" name="Irp" outType="win:HexInt64" />
            <data inType="win:UInt32" name="MajorCode" outType="xs:unsignedInt" />
            <data inType="win:UInt32" name="Status" outType="xs:unsignedInt" />
          </template>
          <template tid="tid_KseDsEventPnpIrp">
            <data inType="win:Pointer" name="DriverObject" outType="win:HexInt64" />
            <data inType="win:Pointer" name="Fdo" outType="win:HexInt64" />
            <data inType="win:Pointer" name="Irp" outType="win:HexInt64" />
            <data inType="win:UInt32" name="MinorCode" outType="xs:unsignedInt" />
            <data inType="win:UInt32" name="Status" outType="xs:unsignedInt" />
          </template>
          <template tid="tid_KseDsEventStartDevice">
            <data inType="win:Pointer" name="DriverObject" outType="win:HexInt64" />
            <data inType="win:Pointer" name="Fdo" outType="win:HexInt64" />
            <data inType="win:Pointer" name="Irp" outType="win:HexInt64" />
            <data inType="win:UInt32" name="Status" outType="xs:unsignedInt" />
          </template>
          <template tid="tid_KseDsEventStopDevice">
            <data inType="win:Pointer" name="DriverObject" outType="win:HexInt64" />
            <data inType="win:Pointer" name="Fdo" outType="win:HexInt64" />
            <data inType="win:Pointer" name="Irp" outType="win:HexInt64" />
            <data inType="win:UInt32" name="Status" outType="xs:unsignedInt" />
          </template>
          <template tid="tid_KseDsEventSystemPowerIrp">
            <data inType="win:Pointer" name="DriverObject" outType="win:HexInt64" />
            <data inType="win:Pointer" name="Fdo" outType="win:HexInt64" />
            <data inType="win:Pointer" name="Irp" outType="win:HexInt64" />
            <data inType="win:UInt32" name="MinorCode" outType="xs:unsignedInt" />
            <data inType="win:UInt32" name="PowerType" outType="xs:unsignedInt" />
            <data inType="win:UInt32" name="PowerState" outType="xs:unsignedInt" />
            <data inType="win:UInt32" name="Status" outType="xs:unsignedInt" />
          </template>
          <template tid="tid_KseDsEventDevicePowerIrp">
            <data inType="win:Pointer" name="DriverObject" outType="win:HexInt64" />
            <data inType="win:Pointer" name="Fdo" outType="win:HexInt64" />
            <data inType="win:Pointer" name="Irp" outType="win:HexInt64" />
            <data inType="win:UInt32" name="MinorCode" outType="xs:unsignedInt" />
            <data inType="win:UInt32" name="PowerType" outType="xs:unsignedInt" />
            <data inType="win:UInt32" name="PowerState" outType="xs:unsignedInt" />
            <data inType="win:UInt32" name="Status" outType="xs:unsignedInt" />
          </template>
          <template tid="tid_KseDsEventRequestPowerIrp">
            <data inType="win:Pointer" name="DriverObject" outType="win:HexInt64" />
            <data inType="win:Pointer" name="Fdo" outType="win:HexInt64" />
            <data inType="win:Pointer" name="Irp" outType="win:HexInt64" />
            <data inType="win:UInt32" name="MinorCode" outType="xs:unsignedInt" />
            <data inType="win:UInt32" name="PowerState" outType="xs:unsignedInt" />
            <data inType="win:UInt32" name="Status" outType="xs:unsignedInt" />
          </template>
          <template tid="tid_KseDsEventDevicePowerCompleted">
            <data inType="win:Pointer" name="DriverObject" outType="win:HexInt64" />
            <data inType="win:Pointer" name="Fdo" outType="win:HexInt64" />
            <data inType="win:Pointer" name="Irp" outType="win:HexInt64" />
            <data inType="win:UInt32" name="Status" outType="xs:unsignedInt" />
          </template>
          <template tid="tid_KseSkipDriverUnloadEventDriverLoad">
            <data inType="win:UnicodeString" name="DriverName" outType="xs:string" />
            <data inType="win:Pointer" name="DriverBase" outType="win:HexInt64" />
            <data inType="win:UInt32" name="DriverSize" outType="xs:unsignedInt" />
            <data inType="win:UInt32" name="DriverTimeStamp" outType="xs:unsignedInt" />
            <data inType="win:UInt32" name="DriverCheckSum" outType="xs:unsignedInt" />
          </template>
          <template tid="tid_KseSkipDriverUnloadEventDriverUnload">
            <data inType="win:Pointer" name="DriverObject" outType="win:HexInt64" />
            <data inType="win:Pointer" name="DriverBase" outType="win:HexInt64" />
          </template>
        </templates>
        <events>
          <event channel="KSHIM_DEBUG_CHANNEL" level="win:Error" symbol="KShimErrorMessage" template="tid_KShimDebugMessage" value="1" version="1" />
          <event channel="KSHIM_DEBUG_CHANNEL" level="win:Informational" symbol="KShimInfoMessage" template="tid_KShimDebugMessage" value="2" version="1" />
          <event channel="KSHIM_OPERATIONAL_CHANNEL" level="win:Informational" message="$(string.KseShimApplied.EventMessage)" opcode="win:Info" symbol="KseShimsApplied" template="tid_KSEShimAppliedEvent" value="3" version="1" />
          <event channel="KSHIM_OPERATIONAL_CHANNEL" level="win:Informational" message="$(string.KseFlagApplied.EventMessage)" opcode="win:Info" symbol="KseFlagsApplied" template="tid_KSEFlagAppliedEvent" value="4" version="1" />
          <event channel="KSHIM_OPERATIONAL_CHANNEL" keywords="SkipDriverUnloadGeneral" level="win:Verbose" symbol="KseSkipDriverUnloadEventDriverLoad" template="tid_KseSkipDriverUnloadEventDriverLoad" value="5" version="1" />
          <event channel="KSHIM_OPERATIONAL_CHANNEL" keywords="SkipDriverUnloadGeneral" level="win:Verbose" symbol="KseSkipDriverUnloadEventDriverUnload" template="tid_KseSkipDriverUnloadEventDriverUnload" value="6" version="1" />
          <event channel="KSHIM_DRIVERSCOPE_CHANNEL" keywords="DriverScopeGeneral" level="win:Verbose" symbol="KseDsEventDriverLoad" template="tid_KseDsEventDriverLoad" value="10" version="1" />
          <event channel="KSHIM_DRIVERSCOPE_CHANNEL" keywords="DriverScopeGeneral" level="win:Verbose" symbol="KseDsEventDriverUnload" template="tid_KseDsEventDriverUnload" value="11" version="1" />
          <event channel="KSHIM_DRIVERSCOPE_CHANNEL" keywords="DriverScopeGeneral" level="win:Verbose" symbol="KseDsEventAddDevice" template="tid_KseDsEventAddDevice" value="12" version="1" />
          <event channel="KSHIM_DRIVERSCOPE_CHANNEL" keywords="DriverScopePool" level="win:Verbose" symbol="KseDsEventPoolAllocate" template="tid_KseDsEventPoolAllocate" value="13" version="1" />
          <event channel="KSHIM_DRIVERSCOPE_CHANNEL" keywords="DriverScopePool" level="win:Verbose" symbol="KseDsEventPoolFree" template="tid_KseDsEventPoolFree" value="14" version="1" />
          <event channel="KSHIM_DRIVERSCOPE_CHANNEL" keywords="DriverScopeIrps" level="win:Verbose" symbol="KseDsEventStartIo" template="tid_KseDsEventStartIo" value="15" version="1" />
          <event channel="KSHIM_DRIVERSCOPE_CHANNEL" keywords="DriverScopeGeneral" level="win:Verbose" symbol="KseDsEventCreateDevice" template="tid_KseDsEventCreateDevice" value="16" version="1" />
          <event channel="KSHIM_DRIVERSCOPE_CHANNEL" keywords="DriverScopeIrps" level="win:Verbose" symbol="KseDsEventDataIrp" template="tid_KseDsEventDataIrp" value="17" version="1" />
          <event channel="KSHIM_DRIVERSCOPE_CHANNEL" keywords="DriverScopePnp" level="win:Verbose" symbol="KseDsEventPnpIrp" template="tid_KseDsEventPnpIrp" value="18" version="1" />
          <event channel="KSHIM_DRIVERSCOPE_CHANNEL" keywords="DriverScopePnp" level="win:Verbose" symbol="KseDsEventStartDevice" template="tid_KseDsEventStartDevice" value="19" version="1" />
          <event channel="KSHIM_DRIVERSCOPE_CHANNEL" keywords="DriverScopePnp" level="win:Verbose" symbol="KseDsEventStopDevice" template="tid_KseDsEventStopDevice" value="20" version="1" />
          <event channel="KSHIM_DRIVERSCOPE_CHANNEL" keywords="DriverScopePower" level="win:Verbose" symbol="KseDsEventSystemPowerIrp" template="tid_KseDsEventSystemPowerIrp" value="21" version="1" />
          <event channel="KSHIM_DRIVERSCOPE_CHANNEL" keywords="DriverScopePower" level="win:Verbose" symbol="KseDsEventDevicePowerIrp" template="tid_KseDsEventDevicePowerIrp" value="22" version="1" />
          <event channel="KSHIM_DRIVERSCOPE_CHANNEL" keywords="DriverScopePower" level="win:Verbose" symbol="KseDsEventRequestPowerIrp" template="tid_KseDsEventRequestPowerIrp" value="23" version="1" />
          <event channel="KSHIM_DRIVERSCOPE_CHANNEL" keywords="DriverScopePower" level="win:Verbose" symbol="KseDsEventDevicePowerCompleted" template="tid_KseDsEventDevicePowerCompleted" value="24" version="1" />
        </events>
      </provider>
      <provider guid="{f5528ada-be5f-4f14-8aef-a95de7281161}" message="$(string.LicensingStartServiceTrigger.ProviderName)" messageFileName="%systemroot%\system32\Microsoft-Windows-System-Events.dll" name="Microsoft-Windows-Kernel-Licensing-StartServiceTrigger" resourceFileName="%systemroot%\system32\Microsoft-Windows-System-Events.dll" symbol="MS_Windows_LicensingStartServiceTrigger_Provider">
        <events>
          <event level="win:Informational" symbol="LicensingStartServiceTrigger" value="1" />
        </events>
      </provider>
      <provider guid="{a103cabd-8242-4a93-8df5-1cdf3b3f26a6}" messageFileName="%systemroot%\system32\Microsoft-Windows-System-Events.dll" name="Microsoft-Windows-Kernel-IoTrace" resourceFileName="%systemroot%\system32\Microsoft-Windows-System-Events.dll" symbol="IoTraceProvider">
        <channels>
          <channel chid="defch" name="Microsoft-Windows-Kernel-IoTrace/Diagnostic" type="Analytic" />
        </channels>
        <tasks>
          <task name="UserInitiatedIo" value="1" />
          <task name="KernelIo" value="2" />
          <task name="ActivityIdTransfer" value="3" />
        </tasks>
        <events>
          <event channel="defch" level="win:Informational" opcode="win:Info" symbol="IoTrace_UserInitiatedIo" task="UserInitiatedIo" value="1" />
          <event channel="defch" level="win:Verbose" opcode="win:Info" symbol="IoTrace_KernelIo_AllocateIrp" task="KernelIo" value="2" />
          <event channel="defch" level="win:Verbose" opcode="win:Info" symbol="IoTrace_KernelIo_ReuseIrp" task="KernelIo" value="3" />
          <event channel="defch" level="win:Informational" opcode="win:Info" symbol="IoTrace_ActivityIdTransfer" task="ActivityIdTransfer" value="4" />
        </events>
      </provider>
      <provider guid="{F1EF270A-0D32-4352-BA52-DBAB41E1D859}" message="$(string.AppModelRuntime.ProviderName)" messageFileName="%SystemRoot%\system32\Microsoft-Windows-System-Events.dll" name="Microsoft-Windows-AppModel-Runtime" resourceFileName="%SystemRoot%\system32\Microsoft-Windows-System-Events.dll" symbol="AppModelRuntimeProviderId">
        <channels>
          <importChannel chid="Application" name="Application" />
          <channel chid="AppModelRuntime" enabled="false" message="$(string.AppModelRuntime.ChannelName)" name="Microsoft-Windows-AppModel-Runtime/Analytic" type="Analytic" />
          <channel chid="AppModelRuntimeAdmin" enabled="true" name="Microsoft-Windows-AppModel-Runtime/Admin" type="Admin" />
          <channel chid="AppModelRuntimeDebug" enabled="false" name="Microsoft-Windows-AppModel-Runtime/Debug" type="Debug" />
          <channel chid="AppModelRuntimePerf" enabled="false" name="Microsoft-Windows-AppModel-Runtime/Diagnostics" type="Analytic" />
        </channels>
        <keywords>
          <keyword mask="0x1" message="$(string.AppModelRuntime.Keyword.Process)" name="Process" symbol="APPMODEL_RUNTIME_KEYWORD_PROCESS" />
          <keyword mask="0x2" message="$(string.AppModelRuntime.Keyword.AppContainer)" name="AppContainer" symbol="APPMODEL_RUNTIME_KEYWORD_AppContainer" />
        </keywords>
        <tasks>
          <task name="AppModelProcessStart" value="1" />
          <task name="AppIntegrityDependencyGraphCheck" value="2" />
          <task name="AppIntegrityProcessCreation" value="3" />
          <task name="AppIntegrityInAppValidatePackage" value="4" />
          <task name="AppModelDynamicPropertiesReadFailed" value="5" />
          <task name="AppModelDynamicPropertiesInvalid" value="6" />
          <task name="RestrictedAppContainerCreation" value="100" />
          <task name="RestrictedAppContainerDeletion" value="101" />
          <task name="RestrictedAppContainerOpen" value="102" />
          <task name="RestrictedAppContainerEnumeration" value="103" />
          <task name="RestrictedAppContainerLaunch" value="104" />
          <task name="RestrictedAppContainerTerminateAll" value="105" />
          <task name="AppContainerCreation" value="201" />
          <task name="AppContainerDeletion" value="202" />
          <task name="AppContainerUpdate" value="203" />
          <task name="FirewallAppContainerCreation" value="204" />
          <task name="FirewallAppContainerDeletion" value="205" />
        </tasks>
        <templates>
          <template tid="tid_AppModelProcessStart">
            <data inType="win:UInt32" name="ProcessID" outType="win:PID" />
            <data inType="win:FILETIME" name="CreateTime" outType="xs:dateTime" />
            <data inType="win:UInt32" name="ParentProcessID" outType="win:PID" />
            <data inType="win:UnicodeString" name="PackageFullName" outType="xs:string" />
            <data inType="win:UnicodeString" name="ImageName" outType="xs:string" />
            <data inType="win:UnicodeString" name="PackageRelativeApplicationId" outType="xs:string" />
          </template>
          <template tid="tid_AppModelProcessStartFailure">
            <data inType="win:UnicodeString" name="PackageFullName" outType="xs:string" />
            <data inType="win:UInt32" name="ErrorCode" outType="win:HexInt32" />
            <data inType="win:UnicodeString" name="ErrorMessage" outType="xs:string" />
          </template>
          <template tid="tid_AppModelLibraryLoadFailure">
            <data inType="win:UnicodeString" name="PackageFullName" outType="xs:string" />
            <data inType="win:UInt32" name="ErrorCode" outType="win:HexInt32" />
            <data inType="win:UnicodeString" name="FailedBinary" />
          </template>
          <template tid="tid_AppModelGenericLibraryLoadFailure">
            <data inType="win:UInt32" name="ErrorCode" outType="win:HexInt32" />
          </template>
          <template tid="tid_AppModelRuntimeDMRCorrupt">
            <data inType="win:UnicodeString" name="FileName" />
            <data inType="win:Int32" name="ErrorCode" />
            <data inType="win:UInt64" name="Size" />
            <data inType="win:UInt32" name="Offset" />
            <data inType="win:Pointer" name="HeaderAddr" />
            <data inType="win:UnicodeString" name="Section" />
            <data inType="win:UInt32" name="ProcessId" outType="win:PID" />
          </template>
          <template tid="tid_AppModelRuntimeDMRSectionNotFound">
            <data inType="win:UnicodeString" name="FileName" />
            <data inType="win:Int32" name="ErrorCode" />
            <data inType="win:UInt64" name="Size" />
            <data inType="win:Pointer" name="HeaderAddr" />
            <data inType="win:UnicodeString" name="Section" />
            <data inType="win:UInt32" name="ProcessId" outType="win:PID" />
          </template>
          <template tid="tid_AppModelRuntimeDMRApplicationNotFound">
            <data inType="win:UnicodeString" name="FileName" />
            <data inType="win:Int32" name="ErrorCode" />
            <data inType="win:UInt64" name="Size" />
            <data inType="win:Pointer" name="HeaderAddr" />
            <data inType="win:UnicodeString" name="ApplicationUserModelId" />
            <data inType="win:UInt32" name="ProcessId" outType="win:PID" />
          </template>
          <template tid="tid_AppModelRuntimeDMRGetApplicationIdentityFailed">
