Windows Kernel Trace MOF - Windows 11 26H1 (Build 28000.1575)

WindowsKernelTrace.mof

[dynamic: ToInstance, Description("Windows Kernel Trace"), Guid("{9e814aad-3204-11d2-9a82-006008a86939}"), LOCALE("ms_409")]
class MSNT_SystemTrace : EventTrace
{
	[Description("Enable Flags"),
	 ValueDescriptions{"Process creations/deletions", "Thread creations/deletions", "Image load", "Process counters", "Context switches", "Deferred procedure calls", "Interrupts", "System calls", "Disk IO", "File details", "Disk IO entry", "Dispatcher operations", "Page faults", "Hard page faults", "Virtual memory allocations", "Network TCP/IP", "Registry details", "ALPC", "Split IO", "Driver delays", "Sample based profiling", "File IO completion", "File IO"},
	 DefineValues{"EVENT_TRACE_FLAG_PROCESS", "EVENT_TRACE_FLAG_THREAD", "EVENT_TRACE_FLAG_IMAGE_LOAD", "EVENT_TRACE_FLAG_PROCESS_COUNTERS", "EVENT_TRACE_FLAG_CSWITCH", "EVENT_TRACE_FLAG_DPC", "EVENT_TRACE_FLAG_INTERRUPT", "EVENT_TRACE_FLAG_SYSTEMCALL", "EVENT_TRACE_FLAG_DISK_IO", "EVENT_TRACE_FLAG_DISK_FILE_IO", "EVENT_TRACE_FLAG_DISK_IO_INIT", "EVENT_TRACE_FLAG_DISPATCHER", "EVENT_TRACE_FLAG_MEMORY_PAGE_FAULTS", "EVENT_TRACE_FLAG_MEMORY_HARD_FAULTS", "EVENT_TRACE_FLAG_VIRTUAL_ALLOC", "EVENT_TRACE_FLAG_NETWORK_TCPIP", "EVENT_TRACE_FLAG_REGISTRY", "EVENT_TRACE_FLAG_ALPC", "EVENT_TRACE_FLAG_SPLIT_IO", "EVENT_TRACE_FLAG_DRIVER", "EVENT_TRACE_FLAG_PROFILE", "EVENT_TRACE_FLAG_FILE_IO", "EVENT_TRACE_FLAG_FILE_IO_INIT"},
	 Values{"process", "thread", "img", "proccntr", "cswitch", "dpc", "isr", "syscall", "disk", "file", "diskinit", "dispatcher", "pf", "hf", "virtalloc", "net", "registry", "alpc", "splitio", "driver", "profile", "fileiocompletion", "fileio"},
	 ValueMap{"0x00000001", "0x00000002", "0x00000004", "0x00000008", "0x00000010", "0x00000020", "0x00000040", "0x00000080", "0x00000100", "0x00000200", "0x00000400", "0x00000800", "0x00001000", "0x00002000", "0x00004000", "0x00010000", "0x00020000", "0x00100000", "0x00200000", "0x00800000", "0x01000000", "0x02000000", "0x04000000"}
	] uint32 Flags;
};

[dynamic: ToInstance, Description("File Name"), Guid("{90cbdc39-4a3e-11d1-84f4-0000f80464e3}"), DisplayName("FileIo"), EventVersion(2), LOCALE("ms_409")]
class FileIo_V2 : MSNT_SystemTrace
{
};

[dynamic: ToInstance, Description("MapFile"), EventType{37, 38, 39, 40}, EventTypeName{"MapFile", "UnmapFile", "MapFileDCStart", "MapFileDCEnd"}, LOCALE("ms_409")]
class FileIo_V2_MapFile : FileIo_V2
{
	[WmiDataId(1), Description("ViewBase"), pointer, read] uint32 ViewBase;
	[WmiDataId(2), Description("FileObject"), pointer, read] uint32 FileObject;
	[WmiDataId(3), Description("MiscInfo"), format("x"), read] uint64 MiscInfo;
	[WmiDataId(4), Description("ViewSize"), extension("SizeT"), read] object ViewSize;
	[WmiDataId(5), Description("ProcessId"), read] uint32 ProcessId;
};

[dynamic: ToInstance, Description("File Dir Enum"), EventType{72, 77}, EventTypeName{"DirEnum", "DirNotify"}, LOCALE("ms_409")]
class FileIo_V2_DirEnum : FileIo_V2
{
	[WmiDataId(1), Description("IrpPtr"), pointer, read] uint32 IrpPtr;
	[WmiDataId(2), Description("TTID"), pointer, read] uint32 TTID;
	[WmiDataId(3), Description("FileObject"), pointer, read] uint32 FileObject;
	[WmiDataId(4), Description("FileKey"), pointer, read] uint32 FileKey;
	[WmiDataId(5), Description("Length"), read] uint32 Length;
	[WmiDataId(6), Description("InfoClass"), read] uint32 InfoClass;
	[WmiDataId(7), Description("FileIndex"), read] uint32 FileIndex;
	[WmiDataId(8), Description("FileName"), StringTermination("NullTerminated"), format("w"), read] string FileName;
};

[dynamic: ToInstance, Description("File Operation End"), EventType(76), EventTypeName("OperationEnd"), LOCALE("ms_409")]
class FileIo_V2_OpEnd : FileIo_V2
{
	[WmiDataId(1), Description("IrpPtr"), pointer, read] uint32 IrpPtr;
	[WmiDataId(2), Description("ExtraInfo"), pointer, read] uint32 ExtraInfo;
	[WmiDataId(3), Description("NtStatus"), read] uint32 NtStatus;
};

[dynamic: ToInstance, Description("File Simple Operation"), EventType{65, 66, 73}, EventTypeName{"Cleanup", "Close", "Flush"}, LOCALE("ms_409")]
class FileIo_V2_SimpleOp : FileIo_V2
{
	[WmiDataId(1), Description("IrpPtr"), pointer, read] uint32 IrpPtr;
	[WmiDataId(2), Description("TTID"), pointer, read] uint32 TTID;
	[WmiDataId(3), Description("FileObject"), pointer, read] uint32 FileObject;
	[WmiDataId(4), Description("FileKey"), pointer, read] uint32 FileKey;
};

[dynamic: ToInstance, Description("File Read Write"), EventType{67, 68}, EventTypeName{"Read", "Write"}, LOCALE("ms_409")]
class FileIo_V2_ReadWrite : FileIo_V2
{
	[WmiDataId(1), Description("Offset"), read] uint64 Offset;
	[WmiDataId(2), Description("IrpPtr"), pointer, read] uint32 IrpPtr;
	[WmiDataId(3), Description("TTID"), pointer, read] uint32 TTID;
	[WmiDataId(4), Description("FileObject"), pointer, read] uint32 FileObject;
	[WmiDataId(5), Description("FileKey"), pointer, read] uint32 FileKey;
	[WmiDataId(6), Description("IoSize"), read] uint32 IoSize;
	[WmiDataId(7), Description("IoFlags"), read] uint32 IoFlags;
};

[dynamic: ToInstance, Description("File Information"), EventType{69, 70, 71, 74, 75}, EventTypeName{"SetInfo", "Delete", "Rename", "QueryInfo", "FSControl"}, LOCALE("ms_409")]
class FileIo_V2_Info : FileIo_V2
{
	[WmiDataId(1), Description("IrpPtr"), pointer, read] uint32 IrpPtr;
	[WmiDataId(2), Description("TTID"), pointer, read] uint32 TTID;
	[WmiDataId(3), Description("FileObject"), pointer, read] uint32 FileObject;
	[WmiDataId(4), Description("FileKey"), pointer, read] uint32 FileKey;
	[WmiDataId(5), Description("ExtraInfo"), pointer, read] uint32 ExtraInfo;
	[WmiDataId(6), Description("InfoClass"), read] uint32 InfoClass;
};

[dynamic: ToInstance, Description("File Name"), EventType{0, 32, 35, 36}, EventTypeName{"Name", "FileCreate", "FileDelete", "FileRundown"}, LOCALE("ms_409")]
class FileIo_V2_Name : FileIo_V2
{
	[WmiDataId(1), Description("FileObject"), pointer, read] uint32 FileObject;
	[WmiDataId(2), Description("FileName"), StringTermination("NullTerminated"), format("w"), read] string FileName;
};

[dynamic: ToInstance, Description("File Create"), EventType(64), EventTypeName("Create"), LOCALE("ms_409")]
class FileIo_V2_Create : FileIo_V2
{
	[WmiDataId(1), Description("IrpPtr"), pointer, read] uint32 IrpPtr;
	[WmiDataId(2), Description("TTID"), pointer, read] uint32 TTID;
	[WmiDataId(3), Description("FileObject"), pointer, read] uint32 FileObject;
	[WmiDataId(4), Description("CreateOptions"), read] uint32 CreateOptions;
	[WmiDataId(5), Description("FileAttributes"), read] uint32 FileAttributes;
	[WmiDataId(6), Description("ShareAccess"), read] uint32 ShareAccess;
	[WmiDataId(7), Description("OpenPath"), StringTermination("NullTerminated"), format("w"), read] string OpenPath;
};

[dynamic: ToInstance, Description("PerfInfo Event"), Guid("{ce1dbfb4-137e-4da6-87b0-3f59aa102cbc}"), DisplayName("PerfInfo"), EventVersion(0), LOCALE("ms_409")]
class PerfInfo_V0 : MSNT_SystemTrace
{
};

[dynamic: ToInstance, Description("Mark"), EventType(34), EventTypeName("Mark"), LOCALE("ms_409")]
class Mark_V0 : PerfInfo_V0
{
	[WmiDataId(1), Description("Message"), StringTermination("NullTerminated"), read] string Message;
	[WmiDataId(2), Description("Reserved"), read, MAX(1)] char16 Padding;
};

[dynamic: ToInstance, Description("Object Manager Events"), Guid("{89497f50-effe-4440-8cf2-ce6b1cdcaca7}"), DisplayName("Object"), EventVersion(2), LOCALE("ms_409")]
class ObTrace : MSNT_SystemTrace
{
};

[dynamic: ToInstance, Description("Object Reference/Dereference Events"), EventType{50, 51}, EventTypeName{"ReferenceObject", "DereferenceObject"}, LOCALE("ms_409")]
class ObReferenceEvent : ObTrace
{
	[WmiDataId(1), Description("Object"), format("x"), pointer, read] uint32 Object;
	[WmiDataId(2), Description("Tag"), format("x"), read] uint32 Tag;
	[WmiDataId(3), Description("Count"), read] uint32 Count;
};

[dynamic: ToInstance, Description("Object Type Events"), EventType{36, 37}, EventTypeName{"TypeDCStart", "TypeDCEnd"}, LOCALE("ms_409")]
class ObTypeEvent : ObTrace
{
	[WmiDataId(1), Description("ObjectType"), read] uint16 ObjectType;
	[WmiDataId(2), Description("Reserved"), read] uint16 Reserved;
	[WmiDataId(3), Description("TypeName"), StringTermination("NullTerminated"), format("w"), read] string TypeName;
};

[dynamic: ToInstance, Description("Object Handle Events"), EventType{38, 39}, EventTypeName{"HandleDCStart", "HandleDCEnd"}, LOCALE("ms_409")]
class ObHandleRundownEvent : ObTrace
{
	[WmiDataId(1), Description("Object"), format("x"), pointer, read] uint32 Object;
	[WmiDataId(2), Description("ProcessId"), format("x"), read] uint32 ProcessId;
	[WmiDataId(3), Description("Handle"), format("x"), read] uint32 Handle;
	[WmiDataId(4), Description("ObjectType"), read] uint16 ObjectType;
	[WmiDataId(5), Description("ObjectName"), StringTermination("NullTerminated"), format("w"), read] string ObjectName;
};

[dynamic: ToInstance, Description("Object Create/Delete Events"), EventType{48, 49}, EventTypeName{"CreateObject", "DeleteObject"}, LOCALE("ms_409")]
class ObObjectEvent : ObTrace
{
	[WmiDataId(1), Description("Object"), format("x"), pointer, read] uint32 Object;
	[WmiDataId(2), Description("ObjectType"), read] uint16 ObjectType;
};

[dynamic: ToInstance, Description("Handle Create/Close Events"), EventType{32, 33}, EventTypeName{"CreateHandle", "CloseHandle"}, LOCALE("ms_409")]
class ObHandleEvent : ObTrace
{
	[WmiDataId(1), Description("Object"), format("x"), pointer, read] uint32 Object;
	[WmiDataId(2), Description("Handle"), format("x"), read] uint32 Handle;
	[WmiDataId(3), Description("ObjectType"), read] uint16 ObjectType;
	[WmiDataId(4), Description("ObjectName"), StringTermination("NullTerminated"), format("w"), read] string ObjectName;
};

[dynamic: ToInstance, Description("Page Fault Event"), Guid("{3d6fa8d3-fe05-11d0-9dda-00c04fd7ba7c}"), DisplayName("PageFault"), EventVersion(2), LOCALE("ms_409")]
class PageFault_V2 : MSNT_SystemTrace
{
};

[dynamic: ToInstance, Description("Heap Range Rundown Event"), EventType(100), EventTypeName("HRRundown"), EventVersion(3), LOCALE("ms_409")]
class PageFault_HeapRangeRundown_V3 : PageFault_V2
{
	[WmiDataId(1), Description("HeapHandle"), pointer, read] uint32 HeapHandle;
	[WmiDataId(2), Description("HRFlags"), format("x"), read] uint32 HRFlags;
	[WmiDataId(3), Description("HRPid"), format("x"), read] uint32 HRPid;
	[WmiDataId(4), Description("HRRangeCount"), read] uint32 HRRangeCount;
	[WmiDataId(5), Description("Reserved"), read] uint32 Reserved;
};

[dynamic: ToInstance, Description("Hard Page Fault Event"), EventType(32), EventTypeName("HardFault"), LOCALE("ms_409")]
class PageFault_HardFault : PageFault_V2
{
	[WmiDataId(1), Description("Initial Time"), extension("WmiTime"), read] object InitialTime;
	[WmiDataId(2), Description("ReadOffset"), format("x"), read] uint64 ReadOffset;
	[WmiDataId(3), Description("VirtualAddress"), pointer, read] uint32 VirtualAddress;
	[WmiDataId(4), Description("FileObject"), pointer, read] uint32 FileObject;
	[WmiDataId(5), Description("ThreadId"), format("x"), read] uint32 TThreadId;
	[WmiDataId(6), Description("ByteCount"), read] uint32 ByteCount;
};

[dynamic: ToInstance, Description("Virtual Allocations Rundown"), EventType{128, 129}, EventTypeName{"VirtualAllocDCStart", "VirtualAllocDCEnd"}, LOCALE("ms_409")]
class PageFault_VirtualAllocRundown : PageFault_V2
{
	[WmiDataId(1), Description("BaseAddress"), pointer, read] uint32 BaseAddress;
	[WmiDataId(2), Description("RegionSize"), extension("SizeT"), read] object RegionSize;
	[WmiDataId(3), Description("ProcessId"), read] uint32 ProcessId;
	[WmiDataId(5), Description("CommitSizeInBytes"), extension("SizeT"), read] object CommitSizeInBytes;
};

[dynamic: ToInstance, Description("Virtual Allocations"), EventType{98, 99}, EventTypeName{"VirtualAlloc", "VirtualFree"}, LOCALE("ms_409")]
class PageFault_VirtualAlloc : PageFault_V2
{
	[WmiDataId(1), Description("BaseAddress"), pointer, read] uint32 BaseAddress;
	[WmiDataId(2), Description("RegionSize"), extension("SizeT"), read] object RegionSize;
	[WmiDataId(3), Description("ProcessId"), read] uint32 ProcessId;
};

[dynamic: ToInstance, Description("MemReset Info"), EventType{134}, EventTypeName{"MemResetInfo"}, LOCALE("ms_409")]
class PageFault_MemReset : PageFault_V2
{
	[WmiDataId(1), Description("BaseAddress"), pointer, read] uint32 BaseAddress;
	[WmiDataId(2), Description("SizeInBytes"), extension("SizeT"), read] object SizeInBytes;
};

[dynamic: ToInstance, Description("Heap Range Rundown Event"), EventType(100), EventTypeName("HRRundown"), LOCALE("ms_409")]
class PageFault_HeapRangeRundown_V2 : PageFault_V2
{
	[WmiDataId(1), Description("HeapHandle"), pointer, read] uint32 HeapHandle;
	[WmiDataId(2), Description("HRFlags"), format("x"), read] uint32 HRFlags;
	[WmiDataId(3), Description("HRPid"), format("x"), read] uint32 HRPid;
	[WmiDataId(4), Description("HRRangeCount"), read] uint32 HRRangeCount;
};

[dynamic: ToInstance, Description("Heap Range Destroy Event"), EventType(104), EventTypeName("HRDestroy"), LOCALE("ms_409")]
class PageFault_HeapRangeDestroy : PageFault_V2
{
	[WmiDataId(1), Description("HeapHandle"), pointer, read] uint32 HeapHandle;
};

[dynamic: ToInstance,
 Description("Page Fault Event"),
 EventType{10, 11, 12, 13, 14, 15},
 EventTypeName{"TransitionFault", "DemandZeroFault", "CopyOnWrite", "GuardPageFault", "HardPageFault", "AccessViolation"},
 LOCALE("ms_409")
]
class PageFault_TypeGroup1 : PageFault_V2
{
	[WmiDataId(1), Description("VirtualAddress"), pointer, read] uint32 VirtualAddress;
	[WmiDataId(2), Description("ProgramCounter"), pointer, read] uint32 ProgramCounter;
};

[dynamic: ToInstance, Description("Image Load in PageFile Event"), EventType(105), EventTypeName("ImageLoadBacked"), LOCALE("ms_409")]
class PageFault_ImageLoadBacked : PageFault_V2
{
	[WmiDataId(1), Description("FileObject"), pointer, read] uint32 FileObject;
	[WmiDataId(2), Description("DeviceChar"), format("x"), read] uint32 DeviceChar;
	[WmiDataId(3), Description("FileChar"), format("x"), read] uint16 FileChar;
	[WmiDataId(4), Description("LoadFlags"), format("x"), read] uint16 LoadFlags;
};

[dynamic: ToInstance, Description("Heap Range Event"), EventType{102, 103}, EventTypeName{"HRReserve", "HRRelease"}, LOCALE("ms_409")]
class PageFault_HeapRangeTypeGroup : PageFault_V2
{
	[WmiDataId(1), Description("HeapHandle"), pointer, read] uint32 HeapHandle;
	[WmiDataId(2), Description("HRAddress"), pointer, read] uint32 HRAddress;
	[WmiDataId(3), Description("HRSize"), extension("SizeT"), read] object HRSize;
};

[dynamic: ToInstance, Description("Heap Range Create Event"), EventType(101), EventTypeName("HRCreate"), LOCALE("ms_409")]
class PageFault_HeapRangeCreate : PageFault_V2
{
	[WmiDataId(1), Description("HeapHandle"), pointer, read] uint32 HeapHandle;
	[WmiDataId(2), Description("FirstRangeSize"), extension("SizeT"), read] object FirstRangeSize;
	[WmiDataId(3), Description("HRCreateFlags"), format("x"), read] uint32 HRCreateFlags;
};

[dynamic: ToInstance, Description("Virtual Rotate"), EventType{127}, EventTypeName{"VirtualRotate"}, LOCALE("ms_409")]
class PageFault_VirtualRotate : PageFault_V2
{
	[WmiDataId(1), Description("BaseAddress"), pointer, read] uint32 BaseAddress;
	[WmiDataId(2), Description("SizeInBytes"), extension("SizeT"), read] object SizeInBytes;
};

[dynamic: ToInstance, Description("PerfInfo Event"), Guid("{ce1dbfb4-137e-4da6-87b0-3f59aa102cbc}"), DisplayName("PerfInfo"), EventVersion(2), LOCALE("ms_409")]
class PerfInfo_V2 : MSNT_SystemTrace
{
};

[dynamic: ToInstance, Description("Finalize KTIMER2 Disablement Event"), EventType(108), EventTypeName("FinalizeKTimer2"), LOCALE("ms_409")]
class FinalizeKTimer2 : PerfInfo_V2
{
	[WmiDataId(1), Description("Timer Address"), pointer, read] uint32 Timer;
	[WmiDataId(2), Description("Disable Callback"), pointer, read] uint32 DisableCallback;
	[WmiDataId(3), Description("Disable Context"), pointer, read] uint32 DisableContext;
};

[dynamic: ToInstance, Description("WDF ISR"), EventType{96, 97}, EventTypeName{"WdfISR", "WdfPassiveISR"}, LOCALE("ms_409")]
class WDF_ISR : PerfInfo_V2
{
	[WmiDataId(1), Description("Routine"), pointer, read] uint32 Routine;
};

[dynamic: ToInstance, Description("WDF DPC"), EventType{98}, EventTypeName{"WdfDPC"}, LOCALE("ms_409")]
class WDF_DPC : PerfInfo_V2
{
	[WmiDataId(1), Description("Routine"), pointer, read] uint32 Routine;
};

[dynamic: ToInstance, Description("Unexpected ISR"), EventType(92), EventTypeName("ISR-Unexpected"), LOCALE("ms_409")]
class ISR_Unexpected : PerfInfo_V2
{
	[WmiDataId(1), Description("Interrupt Vector"), read] uint16 Vector;
};

[dynamic: ToInstance, Description("Context Registers ARM64"), EventType(123), EventTypeName("ContextRegistersARM64"), LOCALE("ms_409")]
class ContextRegistersARM64 : PerfInfo_V2
{
	[WmiDataId(1), Description("Cpsr"), read] uint32 Cpsr;
	[WmiDataId(2), Description("X0"), read] uint64 X0;
	[WmiDataId(3), Description("X1"), read] uint64 X1;
	[WmiDataId(4), Description("X2"), read] uint64 X2;
	[WmiDataId(5), Description("X3"), read] uint64 X3;
	[WmiDataId(6), Description("X4"), read] uint64 X4;
	[WmiDataId(7), Description("X5"), read] uint64 X5;
	[WmiDataId(8), Description("X6"), read] uint64 X6;
	[WmiDataId(9), Description("X7"), read] uint64 X7;
	[WmiDataId(10), Description("X8"), read] uint64 X8;
	[WmiDataId(11), Description("X9"), read] uint64 X9;
	[WmiDataId(12), Description("X10"), read] uint64 X10;
	[WmiDataId(13), Description("X11"), read] uint64 X11;
	[WmiDataId(14), Description("X12"), read] uint64 X12;
	[WmiDataId(15), Description("X13"), read] uint64 X13;
	[WmiDataId(16), Description("X14"), read] uint64 X14;
	[WmiDataId(17), Description("X15"), read] uint64 X15;
	[WmiDataId(18), Description("X16"), read] uint64 X16;
	[WmiDataId(19), Description("X17"), read] uint64 X17;
	[WmiDataId(20), Description("X18"), read] uint64 X18;
	[WmiDataId(21), Description("X19"), read] uint64 X19;
	[WmiDataId(22), Description("X20"), read] uint64 X20;
	[WmiDataId(23), Description("X21"), read] uint64 X21;
	[WmiDataId(24), Description("X22"), read] uint64 X22;
	[WmiDataId(25), Description("X23"), read] uint64 X23;
	[WmiDataId(26), Description("X24"), read] uint64 X24;
	[WmiDataId(27), Description("X25"), read] uint64 X25;
	[WmiDataId(28), Description("X26"), read] uint64 X26;
	[WmiDataId(29), Description("X27"), read] uint64 X27;
	[WmiDataId(30), Description("X28"), read] uint64 X28;
	[WmiDataId(31), Description("Fp"), read] uint64 Fp;
	[WmiDataId(32), Description("Lr"), read] uint64 Lr;
	[WmiDataId(33), Description("Sp"), read] uint64 Sp;
	[WmiDataId(34), Description("Pc"), read] uint64 Pc;
};

[dynamic: ToInstance, Description("Sampled Profile"), EventType(46), EventTypeName("SampleProf"), LOCALE("ms_409")]
class SampledProfile : PerfInfo_V2
{
	[WmiDataId(1), Description("InstructionPointer"), pointer, read] uint32 InstructionPointer;
	[WmiDataId(2), Description("ThreadId"), read] uint32 ThreadId;
	[WmiDataId(3), Description("Count"), read] uint16 Count;
	[WmiDataId(4), Description("Reserved"), read] uint16 Reserved;
};

[dynamic: ToInstance, Description("Cancel KTIMER2 Event"), EventType(106), EventTypeName("CancelKTimer2"), LOCALE("ms_409")]
class CancelKTimer2 : PerfInfo_V2
{
	[WmiDataId(1), Description("Timer Address"), pointer, read] uint32 Timer;
};

[dynamic: ToInstance, Description("PMC Counter Profile"), EventType(47), EventTypeName("PmcCounterProf"), LOCALE("ms_409")]
class PmcCounterProfile : PerfInfo_V2
{
	[WmiDataId(1), Description("InstructionPointer"), pointer, read] uint32 InstructionPointer;
	[WmiDataId(2), Description("ThreadId"), read] uint32 ThreadId;
	[WmiDataId(3), Description("ProfileSource"), read] uint16 ProfileSource;
	[WmiDataId(4), Description("Reserved"), read] uint16 Reserved;
};

[dynamic: ToInstance, Description("PMC Counter Configuration"), EventType(48), EventTypeName("PmcCtrConfig"), LOCALE("ms_409")]
class PmcCounterConfig_V2 : PerfInfo_V2
{
	[WmiDataId(1), Description("Number of counters"), read] uint32 CounterCount;
	[WmiDataId(2), Description("Counter Name"), StringTermination("NullTerminated"), format("w"), WmiSizeIs("CounterCount"), read] string CounterName;
};

[dynamic: ToInstance, Description("System Call Exit"), EventType(52), EventTypeName("SysClExit"), LOCALE("ms_409")]
class SysCallExit : PerfInfo_V2
{
	[WmiDataId(1), Description("SysCallNtStatus"), format("x"), read] uint32 SysCallNtStatus;
};

[dynamic: ToInstance, Description("Message Signaled ISR"), EventType(50), EventTypeName("ISR-MSI"), LOCALE("ms_409")]
class ISR_MSI : PerfInfo_V2
{
	[WmiDataId(1), Description("Initial Time"), extension("WmiTime"), read] object InitialTime;
	[WmiDataId(2), Description("Routine"), pointer, read] uint32 Routine;
	[WmiDataId(3), Description("Return Value"), read] uint8 ReturnValue;
	[WmiDataId(4), Description("Interrupt Vector"), read] uint16 Vector;
	[WmiDataId(5), Description("Reserved"), read] uint8 Reserved;
	[WmiDataId(6), Description("Message Number"), read] uint32 MessageNumber;
};

[dynamic: ToInstance, Description("Disable KTIMER2 Event"), EventType(107), EventTypeName("DisableKTimer2"), LOCALE("ms_409")]
class DisableKTimer2 : PerfInfo_V2
{
	[WmiDataId(1), Description("Timer Address"), pointer, read] uint32 Timer;
	[WmiDataId(2), Description("Disable Callback"), pointer, read] uint32 DisableCallback;
	[WmiDataId(3), Description("Disable Context"), pointer, read] uint32 DisableContext;
	[WmiDataId(4), Description("TimerFlags"), read] uint8 TimerFlags;
};

[dynamic: ToInstance, Description("Set or Expire KTIMER2 Event"), EventType{104, 105}, EventTypeName{"SetKTimer2", "ExpireKTimer2"}, LOCALE("ms_409")]
class SetOrExpireKTimer2 : PerfInfo_V2
{
	[WmiDataId(1), Description("Due Time"), read] uint64 DueTime;
	[WmiDataId(2), Description("Maximum Due Time"), read] uint64 MaximumDueTime;
	[WmiDataId(3), Description("Period"), read] uint64 Period;
	[WmiDataId(4), Description("Timer Address"), pointer, read] uint32 Timer;
	[WmiDataId(5), Description("Callback"), pointer, read] uint32 Callback;
	[WmiDataId(6), Description("Callback Context"), pointer, read] uint32 CallbackContext;
	[WmiDataId(7), Description("TimerFlags"), read] uint8 TimerFlags;
};

