Account, ItemWString ChannelType, ItemULongX NegotiatedFlags, ItemULongX Status, ItemULongX } 63dbb180-dbed-11d2-895b-00c04f79ab69 NlSecChanlSetup #type Start 1 #type End 2 //*****************************************************************************

// SRV events //***************************************************************************** e09074ae-0a98-4805-9a41-a8940af97086 SrvSmb #type CreateDirectory 0 #type DeleteDirectory 1 #type Open 2 #type Create 3 #type Close 4 #type Flush 5 #type Delete 6 #type Rename 7 #type QueryInformation 8 #type SetInformation 9 #type Read 10 #type Write 11 #type Loc ByteRange 12 #type Unloc ByteRange 13 #type CreateTemporary 14 #type Chec Directory 15 #type ProcessExit 16 #type See 17 #type Loc AndRead 18 #type SetInformation2 19 #type QueryInformation2 20 #type Loc ingAndX 21 #type Transaction 22 #type TransactionSecondary 23 #type Ioctl 24 #type IoctlSecondary 25 #type Move 26 #type Echo 27 #type OpenAndX 28 #type ReadAndX 29 #type WriteAndX 30 #type FindClose2 31 #type FindNotifyClose 32 #type TreeConnect 33 #type TreeDisconnect 34 #type Negotiate 35 #type SessionSetupAndX 36 #type LogoffAndX 37 #type TreeConnectAndX 38 #type QueryInformationDis 39 #type Search 40 #type NtTransaction 41 #type NtTransactionSecondary 42 #type NtCreateAndX 43 #type NtCancel 44

#type OpenPrintFile #type ClosePrintFile #type GetPrintQueue #type ReadRaw #type WriteRaw #type ReadMpx #type WriteMpx #type WriteMpxSecondary #type Open2 #type FindFirst2 #type FindNext2 #type QueryFsInformation #type SetFsInformation #type QueryPathInformation #type SetPathInformation #type QueryFileInformation #type SetFileInformation #type Fsctl #type Ioctl2 #type FindNotify #type CreateDirectory2 #type GetDfsReferrals #type ReportDfsInconsistency #type CreateWirhSdOrEa #type NtIoctl #type SetSecurityDescriptor #type NtNotifyChange #type NtRename #type QuerySecurityDescriptor #type QueryQuota #type SetQuota { StartTime, ItemULongLong ElapseKCPU, ItemCPUTime ElapseUCPU, ItemCPUTime ClientAddr, ItemIpAddr FileObject, ItemULongX FileName, ItemPWString }

45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75

//***************************************************************************** // DFS events //***************************************************************************** e3f1c64a-1a24-494b-8d47-ac37ad623342 DFS #type TranslatePathStart 50 #type TranslatePathEnd 52 { rtnStatus, ItemULongX SubDirectory, ItemPWString ParentPathName, ItemPWString DfsPathName, ItemPWString } #type GetReferralsStart 55 #type GetReferralsEnd 59 { rtnStatus, ItemULongX DfsPathName, ItemPWString }

#type FindShareStart 76 #type FindShareEnd 79 { rtnStatus, ItemULongX ShareName, ItemPWString } //***************************************************************************** // NSPI events: Uses DS Control Guid. //***************************************************************************** D01B04CF-240E-11d3-ACBE-00C04F68A51D NspiUpdateStat #type Start 1 #type End 2 4D63B05C-2502-11d3-ACC1-00C04F68A51D NspiCompareDNTs #type Start 1 #type End 2 61569D69-2502-11d3-ACC1-00C04F68A51D NspiQueryRows #type Start 1 #type End 2 6F370D3C-2502-11d3-ACC1-00C04F68A51D NspiSee Entries #type Start 1 #type End 2 6F370D3D-2502-11d3-ACC1-00C04F68A51D NspiGetMatches #type Start 1 #type End 2 6F370D3E-2502-11d3-ACC1-00C04F68A51D NspiResolveNames #type Start 1 #type End 2 7842189A-2502-11d3-ACC1-00C04F68A51D NspiDNToEph #type Start 1 #type End 2 7842189B-2502-11d3-ACC1-00C04F68A51D NspiGetHierInfo #type Start 1 #type End 2 7842189C-2502-11d3-ACC1-00C04F68A51D NspiResrtRestrct #type Start 1 #type End 2 80AD666A-2502-11d3-ACC1-00C04F68A51D NspiBind #type Start 1 #type End 2 873BDDEA-2502-11d3-ACC1-00C04F68A51D NspiGtNamFromIDs #type Start 1 #type End 2 873BDDEB-2502-11d3-ACC1-00C04F68A51D NspiGtIDsFromNam #type Start 1 #type End 2 8D8C5846-2502-11d3-ACC1-00C04F68A51D NspiGetPropList #type Start 1