            <data inType="win:UnicodeString" name="FileName" />
            <data inType="win:Int32" name="ErrorCode" />
            <data inType="win:UInt64" name="Size" />
            <data inType="win:Pointer" name="HeaderAddr" />
            <data inType="win:UInt32" name="ProcessId" outType="win:PID" />
          </template>
          <template tid="tid_AppModelRuntimeDMROpenFailed">
            <data inType="win:UnicodeString" name="FileName" />
            <data inType="win:Int32" name="ErrorCode" />
            <data inType="win:UInt32" name="ProcessId" outType="win:PID" />
          </template>
          <template tid="tid_AppModelRuntimeDMRExceptionDuringLoad">
            <data inType="win:UnicodeString" name="FileName" />
            <data inType="win:Int32" name="ExceptionCode" />
          </template>
          <template tid="tid_AppModelAppContainerFailureWithContext">
            <data inType="win:UInt32" name="ErrorCode" outType="win:HexInt32" />
            <data inType="win:UnicodeString" name="Context" outType="xs:string" />
          </template>
          <template tid="tid_AppModelAppContainerWin32FailureWithContext">
            <data inType="win:UInt32" name="ErrorCode" />
            <data inType="win:UnicodeString" name="Context" outType="xs:string" />
          </template>
          <template tid="tid_AppModelAppContainerFailureNoContext">
            <data inType="win:UInt32" name="ErrorCode" outType="win:HexInt32" />
          </template>
          <template tid="tid_AppModelAppContainerSuccess">
            <data inType="win:UnicodeString" name="AppContainerName" outType="xs:string" />
          </template>
          <template tid="tid_AppIntegrityRuntimeCheckInformation">
            <data inType="win:UnicodeString" name="PackageFullName" outType="xs:string" />
          </template>
          <template tid="tid_AppIntegrityRuntimeCheckInformationWithErrorCode">
            <data inType="win:UInt32" name="ErrorCode" />
            <data inType="win:UnicodeString" name="PackageFullName" outType="xs:string" />
          </template>
          <template tid="tid_AppModelDynamicPropertiesReadFailed">
            <data inType="win:UInt32" name="ErrorCode" outType="win:HexInt32" />
            <data inType="win:UnicodeString" name="Resource" outType="xs:string" />
          </template>
          <template tid="tid_AppModelDynamicPropertiesInvalid">
            <data inType="win:UInt32" name="ErrorCode" outType="win:HexInt32" />
            <data inType="win:UnicodeString" name="Resource" outType="xs:string" />
          </template>
          <template tid="tid_AppModelPackageStatusGetFailed">
            <data inType="win:UInt32" name="ErrorCode" outType="win:HexInt32" />
            <data inType="win:UnicodeString" name="PackageFullName" outType="xs:string" />
          </template>
          <template tid="tid_AppModelPackageStatusGetForUserFailed">
            <data inType="win:UInt32" name="ErrorCode" outType="win:HexInt32" />
            <data inType="win:UnicodeString" name="PackageFullName" outType="xs:string" />
            <data inType="win:SID" name="User" outType="xs:string" />
          </template>
          <template tid="tid_AppModelPackageStatusUpdateFailed">
            <data inType="win:UInt32" name="ErrorCode" outType="win:HexInt32" />
            <data inType="win:UnicodeString" name="PackageFullName" outType="xs:string" />
            <data inType="win:UInt32" name="DesiredStatus" outType="win:HexInt32" />
            <data inType="win:UInt32" name="CurrentStatus" outType="win:HexInt32" />
          </template>
          <template tid="tid_AppModelPackageStatusUpdated">
            <data inType="win:UnicodeString" name="PackageFullName" outType="xs:string" />
            <data inType="win:UInt32" name="DesiredStatus" outType="win:HexInt32" />
            <data inType="win:UInt32" name="CurrentStatus" outType="win:HexInt32" />
          </template>
          <template tid="tid_AppModelPackageStatusUpdateForUserFailed">
            <data inType="win:UInt32" name="ErrorCode" outType="win:HexInt32" />
            <data inType="win:UnicodeString" name="PackageFullName" outType="xs:string" />
            <data inType="win:SID" name="User" outType="xs:string" />
            <data inType="win:UInt32" name="DesiredStatus" outType="win:HexInt32" />
            <data inType="win:UInt32" name="CurrentStatus" outType="win:HexInt32" />
          </template>
          <template tid="tid_AppModelPackageStatusUpdatedForUser">
            <data inType="win:UnicodeString" name="PackageFullName" outType="xs:string" />
            <data inType="win:SID" name="User" outType="xs:string" />
            <data inType="win:UInt32" name="DesiredStatus" outType="win:HexInt32" />
            <data inType="win:UInt32" name="CurrentStatus" outType="win:HexInt32" />
          </template>
          <template tid="tid_AppModelPackageStatusVersionIncrementFailed">
            <data inType="win:UInt32" name="ErrorCode" outType="win:HexInt32" />
            <data inType="win:UnicodeString" name="Context" outType="xs:string" />
          </template>
        </templates>
        <events>
          <event channel="AppModelRuntime" keywords="Process" level="win:Informational" message="$(string.AppModelRuntime.Event.ProcessStart)" symbol="AppModelProcessStart" template="tid_AppModelProcessStart" value="1" />
          <event channel="AppModelRuntimeAdmin" keywords="Process ms:Measures" level="win:Error" message="$(string.AppModelRuntime.Event.ProcessStartFailureCheckpointStart)" symbol="AppModelProcessStartFailureCheckpointStart" template="tid_AppModelProcessStartFailure" value="2" />
          <event channel="AppModelRuntimeAdmin" keywords="Process ms:Measures" level="win:Error" message="$(string.AppModelRuntime.Event.ProcessStartFailureCheckpointLicenseCheck)" symbol="AppModelProcessStartFailureCheckpointLicenseCheck" template="tid_AppModelProcessStartFailure" value="3" />
          <event channel="AppModelRuntimeAdmin" keywords="Process ms:Measures" level="win:Error" message="$(string.AppModelRuntime.Event.ProcessStartFailureCheckpointPreCreationExtension)" symbol="AppModelProcessStartFailureCheckpointPreCreationExtension" template="tid_AppModelProcessStartFailure" value="4" />
          <event channel="AppModelRuntimeAdmin" keywords="Process ms:Measures" level="win:Error" message="$(string.AppModelRuntime.Event.ProcessStartFailureCheckpointPackageStatusCheckUser)" symbol="AppModelProcessStartFailureCheckpointPackageStatusCheckUser" template="tid_AppModelProcessStartFailure" value="5" />
          <event channel="AppModelRuntimeAdmin" keywords="Process ms:Measures" level="win:Error" message="$(string.AppModelRuntime.Event.ProcessStartFailureCheckpointPackageStatusCheckMachine)" symbol="AppModelProcessStartFailureCheckpointPackageStatusCheckMachine" template="tid_AppModelProcessStartFailure" value="6" />
          <event channel="AppModelRuntimeAdmin" keywords="Process" level="win:Error" message="$(string.AppModelRuntime.Event.ProcessStartFailureIsAppContainer)" symbol="AppModelProcessStartFailureCheckpointIsAppContainer" template="tid_AppModelProcessStartFailure" value="7" />
          <event channel="AppModelRuntimeAdmin" keywords="Process" level="win:Error" message="$(string.AppModelRuntime.Event.ActivationLogRemediationApplicationBinary)" symbol="AppModelLibraryLoadFailureApplicationBinary" template="tid_AppModelLibraryLoadFailure" value="8" />
          <event channel="Application" keywords="Process" level="win:Error" message="$(string.AppModelRuntime.Event.ActivationLogRemediationSystemBinary)" symbol="AppModelLibraryLoadFailureSystemBinary" template="tid_AppModelLibraryLoadFailure" value="9" />
          <event channel="AppModelRuntimeAdmin" keywords="Process" level="win:Warning" message="$(string.AppModelRuntime.Event.ActivationLogRemediationNgenBinary)" symbol="AppModelLibraryLoadFailureNgenBinary" template="tid_AppModelLibraryLoadFailure" value="11" />
          <event channel="AppModelRuntimeAdmin" keywords="Process" level="win:Warning" message="$(string.AppModelRuntime.Event.ActivationLogRemediationGenericErrorNoTermination)" symbol="AppModelGenericLibraryLoadFailureNoTermination" template="tid_AppModelGenericLibraryLoadFailure" value="12" />
          <event channel="AppModelRuntimeAdmin" keywords="Process" level="win:Error" message="$(string.AppModelRuntime.Event.DMRCorrupt)" symbol="AppModelRuntimeDMRCorrupt" template="tid_AppModelRuntimeDMRCorrupt" value="14" />
          <event channel="AppModelRuntimeAdmin" keywords="Process" level="win:Error" message="$(string.AppModelRuntime.Event.DMRSectionNotFound)" symbol="AppModelRuntimeDMRSectionNotFound" template="tid_AppModelRuntimeDMRSectionNotFound" value="15" />
          <event channel="AppModelRuntimeAdmin" keywords="Process" level="win:Error" message="$(string.AppModelRuntime.Event.DMRDuplicateSectionFound)" symbol="AppModelRuntimeDMRDuplicateSectionFound" template="tid_AppModelRuntimeDMRCorrupt" value="16" />
          <event channel="AppModelRuntimeAdmin" keywords="Process" level="win:Error" message="$(string.AppModelRuntime.Event.DMRUnknownSectionFound)" symbol="AppModelRuntimeDMRUnknownSectionFound" template="tid_AppModelRuntimeDMRCorrupt" value="17" />
          <event channel="AppModelRuntimeAdmin" keywords="Process" level="win:Error" message="$(string.AppModelRuntime.Event.DMROpenFailed)" symbol="AppModelRuntimeDMROpenFailed" template="tid_AppModelRuntimeDMROpenFailed" value="18" />
          <event channel="AppModelRuntimeAdmin" keywords="Process" level="win:Error" message="$(string.AppModelRuntime.Event.DMRExceptionDuringLoad)" symbol="AppModelRuntimeDMRExceptionDuringLoad" template="tid_AppModelRuntimeDMRExceptionDuringLoad" value="19" />
          <event channel="AppModelRuntimeAdmin" keywords="Process ms:Measures" level="win:Error" message="$(string.AppModelRuntime.Event.ProcessStartFailureCheckpointLoadPackageRuntimeInformation)" symbol="AppModelProcessStartFailureCheckpointLoadPackageRuntimeInformation" template="tid_AppModelProcessStartFailure" value="20" />
          <event channel="AppModelRuntimeAdmin" keywords="AppContainer ms:Measures" level="win:Error" message="$(string.AppModelRuntime.Event.CreateAppContainerFailure)" symbol="AppModelCreateAppContainerFailure" template="tid_AppModelAppContainerFailureWithContext" value="21" />
          <event channel="AppModelRuntimeAdmin" keywords="AppContainer" level="win:Error" message="$(string.AppModelRuntime.Event.DeleteAppContainerFailure)" symbol="AppModelDeleteAppContainerFailure" template="tid_AppModelAppContainerFailureWithContext" value="22" />
          <event channel="AppModelRuntimeAdmin" keywords="AppContainer" level="win:Error" message="$(string.AppModelRuntime.Event.UpdateAppContainerFailure)" symbol="AppModelUpdateAppContainerFailure" template="tid_AppModelAppContainerFailureWithContext" value="23" />
          <event channel="AppModelRuntimeAdmin" keywords="AppContainer" level="win:Error" message="$(string.AppModelRuntime.Event.AppContainerCreateRegistryKeyFailure)" symbol="AppModelAppContainerCreateRegistryKeyFailure" template="tid_AppModelAppContainerFailureWithContext" value="24" />
          <event channel="AppModelRuntimeAdmin" keywords="AppContainer" level="win:Error" message="$(string.AppModelRuntime.Event.AppContainerSetRegistryKeySecurityFailure)" symbol="AppModelAppContainerSetRegistryKeySecurityFailure" template="tid_AppModelAppContainerFailureWithContext" value="25" />
          <event channel="AppModelRuntimeAdmin" keywords="AppContainer" level="win:Error" message="$(string.AppModelRuntime.Event.AppContainerDeletegistryKeyFailure)" symbol="AppModelAppContainerDeleteRegistryKeyFailure" template="tid_AppModelAppContainerFailureWithContext" value="26" />
          <event channel="AppModelRuntimeAdmin" keywords="AppContainer" level="win:Error" message="$(string.AppModelRuntime.Event.AppContainerCreateFolderFailure)" symbol="AppModelAppContainerCreateFolderFailure" template="tid_AppModelAppContainerFailureWithContext" value="27" />
          <event channel="AppModelRuntimeAdmin" keywords="AppContainer" level="win:Error" message="$(string.AppModelRuntime.Event.AppContainerSetFolderAttributesFailure)" symbol="AppModelAppContainerSetFolderAttributesFailure" template="tid_AppModelAppContainerFailureWithContext" value="28" />
          <event channel="AppModelRuntimeAdmin" keywords="AppContainer" level="win:Error" message="$(string.AppModelRuntime.Event.AppContainerVerifyRegistryKeyFailure)" symbol="AppModelAppContainerVerifyRegistryKeyFailure" template="tid_AppModelAppContainerFailureWithContext" value="29" />
          <event channel="AppModelRuntimeAdmin" keywords="AppContainer" level="win:Error" message="$(string.AppModelRuntime.Event.AppContainerVerifyFolderFailure)" symbol="AppModelAppContainerVerifyFolderFailure" template="tid_AppModelAppContainerFailureWithContext" value="30" />
          <event channel="AppModelRuntimeAdmin" keywords="AppContainer" level="win:Error" message="$(string.AppModelRuntime.Event.AppContainerGetAppDataFolderFailure)" symbol="AppModelAppContainerGetAppDataFolderFailure" template="tid_AppModelAppContainerFailureNoContext" value="31" />
          <event channel="AppModelRuntimeAdmin" keywords="AppContainer" level="win:Error" message="$(string.AppModelRuntime.Event.AppContainerDeleteFolderFailure)" symbol="AppModelAppContainerDeleteFolderFailure" template="tid_AppModelAppContainerFailureWithContext" value="32" />
          <event channel="AppModelRuntimeAdmin" keywords="AppContainer" level="win:Error" message="$(string.AppModelRuntime.Event.AppContainerNameFailure)" symbol="AppModelAppContainerGetNameFailure" template="tid_AppModelAppContainerFailureNoContext" value="33" />
          <event channel="AppModelRuntimeAdmin" keywords="AppContainer" level="win:Error" message="$(string.AppModelRuntime.Event.AppContainerDisplayNameFailure)" symbol="AppModelAppContainerGetDisplayNameFailure" template="tid_AppModelAppContainerFailureNoContext" value="34" />
          <event channel="AppModelRuntimeAdmin" keywords="AppContainer" level="win:Error" message="$(string.AppModelRuntime.Event.AppContainerRegisterFirewallFailure)" symbol="AppModelAppContainerRegisterFirewallFailure" template="tid_AppModelAppContainerFailureNoContext" value="35" />
          <event channel="AppModelRuntimeAdmin" keywords="AppContainer" level="win:Error" message="$(string.AppModelRuntime.Event.AppContainerUnregisterFirewallFailure)" symbol="AppModelAppContainerUnregisterFirewallFailure" template="tid_AppModelAppContainerFailureNoContext" value="36" />
          <event channel="AppModelRuntimeAdmin" keywords="AppContainer" level="win:Error" message="$(string.AppModelRuntime.Event.AppContainerRegisterSidFailure)" symbol="AppModelAppContainerRegisterSidFailure" template="tid_AppModelAppContainerFailureNoContext" value="37" />
          <event channel="AppModelRuntimeAdmin" keywords="AppContainer" level="win:Error" message="$(string.AppModelRuntime.Event.AppContainerUnregisterSidFailure)" symbol="AppModelAppContainerUnregisterSidFailure" template="tid_AppModelAppContainerFailureNoContext" value="38" />
          <event channel="AppModelRuntimeAdmin" keywords="AppContainer" level="win:Informational" message="$(string.AppModelRuntime.Event.AppContainerCreationSuccess)" symbol="AppModelAppContainerCreationSuccess" template="tid_AppModelAppContainerSuccess" value="39" />
          <event channel="AppModelRuntimeAdmin" keywords="AppContainer" level="win:Informational" message="$(string.AppModelRuntime.Event.AppContainerAlreadyExists)" symbol="AppModelAppContainerAlreadyExists" template="tid_AppModelAppContainerSuccess" value="40" />
          <event channel="AppModelRuntimeAdmin" keywords="AppContainer" level="win:Informational" message="$(string.AppModelRuntime.Event.AppContainerDeletionSuccess)" symbol="AppModelAppContainerDeletionSuccess" template="tid_AppModelAppContainerSuccess" value="41" />