[dynamic: ToInstance, Description("ISR"), EventType{67, 95}, EventTypeName{"ISR", "ISR-PASS"}, LOCALE("ms_409")]
class ISR : PerfInfo_V2
{
	[WmiDataId(1), Description("Initial Time"), extension("WmiTime"), read] object InitialTime;
	[WmiDataId(2), Description("Routine"), pointer, read] uint32 Routine;
	[WmiDataId(3), Description("Return Value"), read] uint8 ReturnValue;
	[WmiDataId(4), Description("Interrupt Vector"), read] uint16 Vector;
	[WmiDataId(5), Description("Reserved"), read] uint8 Reserved;
};

[dynamic: ToInstance, Description("PMC Counter Corruption"), EventType(49), EventTypeName("PmcCtrConrruption"), LOCALE("ms_409")]
class PmcCounterCorruption_V2 : PerfInfo_V2
{
	[WmiDataId(1), Description("ProcessorNumber"), read] uint32 ProcessorNumber;
	[WmiDataId(2), Description("Number of counters"), read] uint32 CounterCount;
	[WmiDataId(3), Description("Counter Corruption Status Array"), WmiSizeIs("CounterCount"), read] object CounterStatus;
};

[dynamic: ToInstance, Description("System Call Enter"), EventType(51), EventTypeName("SysClEnter"), LOCALE("ms_409")]
class SysCallEnter : PerfInfo_V2
{
	[WmiDataId(1), Description("SysCallAddress"), pointer, read] uint32 SysCallAddress;
};

[dynamic: ToInstance, Description("IO Timer Events"), EventType{93, 94}, EventTypeName{"IoStartTimer", "IoStopTimer"}, LOCALE("ms_409")]
class IoTimerEvent : PerfInfo_V2
{
	[WmiDataId(1), Description("Device Object"), pointer, read] uint32 DeviceObject;
	[WmiDataId(2), Description("Timer Routine"), pointer, read] uint32 TimerRoutine;
};

[dynamic: ToInstance, Description("WDF WorkItem"), EventType{103}, EventTypeName{"WdfWorkItem"}, LOCALE("ms_409")]
class WDF_WorkItem : PerfInfo_V2
{
	[WmiDataId(1), Description("Routine"), pointer, read] uint32 Routine;
};

[dynamic: ToInstance, Description("Context Registers AMD64"), EventType(122), EventTypeName("ContextRegistersAMD64"), LOCALE("ms_409")]
class ContextRegistersAMD64 : PerfInfo_V2
{
	[WmiDataId(1), Description("Rip"), read] uint64 Rip;
	[WmiDataId(2), Description("Rax"), read] uint64 Rax;
	[WmiDataId(3), Description("Rcx"), read] uint64 Rcx;
	[WmiDataId(4), Description("Rdx"), read] uint64 Rdx;
	[WmiDataId(5), Description("Rbx"), read] uint64 Rbx;
	[WmiDataId(6), Description("Rsp"), read] uint64 Rsp;
	[WmiDataId(7), Description("Rbp"), read] uint64 Rbp;
	[WmiDataId(8), Description("Rsi"), read] uint64 Rsi;
	[WmiDataId(9), Description("Rdi"), read] uint64 Rdi;
	[WmiDataId(10), Description("R8"), read] uint64 R8;
	[WmiDataId(11), Description("R9"), read] uint64 R9;
	[WmiDataId(12), Description("R10"), read] uint64 R10;
	[WmiDataId(13), Description("R11"), read] uint64 R11;
	[WmiDataId(14), Description("R12"), read] uint64 R12;
	[WmiDataId(15), Description("R13"), read] uint64 R13;
	[WmiDataId(16), Description("R14"), read] uint64 R14;
	[WmiDataId(17), Description("R15"), read] uint64 R15;
};

[dynamic: ToInstance, Description("Debugger Enabled"), EventType{58}, EventTypeName{"DebuggerEnabled"}, LOCALE("ms_409")]
class DebuggerEnabled : PerfInfo_V2
{
};

[dynamic: ToInstance, Description("Sampled Profile Interval"), EventType{72, 73, 74}, EventTypeName{"SetInterval", "CollectionStart", "CollectionEnd"}, LOCALE("ms_409")]
class SampledProfileInterval_V2 : PerfInfo_V2
{
	[WmiDataId(1), Description("Profile Source"), read] uint32 Source;
	[WmiDataId(2), Description("New Interval"), read] uint32 NewInterval;
	[WmiDataId(3), Description("Old Interval"), read] uint32 OldInterval;
};

[dynamic: ToInstance, Description("Kernel Hypercalls"), EventType(114), EventTypeName("KernelHypercall"), LOCALE("ms_409")]
class HV_Hypercall : PerfInfo_V2
{
	[WmiDataId(1), Description("Hypercall Callcode"), read] uint32 CallCode;
	[WmiDataId(2), Description("Is fast"), read] uint8 IsFast;
	[WmiDataId(3), Description("Is Nested"), read] uint8 IsNested;
};

[dynamic: ToInstance, Description("DPC"), EventType{66, 68, 69, 70}, EventTypeName{"ThreadedDPC", "DPC", "TimerDPC", "IOTimer"}, LOCALE("ms_409")]
class DPC : PerfInfo_V2
{
	[WmiDataId(1), Description("Initial Time"), extension("WmiTime"), read] object InitialTime;
	[WmiDataId(2), Description("Routine"), pointer, read] uint32 Routine;
};

[dynamic: ToInstance, Description("Spinlock Configure Event"), EventType{75, 76}, EventTypeName{"CollectionStart", "CollectionEnd"}, LOCALE("ms_409")]
class SpinLockConfig_V2 : PerfInfo_V2
{
	[WmiDataId(1), Description("SpinLockSpinThreshold"), read] uint32 SpinLockSpinThreshold;
	[WmiDataId(2), Description("SpinLockContentionSampleRate"), read] uint32 SpinLockContentionSampleRate;
	[WmiDataId(3), Description("SpinLockAcquireSampleRate"), read] uint32 SpinLockAcquireSampleRate;
};

[dynamic: ToInstance, Description("UdpIp Send/Receive"), Guid("{bf3a50c5-a9c9-4988-a005-2df0b7c80f80}"), DisplayName("UdpIp"), EventVersion(2), LOCALE("ms_409")]
class UdpIp : MSNT_SystemTrace
{
};

[dynamic: ToInstance, Description("UdpIp Fail"), EventType(17), EventTypeName("Fail"), LOCALE("ms_409")]
class UdpIp_Fail : UdpIp
{
	[WmiDataId(1), Description("Protocol"), read] uint16 Proto;
	[WmiDataId(2), Description("FailureCode"), read] uint16 FailureCode;
};

[dynamic: ToInstance, Description("UdpIp IPV6 Send/Receive"), EventType{26, 27}, EventTypeName{"SendIPV6", "RecvIPV6"}, LOCALE("ms_409")]
class UdpIp_TypeGroup2 : UdpIp
{
	[WmiDataId(1), Description("Process ID"), read] uint32 PID;
	[WmiDataId(2), Description("Transfer Size in Bytes"), read] uint32 size;
	[WmiDataId(3), Description("Remote IP Address"), extension("IPAddrV6"), read] object daddr;
	[WmiDataId(4), Description("Local IP Address"), extension("IPAddrV6"), read] object saddr;
	[WmiDataId(5), Description("Remote Port"), extension("Port"), read] object dport;
	[WmiDataId(6), Description("Local Port"), extension("Port"), read] object sport;
	[WmiDataId(7), Description("Sequence Number"), read] uint32 seqnum;
	[WmiDataId(8), Description("ConnID"), PointerType, read] uint32 connid;
};

[dynamic: ToInstance, Description("UdpIp IPV4 Send/Receive"), EventType{10, 11}, EventTypeName{"SendIPV4", "RecvIPV4"}, LOCALE("ms_409")]
class UdpIp_TypeGroup1 : UdpIp
{
	[WmiDataId(1), Description("Process ID"), read] uint32 PID;
	[WmiDataId(2), Description("Transfer Size in Bytes"), read] uint32 size;
	[WmiDataId(3), Description("Remote IP Address"), extension("IPAddrV4"), read] object daddr;
	[WmiDataId(4), Description("Local IP Address"), extension("IPAddrV4"), read] object saddr;
	[WmiDataId(5), Description("Remote Port"), extension("Port"), read] object dport;
	[WmiDataId(6), Description("Local Port"), extension("Port"), read] object sport;
	[WmiDataId(7), Description("Sequence Number"), read] uint32 seqnum;
	[WmiDataId(8), Description("ConnID"), PointerType, read] uint32 connid;
};

[dynamic: ToInstance, Description("Thread Create/Exit Event"), Guid("{3d6fa8d1-fe05-11d0-9dda-00c04fd7ba7c}"), DisplayName("Thread"), EventVersion(2), LOCALE("ms_409")]
class Thread_V2 : MSNT_SystemTrace
{
};

[dynamic: ToInstance, Description("AutoBoost Clear Floor Event"), EventType(67), EventTypeName("AutoBoost Clear Floor"), LOCALE("ms_409")]
class AutoBoostClearFloor : Thread_V2
{
	[WmiDataId(1), Description("LockAddress"), pointer, read] uint32 LockAddress;
	[WmiDataId(2), Description("ThreadId"), format("x"), read] uint32 ThreadId;
	[WmiDataId(3), Description("BoostBitmap"), read] uint32 BoostBitmap;
};

[dynamic: ToInstance, Description("Worker Thread Event"), EventType(57), EventTypeName("WorkerThread"), LOCALE("ms_409")]
class WorkerThread : Thread_V2
{
	[WmiDataId(1), Description("ThreadId"), format("x"), read] uint32 TThreadId;
	[WmiDataId(2), Description("StartTime"), read] uint64 StartTime;
	[WmiDataId(3), Description("ThreadRoutine"), pointer, read] uint32 ThreadRoutine;
};

[dynamic: ToInstance, Description("Kernel Queue Enqueue Event"), EventType(62), EventTypeName("Kernel Queue Enqueue"), LOCALE("ms_409")]
class KernelQueueEnqueue : Thread_V2
{
	[WmiDataId(1), Description("Entry"), pointer, read] uint32 Entry;
	[WmiDataId(2), Description("ThreadId"), format("x"), read] uint32 ThreadId;
};

[dynamic: ToInstance, Description("Context Switch Event"), EventType(36), EventTypeName("CSwitch"), LOCALE("ms_409")]
class CSwitch_V2 : Thread_V2
{
	[WmiDataId(1), Description("NewThreadId"), format("x"), read] uint32 NewThreadId;
	[WmiDataId(2), Description("OldThreadId"), format("x"), read] uint32 OldThreadId;
	[WmiDataId(3), Description("NewThreadPriority"), read] sint8 NewThreadPriority;
	[WmiDataId(4), Description("OldThreadPriority"), read] sint8 OldThreadPriority;
	[WmiDataId(5), Description("PreviousCState or OldThreadRank"), read] uint8 PreviousCState;
	[WmiDataId(6), Description("SpareByte"), read] sint8 SpareByte;
	[WmiDataId(7), Description("OldThreadWaitReason"), read] sint8 OldThreadWaitReason;
	[WmiDataId(8), Description("OldThreadWaitMode"), read] sint8 OldThreadWaitMode;
	[WmiDataId(9), Description("OldThreadState"), read] sint8 OldThreadState;
	[WmiDataId(10), Description("OldThreadWaitIdealProcessor"), read] sint8 OldThreadWaitIdealProcessor;
	[WmiDataId(11), Description("NewThreadWaitTime"), format("x"), read] uint32 NewThreadWaitTime;
	[WmiDataId(12), Description("Reserved"), read] uint32 Reserved;
};

[dynamic: ToInstance, Description("Thread SubProcessTag Changed"), EventType(69), EventTypeName("SubProcessTag Changed"), LOCALE("ms_409")]
class SubProcessTagChanged : Thread_V2
{
	[WmiDataId(1), Description("Old Tag"), format("x"), read] uint32 OldTag;
	[WmiDataId(2), Description("New Tag"), format("x"), read] uint32 NewTag;
};

[dynamic: ToInstance, Description("Spinlock Release Event"), EventType(41), EventTypeName("SpinLock"), LOCALE("ms_409")]
class SpinLock : Thread_V2
{
	[WmiDataId(1), Description("SpinLockAddress"), pointer, read] uint32 SpinLockAddress;
	[WmiDataId(2), Description("CallerAddress"), pointer, read] uint32 CallerAddress;
	[WmiDataId(3), Description("AcquireTime"), read] uint64 AcquireTime;
	[WmiDataId(4), Description("ReleaseTime"), read] uint64 ReleaseTime;
	[WmiDataId(5), Description("WaitTimeInCycles"), read] uint32 WaitTimeInCycles;
	[WmiDataId(6), Description("SpinCount"), read] uint32 SpinCount;
	[WmiDataId(7), Description("ThreadId"), read] uint32 ThreadId;
	[WmiDataId(8), Description("InterruptCount"), read] uint32 InterruptCount;
	[WmiDataId(9), Description("Irql"), read] uint8 Irql;
	[WmiDataId(10), Description("AcquireDepth"), read] uint8 AcquireDepth;
	[WmiDataId(11), Description("Flag"), read] uint8 Flag;
	[WmiDataId(12), Description("Reserved"), read, MAX(5)] uint8 Reserved;
};

[dynamic: ToInstance, Description("Thread Migration Event"), EventType(61), EventTypeName("Thread Migration"), LOCALE("ms_409")]
class ThreadMigration : Thread_V2
{
	[WmiDataId(1), Description("ThreadId"), format("x"), read] uint32 ThreadId;
	[WmiDataId(2), Description("SourceProcessorIndex"), read] uint16 SourceProcessorIndex;
	[WmiDataId(3), Description("TargetProcessorIndex"), read] uint16 TargetProcessorIndex;
	[WmiDataId(4), Description("Priority"), read] uint8 Priority;
	[WmiDataId(5), Description("IdealProcessorAdjust"), read] boolean IdealProcessorAdjust;
	[WmiDataId(6), Description("OldIdealProcessorIndex"), read] uint16 OldIdealProcessorIndex;
};

[dynamic: ToInstance, Description("Kernel Queue Dequeue Event"), EventType(63), EventTypeName("Kernel Queue Dequeue"), LOCALE("ms_409")]
class KernelQueueDequeue : Thread_V2
{
	[WmiDataId(1), Description("ThreadId"), format("x"), read] uint32 ThreadId;
	[WmiDataId(2), Description("EntryCount"), read] uint32 EntryCount;
	[WmiDataId(3), Description("Entries"), WmiSizeIs("EntryCount"), pointer, read] uint32 Entries;
};

[dynamic: ToInstance, Description("AutoBoost Set Floor Event"), EventType(66), EventTypeName("AutoBoost Set Floor"), LOCALE("ms_409")]
class AutoBoostSetFloor : Thread_V2
{
	[WmiDataId(1), Description("Lock"), pointer, read] uint32 Lock;
	[WmiDataId(2), Description("ThreadId"), format("x"), read] uint32 ThreadId;
	[WmiDataId(3), Description("NewCpuPriorityFloor"), read] uint8 NewCpuPriorityFloor;
	[WmiDataId(4), Description("OldCpuPriority"), read] uint8 OldCpuPriority;
	[WmiDataId(5), Description("IoPriorities"), read] uint8 IoPriorities;
	[WmiDataId(6), Description("BoostFlags"), read] uint8 BoostFlags;
};

[dynamic: ToInstance, Description("Thread Affinity Event"), EventType(53), EventTypeName("ThreadAffinity"), LOCALE("ms_409")]
class ThreadAffinity : Thread_V2
{
	[WmiDataId(1), Description("Affinity"), pointer, read] uint32 Affinity;
	[WmiDataId(2), Description("ThreadId"), format("x"), read] uint32 ThreadId;
	[WmiDataId(3), Description("Group"), read] uint16 Group;
	[WmiDataId(4), Description("Reserved"), read] uint16 Reserved;
};

[dynamic: ToInstance, Description("Worker Thread Start/Stop Event"), EventType{64, 65}, EventTypeName{"Start", "End"}, LOCALE("ms_409")]
class WorkerThread_StartStop_V2 : Thread_V2
{
	[WmiDataId(1), Description("CallbackRoutine"), pointer, read] uint32 CallbackRoutine;
};

[dynamic: ToInstance, Description("Thread Set Name Event"), EventType(72), EventTypeName("SetName"), LOCALE("ms_409")]
class ThreadSetName : Thread_V2
{
	[WmiDataId(1), Description("ProcessId"), format("x"), read] uint32 ProcessId;
	[WmiDataId(2), Description("ThreadId"), format("x"), read] uint32 ThreadId;
	[WmiDataId(3), Description("ThreadName"), StringTermination("NullTerminated"), format("w"), read] string ThreadName;
};

[dynamic: ToInstance, Description("Compressed CS Event"), EventType(37), EventTypeName("CompCS"), LOCALE("ms_409")]
class CompCS : Thread_V2
{
};

[dynamic: ToInstance, Description("AutoBoost Entry Exhaustion Event"), EventType(68), EventTypeName("AutoBoost Entry Exhaustion"), LOCALE("ms_409")]
class AutoBoostEntryExhaustion : Thread_V2
{
	[WmiDataId(1), Description("LockAddress"), pointer, read] uint32 LockAddress;
	[WmiDataId(2), Description("ThreadId"), format("x"), read] uint32 ThreadId;
};

[dynamic: ToInstance, Description("Ready Thread Event"), EventType(50), EventTypeName("ReadyThread"), LOCALE("ms_409")]
class ReadyThread : Thread_V2
{
	[WmiDataId(1), Description("ThreadId"), format("x"), read] uint32 TThreadId;
	[WmiDataId(2), Description("AdjustReason"), read] sint8 AdjustReason;
	[WmiDataId(3), Description("AdjustIncrement"), read] sint8 AdjustIncrement;
	[WmiDataId(4), Description("Flags"), read] sint8 Flag;
	[WmiDataId(5), Description("Reserved"), read] sint8 Reserved;
};

[dynamic: ToInstance, Description("Anti Starvation Boost Event"), EventType(60), EventTypeName("AntiStarvationBoost"), LOCALE("ms_409")]
class AntiStarvationBoost : Thread_V2
{
	[WmiDataId(1), Description("ThreadId"), format("x"), read] uint32 ThreadId;
	[WmiDataId(2), Description("ProcessorIndex"), read] uint16 ProcessorIndex;
	[WmiDataId(3), Description("Priority"), read] uint8 Priority;
	[WmiDataId(4), Description("Reserved"), read] uint8 Reserved;
};

[dynamic: ToInstance, Description("Thread Create/Exit Event"), EventType{1, 2, 3, 4}, EventTypeName{"Start", "End", "DCStart", "DCEnd"}, LOCALE("ms_409")]
class Thread_V2_TypeGroup1 : Thread_V2
{
	[WmiDataId(1), Description("ProcessId"), format("x"), read] uint32 ProcessId;
	[WmiDataId(2), Description("ThreadId"), format("x"), read] uint32 TThreadId;
	[WmiDataId(3), Description("StackBase"), pointer, read] uint32 StackBase;
	[WmiDataId(4), Description("StackLimit"), pointer, read] uint32 StackLimit;
	[WmiDataId(5), Description("UserStackBase"), pointer, read] uint32 UserStackBase;
	[WmiDataId(6), Description("UserStackLimit"), pointer, read] uint32 UserStackLimit;
	[WmiDataId(7), Description("StartAddr"), pointer, read] uint32 StartAddr;
	[WmiDataId(8), Description("Win32StartAddr"), pointer, read] uint32 Win32StartAddr;
	[WmiDataId(9), Description("TebBase"), pointer, read] uint32 TebBase;
	[WmiDataId(10), Description("SubProcessTag"), format("x"), read] uint32 SubProcessTag;
};

[dynamic: ToInstance, Description("UdpIp Send/Receive"), Guid("{bf3a50c5-a9c9-4988-a005-2df0b7c80f80}"), DisplayName("UdpIp"), EventVersion(0), LOCALE("ms_409")]
class UdpIp_V0 : MSNT_SystemTrace
{
};

[dynamic: ToInstance, Description("UdpIp Send/Receive"), EventType{10, 11}, EventTypeName{"Send", "Recv"}, LOCALE("ms_409")]
class UdpIp_V0_TypeGroup1 : UdpIp_V0
{
	[WmiDataId(1), Description("Process ID"), pointer, read] uint32 context;
	[WmiDataId(2), Description("Local IP Address"), extension("IPAddr"), read] object saddr;
	[WmiDataId(3), Description("Local Port"), extension("Port"), read] object sport;
	[WmiDataId(4), Description("Transfer Size in Bytes"), read] uint16 size;
	[WmiDataId(5), Description("Remote IP Address"), extension("IPAddr"), read] object daddr;
	[WmiDataId(6), Description("Remote Port"), extension("Port"), read] object dport;
	[WmiDataId(7), Description("Number of Bytes successfully sent"), read] uint16 dsize;
};

[dynamic: ToInstance, Description("StackWalk Event"), Guid("{def2fe46-7bd6-4b80-bd94-f57fe20d0ce3}"), DisplayName("StackWalk"), EventVersion(2), LOCALE("ms_409")]
class StackWalk : MSNT_SystemTrace
{
};

[dynamic: ToInstance, Description("StackWalk Event"), EventType{34, 35, 36}, EventTypeName{"KeyCreate", "KeyDelete", "KeyRundown"}, LOCALE("ms_409")]
class StackWalk_TypeGroup1 : StackWalk
{
	[WmiDataId(1), Description("Stack Key"), pointer, read] uint32 key;
	[WmiDataId(2), Description("Stack Trace"), pointer, read, MAX(192)] uint32 StackFrame;
};

[dynamic: ToInstance, Description("StackWalk Event"), EventType{37, 38}, EventTypeName{"StackKeyKernel", "StackKeyUser"}, LOCALE("ms_409")]
class StackWalk_Key : StackWalk
{
	[WmiDataId(1), Description("TimeStamp"), read] uint64 EventTimeStamp;
	[WmiDataId(2), Description("ProcessId"), format("x"), read] uint32 StackProcess;
	[WmiDataId(3), Description("ThreadId"), read] uint32 StackThread;
	[WmiDataId(4), Description("Stack Key"), pointer, read] uint32 StackKey;
};

[dynamic: ToInstance, Description("StackWalk Event"), EventType(32), EventTypeName("Stack"), LOCALE("ms_409")]
class StackWalk_Event : StackWalk
{
	[WmiDataId(1), Description("TimeStamp"), read] uint64 EventTimeStamp;
	[WmiDataId(2), Description("ProcessId"), format("x"), read] uint32 StackProcess;
	[WmiDataId(3), Description("ThreadId"), read] uint32 StackThread;
	[WmiDataId(4), Description("Stack1"), pointer, read] uint32 Stack1;
	[WmiDataId(5), Description("Stack2"), pointer, read] uint32 Stack2;
	[WmiDataId(6), Description("Stack3"), pointer, read] uint32 Stack3;
	[WmiDataId(7), Description("Stack4"), pointer, read] uint32 Stack4;
	[WmiDataId(8), Description("Stack5"), pointer, read] uint32 Stack5;
	[WmiDataId(9), Description("Stack6"), pointer, read] uint32 Stack6;
	[WmiDataId(10), Description("Stack7"), pointer, read] uint32 Stack7;
	[WmiDataId(11), Description("Stack8"), pointer, read] uint32 Stack8;
	[WmiDataId(12), Description("Stack9"), pointer, read] uint32 Stack9;
	[WmiDataId(13), Description("Stack10"), pointer, read] uint32 Stack10;
	[WmiDataId(14), Description("Stack11"), pointer, read] uint32 Stack11;
	[WmiDataId(15), Description("Stack12"), pointer, read] uint32 Stack12;
	[WmiDataId(16), Description("Stack13"), pointer, read] uint32 Stack13;
	[WmiDataId(17), Description("Stack14"), pointer, read] uint32 Stack14;
	[WmiDataId(18), Description("Stack15"), pointer, read] uint32 Stack15;
	[WmiDataId(19), Description("Stack16"), pointer, read] uint32 Stack16;
	[WmiDataId(20), Description("Stack17"), pointer, read] uint32 Stack17;
	[WmiDataId(21), Description("Stack18"), pointer, read] uint32 Stack18;
	[WmiDataId(22), Description("Stack19"), pointer, read] uint32 Stack19;
	[WmiDataId(23), Description("Stack20"), pointer, read] uint32 Stack20;
	[WmiDataId(24), Description("Stack21"), pointer, read] uint32 Stack21;
	[WmiDataId(25), Description("Stack22"), pointer, read] uint32 Stack22;
	[WmiDataId(26), Description("Stack23"), pointer, read] uint32 Stack23;
	[WmiDataId(27), Description("Stack24"), pointer, read] uint32 Stack24;
	[WmiDataId(28), Description("Stack25"), pointer, read] uint32 Stack25;
	[WmiDataId(29), Description("Stack26"), pointer, read] uint32 Stack26;
	[WmiDataId(30), Description("Stack27"), pointer, read] uint32 Stack27;
	[WmiDataId(31), Description("Stack28"), pointer, read] uint32 Stack28;
	[WmiDataId(32), Description("Stack29"), pointer, read] uint32 Stack29;
	[WmiDataId(33), Description("Stack30"), pointer, read] uint32 Stack30;
	[WmiDataId(34), Description("Stack31"), pointer, read] uint32 Stack31;
	[WmiDataId(35), Description("Stack32"), pointer, read] uint32 Stack32;
};

[dynamic: ToInstance, Description("I/O Read/Write Event"), Guid("{3d6fa8d4-fe05-11d0-9dda-00c04fd7ba7c}"), DisplayName("DiskIo"), EventVersion(1), LOCALE("ms_409")]
class DiskIo_V1 : MSNT_SystemTrace
{
};

[dynamic: ToInstance, Description("Driver Major Function Return"), EventType(35), EventTypeName("DrvMjFnRet"), LOCALE("ms_409")]
class V1_DriverMajorFunctionReturn : DiskIo_V1
{
	[WmiDataId(1), Description("UniqMatchId"), read] uint32 UniqMatchId;
	[WmiDataId(2), Description("Irp"), pointer, read] uint32 Irp;
};

[dynamic: ToInstance, Description("Driver Complete Request"), EventType(52), EventTypeName("DrvComplReq"), LOCALE("ms_409")]
class V1_DriverCompleteRequest : DiskIo_V1
{
	[WmiDataId(1), Description("RoutineAddr"), pointer, read] uint32 RoutineAddr;
	[WmiDataId(2), Description("Irp"), pointer, read] uint32 Irp;
	[WmiDataId(3), Description("UniqMatchId"), read] uint32 UniqMatchId;
};

[dynamic: ToInstance, Description("Driver Delay Complete Request Return"), EventType(53), EventTypeName("DrvComplReqRet"), LOCALE("ms_409")]
class V1_DriverCompleteRequestReturn : DiskIo_V1
{
	[WmiDataId(1), Description("Irp"), pointer, read] uint32 Irp;
	[WmiDataId(2), Description("UniqMatchId"), read] uint32 UniqMatchId;
};

[dynamic: ToInstance, Description("I/O Read/Write Event"), EventType{10, 11}, EventTypeName{"Read", "Write"}, LOCALE("ms_409")]
class DiskIo_V1_TypeGroup1 : DiskIo_V1
{
	[WmiDataId(1), Description("DiskNumber"), read] uint32 DiskNumber;
	[WmiDataId(2), Description("IrpFlags"), format("x"), read] uint32 IrpFlags;
	[WmiDataId(3), Description("TransferSize"), read] uint32 TransferSize;
	[WmiDataId(4), Description("ResponseTime"), read] uint32 ResponseTime;
	[WmiDataId(5), Description("ByteOffset"), read] uint64 ByteOffset;
	[WmiDataId(6), Description("FileObject"), pointer, read] uint32 FileObject;
	[WmiDataId(7), Description("HighResResponseTime"), read] uint64 HighResResponseTime;
};

[dynamic: ToInstance, Description("Driver Major Function Call"), EventType(34), EventTypeName("DrvMjFnCall"), LOCALE("ms_409")]
class V1_DriverMajorFunctionCall : DiskIo_V1
{
	[WmiDataId(1), Description("UniqMatchId"), read] uint32 UniqMatchId;
	[WmiDataId(2), Description("RoutineAddr"), pointer, read] uint32 RoutineAddr;
	[WmiDataId(3), Description("Irp"), pointer, read] uint32 Irp;
	[WmiDataId(4), Description("MajorFunction"), read] uint32 MajorFunction;
	[WmiDataId(5), Description("MinorFunction"), read] uint32 MinorFunction;
	[WmiDataId(6), Description("FileObject"), pointer, read] uint32 FileObject;
};