#type End

8D8C5847-2502-11d3-ACC1-00C04F68A51D NspiQueryCol #type Start 1 #type End 2 8D8C5848-2502-11d3-ACC1-00C04F68A51D NspiGetProps #type Start 1 #type End 2 96EF9AA6-2502-11d3-ACC1-00C04F68A51D NspiGetTemplInfo #type Start 1 #type End 2 96EF9AA7-2502-11d3-ACC1-00C04F68A51D NspiModProps #type Start 1 #type End 2 380D48A4-2506-11d3-ACC1-00C04F68A51D NspiModLin Att #type Start 1 #type End 2 380D48A5-2506-11d3-ACC1-00C04F68A51D NspiDeleteEntries #type Start 1 #type End 2 E357DC53-B6FC-48e0-8189-C9D2AB2A8F16 DsTas QueueExecuteGuid #type Start 1 #type End 2 //****************************************** // SPOOLER Events // Control guid is 94a984ef-f525-4bf1-be3c-ef374056a592 //****************************************** 127eb555-3b06-46ea-a08b-5dc2c3c57cfd PrintJob #type SpoolJob 1 #type PrintJob 7 #type Trac Thread 8 #type EndTrac Thread 10 #type PauseJob 12 #type ResumeJob 13 { JobId, ItemULong } #type DeleteJob 2 { JobId, ItemULong JobSize, ItemULong DataType, ItemULong Pages, ItemULong PagesPerSide, ItemULong FilesOpened, ItemShort } 1d32b239-92a6-485a-96d2-dc3659fb803e RenderedJob #type JobRendered 11 { JobId, ItemULong

GdiJobSize, ItemULong ICMMethod, ItemULong Color, ItemShort XRes, ItemShort YRes, ItemShort Quality, ItemShort Copies, ItemShort TTOption, ItemShort } //****************************************** // NTLM Events // C92CF544-91B3-4dc0-8E11-C580339A0BF8 NtlmControl //****************************************** 94D4C9EB-0D01-41ae-99E8-15B26B593A83 NtlmServerAccept #type Start 1 { StageHint, ItemULong InContext, ItemPtr } #type End 2 { StageHint, ItemULong InContext, ItemPtr OutContext, ItemPtr Status, ItemULong } #type Info 0 { StageHint, ItemULong InContext, ItemPtr OutContext, ItemPtr Flags, ItemULong UserName, ItemPWString DomainName, ItemPWString Wor station, ItemPWString } 6DF28B22-73BE-45cc-BA80-8B332B35A21D NtlmClientInitialize #type Start 1 { StageHint, ItemULong InContext, ItemPtr } #type End 2 { StageHint, ItemULong InContext, ItemPtr OutContext, ItemPtr Status, ItemULong } 19196B33-A302-4c12-9D5A-EAC149E93C46 NtlmLogonUser #type Start 1 { } #type End 2

{ Status, ItemULong LogonType, ItemULong UserName, ItemPWString DomainName, ItemPWString } 34D84181-C28A-41d8-BB9E-995190DF83DF NtlmValidateUser #type Start 1 { } #type End 2 { Success, ItemULong LogonServer, ItemPWString LogonDomain, ItemPWString UserName, ItemPWString Wor station, ItemPWString } //****************************************** // Com+ Services Events //****************************************** 67F49F8C-01B8-4354-BFFB-7A93E7211C3E ObjPoolCreateObject #version 0 #type Event 0 { ProcessId, ItemULong ApplicationID, ItemGUID PartitionID, ItemGUID AppInstanceID, ItemGUID ComputerName, ItemWChar[256] ObjectGuid, ItemGUID ObjectsCreated, ItemULong ObjectID, ItemULongLong } C5A3005A-F643-4f09-B146-A47B9165E522 ObjPoolDestroyObject #version 0 #type Event 0 { ProcessId, ItemULong ApplicationID, ItemGUID PartitionID, ItemGUID AppInstanceID, ItemGUID ComputerName, ItemWChar[256] ObjectGuid, ItemGUID ObjectsCreated, ItemULong ObjectID, ItemULongLong } F1A43E1E-150B-4a8a-8DFF-5E9504819A83 ObjPoolPutObject #version 0 #type Event 0 { ProcessId, ItemULong ApplicationID, ItemGUID PartitionID, ItemGUID AppInstanceID, ItemGUID