          <event channel="AppModelRuntimeAdmin" keywords="AppContainer" level="win:Informational" message="$(string.AppModelRuntime.Event.AppContainerUpdateSuccess)" symbol="AppModelAppContainerUpdateSuccess" template="tid_AppModelAppContainerSuccess" value="42" />
          <event channel="AppModelRuntimeAdmin" keywords="Process" level="win:Error" message="$(string.AppModelRuntime.Event.DMRApplicationNotFound)" symbol="AppModelRuntimeDMRApplicationNotFound" template="tid_AppModelRuntimeDMRApplicationNotFound" value="43" />
          <event channel="AppModelRuntimeAdmin" keywords="Process" level="win:Error" message="$(string.AppModelRuntime.Event.DMRGetApplicationIdentityFailed)" symbol="AppModelRuntimeDMRGetApplicationIdentityFailed" template="tid_AppModelRuntimeDMRGetApplicationIdentityFailed" value="44" />
          <event channel="AppModelRuntimeAdmin" keywords="Process" level="win:Error" message="$(string.AppModelRuntime.Event.RestrictedClientApplicationInfoRetrievalFailed)" symbol="AppModelRuntimeRestrictedClientApplicationInfoRetrievalFailed" template="tid_AppModelAppContainerFailureWithContext" value="45" />
          <event channel="AppModelRuntimeAdmin" keywords="Process" level="win:Error" message="$(string.AppModelRuntime.Event.RestrictedClientApplicationAllInfoRetrievalFailed)" symbol="AppModelRuntimeRestrictedClientApplicationAllInfoRetrievalFailed" template="tid_AppModelAppContainerFailureNoContext" value="46" />
          <event channel="AppModelRuntimeAdmin" keywords="Process" level="win:Error" message="$(string.AppModelRuntime.Event.RestrictedClientApplicationInfoRetrievalFailedBadCaller)" symbol="AppModelRuntimeRestrictedClientApplicationInfoRetrievalFailedBadCaller" template="tid_AppModelAppContainerFailureNoContext" value="47" />
          <event channel="AppModelRuntimeAdmin" keywords="Process" level="win:Error" message="$(string.AppModelRuntime.Event.RestrictedAppContainerEventArgsCreationFailed)" symbol="AppModelRuntimeRestrictedAppContainerEventArgsCreationFailed" template="tid_AppModelAppContainerFailureWithContext" value="48" />
          <event channel="AppModelRuntimeAdmin" keywords="Process" level="win:Error" message="$(string.AppModelRuntime.Event.RestrictedAppContainerActivationFailed)" symbol="AppModelRuntimeRestrictedAppContainerActivationFailed" template="tid_AppModelAppContainerFailureWithContext" value="49" />
          <event channel="AppModelRuntimeAdmin" keywords="Process" level="win:Error" message="$(string.AppModelRuntime.Event.RestrictedAppContainerInvalidCapability)" symbol="AppModelRuntimeRestrictedAppContainerInvalidCapability" template="tid_AppModelAppContainerFailureWithContext" value="50" />
          <event channel="AppModelRuntimeAdmin" keywords="Process" level="win:Error" message="$(string.AppModelRuntime.Event.RestrictedCapabilitiesOpenFailed)" symbol="AppModelRuntimeRestrictedCapabilitiesOpenFailed" template="tid_AppModelAppContainerFailureWithContext" value="51" />
          <event channel="AppModelRuntimeAdmin" keywords="Process" level="win:Error" message="$(string.AppModelRuntime.Event.CreateRestrictedCapabilitiesValueFailed)" symbol="AppModelRuntimeCreateRestrictedCapabilitiesValueFailed" template="tid_AppModelAppContainerFailureWithContext" value="52" />
          <event channel="AppModelRuntimeAdmin" keywords="Process" level="win:Informational" message="$(string.AppModelRuntime.Event.AppIntegrityPackageValidationRequired)" symbol="AppModelRuntimeAppIntegrityPackageValidationRequired" template="tid_AppIntegrityRuntimeCheckInformation" value="53" />
          <event channel="AppModelRuntimeAdmin" keywords="Process" level="win:Error" message="$(string.AppModelRuntime.Event.AppIntegrityPackageModified)" symbol="AppModelRuntimeAppIntegrityPackageModified" template="tid_AppIntegrityRuntimeCheckInformation" value="54" />
          <event channel="AppModelRuntimeAdmin" keywords="Process" level="win:Error" message="$(string.AppModelRuntime.Event.AppIntegrityProcessTerminationFailed)" symbol="AppModelRuntimeAppIntegrityProcessTerminationFailed" template="tid_AppIntegrityRuntimeCheckInformation" value="55" />
          <event channel="AppModelRuntimeAdmin" keywords="Process" level="win:Informational" message="$(string.AppModelRuntime.Event.AppIntegrityValidationSuccessful)" symbol="AppModelRuntimeAppIntegrityValidationSuccessful" template="tid_AppIntegrityRuntimeCheckInformation" value="56" />
          <event channel="AppModelRuntimeAdmin" keywords="Process" level="win:Error" message="$(string.AppModelRuntime.Event.AppIntegrityFailedToQueryDirectoryTrustState)" symbol="AppModelRuntimeAppIntegrityFailedToQueryDirectoryTrustState" template="tid_AppIntegrityRuntimeCheckInformationWithErrorCode" value="57" />
          <event channel="AppModelRuntimeAdmin" keywords="Process" level="win:Error" message="$(string.AppModelRuntime.Event.AppIntegrityInfrastructureFailure)" symbol="AppModelRuntimeAppIntegrityInfrastructureFailure" template="tid_AppIntegrityRuntimeCheckInformationWithErrorCode" value="58" />
          <event channel="AppModelRuntimeAdmin" keywords="Process" level="win:Error" message="$(string.AppModelRuntime.Event.AppIntegrityAppTerminated)" symbol="AppModelRuntimeAppIntegrityAppTerminated" template="tid_AppIntegrityRuntimeCheckInformationWithErrorCode" value="59" />
          <event channel="AppModelRuntimeAdmin" keywords="Process" level="win:Error" message="$(string.AppModelRuntime.Event.AppIntegrityCheckTimedOut)" symbol="AppModelRuntimeAppIntegrityCheckTimedOut" template="tid_AppIntegrityRuntimeCheckInformation" value="60" />
          <event channel="AppModelRuntimeAdmin" keywords="Process ms:Measures" level="win:Error" message="$(string.AppModelRuntime.Event.ProcessStartFailureCheckpointAppIntegrityCheck)" symbol="AppModelProcessStartFailureCheckpointAppIntegrityCheck" template="tid_AppModelProcessStartFailure" value="61" />
          <event channel="AppModelRuntimeAdmin" keywords="Process" level="win:Error" message="$(string.AppModelRuntime.Event.IntegrityServerPackageValidationFailed)" symbol="AppModelRuntimeServerPackageValidationFailed" template="tid_AppIntegrityRuntimeCheckInformationWithErrorCode" value="62" />
          <event channel="AppModelRuntimeAdmin" keywords="Process" level="win:Error" message="$(string.AppModelRuntime.Event.DynamicPropertiesReadFailed)" symbol="AppModelDynamicPropertiesReadFailed" template="tid_AppModelDynamicPropertiesReadFailed" value="63" />
          <event channel="AppModelRuntimeAdmin" keywords="Process" level="win:Error" message="$(string.AppModelRuntime.Event.DynamicPropertiesInvalid)" symbol="AppModelDynamicPropertiesInvalid" template="tid_AppModelDynamicPropertiesInvalid" value="64" />
          <event channel="AppModelRuntimeAdmin" keywords="Process" level="win:Error" message="$(string.AppModelRuntime.Event.PackageStatusGetFailed)" symbol="AppModelPackageStatusGetFailed" template="tid_AppModelPackageStatusGetFailed" value="65" />
          <event channel="AppModelRuntimeAdmin" keywords="Process" level="win:Error" message="$(string.AppModelRuntime.Event.PackageStatusGetForUserFailed)" symbol="AppModelPackageStatusGetForUserFailed" template="tid_AppModelPackageStatusGetForUserFailed" value="66" />
          <event channel="AppModelRuntimeAdmin" keywords="Process ms:Measures" level="win:Error" message="$(string.AppModelRuntime.Event.PackageStatusUpdateFailed)" symbol="AppModelPackageStatusUpdateFailed" template="tid_AppModelPackageStatusUpdateFailed" value="67" />
          <event channel="AppModelRuntimeAdmin" keywords="Process ms:Measures" level="win:Informational" message="$(string.AppModelRuntime.Event.PackageStatusUpdated)" symbol="AppModelPackageStatusUpdated" template="tid_AppModelPackageStatusUpdated" value="68" />
          <event channel="AppModelRuntimeAdmin" keywords="Process ms:Measures" level="win:Error" message="$(string.AppModelRuntime.Event.PackageStatusUpdateForUserFailed)" symbol="AppModelPackageStatusUpdateForUserFailed" template="tid_AppModelPackageStatusUpdateForUserFailed" value="69" />
          <event channel="AppModelRuntimeAdmin" keywords="Process ms:Measures" level="win:Informational" message="$(string.AppModelRuntime.Event.PackageStatusUpdatedForUser)" symbol="AppModelPackageStatusUpdatedForUser" template="tid_AppModelPackageStatusUpdatedForUser" value="70" />
          <event channel="AppModelRuntimeAdmin" keywords="Process ms:Measures" level="win:Error" message="$(string.AppModelRuntime.Event.PackageStatusVersionIncrementFailed)" symbol="AppModelPackageStatusVersionIncrementFailed" template="tid_AppModelPackageStatusVersionIncrementFailed" value="71" />
          <event channel="AppModelRuntimeDebug" keywords="Process" level="win:Informational" message="$(string.AppModelRuntime.Event.PackageStatusVersionIncremented)" symbol="AppModelPackageStatusVersionIncremented" value="72" />
          <event channel="AppModelRuntimeAdmin" keywords="Process" level="win:Error" message="$(string.AppModelRuntime.Event.ProcessStartFailureCheckpointAppDataCreation)" symbol="AppModelProcessStartFailureCheckpointAppDataCreation" template="tid_AppModelProcessStartFailure" value="73" />
          <event channel="AppModelRuntimePerf" keywords="AppContainer" level="win:Informational" message="$(string.AppModelRuntime.Event.AppContainerCreationStart)" opcode="win:Start" symbol="AppModelAppContainerCreationStart" task="AppContainerCreation" template="tid_AppModelAppContainerSuccess" value="101" />
          <event channel="AppModelRuntimePerf" keywords="AppContainer" level="win:Informational" message="$(string.AppModelRuntime.Event.AppContainerCreationStop)" opcode="win:Stop" symbol="AppModelAppContainerCreationStop" task="AppContainerCreation" template="tid_AppModelAppContainerFailureWithContext" value="102" />
          <event channel="AppModelRuntimePerf" keywords="AppContainer" level="win:Informational" message="$(string.AppModelRuntime.Event.AppContainerDeletionStart)" opcode="win:Start" symbol="AppModelAppContainerDeletionStart" task="AppContainerDeletion" template="tid_AppModelAppContainerSuccess" value="103" />
          <event channel="AppModelRuntimePerf" keywords="AppContainer" level="win:Informational" message="$(string.AppModelRuntime.Event.AppContainerDeletionStop)" opcode="win:Stop" symbol="AppModelAppContainerDeletionStop" task="AppContainerDeletion" template="tid_AppModelAppContainerFailureWithContext" value="104" />
          <event channel="AppModelRuntimePerf" keywords="AppContainer" level="win:Informational" message="$(string.AppModelRuntime.Event.AppContainerUpdateStart)" opcode="win:Start" symbol="AppModelAppContainerUpdateStart" task="AppContainerUpdate" template="tid_AppModelAppContainerSuccess" value="105" />
          <event channel="AppModelRuntimePerf" keywords="AppContainer" level="win:Informational" message="$(string.AppModelRuntime.Event.AppContainerUpdateStop)" opcode="win:Stop" symbol="AppModelAppContainerUpdateStop" task="AppContainerUpdate" template="tid_AppModelAppContainerFailureWithContext" value="106" />
          <event channel="AppModelRuntimePerf" keywords="AppContainer" level="win:Informational" message="$(string.AppModelRuntime.Event.FirewallAppContainerCreationStart)" opcode="win:Start" symbol="AppModelFirewallAppContainerCreationStart" task="FirewallAppContainerCreation" template="tid_AppModelAppContainerSuccess" value="107" />
          <event channel="AppModelRuntimePerf" keywords="AppContainer" level="win:Informational" message="$(string.AppModelRuntime.Event.FirewallAppContainerCreationStop)" opcode="win:Stop" symbol="AppModelFirewallAppContainerCreationStop" task="FirewallAppContainerCreation" template="tid_AppModelAppContainerWin32FailureWithContext" value="108" />
          <event channel="AppModelRuntimePerf" keywords="AppContainer" level="win:Informational" message="$(string.AppModelRuntime.Event.FirewallAppContainerDeletionStart)" opcode="win:Start" symbol="AppModelFirewallAppContainerDeletionStart" task="FirewallAppContainerDeletion" template="tid_AppModelAppContainerSuccess" value="109" />
          <event channel="AppModelRuntimePerf" keywords="AppContainer" level="win:Informational" message="$(string.AppModelRuntime.Event.FirewallAppContainerDeletionStop)" opcode="win:Stop" symbol="AppModelFirewallAppContainerDeletionStop" task="FirewallAppContainerDeletion" template="tid_AppModelAppContainerWin32FailureWithContext" value="110" />
          <event channel="AppModelRuntimePerf" keywords="AppContainer" level="win:Informational" message="$(string.AppModelRuntime.Event.RestrictedAppContainerCreationStart)" opcode="win:Start" symbol="AppModelRestrictedAppContainerCreationStart" task="RestrictedAppContainerCreation" template="tid_AppModelAppContainerSuccess" value="111" />
          <event channel="AppModelRuntimePerf" keywords="AppContainer" level="win:Informational" message="$(string.AppModelRuntime.Event.RestrictedAppContainerCreationStop)" opcode="win:Stop" symbol="AppModelRestrictedAppContainerCreationStop" task="RestrictedAppContainerCreation" template="tid_AppModelAppContainerWin32FailureWithContext" value="112" />
          <event channel="AppModelRuntimePerf" keywords="AppContainer" level="win:Informational" message="$(string.AppModelRuntime.Event.RestrictedAppContainerDeletionStart)" opcode="win:Start" symbol="AppModelRestrictedAppContainerDeletionStart" task="RestrictedAppContainerDeletion" template="tid_AppModelAppContainerSuccess" value="113" />
          <event channel="AppModelRuntimePerf" keywords="AppContainer" level="win:Informational" message="$(string.AppModelRuntime.Event.RestrictedAppContainerDeletionStop)" opcode="win:Stop" symbol="AppModelRestrictedAppContainerDeletionStop" task="RestrictedAppContainerDeletion" template="tid_AppModelAppContainerWin32FailureWithContext" value="114" />
          <event channel="AppModelRuntimePerf" keywords="AppContainer" level="win:Informational" message="$(string.AppModelRuntime.Event.RestrictedAppContainerOpenStart)" opcode="win:Start" symbol="AppModelRestrictedAppContainerOpenStart" task="RestrictedAppContainerOpen" template="tid_AppModelAppContainerSuccess" value="115" />
          <event channel="AppModelRuntimePerf" keywords="AppContainer" level="win:Informational" message="$(string.AppModelRuntime.Event.RestrictedAppContainerOpenStop)" opcode="win:Stop" symbol="AppModelRestrictedAppContainerOpenStop" task="RestrictedAppContainerOpen" template="tid_AppModelAppContainerWin32FailureWithContext" value="116" />
          <event channel="AppModelRuntimePerf" keywords="AppContainer" level="win:Informational" message="$(string.AppModelRuntime.Event.RestrictedAppContainerFindAllStart)" opcode="win:Start" symbol="AppModelRestrictedAppContainerFindAllStart" task="RestrictedAppContainerEnumeration" template="tid_AppModelAppContainerSuccess" value="117" />
          <event channel="AppModelRuntimePerf" keywords="AppContainer" level="win:Informational" message="$(string.AppModelRuntime.Event.RestrictedAppContainerFindAllStop)" opcode="win:Stop" symbol="AppModelRestrictedAppContainerFindAllStop" task="RestrictedAppContainerEnumeration" template="tid_AppModelAppContainerWin32FailureWithContext" value="118" />
          <event channel="AppModelRuntimePerf" keywords="AppContainer" level="win:Informational" message="$(string.AppModelRuntime.Event.RestrictedAppContainerLaunchStart)" opcode="win:Start" symbol="AppModelRestrictedAppContainerLaunchStart" task="RestrictedAppContainerLaunch" template="tid_AppModelAppContainerSuccess" value="119" />
          <event channel="AppModelRuntimePerf" keywords="AppContainer" level="win:Informational" message="$(string.AppModelRuntime.Event.RestrictedAppContainerLaunchStop)" opcode="win:Stop" symbol="AppModelRestrictedAppContainerLaunchStop" task="RestrictedAppContainerLaunch" template="tid_AppModelAppContainerWin32FailureWithContext" value="120" />