[dynamic: ToInstance, Description("UMS Events"), Guid("{9aec974b-5b8e-4118-9b92-3186d8002ce5}"), DisplayName("UMS"), EventVersion(2), LOCALE("ms_409")]
class UmsEvent : MSNT_SystemTrace
{
};

[dynamic: ToInstance, Description("UMS Context Switch"), EventType(36), EventTypeName("CSwitch"), LOCALE("ms_409")]
class UmsContextSwitch : UmsEvent
{
	[WmiDataId(1), Description("ScheduledThreadId"), format("x"), read] uint32 ScheduledThreadId;
	[WmiDataId(2), Description("SwitchCount"), read] uint32 SwitchCount;
	[WmiDataId(3), Description("KernelYieldCount"), read] uint32 KernelYieldCount;
	[WmiDataId(4), Description("MixedYieldCount"), read] uint32 MixedYieldCount;
	[WmiDataId(5), Description("YieldCount"), read] uint32 YieldCount;
};

[dynamic: ToInstance, Description("UMS Directed Switch - End"), EventType(33), EventTypeName("DSwitchEnd"), LOCALE("ms_409")]
class UmsDirectedSwitchEnd : UmsEvent
{
	[WmiDataId(1), Description("ProcessId"), format("x"), read] uint32 ProcessId;
	[WmiDataId(2), Description("ScheduledThreadId"), format("x"), read] uint32 ScheduledThreadId;
	[WmiDataId(3), Description("PrimaryThreadId"), format("x"), read] uint32 PrimaryThreadId;
	[WmiDataId(4), Description("SwitchFlags"), format("x"), read] uint32 SwitchFlags;
};

[dynamic: ToInstance, Description("UMS Scheduled Thread Park"), EventType(34), EventTypeName("ScheduledPark"), LOCALE("ms_409")]
class UmsScheduledPark : UmsEvent
{
	[WmiDataId(1), Description("ProcessId"), format("x"), read] uint32 ProcessId;
	[WmiDataId(2), Description("ScheduledThreadId"), format("x"), read] uint32 ScheduledThreadId;
	[WmiDataId(3), Description("ParkFlags"), format("x"), read] uint32 ParkFlags;
};

[dynamic: ToInstance, Description("UMS Disassociate From Primary"), EventType(35), EventTypeName("Disassociate"), LOCALE("ms_409")]
class UmsDisassociate : UmsEvent
{
	[WmiDataId(1), Description("ProcessId"), format("x"), read] uint32 ProcessId;
	[WmiDataId(2), Description("ScheduledThreadId"), format("x"), read] uint32 ScheduledThreadId;
	[WmiDataId(3), Description("PrimaryThreadId"), format("x"), read] uint32 PrimaryThreadId;
	[WmiDataId(4), Description("UmsApcControlFlags"), format("x"), read] uint32 UmsApcControlFlags;
	[WmiDataId(5), Description("Status"), format("x"), read] uint32 Status;
};

[dynamic: ToInstance, Description("UMS Directed Switch - Start"), EventType(32), EventTypeName("DSwitchStart"), LOCALE("ms_409")]
class UmsDirectedSwitchStart : UmsEvent
{
	[WmiDataId(1), Description("ProcessId"), format("x"), read] uint32 ProcessId;
	[WmiDataId(2), Description("ScheduledThreadId"), format("x"), read] uint32 ScheduledThreadId;
	[WmiDataId(3), Description("PrimaryThreadId"), format("x"), read] uint32 PrimaryThreadId;
	[WmiDataId(4), Description("SwitchFlags"), format("x"), read] uint32 SwitchFlags;
};

[dynamic: ToInstance, Description("PerfInfo Event"), Guid("{ce1dbfb4-137e-4da6-87b0-3f59aa102cbc}"), DisplayName("PerfInfo"), EventVersion(3), LOCALE("ms_409")]
class PerfInfo : MSNT_SystemTrace
{
};

[dynamic: ToInstance, Description("Sampled Profile Interval"), EventType{73, 74}, EventTypeName{"CollectionStart", "CollectionEnd"}, LOCALE("ms_409")]
class SampledProfileInterval_V3 : PerfInfo
{
	[WmiDataId(1), Description("Profile Source"), read] uint32 Source;
	[WmiDataId(2), Description("New Interval"), read] uint32 NewInterval;
	[WmiDataId(3), Description("Old Interval"), read] uint32 OldInterval;
	[WmiDataId(4), Description("Profile Source Name"), StringTermination("NullTerminated"), format("w"), read] string SourceName;
};

[dynamic: ToInstance, Description("Spinlock Configure Event"), EventType{75, 76}, EventTypeName{"CollectionStart", "CollectionEnd"}, LOCALE("ms_409")]
class SpinLockConfig_V3 : PerfInfo
{
	[WmiDataId(1), Description("SpinLockSpinThreshold"), read] uint32 SpinLockSpinThreshold;
	[WmiDataId(2), Description("SpinLockContentionSampleRate"), read] uint32 SpinLockContentionSampleRate;
	[WmiDataId(3), Description("SpinLockAcquireSampleRate"), read] uint32 SpinLockAcquireSampleRate;
	[WmiDataId(4), Description("SpinLockHoldThreshold"), read] uint32 SpinLockHoldThreshold;
};

[dynamic: ToInstance, Description("TcpIp Send/Receive"), Guid("{9a280ac0-c8e0-11d1-84e2-00c04fb998a2}"), DisplayName("TcpIp"), EventVersion(1), LOCALE("ms_409")]
class TcpIp_V1 : MSNT_SystemTrace
{
};

[dynamic: ToInstance, Description("TcpIp Fail"), EventType(17), EventTypeName("Fail"), LOCALE("ms_409")]
class TcpIp_V1_Fail : TcpIp_V1
{
	[WmiDataId(1), Description("Protocol"), read] uint32 Proto;
};

[dynamic: ToInstance, Description("TcpIp Copy/ACK"), EventType{18, 19, 20, 21, 22}, EventTypeName{"TCPCopy", "ARPCopy", "FullACK", "PartACK", "DupACK"}, LOCALE("ms_409")]
class TcpIp_V1_TypeGroup3 : TcpIp_V1
{
	[WmiDataId(1), Description("Process ID"), read] uint32 PID;
	[WmiDataId(2), Description("Transfer Size in Bytes"), read] uint32 size;
	[WmiDataId(3), Description("Remote IP Address"), extension("IPAddr"), read] object daddr;
	[WmiDataId(4), Description("Local IP Address"), extension("IPAddr"), read] object saddr;
	[WmiDataId(5), Description("Remote Port"), extension("Port"), read] object dport;
	[WmiDataId(6), Description("Local Port"), extension("Port"), read] object sport;
	[WmiDataId(7), Description("ConnID"), PointerType, read] uint32 connid;
	[WmiDataId(8), Description("Sequence Number"), read] uint32 seqnum;
};

[dynamic: ToInstance, Description("TcpIp Send"), EventType(10), EventTypeName("Send"), LOCALE("ms_409")]
class TcpIp_V1_Send : TcpIp_V1
{
	[WmiDataId(1), Description("Process ID"), read] uint32 PID;
	[WmiDataId(2), Description("Transfer Size in Bytes"), read] uint32 size;
	[WmiDataId(3), Description("Remote IP Address"), extension("IPAddr"), read] object daddr;
	[WmiDataId(4), Description("Local IP Address"), extension("IPAddr"), read] object saddr;
	[WmiDataId(5), Description("Remote Port"), extension("Port"), read] object dport;
	[WmiDataId(6), Description("Local Port"), extension("Port"), read] object sport;
	[WmiDataId(7), Description("Start SendReq Time"), read] uint32 startime;
	[WmiDataId(8), Description("End SendReq Time"), read] uint32 endtime;
	[WmiDataId(9), Description("ConnID"), PointerType, read] uint32 connid;
	[WmiDataId(10), Description("Sequence Number"), read] uint32 seqnum;
};

[dynamic: ToInstance, Description("TcpIp Disconnect"), EventType{13, 14, 16}, EventTypeName{"Disconnect", "Retransmit", "Reconnect"}, LOCALE("ms_409")]
class TcpIp_V1_TypeGroup1 : TcpIp_V1
{
	[WmiDataId(1), Description("Process ID"), read] uint32 PID;
	[WmiDataId(2), Description("Transfer Size in Bytes"), read] uint32 size;
	[WmiDataId(3), Description("Remote IP Address"), extension("IPAddr"), read] object daddr;
	[WmiDataId(4), Description("Local IP Address"), extension("IPAddr"), read] object saddr;
	[WmiDataId(5), Description("Remote Port"), extension("Port"), read] object dport;
	[WmiDataId(6), Description("Local Port"), extension("Port"), read] object sport;
	[WmiDataId(7), Description("ConnID"), PointerType, read] uint32 connid;
	[WmiDataId(8), Description("Sequence Number"), read] uint32 seqnum;
};

[dynamic: ToInstance, Description("TcpIp Connect/Accept"), EventType{12, 15}, EventTypeName{"Connect", "Accept"}, LOCALE("ms_409")]
class TcpIp_V1_TypeGroup2 : TcpIp_V1
{
	[WmiDataId(1), Description("Process ID"), read] uint32 PID;
	[WmiDataId(2), Description("Transfer Size in Bytes"), read] uint32 size;
	[WmiDataId(3), Description("Remote IP Address"), extension("IPAddr"), read] object daddr;
	[WmiDataId(4), Description("Local IP Address"), extension("IPAddr"), read] object saddr;
	[WmiDataId(5), Description("Remote Port"), extension("Port"), read] object dport;
	[WmiDataId(6), Description("Local Port"), extension("Port"), read] object sport;
	[WmiDataId(7), Description("MSS"), read] uint16 mss;
	[WmiDataId(8), Description("SACK Option"), read] uint16 sackopt;
	[WmiDataId(9), Description("TimeStamp Option"), read] uint16 tsopt;
	[WmiDataId(10), Description("WindowScale Option"), read] uint16 wsopt;
	[WmiDataId(11), Description("TCP Window Size"), read] uint32 rcvwin;
	[WmiDataId(12), Description("Receive Window Scale"), read] sint16 rcvwinscale;
	[WmiDataId(13), Description("Send Window Scale"), read] sint16 sndwinscale;
	[WmiDataId(14), Description("ConnID"), PointerType, read] uint32 connid;
	[WmiDataId(15), Description("Sequence Number"), read] uint32 seqnum;
};

[dynamic: ToInstance, Description("TcpIp Receive"), EventType(11), EventTypeName("Recv"), LOCALE("ms_409")]
class TcpIp_V1_Receive : TcpIp_V1
{
	[WmiDataId(1), Description("Process ID"), read] uint32 PID;
	[WmiDataId(2), Description("Transfer Size in Bytes"), read] uint32 size;
	[WmiDataId(3), Description("Remote IP Address"), extension("IPAddr"), read] object daddr;
	[WmiDataId(4), Description("Local IP Address"), extension("IPAddr"), read] object saddr;
	[WmiDataId(5), Description("Remote Port"), extension("Port"), read] object dport;
	[WmiDataId(6), Description("Local Port"), extension("Port"), read] object sport;
	[WmiDataId(7), Description("ConnID"), PointerType, read] uint32 connid;
	[WmiDataId(8), Description("Sequence Number"), read] uint32 seqnum;
};

[dynamic: ToInstance, Description("Event Trace Event"), Guid("{68fdd900-4a3e-11d1-84f4-0000f80464e3}"), DisplayName("EventTrace"), EventVersion(2), LOCALE("ms_409")]
class EventTraceEvent : MSNT_SystemTrace
{
};

[dynamic: ToInstance, Description("Build Information"), EventType{66}, EventTypeName{"BuildInfo"}, LOCALE("ms_409")]
class Header_BuildInfo_TypeGroup : EventTraceEvent
{
	[WmiDataId(1), Description("BuildString"), StringTermination("NullTerminated"), read] string BuildString;
};

[dynamic: ToInstance, Description("DebugId"), EventType{64}, EventTypeName{"DbgIdRSDS"}, LOCALE("ms_409")]
class Header_DbgIdRSDS_TypeGroup : EventTraceEvent
{
	[WmiDataId(1), Description("Guid"), extension("GUID"), read] object Guid;
	[WmiDataId(2), Description("Age"), read] uint32 Age;
	[WmiDataId(3), Description("PdbName"), StringTermination("NullTerminated"), read] string PdbName;
};

[dynamic: ToInstance, Description("Partition Info Extension V2"), EventType{80}, EventTypeName{"PartitionInfoExtensionV2"}, EventVersion(2), LOCALE("ms_409")]
class Header_PartitionInfoExtensionV2_TypeGroup : EventTraceEvent
{
	[WmiDataId(1), Description("Event Version"), read] uint16 EventVersion;
	[WmiDataId(2), Description("Reserved"), read] uint16 Reserved;
	[WmiDataId(3), Description("Partition Type"), read] uint32 PartitionType;
	[WmiDataId(4), Description("Qpc Offset From Root"), read] sint64 QpcOffsetFromRoot;
	[WmiDataId(5), Description("Partition ID"), StringTermination("NullTerminated"), format("w"), read] string PartitionId;
	[WmiDataId(6), Description("Parent ID"), StringTermination("NullTerminated"), format("w"), read] string ParentId;
};

[dynamic: ToInstance, Description("Event Trace Header Extension"), EventType{5, 32}, EventTypeName{"Extension", "EndExtension"}, LOCALE("ms_409")]
class Header_Extension_TypeGroup : EventTraceEvent
{
	[WmiDataId(1), Description("GroupMask1"), format("x"), read] uint32 GroupMask1;
	[WmiDataId(2), Description("GroupMask2"), format("x"), read] uint32 GroupMask2;
	[WmiDataId(3), Description("GroupMask3"), format("x"), read] uint32 GroupMask3;
	[WmiDataId(4), Description("GroupMask4"), format("x"), read] uint32 GroupMask4;
	[WmiDataId(5), Description("GroupMask5"), format("x"), read] uint32 GroupMask5;
	[WmiDataId(6), Description("GroupMask6"), format("x"), read] uint32 GroupMask6;
	[WmiDataId(7), Description("GroupMask7"), format("x"), read] uint32 GroupMask7;
	[WmiDataId(8), Description("GroupMask8"), format("x"), read] uint32 GroupMask8;
	[WmiDataId(9), Description("KernelEventVersion"), format("x"), read] uint32 KernelEventVersion;
};

[dynamic: ToInstance, Description("Last Dropped Event Times"), EventType{82}, EventTypeName{"LastDroppedTimes"}, LOCALE("ms_409")]
class Header_LastDroppedTimes_TypeGroup : EventTraceEvent
{
	[WmiDataId(1), Description("Number of TimeStamps"), read] uint32 TimeStampCount;
	[WmiDataId(2), Description("Padding"), read] uint32 Padding;
	[WmiDataId(3), Description("TimeStamp"), WmiSizeIs("TimeStampCount"), read] uint64 TimeStamp;
};

[dynamic: ToInstance, Description("Partition Info Extension"), EventType{80}, EventTypeName{"PartitionInfoExtension"}, EventVersion(0), LOCALE("ms_409")]
class Header_PartitionInfoExtension_TypeGroup : EventTraceEvent
{
	[WmiDataId(1), Description("Event Version"), read] uint16 EventVersion;
	[WmiDataId(2), Description("Reserved"), read] uint16 Reserved;
	[WmiDataId(3), Description("Partition Type"), read] uint32 PartitionType;
	[WmiDataId(4), Description("Qpc Offset From Root"), read] sint64 QpcOffsetFromRoot;
	[WmiDataId(5), Description("Partition ID"), extension("GUID"), read] object PartitionId;
	[WmiDataId(6), Description("Parent ID"), extension("GUID"), read] object ParentId;
};

[dynamic: ToInstance, Description("Event Trace Event"), EventType(0), EventTypeName("Header"), LOCALE("ms_409")]
class EventTrace_Header : EventTraceEvent
{
	[WmiDataId(1), Description("Buffer Size in Bytes"), read] uint32 BufferSize;
	[WmiDataId(2), Description("Event Trace Version"), read] uint32 Version;
	[WmiDataId(3), Description("Windows Build Number"), read] uint32 ProviderVersion;
	[WmiDataId(4), Description("Number Of Processors"), read] uint32 NumberOfProcessors;
	[WmiDataId(5), Description("Collection End Time"), read] uint64 EndTime;
	[WmiDataId(6), Description("Timer Resolution"), read] uint32 TimerResolution;
	[WmiDataId(7), Description("Maximum File Size in MBytes"), read] uint32 MaxFileSize;
	[WmiDataId(8), Description("LogFileMode"), format("x"), read] uint32 LogFileMode;
	[WmiDataId(9), Description("Number of Buffers Written"), read] uint32 BuffersWritten;
	[WmiDataId(10), Description("Buffer Number with earliest TimeStamp for a Circular LogFile"), read] uint32 StartBuffers;
	[WmiDataId(11), Description("Pointer Size in Bytes"), read] uint32 PointerSize;
	[WmiDataId(12), Description("Number of Events Lost during collection"), read] uint32 EventsLost;
	[WmiDataId(13), Description("CPU Speed in MHz"), read] uint32 CPUSpeed;
	[WmiDataId(14), Description("Logger Name"), pointer, read] uint32 LoggerName;
	[WmiDataId(15), Description("LogFile Name"), pointer, read] uint32 LogFileName;
	[WmiDataId(16), Description("TimeZoneInformation"), extension("NoPrint"), read, MAX(176)] uint8 TimeZoneInformation;
	[WmiDataId(17), Description("BootTime"), read] uint64 BootTime;
	[WmiDataId(18), Description("Performance counter frequency in counts per second"), read] uint64 PerfFreq;
	[WmiDataId(19), Description("StartTime"), read] uint64 StartTime;
	[WmiDataId(20), Description("ReservedFlags"), format("x"), read] uint32 ReservedFlags;
	[WmiDataId(21), Description("Number of Buffers Lost during collection"), read] uint32 BuffersLost;
	[WmiDataId(22), Description("SessionNameString"), StringTermination("NullTerminated"), format("w"), read] string SessionNameString;
	[WmiDataId(23), Description("LogFileNameString"), StringTermination("NullTerminated"), format("w"), read] string LogFileNameString;
};

[dynamic: ToInstance, Description("Provider Binary Path"), EventType{67}, EventTypeName{"ProviderBinaryPath"}, LOCALE("ms_409")]
class Header_ProviderBinaryPath_TypeGroup : EventTraceEvent
{
	[WmiDataId(1), Description("Number of GUIDs"), read] uint32 GuidCount;
	[WmiDataId(2), Description("GUID"), extension("GUID"), WmiSizeIs("GuidCount"), read] object Guid;
	[WmiDataId(3), Description("Binary path"), StringTermination("NullTerminated"), format("w"), read] string BinaryPath;
};

[dynamic: ToInstance, Description("Event Trace Rundown Complete"), EventType(8), EventTypeName("RDComplete"), LOCALE("ms_409")]
class RDComplete : EventTraceEvent
{
};

[dynamic: ToInstance, Description("MMCSS"), Guid("{f8f10121-b617-4a56-868b-9df1b27fe32c}"), DisplayName("MMCSS"), EventVersion(0), LOCALE("ms_409")]
class MMCSSTrace : MSNT_SystemTrace
{
};

[dynamic: ToInstance, Description("MMCSS Events"), EventType(34), EventTypeName("Scheduler"), LOCALE("ms_409")]
class MMCSSEvent : MMCSSTrace
{
	[WmiDataId(1), Description("ProcessId"), format("x"), read] uint32 ScheduledPID;
	[WmiDataId(2), Description("ThreadId"), format("x"), read] uint32 ScheduledTID;
	[WmiDataId(3), Description("SchedulingPriority"), read] uint32 SchedulingPriority;
	[WmiDataId(4), Description("TaskIndex"), read] uint32 TaskIndex;
};

[dynamic: ToInstance, Description("MMCSS Events"), EventType(35), EventTypeName("Wakeup"), LOCALE("ms_409")]
class MMCSSWakeup : MMCSSTrace
{
	[WmiDataId(1), Description("Reason"), format("x"), read] uint32 Reason;
};

[dynamic: ToInstance, Description("MMCSS Events"), EventType{32, 33, 36, 37}, EventTypeName{"Start", "Stop", "Sleep", "SleepResp"}, LOCALE("ms_409")]
class MMCSS_TypeGroup : MMCSSTrace
{
};

[dynamic: ToInstance, Description("System Configuration"), Guid("{01853a65-418f-4f36-aefc-dc0f1d2fd235}"), DisplayName("SystemConfig"), EventVersion(1), LOCALE("ms_409")]
class SystemConfig_V1 : MSNT_SystemTrace
{
};

[dynamic: ToInstance, Description("System Configuration"), EventType(12), EventTypeName("LogDisk"), LOCALE("ms_409")]
class SystemConfig_V1_LogDisk : SystemConfig_V1
{
	[WmiDataId(1), Description("StartOffset"), read] uint64 StartOffset;
	[WmiDataId(2), Description("PartitionSize"), read] uint64 PartitionSize;
	[WmiDataId(3), Description("DiskNumber"), read] uint32 DiskNumber;
	[WmiDataId(4), Description("Size"), read] uint32 Size;
	[WmiDataId(5), Description("DriveType"), read] uint32 DriveType;
	[WmiDataId(6), Description("DriveLetter"), read, MAX(4)] char16 DriveLetterString;
	[WmiDataId(7), Description("Pad1"), read] uint32 Pad1;
	[WmiDataId(8), Description("PartitionNumber"), read] uint32 PartitionNumber;
	[WmiDataId(9), Description("SectorsPerCluster"), read] uint32 SectorsPerCluster;
	[WmiDataId(10), Description("BytesPerSector"), read] uint32 BytesPerSector;
	[WmiDataId(11), Description("Pad2"), read] uint32 Pad2;
	[WmiDataId(12), Description("NumberOfFreeClusters"), read] sint64 NumberOfFreeClusters;
	[WmiDataId(13), Description("TotalNumberOfClusters"), read] sint64 TotalNumberOfClusters;
	[WmiDataId(14), Description("FileSystem"), read, MAX(16)] char16 FileSystem;
	[WmiDataId(15), Description("VolumeExtent"), read] uint32 VolumeExt;
};

[dynamic: ToInstance, Description("System Configuration"), EventType(11), EventTypeName("PhyDisk"), LOCALE("ms_409")]
class SystemConfig_V1_PhyDisk : SystemConfig_V1
{
	[WmiDataId(1), Description("DiskNumber"), read] uint32 DiskNumber;
	[WmiDataId(2), Description("BytesPerSector"), read] uint32 BytesPerSector;
	[WmiDataId(3), Description("SectorsPerTrack"), read] uint32 SectorsPerTrack;
	[WmiDataId(4), Description("TracksPerCylinder"), read] uint32 TracksPerCylinder;
	[WmiDataId(5), Description("Cylinders"), read] uint64 Cylinders;
	[WmiDataId(6), Description("SCSIPort"), read] uint32 SCSIPort;
	[WmiDataId(7), Description("SCSIPath"), read] uint32 SCSIPath;
	[WmiDataId(8), Description("SCSITarget"), read] uint32 SCSITarget;
	[WmiDataId(9), Description("SCSILun"), read] uint32 SCSILun;
	[WmiDataId(10), Description("Manufacturer"), read, MAX(256)] char16 Manufacturer;
	[WmiDataId(11), Description("PartitionCount"), read] uint32 PartitionCount;
	[WmiDataId(12), Description("WriteCacheEnabled"), read] uint8 WriteCacheEnabled;
	[WmiDataId(13), Description("Pad: not used"), read] uint8 Pad;
	[WmiDataId(14), Description("BootDriveLetter"), read, MAX(3)] char16 BootDriveLetter;
	[WmiDataId(15), Description("Spare"), read, MAX(2)] char16 Spare;
};

[dynamic: ToInstance, Description("System Configuration"), EventType(21), EventTypeName("IRQ"), LOCALE("ms_409")]
class SystemConfig_V1_IRQ : SystemConfig_V1
{
	[WmiDataId(1), Description("IRQAffinity"), format("x"), read] uint64 IRQAffinity;
	[WmiDataId(2), Description("IRQNum"), read] uint32 IRQNum;
	[WmiDataId(3), Description("DeviceDescriptionLen"), read] uint32 DeviceDescriptionLen;
	[WmiDataId(4), Description("DeviceDescription"), StringTermination("NullTerminated"), format("w"), read] string DeviceDescription;
};

[dynamic: ToInstance, Description("System Configuration"), EventType(10), EventTypeName("CPU"), LOCALE("ms_409")]
class SystemConfig_V1_CPU : SystemConfig_V1
{
	[WmiDataId(1), Description("MHz"), read] uint32 MHz;
	[WmiDataId(2), Description("NumberOfProcessors"), read] uint32 NumberOfProcessors;
	[WmiDataId(3), Description("MemSize"), read] uint32 MemSize;
	[WmiDataId(4), Description("PageSize"), read] uint32 PageSize;
	[WmiDataId(5), Description("AllocationGranularity"), read] uint32 AllocationGranularity;
	[WmiDataId(6), Description("ComputerName"), read, MAX(256)] char16 ComputerName;
	[WmiDataId(7), Description("DomainName"), read, MAX(132)] char16 DomainName;
	[WmiDataId(8), Description("HyperThreadingFlag"), pointer, read] uint32 HyperThreadingFlag;
};

[dynamic: ToInstance, Description("System Configuration"), EventType(16), EventTypeName("Power"), LOCALE("ms_409")]
class SystemConfig_V1_Power : SystemConfig_V1
{
	[WmiDataId(1), Description("S1"), read] uint8 S1;
	[WmiDataId(2), Description("S2"), read] uint8 S2;
	[WmiDataId(3), Description("S3"), read] uint8 S3;
	[WmiDataId(4), Description("S4"), read] uint8 S4;
	[WmiDataId(5), Description("S5"), read] uint8 S5;
	[WmiDataId(6), Description("Reserved; do not use."), read] uint8 Pad1;
	[WmiDataId(7), Description("Reserved; do not use."), read] uint8 Pad2;
	[WmiDataId(8), Description("Reserved; do not use."), read] uint8 Pad3;
};

[dynamic: ToInstance, Description("System Configuration"), EventType(14), EventTypeName("Video"), LOCALE("ms_409")]
class SystemConfig_V1_Video : SystemConfig_V1
{
	[WmiDataId(1), Description("MemorySize"), read] uint32 MemorySize;
	[WmiDataId(2), Description("XResolution"), read] uint32 XResolution;
	[WmiDataId(3), Description("YResolution"), read] uint32 YResolution;
	[WmiDataId(4), Description("BitsPerPixel"), read] uint32 BitsPerPixel;
	[WmiDataId(5), Description("VRefresh"), read] uint32 VRefresh;
	[WmiDataId(6), Description("ChipType"), read, MAX(256)] char16 ChipType;
	[WmiDataId(7), Description("DACType"), read, MAX(256)] char16 DACType;
	[WmiDataId(8), Description("AdapterString"), read, MAX(256)] char16 AdapterString;
	[WmiDataId(9), Description("BiosString"), read, MAX(256)] char16 BiosString;
	[WmiDataId(10), Description("Device Name"), read, MAX(256)] char16 DeviceId;
	[WmiDataId(11), Description("StateFlags"), format("x"), read] uint32 StateFlags;
};

[dynamic: ToInstance, Description("System Configuration"), EventType(15), EventTypeName("Services"), LOCALE("ms_409")]
class SystemConfig_V1_Services : SystemConfig_V1
{
	[WmiDataId(1), Description("ServiceName"), read, MAX(34)] char16 ServiceName;
	[WmiDataId(2), Description("DisplayName"), read, MAX(256)] char16 DisplayName;
	[WmiDataId(3), Description("ProcessName"), read, MAX(34)] char16 ProcessName;
	[WmiDataId(4), Description("ProcessId"), read] uint32 ProcessId;
};