ComputerName, ItemWChar[256] ObjectGuid, ItemGUID Reason, ItemLong AvailableObjects, ItemULong ObjectID, ItemULongLong } D3B13BA9-E13C-42a5-AB9D-A765EABD8DD7 ObjPoolGetObject #version 0 #type Event 0 { ProcessId, ItemULong ApplicationID, ItemGUID PartitionID, ItemGUID AppInstanceID, ItemGUID ComputerName, ItemWChar[256] ActivityGuid, ItemGUID ObjectGuid, ItemGUID AvailableObjects, ItemULong ObjectID, ItemULongLong } 6251827A-9115-41ca-A3B7-2073CD25EB87 ObjPoolRecycleToTx #version 0 #type Event 0 { ProcessId, ItemULong ApplicationID, ItemGUID PartitionID, ItemGUID AppInstanceID, ItemGUID ComputerName, ItemWChar[256] ActivityGuid, ItemGUID ObjectGuid, ItemGUID TransactionGuid, ItemGUID ObjectID, ItemULongLong } 3ED9E879-E0CB-432a-B29E-3440BE825B5C ObjPoolGetFromTx #version 0 #type Event 0 { ProcessId, ItemULong ApplicationID, ItemGUID PartitionID, ItemGUID AppInstanceID, ItemGUID ComputerName, ItemWChar[256] ActivityGuid, ItemGUID ObjectGuid, ItemGUID TransactionGuid, ItemGUID ObjectID, ItemULongLong } 880F56F9-5B21-4d36-8C8E-95FF4283006F ObjPoolCreateDecision #version 0 #type Event 0 { ProcessId, ItemULong ApplicationID, ItemGUID PartitionID, ItemGUID AppInstanceID, ItemGUID

ComputerName, ItemWChar[256] ObjectGuid, ItemGUID ThreadsWaiting, ItemULong AvailableObjects, ItemULong CreatedObjects, ItemULong Minimum, ItemULong Maximum, ItemULong } 664E7E9A-458C-4b84-BF3A-C9877D929D00 ObjPoolTimeout #version 0 #type Event 0 { ProcessId, ItemULong ApplicationID, ItemGUID PartitionID, ItemGUID AppInstanceID, ItemGUID ComputerName, ItemWChar[256] ObjectGuid, ItemGUID ActivityGuid, ItemGUID Timeout, ItemULong } E68E1870-CB15-4d2d-986E-E9E6D1B2E656 ObjPoolCreatePool #version 0 #type Event 0 { ProcessId, ItemULong ApplicationID, ItemGUID PartitionID, ItemGUID AppInstanceID, ItemGUID ComputerName, ItemWChar[256] ObjectGuid, ItemGUID Minimum, ItemULong Maximum, ItemULong Timeout, ItemULong } B896121F-0C4F-47e1-AD15-C7B0AA4491C4 AppActivation #version 0 #type Event 0 { ProcessId, ItemULong ApplicationID, ItemGUID PartitionID, ItemGUID AppInstanceID, ItemGUID ComputerName, ItemWChar[256] AppID, ItemGUID } E90FF16B-2AC0-40b0-9F84-CB742C468CB2 AppShutdown #version 0 #type Event 0 { ProcessId, ItemULong ApplicationID, ItemGUID PartitionID, ItemGUID AppInstanceID, ItemGUID ComputerName, ItemWChar[256] AppID, ItemGUID