          <event channel="AppModelRuntimePerf" keywords="AppContainer" level="win:Informational" message="$(string.AppModelRuntime.Event.RestrictedAppContainerTerminateAllStart)" opcode="win:Start" symbol="AppModelRestrictedAppContainerTerminateAllStart" task="RestrictedAppContainerTerminateAll" template="tid_AppModelAppContainerSuccess" value="121" />
          <event channel="AppModelRuntimePerf" keywords="AppContainer" level="win:Informational" message="$(string.AppModelRuntime.Event.RestrictedAppContainerTerminateAllStop)" opcode="win:Stop" symbol="AppModelRestrictedAppContainerTerminateAllStop" task="RestrictedAppContainerTerminateAll" template="tid_AppModelAppContainerWin32FailureWithContext" value="122" />
          <event channel="AppModelRuntimePerf" keywords="Process" level="win:Informational" message="$(string.AppModelRuntime.Event.AppIntegrityDependencyGraphCheckStart)" opcode="win:Start" symbol="AppIntegrityDependencyGraphCheckStart" task="AppIntegrityDependencyGraphCheck" template="tid_AppIntegrityRuntimeCheckInformation" value="123" />
          <event channel="AppModelRuntimePerf" keywords="Process" level="win:Informational" message="$(string.AppModelRuntime.Event.AppIntegrityDependencyGraphCheckStop)" opcode="win:Stop" symbol="AppIntegrityDependencyGraphCheckStop" task="AppIntegrityDependencyGraphCheck" template="tid_AppIntegrityRuntimeCheckInformationWithErrorCode" value="124" />
          <event channel="AppModelRuntimePerf" keywords="Process" level="win:Informational" message="$(string.AppModelRuntime.Event.AppIntegrityProcessCreationStart)" opcode="win:Start" symbol="AppIntegrityProcessCreationStart" task="AppIntegrityProcessCreation" template="tid_AppIntegrityRuntimeCheckInformation" value="125" />
          <event channel="AppModelRuntimePerf" keywords="Process" level="win:Informational" message="$(string.AppModelRuntime.Event.AppIntegrityProcessCreationStop)" opcode="win:Stop" symbol="AppIntegrityProcessCreationStop" task="AppIntegrityProcessCreation" template="tid_AppIntegrityRuntimeCheckInformationWithErrorCode" value="126" />
          <event channel="AppModelRuntimePerf" keywords="Process" level="win:Informational" message="$(string.AppModelRuntime.Event.AppIntegrityInAppValidatePackageStart)" opcode="win:Start" symbol="AppIntegrityInAppValidatePackageStart" task="AppIntegrityInAppValidatePackage" template="tid_AppIntegrityRuntimeCheckInformation" value="127" />
          <event channel="AppModelRuntimePerf" keywords="Process" level="win:Informational" message="$(string.AppModelRuntime.Event.AppIntegrityInAppValidatePackageStop)" opcode="win:Stop" symbol="AppIntegrityInAppValidatePackageStop" task="AppIntegrityInAppValidatePackage" template="tid_AppIntegrityRuntimeCheckInformationWithErrorCode" value="128" />
        </events>
      </provider>
      <provider guid="{BFF15E13-81BF-45EE-8B16-7CFEAD00DA86}" message="$(string.AppModelState.ProviderName)" messageFileName="%SystemRoot%\system32\Microsoft-Windows-System-Events.dll" name="Microsoft-Windows-AppModel-State" resourceFileName="%SystemRoot%\system32\Microsoft-Windows-System-Events.dll" symbol="StateManagerProviderId">
        <channels>
          <importChannel chid="Application" name="Application" />
          <channel chid="StateManagerDebug" enabled="false" message="$(string.AppModelState.ChannelName.Debug)" name="Microsoft-Windows-AppModel-State/Debug" type="Debug" />
          <channel chid="StateManagerPerf" enabled="false" message="$(string.AppModelState.ChannelName.Perf)" name="Microsoft-Windows-AppModel-State/Diagnostic" type="Analytic" />
        </channels>
        <keywords>
          <keyword mask="0x1" message="$(string.AppModelState.Keyword.Structured)" name="Structured" symbol="APPMODELSTATE_STRUCTURED_KEYWORD" />
          <keyword mask="0x2" message="$(string.AppModelState.Keyword.UnstructuredReset)" name="UnstructuredReset" symbol="APPMODELSTATE_UNSTRUCTUREDRESET_KEYWORD" />
          <keyword mask="0x4" message="$(string.AppModelState.Keyword.OutOfMemory)" name="OutOfMemory" symbol="APPMODELSTATE_OUTOFMEMORY_KEYWORD" />
          <keyword mask="0x8" message="$(string.AppModelState.Keyword.ApiSetError)" name="ApiSetError" symbol="APPMODELSTATE_APISETERROR_KEYWORD" />
          <keyword mask="0x10" message="$(string.AppModelState.Keyword.WinRT)" name="WinRT" symbol="APPMODELSTATE_WINRT_KEYWORD" />
          <keyword mask="0x20" message="$(string.AppModelState.Keyword.DataStoreError)" name="DataStoreError" symbol="APPMODELSTATE_DATASTOREERROR_KEYWORD" />
        </keywords>
        <tasks>
          <task name="AppModel.Task.State.WriteSetting" symbol="Task_State_WriteSetting" value="1" />
          <task name="AppModel.Task.State.ReadSetting" symbol="Task_State_ReadSetting" value="2" />
          <task name="AppModel.Task.State.DeleteSetting" symbol="Task_State_DeleteSetting" value="3" />
          <task name="AppModel.Task.State.WriteSettingInAtom" symbol="Task_State_WriteSettingInAtom" value="4" />
          <task name="AppModel.Task.State.ReadSettingInAtom" symbol="Task_State_ReadSettingInAtom" value="5" />
          <task name="AppModel.Task.State.DeleteSettingInAtom" symbol="Task_State_DeleteSettingInAtom" value="6" />
          <task name="AppModel.Task.State.CommitAtom" symbol="Task_State_CommitAtom" value="7" />
          <task name="AppModel.Task.State.LoadAppHive" symbol="Task_State_LoadAppHive" value="8" />
          <task name="AppModel.Task.StateWinRT.AppDataFactory_Activation" symbol="Task_StateWinRT_AppDataFactory_Activation" value="100" />
          <task name="AppModel.Task.StateWinRT.ApplicationDataServer_Lifespan" symbol="Task_StateWinRT_ApplicationDataServer_Lifespan" value="101" />
          <task name="AppModel.Task.StateWinRT.ApplicationDataServer_GetVersion" symbol="Task_StateWinRT_ApplicationDataServer_GetVersion" value="102" />
          <task name="AppModel.Task.StateWinRT.ApplicationDataServer_SetVersion" symbol="Task_StateWinRT_ApplicationDataServer_SetVersion" value="103" />
          <task name="AppModel.Task.StateWinRT.ApplicationDataServer_RoamingStorageQuota" symbol="Task_StateWinRT_ApplicationDataServer_RoamingStorageQuota" value="104" />
          <task name="AppModel.Task.StateWinRT.ApplicationDataServer_RoamingStorageUsage" symbol="Task_StateWinRT_ApplicationDataServer_RoamingStorageUsage" value="105" />
          <task name="AppModel.Task.StateWinRT.ApplicationDataServer_ActivateContainerServer" symbol="Task_StateWinRT_ApplicationDataServer_ActivateContainerServer" value="106" />
          <task name="AppModel.Task.StateWinRT.ApplicationDataServer_ActivateFileItemServer" symbol="Task_StateWinRT_ApplicationDataServer_ActivateFileItemServer" value="107" />
          <task name="AppModel.Task.StateWinRT.ApplicationDataContainerServer_Lifespan" symbol="Task_StateWinRT_ApplicationDataContainerServer_Lifespan" value="108" />
          <task name="AppModel.Task.StateWinRT.ApplicationDataContainerServer_GetValues" symbol="Task_StateWinRT_ApplicationDataContainerServer_GetValues" value="109" />
          <task name="AppModel.Task.StateWinRT.ApplicationDataContainerServer_GetContainers" symbol="Task_StateWinRT_ApplicationDataContainerServer_GetContainers" value="110" />
          <task name="AppModel.Task.StateWinRT.ApplicationDataContainerServer_CreateContainer" symbol="Task_StateWinRT_ApplicationDataContainerServer_CreateContainer" value="111" />
          <task name="AppModel.Task.StateWinRT.ApplicationDataContainerServer_DeleteContainer" symbol="Task_StateWinRT_ApplicationDataContainerServer_DeleteContainer" value="112" />
          <task name="AppModel.Task.StateWinRT.ApplicationDataContainerSettingsServer_Lifespan" symbol="Task_StateWinRT_ApplicationDataContainerSettingsServer_Lifespan" value="113" />
          <task name="AppModel.Task.StateWinRT.ApplicationDataContainerSettingsServer_Lookup" symbol="Task_StateWinRT_ApplicationDataContainerSettingsServer_Lookup" value="114" />
          <task name="AppModel.Task.StateWinRT.ApplicationDataContainerSettingsServer_Size" symbol="Task_StateWinRT_ApplicationDataContainerSettingsServer_Size" value="115" />
          <task name="AppModel.Task.StateWinRT.ApplicationDataContainerSettingsServer_HasKey" symbol="Task_StateWinRT_ApplicationDataContainerSettingsServer_HasKey" value="116" />
          <task name="AppModel.Task.StateWinRT.ApplicationDataContainerSettingsServer_GetView" symbol="Task_StateWinRT_ApplicationDataContainerSettingsServer_GetView" value="117" />
          <task name="AppModel.Task.StateWinRT.ApplicationDataContainerSettingsServer_Insert" symbol="Task_StateWinRT_ApplicationDataContainerSettingsServer_Insert" value="118" />
          <task name="AppModel.Task.StateWinRT.ApplicationDataContainerSettingsServer_Remove" symbol="Task_StateWinRT_ApplicationDataContainerSettingsServer_Remove" value="119" />
          <task name="AppModel.Task.StateWinRT.ApplicationDataContainerSettingsServer_Clear" symbol="Task_StateWinRT_ApplicationDataContainerSettingsServer_Clear" value="120" />
          <task name="AppModel.Task.StateWinRT.ApplicationDataContainerSettingsServer_First" symbol="Task_StateWinRT_ApplicationDataContainerSettingsServer_First" value="121" />
          <task name="AppModel.Task.StateWinRT.ApplicationDataCompositeValueServer_Lifespan" symbol="Task_StateWinRT_ApplicationDataCompositeValueServer_Lifespan" value="122" />
          <task name="AppModel.Task.StateWinRT.ApplicationDataCompositeValueServer_Lookup" symbol="Task_StateWinRT_ApplicationDataCompositeValueServer_Lookup" value="123" />
          <task name="AppModel.Task.StateWinRT.ApplicationDataCompositeValueServer_Size" symbol="Task_StateWinRT_ApplicationDataCompositeValueServer_Size" value="124" />
          <task name="AppModel.Task.StateWinRT.ApplicationDataCompositeValueServer_HasKey" symbol="Task_StateWinRT_ApplicationDataCompositeValueServer_HasKey" value="125" />
          <task name="AppModel.Task.StateWinRT.ApplicationDataCompositeValueServer_GetView" symbol="Task_StateWinRT_ApplicationDataCompositeValueServer_GetView" value="126" />
          <task name="AppModel.Task.StateWinRT.ApplicationDataCompositeValueServer_Insert" symbol="Task_StateWinRT_ApplicationDataCompositeValueServer_Insert" value="127" />
          <task name="AppModel.Task.StateWinRT.ApplicationDataCompositeValueServer_Remove" symbol="Task_StateWinRT_ApplicationDataCompositeValueServer_Remove" value="128" />
          <task name="AppModel.Task.StateWinRT.ApplicationDataCompositeValueServer_Clear" symbol="Task_StateWinRT_ApplicationDataCompositeValueServer_Clear" value="129" />
          <task name="AppModel.Task.StateWinRT.ApplicationDataCompositeValueServer_First" symbol="Task_StateWinRT_ApplicationDataCompositeValueServer_First" value="130" />
          <task name="AppModel.Task.StateWinRT.RoamingRpcSignal" symbol="Task_StateWinRT_RoamingRpcSignal" value="131" />
          <task name="AppModel.Task.StateWinRT.DataChangedEventDispatch" symbol="Task_StateWinRT_DataChangedEventDispatch" value="132" />
          <task name="AppModel.Task.StateWinRT.TempCleanup" symbol="Task_State_TempCleanup" value="133" />
          <task name="AppModel.Task.StateWinRT.ApplicationDataServer_ForUser" symbol="Task_StateWinRT_ApplicationDataServer_ForUser" value="134" />
        </tasks>
        <templates>
          <template tid="GenericInformational">
            <data inType="win:UnicodeString" name="InformationalString" />
          </template>
          <template tid="GenericError">
            <data inType="win:UnicodeString" name="ErrorString" />
            <data inType="win:Int32" name="Error" />
          </template>
          <template tid="FolderInstantiationError">
            <data inType="win:UnicodeString" name="FolderString" />
            <data inType="win:UnicodeString" name="PackageString" />
            <data inType="win:Int32" name="Error" />
          </template>
          <template tid="StateUpdateRequiredEvent">
            <data inType="win:UnicodeString" name="PackageString" />
            <data inType="win:UnicodeString" name="UserSid" />
            <data inType="win:Int32" name="Error" />
          </template>
        </templates>
        <events>
          <event channel="StateManagerDebug" keywords="UnstructuredReset" level="win:Informational" message="$(string.AppModelState.Event.DeleteFileError)" symbol="APPMODELSTATE_DELETE_FILE_ERROR_EVENT" template="GenericError" value="1" />
          <event channel="StateManagerDebug" keywords="UnstructuredReset" level="win:Informational" message="$(string.AppModelState.Event.DeleteDirectoryError)" symbol="APPMODELSTATE_DELETE_DIRECTORY_ERROR_EVENT" template="GenericError" value="2" />
          <event channel="StateManagerDebug" keywords="OutOfMemory" level="win:Error" message="$(string.AppModelState.Event.OutOfMemory)" symbol="APPMODELSTATE_OUT_OF_MEMORY_EVENT" value="3" />
          <event channel="StateManagerDebug" keywords="ApiSetError" level="win:Error" message="$(string.AppModelState.Event.ApiSetError)" symbol="APPMODELSTATE_APISETERROR_EVENT" template="GenericError" value="4" />
          <event channel="StateManagerDebug" keywords="DataStoreError" level="win:Error" message="$(string.AppModelState.Event.DataStoreError)" symbol="APPMODELSTATE_DATASTOREERROR_EVENT" template="GenericError" value="5" />
          <event channel="StateManagerDebug" level="win:Informational" message="$(string.AppModelState.Event.TempCleanup.Skipped)" symbol="APPMODELSTATE_TEMPCLEANUP_SKIPPED_EVENT" value="6" />
          <event channel="StateManagerDebug" level="win:Informational" message="$(string.AppModelState.Event.TempCleanup.Completed)" symbol="APPMODELSTATE_TEMPCLEANUP_COMPLETED_EVENT" value="7" />
          <event channel="StateManagerDebug" level="win:Error" message="$(string.AppModelState.Event.TempCleanup.ProfileError)" symbol="APPMODELSTATE_TEMPCLEANUP_PROFILEERROR_EVENT" template="GenericError" value="8" />
          <event channel="StateManagerDebug" level="win:Error" message="$(string.AppModelState.Event.TempCleanup.Aborted)" symbol="APPMODELSTATE_TEMPCLEANUP_ABORTED_EVENT" value="9" />
          <event channel="Application" level="win:Error" message="$(string.AppModelState.Event.AppHiveLoad.Error)" symbol="APPMODELSTATE_APPHIVELOAD_ERROR_EVENT" template="GenericError" value="10" />
          <event channel="Application" level="win:Error" message="$(string.AppModelState.Event.ReadSetting.Error)" symbol="APPMODELSTATE_READSETTING_ERROR_EVENT" template="GenericError" value="11" />
          <event channel="Application" level="win:Error" message="$(string.AppModelState.Event.WriteSetting.Error)" symbol="APPMODELSTATE_WRITESETTING_ERROR_EVENT" template="GenericError" value="12" />
          <event channel="Application" level="win:Error" message="$(string.AppModelState.Event.StorageFolderInstantiation.Error)" symbol="APPLICATIONSTATE_STORAGEFOLDERINSTANTIATIONERROR_EVENT" template="FolderInstantiationError" value="13" />
          <event channel="StateManagerDebug" level="win:Informational" message="$(string.AppModelState.Event.UpdateRequired.SchemaNotFound)" symbol="APPLICATIONSTATE_UPDATEREQUIRED_SCHEMANOTFOUND_EVENT" template="StateUpdateRequiredEvent" value="14" />
          <event channel="StateManagerDebug" level="win:Informational" message="$(string.AppModelState.Event.UpdateRequired.PackageNotFound)" symbol="APPLICATIONSTATE_UPDATEREQUIRED_PACKAGENOTFOUND_EVENT" template="StateUpdateRequiredEvent" value="15" />
          <event channel="StateManagerDebug" level="win:Informational" message="$(string.AppModelState.Event.UpdateRequired.PackageNameChanged)" symbol="APPLICATIONSTATE_UPDATEREQUIRED_PACKAGENAMECHANGED_EVENT" template="StateUpdateRequiredEvent" value="16" />
          <event channel="StateManagerDebug" level="win:Informational" message="$(string.AppModelState.Event.UpdateRequired.SchemaChanged)" symbol="APPLICATIONSTATE_UPDATEREQUIRED_SCHEMACHANGED_EVENT" template="StateUpdateRequiredEvent" value="17" />