[dynamic: ToInstance, Description("System Configuration"), EventType(22), EventTypeName("PnP"), LOCALE("ms_409")]
class SystemConfig_V1_PnP : SystemConfig_V1
{
	[WmiDataId(1), Description("IDLength"), read] uint32 IDLength;
	[WmiDataId(2), Description("DescriptionLength"), read] uint32 DescriptionLength;
	[WmiDataId(3), Description("FriendlyNameLength"), read] uint32 FriendlyNameLength;
	[WmiDataId(4), Description("DeviceID"), StringTermination("NullTerminated"), format("w"), read] string DeviceID;
	[WmiDataId(5), Description("DeviceDescription"), StringTermination("NullTerminated"), format("w"), read] string DeviceDescription;
	[WmiDataId(6), Description("FriendlyName"), StringTermination("NullTerminated"), format("w"), read] string FriendlyName;
};

[dynamic: ToInstance, Description("System Configuration"), EventType(13), EventTypeName("NIC"), LOCALE("ms_409")]
class SystemConfig_V1_NIC : SystemConfig_V1
{
	[WmiDataId(1), Description("NICName"), read, MAX(256)] char16 NICName;
	[WmiDataId(2), Description("Index"), read] uint32 Index;
	[WmiDataId(3), Description("PhysicalAddressLen"), read] uint32 PhysicalAddrLen;
	[WmiDataId(4), Description("PhysicalAddress"), read, MAX(8)] char16 PhysicalAddr;
	[WmiDataId(5), Description("Size"), read] uint32 Size;
	[WmiDataId(6), Description("IpAddress"), read] sint32 IpAddress;
	[WmiDataId(7), Description("SubnetMask"), read] sint32 SubnetMask;
	[WmiDataId(8), Description("DhcpServer"), read] sint32 DhcpServer;
	[WmiDataId(9), Description("Gateway"), read] sint32 Gateway;
	[WmiDataId(10), Description("PrimaryWinsServer"), read] sint32 PrimaryWinsServer;
	[WmiDataId(11), Description("SecondaryWinsServer"), read] sint32 SecondaryWinsServer;
	[WmiDataId(12), Description("DnsServer1"), read] sint32 DnsServer1;
	[WmiDataId(13), Description("DnsServer2"), read] sint32 DnsServer2;
	[WmiDataId(14), Description("DnsServer3"), read] sint32 DnsServer3;
	[WmiDataId(15), Description("DnsServer4"), read] sint32 DnsServer4;
	[WmiDataId(16), Description("Reserved; do not use."), read] uint32 Data;
};

[dynamic: ToInstance, Description("Registry"), Guid("{ae53722e-c863-11d2-8659-00c04fa321a1}"), DisplayName("Registry"), EventVersion(2), LOCALE("ms_409")]
class Registry : MSNT_SystemTrace
{
};

[dynamic: ToInstance, Description("Registry Hive Dirty"), EventType(40), EventTypeName("HiveDirty"), LOCALE("ms_409")]
class Registry_HiveDirty : Registry
{
	[WmiDataId(1), Description("Hive Address"), pointer, read] uint32 Hive;
	[WmiDataId(2), Description("Link Path"), StringTermination("NullTerminated"), format("w"), read] string LinkPath;
	[WmiDataId(3), Description("Dirty Reason"), read] uint32 DirtyReason;
};

[dynamic: ToInstance, Description("Registry"), EventType(35), EventTypeName("Config"), LOCALE("ms_409")]
class Registry_Config : Registry
{
	[WmiDataId(1), Description("Current Control Set"), read] uint32 CurrentControlSet;
};

[dynamic: ToInstance, Description("Registry Hive Destory"), EventType(37), EventTypeName("HiveDestroy"), LOCALE("ms_409")]
class Registry_HiveDestroy : Registry
{
	[WmiDataId(1), Description("Hive Address"), pointer, read] uint32 Hive;
	[WmiDataId(2), Description("Hive Filename"), StringTermination("NullTerminated"), format("w"), read] string FileName;
	[WmiDataId(3), Description("Link Path"), StringTermination("NullTerminated"), format("w"), read] string Path;
};

[dynamic: ToInstance, Description("Registry"), EventType(34), EventTypeName("Counters"), LOCALE("ms_409")]
class Registry_Counters : Registry
{
	[WmiDataId(1), Description("Counter"), read] uint64 Counter1;
	[WmiDataId(2), Description("Counter"), read] uint64 Counter2;
	[WmiDataId(3), Description("Counter"), read] uint64 Counter3;
	[WmiDataId(4), Description("Counter"), read] uint64 Counter4;
	[WmiDataId(5), Description("Counter"), read] uint64 Counter5;
	[WmiDataId(6), Description("Counter"), read] uint64 Counter6;
	[WmiDataId(7), Description("Counter"), read] uint64 Counter7;
	[WmiDataId(8), Description("Counter"), read] uint64 Counter8;
	[WmiDataId(9), Description("Counter"), read] uint64 Counter9;
	[WmiDataId(10), Description("Counter"), read] uint64 Counter10;
	[WmiDataId(11), Description("Counter"), read] uint64 Counter11;
};

[dynamic: ToInstance,
 Description("Registry"),
 EventType{10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29},
 EventTypeName{"Create", "Open", "Delete", "Query", "SetValue", "DeleteValue", "QueryValue", "EnumerateKey", "EnumerateValueKey", "QueryMultipleValue", "SetInformation", "Flush", "KCBCreate", "KCBDelete", "KCBRundownBegin", "KCBRundownEnd", "Virtualize", "Close", "SetSecurity", "QuerySecurity"},
 LOCALE("ms_409")
]
class Registry_TypeGroup1 : Registry
{
	[WmiDataId(1), Description("Initial Time"), read] sint64 InitialTime;
	[WmiDataId(2), Description("Status"), read] uint32 Status;
	[WmiDataId(3), Description("Index"), read] uint32 Index;
	[WmiDataId(4), Description("KeyHandle"), pointer, read] uint32 KeyHandle;
	[WmiDataId(5), Description("KeyName"), StringTermination("NullTerminated"), format("w"), read] string KeyName;
};

[dynamic: ToInstance, Description("Registry Hive Initialize"), EventType(36), EventTypeName("HiveInit"), LOCALE("ms_409")]
class Registry_HiveInitialize : Registry
{
	[WmiDataId(1), Description("Hive Address"), pointer, read] uint32 Hive;
	[WmiDataId(2), Description("Operation Type"), read] uint32 OperationType;
	[WmiDataId(3), Description("Pool Tag"), read] uint32 PoolTag;
	[WmiDataId(4), Description("Hive Size"), read] uint32 Size;
	[WmiDataId(5), Description("Hive Filename"), StringTermination("NullTerminated"), format("w"), read] string FileName;
};

[dynamic: ToInstance, Description("Registry"), EventType{30, 31, 32}, EventTypeName{"TxRCommit", "TxRPrepare", "TxRRollback"}, LOCALE("ms_409")]
class Registry_TxR : Registry
{
	[WmiDataId(1), Description("TxRGUID"), extension("GUID"), read] object TxrGUID;
	[WmiDataId(2), Description("Status"), read] uint32 Status;
	[WmiDataId(3), Description("UOW Count"), read] uint32 UowCount;
	[WmiDataId(4), Description("Operation Time"), read] uint64 OperationTime;
	[WmiDataId(5), Description("Hive"), StringTermination("NullTerminated"), format("w"), read] string Hive;
};

[dynamic: ToInstance, Description("Registry Hive Rundown"), EventType(39), EventTypeName("HiveDCEnd"), LOCALE("ms_409")]
class Registry_HiveRundown : Registry
{
	[WmiDataId(1), Description("Hive Size"), read] uint64 Size;
	[WmiDataId(2), Description("Hive Address"), pointer, read] uint32 Hive;
	[WmiDataId(3), Description("Key Count at Hive Load"), read] uint32 LoadedKeyCount;
	[WmiDataId(4), Description("Hive Filename"), StringTermination("NullTerminated"), format("w"), read] string FileName;
	[WmiDataId(5), Description("Link Path"), StringTermination("NullTerminated"), format("w"), read] string LinkPath;
};

[dynamic: ToInstance, Description("Change Notification Registration"), EventType(48), EventTypeName("ChangeNotify"), LOCALE("ms_409")]
class Registry_ChangeNotification : Registry
{
	[WmiDataId(1), Description("Notification"), pointer, read] uint32 Notification;
	[WmiDataId(2), Description("Key Handle"), pointer, read] uint32 KeyHandle;
	[WmiDataId(3), Description("Type"), read] uint8 Type;
	[WmiDataId(4), Description("Watch Subtree"), read] uint8 WatchSubtree;
	[WmiDataId(5), Description("Primary Registration"), read] uint8 Primary;
};

[dynamic: ToInstance, Description("Registy Hive Link"), EventType(38), EventTypeName("HiveLink"), LOCALE("ms_409")]
class Registry_HiveLink : Registry
{
	[WmiDataId(1), Description("Hive Address"), pointer, read] uint32 Hive;
	[WmiDataId(2), Description("Link Path"), StringTermination("NullTerminated"), format("w"), read] string Path;
};

[dynamic: ToInstance, Description("Page Fault Event"), Guid("{3d6fa8d3-fe05-11d0-9dda-00c04fd7ba7c}"), DisplayName("PageFault"), EventVersion(3), LOCALE("ms_409")]
class PageFault : MSNT_SystemTrace
{
};

[dynamic: ToInstance, Description("Heap Range Rundown Event"), EventType(100), EventTypeName("HRRundown"), EventVersion(4), LOCALE("ms_409")]
class PageFault_HeapRangeRundown_V4 : PageFault
{
	[WmiDataId(1), Description("HeapHandle"), pointer, read] uint32 HeapHandle;
	[WmiDataId(2), Description("HRFlags"), format("x"), read] uint32 HRFlags;
	[WmiDataId(3), Description("HRPid"), format("x"), read] uint32 HRPid;
	[WmiDataId(4), Description("HRRangeCount"), read] uint32 HRRangeCount;
	[WmiDataId(5), Description("HRHeapTag"), read] uint64 HRHeapTag;
};

[dynamic: ToInstance, Description("Event Trace Event"), Guid("{68fdd900-4a3e-11d1-84f4-0000f80464e3}"), DisplayName("EventTrace"), EventVersion(0), LOCALE("ms_409")]
class EventTraceEvent_V0 : MSNT_SystemTrace
{
};

[dynamic: ToInstance, Description("Event Trace Rundown Complete"), EventType(8), EventTypeName("RDComplete"), LOCALE("ms_409")]
class RDComplete_V0 : EventTraceEvent_V0
{
};

[dynamic: ToInstance, Description("Event Trace Header Extension"), EventType{5, 32}, EventTypeName{"Extension", "EndExtension"}, LOCALE("ms_409")]
class Header_Extension_V0_TypeGroup : EventTraceEvent_V0
{
	[WmiDataId(1), Description("GroupMask1"), format("x"), read] uint32 GroupMask1;
	[WmiDataId(2), Description("GroupMask2"), format("x"), read] uint32 GroupMask2;
	[WmiDataId(3), Description("GroupMask3"), format("x"), read] uint32 GroupMask3;
	[WmiDataId(4), Description("GroupMask4"), format("x"), read] uint32 GroupMask4;
	[WmiDataId(5), Description("GroupMask5"), format("x"), read] uint32 GroupMask5;
	[WmiDataId(6), Description("GroupMask6"), format("x"), read] uint32 GroupMask6;
	[WmiDataId(7), Description("GroupMask7"), format("x"), read] uint32 GroupMask7;
	[WmiDataId(8), Description("GroupMask8"), format("x"), read] uint32 GroupMask8;
};

[dynamic: ToInstance, Description("Event Trace Event"), EventType(0), EventTypeName("Header"), LOCALE("ms_409")]
class EventTrace_V0_Header : EventTraceEvent_V0
{
	[WmiDataId(1), Description("Buffer Size in Bytes"), read] uint32 BufferSize;
	[WmiDataId(2), Description("Event Trace Version"), read] uint32 Version;
	[WmiDataId(3), Description("Windows Build Number"), read] uint32 ProviderVersion;
	[WmiDataId(4), Description("Number Of Processors"), read] uint32 NumberOfProcessors;
	[WmiDataId(5), Description("Collection End Time"), read] uint64 EndTime;
	[WmiDataId(6), Description("Timer Resolution"), read] uint32 TimerResolution;
	[WmiDataId(7), Description("Maximum File Size in MBytes"), read] uint32 MaxFileSize;
	[WmiDataId(8), Description("LogFileMode"), format("x"), read] uint32 LogFileMode;
	[WmiDataId(9), Description("Number of Buffers Written"), read] uint32 BuffersWritten;
	[WmiDataId(10), Description("Buffer Number with earliest TimeStamp for a Circular LogFile"), read] uint32 StartBuffers;
	[WmiDataId(11), Description("Pointer Size in Bytes"), read] uint32 PointerSize;
	[WmiDataId(12), Description("Number of Events Lost during collection"), read] uint32 EventsLost;
	[WmiDataId(13), Description("CPU Speed in MHz"), read] uint32 CPUSpeed;
	[WmiDataId(14), Description("Logger Name"), pointer, read] uint32 LoggerName;
	[WmiDataId(15), Description("LogFile Name"), pointer, read] uint32 LogFileName;
	[WmiDataId(16), Description("TimeZoneInformation"), extension("NoPrint"), read, MAX(176)] uint8 TimeZoneInformation;
	[WmiDataId(17), Description("BootTime"), read] uint64 BootTime;
	[WmiDataId(18), Description("Performance counter frequency in counts per second"), read] uint64 PerfFreq;
	[WmiDataId(19), Description("StartTime"), read] uint64 StartTime;
	[WmiDataId(20), Description("ReservedFlags"), format("x"), read] uint32 ReservedFlags;
	[WmiDataId(21), Description("Number of Buffers Lost during collection"), read] uint32 BuffersLost;
	[WmiDataId(22), Description("SessionNameString"), StringTermination("NullTerminated"), format("w"), read] string SessionNameString;
	[WmiDataId(23), Description("LogFileNameString"), StringTermination("NullTerminated"), format("w"), read] string LogFileNameString;
};

[dynamic: ToInstance, Description("Process Create/Exit Event"), Guid("{3d6fa8d0-fe05-11d0-9dda-00c04fd7ba7c}"), DisplayName("Process"), EventVersion(1), LOCALE("ms_409")]
class Process_V1 : MSNT_SystemTrace
{
};

[dynamic: ToInstance, Description("Process Create/Exit Event"), EventType{1, 2, 3, 4}, EventTypeName{"Start", "End", "DCStart", "DCEnd"}, LOCALE("ms_409")]
class Process_V1_TypeGroup1 : Process_V1
{
	[WmiDataId(1), Description("PageDirectoryBase"), pointer, read] uint32 PageDirectoryBase;
	[WmiDataId(2), Description("ProcessId"), format("x"), read] uint32 ProcessId;
	[WmiDataId(3), Description("ParentId"), format("x"), read] uint32 ParentId;
	[WmiDataId(4), Description("SessionId"), read] uint32 SessionId;
	[WmiDataId(5), Description("ExitStatus"), read] sint32 ExitStatus;
	[WmiDataId(6), Description("UserSID"), extension("Sid"), read] object UserSID;
	[WmiDataId(7), Description("ImageFileName"), StringTermination("NullTerminated"), read] string ImageFileName;
};

[dynamic: ToInstance, Description("PerfInfo Event"), Guid("{ce1dbfb4-137e-4da6-87b0-3f59aa102cbc}"), DisplayName("PerfInfo"), EventVersion(1), LOCALE("ms_409")]
class PerfInfo_V1 : MSNT_SystemTrace
{
};

[dynamic: ToInstance, Description("Sampled Profile"), EventType(46), EventTypeName("SampleProf"), LOCALE("ms_409")]
class SampledProfile_V1 : PerfInfo_V1
{
	[WmiDataId(1), Description("InstructionPointer"), pointer, read] uint32 InstructionPointer;
	[WmiDataId(2), Description("ThreadId"), read] uint32 ThreadId;
	[WmiDataId(3), Description("Count"), read] uint16 Count;
};

[dynamic: ToInstance, Description("DPC"), EventType{68, 69}, EventTypeName{"DPC", "TimerDPC"}, LOCALE("ms_409")]
class DPC_V1 : PerfInfo_V1
{
	[WmiDataId(1), Description("Initial Time"), extension("WmiTime"), read] object InitialTime;
	[WmiDataId(2), Description("Routine"), pointer, read] uint32 Routine;
};

[dynamic: ToInstance, Description("ISR"), EventType{67, 95}, EventTypeName{"ISR", "ISR-PASS"}, LOCALE("ms_409")]
class ISR_V1 : PerfInfo_V1
{
	[WmiDataId(1), Description("Initial Time"), extension("WmiTime"), read] object InitialTime;
	[WmiDataId(2), Description("Routine"), pointer, read] uint32 Routine;
	[WmiDataId(3), Description("Return Value"), read] uint32 ReturnValue;
};

[dynamic: ToInstance, Description("Image Load"), Guid("{2cb15d1d-5fc1-11d2-abe1-00a0c911f518}"), DisplayName("Image"), EventVersion(2), LOCALE("ms_409")]
class Image_V2 : MSNT_SystemTrace
{
};

[dynamic: ToInstance, Description("Kernel Image Base"), EventType(33), EventTypeName("KernelBase"), LOCALE("ms_409")]
class KernelImageBase : Image_V2
{
	[WmiDataId(1), Description("ImageBase"), pointer, read] uint32 ImageBase;
};

[dynamic: ToInstance,
 Description("Library Loader Basic Event"),
 EventType{128, 129, 130, 131, 132, 133, 134, 135},
 EventTypeName{"LoaderLockAttempt", "LoaderLockAcquire", "LoaderLockTriedAndFailed", "LoaderLockWait", "ProcessInitDone", "CreateSectionBegin", "CreateSectionEnd", "MapViewBegin"},
 LOCALE("ms_409")
]
class LoaderBasicEvent : Image_V2
{
};

[dynamic: ToInstance,
 Description("Library Loader Coded Event"),
 EventType{160, 161, 162, 163, 164},
 EventTypeName{"FindDllByName", "MapViewEnd", "LoaderLockRelease", "DllMainEnter", "LoaderError"},
 LOCALE("ms_409")
]
class LoaderCodedEvent : Image_V2
{
	[WmiDataId(1), Description("Base Address or Status Code"), format("x"), read] uint64 BaseAddress;
	[WmiDataId(2), Description("ErrorOpcode"), format("x"), read] uint8 ErrorOpcode;
	[WmiDataId(3), Description("Code"), read] sint8 Code;
	[WmiDataId(4), Description("String"), StringTermination("NullTerminated"), format("w"), read] string String;
};

[dynamic: ToInstance,
 Description("Library Loader BaseAddress Event"),
 EventType{144, 145, 146, 147, 148, 149, 150},
 EventTypeName{"RelocateImageBegin", "RelocateImageEnd", "HandleOldDescsBegin", "HandleOldDescsEnd", "HandleNewDescsBegin", "HandleNewDescsEnd", "DllMainExit"},
 LOCALE("ms_409")
]
class LoaderBaseEvent : Image_V2
{
	[WmiDataId(1), Description("Base Address"), format("x"), read] uint64 BaseAddress;
};

[dynamic: ToInstance, Description("Image Load"), EventType{10, 2, 3, 4}, EventTypeName{"Load", "UnLoad", "DCStart", "DCEnd"}, LOCALE("ms_409")]
class Image_Load_V2 : Image_V2
{
	[WmiDataId(1), Description("ImageBase"), pointer, read] uint32 ImageBase;
	[WmiDataId(2), Description("ImageSize"), pointer, read] uint32 ImageSize;
	[WmiDataId(3), Description("ProcessId"), read] uint32 ProcessId;
	[WmiDataId(4), Description("ImageChecksum"), read] uint32 ImageChecksum;
	[WmiDataId(5), Description("TimeDateStamp"), read] uint32 TimeDateStamp;
	[WmiDataId(6), Description("Reserved0"), read] uint32 Reserved0;
	[WmiDataId(7), Description("DefaultBase"), pointer, read] uint32 DefaultBase;
	[WmiDataId(8), Description("Reserved1"), read] uint32 Reserved1;
	[WmiDataId(9), Description("Reserved2"), read] uint32 Reserved2;
	[WmiDataId(10), Description("Reserved3"), read] uint32 Reserved3;
	[WmiDataId(11), Description("Reserved4"), read] uint32 Reserved4;
	[WmiDataId(12), Description("FileName"), StringTermination("NullTerminated"), format("w"), read] string FileName;
};

[dynamic: ToInstance, Description("Hypercall Page"), EventType(34), EventTypeName("HypercallPage"), LOCALE("ms_409")]
class HypercallPage : Image_V2
{
	[WmiDataId(1), Description("Hypercall Page Address"), pointer, read] uint32 HypercallPageVa;
};

[dynamic: ToInstance, Description("UdpIp Send/Receive"), Guid("{bf3a50c5-a9c9-4988-a005-2df0b7c80f80}"), DisplayName("UdpIp"), EventVersion(1), LOCALE("ms_409")]
class UdpIp_V1 : MSNT_SystemTrace
{
};

[dynamic: ToInstance, Description("UdpIp Send/Receive"), EventType{10, 11}, EventTypeName{"Send", "Recv"}, LOCALE("ms_409")]
class UdpIp_V1_TypeGroup1 : UdpIp_V1
{
	[WmiDataId(1), Description("Process ID"), read] uint32 PID;
	[WmiDataId(2), Description("Transfer Size in Bytes"), read] uint32 size;
	[WmiDataId(3), Description("Remote IP Address"), extension("IPAddr"), read] object daddr;
	[WmiDataId(4), Description("Local IP Address"), extension("IPAddr"), read] object saddr;
	[WmiDataId(5), Description("Remote Port"), extension("Port"), read] object dport;
	[WmiDataId(6), Description("Local Port"), extension("Port"), read] object sport;
};

[dynamic: ToInstance, Description("Registry"), Guid("{ae53722e-c863-11d2-8659-00c04fa321a1}"), DisplayName("Registry"), EventVersion(0), LOCALE("ms_409")]
class Registry_V0 : MSNT_SystemTrace
{
};

[dynamic: ToInstance,
 Description("Registry"),
 EventType{10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21},
 EventTypeName{"Create", "Open", "Delete", "Query", "SetValue", "DeleteValue", "QueryValue", "EnumerateKey", "EnumerateValueKey", "QueryMultipleValue", "SetInformation", "Flush"},
 LOCALE("ms_409")
]
class Registry_V0_TypeGroup1 : Registry_V0
{
	[WmiDataId(1), Description("Status"), pointer, read] uint32 Status;
	[WmiDataId(2), Description("KeyHandle"), pointer, read] uint32 KeyHandle;
	[WmiDataId(3), Description("ElapsedTime"), read] sint64 ElapsedTime;
	[WmiDataId(4), Description("KeyName"), StringTermination("NullTerminated"), format("w"), read] string KeyName;
};

[dynamic: ToInstance, Description("Process Create/Exit Event"), Guid("{3d6fa8d0-fe05-11d0-9dda-00c04fd7ba7c}"), DisplayName("Process"), EventVersion(0), LOCALE("ms_409")]
class Process_V0 : MSNT_SystemTrace
{
};

[dynamic: ToInstance, Description("Process Create/Exit Event"), EventType{1, 2, 3, 4}, EventTypeName{"Start", "End", "DCStart", "DCEnd"}, LOCALE("ms_409")]
class Process_V0_TypeGroup1 : Process_V0
{
	[WmiDataId(1), Description("Process ID"), pointer, read] uint32 ProcessId;
	[WmiDataId(2), Description("Parent Process ID"), pointer, read] uint32 ParentId;
	[WmiDataId(3), Description("User SID"), extension("Sid"), read] object UserSID;
	[WmiDataId(4), Description("ImageFileName"), StringTermination("NullTerminated"), read] string ImageFileName;
};

[dynamic: ToInstance, Description("File Name"), Guid("{90cbdc39-4a3e-11d1-84f4-0000f80464e3}"), DisplayName("FileIo"), EventVersion(3), LOCALE("ms_409")]
class FileIo : MSNT_SystemTrace
{
};

[dynamic: ToInstance, Description("File Read Write"), EventType{67, 68}, EventTypeName{"Read", "Write"}, LOCALE("ms_409")]
class FileIo_ReadWrite : FileIo
{
	[WmiDataId(1), Description("Offset"), read] uint64 Offset;
	[WmiDataId(2), Description("IrpPtr"), pointer, read] uint32 IrpPtr;
	[WmiDataId(3), Description("FileObject"), pointer, read] uint32 FileObject;
	[WmiDataId(4), Description("FileKey"), pointer, read] uint32 FileKey;
	[WmiDataId(5), Description("TTID"), read] uint32 TTID;
	[WmiDataId(6), Description("IoSize"), read] uint32 IoSize;
	[WmiDataId(7), Description("IoFlags"), read] uint32 IoFlags;
};

[dynamic: ToInstance, Description("File Create"), EventType(64), EventTypeName("Create"), LOCALE("ms_409")]
class FileIo_Create : FileIo
{
	[WmiDataId(1), Description("IrpPtr"), pointer, read] uint32 IrpPtr;
	[WmiDataId(2), Description("FileObject"), pointer, read] uint32 FileObject;
	[WmiDataId(3), Description("TTID"), read] uint32 TTID;
	[WmiDataId(4), Description("CreateOptions"), read] uint32 CreateOptions;
	[WmiDataId(5), Description("FileAttributes"), read] uint32 FileAttributes;
	[WmiDataId(6), Description("ShareAccess"), read] uint32 ShareAccess;
	[WmiDataId(7), Description("OpenPath"), StringTermination("NullTerminated"), format("w"), read] string OpenPath;
};

[dynamic: ToInstance, Description("Minifilter IO Init"), EventType{96, 97}, EventTypeName{"PreOpInit", "PostOpInit"}, LOCALE("ms_409")]
class FltIoInit : FileIo
{
	[WmiDataId(1), Description("RoutineAddr"), pointer, read] uint32 RoutineAddr;
	[WmiDataId(2), Description("FileObject"), pointer, read] uint32 FileObject;
	[WmiDataId(3), Description("FileContext"), pointer, read] uint32 FileContext;
	[WmiDataId(4), Description("Irp"), pointer, read] uint32 IrpPtr;
	[WmiDataId(5), Description("CallbackData"), pointer, read] uint32 CallbackDataPtr;
	[WmiDataId(6), Description("MajorFunction"), read] uint32 MajorFunction;
};

[dynamic: ToInstance, Description("Minifilter IO Failure"), EventType{100, 101}, EventTypeName{"PreOpFailure", "PostOpFailure"}, LOCALE("ms_409")]
class FltIoFailure : FileIo
{
	[WmiDataId(1), Description("RoutineAddr"), pointer, read] uint32 RoutineAddr;
	[WmiDataId(2), Description("FileObject"), pointer, read] uint32 FileObject;
	[WmiDataId(3), Description("FileContext"), pointer, read] uint32 FileContext;
	[WmiDataId(4), Description("Irp"), pointer, read] uint32 IrpPtr;
	[WmiDataId(5), Description("CallbackData"), pointer, read] uint32 CallbackDataPtr;
	[WmiDataId(6), Description("MajorFunction"), read] uint32 MajorFunction;
	[WmiDataId(7), Description("Status"), format("x"), read] uint32 Status;
};

[dynamic: ToInstance, Description("File Name"), EventType{0, 32, 35, 36}, EventTypeName{"Name", "FileCreate", "FileDelete", "FileRundown"}, LOCALE("ms_409")]
class FileIo_Name : FileIo
{
	[WmiDataId(1), Description("FileObject"), pointer, read] uint32 FileObject;
	[WmiDataId(2), Description("FileName"), StringTermination("NullTerminated"), format("w"), read] string FileName;
};

[dynamic: ToInstance, Description("File Information"), EventType{69, 70, 71, 74, 75}, EventTypeName{"SetInfo", "Delete", "Rename", "QueryInfo", "FSControl"}, LOCALE("ms_409")]
class FileIo_Info : FileIo
{
	[WmiDataId(1), Description("IrpPtr"), pointer, read] uint32 IrpPtr;
	[WmiDataId(2), Description("FileObject"), pointer, read] uint32 FileObject;
	[WmiDataId(3), Description("FileKey"), pointer, read] uint32 FileKey;
	[WmiDataId(4), Description("ExtraInfo"), pointer, read] uint32 ExtraInfo;
	[WmiDataId(5), Description("TTID"), read] uint32 TTID;
	[WmiDataId(6), Description("InfoClass"), read] uint32 InfoClass;
};