} 1114B062-2702-4b52-92D2-2EB11ABA646E AppForceShutdown #version 0 #type Event 0 { ProcessId, ItemULong ApplicationID, ItemGUID PartitionID, ItemGUID AppInstanceID, ItemGUID ComputerName, ItemWChar[256] AppID, ItemGUID } DA6C4250-BC95-45f0-AB49-CC4D605ECF41 ThreadStart #version 0 #type Event 0 { ProcessId, ItemULong ApplicationID, ItemGUID PartitionID, ItemGUID AppInstanceID, ItemGUID ComputerName, ItemWChar[256] TThreadID, ItemULongLong SystemThread, ItemULong ThreadCount, ItemULong } 1DAE16A8-E038-46bc-B27A-8609E643099B ThreadTerminate #version 0 #type Event 0 { ProcessId, ItemULong ApplicationID, ItemGUID PartitionID, ItemGUID AppInstanceID, ItemGUID ComputerName, ItemWChar[256] TThreadID, ItemULongLong SystemThread, ItemULong ThreadCount, ItemULong } 6818FD0A-C7F3-406f-91F4-7600978CC3C9 ThreadBindToApt #version 0 #type Event 0 { ProcessId, ItemULong ApplicationID, ItemGUID PartitionID, ItemGUID AppInstanceID, ItemGUID ComputerName, ItemWChar[256] TThreadID, ItemULongLong AptID, ItemULongLong ActivitiesCount, ItemULong LowCount, ItemULong } 440EA498-EB7E-4b70-A1E3-9A91861CD6C3 ThreadUnbind #version 0 #type Event 0

{ ProcessId, ItemULong ApplicationID, ItemGUID PartitionID, ItemGUID AppInstanceID, ItemGUID ComputerName, ItemWChar[256] TThreadID, ItemULongLong AptID, ItemULongLong ActivitiesCount, ItemULong } E9EBBACC-7A92-40f3-80AF-783535CBD118 ThreadAssignApt #version 0 #type Event 0 { ProcessId, ItemULong ApplicationID, ItemGUID PartitionID, ItemGUID AppInstanceID, ItemGUID ComputerName, ItemWChar[256] ActivityGuid, ItemGUID AptID, ItemULongLong } 72502A15-B665-4f5b-A319-E395CCA92393 ThreadUnassignApt #version 0 #type Event 0 { ProcessId, ItemULong ApplicationID, ItemGUID PartitionID, ItemGUID AppInstanceID, ItemGUID ComputerName, ItemWChar[256] AptID, ItemULongLong } 1E9E83C5-C5C8-4a2d-AB63-8469C296764B CreateInstance #version 0 #type Event 0 { ProcessId, ItemULong ApplicationID, ItemGUID PartitionID, ItemGUID AppInstanceID, ItemGUID ComputerName, ItemWChar[256] ActivityGuid, ItemGUID CLSID, ItemGUID TSID, ItemGUID ContextID, ItemULongLong ObjectID, ItemULongLong } 3A446C03-769E-4dca-8F59-8F5FA7761FAB DestroyInstance #version 0 #type Event 0 { ProcessId, ItemULong ApplicationID, ItemGUID PartitionID, ItemGUID AppInstanceID, ItemGUID

ComputerName, ItemWChar[256] ContextID, ItemULongLong } 3F2E0CEB-6C34-4ae2-9475-A01B086E8C60 TransactionStart #version 0 #type Event 0 { ProcessId, ItemULong ApplicationID, ItemGUID PartitionID, ItemGUID AppInstanceID, ItemGUID ComputerName, ItemWChar[256] TransactionGuid, ItemGUID TSID, ItemGUID Root, ItemBool } DA92FF99-95C0-43d5-9A7D-6C23C15E2FE7 TransactionPrepare #version 0 #type Event 0 { ProcessId, ItemULong ApplicationID, ItemGUID PartitionID, ItemGUID AppInstanceID, ItemGUID ComputerName, ItemWChar[256] TransactionGuid, ItemGUID VoteYes, ItemBool } BE2B8AA1-1FEF-4ded-907D-CDCE5849008E TransactionAbort #version 0 #type Event 0 { ProcessId, ItemULong ApplicationID, ItemGUID PartitionID, ItemGUID AppInstanceID, ItemGUID ComputerName, ItemWChar[256] TransactionGuid, ItemGUID } C67F7946-4630-4c77-B4F6-88C6ABE65F12 TransactionCommit #version 0 #type Event 0 { ProcessId, ItemULong ApplicationID, ItemGUID PartitionID, ItemGUID AppInstanceID, ItemGUID ComputerName, ItemWChar[256] TransactionGuid, ItemGUID } BAC5C1AE-009D-4e09-9A0A-FD88BB31A1E8 MethodCall #version 0 #type Event 0 { ProcessId, ItemULong