          <event channel="StateManagerDebug" level="win:Informational" message="$(string.AppModelState.Event.FixStateLocationsAccess.Succeeded)" symbol="APPLICATIONSTATE_FIXSTATELOCATIONS_SUCCEEDED_EVENT" template="GenericInformational" value="18" />
          <event channel="StateManagerDebug" level="win:Error" message="$(string.AppModelState.Event.FixStateLocationsAccess.Failed)" symbol="APPLICATIONSTATE_FIXSTATELOCATIONS_FAILED_EVENT" template="GenericError" value="19" />
          <event channel="StateManagerPerf" keywords="Structured win:ResponseTime" level="win:Informational" opcode="win:Start" symbol="APPMODELSTATE_WRITE_SETTING_START" task="AppModel.Task.State.WriteSetting" value="50" />
          <event channel="StateManagerPerf" keywords="Structured win:ResponseTime" level="win:Informational" opcode="win:Stop" symbol="APPMODELSTATE_WRITE_SETTING_STOP" task="AppModel.Task.State.WriteSetting" value="51" />
          <event channel="StateManagerPerf" keywords="Structured win:ResponseTime" level="win:Informational" opcode="win:Start" symbol="APPMODELSTATE_READ_SETTING_START" task="AppModel.Task.State.ReadSetting" value="60" />
          <event channel="StateManagerPerf" keywords="Structured win:ResponseTime" level="win:Informational" opcode="win:Stop" symbol="APPMODELSTATE_READ_SETTING_STOP" task="AppModel.Task.State.ReadSetting" value="61" />
          <event channel="StateManagerPerf" keywords="Structured win:ResponseTime" level="win:Informational" opcode="win:Start" symbol="APPMODELSTATE_DELETE_SETTING_START" task="AppModel.Task.State.DeleteSetting" value="70" />
          <event channel="StateManagerPerf" keywords="Structured win:ResponseTime" level="win:Informational" opcode="win:Stop" symbol="APPMODELSTATE_DELETE_SETTING_STOP" task="AppModel.Task.State.DeleteSetting" value="71" />
          <event channel="StateManagerPerf" keywords="Structured win:ResponseTime" level="win:Informational" opcode="win:Start" symbol="APPMODELSTATE_WRITE_SETTING_IN_ATOM_START" task="AppModel.Task.State.WriteSettingInAtom" value="80" />
          <event channel="StateManagerPerf" keywords="Structured win:ResponseTime" level="win:Informational" opcode="win:Stop" symbol="APPMODELSTATE_WRITE_SETTING_IN_ATOM_STOP" task="AppModel.Task.State.WriteSettingInAtom" value="81" />
          <event channel="StateManagerPerf" keywords="Structured win:ResponseTime" level="win:Informational" opcode="win:Start" symbol="APPMODELSTATE_READ_SETTING_IN_ATOM_START" task="AppModel.Task.State.ReadSettingInAtom" value="90" />
          <event channel="StateManagerPerf" keywords="Structured win:ResponseTime" level="win:Informational" opcode="win:Stop" symbol="APPMODELSTATE_READ_SETTING_IN_ATOM_STOP" task="AppModel.Task.State.ReadSettingInAtom" value="91" />
          <event channel="StateManagerPerf" keywords="Structured win:ResponseTime" level="win:Informational" opcode="win:Start" symbol="APPMODELSTATE_DELETE_SETTING_IN_ATOM_START" task="AppModel.Task.State.DeleteSettingInAtom" value="100" />
          <event channel="StateManagerPerf" keywords="Structured win:ResponseTime" level="win:Informational" opcode="win:Stop" symbol="APPMODELSTATE_DELETE_SETTING_IN_ATOM_STOP" task="AppModel.Task.State.DeleteSettingInAtom" value="101" />
          <event channel="StateManagerPerf" keywords="Structured win:ResponseTime" level="win:Informational" opcode="win:Start" symbol="APPMODELSTATE_COMMIT_ATOM_START" task="AppModel.Task.State.CommitAtom" value="110" />
          <event channel="StateManagerPerf" keywords="Structured win:ResponseTime" level="win:Informational" opcode="win:Stop" symbol="APPMODELSTATE_COMMIT_ATOM_STOP" task="AppModel.Task.State.CommitAtom" value="111" />
          <event channel="StateManagerPerf" keywords="Structured win:ResponseTime" level="win:Informational" opcode="win:Start" symbol="APPMODELSTATE_LOAD_APPHIVE_START" task="AppModel.Task.State.LoadAppHive" value="120" />
          <event channel="StateManagerPerf" keywords="Structured win:ResponseTime" level="win:Informational" opcode="win:Stop" symbol="APPMODELSTATE_LOAD_APPHIVE_STOP" task="AppModel.Task.State.LoadAppHive" value="121" />
          <event channel="StateManagerPerf" keywords="WinRT win:ResponseTime" level="win:Informational" opcode="win:Start" symbol="APPMODELSTATE_WINRT_APPDATAFACTORY_ACTIVATE_START" task="AppModel.Task.StateWinRT.AppDataFactory_Activation" value="150" />
          <event channel="StateManagerPerf" keywords="WinRT win:ResponseTime" level="win:Informational" opcode="win:Stop" symbol="APPMODELSTATE_WINRT_APPDATAFACTORY_ACTIVATE_STOP" task="AppModel.Task.StateWinRT.AppDataFactory_Activation" value="151" />
          <event channel="StateManagerPerf" keywords="WinRT win:ResponseTime" level="win:Informational" opcode="win:Start" symbol="APPMODELSTATE_WINRT_APPLICATIONDATASERVER_LIFESPAN_START" task="AppModel.Task.StateWinRT.ApplicationDataServer_Lifespan" value="160" />
          <event channel="StateManagerPerf" keywords="WinRT win:ResponseTime" level="win:Informational" opcode="win:Stop" symbol="APPMODELSTATE_WINRT_APPLICATIONDATASERVER_LIFESPAN_STOP" task="AppModel.Task.StateWinRT.ApplicationDataServer_Lifespan" value="161" />
          <event channel="StateManagerPerf" keywords="WinRT win:ResponseTime" level="win:Informational" opcode="win:Start" symbol="APPMODELSTATE_WINRT_APPLICATIONDATASERVER_GETVERSION_START" task="AppModel.Task.StateWinRT.ApplicationDataServer_GetVersion" value="170" />
          <event channel="StateManagerPerf" keywords="WinRT win:ResponseTime" level="win:Informational" opcode="win:Stop" symbol="APPMODELSTATE_WINRT_APPLICATIONDATASERVER_GETVERSION_STOP" task="AppModel.Task.StateWinRT.ApplicationDataServer_GetVersion" value="171" />
          <event channel="StateManagerPerf" keywords="WinRT win:ResponseTime" level="win:Informational" opcode="win:Start" symbol="APPMODELSTATE_WINRT_APPLICATIONDATASERVER_SETVERSION_START" task="AppModel.Task.StateWinRT.ApplicationDataServer_SetVersion" value="180" />
          <event channel="StateManagerPerf" keywords="WinRT win:ResponseTime" level="win:Informational" opcode="win:Stop" symbol="APPMODELSTATE_WINRT_APPLICATIONDATASERVER_SETVERSION_STOP" task="AppModel.Task.StateWinRT.ApplicationDataServer_SetVersion" value="181" />
          <event channel="StateManagerPerf" keywords="WinRT win:ResponseTime" level="win:Informational" opcode="win:Start" symbol="APPMODELSTATE_WINRT_APPLICATIONDATASERVER_ROAMINGSTORAGEQUOTA_START" task="AppModel.Task.StateWinRT.ApplicationDataServer_RoamingStorageQuota" value="190" />
          <event channel="StateManagerPerf" keywords="WinRT win:ResponseTime" level="win:Informational" opcode="win:Stop" symbol="APPMODELSTATE_WINRT_APPLICATIONDATASERVER_ROAMINGSTORAGEQUOTA_STOP" task="AppModel.Task.StateWinRT.ApplicationDataServer_RoamingStorageQuota" value="191" />
          <event channel="StateManagerPerf" keywords="WinRT win:ResponseTime" level="win:Informational" opcode="win:Start" symbol="APPMODELSTATE_WINRT_APPLICATIONDATASERVER_ACTIVATECONTAINERSERVER_START" task="AppModel.Task.StateWinRT.ApplicationDataServer_ActivateContainerServer" value="210" />
          <event channel="StateManagerPerf" keywords="WinRT win:ResponseTime" level="win:Informational" opcode="win:Stop" symbol="APPMODELSTATE_WINRT_APPLICATIONDATASERVER_ACTIVATECONTAINERSERVER_STOP" task="AppModel.Task.StateWinRT.ApplicationDataServer_ActivateContainerServer" value="211" />
          <event channel="StateManagerPerf" keywords="WinRT win:ResponseTime" level="win:Informational" opcode="win:Start" symbol="APPMODELSTATE_WINRT_APPLICATIONDATASERVER_ACTIVATEFILEITEMSERVER_START" task="AppModel.Task.StateWinRT.ApplicationDataServer_ActivateFileItemServer" value="220" />
          <event channel="StateManagerPerf" keywords="WinRT win:ResponseTime" level="win:Informational" opcode="win:Stop" symbol="APPMODELSTATE_WINRT_APPLICATIONDATASERVER_ACTIVATEFILEITEMSERVER_STOP" task="AppModel.Task.StateWinRT.ApplicationDataServer_ActivateFileItemServer" value="221" />
          <event channel="StateManagerPerf" keywords="WinRT win:ResponseTime" level="win:Informational" opcode="win:Start" symbol="APPMODELSTATE_WINRT_APPLICATIONDATACONTAINERSERVER_LIFESPAN_START" task="AppModel.Task.StateWinRT.ApplicationDataContainerServer_Lifespan" value="230" />
          <event channel="StateManagerPerf" keywords="WinRT win:ResponseTime" level="win:Informational" opcode="win:Stop" symbol="APPMODELSTATE_WINRT_APPLICATIONDATACONTAINERSERVER_LIFESPAN_STOP" task="AppModel.Task.StateWinRT.ApplicationDataContainerServer_Lifespan" value="231" />
          <event channel="StateManagerPerf" keywords="WinRT win:ResponseTime" level="win:Informational" opcode="win:Start" symbol="APPMODELSTATE_WINRT_APPLICATIONDATACONTAINERSERVER_GETVALUES_START" task="AppModel.Task.StateWinRT.ApplicationDataContainerServer_GetValues" value="240" />
          <event channel="StateManagerPerf" keywords="WinRT win:ResponseTime" level="win:Informational" opcode="win:Stop" symbol="APPMODELSTATE_WINRT_APPLICATIONDATACONTAINERSERVER_GETVALUES_STOP" task="AppModel.Task.StateWinRT.ApplicationDataContainerServer_GetValues" value="241" />
          <event channel="StateManagerPerf" keywords="WinRT win:ResponseTime" level="win:Informational" opcode="win:Start" symbol="APPMODELSTATE_WINRT_APPLICATIONDATACONTAINERSERVER_GETCONTAINERS_START" task="AppModel.Task.StateWinRT.ApplicationDataContainerServer_GetContainers" value="250" />
          <event channel="StateManagerPerf" keywords="WinRT win:ResponseTime" level="win:Informational" opcode="win:Stop" symbol="APPMODELSTATE_WINRT_APPLICATIONDATACONTAINERSERVER_GETCONTAINERS_STOP" task="AppModel.Task.StateWinRT.ApplicationDataContainerServer_GetContainers" value="251" />
          <event channel="StateManagerPerf" keywords="WinRT win:ResponseTime" level="win:Informational" opcode="win:Start" symbol="APPMODELSTATE_WINRT_APPLICATIONDATACONTAINERSERVER_CREATECONTAINER_START" task="AppModel.Task.StateWinRT.ApplicationDataContainerServer_CreateContainer" value="260" />
          <event channel="StateManagerPerf" keywords="WinRT win:ResponseTime" level="win:Informational" opcode="win:Stop" symbol="APPMODELSTATE_WINRT_APPLICATIONDATACONTAINERSERVER_CREATECONTAINER_STOP" task="AppModel.Task.StateWinRT.ApplicationDataContainerServer_CreateContainer" value="261" />
          <event channel="StateManagerPerf" keywords="WinRT win:ResponseTime" level="win:Informational" opcode="win:Start" symbol="APPMODELSTATE_WINRT_APPLICATIONDATACONTAINERSERVER_DELETECONTAINER_START" task="AppModel.Task.StateWinRT.ApplicationDataContainerServer_DeleteContainer" value="270" />
          <event channel="StateManagerPerf" keywords="WinRT win:ResponseTime" level="win:Informational" opcode="win:Stop" symbol="APPMODELSTATE_WINRT_APPLICATIONDATACONTAINERSERVER_DELETECONTAINER_STOP" task="AppModel.Task.StateWinRT.ApplicationDataContainerServer_DeleteContainer" value="271" />
          <event channel="StateManagerPerf" keywords="WinRT win:ResponseTime" level="win:Informational" opcode="win:Start" symbol="APPMODELSTATE_WINRT_APPLICATIONDATACONTAINERSETTINGSSERVER_LIFESPAN_START" task="AppModel.Task.StateWinRT.ApplicationDataContainerSettingsServer_Lifespan" value="280" />
          <event channel="StateManagerPerf" keywords="WinRT win:ResponseTime" level="win:Informational" opcode="win:Stop" symbol="APPMODELSTATE_WINRT_APPLICATIONDATACONTAINERSETTINGSSERVER_LIFESPAN_STOP" task="AppModel.Task.StateWinRT.ApplicationDataContainerSettingsServer_Lifespan" value="281" />
          <event channel="StateManagerPerf" keywords="WinRT win:ResponseTime" level="win:Informational" opcode="win:Start" symbol="APPMODELSTATE_WINRT_APPLICATIONDATACONTAINERSETTINGSSERVER_LOOKUP_START" task="AppModel.Task.StateWinRT.ApplicationDataContainerSettingsServer_Lookup" value="290" />
          <event channel="StateManagerPerf" keywords="WinRT win:ResponseTime" level="win:Informational" opcode="win:Stop" symbol="APPMODELSTATE_WINRT_APPLICATIONDATACONTAINERSETTINGSSERVER_LOOKUP_STOP" task="AppModel.Task.StateWinRT.ApplicationDataContainerSettingsServer_Lookup" value="291" />
          <event channel="StateManagerPerf" keywords="WinRT win:ResponseTime" level="win:Informational" opcode="win:Start" symbol="APPMODELSTATE_WINRT_APPLICATIONDATACONTAINERSETTINGSSERVER_SIZE_START" task="AppModel.Task.StateWinRT.ApplicationDataContainerSettingsServer_Size" value="300" />
          <event channel="StateManagerPerf" keywords="WinRT win:ResponseTime" level="win:Informational" opcode="win:Stop" symbol="APPMODELSTATE_WINRT_APPLICATIONDATACONTAINERSETTINGSSERVER_SIZE_STOP" task="AppModel.Task.StateWinRT.ApplicationDataContainerSettingsServer_Size" value="301" />
          <event channel="StateManagerPerf" keywords="WinRT win:ResponseTime" level="win:Informational" opcode="win:Start" symbol="APPMODELSTATE_WINRT_APPLICATIONDATACONTAINERSETTINGSSERVER_HASKEY_START" task="AppModel.Task.StateWinRT.ApplicationDataContainerSettingsServer_HasKey" value="310" />
          <event channel="StateManagerPerf" keywords="WinRT win:ResponseTime" level="win:Informational" opcode="win:Stop" symbol="APPMODELSTATE_WINRT_APPLICATIONDATACONTAINERSETTINGSSERVER_HASKEY_STOP" task="AppModel.Task.StateWinRT.ApplicationDataContainerSettingsServer_HasKey" value="311" />
          <event channel="StateManagerPerf" keywords="WinRT win:ResponseTime" level="win:Informational" opcode="win:Start" symbol="APPMODELSTATE_WINRT_APPLICATIONDATACONTAINERSETTINGSSERVER_GETVIEW_START" task="AppModel.Task.StateWinRT.ApplicationDataContainerSettingsServer_GetView" value="320" />
          <event channel="StateManagerPerf" keywords="WinRT win:ResponseTime" level="win:Informational" opcode="win:Stop" symbol="APPMODELSTATE_WINRT_APPLICATIONDATACONTAINERSETTINGSSERVER_GETVIEW_STOP" task="AppModel.Task.StateWinRT.ApplicationDataContainerSettingsServer_GetView" value="321" />
          <event channel="StateManagerPerf" keywords="WinRT win:ResponseTime" level="win:Informational" opcode="win:Start" symbol="APPMODELSTATE_WINRT_APPLICATIONDATACONTAINERSETTINGSSERVER_INSERT_START" task="AppModel.Task.StateWinRT.ApplicationDataContainerSettingsServer_Insert" value="330" />
          <event channel="StateManagerPerf" keywords="WinRT win:ResponseTime" level="win:Informational" opcode="win:Stop" symbol="APPMODELSTATE_WINRT_APPLICATIONDATACONTAINERSETTINGSSERVER_INSERT_STOP" task="AppModel.Task.StateWinRT.ApplicationDataContainerSettingsServer_Insert" value="331" />
          <event channel="StateManagerPerf" keywords="WinRT win:ResponseTime" level="win:Informational" opcode="win:Start" symbol="APPMODELSTATE_WINRT_APPLICATIONDATACONTAINERSETTINGSSERVER_REMOVE_START" task="AppModel.Task.StateWinRT.ApplicationDataContainerSettingsServer_Remove" value="340" />
          <event channel="StateManagerPerf" keywords="WinRT win:ResponseTime" level="win:Informational" opcode="win:Stop" symbol="APPMODELSTATE_WINRT_APPLICATIONDATACONTAINERSETTINGSSERVER_REMOVE_STOP" task="AppModel.Task.StateWinRT.ApplicationDataContainerSettingsServer_Remove" value="341" />
          <event channel="StateManagerPerf" keywords="WinRT win:ResponseTime" level="win:Informational" opcode="win:Start" symbol="APPMODELSTATE_WINRT_APPLICATIONDATACONTAINERSETTINGSSERVER_CLEAR_START" task="AppModel.Task.StateWinRT.ApplicationDataContainerSettingsServer_Clear" value="350" />
          <event channel="StateManagerPerf" keywords="WinRT win:ResponseTime" level="win:Informational" opcode="win:Stop" symbol="APPMODELSTATE_WINRT_APPLICATIONDATACONTAINERSETTINGSSERVER_CLEAR_STOP" task="AppModel.Task.StateWinRT.ApplicationDataContainerSettingsServer_Clear" value="351" />
          <event channel="StateManagerPerf" keywords="WinRT win:ResponseTime" level="win:Informational" opcode="win:Start" symbol="APPMODELSTATE_WINRT_APPLICATIONDATACONTAINERSETTINGSSERVER_FIRST_START" task="AppModel.Task.StateWinRT.ApplicationDataContainerSettingsServer_First" value="360" />