[dynamic: ToInstance, Description("File Simple Operation"), EventType{65, 66, 73}, EventTypeName{"Cleanup", "Close", "Flush"}, LOCALE("ms_409")]
class FileIo_SimpleOp : FileIo
{
	[WmiDataId(1), Description("IrpPtr"), pointer, read] uint32 IrpPtr;
	[WmiDataId(2), Description("FileObject"), pointer, read] uint32 FileObject;
	[WmiDataId(3), Description("FileKey"), pointer, read] uint32 FileKey;
	[WmiDataId(4), Description("TTID"), read] uint32 TTID;
};

[dynamic: ToInstance, Description("Minifilter IO Completion"), EventType{98, 99}, EventTypeName{"PreOpCompletion", "PostOpCompletion"}, LOCALE("ms_409")]
class FltIoCompletion : FileIo
{
	[WmiDataId(1), Description("Initial Time"), extension("WmiTime"), read] object InitialTime;
	[WmiDataId(2), Description("RoutineAddr"), pointer, read] uint32 RoutineAddr;
	[WmiDataId(3), Description("FileObject"), pointer, read] uint32 FileObject;
	[WmiDataId(4), Description("FileContext"), pointer, read] uint32 FileContext;
	[WmiDataId(5), Description("Irp"), pointer, read] uint32 IrpPtr;
	[WmiDataId(6), Description("CallbackData"), pointer, read] uint32 CallbackDataPtr;
	[WmiDataId(7), Description("MajorFunction"), read] uint32 MajorFunction;
};

[dynamic: ToInstance, Description("File Dir Enum"), EventType{72, 77}, EventTypeName{"DirEnum", "DirNotify"}, LOCALE("ms_409")]
class FileIo_DirEnum : FileIo
{
	[WmiDataId(1), Description("IrpPtr"), pointer, read] uint32 IrpPtr;
	[WmiDataId(2), Description("FileObject"), pointer, read] uint32 FileObject;
	[WmiDataId(3), Description("FileKey"), pointer, read] uint32 FileKey;
	[WmiDataId(4), Description("TTID"), read] uint32 TTID;
	[WmiDataId(5), Description("Length"), read] uint32 Length;
	[WmiDataId(6), Description("InfoClass"), read] uint32 InfoClass;
	[WmiDataId(7), Description("FileIndex"), read] uint32 FileIndex;
	[WmiDataId(8), Description("FileName"), StringTermination("NullTerminated"), format("w"), read] string FileName;
};

[dynamic: ToInstance, Description("File Path Operation"), EventType{79, 80, 81}, EventTypeName{"DletePath", "RenamePath", "SetLinkPath"}, LOCALE("ms_409")]
class FileIo_PathOperation : FileIo
{
	[WmiDataId(1), Description("IrpPtr"), pointer, read] uint32 IrpPtr;
	[WmiDataId(2), Description("FileObject"), pointer, read] uint32 FileObject;
	[WmiDataId(3), Description("FileKey"), pointer, read] uint32 FileKey;
	[WmiDataId(4), Description("ExtraInfo"), pointer, read] uint32 ExtraInfo;
	[WmiDataId(5), Description("TTID"), read] uint32 TTID;
	[WmiDataId(6), Description("InfoClass"), read] uint32 InfoClass;
	[WmiDataId(7), Description("FileName"), StringTermination("NullTerminated"), format("w"), read] string FileName;
};

[dynamic: ToInstance, Description("File Operation End"), EventType(76), EventTypeName("OperationEnd"), LOCALE("ms_409")]
class FileIo_OpEnd : FileIo
{
	[WmiDataId(1), Description("IrpPtr"), pointer, read] uint32 IrpPtr;
	[WmiDataId(2), Description("ExtraInfo"), pointer, read] uint32 ExtraInfo;
	[WmiDataId(3), Description("NtStatus"), read] uint32 NtStatus;
};

[dynamic: ToInstance, Description("Split IO Event"), Guid("{d837ca92-12b9-44a5-ad6a-3a65b3578aa8}"), DisplayName("SplitIo"), EventVersion(2), locale("ms_409")]
class SplitIo : MSNT_SystemTrace
{
};

[dynamic: ToInstance, Description("Split IO"), EventType(32), EventTypeName("VolMgr"), locale("ms_409")]
class SplitIo_Info : SplitIo
{
	[WmiDataId(1), Description("ParentIrp"), pointer, read] uint32 ParentIrp;
	[WmiDataId(2), Description("ChildIrp"), pointer, read] uint32 ChildIrp;
};

[dynamic: ToInstance, Description("LBR Event"), Guid("{99134383-5248-43fc-834b-529454e75df3}"), DisplayName("LBR"), EventVersion(2), LOCALE("ms_409")]
class LBR_V2 : MSNT_SystemTrace
{
};

[dynamic: ToInstance, Description("LBR Record"), EventType(32), EventTypeName("LbrRecord"), LOCALE("ms_409")]
class LbrRecord_V2 : LBR_V2
{
	[WmiDataId(1), Description("TimeStamp"), read] uint64 TimeStamp;
	[WmiDataId(2), Description("ProcessId"), read] uint32 ProcessId;
	[WmiDataId(3), Description("ThreadId"), read] uint32 ThreadId;
	[WmiDataId(4), Description("Options"), read] uint32 Options;
	[WmiDataId(5), Description("Lbr Entries Array"), read] object Entries;
};

[dynamic: ToInstance, Description("TcpIp Send/Receive"), Guid("{9a280ac0-c8e0-11d1-84e2-00c04fb998a2}"), DisplayName("TcpIp"), EventVersion(2), LOCALE("ms_409")]
class TcpIp : MSNT_SystemTrace
{
};

[dynamic: ToInstance,
 Description("TcpIp IPV6 Generic"),
 EventType{27, 29, 30, 32, 34},
 EventTypeName{"RecvIPV6", "DisconnectIPV6", "RetransmitIPV6", "ReconnectIPV6", "TCPCopyIPV6"},
 LOCALE("ms_409")
]
class TcpIp_TypeGroup3 : TcpIp
{
	[WmiDataId(1), Description("Process ID"), read] uint32 PID;
	[WmiDataId(2), Description("Transfer Size in Bytes"), read] uint32 size;
	[WmiDataId(3), Description("Remote IP Address"), extension("IPAddrV6"), read] object daddr;
	[WmiDataId(4), Description("Local IP Address"), extension("IPAddrV6"), read] object saddr;
	[WmiDataId(5), Description("Remote Port"), extension("Port"), read] object dport;
	[WmiDataId(6), Description("Local Port"), extension("Port"), read] object sport;
	[WmiDataId(7), Description("Sequence Number"), read] uint32 seqnum;
	[WmiDataId(8), Description("ConnID"), PointerType, read] uint32 connid;
};

[dynamic: ToInstance, Description("TcpIp IPV4 Send"), EventType(10), EventTypeName("SendIPV4"), LOCALE("ms_409")]
class TcpIp_SendIPV4 : TcpIp
{
	[WmiDataId(1), Description("Process ID"), read] uint32 PID;
	[WmiDataId(2), Description("Transfer Size in Bytes"), read] uint32 size;
	[WmiDataId(3), Description("Remote IP Address"), extension("IPAddrV4"), read] object daddr;
	[WmiDataId(4), Description("Local IP Address"), extension("IPAddrV4"), read] object saddr;
	[WmiDataId(5), Description("Remote Port"), extension("Port"), read] object dport;
	[WmiDataId(6), Description("Local Port"), extension("Port"), read] object sport;
	[WmiDataId(7), Description("Start SendReq Time"), read] uint32 startime;
	[WmiDataId(8), Description("End SendReq Time"), read] uint32 endtime;
	[WmiDataId(9), Description("Sequence Number"), read] uint32 seqnum;
	[WmiDataId(10), Description("ConnID"), PointerType, read] uint32 connid;
};

[dynamic: ToInstance, Description("TcpIp Fail"), EventType(17), EventTypeName("Fail"), LOCALE("ms_409")]
class TcpIp_Fail : TcpIp
{
	[WmiDataId(1), Description("Protocol"), read] uint16 Proto;
	[WmiDataId(2), Description("FailureCode"), read] uint16 FailureCode;
};

[dynamic: ToInstance, Description("TcpIp IPV4 Connect/Accept"), EventType{12, 15}, EventTypeName{"ConnectIPV4", "AcceptIPV4"}, LOCALE("ms_409")]
class TcpIp_TypeGroup2 : TcpIp
{
	[WmiDataId(1), Description("Process ID"), read] uint32 PID;
	[WmiDataId(2), Description("Transfer Size in Bytes"), read] uint32 size;
	[WmiDataId(3), Description("Remote IP Address"), extension("IPAddrV4"), read] object daddr;
	[WmiDataId(4), Description("Local IP Address"), extension("IPAddrV4"), read] object saddr;
	[WmiDataId(5), Description("Remote Port"), extension("Port"), read] object dport;
	[WmiDataId(6), Description("Local Port"), extension("Port"), read] object sport;
	[WmiDataId(7), Description("MSS"), read] uint16 mss;
	[WmiDataId(8), Description("SACK Option"), read] uint16 sackopt;
	[WmiDataId(9), Description("TimeStamp Option"), read] uint16 tsopt;
	[WmiDataId(10), Description("WindowScale Option"), read] uint16 wsopt;
	[WmiDataId(11), Description("TCP Window Size"), read] uint32 rcvwin;
	[WmiDataId(12), Description("Receive Window Scale"), read] sint16 rcvwinscale;
	[WmiDataId(13), Description("Send Window Scale"), read] sint16 sndwinscale;
	[WmiDataId(14), Description("Sequence Number"), read] uint32 seqnum;
	[WmiDataId(15), Description("ConnID"), PointerType, read] uint32 connid;
};

[dynamic: ToInstance, Description("TcpIp IPV6 Send"), EventType(26), EventTypeName("SendIPV6"), LOCALE("ms_409")]
class TcpIp_SendIPV6 : TcpIp
{
	[WmiDataId(1), Description("Process ID"), read] uint32 PID;
	[WmiDataId(2), Description("Transfer Size in Bytes"), read] uint32 size;
	[WmiDataId(3), Description("Remote IP Address"), extension("IPAddrV6"), read] object daddr;
	[WmiDataId(4), Description("Local IP Address"), extension("IPAddrV6"), read] object saddr;
	[WmiDataId(5), Description("Remote Port"), extension("Port"), read] object dport;
	[WmiDataId(6), Description("Local Port"), extension("Port"), read] object sport;
	[WmiDataId(7), Description("Start SendReq Time"), read] uint32 startime;
	[WmiDataId(8), Description("End SendReq Time"), read] uint32 endtime;
	[WmiDataId(9), Description("Sequence Number"), read] uint32 seqnum;
	[WmiDataId(10), Description("ConnID"), PointerType, read] uint32 connid;
};

[dynamic: ToInstance,
 Description("TcpIp IPV4 Generic"),
 EventType{11, 13, 14, 16, 18},
 EventTypeName{"RecvIPV4", "DisconnectIPV4", "RetransmitIPV4", "ReconnectIPV4", "TCPCopyIPV4"},
 LOCALE("ms_409")
]
class TcpIp_TypeGroup1 : TcpIp
{
	[WmiDataId(1), Description("Process ID"), read] uint32 PID;
	[WmiDataId(2), Description("Transfer Size in Bytes"), read] uint32 size;
	[WmiDataId(3), Description("Remote IP Address"), extension("IPAddrV4"), read] object daddr;
	[WmiDataId(4), Description("Local IP Address"), extension("IPAddrV4"), read] object saddr;
	[WmiDataId(5), Description("Remote Port"), extension("Port"), read] object dport;
	[WmiDataId(6), Description("Local Port"), extension("Port"), read] object sport;
	[WmiDataId(7), Description("Sequence Number"), read] uint32 seqnum;
	[WmiDataId(8), Description("ConnID"), PointerType, read] uint32 connid;
};

[dynamic: ToInstance, Description("TcpIp IPV6 Connect/Accept"), EventType{28, 31}, EventTypeName{"ConnectIPV6", "AcceptIPV6"}, LOCALE("ms_409")]
class TcpIp_TypeGroup4 : TcpIp
{
	[WmiDataId(1), Description("Process ID"), read] uint32 PID;
	[WmiDataId(2), Description("Transfer Size in Bytes"), read] uint32 size;
	[WmiDataId(3), Description("Remote IP Address"), extension("IPAddrV6"), read] object daddr;
	[WmiDataId(4), Description("Local IP Address"), extension("IPAddrV6"), read] object saddr;
	[WmiDataId(5), Description("Remote Port"), extension("Port"), read] object dport;
	[WmiDataId(6), Description("Local Port"), extension("Port"), read] object sport;
	[WmiDataId(7), Description("MSS"), read] uint16 mss;
	[WmiDataId(8), Description("SACK Option"), read] uint16 sackopt;
	[WmiDataId(9), Description("TimeStamp Option"), read] uint16 tsopt;
	[WmiDataId(10), Description("WindowScale Option"), read] uint16 wsopt;
	[WmiDataId(11), Description("TCP Window Size"), read] uint32 rcvwin;
	[WmiDataId(12), Description("Receive Window Scale"), read] sint16 rcvwinscale;
	[WmiDataId(13), Description("Send Window Scale"), read] sint16 sndwinscale;
	[WmiDataId(14), Description("Sequence Number"), read] uint32 seqnum;
	[WmiDataId(15), Description("ConnID"), PointerType, read] uint32 connid;
};

[dynamic: ToInstance, Description("Thread Create/Exit Event"), Guid("{3d6fa8d1-fe05-11d0-9dda-00c04fd7ba7c}"), DisplayName("Thread"), EventVersion(0), LOCALE("ms_409")]
class Thread_V0 : MSNT_SystemTrace
{
};

[dynamic: ToInstance, Description("Thread Create/Exit Event"), EventType{1, 2, 3, 4}, EventTypeName{"Start", "End", "DCStart", "DCEnd"}, LOCALE("ms_409")]
class Thread_V0_TypeGroup1 : Thread_V0
{
	[WmiDataId(1), Description("ThreadId"), format("x"), read] uint32 TThreadId;
	[WmiDataId(2), Description("ProcessId"), format("x"), read] uint32 ProcessId;
};

[dynamic: ToInstance, Description("Registry"), Guid("{ae53722e-c863-11d2-8659-00c04fa321a1}"), DisplayName("Registry"), EventVersion(1), LOCALE("ms_409")]
class Registry_V1 : MSNT_SystemTrace
{
};

[dynamic: ToInstance,
 Description("Registry"),
 EventType{10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22},
 EventTypeName{"Create", "Open", "Delete", "Query", "SetValue", "DeleteValue", "QueryValue", "EnumerateKey", "EnumerateValueKey", "QueryMultipleValue", "SetInformation", "Flush", "RunDown"},
 LOCALE("ms_409")
]
class Registry_V1_TypeGroup1 : Registry_V1
{
	[WmiDataId(1), Description("Status"), pointer, read] uint32 Status;
	[WmiDataId(2), Description("KeyHandle"), pointer, read] uint32 KeyHandle;
	[WmiDataId(3), Description("ElapsedTime"), read] sint64 ElapsedTime;
	[WmiDataId(4), Description("Index"), read] uint32 Index;
	[WmiDataId(5), Description("KeyName"), StringTermination("NullTerminated"), format("w"), read] string KeyName;
};

[dynamic: ToInstance, Description("Image Load"), Guid("{2cb15d1d-5fc1-11d2-abe1-00a0c911f518}"), DisplayName("Image"), EventVersion(0), LOCALE("ms_409")]
class Image_V0 : MSNT_SystemTrace
{
};

[dynamic: ToInstance, Description("Image Load"), EventType(10), EventTypeName("Load"), LOCALE("ms_409")]
class Image_V0_Load : Image_V0
{
	[WmiDataId(1), Description("BaseAddress"), pointer, read] uint32 BaseAddress;
	[WmiDataId(2), Description("ModuleSize"), read] uint32 ModuleSize;
	[WmiDataId(3), Description("ImageFileName"), StringTermination("NullTerminated"), format("w"), read] string ImageFileName;
};

[dynamic: ToInstance, Description("System Configuration"), Guid("{01853a65-418f-4f36-aefc-dc0f1d2fd235}"), DisplayName("SystemConfig"), EventVersion(4), LOCALE("ms_409")]
class SystemConfig_V4 : MSNT_SystemTrace
{
};

[dynamic: ToInstance, Description("System Configuration"), EventType(32), EventTypeName("MobilePlatform"), LOCALE("ms_409")]
class SystemConfig_V4_MobilePlatform : SystemConfig_V4
{
	[WmiDataId(1), Description("DeviceManufacturer"), StringTermination("NullTerminated"), format("w"), read] string DeviceManufacturer;
	[WmiDataId(2), Description("DeviceManufacturerDisplayName"), StringTermination("NullTerminated"), format("w"), read] string DeviceManufacturerDisplayName;
	[WmiDataId(3), Description("DeviceModel"), StringTermination("NullTerminated"), format("w"), read] string DeviceModel;
	[WmiDataId(4), Description("DeviceModelDisplayName"), StringTermination("NullTerminated"), format("w"), read] string DeviceModelDisplayName;
	[WmiDataId(5), Description("MobileOperator"), StringTermination("NullTerminated"), format("w"), read] string MobileOperator;
	[WmiDataId(6), Description("SocVersion"), StringTermination("NullTerminated"), format("w"), read] string SocVersion;
	[WmiDataId(7), Description("BspVersion"), StringTermination("NullTerminated"), format("w"), read] string BspVersion;
};

[dynamic: ToInstance, Description("System Configuration"), EventType(22), EventTypeName("PnP"), LOCALE("ms_409")]
class SystemConfig_V4_PnP : SystemConfig_V4
{
	[WmiDataId(1), Description("ClassGuid"), extension("GUID"), read] object ClassGuid;
	[WmiDataId(2), Description("Upper Filters Count"), read] uint32 UpperFiltersCount;
	[WmiDataId(3), Description("Lower Filter Count"), read] uint32 LowerFiltersCount;
	[WmiDataId(4), Description("DeviceID"), StringTermination("NullTerminated"), format("w"), read] string DeviceID;
	[WmiDataId(5), Description("DeviceDescription"), StringTermination("NullTerminated"), format("w"), read] string DeviceDescription;
	[WmiDataId(6), Description("FriendlyName"), StringTermination("NullTerminated"), format("w"), read] string FriendlyName;
	[WmiDataId(7), Description("PdoName"), StringTermination("NullTerminated"), format("w"), read] string PdoName;
	[WmiDataId(8), Description("ServiceName"), StringTermination("NullTerminated"), format("w"), read] string ServiceName;
	[WmiDataId(9), Description("Upper Filters"), StringTermination("NullTerminated"), format("w"), WmiSizeIs("UpperFiltersCount"), read] string UpperFilters;
	[WmiDataId(10), Description("Lower Filters"), StringTermination("NullTerminated"), format("w"), WmiSizeIs("LowerFiltersCount"), read] string LowerFilters;
};

[dynamic: ToInstance, Description("Image Load"), Guid("{2cb15d1d-5fc1-11d2-abe1-00a0c911f518}"), DisplayName("Image"), EventVersion(1), LOCALE("ms_409")]
class Image_V1 : MSNT_SystemTrace
{
};

[dynamic: ToInstance, Description("Image Load"), EventType(10), EventTypeName("Load"), LOCALE("ms_409")]
class Image_V1_Load : Image_V1
{
	[WmiDataId(1), Description("ImageBase"), pointer, read] uint32 ImageBase;
	[WmiDataId(2), Description("ImageSize"), pointer, read] uint32 ImageSize;
	[WmiDataId(3), Description("ProcessId"), read] uint32 ProcessId;
	[WmiDataId(4), Description("FileName"), StringTermination("NullTerminated"), format("w"), read] string FileName;
};

[dynamic: ToInstance, Description("Thread Create/Exit Event"), Guid("{3d6fa8d1-fe05-11d0-9dda-00c04fd7ba7c}"), DisplayName("Thread"), EventVersion(3), LOCALE("ms_409")]
class Thread_V3 : MSNT_SystemTrace
{
};

[dynamic: ToInstance, Description("Thread Create/Exit Event"), EventType{1, 2, 3, 4}, EventTypeName{"Start", "End", "DCStart", "DCEnd"}, LOCALE("ms_409")]
class Thread_V3_TypeGroup1 : Thread_V3
{
	[WmiDataId(1), Description("ProcessId"), format("x"), read] uint32 ProcessId;
	[WmiDataId(2), Description("ThreadId"), format("x"), read] uint32 TThreadId;
	[WmiDataId(3), Description("StackBase"), pointer, read] uint32 StackBase;
	[WmiDataId(4), Description("StackLimit"), pointer, read] uint32 StackLimit;
	[WmiDataId(5), Description("UserStackBase"), pointer, read] uint32 UserStackBase;
	[WmiDataId(6), Description("UserStackLimit"), pointer, read] uint32 UserStackLimit;
	[WmiDataId(7), Description("Affinity"), pointer, read] uint32 Affinity;
	[WmiDataId(8), Description("Win32StartAddr"), pointer, read] uint32 Win32StartAddr;
	[WmiDataId(9), Description("TebBase"), pointer, read] uint32 TebBase;
	[WmiDataId(10), Description("SubProcessTag"), format("x"), read] uint32 SubProcessTag;
	[WmiDataId(11), Description("BasePriority"), read] uint8 BasePriority;
	[WmiDataId(12), Description("PagePriority"), read] uint8 PagePriority;
	[WmiDataId(13), Description("IoPriority"), read] uint8 IoPriority;
	[WmiDataId(14), Description("Flags"), read] uint8 ThreadFlags;
};

[dynamic: ToInstance,
 Description("Priority Change Event"),
 EventType{48, 49, 51, 52},
 EventTypeName{"SetPriority", "SetBasePriority", "SetPagePriority", "SetIoPriority"},
 LOCALE("ms_409")
]
class ThreadPriority : Thread_V3
{
	[WmiDataId(1), Description("ThreadId"), format("x"), read] uint32 ThreadId;
	[WmiDataId(2), Description("OldPriority"), read] uint8 OldPriority;
	[WmiDataId(3), Description("NewPriority"), read] uint8 NewPriority;
	[WmiDataId(4), Description("Reserved"), read] uint16 Reserved;
};

[dynamic: ToInstance, Description("Context Switch Event"), EventType(36), EventTypeName("CSwitch"), LOCALE("ms_409")]
class CSwitch_V3 : Thread_V3
{
	[WmiDataId(1), Description("NewThreadId"), format("x"), read] uint32 NewThreadId;
	[WmiDataId(2), Description("OldThreadId"), format("x"), read] uint32 OldThreadId;
	[WmiDataId(3), Description("NewThreadPriority"), read] sint8 NewThreadPriority;
	[WmiDataId(4), Description("OldThreadPriority"), read] sint8 OldThreadPriority;
	[WmiDataId(5), Description("PreviousCState or OldThreadRank"), read] uint8 PreviousCState;
	[WmiDataId(6), Description("SpareByte"), read] sint8 SpareByte;
	[WmiDataId(7), Description("OldThreadWaitReason"), read] sint8 OldThreadWaitReason;
	[WmiDataId(8), Description("ThreadFlags"), read] sint8 ThreadFlags;
	[WmiDataId(9), Description("OldThreadState"), read] sint8 OldThreadState;
	[WmiDataId(10), Description("OldThreadWaitIdealProcessor"), read] sint8 OldThreadWaitIdealProcessor;
	[WmiDataId(11), Description("NewThreadWaitTime"), format("x"), read] uint32 NewThreadWaitTime;
	[WmiDataId(12), Description("Reserved"), read] uint32 Reserved;
};

[dynamic: ToInstance, Description("System Configuration"), Guid("{01853a65-418f-4f36-aefc-dc0f1d2fd235}"), DisplayName("SystemConfig"), EventVersion(3), LOCALE("ms_409")]
class SystemConfig_V3 : MSNT_SystemTrace
{
};

[dynamic: ToInstance, Description("System Configuration"), EventType(32), EventTypeName("MobilePlatform"), LOCALE("ms_409")]
class SystemConfig_V3_MobilePlatform : SystemConfig_V3
{
	[WmiDataId(1), Description("DeviceManufacturer"), StringTermination("NullTerminated"), format("w"), read] string DeviceManufacturer;
	[WmiDataId(2), Description("DeviceManufacturerDisplayName"), StringTermination("NullTerminated"), format("w"), read] string DeviceManufacturerDisplayName;
	[WmiDataId(3), Description("DeviceModel"), StringTermination("NullTerminated"), format("w"), read] string DeviceModel;
	[WmiDataId(4), Description("DeviceModelDisplayName"), StringTermination("NullTerminated"), format("w"), read] string DeviceModelDisplayName;
	[WmiDataId(5), Description("MobileOperator"), StringTermination("NullTerminated"), format("w"), read] string MobileOperator;
	[WmiDataId(6), Description("MobileOperatorDisplayName"), StringTermination("NullTerminated"), format("w"), read] string MobileOperatorDisplayName;
	[WmiDataId(7), Description("HardwareVersion"), StringTermination("NullTerminated"), format("w"), read] string HardwareVersion;
	[WmiDataId(8), Description("SocVersion"), StringTermination("NullTerminated"), format("w"), read] string SocVersion;
	[WmiDataId(9), Description("RadioHardwareVersion"), StringTermination("NullTerminated"), format("w"), read] string RadioHardwareVersion;
	[WmiDataId(10), Description("RadioSoftwareVersion"), StringTermination("NullTerminated"), format("w"), read] string RadioSoftwareVersion;
	[WmiDataId(11), Description("BspVersion"), StringTermination("NullTerminated"), format("w"), read] string BspVersion;
	[WmiDataId(12), Description("OemSoftwareVersion"), StringTermination("NullTerminated"), format("w"), read] string OemSoftwareVersion;
};

[dynamic: ToInstance, Description("System Configuration"), EventType(15), EventTypeName("Services"), LOCALE("ms_409")]
class SystemConfig_V3_Services : SystemConfig_V3
{
	[WmiDataId(1), Description("ProcessId"), format("x"), read] uint32 ProcessId;
	[WmiDataId(2), Description("ServiceState"), format("x"), read] uint32 ServiceState;
	[WmiDataId(3), Description("SubProcessTag"), format("x"), read] uint32 SubProcessTag;
	[WmiDataId(4), Description("ServiceName"), StringTermination("NullTerminated"), format("w"), read] string ServiceName;
	[WmiDataId(5), Description("DisplayName"), StringTermination("NullTerminated"), format("w"), read] string DisplayName;
	[WmiDataId(6), Description("ProcessName"), StringTermination("NullTerminated"), format("w"), read] string ProcessName;
	[WmiDataId(7), Description("LoadOrderGroup"), StringTermination("NullTerminated"), format("w"), read] string LoadOrderGroup;
	[WmiDataId(8), Description("SvchostGroup"), StringTermination("NullTerminated"), format("w"), read] string SvchostGroup;
};

[dynamic: ToInstance, Description("System Configuration"), EventType(21), EventTypeName("IRQ"), LOCALE("ms_409")]
class SystemConfig_V3_IRQ : SystemConfig_V3
{
	[WmiDataId(1), Description("IRQAffinity"), format("x"), read] uint64 IRQAffinity;
	[WmiDataId(2), Description("IRQGroup"), read] uint16 IRQGroup;
	[WmiDataId(3), Description("Reserved"), read] uint16 Reserved;
	[WmiDataId(4), Description("IRQNum"), read] uint32 IRQNum;
	[WmiDataId(5), Description("DeviceDescriptionLen"), read] uint32 DeviceDescriptionLen;
	[WmiDataId(6), Description("DeviceDescription"), StringTermination("NullTerminated"), format("w"), read] string DeviceDescription;
};