ApplicationID, ItemGUID PartitionID, ItemGUID AppInstanceID, ItemGUID ComputerName, ItemWChar[256] ObjectID, ItemULongLong CLSID, ItemGUID IID, ItemGUID MethodIndex, ItemULong } F0B30BEC-DB18-478c-9221-EAA208CBB5AE MethodReturn #version 0 #type Event 0 { ProcessId, ItemULong ApplicationID, ItemGUID PartitionID, ItemGUID AppInstanceID, ItemGUID ComputerName, ItemWChar[256] ObjectID, ItemULongLong CLSID, ItemGUID IID, ItemGUID MethodIndex, ItemULong HResult, ItemLong } 91D068A5-0B98-48f1-A0CF-AB8626CA5147 MethodException #version 0 #type Event 0 { ProcessId, ItemULong ApplicationID, ItemGUID PartitionID, ItemGUID AppInstanceID, ItemGUID ComputerName, ItemWChar[256] ObjectID, ItemULongLong CLSID, ItemGUID IID, ItemGUID MethodIndex, ItemULong } 8FE5F194-CF29-4eff-A5AA-A54AD7F4F131 DisableCommit #version 0 #type Event 0 { ProcessId, ItemULong ApplicationID, ItemGUID PartitionID, ItemGUID AppInstanceID, ItemGUID ComputerName, ItemWChar[256] ContextID, ItemULongLong } 37276016-0EBD-432a-8333-D84821AB3863 EnableCommit #version 0 #type Event 0 { ProcessId, ItemULong ApplicationID, ItemGUID PartitionID, ItemGUID

AppInstanceID, ItemGUID ComputerName, ItemWChar[256] ContextID, ItemULongLong } AB095D80-3E83-4597-8007-00803D50DF86 SetComplete #version 0 #type Event 0 { ProcessId, ItemULong ApplicationID, ItemGUID PartitionID, ItemGUID AppInstanceID, ItemGUID ComputerName, ItemWChar[256] ContextID, ItemULongLong } 9A39AA4F-63DB-42ec-A59E-DD116F57A247 SetAbort #version 0 #type Event 0 { ProcessId, ItemULong ApplicationID, ItemGUID PartitionID, ItemGUID AppInstanceID, ItemGUID ComputerName, ItemWChar[256] ContextID, ItemULongLong } A6D75196-3DDC-4f35-9AB9-3CB121F28BAE Deactivate #version 0 #type Event 0 { ProcessId, ItemULong ApplicationID, ItemGUID PartitionID, ItemGUID AppInstanceID, ItemGUID ComputerName, ItemWChar[256] ContextID, ItemULongLong ObjectID, ItemULongLong } B0CE0D5B-05EC-4380-B225-2EEDA3903042 Activate #version 0 #type Event 0 { ProcessId, ItemULong ApplicationID, ItemGUID PartitionID, ItemGUID AppInstanceID, ItemGUID ComputerName, ItemWChar[256] ContextID, ItemULongLong ObjectID, ItemULongLong } 7649AF3C-3E56-47b7-9596-876FADD36B5D ResourceCreate #version 0 #type Event 0 { ProcessId, ItemULong