          <event channel="StateManagerPerf" keywords="WinRT win:ResponseTime" level="win:Informational" opcode="win:Stop" symbol="APPMODELSTATE_WINRT_APPLICATIONDATACONTAINERSETTINGSSERVER_FIRST_STOP" task="AppModel.Task.StateWinRT.ApplicationDataContainerSettingsServer_First" value="361" />
          <event channel="StateManagerPerf" keywords="WinRT win:ResponseTime" level="win:Informational" opcode="win:Start" symbol="APPMODELSTATE_WINRT_APPLICATIONDATACOMPOSITEVALUESERVER_LIFESPAN_START" task="AppModel.Task.StateWinRT.ApplicationDataCompositeValueServer_Lifespan" value="370" />
          <event channel="StateManagerPerf" keywords="WinRT win:ResponseTime" level="win:Informational" opcode="win:Stop" symbol="APPMODELSTATE_WINRT_APPLICATIONDATACOMPOSITEVALUESERVER_LIFESPAN_STOP" task="AppModel.Task.StateWinRT.ApplicationDataCompositeValueServer_Lifespan" value="371" />
          <event channel="StateManagerPerf" keywords="WinRT win:ResponseTime" level="win:Informational" opcode="win:Start" symbol="APPMODELSTATE_WINRT_APPLICATIONDATACOMPOSITEVALUESERVER_LOOKUP_START" task="AppModel.Task.StateWinRT.ApplicationDataCompositeValueServer_Lookup" value="380" />
          <event channel="StateManagerPerf" keywords="WinRT win:ResponseTime" level="win:Informational" opcode="win:Stop" symbol="APPMODELSTATE_WINRT_APPLICATIONDATACOMPOSITEVALUESERVER_LOOKUP_STOP" task="AppModel.Task.StateWinRT.ApplicationDataCompositeValueServer_Lookup" value="381" />
          <event channel="StateManagerPerf" keywords="WinRT win:ResponseTime" level="win:Informational" opcode="win:Start" symbol="APPMODELSTATE_WINRT_APPLICATIONDATACOMPOSITEVALUESERVER_SIZE_START" task="AppModel.Task.StateWinRT.ApplicationDataCompositeValueServer_Size" value="390" />
          <event channel="StateManagerPerf" keywords="WinRT win:ResponseTime" level="win:Informational" opcode="win:Stop" symbol="APPMODELSTATE_WINRT_APPLICATIONDATACOMPOSITEVALUESERVER_SIZE_STOP" task="AppModel.Task.StateWinRT.ApplicationDataCompositeValueServer_Size" value="391" />
          <event channel="StateManagerPerf" keywords="WinRT win:ResponseTime" level="win:Informational" opcode="win:Start" symbol="APPMODELSTATE_WINRT_APPLICATIONDATACOMPOSITEVALUESERVER_HASKEY_START" task="AppModel.Task.StateWinRT.ApplicationDataCompositeValueServer_HasKey" value="400" />
          <event channel="StateManagerPerf" keywords="WinRT win:ResponseTime" level="win:Informational" opcode="win:Stop" symbol="APPMODELSTATE_WINRT_APPLICATIONDATACOMPOSITEVALUESERVER_HASKEY_STOP" task="AppModel.Task.StateWinRT.ApplicationDataCompositeValueServer_HasKey" value="401" />
          <event channel="StateManagerPerf" keywords="WinRT win:ResponseTime" level="win:Informational" opcode="win:Start" symbol="APPMODELSTATE_WINRT_APPLICATIONDATACOMPOSITEVALUESERVER_GETVIEW_START" task="AppModel.Task.StateWinRT.ApplicationDataCompositeValueServer_GetView" value="410" />
          <event channel="StateManagerPerf" keywords="WinRT win:ResponseTime" level="win:Informational" opcode="win:Stop" symbol="APPMODELSTATE_WINRT_APPLICATIONDATACOMPOSITEVALUESERVER_GETVIEW_STOP" task="AppModel.Task.StateWinRT.ApplicationDataCompositeValueServer_GetView" value="411" />
          <event channel="StateManagerPerf" keywords="WinRT win:ResponseTime" level="win:Informational" opcode="win:Start" symbol="APPMODELSTATE_WINRT_APPLICATIONDATACOMPOSITEVALUESERVER_INSERT_START" task="AppModel.Task.StateWinRT.ApplicationDataCompositeValueServer_Insert" value="420" />
          <event channel="StateManagerPerf" keywords="WinRT win:ResponseTime" level="win:Informational" opcode="win:Stop" symbol="APPMODELSTATE_WINRT_APPLICATIONDATACOMPOSITEVALUESERVER_INSERT_STOP" task="AppModel.Task.StateWinRT.ApplicationDataCompositeValueServer_Insert" value="421" />
          <event channel="StateManagerPerf" keywords="WinRT win:ResponseTime" level="win:Informational" opcode="win:Start" symbol="APPMODELSTATE_WINRT_APPLICATIONDATACOMPOSITEVALUESERVER_REMOVE_START" task="AppModel.Task.StateWinRT.ApplicationDataCompositeValueServer_Remove" value="430" />
          <event channel="StateManagerPerf" keywords="WinRT win:ResponseTime" level="win:Informational" opcode="win:Stop" symbol="APPMODELSTATE_WINRT_APPLICATIONDATACOMPOSITEVALUESERVER_REMOVE_STOP" task="AppModel.Task.StateWinRT.ApplicationDataCompositeValueServer_Remove" value="431" />
          <event channel="StateManagerPerf" keywords="WinRT win:ResponseTime" level="win:Informational" opcode="win:Start" symbol="APPMODELSTATE_WINRT_APPLICATIONDATACOMPOSITEVALUESERVER_CLEAR_START" task="AppModel.Task.StateWinRT.ApplicationDataCompositeValueServer_Clear" value="440" />
          <event channel="StateManagerPerf" keywords="WinRT win:ResponseTime" level="win:Informational" opcode="win:Stop" symbol="APPMODELSTATE_WINRT_APPLICATIONDATACOMPOSITEVALUESERVER_CLEAR_STOP" task="AppModel.Task.StateWinRT.ApplicationDataCompositeValueServer_Clear" value="441" />
          <event channel="StateManagerPerf" keywords="WinRT win:ResponseTime" level="win:Informational" opcode="win:Start" symbol="APPMODELSTATE_WINRT_APPLICATIONDATACOMPOSITEVALUESERVER_FIRST_START" task="AppModel.Task.StateWinRT.ApplicationDataCompositeValueServer_First" value="450" />
          <event channel="StateManagerPerf" keywords="WinRT win:ResponseTime" level="win:Informational" opcode="win:Stop" symbol="APPMODELSTATE_WINRT_APPLICATIONDATACOMPOSITEVALUESERVER_FIRST_STOP" task="AppModel.Task.StateWinRT.ApplicationDataCompositeValueServer_First" value="451" />
          <event channel="StateManagerPerf" keywords="WinRT win:ResponseTime" level="win:Informational" opcode="win:Start" symbol="APPMODELSTATE_WINRT_ROAMINGRPCSIGNAL_START" task="AppModel.Task.StateWinRT.RoamingRpcSignal" value="460" />
          <event channel="StateManagerPerf" keywords="WinRT win:ResponseTime" level="win:Informational" opcode="win:Stop" symbol="APPMODELSTATE_WINRT_ROAMINGRPCSIGNAL_STOP" task="AppModel.Task.StateWinRT.RoamingRpcSignal" value="461" />
          <event channel="StateManagerPerf" keywords="WinRT win:ResponseTime" level="win:Informational" opcode="win:Start" symbol="APPMODELSTATE_WINRT_DATACHANGEDEVENTDISPATCH_START" task="AppModel.Task.StateWinRT.DataChangedEventDispatch" value="470" />
          <event channel="StateManagerPerf" keywords="WinRT win:ResponseTime" level="win:Informational" opcode="win:Stop" symbol="APPMODELSTATE_WINRT_DATACHANGEDEVENTDISPATCH_STOP" task="AppModel.Task.StateWinRT.DataChangedEventDispatch" value="471" />
          <event channel="StateManagerPerf" keywords="WinRT win:ResponseTime" level="win:Informational" opcode="win:Start" symbol="APPMODELSTATE_WINRT_TEMP_CLEANUP_START" task="AppModel.Task.StateWinRT.TempCleanup" value="480" />
          <event channel="StateManagerPerf" keywords="WinRT win:ResponseTime" level="win:Informational" opcode="win:Stop" symbol="APPMODELSTATE_WINRT_TEMP_CLEANUP_STOP" task="AppModel.Task.StateWinRT.TempCleanup" value="481" />
          <event channel="StateManagerPerf" keywords="WinRT win:ResponseTime" level="win:Informational" opcode="win:Start" symbol="APPMODELSTATE_WINRT_APPLICATIONDATASERVER_FORUSER_START" task="AppModel.Task.StateWinRT.ApplicationDataServer_ForUser" value="490" />
          <event channel="StateManagerPerf" keywords="WinRT win:ResponseTime" level="win:Informational" opcode="win:Stop" symbol="APPMODELSTATE_WINRT_APPLICATIONDATASERVER_FORUSER_STOP" task="AppModel.Task.StateWinRT.ApplicationDataServer_ForUser" value="491" />
        </events>
      </provider>
      <provider guid="{3635d4b6-77e3-4375-8124-d545b7149337}" message="$(string.WSServiceStartServiceTrigger.ProviderName)" messageFileName="%systemroot%\system32\Microsoft-Windows-System-Events.dll" name="Microsoft-Windows-Kernel-WSService-StartServiceTrigger" resourceFileName="%systemroot%\system32\Microsoft-Windows-System-Events.dll" symbol="MS_Windows_WSServiceStartServiceTrigger_Provider">
        <events>
          <event level="win:Informational" symbol="WSServiceStartServiceTrigger" value="1" />
        </events>
      </provider>
      <provider guid="{ABF1F586-2E50-4BA8-928D-49044E6F0DB7}" message="$(string.IoMgr.ProviderName)" messageFileName="%SystemRoot%\system32\Microsoft-Windows-System-Events.dll" name="Microsoft-Windows-Kernel-IO" resourceFileName="%SystemRoot%\system32\Microsoft-Windows-System-Events.dll" symbol="IoMgrProvider">
        <channels>
          <channel chid="OperationalCh" enabled="true" isolation="System" message="$(string.IoMgr.channel.operational.message)" name="Microsoft-Windows-Kernel-IO/Operational" symbol="OperationalCh" type="Operational" />
        </channels>
        <templates>
          <template tid="tid_IoMgr_VolumeDetail">
            <data inType="win:GUID" name="VolumeGuid" />
            <data inType="win:UInt16" name="VolumeNameLength" />
            <data inType="win:UnicodeString" length="VolumeNameLength" name="VolumeName" />
          </template>
          <template tid="tid_IoMgr_VolumeDetail_Status">
            <data inType="win:GUID" name="VolumeGuid" />
            <data inType="win:UInt16" name="VolumeNameLength" />
            <data inType="win:UnicodeString" length="VolumeNameLength" name="VolumeName" />
            <data inType="win:HexInt32" name="Error" outType="win:NTSTATUS" />
          </template>
        </templates>
        <events>
          <event channel="OperationalCh" level="win:Informational" message="$(string.IoMgr_MountBegin.EventMessage)" opcode="win:Start" symbol="IoMgr_MountBegin" template="tid_IoMgr_VolumeDetail" value="1" />
          <event channel="OperationalCh" level="win:Informational" message="$(string.IoMgr_MountSucceeded.EventMessage)" opcode="win:Stop" symbol="IoMgr_MountSucceeded" template="tid_IoMgr_VolumeDetail" value="2" />
          <event channel="OperationalCh" level="win:Warning" message="$(string.IoMgr_MountFailed.EventMessage)" opcode="win:Stop" symbol="IoMgr_MountFailed" template="tid_IoMgr_VolumeDetail_Status" value="3" />
        </events>
      </provider>
      <provider guid="{BEF2AA8E-81CD-11E2-A7BB-5EAC6188709B}" message="$(string.LiveDump.ProviderName)" messageFileName="%SystemRoot%\system32\Microsoft-Windows-System-Events.dll" name="Microsoft-Windows-Kernel-LiveDump" resourceFileName="%SystemRoot%\system32\Microsoft-Windows-System-Events.dll" symbol="LiveDumpProvGuid">
        <events>
          <event channel="LIVEDUMP_CHANNEL_ANALYTIC" level="win:Informational" message="$(string.LiveDump.event.LIVEDUMP_EVENT_CAPTURE_API_START.message)" opcode="APIStart" symbol="LIVEDUMP_EVENT_CAPTURE_API_START" task="LIVEDUMP_TASK_CAPTURE_API" value="1" version="0" />
          <event channel="LIVEDUMP_CHANNEL_ANALYTIC" level="win:Informational" message="$(string.LiveDump.event.LIVEDUMP_EVENT_CAPTURE_API_END.message)" opcode="APIEnd" symbol="LIVEDUMP_EVENT_CAPTURE_API_END" task="LIVEDUMP_TASK_CAPTURE_API" template="tidAPIEnd" value="2" version="0" />
          <event channel="LIVEDUMP_CHANNEL_ANALYTIC" level="win:Informational" message="$(string.LiveDump.event.LIVEDUMP_EVENT_WRITE_DUMPDATA_TO_FILE_START.message)" opcode="WriteDumpDataToFileStart" symbol="LIVEDUMP_EVENT_WRITE_DUMPDATA_TO_FILE_START" task="LIVEDUMP_TASK_CAPTURE_API" value="3" version="0" />
          <event channel="LIVEDUMP_CHANNEL_ANALYTIC" level="win:Informational" message="$(string.LiveDump.event.LIVEDUMP_EVENT_WRITE_DUMPDATA_TO_FILE_END.message)" opcode="WriteDumpDataToFileEnd" symbol="LIVEDUMP_EVENT_WRITE_DUMPDATA_TO_FILE_END" task="LIVEDUMP_TASK_CAPTURE_API" template="tidDumpFileWriteEnd" value="4" version="0" />
          <event channel="LIVEDUMP_CHANNEL_ANALYTIC" level="win:Informational" message="$(string.LiveDump.event.LIVEDUMP_EVENT_MEMORY_PRESSURE_ABORT.message)" opcode="BufferAllocation" symbol="LIVEDUMP_EVENT_MEMORY_PRESSURE_ABORT" task="LIVEDUMP_TASK_CAPTURE_API" value="5" version="0" />
          <event channel="LIVEDUMP_CHANNEL_ANALYTIC" level="win:Informational" message="$(string.LiveDump.event.LIVEDUMP_EVENT_SIZING_WORKFLOW_MIRRORING_START.message)" opcode="MirroringStart" symbol="LIVEDUMP_EVENT_SIZING_WORKFLOW_MIRRORING_START" task="LIVEDUMP_TASK_SIZING_WORKFLOW" value="101" version="0" />
          <event channel="LIVEDUMP_CHANNEL_ANALYTIC" level="win:Informational" message="$(string.LiveDump.event.LIVEDUMP_EVENT_SIZING_WORKFLOW_MIRRORING_PHASE0_END.message)" opcode="MirroringPhase0End" symbol="LIVEDUMP_EVENT_SIZING_WORKFLOW_MIRRORING_PHASE0_END" task="LIVEDUMP_TASK_SIZING_WORKFLOW" value="102" version="0" />
          <event channel="LIVEDUMP_CHANNEL_ANALYTIC" level="win:Informational" message="$(string.LiveDump.event.LIVEDUMP_EVENT_SIZING_WORKFLOW_MIRRORING_PHASE1_END.message)" opcode="MirroringPhase1End" symbol="LIVEDUMP_EVENT_SIZING_WORKFLOW_MIRRORING_PHASE1_END" task="LIVEDUMP_TASK_SIZING_WORKFLOW" value="103" version="0" />
          <event channel="LIVEDUMP_CHANNEL_ANALYTIC" level="win:Informational" message="$(string.LiveDump.event.LIVEDUMP_EVENT_SIZING_WORKFLOW_SYSTEM_QUIESCE_START.message)" opcode="SystemQuiesceStart" symbol="LIVEDUMP_EVENT_SIZING_WORKFLOW_SYSTEM_QUIESCE_START" task="LIVEDUMP_TASK_SIZING_WORKFLOW" value="104" version="0" />
          <event channel="LIVEDUMP_CHANNEL_ANALYTIC" level="win:Informational" message="$(string.LiveDump.event.LIVEDUMP_EVENT_SIZING_WORKFLOW_SYSTEM_QUIESCE_END.message)" opcode="SystemQuiesceEnd" symbol="LIVEDUMP_EVENT_SIZING_WORKFLOW_SYSTEM_QUIESCE_END" task="LIVEDUMP_TASK_SIZING_WORKFLOW" value="105" version="0" />
          <event channel="LIVEDUMP_CHANNEL_ANALYTIC" level="win:Informational" message="$(string.LiveDump.event.LIVEDUMP_EVENT_SIZING_WORKFLOW_BUFFER_ESTIMATION.message)" opcode="BufferEstimation" symbol="LIVEDUMP_EVENT_SIZING_WORKFLOW_BUFFER_ESTIMATION" task="LIVEDUMP_TASK_SIZING_WORKFLOW" template="tidBufferEstimation" value="106" version="0" />
          <event channel="LIVEDUMP_CHANNEL_ANALYTIC" level="win:Informational" message="$(string.LiveDump.event.LIVEDUMP_EVENT_SIZING_WORKFLOW_BUFFER_ALLOCATION.message)" opcode="BufferAllocation" symbol="LIVEDUMP_EVENT_SIZING_WORKFLOW_BUFFER_ALLOCATION" task="LIVEDUMP_TASK_SIZING_WORKFLOW" template="tidBufferAllocation" value="107" version="0" />
          <event channel="LIVEDUMP_CHANNEL_ANALYTIC" level="win:Informational" message="$(string.LiveDump.event.LIVEDUMP_EVENT_SIZING_WORKFLOW_REMOVEPAGES_CALLBACKS_START.message)" opcode="RemovePages" symbol="LIVEDUMP_EVENT_SIZING_WORKFLOW_REMOVEPAGES_CALLBACKS_START" task="LIVEDUMP_TASK_SIZING_WORKFLOW" value="108" version="0" />
          <event channel="LIVEDUMP_CHANNEL_ANALYTIC" level="win:Informational" message="$(string.LiveDump.event.LIVEDUMP_EVENT_SIZING_WORKFLOW_REMOVEPAGES_CALLBACKS_END.message)" opcode="RemovePages" symbol="LIVEDUMP_EVENT_SIZING_WORKFLOW_REMOVEPAGES_CALLBACKS_END" task="LIVEDUMP_TASK_SIZING_WORKFLOW" value="109" version="0" />
          <event channel="LIVEDUMP_CHANNEL_ANALYTIC" level="win:Informational" message="$(string.LiveDump.event.LIVEDUMP_EVENT_SIZING_WORKFLOW_REMOVEPAGES_CALLBACK_START.message)" opcode="RemovePages" symbol="LIVEDUMP_EVENT_SIZING_WORKFLOW_REMOVEPAGES_CALLBACK_START" task="LIVEDUMP_TASK_SIZING_WORKFLOW" template="tidRemovePagesCallback" value="110" version="0" />
          <event channel="LIVEDUMP_CHANNEL_ANALYTIC" level="win:Informational" message="$(string.LiveDump.event.LIVEDUMP_EVENT_SIZING_WORKFLOW_REMOVEPAGES_CALLBACK_END.message)" opcode="RemovePages" symbol="LIVEDUMP_EVENT_SIZING_WORKFLOW_REMOVEPAGES_CALLBACK_END" task="LIVEDUMP_TASK_SIZING_WORKFLOW" template="tidRemovePagesCallback" value="111" version="0" />
          <event channel="LIVEDUMP_CHANNEL_ANALYTIC" level="win:Informational" message="$(string.LiveDump.event.LIVEDUMP_EVENT_SIZING_WORKFLOW_REMOVEPAGES_CALLBACK_FAILURE.message)" opcode="RemovePages" symbol="LIVEDUMP_EVENT_SIZING_WORKFLOW_REMOVEPAGES_CALLBACK_FAILURE" task="LIVEDUMP_TASK_SIZING_WORKFLOW" template="tidRemovePagesCallbackFailure" value="112" version="0" />