[dynamic: ToInstance, Description("System Configuration"), EventType(10), EventTypeName("CPU"), LOCALE("ms_409")]
class SystemConfig_V3_CPU : SystemConfig_V3
{
	[WmiDataId(1), Description("MHz"), read] uint32 MHz;
	[WmiDataId(2), Description("NumberOfProcessors"), read] uint32 NumberOfProcessors;
	[WmiDataId(3), Description("MemSize"), read] uint32 MemSize;
	[WmiDataId(4), Description("PageSize"), read] uint32 PageSize;
	[WmiDataId(5), Description("AllocationGranularity"), read] uint32 AllocationGranularity;
	[WmiDataId(6), Description("ComputerName"), format("s"), read, MAX(256)] char16 ComputerName;
	[WmiDataId(7), Description("DomainName"), format("s"), read, MAX(134)] char16 DomainName;
	[WmiDataId(8), Description("HyperThreadingFlag"), pointer, read] uint32 HyperThreadingFlag;
	[WmiDataId(9), Description("HighestUserAddress"), pointer, read] uint32 HighestUserAddress;
	[WmiDataId(10), Description("ProcessorArchitecture"), read] uint16 ProcessorArchitecture;
	[WmiDataId(11), Description("ProcessorLevel"), read] uint16 ProcessorLevel;
	[WmiDataId(12), Description("ProcessorRevision"), read] uint16 ProcessorRevision;
	[WmiDataId(13), Description("PAE Enabled"), read] uint8 PaeEnabled;
	[WmiDataId(14), Description("NX Enabled"), read] uint8 NxEnabled;
	[WmiDataId(15), Description("MemorySpeed"), read] uint32 MemorySpeed;
};

[dynamic: ToInstance, Description("System Configuration"), EventType(22), EventTypeName("PnP"), LOCALE("ms_409")]
class SystemConfig_V3_PnP : SystemConfig_V3
{
	[WmiDataId(1), Description("IDLength"), read] uint32 IDLength;
	[WmiDataId(2), Description("DescriptionLength"), read] uint32 DescriptionLength;
	[WmiDataId(3), Description("FriendlyNameLength"), read] uint32 FriendlyNameLength;
	[WmiDataId(4), Description("DeviceID"), StringTermination("NullTerminated"), format("w"), read] string DeviceID;
	[WmiDataId(5), Description("DeviceDescription"), StringTermination("NullTerminated"), format("w"), read] string DeviceDescription;
	[WmiDataId(6), Description("FriendlyName"), StringTermination("NullTerminated"), format("w"), read] string FriendlyName;
	[WmiDataId(7), Description("PdoName"), StringTermination("NullTerminated"), format("w"), read] string PdoName;
};

[dynamic: ToInstance, Description("File Name"), Guid("{90cbdc39-4a3e-11d1-84f4-0000f80464e3}"), DisplayName("FileIo"), EventVersion(0), LOCALE("ms_409")]
class FileIo_V0 : MSNT_SystemTrace
{
};

[dynamic: ToInstance, Description("File Name"), EventType(0), EventTypeName("Name"), LOCALE("ms_409")]
class FileIo_V0_Name : FileIo_V0
{
	[WmiDataId(1), Description("FileObject"), pointer, read] uint32 FileObject;
	[WmiDataId(2), Description("FileName"), StringTermination("NullTerminated"), format("w"), read] string FileName;
};

[dynamic: ToInstance, Description("Thread Create/Exit Event"), Guid("{3d6fa8d1-fe05-11d0-9dda-00c04fd7ba7c}"), DisplayName("Thread"), EventVersion(4), LOCALE("ms_409")]
class Thread_V4 : MSNT_SystemTrace
{
};

[dynamic: ToInstance, Description("Thread Create/Exit Event"), EventType{1, 2, 3, 4}, EventTypeName{"Start", "End", "DCStart", "DCEnd"}, LOCALE("ms_409")]
class Thread_TypeGroup1 : Thread_V4
{
	[WmiDataId(1), Description("ProcessId"), format("x"), read] uint32 ProcessId;
	[WmiDataId(2), Description("ThreadId"), format("x"), read] uint32 TThreadId;
	[WmiDataId(3), Description("StackBase"), pointer, read] uint32 StackBase;
	[WmiDataId(4), Description("StackLimit"), pointer, read] uint32 StackLimit;
	[WmiDataId(5), Description("UserStackBase"), pointer, read] uint32 UserStackBase;
	[WmiDataId(6), Description("UserStackLimit"), pointer, read] uint32 UserStackLimit;
	[WmiDataId(7), Description("Affinity"), pointer, read] uint32 Affinity;
	[WmiDataId(8), Description("Win32StartAddr"), pointer, read] uint32 Win32StartAddr;
	[WmiDataId(9), Description("TebBase"), pointer, read] uint32 TebBase;
	[WmiDataId(10), Description("SubProcessTag"), format("x"), read] uint32 SubProcessTag;
	[WmiDataId(11), Description("BasePriority"), read] uint8 BasePriority;
	[WmiDataId(12), Description("PagePriority"), read] uint8 PagePriority;
	[WmiDataId(13), Description("IoPriority"), read] uint8 IoPriority;
	[WmiDataId(14), Description("Flags"), read] uint8 ThreadFlags;
	[WmiDataId(15), Description("Name"), StringTermination("NullTerminated"), format("w"), read] string ThreadName;
};

[dynamic: ToInstance, Description("Context Switch Event"), EventType(36), EventTypeName("CSwitch"), LOCALE("ms_409")]
class CSwitch_V4 : Thread_V4
{
	[WmiDataId(1), Description("NewThreadId"), format("x"), read] uint32 NewThreadId;
	[WmiDataId(2), Description("OldThreadId"), format("x"), read] uint32 OldThreadId;
	[WmiDataId(3), Description("NewThreadPriority"), read] sint8 NewThreadPriority;
	[WmiDataId(4), Description("OldThreadPriority"), read] sint8 OldThreadPriority;
	[WmiDataId(5), Description("PreviousCState or OldThreadRank"), read] uint8 PreviousCState;
	[WmiDataId(6), Description("SpareByte"), read] sint8 SpareByte;
	[WmiDataId(7), Description("OldThreadWaitReason"), read] sint8 OldThreadWaitReason;
	[WmiDataId(8), Description("ThreadFlags"), read] sint8 ThreadFlags;
	[WmiDataId(9), Description("OldThreadState"), read] sint8 OldThreadState;
	[WmiDataId(10), Description("OldThreadWaitIdealProcessor"), read] sint8 OldThreadWaitIdealProcessor;
	[WmiDataId(11), Description("NewThreadWaitTime"), format("x"), read] uint32 NewThreadWaitTime;
	[WmiDataId(12), Description("Reserved"), read] uint32 Reserved;
};

[dynamic: ToInstance, Description("I/O Read/Write Event"), Guid("{3d6fa8d4-fe05-11d0-9dda-00c04fd7ba7c}"), DisplayName("DiskIo"), EventVersion(0), LOCALE("ms_409")]
class DiskIo_V0 : MSNT_SystemTrace
{
};

[dynamic: ToInstance, Description("I/O Read/Write Event"), EventType{10, 11}, EventTypeName{"Read", "Write"}, LOCALE("ms_409")]
class DiskIo_V0_TypeGroup1 : DiskIo_V0
{
	[WmiDataId(1), Description("DiskNumber"), read] uint32 DiskNumber;
	[WmiDataId(2), Description("IrpFlags"), format("x"), read] uint32 IrpFlags;
	[WmiDataId(3), Description("TransferSize"), read] uint32 TransferSize;
	[WmiDataId(4), Description("ResponseTime"), read] uint32 Reserved;
	[WmiDataId(5), Description("ByteOffset"), read] uint64 ByteOffset;
	[WmiDataId(6), Description("FileObject"), pointer, read] uint32 FileObject;
};

[dynamic: ToInstance, Description("System Configuration"), Guid("{01853a65-418f-4f36-aefc-dc0f1d2fd235}"), DisplayName("SystemConfig"), EventVersion(5), LOCALE("ms_409")]
class SystemConfig : MSNT_SystemTrace
{
};

[dynamic: ToInstance, Description("System Configuration"), EventType(22), EventTypeName("PnP"), LOCALE("ms_409")]
class SystemConfig_PnP : SystemConfig
{
	[WmiDataId(1), Description("ClassGuid"), extension("GUID"), read] object ClassGuid;
	[WmiDataId(2), Description("Upper Filters Count"), read] uint32 UpperFiltersCount;
	[WmiDataId(3), Description("Lower Filter Count"), read] uint32 LowerFiltersCount;
	[WmiDataId(4), Description("Device Status"), read] uint32 DevStatus;
	[WmiDataId(5), Description("Device Problem Code"), read] uint32 DevProblem;
	[WmiDataId(6), Description("DeviceID"), StringTermination("NullTerminated"), format("w"), read] string DeviceID;
	[WmiDataId(7), Description("DeviceDescription"), StringTermination("NullTerminated"), format("w"), read] string DeviceDescription;
	[WmiDataId(8), Description("FriendlyName"), StringTermination("NullTerminated"), format("w"), read] string FriendlyName;
	[WmiDataId(9), Description("PdoName"), StringTermination("NullTerminated"), format("w"), read] string PdoName;
	[WmiDataId(10), Description("ServiceName"), StringTermination("NullTerminated"), format("w"), read] string ServiceName;
	[WmiDataId(11), Description("Upper Filters"), StringTermination("NullTerminated"), format("w"), WmiSizeIs("UpperFiltersCount"), read] string UpperFilters;
	[WmiDataId(12), Description("Lower Filters"), StringTermination("NullTerminated"), format("w"), WmiSizeIs("LowerFiltersCount"), read] string LowerFilters;
};

[dynamic: ToInstance, Description("Process Create/Exit Event"), Guid("{3d6fa8d0-fe05-11d0-9dda-00c04fd7ba7c}"), DisplayName("Process"), EventVersion(5), LOCALE("ms_409")]
class Process : MSNT_SystemTrace
{
};

[dynamic: ToInstance, Description("Process Zombie Event"), EventType{39}, EventTypeName{"Defunct"}, LOCALE("ms_409")]
class Process_Defunct_TypeGroup1 : Process
{
	[WmiDataId(1), Description("UniqueProcessKey"), pointer, read] uint32 UniqueProcessKey;
	[WmiDataId(2), Description("ProcessId"), format("x"), read] uint32 ProcessId;
	[WmiDataId(3), Description("ParentId"), format("x"), read] uint32 ParentId;
	[WmiDataId(4), Description("SessionId"), read] uint32 SessionId;
	[WmiDataId(5), Description("ExitStatus"), read] sint32 ExitStatus;
	[WmiDataId(6), Description("DirectoryTableBase"), pointer, read] uint32 DirectoryTableBase;
	[WmiDataId(8), Description("UserSID"), extension("Sid"), read] object UserSID;
	[WmiDataId(9), Description("ImageFileName"), StringTermination("NullTerminated"), read] string ImageFileName;
	[WmiDataId(10), Description("CommandLine"), StringTermination("NullTerminated"), format("w"), read] string CommandLine;
	[WmiDataId(11), Description("PackageFullName"), StringTermination("NullTerminated"), format("w"), read] string PackageFullName;
	[WmiDataId(12), Description("ApplicationId"), StringTermination("NullTerminated"), format("w"), read] string ApplicationId;
	[WmiDataId(13), Description("ExitTime"), read] uint64 ExitTime;
};

[dynamic: ToInstance, Description("Pool Event"), Guid("{0268a8b6-74fd-4302-9dd0-6e8f1795c0cf}"), DisplayName("Pool"), EventVersion(2), LOCALE("ms_409")]
class PoolTrace : MSNT_SystemTrace
{
};

[dynamic: ToInstance, Description("Pool Allocation/Free Event"), EventType{32, 34}, EventTypeName{"PoolAllocation", "PoolFree"}, LOCALE("ms_409")]
class PoolAllocFree : PoolTrace
{
	[WmiDataId(1), Description("PoolType"), read] uint32 Type;
	[WmiDataId(2), Description("PoolTag"), format("x"), read] uint32 Tag;
	[WmiDataId(3), Description("NumberOfBytes"), extension("SizeT"), read] object NumberOfBytes;
	[WmiDataId(4), Description("Entry"), pointer, read] uint32 Entry;
};

[dynamic: ToInstance, Description("Session Pool Allocation/Free Event"), EventType{33, 35}, EventTypeName{"SessionPoolAllocation", "SessionPoolFree"}, LOCALE("ms_409")]
class SessionPoolAllocFree : PoolTrace
{
	[WmiDataId(1), Description("PoolType"), read] uint32 Type;
	[WmiDataId(2), Description("PoolTag"), format("x"), read] uint32 Tag;
	[WmiDataId(3), Description("NumberOfBytes"), extension("SizeT"), read] object NumberOfBytes;
	[WmiDataId(4), Description("Entry"), pointer, read] uint32 Entry;
	[WmiDataId(5), Description("SessionId"), read] uint32 SessionId;
};

[dynamic: ToInstance,
 Description("Pool Snapshot Event"),
 EventType{40, 41, 42, 43, 44, 45, 46, 47},
 EventTypeName{"PoolSnapDCStart", "PoolSnapDCEnd", "BigPoolSnapDCStart", "BigPoolSnapDCEnd", "SessionPoolSnapDCStart", "SessionPoolSnapDCEnd", "SessionBigPoolSnapDCStart", "SessionBigPoolSnapDCEnd"},
 LOCALE("ms_409")
]
class PoolSnapshot : PoolTrace
{
};

[dynamic: ToInstance, Description("I/O Read/Write Event"), Guid("{3d6fa8d4-fe05-11d0-9dda-00c04fd7ba7c}"), DisplayName("DiskIo"), EventVersion(3), LOCALE("ms_409")]
class DiskIo : MSNT_SystemTrace
{
};

[dynamic: ToInstance,
 Description("I/O Read/Write/Flush Start Event"),
 EventType{12, 13, 15, 58, 59, 60},
 EventTypeName{"ReadInit", "WriteInit", "FlushInit", "OpticalReadInit", "OpticalWriteInit", "OpticalFlushInit"},
 LOCALE("ms_409")
]
class DiskIo_TypeGroup2 : DiskIo
{
	[WmiDataId(1), Description("IORequestPacket"), pointer, read] uint32 Irp;
	[WmiDataId(2), Description("IssuingThreadId"), read] uint32 IssuingThreadId;
};

[dynamic: ToInstance, Description("I/O Read/Write Event"), EventType{10, 11, 55, 56}, EventTypeName{"Read", "Write", "OpticalRead", "OpticalWrite"}, LOCALE("ms_409")]
class DiskIo_TypeGroup1 : DiskIo
{
	[WmiDataId(1), Description("DiskNumber"), read] uint32 DiskNumber;
	[WmiDataId(2), Description("IrpFlags"), format("x"), read] uint32 IrpFlags;
	[WmiDataId(3), Description("TransferSize"), read] uint32 TransferSize;
	[WmiDataId(4), Description("Reserved"), read] uint32 Reserved;
	[WmiDataId(5), Description("ByteOffset"), read] uint64 ByteOffset;
	[WmiDataId(6), Description("FileObject"), pointer, read] uint32 FileObject;
	[WmiDataId(7), Description("IORequestPacket"), pointer, read] uint32 Irp;
	[WmiDataId(8), Description("HighResResponseTime"), read] uint64 HighResResponseTime;
	[WmiDataId(9), Description("IssuingThreadId"), read] uint32 IssuingThreadId;
};

[dynamic: ToInstance, Description("I/O Flush Buffers Event"), EventType{14, 57}, EventTypeName{"FlushBuffers", "OpticalFlushBuffers"}, LOCALE("ms_409")]
class DiskIo_TypeGroup3 : DiskIo
{
	[WmiDataId(1), Description("DiskNumber"), read] uint32 DiskNumber;
	[WmiDataId(2), Description("IrpFlags"), format("x"), read] uint32 IrpFlags;
	[WmiDataId(3), Description("HighResResponseTime"), read] uint64 HighResResponseTime;
	[WmiDataId(4), Description("IORequestPacket"), pointer, read] uint32 Irp;
	[WmiDataId(5), Description("IssuingThreadId"), read] uint32 IssuingThreadId;
};

[dynamic: ToInstance, Description("Lost Event Event"), Guid("{6a399ae0-4bc6-4de9-870b-3657f8947e7e}"), DisplayName("LostEvent"), EventVersion(0), LOCALE("ms_409")]
class Lost_Event : MSNT_SystemTrace
{
};

[dynamic: ToInstance, Description("RT Lost Event"), EventType{32, 33, 34}, EventTypeName{"RTLostEvent", "RTLostBuffer", "RTLostFile"}, LOCALE("ms_409")]
class RT_LostEvent : Lost_Event
{
};

[dynamic: ToInstance, Description("File Name"), Guid("{90cbdc39-4a3e-11d1-84f4-0000f80464e3}"), DisplayName("FileIo"), EventVersion(1), LOCALE("ms_409")]
class FileIo_V1 : MSNT_SystemTrace
{
};

[dynamic: ToInstance, Description("File Name"), EventType{0, 32}, EventTypeName{"Name", "FileCreate"}, LOCALE("ms_409")]
class FileIo_V1_Name : FileIo_V1
{
	[WmiDataId(1), Description("FileObject"), pointer, read] uint32 FileObject;
	[WmiDataId(2), Description("FileName"), StringTermination("NullTerminated"), format("w"), read] string FileName;
};

[dynamic: ToInstance, Description("Event Trace Event"), Guid("{68fdd900-4a3e-11d1-84f4-0000f80464e3}"), DisplayName("EventTrace"), EventVersion(1), LOCALE("ms_409")]
class EventTraceEvent_V1 : MSNT_SystemTrace
{
};

[dynamic: ToInstance, Description("Event Trace Event"), EventType(0), EventTypeName("Header"), LOCALE("ms_409")]
class EventTrace_V1_Header : EventTraceEvent_V1
{
	[WmiDataId(1), Description("Buffer Size in Bytes"), read] uint32 BufferSize;
	[WmiDataId(2), Description("Event Trace Version"), read] uint32 Version;
	[WmiDataId(3), Description("Windows Build Number"), read] uint32 ProviderVersion;
	[WmiDataId(4), Description("Number Of Processors"), read] uint32 NumberOfProcessors;
	[WmiDataId(5), Description("Collection End Time"), read] uint64 EndTime;
	[WmiDataId(6), Description("Timer Resolution"), read] uint32 TimerResolution;
	[WmiDataId(7), Description("Maximum File Size in MBytes"), read] uint32 MaxFileSize;
	[WmiDataId(8), Description("LogFileMode"), format("x"), read] uint32 LogFileMode;
	[WmiDataId(9), Description("Number of Buffers Written"), read] uint32 BuffersWritten;
	[WmiDataId(10), Description("Buffer Number with earliest TimeStamp for a Circular LogFile"), read] uint32 StartBuffers;
	[WmiDataId(11), Description("Pointer Size in Bytes"), read] uint32 PointerSize;
	[WmiDataId(12), Description("Number of Events Lost during collection"), read] uint32 EventsLost;
	[WmiDataId(13), Description("CPU Speed in MHz"), read] uint32 CPUSpeed;
	[WmiDataId(14), Description("Logger Name"), pointer, read] uint32 LoggerName;
	[WmiDataId(15), Description("LogFile Name"), pointer, read] uint32 LogFileName;
	[WmiDataId(16), Description("TimeZoneInformation"), extension("NoPrint"), read, MAX(176)] uint8 TimeZoneInformation;
	[WmiDataId(17), Description("BootTime"), read] uint64 BootTime;
	[WmiDataId(18), Description("Performance counter frequency in counts per second"), read] uint64 PerfFreq;
	[WmiDataId(19), Description("StartTime"), read] uint64 StartTime;
	[WmiDataId(20), Description("ReservedFlags"), format("x"), read] uint32 ReservedFlags;
	[WmiDataId(21), Description("Number of Buffers Lost during collection"), read] uint32 BuffersLost;
	[WmiDataId(22), Description("SessionNameString"), StringTermination("NullTerminated"), format("w"), read] string SessionNameString;
	[WmiDataId(23), Description("LogFileNameString"), StringTermination("NullTerminated"), format("w"), read] string LogFileNameString;
};

[dynamic: ToInstance, Description("Event Trace Rundown Complete"), EventType(8), EventTypeName("RDComplete"), LOCALE("ms_409")]
class RDComplete_V1 : EventTraceEvent_V1
{
};

[dynamic: ToInstance, Description("Event Trace Header Extension"), EventType{5, 32}, EventTypeName{"Extension", "EndExtension"}, LOCALE("ms_409")]
class Header_Extension_V1_TypeGroup : EventTraceEvent_V1
{
	[WmiDataId(1), Description("GroupMask1"), format("x"), read] uint32 GroupMask1;
	[WmiDataId(2), Description("GroupMask2"), format("x"), read] uint32 GroupMask2;
	[WmiDataId(3), Description("GroupMask3"), format("x"), read] uint32 GroupMask3;
	[WmiDataId(4), Description("GroupMask4"), format("x"), read] uint32 GroupMask4;
	[WmiDataId(5), Description("GroupMask5"), format("x"), read] uint32 GroupMask5;
	[WmiDataId(6), Description("GroupMask6"), format("x"), read] uint32 GroupMask6;
	[WmiDataId(7), Description("GroupMask7"), format("x"), read] uint32 GroupMask7;
	[WmiDataId(8), Description("GroupMask8"), format("x"), read] uint32 GroupMask8;
};

[dynamic: ToInstance, Description("Debugger Event"), Guid("{13976d09-a327-438c-950b-7f03192815c7}"), DisplayName("Debugger"), EventVersion(2), LOCALE("ms_409")]
class Debugger : MSNT_SystemTrace
{
};

[dynamic: ToInstance, Description("DebugPrint Event"), EventType(32), EventTypeName("DebugPrint"), LOCALE("ms_409")]
class DebugPrint_Event : Debugger
{
	[WmiDataId(1), Description("Component"), read] uint32 Component;
	[WmiDataId(2), Description("Level"), read] uint32 Level;
	[WmiDataId(3), Description("Message"), StringTermination("NullTerminated"), read] string Message;
};

[dynamic: ToInstance, Description("I/O Read/Write Event"), Guid("{3d6fa8d4-fe05-11d0-9dda-00c04fd7ba7c}"), DisplayName("DiskIo"), EventVersion(2), LOCALE("ms_409")]
class DiskIo_V2 : MSNT_SystemTrace
{
};

[dynamic: ToInstance, Description("I/O Read/Write Event"), EventType{10, 11}, EventTypeName{"Read", "Write"}, LOCALE("ms_409")]
class DiskIo_V2_TypeGroup1 : DiskIo_V2
{
	[WmiDataId(1), Description("DiskNumber"), read] uint32 DiskNumber;
	[WmiDataId(2), Description("IrpFlags"), format("x"), read] uint32 IrpFlags;
	[WmiDataId(3), Description("TransferSize"), read] uint32 TransferSize;
	[WmiDataId(4), Description("Reserved"), read] uint32 Reserved;
	[WmiDataId(5), Description("ByteOffset"), read] uint64 ByteOffset;
	[WmiDataId(6), Description("FileObject"), pointer, read] uint32 FileObject;
	[WmiDataId(7), Description("IORequestPacket"), pointer, read] uint32 Irp;
	[WmiDataId(8), Description("HighResResponseTime"), read] uint64 HighResResponseTime;
};

[dynamic: ToInstance, Description("Driver Major Function Return"), EventType(35), EventTypeName("DrvMjFnRet"), LOCALE("ms_409")]
class DriverMajorFunctionReturn : DiskIo_V2
{
	[WmiDataId(1), Description("Irp"), pointer, read] uint32 Irp;
	[WmiDataId(2), Description("UniqMatchId"), read] uint32 UniqMatchId;
};

[dynamic: ToInstance, Description("Driver Completion Routine"), EventType(37), EventTypeName("DrvComplRout"), LOCALE("ms_409")]
class DriverCompletionRoutine : DiskIo_V2
{
	[WmiDataId(1), Description("Routine"), pointer, read] uint32 Routine;
	[WmiDataId(2), Description("IrpPtr"), pointer, read] uint32 IrpPtr;
	[WmiDataId(3), Description("UniqMatchId"), read] uint32 UniqMatchId;
};

[dynamic: ToInstance, Description("Driver Major Function Call"), EventType(34), EventTypeName("DrvMjFnCall"), LOCALE("ms_409")]
class DriverMajorFunctionCall : DiskIo_V2
{
	[WmiDataId(1), Description("MajorFunction"), read] uint32 MajorFunction;
	[WmiDataId(2), Description("MinorFunction"), read] uint32 MinorFunction;
	[WmiDataId(3), Description("RoutineAddr"), pointer, read] uint32 RoutineAddr;
	[WmiDataId(4), Description("FileObject"), pointer, read] uint32 FileObject;
	[WmiDataId(5), Description("Irp"), pointer, read] uint32 Irp;
	[WmiDataId(6), Description("UniqMatchId"), read] uint32 UniqMatchId;
};

[dynamic: ToInstance, Description("Driver Delay Complete Request Return"), EventType(53), EventTypeName("DrvComplReqRet"), LOCALE("ms_409")]
class DriverCompleteRequestReturn : DiskIo_V2
{
	[WmiDataId(1), Description("Irp"), pointer, read] uint32 Irp;
	[WmiDataId(2), Description("UniqMatchId"), read] uint32 UniqMatchId;
};

[dynamic: ToInstance, Description("I/O Flush Buffers Event"), EventType(14), EventTypeName("FlushBuffers"), LOCALE("ms_409")]
class DiskIo_V2_TypeGroup3 : DiskIo_V2
{
	[WmiDataId(1), Description("DiskNumber"), read] uint32 DiskNumber;
	[WmiDataId(2), Description("IrpFlags"), format("x"), read] uint32 IrpFlags;
	[WmiDataId(3), Description("HighResResponseTime"), read] uint64 HighResResponseTime;
	[WmiDataId(4), Description("IORequestPacket"), pointer, read] uint32 Irp;
};

[dynamic: ToInstance, Description("I/O Read/Write/Flush Start Event"), EventType{12, 13, 15}, EventTypeName{"ReadInit", "WriteInit", "FlushInit"}, LOCALE("ms_409")]
class DiskIo_V2_TypeGroup2 : DiskIo_V2
{
	[WmiDataId(1), Description("IORequestPacket"), pointer, read] uint32 Irp;
};

[dynamic: ToInstance, Description("Driver Complete Request"), EventType(52), EventTypeName("DrvComplReq"), LOCALE("ms_409")]
class DriverCompleteRequest : DiskIo_V2
{
	[WmiDataId(1), Description("RoutineAddr"), pointer, read] uint32 RoutineAddr;
	[WmiDataId(2), Description("Irp"), pointer, read] uint32 Irp;
	[WmiDataId(3), Description("UniqMatchId"), read] uint32 UniqMatchId;
};

[dynamic: ToInstance, Description("System Configuration"), Guid("{01853a65-418f-4f36-aefc-dc0f1d2fd235}"), DisplayName("SystemConfig"), EventVersion(0), LOCALE("ms_409")]
class SystemConfig_V0 : MSNT_SystemTrace
{
};

[dynamic: ToInstance, Description("System Configuration"), EventType(21), EventTypeName("IRQ"), LOCALE("ms_409")]
class SystemConfig_V0_IRQ : SystemConfig_V0
{
	[WmiDataId(1), Description("IRQAffinity"), format("x"), read] uint64 IRQAffinity;
	[WmiDataId(2), Description("IRQNum"), read] uint32 IRQNum;
	[WmiDataId(3), Description("DeviceDescriptionLen"), read] uint32 DeviceDescriptionLen;
	[WmiDataId(4), Description("DeviceDescription"), StringTermination("NullTerminated"), format("w"), read] string DeviceDescription;
};

[dynamic: ToInstance, Description("System Configuration"), EventType(10), EventTypeName("CPU"), LOCALE("ms_409")]
class SystemConfig_V0_CPU : SystemConfig_V0
{
	[WmiDataId(1), Description("MHz"), read] uint32 MHz;
	[WmiDataId(2), Description("NumberOfProcessors"), read] uint32 NumberOfProcessors;
	[WmiDataId(3), Description("MemSize"), read] uint32 MemSize;
	[WmiDataId(4), Description("PageSize"), read] uint32 PageSize;
	[WmiDataId(5), Description("AllocationGranularity"), read] uint32 AllocationGranularity;
	[WmiDataId(6), Description("ComputerName"), read, MAX(256)] char16 ComputerName;
	[WmiDataId(7), Description("DomainName"), read, MAX(132)] char16 DomainName;
	[WmiDataId(8), Description("HyperThreadingFlag"), pointer, read] uint32 HyperThreadingFlag;
};

[dynamic: ToInstance, Description("System Configuration"), EventType(15), EventTypeName("Services"), LOCALE("ms_409")]
class SystemConfig_V0_Services : SystemConfig_V0
{
	[WmiDataId(1), Description("ServiceName"), read, MAX(34)] char16 ServiceName;
	[WmiDataId(2), Description("DisplayName"), read, MAX(256)] char16 DisplayName;
	[WmiDataId(3), Description("ProcessName"), read, MAX(34)] char16 ProcessName;
	[WmiDataId(4), Description("ProcessId"), read] uint32 ProcessId;
};