          <event channel="LIVEDUMP_CHANNEL_ANALYTIC" level="win:Informational" message="$(string.LiveDump.event.LIVEDUMP_EVENT_CAPTURE_PAGES_WORKFLOW_MIRRORING_START.message)" opcode="MirroringStart" symbol="LIVEDUMP_EVENT_CAPTURE_PAGES_WORKFLOW_MIRRORING_START" task="LIVEDUMP_TASK_CAPTURE_PAGES_WORKFLOW" value="151" version="0" />
          <event channel="LIVEDUMP_CHANNEL_ANALYTIC" level="win:Informational" message="$(string.LiveDump.event.LIVEDUMP_EVENT_CAPTURE_PAGES_WORKFLOW_MIRRORING_PHASE0_END.message)" opcode="MirroringPhase0End" symbol="LIVEDUMP_EVENT_CAPTURE_PAGES_WORKFLOW_MIRRORING_PHASE0_END" task="LIVEDUMP_TASK_CAPTURE_PAGES_WORKFLOW" value="152" version="0" />
          <event channel="LIVEDUMP_CHANNEL_ANALYTIC" level="win:Informational" message="$(string.LiveDump.event.LIVEDUMP_EVENT_CAPTURE_PAGES_WORKFLOW_MIRRORING_PHASE1_END.message)" opcode="MirroringPhase1End" symbol="LIVEDUMP_EVENT_CAPTURE_PAGES_WORKFLOW_MIRRORING_PHASE1_END" task="LIVEDUMP_TASK_CAPTURE_PAGES_WORKFLOW" value="153" version="0" />
          <event channel="LIVEDUMP_CHANNEL_ANALYTIC" level="win:Informational" message="$(string.LiveDump.event.LIVEDUMP_EVENT_CAPTURE_PAGES_WORKFLOW_SYSTEM_QUIESCE_START.message)" opcode="SystemQuiesceStart" symbol="LIVEDUMP_EVENT_CAPTURE_PAGES_WORKFLOW_SYSTEM_QUIESCE_START" task="LIVEDUMP_TASK_CAPTURE_PAGES_WORKFLOW" value="154" version="0" />
          <event channel="LIVEDUMP_CHANNEL_ANALYTIC" level="win:Informational" message="$(string.LiveDump.event.LIVEDUMP_EVENT_CAPTURE_PAGES_WORKFLOW_SYSTEM_QUIESCE_END.message)" opcode="SystemQuiesceEnd" symbol="LIVEDUMP_EVENT_CAPTURE_PAGES_WORKFLOW_SYSTEM_QUIESCE_END" task="LIVEDUMP_TASK_CAPTURE_PAGES_WORKFLOW" value="155" version="0" />
          <event channel="LIVEDUMP_CHANNEL_ANALYTIC" level="win:Informational" message="$(string.LiveDump.event.LIVEDUMP_EVENT_CAPTURE_PAGES_WORKFLOW_BUFFERING_START.message)" opcode="PageBufferingStart" symbol="LIVEDUMP_EVENT_CAPTURE_PAGES_WORKFLOW_BUFFERING_START" task="LIVEDUMP_TASK_CAPTURE_PAGES_WORKFLOW" value="156" version="0" />
          <event channel="LIVEDUMP_CHANNEL_ANALYTIC" level="win:Informational" message="$(string.LiveDump.event.LIVEDUMP_EVENT_CAPTURE_PAGES_WORKFLOW_BUFFERING_END.message)" opcode="PageBufferingEnd" symbol="LIVEDUMP_EVENT_CAPTURE_PAGES_WORKFLOW_BUFFERING_END" task="LIVEDUMP_TASK_CAPTURE_PAGES_WORKFLOW" value="157" version="0" />
          <event channel="LIVEDUMP_CHANNEL_ANALYTIC" level="win:Informational" message="$(string.LiveDump.event.LIVEDUMP_EVENT_WRITE_DEFERRED_DATA_API_START.message)" opcode="APIStart" symbol="LIVEDUMP_EVENT_WRITE_DEFERRED_DATA_API_START" task="LIVEDUMP_TASK_WRITE_DEFERRED_DATA_API" value="201" version="0" />
          <event channel="LIVEDUMP_CHANNEL_ANALYTIC" level="win:Informational" message="$(string.LiveDump.event.LIVEDUMP_EVENT_WRITE_DEFERRED_DATA_API_END.message)" opcode="APIEnd" symbol="LIVEDUMP_EVENT_WRITE_DEFERRED_DATA_API_END" task="LIVEDUMP_TASK_WRITE_DEFERRED_DATA_API" template="tidAPIEnd" value="202" version="0" />
          <event channel="LIVEDUMP_CHANNEL_ANALYTIC" level="win:Informational" message="$(string.LiveDump.event.LIVEDUMP_EVENT_WRITE_DEFERRED_DUMPDATA_TO_FILE_START.message)" opcode="WriteDumpDataToFileStart" symbol="LIVEDUMP_EVENT_WRITE_DEFERRED_DUMPDATA_TO_FILE_START" task="LIVEDUMP_TASK_WRITE_DEFERRED_DATA_API" value="203" version="0" />
          <event channel="LIVEDUMP_CHANNEL_ANALYTIC" level="win:Informational" message="$(string.LiveDump.event.LIVEDUMP_EVENT_WRITE_DEFERRED_DUMPDATA_TO_FILE_END.message)" opcode="WriteDumpDataToFileEnd" symbol="LIVEDUMP_EVENT_WRITE_DEFERRED_DUMPDATA_TO_FILE_END" task="LIVEDUMP_TASK_WRITE_DEFERRED_DATA_API" template="tidDumpFileWriteEnd" value="204" version="0" />
          <event channel="LIVEDUMP_CHANNEL_ANALYTIC" level="win:Informational" message="$(string.LiveDump.event.LIVEDUMP_EVENT_DISCARD_DEFERRED_DATA_API_START.message)" opcode="APIStart" symbol="LIVEDUMP_EVENT_DISCARD_DEFERRED_DATA_API_START" task="LIVEDUMP_TASK_DISCARD_DEFERRED_DATA_API" value="251" version="0" />
          <event channel="LIVEDUMP_CHANNEL_ANALYTIC" level="win:Informational" message="$(string.LiveDump.event.LIVEDUMP_EVENT_DISCARD_DEFERRED_DATA_API_END.message)" opcode="APIEnd" symbol="LIVEDUMP_EVENT_DISCARD_DEFERRED_DATA_API_END" task="LIVEDUMP_TASK_DISCARD_DEFERRED_DATA_API" template="tidAPIEnd" value="252" version="0" />
        </events>
        <channels>
          <channel chid="LIVEDUMP_CHANNEL_ANALYTIC" isolation="System" message="$(string.LiveDump.channel.analytic.message)" name="Microsoft-Windows-Kernel-LiveDump/Analytic" symbol="LIVEDUMP_CHANNEL_ANALYTIC" type="Analytic" />
        </channels>
        <tasks>
          <task message="$(string.LiveDump.task.LIVEDUMP_TASK_CAPTURE_API.message)" name="LIVEDUMP_TASK_CAPTURE_API" symbol="LIVEDUMP_TASK_CAPTURE_API" value="1" />
          <task message="$(string.LiveDump.task.LIVEDUMP_TASK_SIZING_WORKFLOW.message)" name="LIVEDUMP_TASK_SIZING_WORKFLOW" symbol="LIVEDUMP_TASK_SIZING_WORKFLOW" value="2" />
          <task message="$(string.LiveDump.task.LIVEDUMP_TASK_CAPTURE_PAGES_WORKFLOW.message)" name="LIVEDUMP_TASK_CAPTURE_PAGES_WORKFLOW" symbol="LIVEDUMP_TASK_CAPTURE_PAGES_WORKFLOW" value="3" />
          <task message="$(string.LiveDump.task.LIVEDUMP_TASK_WRITE_DEFERRED_DATA_API.message)" name="LIVEDUMP_TASK_WRITE_DEFERRED_DATA_API" symbol="LIVEDUMP_TASK_WRITE_DEFERRED_DATA_API" value="4" />
          <task message="$(string.LiveDump.task.LIVEDUMP_TASK_DISCARD_DEFERRED_DATA_API.message)" name="LIVEDUMP_TASK_DISCARD_DEFERRED_DATA_API" symbol="LIVEDUMP_TASK_DISCARD_DEFERRED_DATA_API" value="5" />
        </tasks>
        <opcodes>
          <opcode message="$(string.LiveDump.opcode.LIVEDUMP_API_START.message)" name="APIStart" symbol="LIVEDUMP_API_START" value="10" />
          <opcode message="$(string.LiveDump.opcode.LIVEDUMP_API_END.message)" name="APIEnd" symbol="LIVEDUMP_API_END" value="11" />
          <opcode message="$(string.LiveDump.opcode.LIVEDUMP_DUMPFILE_WRITE_START.message)" name="WriteDumpDataToFileStart" symbol="LIVEDUMP_DUMPFILE_WRITE_START" value="12" />
          <opcode message="$(string.LiveDump.opcode.LIVEDUMP_DUMPFILE_WRITE_END.message)" name="WriteDumpDataToFileEnd" symbol="LIVEDUMP_DUMPFILE_WRITE_END" value="13" />
          <opcode message="$(string.LiveDump.opcode.LIVEDUMP_MIRRORING_START.message)" name="MirroringStart" symbol="LIVEDUMP_MIRRORING_START" value="14" />
          <opcode message="$(string.LiveDump.opcode.LIVEDUMP_MIRRORING_PHASE0_END.message)" name="MirroringPhase0End" symbol="LIVEDUMP_MIRRORING_PHASE0_END" value="15" />
          <opcode message="$(string.LiveDump.opcode.LIVEDUMP_MIRRORING_PHASE1_END.message)" name="MirroringPhase1End" symbol="LIVEDUMP_MIRRORING_PHASE1_END" value="16" />
          <opcode message="$(string.LiveDump.opcode.LIVEDUMP_SYSTEM_QUIESCE_START.message)" name="SystemQuiesceStart" symbol="LIVEDUMP_SYSTEM_QUIESCE_START" value="17" />
          <opcode message="$(string.LiveDump.opcode.LIVEDUMP_SYSTEM_QUIESCE_END.message)" name="SystemQuiesceEnd" symbol="LIVEDUMP_SYSTEM_QUIESCE_END" value="18" />
          <opcode message="$(string.LiveDump.opcode.LIVEDUMP_PAGE_BUFFERING_START.message)" name="PageBufferingStart" symbol="LIVEDUMP_PAGE_BUFFERING_START" value="19" />
          <opcode message="$(string.LiveDump.opcode.LIVEDUMP_PAGE_BUFFERING_END.message)" name="PageBufferingEnd" symbol="LIVEDUMP_PAGE_BUFFERING_END" value="20" />
          <opcode message="$(string.LiveDump.opcode.LIVEDUMP_BUFFER_ESTIMATION.message)" name="BufferEstimation" symbol="LIVEDUMP_BUFFER_ESTIMATION" value="21" />
          <opcode message="$(string.LiveDump.opcode.LIVEDUMP_BUFFER_ALLOCATION.message)" name="BufferAllocation" symbol="LIVEDUMP_BUFFER_ALLOCATION" value="22" />
          <opcode message="$(string.LiveDump.opcode.LIVEDUMP_REMOVEPAGES.message)" name="RemovePages" symbol="LIVEDUMP_REMOVE_PAGES" value="23" />
        </opcodes>
        <templates>
          <template tid="tidAPIEnd">
            <data inType="win:UInt32" name="NTStatus" outType="xs:HexInt32" />
          </template>
          <template tid="tidBufferEstimation">
            <data inType="win:UInt64" name="NtEstimatedRequiredPrimaryDataBytes" outType="xs:unsignedLong" />
            <data inType="win:UInt64" name="NtEstimatedPrimaryDataBytes" outType="xs:unsignedLong" />
            <data inType="win:UInt64" name="HvEstimatedPrimaryDataBytes" outType="xs:unsignedLong" />
            <data inType="win:UInt64" name="HvEstimatedSecondaryDataBytes" outType="xs:unsignedLong" />
          </template>
          <template tid="tidBufferAllocation">
            <data inType="win:UInt64" name="NtPrimaryDataBytes" outType="xs:unsignedLong" />
            <data inType="win:UInt64" name="HvPrimaryDataBytes" outType="xs:unsignedLong" />
            <data inType="win:UInt64" name="HvSecondaryDataBytes" outType="xs:unsignedLong" />
          </template>
          <template tid="tidDumpFileWriteEnd">
            <data inType="win:UInt32" name="NTStatus" outType="xs:HexInt32" />
            <data inType="win:UInt64" name="TotalBytes" outType="xs:unsignedLong" />
            <data inType="win:UInt64" name="HeaderBytes" outType="xs:unsignedLong" />
            <data inType="win:UInt64" name="PrimaryDataBytes" outType="xs:unsignedLong" />
            <data inType="win:UInt64" name="SecondaryDataBytes" outType="xs:unsignedLong" />
          </template>
          <template tid="tidRemovePagesCallback">
            <data inType="win:AnsiString" name="CallbackIdentifier" outType="xs:string" />
          </template>
          <template tid="tidRemovePagesCallbackFailure">
            <data inType="win:AnsiString" name="CallbackIdentifier" outType="xs:string" />
            <data inType="win:UInt32" name="NTStatus" outType="win:NTSTATUS" />
          </template>
        </templates>
      </provider>
      <provider guid="{E02A841C-75A3-4FA7-AFC8-AE09CF9B7F23}" message="$(string.KernelAuditApiCalls.ProviderName)" messageFileName="%SystemRoot%\system32\Microsoft-Windows-System-Events.dll" name="Microsoft-Windows-Kernel-Audit-API-Calls" resourceFileName="%SystemRoot%\system32\Microsoft-Windows-System-Events.dll" symbol="KernelAuditApiCallsGuid">
        <events>
          <event level="win:Informational" opcode="win:Info" symbol="KERNEL_AUDIT_API_PSSETLOADIMAGENOTIFYROUTINE" template="tid_KERNEL_AUDIT_API_PSSETLOADIMAGENOTIFYROUTINE" value="1" version="0" />
          <event level="win:Informational" opcode="win:Info" symbol="KERNEL_AUDIT_API_TERMINATEPROCESS" template="tid_KERNEL_AUDIT_API_TERMINATEPROCESS" value="2" version="0" />
          <event level="win:Informational" opcode="win:Info" symbol="KERNEL_AUDIT_API_CREATESYMBOLICLINKOBJECT" template="tid_KERNEL_AUDIT_API_CREATESYMBOLICLINKOBJECT" value="3" version="0" />
          <event level="win:Informational" opcode="win:Info" symbol="KERNEL_AUDIT_API_SETCONTEXTTHREAD" template="tid_KERNEL_AUDIT_API_GENERIC_RETURNCODE" value="4" version="0" />
          <event level="win:Informational" opcode="win:Info" symbol="KERNEL_AUDIT_API_OPENPROCESS" template="tid_KERNEL_AUDIT_API_OPENPROCESS" value="5" version="0" />
          <event level="win:Informational" opcode="win:Info" symbol="KERNEL_AUDIT_API_OPENTHREAD" template="tid_KERNEL_AUDIT_API_OPENTHREAD" value="6" version="0" />
          <event level="win:Informational" opcode="win:Info" symbol="KERNEL_AUDIT_API_IOREGISTERLASTCHANCESHUTDOWNNOTIFICATION" template="tid_KERNEL_AUDIT_API_IOREGISTERLASTCHANCESHUTDOWNNOTIFICATION" value="7" version="0" />
          <event level="win:Informational" opcode="win:Info" symbol="KERNEL_AUDIT_API_IOREGISTERSHUTDOWNNOTIFICATION" template="tid_KERNEL_AUDIT_API_IOREGISTERSHUTDOWNNOTIFICATION" value="8" version="0" />
        </events>
        <templates>
          <template tid="tid_KERNEL_AUDIT_API_GENERIC_RETURNCODE">
            <data inType="win:UInt32" name="ReturnCode" />
          </template>
          <template tid="tid_KERNEL_AUDIT_API_PSSETLOADIMAGENOTIFYROUTINE">
            <data inType="win:Pointer" name="NotifyRoutineAddress" />
            <data inType="win:UInt32" name="ReturnCode" />
          </template>
          <template tid="tid_KERNEL_AUDIT_API_TERMINATEPROCESS">
            <data inType="win:UInt32" name="TargetProcessId" />
            <data inType="win:UInt32" name="ReturnCode" />
          </template>
          <template tid="tid_KERNEL_AUDIT_API_OPENPROCESS">
            <data inType="win:UInt32" name="TargetProcessId" />
            <data inType="win:UInt32" name="DesiredAccess" />
            <data inType="win:UInt32" name="ReturnCode" />
          </template>
          <template tid="tid_KERNEL_AUDIT_API_OPENTHREAD">
            <data inType="win:UInt32" name="TargetProcessId" />
            <data inType="win:UInt32" name="TargetThreatId" />
            <data inType="win:UInt32" name="DesiredAccess" />
            <data inType="win:UInt32" name="ReturnCode" />
          </template>
          <template tid="tid_KERNEL_AUDIT_API_IOREGISTERLASTCHANCESHUTDOWNNOTIFICATION">
            <data inType="win:UnicodeString" name="DriverName" />
            <data inType="win:UInt32" name="ReturnCode" />
          </template>
          <template tid="tid_KERNEL_AUDIT_API_IOREGISTERSHUTDOWNNOTIFICATION">
            <data inType="win:UnicodeString" name="DriverName" />
            <data inType="win:UInt32" name="ReturnCode" />
          </template>
          <template tid="tid_KERNEL_AUDIT_API_CREATESYMBOLICLINKOBJECT">
            <data inType="win:UnicodeString" name="LinkSourceName" />
            <data inType="win:UnicodeString" name="LinkTargetName" />
            <data inType="win:UInt32" name="DesiredAccess" />
            <data inType="win:UInt32" name="ReturnCode" />
          </template>
        </templates>
      </provider>
      <messageTable>
        <message message="$(string.AppCompat.ProviderName)" value="300" />
        <message message="$(string.AIT.ProviderName)" value="301" />
        <message message="$(string.AeCache.ProviderName)" value="302" />
        <message message="$(string.AeSwitchBack.ProviderName)" value="303" />
        <message message="$(string.AeLookupServiceTrigger.ProviderName)" value="304" />
        <message message="$(string.AeCache.OperationalMessage)" value="307" />
        <message message="$(string.AeCache.InfoMessage)" value="308" />
        <message message="$(string.AeCache.ErrorMessage)" value="309" />
        <message message="$(string.APPCOMPAT_REG_WRP_ACCESS_DENIED.EventMessage)" value="310" />
        <message message="$(string.KernelNetworkProviderName)" value="500" />
        <message message="$(string.KERNEL_NETWORK_OPCODE_SEND.OpcodeMessage)" value="501" />
        <message message="$(string.KERNEL_NETWORK_OPCODE_RECV.OpcodeMessage)" value="502" />
        <message message="$(string.KERNEL_NETWORK_OPCODE_CONNECT.OpcodeMessage)" value="503" />
        <message message="$(string.KERNEL_NETWORK_OPCODE_DISCONNECT.OpcodeMessage)" value="504" />
        <message message="$(string.KERNEL_NETWORK_OPCODE_RETRANSMIT.OpcodeMessage)" value="505" />
        <message message="$(string.KERNEL_NETWORK_OPCODE_ACCEPT.OpcodeMessage)" value="506" />
        <message message="$(string.KERNEL_NETWORK_OPCODE_RECONNECT.OpcodeMessage)" value="507" />
        <message message="$(string.KERNEL_NETWORK_OPCODE_FAIL.OpcodeMessage)" value="508" />
        <message message="$(string.KERNEL_NETWORK_OPCODE_TCPCOPY.OpcodeMessage)" value="509" />
        <message message="$(string.KERNEL_NETWORK_OPCODE_SENDUDP.OpcodeMessage)" value="510" />
        <message message="$(string.KERNEL_NETWORK_OPCODE_RECVUDP.OpcodeMessage)" value="511" />
        <message message="$(string.KERNEL_NETWORK_OPCODE_FAILUDP.OpcodeMessage)" value="512" />
        <message message="$(string.Network.SendIPV4.EventMessage)" value="513" />