[dynamic: ToInstance, Description("System Configuration"), EventType(12), EventTypeName("LogDisk"), LOCALE("ms_409")]
class SystemConfig_V0_LogDisk : SystemConfig_V0
{
	[WmiDataId(1), Description("StartOffset"), read] uint64 StartOffset;
	[WmiDataId(2), Description("PartitionSize"), read] uint64 PartitionSize;
	[WmiDataId(3), Description("DiskNumber"), read] uint32 DiskNumber;
	[WmiDataId(4), Description("Size"), read] uint32 Size;
	[WmiDataId(5), Description("DriveType"), read] uint32 DriveType;
	[WmiDataId(6), Description("DriveLetter"), read, MAX(4)] char16 DriveLetterString;
	[WmiDataId(7), Description("Pad1"), read] uint32 Pad1;
	[WmiDataId(8), Description("PartitionNumber"), read] uint32 PartitionNumber;
	[WmiDataId(9), Description("SectorsPerCluster"), read] uint32 SectorsPerCluster;
	[WmiDataId(10), Description("BytesPerSector"), read] uint32 BytesPerSector;
	[WmiDataId(11), Description("Pad2"), read] uint32 Pad2;
	[WmiDataId(12), Description("NumberOfFreeClusters"), read] sint64 NumberOfFreeClusters;
	[WmiDataId(13), Description("TotalNumberOfClusters"), read] sint64 TotalNumberOfClusters;
	[WmiDataId(14), Description("FileSystem"), read, MAX(16)] char16 FileSystem;
	[WmiDataId(15), Description("VolumeExtent"), read] uint32 VolumeExt;
};

[dynamic: ToInstance, Description("System Configuration"), EventType(14), EventTypeName("Video"), LOCALE("ms_409")]
class SystemConfig_V0_Video : SystemConfig_V0
{
	[WmiDataId(1), Description("MemorySize"), read] uint32 MemorySize;
	[WmiDataId(2), Description("XResolution"), read] uint32 XResolution;
	[WmiDataId(3), Description("YResolution"), read] uint32 YResolution;
	[WmiDataId(4), Description("BitsPerPixel"), read] uint32 BitsPerPixel;
	[WmiDataId(5), Description("VRefresh"), read] uint32 VRefresh;
	[WmiDataId(6), Description("ChipType"), read, MAX(256)] char16 ChipType;
	[WmiDataId(7), Description("DACType"), read, MAX(256)] char16 DACType;
	[WmiDataId(8), Description("AdapterString"), read, MAX(256)] char16 AdapterString;
	[WmiDataId(9), Description("BiosString"), read, MAX(256)] char16 BiosString;
	[WmiDataId(10), Description("Device Name"), read, MAX(256)] char16 DeviceId;
	[WmiDataId(11), Description("StateFlags"), format("x"), read] uint32 StateFlags;
};

[dynamic: ToInstance, Description("System Configuration"), EventType(11), EventTypeName("PhyDisk"), LOCALE("ms_409")]
class SystemConfig_V0_PhyDisk : SystemConfig_V0
{
	[WmiDataId(1), Description("DiskNumber"), read] uint32 DiskNumber;
	[WmiDataId(2), Description("BytesPerSector"), read] uint32 BytesPerSector;
	[WmiDataId(3), Description("SectorsPerTrack"), read] uint32 SectorsPerTrack;
	[WmiDataId(4), Description("TracksPerCylinder"), read] uint32 TracksPerCylinder;
	[WmiDataId(5), Description("Cylinders"), read] uint64 Cylinders;
	[WmiDataId(6), Description("SCSIPort"), read] uint32 SCSIPort;
	[WmiDataId(7), Description("SCSIPath"), read] uint32 SCSIPath;
	[WmiDataId(8), Description("SCSITarget"), read] uint32 SCSITarget;
	[WmiDataId(9), Description("SCSILun"), read] uint32 SCSILun;
	[WmiDataId(10), Description("Manufacturer"), read, MAX(256)] char16 Manufacturer;
	[WmiDataId(11), Description("PartitionCount"), read] uint32 PartitionCount;
	[WmiDataId(12), Description("WriteCacheEnabled"), read] uint8 WriteCacheEnabled;
	[WmiDataId(13), Description("Pad: not used"), read] uint8 Pad;
	[WmiDataId(14), Description("BootDriveLetter"), read, MAX(3)] char16 BootDriveLetter;
	[WmiDataId(15), Description("Spare"), read, MAX(2)] char16 Spare;
};

[dynamic: ToInstance, Description("System Configuration"), EventType(16), EventTypeName("Power"), LOCALE("ms_409")]
class SystemConfig_V0_Power : SystemConfig_V0
{
	[WmiDataId(1), Description("S1"), read] uint8 S1;
	[WmiDataId(2), Description("S2"), read] uint8 S2;
	[WmiDataId(3), Description("S3"), read] uint8 S3;
	[WmiDataId(4), Description("S4"), read] uint8 S4;
	[WmiDataId(5), Description("S5"), read] uint8 S5;
	[WmiDataId(6), Description("Reserved; do not use."), read] uint8 Pad1;
	[WmiDataId(7), Description("Reserved; do not use."), read] uint8 Pad2;
	[WmiDataId(8), Description("Reserved; do not use."), read] uint8 Pad3;
};

[dynamic: ToInstance, Description("System Configuration"), EventType(22), EventTypeName("PnP"), LOCALE("ms_409")]
class SystemConfig_V0_PnP : SystemConfig_V0
{
	[WmiDataId(1), Description("IDLength"), read] uint32 IDLength;
	[WmiDataId(2), Description("DescriptionLength"), read] uint32 DescriptionLength;
	[WmiDataId(3), Description("FriendlyNameLength"), read] uint32 FriendlyNameLength;
	[WmiDataId(4), Description("DeviceID"), StringTermination("NullTerminated"), format("w"), read] string DeviceID;
	[WmiDataId(5), Description("DeviceDescription"), StringTermination("NullTerminated"), format("w"), read] string DeviceDescription;
	[WmiDataId(6), Description("FriendlyName"), StringTermination("NullTerminated"), format("w"), read] string FriendlyName;
};

[dynamic: ToInstance, Description("System Configuration"), EventType(13), EventTypeName("NIC"), LOCALE("ms_409")]
class SystemConfig_V0_NIC : SystemConfig_V0
{
	[WmiDataId(1), Description("NICName"), read, MAX(256)] char16 NICName;
	[WmiDataId(2), Description("Index"), read] uint32 Index;
	[WmiDataId(3), Description("PhysicalAddressLen"), read] uint32 PhysicalAddrLen;
	[WmiDataId(4), Description("PhysicalAddress"), read, MAX(8)] char16 PhysicalAddr;
	[WmiDataId(5), Description("Size"), read] uint32 Size;
	[WmiDataId(6), Description("IpAddress"), read] sint32 IpAddress;
	[WmiDataId(7), Description("SubnetMask"), read] sint32 SubnetMask;
	[WmiDataId(8), Description("DhcpServer"), read] sint32 DhcpServer;
	[WmiDataId(9), Description("Gateway"), read] sint32 Gateway;
	[WmiDataId(10), Description("PrimaryWinsServer"), read] sint32 PrimaryWinsServer;
	[WmiDataId(11), Description("SecondaryWinsServer"), read] sint32 SecondaryWinsServer;
	[WmiDataId(12), Description("DnsServer1"), read] sint32 DnsServer1;
	[WmiDataId(13), Description("DnsServer2"), read] sint32 DnsServer2;
	[WmiDataId(14), Description("DnsServer3"), read] sint32 DnsServer3;
	[WmiDataId(15), Description("DnsServer4"), read] sint32 DnsServer4;
	[WmiDataId(16), Description("Reserved; do not use."), read] uint32 Data;
};

[dynamic: ToInstance, Description("System Configuration"), Guid("{01853a65-418f-4f36-aefc-dc0f1d2fd235}"), DisplayName("SystemConfig"), EventVersion(2), LOCALE("ms_409")]
class SystemConfig_V2 : MSNT_SystemTrace
{
};

[dynamic: ToInstance, Description("System Configuration"), EventType(24), EventTypeName("NumaNode"), LOCALE("ms_409")]
class SystemConfig_V2_NumaNode : SystemConfig_V2
{
	[WmiDataId(1), Description("NodeCount"), read] uint32 NodeCount;
	[WmiDataId(2), Description("NodeMap"), WmiSizeIs("NodeCount"), read] uint64 NodeMap;
};

[dynamic: ToInstance, Description("System Configuration"), EventType(22), EventTypeName("PnP"), LOCALE("ms_409")]
class SystemConfig_V2_PnP : SystemConfig_V2
{
	[WmiDataId(1), Description("IDLength"), read] uint32 IDLength;
	[WmiDataId(2), Description("DescriptionLength"), read] uint32 DescriptionLength;
	[WmiDataId(3), Description("FriendlyNameLength"), read] uint32 FriendlyNameLength;
	[WmiDataId(4), Description("DeviceID"), StringTermination("NullTerminated"), format("w"), read] string DeviceID;
	[WmiDataId(5), Description("DeviceDescription"), StringTermination("NullTerminated"), format("w"), read] string DeviceDescription;
	[WmiDataId(6), Description("FriendlyName"), StringTermination("NullTerminated"), format("w"), read] string FriendlyName;
};

[dynamic: ToInstance, Description("System Configuration"), EventType(29), EventTypeName("CodeIntegrity"), LOCALE("ms_409")]
class SystemConfig_V2_CodeIntegrity : SystemConfig_V2
{
	[WmiDataId(1), Description("CodeIntegrityInfo"), read] uint32 CodeIntegrityInfo;
};

[dynamic: ToInstance, Description("System Configuration"), EventType(12), EventTypeName("LogDisk"), LOCALE("ms_409")]
class SystemConfig_V2_LogDisk : SystemConfig_V2
{
	[WmiDataId(1), Description("StartOffset"), read] uint64 StartOffset;
	[WmiDataId(2), Description("PartitionSize"), read] uint64 PartitionSize;
	[WmiDataId(3), Description("DiskNumber"), read] uint32 DiskNumber;
	[WmiDataId(4), Description("Size"), read] uint32 Size;
	[WmiDataId(5), Description("DriveType"), read] uint32 DriveType;
	[WmiDataId(6), Description("DriveLetter"), format("s"), read, MAX(4)] char16 DriveLetterString;
	[WmiDataId(7), Description("Pad1"), read] uint32 Pad1;
	[WmiDataId(8), Description("PartitionNumber"), read] uint32 PartitionNumber;
	[WmiDataId(9), Description("SectorsPerCluster"), read] uint32 SectorsPerCluster;
	[WmiDataId(10), Description("BytesPerSector"), read] uint32 BytesPerSector;
	[WmiDataId(11), Description("Pad2"), read] uint32 Pad2;
	[WmiDataId(12), Description("NumberOfFreeClusters"), read] sint64 NumberOfFreeClusters;
	[WmiDataId(13), Description("TotalNumberOfClusters"), read] sint64 TotalNumberOfClusters;
	[WmiDataId(14), Description("FileSystem"), format("s"), read, MAX(16)] char16 FileSystem;
	[WmiDataId(15), Description("VolumeExtent"), read] uint32 VolumeExt;
	[WmiDataId(16), Description("Pad3"), read] uint32 Pad3;
};

[dynamic: ToInstance, Description("System Configuration"), EventType(36), EventTypeName("Virtualization Config Info"), LOCALE("ms_409")]
class SystemConfig_Virtualization : SystemConfig_V2
{
	[WmiDataId(1), Description("VBS enabled"), read] uint8 VbsEnabled;
	[WmiDataId(2), Description("HVCI enabled"), read] uint8 HvciEnabled;
	[WmiDataId(3), Description("Hyper V Enabled"), read] uint8 HyperVisorEnabled;
	[WmiDataId(4), Description("Reserved"), read] uint8 Reserved;
};

[dynamic: ToInstance, Description("System Configuration"), EventType(23), EventTypeName("IDEChannel"), LOCALE("ms_409")]
class SystemConfig_V2_IDEChannel : SystemConfig_V2
{
	[WmiDataId(1), Description("TargetId"), read] uint32 TargetId;
	[WmiDataId(2), Description("DeviceType"), format("x"), read] uint32 DeviceType;
	[WmiDataId(3), Description("DeviceTimingMode"), format("x"), read] uint32 DeviceTimingMode;
	[WmiDataId(4), Description("LocationInformationLen"), read] uint32 LocationInformationLen;
	[WmiDataId(5), Description("LocationInformation"), StringTermination("NullTerminated"), format("w"), read] string LocationInformation;
};

[dynamic: ToInstance, Description("Boot Configuration"), EventType(37), EventTypeName("Boot Config Info"), LOCALE("ms_409")]
class SystemConfig_Boot : SystemConfig_V2
{
	[WmiDataId(1), Description("Boot Flags"), read] uint64 BootFlags;
	[WmiDataId(2), Description("Firmware Type"), read] uint32 FirmwareType;
	[WmiDataId(3), Description("Secure Boot enabled"), read] uint8 SecureBootEnabled;
	[WmiDataId(4), Description("Secure Boot Capable"), read] uint8 SecureBootCapable;
	[WmiDataId(5), Description("Reserved"), read] uint8 Reserved1;
	[WmiDataId(6), Description("Reserved"), read] uint8 Reserved2;
};

[dynamic: ToInstance, Description("System Configuration"), EventType(28), EventTypeName("DPI"), LOCALE("ms_409")]
class SystemConfig_V2_DPI : SystemConfig_V2
{
	[WmiDataId(1), Description("MachineDPI"), read] uint32 MachineDPI;
	[WmiDataId(2), Description("UserDPI"), read] uint32 UserDPI;
};

[dynamic: ToInstance, Description("System Configuration"), EventType(13), EventTypeName("NIC"), LOCALE("ms_409")]
class SystemConfig_V2_NIC : SystemConfig_V2
{
	[WmiDataId(1), Description("PhysicalAddress"), format("x"), read] uint64 PhysicalAddr;
	[WmiDataId(2), Description("PhysicalAddressLen"), read] uint32 PhysicalAddrLen;
	[WmiDataId(3), Description("Ipv4Index"), read] uint32 Ipv4Index;
	[WmiDataId(4), Description("Ipv6Index"), read] uint32 Ipv6Index;
	[WmiDataId(5), Description("NIC Description"), StringTermination("NullTerminated"), format("w"), read] string NICDescription;
	[WmiDataId(6), Description("IpAddresses"), StringTermination("NullTerminated"), format("w"), read] string IpAddresses;
	[WmiDataId(7), Description("DnsServerAddresses"), StringTermination("NullTerminated"), format("w"), read] string DnsServerAddresses;
};

[dynamic: ToInstance, Description("System Configuration"), EventType(10), EventTypeName("CPU"), LOCALE("ms_409")]
class SystemConfig_V2_CPU : SystemConfig_V2
{
	[WmiDataId(1), Description("MHz"), read] uint32 MHz;
	[WmiDataId(2), Description("NumberOfProcessors"), read] uint32 NumberOfProcessors;
	[WmiDataId(3), Description("MemSize"), read] uint32 MemSize;
	[WmiDataId(4), Description("PageSize"), read] uint32 PageSize;
	[WmiDataId(5), Description("AllocationGranularity"), read] uint32 AllocationGranularity;
	[WmiDataId(6), Description("ComputerName"), format("s"), read, MAX(256)] char16 ComputerName;
	[WmiDataId(7), Description("DomainName"), format("s"), read, MAX(134)] char16 DomainName;
	[WmiDataId(8), Description("HyperThreadingFlag"), pointer, read] uint32 HyperThreadingFlag;
};

[dynamic: ToInstance, Description("System Configuration"), EventType(33), EventTypeName("DeviceFamily"), LOCALE("ms_409")]
class SystemConfig_V2_DeviceFamily : SystemConfig_V2
{
	[WmiDataId(1), Description("UAPInfo"), read] uint64 UAPInfo;
	[WmiDataId(2), Description("DeviceFamily"), read] uint32 DeviceFamily;
	[WmiDataId(3), Description("DeviceForm"), read] uint32 DeviceForm;
};

[dynamic: ToInstance, Description("System Configuration"), EventType(18), EventTypeName("OpticalDisk"), LOCALE("ms_409")]
class SystemConfig_V2_OpticalMedia : SystemConfig_V2
{
	[WmiDataId(1), Description("DiskNumber"), read] uint16 DiskNumber;
	[WmiDataId(2), Description("BusType"), read] uint16 BusType;
	[WmiDataId(3), Description("DeviceType"), read] uint16 DeviceType;
	[WmiDataId(4), Description("MediaType"), read] uint16 MediaType;
	[WmiDataId(5), Description("StartingOffset"), read] uint64 StartingOffset;
	[WmiDataId(6), Description("Size"), read] uint64 Size;
	[WmiDataId(7), Description("NumberOfFreeBlocks"), read] uint64 NumberOfFreeBlocks;
	[WmiDataId(8), Description("TotalNumberOfBlocks"), read] uint64 TotalNumberOfBlocks;
	[WmiDataId(9), Description("NextWritableAddress"), read] uint64 NextWritableAddress;
	[WmiDataId(10), Description("NumberOfSessions"), read] uint32 NumberOfSessions;
	[WmiDataId(11), Description("NumberOfTracks"), read] uint32 NumberOfTracks;
	[WmiDataId(12), Description("BytesPerSector"), read] uint32 BytesPerSector;
	[WmiDataId(13), Description("DiscStatus"), read] uint16 DiscStatus;
	[WmiDataId(14), Description("LastSessionStatus"), read] uint16 LastSessionStatus;
	[WmiDataId(15), Description("DriveLetter"), StringTermination("NullTerminated"), format("w"), read] string DriveLetter;
	[WmiDataId(16), Description("FileSystemName"), StringTermination("NullTerminated"), format("w"), read] string FileSystemName;
	[WmiDataId(17), Description("DeviceName"), StringTermination("NullTerminated"), format("a"), read] string DeviceName;
	[WmiDataId(18), Description("ManufacturerName"), StringTermination("NullTerminated"), format("a"), read] string ManufacturerName;
};

[dynamic: ToInstance, Description("System Configuration"), EventType(27), EventTypeName("ProcessorNumber"), LOCALE("ms_409")]
class SystemConfig_V2_ProcNumber : SystemConfig_V2
{
	[WmiDataId(1), Description("ProcessorCount"), read] uint32 ProcessorCount;
	[WmiDataId(2), Description("ProcessorNumber"), format("x"), WmiSizeIs("ProcessorCount"), read] uint32 ProcessorNumber;
};

[dynamic: ToInstance, Description("System Configuration"), EventType(14), EventTypeName("Video"), LOCALE("ms_409")]
class SystemConfig_V2_Video : SystemConfig_V2
{
	[WmiDataId(1), Description("MemorySize"), read] uint32 MemorySize;
	[WmiDataId(2), Description("XResolution"), read] uint32 XResolution;
	[WmiDataId(3), Description("YResolution"), read] uint32 YResolution;
	[WmiDataId(4), Description("BitsPerPixel"), read] uint32 BitsPerPixel;
	[WmiDataId(5), Description("VRefresh"), read] uint32 VRefresh;
	[WmiDataId(6), Description("ChipType"), format("s"), read, MAX(256)] char16 ChipType;
	[WmiDataId(7), Description("DACType"), format("s"), read, MAX(256)] char16 DACType;
	[WmiDataId(8), Description("AdapterString"), format("s"), read, MAX(256)] char16 AdapterString;
	[WmiDataId(9), Description("BiosString"), format("s"), read, MAX(256)] char16 BiosString;
	[WmiDataId(10), Description("Device Name"), format("s"), read, MAX(256)] char16 DeviceId;
	[WmiDataId(11), Description("StateFlags"), format("x"), read] uint32 StateFlags;
};

[dynamic: ToInstance, Description("System Configuration"), EventType(17), EventTypeName("Network"), LOCALE("ms_409")]
class SystemConfig_V2_Network : SystemConfig_V2
{
	[WmiDataId(1), Description("TcbTablePartitions"), read] uint32 TcbTablePartitions;
	[WmiDataId(2), Description("MaxHashTableSize"), read] uint32 MaxHashTableSize;
	[WmiDataId(3), Description("MaxUserPort"), read] uint32 MaxUserPort;
	[WmiDataId(4), Description("TcpTimedWaitDelay"), read] uint32 TcpTimedWaitDelay;
};

[dynamic: ToInstance, Description("System Configuration"), EventType(31), EventTypeName("Defragmentation"), LOCALE("ms_409")]
class SystemConfig_V2_Defrag : SystemConfig_V2
{
	[WmiDataId(1), Description("AlignmentClusters"), read] uint64 AlignmentClusters;
	[WmiDataId(2), Description("AvgFreeSpaceSize"), read] uint64 AvgFreeSpaceSize;
	[WmiDataId(3), Description("ClustersPerSlab"), read] uint64 ClustersPerSlab;
	[WmiDataId(4), Description("FragmentedDirectoryExtents"), read] uint64 FragmentedDirectoryExtents;
	[WmiDataId(5), Description("FragmentedExtents"), read] uint64 FragmentedExtents;
	[WmiDataId(6), Description("FreeSpaceCount"), read] uint64 FreeSpaceCount;
	[WmiDataId(7), Description("LargestFreeSpaceSize"), read] uint64 LargestFreeSpaceSize;
	[WmiDataId(8), Description("LastRunActualPurgeClusters"), read] uint64 LastRunActualPurgeClusters;
	[WmiDataId(9), Description("LastRunClustersTrimmed"), read] uint64 LastRunClustersTrimmed;
	[WmiDataId(10), Description("LastRunFullDefragTime"), read] uint64 LastRunFullDefragTime;
	[WmiDataId(11), Description("LastRunTime"), read] uint64 LastRunTime;
	[WmiDataId(12), Description("MFTSize"), read] uint64 MFTSize;
	[WmiDataId(13), Description("TotalClusters"), read] uint64 TotalClusters;
	[WmiDataId(14), Description("TotalUsedClusters"), read] uint64 TotalUsedClusters;
	[WmiDataId(15), Description("AvgFragmentsPerFile"), read] uint32 AvgFragmentsPerFile;
	[WmiDataId(16), Description("BytesPerCluster"), read] uint32 BytesPerCluster;
	[WmiDataId(17), Description("DirectoryCount"), read] uint32 DirectoryCount;
	[WmiDataId(18), Description("FragmentedDirectories"), read] uint32 FragmentedDirectories;
	[WmiDataId(19), Description("FragmentedFiles"), read] uint32 FragmentedFiles;
	[WmiDataId(20), Description("FragmentedSpace"), read] uint32 FragmentedSpace;
	[WmiDataId(21), Description("HardwareIssue"), read] uint32 HardwareIssue;
	[WmiDataId(22), Description("InUseMFTRecords"), read] uint32 InUseMFTRecords;
	[WmiDataId(23), Description("InUseSlabs"), read] uint32 InUseSlabs;
	[WmiDataId(24), Description("LastRunActualPurgeSlabs"), read] uint32 LastRunActualPurgeSlabs;
	[WmiDataId(25), Description("LastRunInitialBackedSlabs"), read] uint32 LastRunInitialBackedSlabs;
	[WmiDataId(26), Description("LastRunPercentFragmentation"), read] uint32 LastRunPercentFragmentation;
	[WmiDataId(27), Description("LastRunPinnedSlabs"), read] uint32 LastRunPinnedSlabs;
	[WmiDataId(28), Description("LastRunPotentialPurgeSlabs"), read] uint32 LastRunPotentialPurgeSlabs;
	[WmiDataId(29), Description("LastRunSpaceInefficientSlabs"), read] uint32 LastRunSpaceInefficientSlabs;
	[WmiDataId(30), Description("LastRunTrimmedSlabs"), read] uint32 LastRunTrimmedSlabs;
	[WmiDataId(31), Description("LastRunUnknownEvictFailSlabs"), read] uint32 LastRunUnknownEvictFailSlabs;
	[WmiDataId(32), Description("LastRunVolsnapPinnedSlabs"), read] uint32 LastRunVolsnapPinnedSlabs;
	[WmiDataId(33), Description("MFTFragmentCount"), read] uint32 MFTFragmentCount;
	[WmiDataId(34), Description("MovableFiles"), read] uint32 MovableFiles;
	[WmiDataId(35), Description("TotalMFTRecords"), read] uint32 TotalMFTRecords;
	[WmiDataId(36), Description("TotalSlabs"), read] uint32 TotalSlabs;
	[WmiDataId(37), Description("UnmovableFiles"), read] uint32 UnmovableFiles;
	[WmiDataId(38), Description("VolumeId"), extension("GUID"), read] object VolumeId;
	[WmiDataId(39), Description("VolumePathNames"), StringTermination("NullTerminated"), format("w"), read] string VolumePathNames;
};

[dynamic: ToInstance, Description("System Configuration"), EventType(35), EventTypeName("Processors"), LOCALE("ms_409")]
class SystemConfig_V2_Processors : SystemConfig_V2
{
	[WmiDataId(1), Description("ProcessorIndex"), read] uint32 ProcessorIndex;
	[WmiDataId(2), Description("FeatureSet"), read] uint32 FeatureSet;
	[WmiDataId(3), Description("ProcessorSpeed"), read] uint32 ProcessorSpeed;
	[WmiDataId(4), Description("ProcessorName"), format("s"), read, MAX(64)] char16 ProcessorName;
	[WmiDataId(5), Description("VendorIdentifier"), format("s"), read, MAX(16)] char16 VendorIdentifier;
	[WmiDataId(6), Description("ProcessorIdentifier"), format("s"), read, MAX(128)] char16 ProcessorIdentifier;
};

[dynamic: ToInstance, Description("System Configuration"), EventType(25), EventTypeName("Platform"), LOCALE("ms_409")]
class SystemConfig_V2_Platform : SystemConfig_V2
{
	[WmiDataId(1), Description("SystemManufacturer"), StringTermination("NullTerminated"), format("w"), read] string SystemManufacturer;
	[WmiDataId(2), Description("SystemProductName"), StringTermination("NullTerminated"), format("w"), read] string SystemProductName;
	[WmiDataId(3), Description("BiosDate"), StringTermination("NullTerminated"), format("w"), read] string BiosDate;
	[WmiDataId(4), Description("BiosVersion"), StringTermination("NullTerminated"), format("w"), read] string BiosVersion;
};

[dynamic: ToInstance, Description("System Configuration"), EventType(26), EventTypeName("ProcessorGroup"), LOCALE("ms_409")]
class SystemConfig_V2_ProcGroup : SystemConfig_V2
{
	[WmiDataId(1), Description("GroupCount"), read] uint32 GroupCount;
	[WmiDataId(2), Description("Affinity"), format("x"), WmiSizeIs("GroupCount"), pointer, read] uint32 Affinity;
};

[dynamic: ToInstance, Description("System Configuration"), EventType(15), EventTypeName("Services"), LOCALE("ms_409")]
class SystemConfig_V2_Services : SystemConfig_V2
{
	[WmiDataId(1), Description("ProcessId"), format("x"), read] uint32 ProcessId;
	[WmiDataId(2), Description("ServiceState"), format("x"), read] uint32 ServiceState;
	[WmiDataId(3), Description("SubProcessTag"), format("x"), read] uint32 SubProcessTag;
	[WmiDataId(4), Description("ServiceName"), StringTermination("NullTerminated"), format("w"), read] string ServiceName;
	[WmiDataId(5), Description("DisplayName"), StringTermination("NullTerminated"), format("w"), read] string DisplayName;
	[WmiDataId(6), Description("ProcessName"), StringTermination("NullTerminated"), format("w"), read] string ProcessName;
};

[dynamic: ToInstance, Description("System Configuration"), EventType(11), EventTypeName("PhyDisk"), LOCALE("ms_409")]
class SystemConfig_V2_PhyDisk : SystemConfig_V2
{
	[WmiDataId(1), Description("DiskNumber"), read] uint32 DiskNumber;
	[WmiDataId(2), Description("BytesPerSector"), read] uint32 BytesPerSector;
	[WmiDataId(3), Description("SectorsPerTrack"), read] uint32 SectorsPerTrack;
	[WmiDataId(4), Description("TracksPerCylinder"), read] uint32 TracksPerCylinder;
	[WmiDataId(5), Description("Cylinders"), read] uint64 Cylinders;
	[WmiDataId(6), Description("SCSIPort"), read] uint32 SCSIPort;
	[WmiDataId(7), Description("SCSIPath"), read] uint32 SCSIPath;
	[WmiDataId(8), Description("SCSITarget"), read] uint32 SCSITarget;
	[WmiDataId(9), Description("SCSILun"), read] uint32 SCSILun;
	[WmiDataId(10), Description("Manufacturer"), format("s"), read, MAX(256)] char16 Manufacturer;
	[WmiDataId(11), Description("PartitionCount"), read] uint32 PartitionCount;
	[WmiDataId(12), Description("WriteCacheEnabled"), read] uint8 WriteCacheEnabled;
	[WmiDataId(13), Description("Pad: not used"), read] uint8 Pad;
	[WmiDataId(14), Description("BootDriveLetter"), format("s"), read, MAX(3)] char16 BootDriveLetter;
	[WmiDataId(15), Description("Spare"), read, MAX(2)] char16 Spare;
};

[dynamic: ToInstance, Description("System Configuration"), EventType(16), EventTypeName("Power"), LOCALE("ms_409")]
class SystemConfig_V2_Power : SystemConfig_V2
{
	[WmiDataId(1), Description("S1"), read] uint8 S1;
	[WmiDataId(2), Description("S2"), read] uint8 S2;
	[WmiDataId(3), Description("S3"), read] uint8 S3;
	[WmiDataId(4), Description("S4"), read] uint8 S4;
	[WmiDataId(5), Description("S5"), read] uint8 S5;
	[WmiDataId(6), Description("Reserved; do not use."), read] uint8 Pad1;
	[WmiDataId(7), Description("Reserved; do not use."), read] uint8 Pad2;
	[WmiDataId(8), Description("Reserved; do not use."), read] uint8 Pad3;
};

[dynamic: ToInstance, Description("System Configuration"), EventType(34), EventTypeName("FlightIds"), LOCALE("ms_409")]
class SystemConfig_V2_FlightIds : SystemConfig_V2
{
	[WmiDataId(1), Description("UpdateId"), StringTermination("NullTerminated"), format("w"), read] string UpdateId;
	[WmiDataId(2), Description("FlightIdList"), StringTermination("NullTerminated"), format("w"), read] string FlightIdList;
};

[dynamic: ToInstance, Description("System Configuration"), EventType(32), EventTypeName("MobilePlatform"), LOCALE("ms_409")]
class SystemConfig_V2_MobilePlatform : SystemConfig_V2
{
	[WmiDataId(1), Description("BootLoaderVersion"), StringTermination("NullTerminated"), format("w"), read] string BootLoaderVersion;
	[WmiDataId(2), Description("FirmwareRevision"), StringTermination("NullTerminated"), format("w"), read] string FirmwareRevision;
	[WmiDataId(3), Description("FriendlyName"), StringTermination("NullTerminated"), format("w"), read] string FriendlyName;
	[WmiDataId(4), Description("HardwareRevision"), StringTermination("NullTerminated"), format("w"), read] string HardwareRevision;
	[WmiDataId(5), Description("Manufacturer"), StringTermination("NullTerminated"), format("w"), read] string Manufacturer;
	[WmiDataId(6), Description("ManufacturerDisplayName"), StringTermination("NullTerminated"), format("w"), read] string ManufacturerDisplayName;
	[WmiDataId(7), Description("ManufacturerModelName"), StringTermination("NullTerminated"), format("w"), read] string ManufacturerModelName;
	[WmiDataId(8), Description("MobileOperatorDisplayName"), StringTermination("NullTerminated"), format("w"), read] string MobileOperatorDisplayName;
	[WmiDataId(9), Description("MobileOperatorName"), StringTermination("NullTerminated"), format("w"), read] string MobileOperatorName;
	[WmiDataId(10), Description("ModelName"), StringTermination("NullTerminated"), format("w"), read] string ModelName;
	[WmiDataId(11), Description("RadioHardwareRevision"), StringTermination("NullTerminated"), format("w"), read] string RadioHardwareRevision;
	[WmiDataId(12), Description("RadioSoftwareRevision"), StringTermination("NullTerminated"), format("w"), read] string RadioSoftwareRevision;
	[WmiDataId(13), Description("ROMVersion"), StringTermination("NullTerminated"), format("w"), read] string ROMVersion;
	[WmiDataId(14), Description("SOCVersion"), StringTermination("NullTerminated"), format("w"), read] string SOCVersion;
	[WmiDataId(15), Description("HardwareVariant"), StringTermination("NullTerminated"), format("w"), read] string HardwareVariant;
};

[dynamic: ToInstance, Description("System Configuration"), EventType(30), EventTypeName("TelemetryConfiguration"), LOCALE("ms_409")]
class SystemConfig_V2_TelemetryInfo : SystemConfig_V2
{
	[WmiDataId(1), Description("MachineId"), extension("GUID"), read] object MachineId;
};

[dynamic: ToInstance, Description("System Configuration"), EventType(21), EventTypeName("IRQ"), LOCALE("ms_409")]
class SystemConfig_V2_IRQ : SystemConfig_V2
{
	[WmiDataId(1), Description("IRQAffinity"), format("x"), read] uint64 IRQAffinity;
	[WmiDataId(2), Description("IRQNum"), read] uint32 IRQNum;
	[WmiDataId(3), Description("DeviceDescriptionLen"), read] uint32 DeviceDescriptionLen;
	[WmiDataId(4), Description("DeviceDescription"), StringTermination("NullTerminated"), format("w"), read] string DeviceDescription;
};

[dynamic: ToInstance, Description("Thread Create/Exit Event"), Guid("{3d6fa8d1-fe05-11d0-9dda-00c04fd7ba7c}"), DisplayName("Thread"), EventVersion(1), LOCALE("ms_409")]
class Thread_V1 : MSNT_SystemTrace
{
};

[dynamic: ToInstance, Description("Thread Create/Exit Event"), EventType{2}, EventTypeName{"End"}, LOCALE("ms_409")]
class Thread_V1_TypeGroup2 : Thread_V1
{
	[WmiDataId(1), Description("ProcessId"), format("x"), read] uint32 ProcessId;
	[WmiDataId(2), Description("ThreadId"), format("x"), read] uint32 TThreadId;
};

[dynamic: ToInstance, Description("Thread Create/Exit Event"), EventType{1, 3, 4}, EventTypeName{"Start", "DCStart", "DCEnd"}, LOCALE("ms_409")]
class Thread_V1_TypeGroup1 : Thread_V1
{
	[WmiDataId(1), Description("ProcessId"), format("x"), read] uint32 ProcessId;
	[WmiDataId(2), Description("ThreadId"), format("x"), read] uint32 TThreadId;
	[WmiDataId(3), Description("StackBase"), pointer, read] uint32 StackBase;
	[WmiDataId(4), Description("StackLimit"), pointer, read] uint32 StackLimit;
	[WmiDataId(5), Description("UserStackBase"), pointer, read] uint32 UserStackBase;
	[WmiDataId(6), Description("UserStackLimit"), pointer, read] uint32 UserStackLimit;
	[WmiDataId(7), Description("StartAddr"), pointer, read] uint32 StartAddr;
	[WmiDataId(8), Description("Win32StartAddr"), pointer, read] uint32 Win32StartAddr;
	[WmiDataId(9), Description("WaitMode"), read] sint8 WaitMode;
};

[dynamic: ToInstance, Description("Context Switch Event"), EventType(36), EventTypeName("CSwitch"), LOCALE("ms_409")]
class CSwitch_V1 : Thread_V1
{
	[WmiDataId(1), Description("NewThreadId"), format("x"), read] uint32 NewThreadId;
	[WmiDataId(2), Description("OldThreadId"), format("x"), read] uint32 OldThreadId;
	[WmiDataId(3), Description("NewThreadPriority"), read] sint8 NewThreadPriority;
	[WmiDataId(4), Description("OldThreadPriority"), read] sint8 OldThreadPriority;
	[WmiDataId(5), Description("NewThreadQuantum"), read] sint8 NewThreadQuantum;
	[WmiDataId(6), Description("OldThreadQuantum"), read] sint8 OldThreadQuantum;
	[WmiDataId(7), Description("OldThreadWaitReason"), read] sint8 OldThreadWaitReason;
	[WmiDataId(8), Description("OldThreadWaitMode"), read] sint8 OldThreadWaitMode;
	[WmiDataId(9), Description("OldThreadState"), read] sint8 OldThreadState;
	[WmiDataId(10), Description("OldThreadWaitIdealProcessor"), read] sint8 OldThreadWaitIdealProcessor;
};

[dynamic: ToInstance, Description("Worker Thread Event"), EventType(57), EventTypeName("WorkerThread"), LOCALE("ms_409")]
class WorkerThread_V1 : Thread_V1
{
	[WmiDataId(1), Description("ThreadId"), format("x"), read] uint32 TThreadId;
	[WmiDataId(2), Description("StartTime"), read] uint64 StartTime;
	[WmiDataId(3), Description("ThreadRoutine"), pointer, read] uint32 ThreadRoutine;
};

[dynamic: ToInstance, Description("TcpIp Send/Receive"), Guid("{9a280ac0-c8e0-11d1-84e2-00c04fb998a2}"), DisplayName("TcpIp"), EventVersion(0), LOCALE("ms_409")]
class TcpIp_V0 : MSNT_SystemTrace
{
};

[dynamic: ToInstance, Description("TcpIp Send/Receive"), EventType{10, 11, 12, 13, 14, 15}, EventTypeName{"Send", "Recv", "Connect", "Disconnect", "Retransmit", "Accept"}, LOCALE("ms_409")]
class TcpIp_V0_TypeGroup1 : TcpIp_V0
{
	[WmiDataId(1), Description("Remote IP Address"), extension("IPAddr"), read] object daddr;
	[WmiDataId(2), Description("Local IP Address"), extension("IPAddr"), read] object saddr;
	[WmiDataId(3), Description("Remote Port"), extension("Port"), read] object dport;
	[WmiDataId(4), Description("Local Port"), extension("Port"), read] object sport;
	[WmiDataId(5), Description("Transfer Size in Bytes"), read] uint32 size;
	[WmiDataId(6), Description("Process ID"), read] uint32 PID;
};

[dynamic: ToInstance, Description("Process Create/Exit Event"), Guid("{3d6fa8d0-fe05-11d0-9dda-00c04fd7ba7c}"), DisplayName("Process"), EventVersion(2), LOCALE("ms_409")]
class Process_V2 : MSNT_SystemTrace
{
};

[dynamic: ToInstance,
 Description("Process Wake Events"),
 EventType{96, 97, 98, 99},
 EventTypeName{"WakeEventUser", "WakeEventExecution", "WakeEventKernel", "WakeEventInstrumentation"},
 LOCALE("ms_409")
]
class Process_V2_TypeGroup5 : Process_V2
{
	[WmiDataId(1), Description("Object"), pointer, read] uint32 Object;
};

[dynamic: ToInstance,
 Description("Process Wake Counter"),
 EventType{48, 49, 50, 51, 52, 64, 65, 66, 67, 68, 80, 81, 82, 83, 84},
 EventTypeName{"WakeChargeUser", "WakeChargeExecution", "WakeChargeKernel", "WakeChargeInstrumentation", "WakeChargePreserveProcess", "WakeReleaseUser", "WakeReleaseExecution", "WakeReleaseKernel", "WakeReleaseInstrumentation", "WakeReleasePreserveProcess", "WakeDropUser", "WakeDropExecution", "WakeDropKernel", "WakeDropInstrumentation", "WakeDropPreserveProcess"},
 LOCALE("ms_409")
]
class Process_V2_TypeGroup4 : Process_V2
{
	[WmiDataId(1), Description("Object"), pointer, read] uint32 Object;
	[WmiDataId(2), Description("Tag"), pointer, read] uint32 Tag;
	[WmiDataId(3), Description("ProcessId"), format("x"), read] uint32 ProcessId;
	[WmiDataId(4), Description("Count"), read] uint32 Count;
};

[dynamic: ToInstance, Description("Process Performance Counters"), EventType{32, 33}, EventTypeName{"PerfCtr", "PerfCtrRundown"}, LOCALE("ms_409")]
class Process_V2_TypeGroup2 : Process_V2
{
	[WmiDataId(1), Description("ProcessId"), format("x"), read] uint32 ProcessId;
	[WmiDataId(2), Description("PageFaultCount"), read] uint32 PageFaultCount;
	[WmiDataId(3), Description("HandleCount"), read] uint32 HandleCount;
	[WmiDataId(4), Description("Reserved"), read] uint32 Reserved;
	[WmiDataId(5), Description("PeakVirtualSize"), extension("SizeT"), read] object PeakVirtualSize;
	[WmiDataId(6), Description("PeakWorkingSetSize"), extension("SizeT"), read] object PeakWorkingSetSize;
	[WmiDataId(7), Description("PeakPagefileUsage"), extension("SizeT"), read] object PeakPagefileUsage;
	[WmiDataId(8), Description("QuotaPeakPagedPoolUsage"), extension("SizeT"), read] object QuotaPeakPagedPoolUsage;
	[WmiDataId(9), Description("QuotaPeakNonPagedPoolUsage"), extension("SizeT"), read] object QuotaPeakNonPagedPoolUsage;
	[WmiDataId(10), Description("VirtualSize"), extension("SizeT"), read] object VirtualSize;
	[WmiDataId(11), Description("WorkingSetSize"), extension("SizeT"), read] object WorkingSetSize;
	[WmiDataId(12), Description("PagefileUsage"), extension("SizeT"), read] object PagefileUsage;
	[WmiDataId(13), Description("QuotaPagedPoolUsage"), extension("SizeT"), read] object QuotaPagedPoolUsage;
	[WmiDataId(14), Description("QuotaNonPagedPoolUsage"), extension("SizeT"), read] object QuotaNonPagedPoolUsage;
	[WmiDataId(15), Description("PrivatePageCount"), extension("SizeT"), read] object PrivatePageCount;
};

[dynamic: ToInstance, Description("Process Create/Exit Event"), EventType{1, 2, 3, 4, 39}, EventTypeName{"Start", "End", "DCStart", "DCEnd", "Defunct"}, LOCALE("ms_409")]
class Process_V2_TypeGroup1 : Process_V2
{
	[WmiDataId(1), Description("UniqueProcessKey"), pointer, read] uint32 UniqueProcessKey;
	[WmiDataId(2), Description("ProcessId"), format("x"), read] uint32 ProcessId;
	[WmiDataId(3), Description("ParentId"), format("x"), read] uint32 ParentId;
	[WmiDataId(4), Description("SessionId"), read] uint32 SessionId;
	[WmiDataId(5), Description("ExitStatus"), read] sint32 ExitStatus;
	[WmiDataId(6), Description("UserSID"), extension("Sid"), read] object UserSID;
	[WmiDataId(7), Description("ImageFileName"), StringTermination("NullTerminated"), read] string ImageFileName;
	[WmiDataId(8), Description("CommandLine"), StringTermination("NullTerminated"), format("w"), read] string CommandLine;
};

[dynamic: ToInstance, Description("Process Terminate Event"), EventType{11}, EventTypeName{"Terminate"}, LOCALE("ms_409")]
class Process_Terminate_TypeGroup1 : Process_V2
{
	[WmiDataId(1), Description("ProcessId"), format("x"), read] uint32 ProcessId;
};

[dynamic: ToInstance, Description("Process In Swap Event"), EventType(35), EventTypeName("InSwap"), LOCALE("ms_409")]
class Process_V2_TypeGroup3 : Process_V2
{
	[WmiDataId(1), Description("DirectoryTableBase"), pointer, read] uint32 DirectoryTableBase;
	[WmiDataId(2), Description("ProcessId"), format("x"), read] uint32 ProcessId;
};

[dynamic: ToInstance, Description("Process Create/Exit Event"), Guid("{3d6fa8d0-fe05-11d0-9dda-00c04fd7ba7c}"), DisplayName("Process"), EventVersion(4), LOCALE("ms_409")]
class Process_V4 : MSNT_SystemTrace
{
};

[dynamic: ToInstance, Description("Process Create/Exit Event"), EventType{1, 2, 3, 4, 39}, EventTypeName{"Start", "End", "DCStart", "DCEnd", "Defunct"}, LOCALE("ms_409")]
class Process_V4_TypeGroup1 : Process_V4
{
	[WmiDataId(1), Description("UniqueProcessKey"), pointer, read] uint32 UniqueProcessKey;
	[WmiDataId(2), Description("ProcessId"), format("x"), read] uint32 ProcessId;
	[WmiDataId(3), Description("ParentId"), format("x"), read] uint32 ParentId;
	[WmiDataId(4), Description("SessionId"), read] uint32 SessionId;
	[WmiDataId(5), Description("ExitStatus"), read] sint32 ExitStatus;
	[WmiDataId(6), Description("DirectoryTableBase"), pointer, read] uint32 DirectoryTableBase;
	[WmiDataId(8), Description("UserSID"), extension("Sid"), read] object UserSID;
	[WmiDataId(9), Description("ImageFileName"), StringTermination("NullTerminated"), read] string ImageFileName;
	[WmiDataId(10), Description("CommandLine"), StringTermination("NullTerminated"), format("w"), read] string CommandLine;
	[WmiDataId(11), Description("PackageFullName"), StringTermination("NullTerminated"), format("w"), read] string PackageFullName;
	[WmiDataId(12), Description("ApplicationId"), StringTermination("NullTerminated"), format("w"), read] string ApplicationId;
};

[dynamic: ToInstance, Description("Object Manager Events"), Guid("{89497f50-effe-4440-8cf2-ce6b1cdcaca7}"), DisplayName("Object"), EventVersion(3), LOCALE("ms_409")]
class ObTrace_V3 : MSNT_SystemTrace
{
};

[dynamic: ToInstance, Description("Handle Duplicate Event"), EventType(34), EventTypeName("DuplicateHandle"), LOCALE("ms_409")]
class ObHandleDuplicateEvent : ObTrace_V3
{
	[WmiDataId(1), Description("Object"), format("x"), pointer, read] uint32 Object;
	[WmiDataId(2), Description("SourceHandle"), format("x"), read] uint32 SourceHandle;
	[WmiDataId(3), Description("TargetHandle"), format("x"), read] uint32 TargetHandle;
	[WmiDataId(4), Description("TargetProcessId"), format("x"), read] uint32 TargetProcessId;
	[WmiDataId(5), Description("ObjectType"), read] uint16 ObjectType;
};

[dynamic: ToInstance, Description("Power Event"), Guid("{e43445e0-0903-48c3-b878-ff0fccebdd04}"), DisplayName("Power"), EventVersion(2), LOCALE("ms_409")]
class PowerEvents : MSNT_SystemTrace
{
};

[dynamic: ToInstance, Description("Idle Exit Latency"), EventType(60), EventTypeName("IdleExitLatency"), LOCALE("ms_409")]
class IdleExitLatency : PowerEvents
{
	[WmiDataId(2), Description("PlatformState"), read] uint32 PlatformState;
	[WmiDataId(3), Description("ProcessorState"), read] uint32 ProcessorState;
	[WmiDataId(4), Description("ReturnLatency"), read] uint32 ReturnLatency;
	[WmiDataId(5), Description("TotalLatency"), read] uint32 TotalLatency;
};

[dynamic: ToInstance, Description("Process Create/Exit Event"), Guid("{3d6fa8d0-fe05-11d0-9dda-00c04fd7ba7c}"), DisplayName("Process"), EventVersion(3), LOCALE("ms_409")]
class Process_V3 : MSNT_SystemTrace
{
};

[dynamic: ToInstance, Description("Process Create/Exit Event"), EventType{1, 2, 3, 4, 39}, EventTypeName{"Start", "End", "DCStart", "DCEnd", "Defunct"}, LOCALE("ms_409")]
class Process_V3_TypeGroup1 : Process_V3
{
	[WmiDataId(1), Description("UniqueProcessKey"), pointer, read] uint32 UniqueProcessKey;
	[WmiDataId(2), Description("ProcessId"), format("x"), read] uint32 ProcessId;
	[WmiDataId(3), Description("ParentId"), format("x"), read] uint32 ParentId;
	[WmiDataId(4), Description("SessionId"), read] uint32 SessionId;
	[WmiDataId(5), Description("ExitStatus"), read] sint32 ExitStatus;
	[WmiDataId(6), Description("DirectoryTableBase"), pointer, read] uint32 DirectoryTableBase;
	[WmiDataId(7), Description("UserSID"), extension("Sid"), read] object UserSID;
	[WmiDataId(8), Description("ImageFileName"), StringTermination("NullTerminated"), read] string ImageFileName;
	[WmiDataId(9), Description("CommandLine"), StringTermination("NullTerminated"), format("w"), read] string CommandLine;
};

[dynamic: ToInstance, Description("ALPC Event"), Guid("{45d8cccd-539f-4b72-a8b7-5c683142609a}"), DisplayName("ALPC"), EventVersion(2), LOCALE("ms_409")]
class ALPC : MSNT_SystemTrace
{
};

[dynamic: ToInstance, Description("ALPC Receive Message"), EventType(34), EventTypeName("ALPC-Receive-Message"), LOCALE("ms_409")]
class ALPC_Receive_Message : ALPC
{
	[WmiDataId(1), Description("MessageID"), read] uint32 MessageID;
};

[dynamic: ToInstance, Description("ALPC Wait For Reply"), EventType(35), EventTypeName("ALPC-Wait-For-Reply"), LOCALE("ms_409")]
class ALPC_Wait_For_Reply : ALPC
{
	[WmiDataId(1), Description("MessageID"), read] uint32 MessageID;
};

[dynamic: ToInstance, Description("ALPC Send Message"), EventType(33), EventTypeName("ALPC-Send-Message"), LOCALE("ms_409")]
class ALPC_Send_Message : ALPC
{
	[WmiDataId(1), Description("MessageID"), read] uint32 MessageID;
};

[dynamic: ToInstance, Description("ALPC Unwait"), EventType(37), EventTypeName("ALPC-Unwait"), LOCALE("ms_409")]
class ALPC_Unwait : ALPC
{
	[WmiDataId(1), Description("Status"), read] uint32 Status;
};

[dynamic: ToInstance, Description("ALPC Wait For New Message"), EventType(36), EventTypeName("ALPC-Wait-For-New-Message"), LOCALE("ms_409")]
class ALPC_Wait_For_New_Message : ALPC
{
	[WmiDataId(1), Description("IsServerPort"), read] uint32 IsServerPort;
	[WmiDataId(2), Description("PortName"), StringTermination("NullTerminated"), format("w"), read] string PortName;
};

[dynamic: ToInstance, Description("Image Load"), Guid("{2cb15d1d-5fc1-11d2-abe1-00a0c911f518}"), DisplayName("Image"), EventVersion(3), LOCALE("ms_409")]
class Image : MSNT_SystemTrace
{
};

[dynamic: ToInstance, Description("Image Load"), EventType{10, 2, 3, 4}, EventTypeName{"Load", "UnLoad", "DCStart", "DCEnd"}, LOCALE("ms_409")]
class Image_Load : Image
{
	[WmiDataId(1), Description("ImageBase"), pointer, read] uint32 ImageBase;
	[WmiDataId(2), Description("ImageSize"), pointer, read] uint32 ImageSize;
	[WmiDataId(3), Description("ProcessId"), read] uint32 ProcessId;
	[WmiDataId(4), Description("ImageChecksum"), read] uint32 ImageChecksum;
	[WmiDataId(5), Description("TimeDateStamp"), read] uint32 TimeDateStamp;
	[WmiDataId(6), Description("SignatureLevel"), read] uint8 SignatureLevel;
	[WmiDataId(7), Description("SignatureType"), read] uint8 SignatureType;
	[WmiDataId(8), Description("Reserved0"), read] uint16 Reserved0;
	[WmiDataId(9), Description("DefaultBase"), pointer, read] uint32 DefaultBase;
	[WmiDataId(10), Description("Reserved1"), read] uint32 Reserved1;
	[WmiDataId(11), Description("Reserved2"), read] uint32 Reserved2;
	[WmiDataId(12), Description("Reserved3"), read] uint32 Reserved3;
	[WmiDataId(13), Description("Reserved4"), read] uint32 Reserved4;
	[WmiDataId(14), Description("FileName"), StringTermination("NullTerminated"), format("w"), read] string FileName;
};

[dynamic: ToInstance, Description("Library Loader Security Search Event"), EventType{212}, EventTypeName{"DllSearchResults"}, LOCALE("ms_409")]
class LoaderDllSearchResults : Image
{
	[WmiDataId(1), Description("Internal loader flags"), format("x"), read] uint32 LdrLoadFlags;
	[WmiDataId(2), Description("Loader search flags"), format("x"), read] uint32 LdrSearchFlags;
	[WmiDataId(3), Description("Search results information flags"), format("x"), read] uint32 SearchInfo;
	[WmiDataId(4), Description("Load reason"), format("x"), read] uint32 LoadReason;
	[WmiDataId(5), Description("Full dll name"), StringTermination("NullTerminated"), format("w"), read] string FullDllName;
};

[dynamic: ToInstance, Description("Library Loader New/Dependence DLL Load Event"), EventType{176, 177}, EventTypeName{"NewDllLoad", "NewDllLoadAsData"}, LOCALE("ms_409")]
class LoaderNewDllEvent : Image
{
	[WmiDataId(1), Description("NewDll Base Address"), format("x"), pointer, read] uint32 NewDllBaseAddress;
	[WmiDataId(2), Description("ParentDll Base Address"), format("x"), pointer, read] uint32 ParentDllBaseAddress;
	[WmiDataId(3), Description("Load Reason"), format("x"), read] uint32 LoadReason;
	[WmiDataId(4), Description("String"), StringTermination("NullTerminated"), format("w"), read] string FilePath;
};

[dynamic: ToInstance, Description("Library Loader Coded Event"), EventType{192, 193}, EventTypeName{"DllSearchPathExternal", "DllSearchPathInternal"}, LOCALE("ms_409")]
class LoaderCodedEventPath : Image
{
	[WmiDataId(1), Description("Base Address or Status Code"), format("x"), read] uint64 BaseAddress;
	[WmiDataId(2), Description("ErrorOpcode"), format("x"), read] uint8 ErrorOpcode;
	[WmiDataId(3), Description("Code"), read] sint8 Code;
	[WmiDataId(4), Description("Description String"), StringTermination("NullTerminated"), format("w"), read] string String1;
	[WmiDataId(5), Description("Dll name or path"), StringTermination("NullTerminated"), format("w"), read] string String2;
};

[dynamic: ToInstance,
 Description("Library Loader Coded Event"),
 EventType{165, 166, 167, 168, 169, 170, 171, 172, 173, 174, 208, 209, 210, 211},
 EventTypeName{"MapViewStart", "SnappingStart", "SnappingEnd", "LoadingStart", "LoadingEnd", "FoundKnownDll", "AbnormalTermination", "ModulePlaceHolder", "ReadyToInit", "ReadyToRun", "ApiSetResolving", "ApiSetHosted", "ApiSetUnhosted", "ApiSetUnresolved"},
 LOCALE("ms_409")
]
class LoaderCodedEventStatus : Image
{
	[WmiDataId(1), Description("Base Address or Status Code"), format("x"), read] uint64 BaseAddress;
	[WmiDataId(2), Description("ErrorOpcode"), format("x"), read] uint8 ErrorOpcode;
	[WmiDataId(3), Description("Code"), read] sint8 Code;
	[WmiDataId(4), Description("String"), StringTermination("NullTerminated"), format("w"), read] string String;
};

[dynamic: ToInstance, Description("Library Loader Security Path Search Event"), EventType{213}, EventTypeName{"DllPathSearchResults"}, LOCALE("ms_409")]
class LoaderPathSearchResults : Image
{
	[WmiDataId(1), Description("Search results information flags"), format("x"), read] uint32 SearchInfo;
	[WmiDataId(2), Description("Current working directory path"), StringTermination("NullTerminated"), format("w"), read] string Cwd;
	[WmiDataId(3), Description("Application directory path"), StringTermination("NullTerminated"), format("w"), read] string AppDir;
	[WmiDataId(4), Description("Dll directory path"), StringTermination("NullTerminated"), format("w"), read] string DllDir;
	[WmiDataId(5), Description("Dll Load directory path"), StringTermination("NullTerminated"), format("w"), read] string DllLoadDir;
};