        <message message="$(string.Network.RecvIPV4.EventMessage)" value="514" />
        <message message="$(string.Network.ConnectIPV4.EventMessage)" value="515" />
        <message message="$(string.Network.DisconnectIPV4.EventMessage)" value="516" />
        <message message="$(string.Network.RetransmitIPV4.EventMessage)" value="517" />
        <message message="$(string.Network.AcceptIPV4.EventMessage)" value="518" />
        <message message="$(string.Network.ReconnectIPV4.EventMessage)" value="519" />
        <message message="$(string.Network.Fail.EventMessage)" value="520" />
        <message message="$(string.Network.TcpCopyIPV4.EventMessage)" value="521" />
        <message message="$(string.Network.SendIPV4Udp.EventMessage)" value="522" />
        <message message="$(string.Network.RecvIPV4Udp.EventMessage)" value="523" />
        <message message="$(string.Network.FailUdp.EventMessage)" value="524" />
        <message message="$(string.Network.SendIPV6.EventMessage)" value="525" />
        <message message="$(string.Network.RecvIPV6.EventMessage)" value="526" />
        <message message="$(string.Network.ConnectIPV6.EventMessage)" value="527" />
        <message message="$(string.Network.DisconnectIPV6.EventMessage)" value="528" />
        <message message="$(string.Network.RetransmitIPV6.EventMessage)" value="529" />
        <message message="$(string.Network.AcceptIPV6.EventMessage)" value="530" />
        <message message="$(string.Network.ReconnectIPV6.EventMessage)" value="531" />
        <message message="$(string.Network.TcpCopyIPV6.EventMessage)" value="532" />
        <message message="$(string.Network.SendIPV6Udp.EventMessage)" value="533" />
        <message message="$(string.Network.RecvIPV6Udp.EventMessage)" value="534" />
        <message message="$(string.KernelDiskProviderName)" value="600" />
        <message message="$(string.Disk.Read.EventMessage)" value="601" />
        <message message="$(string.Disk.Write.EventMessage)" value="602" />
        <message message="$(string.Disk.Flush.EventMessage)" value="603" />
        <message message="$(string.BootEnv.ProviderName)" value="700" />
        <message message="$(string.BootEnv.BootFirmwareResolution)" value="701" />
        <message message="$(string.BootEnv.BootOsResolution)" value="702" />
        <message message="$(string.BootEnv.BootBitTransferRate)" value="703" />
        <message message="$(string.BootEnv.BootFileAccess)" value="704" />
        <message message="$(string.BootEnv.BootTotalIO)" value="705" />
        <message message="$(string.BootEnv.BootImageIntegrityCheck)" value="706" />
        <message message="$(string.BootEnv.BootmgrTime)" value="707" />
        <message message="$(string.BootEnv.BootImageHashCheck)" value="708" />
        <message message="$(string.BootEnv.BootNonexistentDisk)" value="709" />
        <message message="$(string.BootEnv.SecureBootVariableUsage)" value="710" />
        <message message="$(string.BootEnv.SecureBootBcdPolicyViolation)" value="711" />
        <message message="$(string.BootEnv.SecureBootPolicyUpdate)" value="712" />
        <message message="$(string.BootEnv.SecureBootRevocationUpdate)" value="713" />
        <message message="$(string.BootEnv.RetrieveDriverListTime)" value="714" />
        <message message="$(string.BootEnv.LoadDriversTime)" value="715" />
        <message message="$(string.BootEnv.LoadHiveTime)" value="716" />
        <message message="$(string.BootEnv.ApplicationLoadTime)" value="717" />
        <message message="$(string.BootEnv.ApplicationExecutionTime)" value="718" />
        <message message="$(string.BootEnv.BuildChunkTableFailure)" value="719" />
        <message message="$(string.BootEnv.PrepareTargetFailure)" value="720" />
        <message message="$(string.BootEnv.ProcessPersistentDataFailure)" value="721" />
        <message message="$(string.KernelFileProviderName)" value="800" />
        <message message="$(string.ETW.ProviderName)" value="901" />
        <message message="$(string.ETW.event.ETW_EVENT_WRITE_FAILED.message)" value="902" />
        <message message="$(string.ETW.event.ETW_EVENT_BACKING_FILE_FULL.message)" value="903" />
        <message message="$(string.ETW.event.ETW_EVENT_SESSION_START_FAILED.message)" value="904" />
        <message message="$(string.ETW.event.ETW_EVENT_SESSION_END_FAILED.message)" value="905" />
        <message message="$(string.ETW.event.ETW_EVENT_MAX_FILE_SIZE_REACHED.message)" value="906" />
        <message message="$(string.ETW.event.ETW_EVENT_SWITCH_TO_NEW_FILE_FAILED.message)" value="907" />
        <message message="$(string.ETW.event.ETW_EVENT_PROVIDER_REGISTER.message)" value="910" />
        <message message="$(string.ETW.event.ETW_EVENT_PROVIDER_UNREGISTERS.message)" value="911" />
        <message message="$(string.ETW.event.ETW_EVENT_START_TRACE.message)" value="912" />
        <message message="$(string.ETW.event.ETW_EVENT_STOP_TRACE.message)" value="913" />
        <message message="$(string.ETW.event.ETW_EVENT_UPDATE_TRACE.message)" value="914" />
        <message message="$(string.ETW.event.ETW_EVENT_FLUSH_TRACE.message)" value="915" />
        <message message="$(string.ETW.event.ETW_EVENT_PROVIDER_ENABLED.message)" value="916" />
        <message message="$(string.ETW.event.ETW_EVENT_PROVIDER_DISABLED.message)" value="917" />
        <message message="$(string.ETW.event.ETW_EVENT_CHANGE_PROVIDER_SD.message)" value="918" />
        <message message="$(string.ETW.event.ETW_EVENT_CHANGE_SESSION_SD.message)" value="919" />
        <message message="$(string.ETW.task.ETW_TASK_PROVIDER.message)" value="920" />
        <message message="$(string.ETW.task.ETW_TASK_SESSION.message)" value="921" />
        <message message="$(string.ETW.task.ETW_TASK_LOGGING.message)" value="923" />
        <message message="$(string.ETW.opcode.ETW_OPCODE_STOP.message)" value="925" />
        <message message="$(string.ETW.opcode.ETW_OPCODE_START.message)" value="926" />
        <message message="$(string.ETW.opcode.ETW_OPCODE_DISABLE.message)" value="927" />
        <message message="$(string.ETW.opcode.ETW_OPCODE_ENABLE.message)" value="928" />
        <message message="$(string.ETW.opcode.ETW_OPCODE_UNREGISTER.message)" value="929" />
        <message message="$(string.ETW.opcode.ETW_OPCODE_REGISTER.message)" value="930" />
        <message message="$(string.ETW.opcode.ETW_OPCODE_FLUSH.message)" value="931" />
        <message message="$(string.ETW.opcode.ETW_OPCODE_CONFIGURE.message)" value="932" />
        <message message="$(string.ETW.opcode.ETW_OPCODE_WRITE_BUFFER.message)" value="935" />
        <message message="$(string.ETW.opcode.ETW_OPCODE_FILE_SWITCH.message)" value="936" />
        <message message="$(string.ETW.keyword.EVENT_TRACING_KEYWORD_PROVIDER.message)" value="938" />
        <message message="$(string.ETW.keyword.EVENT_TRACING_KEYWORD_SESSION.message)" value="939" />
        <message message="$(string.ETW.event.ETW_EVENT_USER_MODE_STACK_TRACE.message)" value="940" />
        <message message="$(string.ETW.task.ETW_TASK_STACK_TRACE.message)" value="941" />
        <message message="$(string.ETW.opcode.ETW_OPCODE_USER_MODE_STACK_TRACE.message)" value="942" />
        <message message="$(string.ETW.channel.analytic.message)" value="943" />
        <message message="$(string.ETW.channel.admin.message)" value="944" />
        <message message="$(string.ETW.task.ETW_TASK_LOST_EVENT.message)" value="945" />
        <message message="$(string.ETW.keyword.EVENT_TRACING_KEYWORD_LOST_EVENT.message)" value="946" />
        <message message="$(string.ETW.ReasonMap.UnsupportedAppendLoggerMode.message)" value="947" />
        <message message="$(string.ETW.ReasonMap.UnsupportedAppendOsVersion.message)" value="948" />
        <message message="$(string.ETW.ReasonMap.UnsupportedAppendPointerSize.message)" value="949" />
        <message message="$(string.ETW.ReasonMap.UnsupportedAppendBufferSize.message)" value="950" />
        <message message="$(string.ETW.ReasonMap.AppendAutologgerBufferSizeMismatch.message)" value="951" />
        <message message="$(string.ETW.ReasonMap.UnsupportedAppendPreallocateMode.message)" value="952" />
        <message message="$(string.ETW.ReasonMap.FileSizeQueryFailed.message)" value="953" />
        <message message="$(string.ETW.ReasonMap.MaxFileSizeReached.message)" value="954" />
        <message message="$(string.ETW.ReasonMap.AppendBuffersWrittenZero.message)" value="955" />
        <message message="$(string.ETW.ReasonMap.AppendProcessorCountMismatch.message)" value="956" />
        <message message="$(string.StoreMgrProviderName)" value="960" />
        <message message="$(string.StoreMgrOperationalChannelName)" value="961" />
        <message message="$(string.StoreMgr.CorruptPage)" value="962" />
        <message message="$(string.StoreMgr.CorruptRAM)" value="963" />
        <message message="$(string.StoreMgr.CorruptFlash)" value="964" />
        <message message="$(string.StoreMgr.UnpersistFailure)" value="965" />
        <message message="$(string.StoreMgr.CacheTermination)" value="966" />
        <message message="$(string.StoreMgr.CT_ReasonCorruption)" value="967" />
        <message message="$(string.StoreMgr.CT_ReasonIoFailure)" value="968" />
        <message message="$(string.LicensingStartServiceTrigger.ProviderName)" value="1000" />
        <message message="$(string.WSServiceStartServiceTrigger.ProviderName)" value="1010" />
        <message message="$(string.LiveDump.ProviderName)" value="1100" />
        <message message="$(string.LiveDump.channel.analytic.message)" value="1101" />
        <message message="$(string.LiveDump.task.LIVEDUMP_TASK_CAPTURE_API.message)" value="1102" />
        <message message="$(string.LiveDump.task.LIVEDUMP_TASK_SIZING_WORKFLOW.message)" value="1103" />
        <message message="$(string.LiveDump.task.LIVEDUMP_TASK_CAPTURE_PAGES_WORKFLOW.message)" value="1104" />
        <message message="$(string.LiveDump.task.LIVEDUMP_TASK_WRITE_DEFERRED_DATA_API.message)" value="1105" />
        <message message="$(string.LiveDump.task.LIVEDUMP_TASK_DISCARD_DEFERRED_DATA_API.message)" value="1106" />
        <message message="$(string.LiveDump.event.LIVEDUMP_EVENT_SIZING_WORKFLOW_MIRRORING_START.message)" value="1107" />
        <message message="$(string.LiveDump.event.LIVEDUMP_EVENT_SIZING_WORKFLOW_MIRRORING_PHASE0_END.message)" value="1108" />
        <message message="$(string.LiveDump.event.LIVEDUMP_EVENT_SIZING_WORKFLOW_MIRRORING_PHASE1_END.message)" value="1109" />
        <message message="$(string.LiveDump.event.LIVEDUMP_EVENT_SIZING_WORKFLOW_SYSTEM_QUIESCE_START.message)" value="1110" />
        <message message="$(string.LiveDump.event.LIVEDUMP_EVENT_SIZING_WORKFLOW_SYSTEM_QUIESCE_END.message)" value="1111" />
        <message message="$(string.LiveDump.event.LIVEDUMP_EVENT_CAPTURE_PAGES_WORKFLOW_MIRRORING_START.message)" value="1112" />
        <message message="$(string.LiveDump.event.LIVEDUMP_EVENT_CAPTURE_PAGES_WORKFLOW_MIRRORING_PHASE0_END.message)" value="1113" />
        <message message="$(string.LiveDump.event.LIVEDUMP_EVENT_CAPTURE_PAGES_WORKFLOW_MIRRORING_PHASE1_END.message)" value="1114" />
        <message message="$(string.LiveDump.event.LIVEDUMP_EVENT_CAPTURE_PAGES_WORKFLOW_SYSTEM_QUIESCE_START.message)" value="1115" />
        <message message="$(string.LiveDump.event.LIVEDUMP_EVENT_CAPTURE_PAGES_WORKFLOW_SYSTEM_QUIESCE_END.message)" value="1116" />
        <message message="$(string.LiveDump.event.LIVEDUMP_EVENT_CAPTURE_PAGES_WORKFLOW_BUFFERING_START.message)" value="1117" />
        <message message="$(string.LiveDump.event.LIVEDUMP_EVENT_CAPTURE_PAGES_WORKFLOW_BUFFERING_END.message)" value="1118" />
        <message message="$(string.LiveDump.event.LIVEDUMP_EVENT_CAPTURE_API_START.message)" value="1119" />
        <message message="$(string.LiveDump.event.LIVEDUMP_EVENT_CAPTURE_API_END.message)" value="1120" />
        <message message="$(string.LiveDump.event.LIVEDUMP_EVENT_WRITE_DUMPDATA_TO_FILE_START.message)" value="1121" />
        <message message="$(string.LiveDump.event.LIVEDUMP_EVENT_WRITE_DUMPDATA_TO_FILE_END.message)" value="1122" />
        <message message="$(string.LiveDump.opcode.LIVEDUMP_API_START.message)" value="1123" />
        <message message="$(string.LiveDump.opcode.LIVEDUMP_API_END.message)" value="1124" />
        <message message="$(string.LiveDump.opcode.LIVEDUMP_DUMPFILE_WRITE_START.message)" value="1125" />
        <message message="$(string.LiveDump.opcode.LIVEDUMP_DUMPFILE_WRITE_END.message)" value="1126" />
        <message message="$(string.LiveDump.opcode.LIVEDUMP_MIRRORING_START.message)" value="1127" />
        <message message="$(string.LiveDump.opcode.LIVEDUMP_MIRRORING_PHASE0_END.message)" value="1128" />
        <message message="$(string.LiveDump.opcode.LIVEDUMP_MIRRORING_PHASE1_END.message)" value="1129" />
        <message message="$(string.LiveDump.opcode.LIVEDUMP_SYSTEM_QUIESCE_START.message)" value="1130" />
        <message message="$(string.LiveDump.opcode.LIVEDUMP_SYSTEM_QUIESCE_END.message)" value="1131" />
        <message message="$(string.LiveDump.opcode.LIVEDUMP_PAGE_BUFFERING_START.message)" value="1132" />
        <message message="$(string.LiveDump.opcode.LIVEDUMP_PAGE_BUFFERING_END.message)" value="1133" />
        <message message="$(string.LiveDump.event.LIVEDUMP_EVENT_WRITE_DEFERRED_DATA_API_START.message)" value="1134" />
        <message message="$(string.LiveDump.event.LIVEDUMP_EVENT_WRITE_DEFERRED_DATA_API_END.message)" value="1135" />
        <message message="$(string.LiveDump.event.LIVEDUMP_EVENT_WRITE_DEFERRED_DUMPDATA_TO_FILE_START.message)" value="1136" />
        <message message="$(string.LiveDump.event.LIVEDUMP_EVENT_WRITE_DEFERRED_DUMPDATA_TO_FILE_END.message)" value="1137" />
        <message message="$(string.LiveDump.event.LIVEDUMP_EVENT_DISCARD_DEFERRED_DATA_API_START.message)" value="1138" />
        <message message="$(string.LiveDump.event.LIVEDUMP_EVENT_DISCARD_DEFERRED_DATA_API_END.message)" value="1139" />
        <message message="$(string.LiveDump.event.LIVEDUMP_EVENT_SIZING_WORKFLOW_BUFFER_ESTIMATION.message)" value="1140" />
        <message message="$(string.LiveDump.event.LIVEDUMP_EVENT_SIZING_WORKFLOW_BUFFER_ALLOCATION.message)" value="1141" />
        <message message="$(string.LiveDump.opcode.LIVEDUMP_BUFFER_ESTIMATION.message)" value="1142" />
        <message message="$(string.LiveDump.opcode.LIVEDUMP_BUFFER_ALLOCATION.message)" value="1143" />
        <message message="$(string.LiveDump.event.LIVEDUMP_EVENT_SIZING_WORKFLOW_REMOVEPAGES_CALLBACKS_START.message)" value="1144" />
        <message message="$(string.LiveDump.event.LIVEDUMP_EVENT_SIZING_WORKFLOW_REMOVEPAGES_CALLBACKS_END.message)" value="1145" />
        <message message="$(string.LiveDump.event.LIVEDUMP_EVENT_SIZING_WORKFLOW_REMOVEPAGES_CALLBACK_START.message)" value="1146" />
        <message message="$(string.LiveDump.event.LIVEDUMP_EVENT_SIZING_WORKFLOW_REMOVEPAGES_CALLBACK_END.message)" value="1147" />
        <message message="$(string.LiveDump.event.LIVEDUMP_EVENT_SIZING_WORKFLOW_REMOVEPAGES_CALLBACK_FAILURE.message)" value="1148" />
        <message message="$(string.LiveDump.opcode.LIVEDUMP_REMOVEPAGES.message)" value="1149" />
        <message message="$(string.LiveDump.event.LIVEDUMP_EVENT_MEMORY_PRESSURE_ABORT.message)" value="1150" />
        <message message="$(string.IoMgr_MountBegin.EventMessage)" value="1200" />
        <message message="$(string.IoMgr_MountSucceeded.EventMessage)" value="1201" />
        <message message="$(string.IoMgr_MountFailed.EventMessage)" value="1202" />
        <message message="$(string.IoMgr.ProviderName)" value="1203" />
        <message message="$(string.IoMgr.channel.operational.message)" value="1204" />
        <message message="$(string.KernelAuditApiCalls.ProviderName)" value="1300" />
      </messageTable>
    </events>
  </instrumentation>
</assembly>