ApplicationID, ItemGUID PartitionID, ItemGUID AppInstanceID, ItemGUID ComputerName, ItemWChar[256] ObjectID, ItemULongLong ResourceID, ItemULongLong ResType, ItemWChar[64] Enlisted, ItemBool } 5BA81729-A69D-473e-B656-56C9C393A862 ResourceAllocate #version 0 #type Event 0 { ProcessId, ItemULong ApplicationID, ItemGUID PartitionID, ItemGUID AppInstanceID, ItemGUID ComputerName, ItemWChar[256] ObjectID, ItemULongLong ResourceID, ItemULongLong ResType, ItemWChar[64] Enlisted, ItemBool NumRated, ItemULong Rating, ItemULong } 4F0B170E-9065-4d5a-AD2C-7BFC0DAA0C93 ResourceRecycle #version 0 #type Event 0 { ProcessId, ItemULong ApplicationID, ItemGUID PartitionID, ItemGUID AppInstanceID, ItemGUID ComputerName, ItemWChar[256] ObjectID, ItemULongLong ResourceID, ItemULongLong ResType, ItemWChar[64] } 58CDFE25-2DC0-485b-981C-7A0B39B96FAB ResourceDestroy #version 0 #type Event 0 { ProcessId, ItemULong ApplicationID, ItemGUID PartitionID, ItemGUID AppInstanceID, ItemGUID ComputerName, ItemWChar[256] ObjectID, ItemULongLong ResourceID, ItemULongLong HResult, ItemLong ResType, ItemWChar[64] }

F96DE808-C2D7-43b3-8593-6BC1E772DB9B ResourceTrac #version 0 #type Event 0 {

ProcessId, ItemULong ApplicationID, ItemGUID PartitionID, ItemGUID AppInstanceID, ItemGUID ComputerName, ItemWChar[256] ObjectID, ItemULongLong ResourceID, ItemULongLong ResType, ItemWChar[64] Enlisted, ItemBool } CD6D18FC-31F0-4304-A5DF-BA2A15840266 Authenticate #version 0 #type Event 0 { ProcessId, ItemULong ApplicationID, ItemGUID PartitionID, ItemGUID AppInstanceID, ItemGUID ComputerName, ItemWChar[256] ActivityGuid, ItemGUID ObjectID, ItemULongLong IID, ItemGUID MethodIndex, ItemULong CurrentUserImpersonationInproc, ItemBool LengthOrigUserSID, ItemULong LengthCrtUserSID, ItemULong SIDsBuffer, ItemVariant } 03148C79-11DC-4b43-ACA3-65B11682CFF4 AuthenticateFail #version 0 #type Event 0 { ProcessId, ItemULong ApplicationID, ItemGUID PartitionID, ItemGUID AppInstanceID, ItemGUID ComputerName, ItemWChar[256] ActivityGuid, ItemGUID ObjectID, ItemULongLong IID, ItemGUID MethodIndex, ItemULong CurrentUserImpersonationInproc, ItemBool LengthOrigUserSID, ItemULong LengthCrtUserSID, ItemULong SIDsBuffer, ItemVariant } 9B3359DC-2B4C-46b4-A03A-7339AF71B765 ObjectConstruct #version 0 #type Event 0 { ProcessId, ItemULong ApplicationID, ItemGUID PartitionID, ItemGUID AppInstanceID, ItemGUID ComputerName, ItemWChar[256] ObjectGuid, ItemGUID ObjectID, ItemULongLong

ConstructString, ItemWChar[64] } C49B4FA9-20DF-4f48-82B2-C448DEF02DFC UserEvent #version 0 #type Event 0 { ProcessId, ItemULong ApplicationID, ItemGUID PartitionID, ItemGUID AppInstanceID, ItemGUID ComputerName, ItemWChar[256] Buffer, ItemVariant } 90B8FED5-7EEF-4107-B791-8CF15B2117F3 ActivityCreate #version 0 #type Event 0 { ProcessId, ItemULong ApplicationID, ItemGUID PartitionID, ItemGUID AppInstanceID, ItemGUID ComputerName, ItemWChar[256] ActivityGuid, ItemGUID } EDC039B9-84E7-4f69-937B-A08942719651 ActivityDestroy #version 0 #type Event 0 { ProcessId, ItemULong ApplicationID, ItemGUID PartitionID, ItemGUID AppInstanceID, ItemGUID ComputerName, ItemWChar[256] ActivityGuid, ItemGUID } 43B68014-2B7E-47ae-AFC2-E54184CFF71F ActivityEnter #version 0 #type Event 0 { ProcessId, ItemULong ApplicationID, ItemGUID PartitionID, ItemGUID AppInstanceID, ItemGUID ComputerName, ItemWChar[256] Current, ItemGUID Entered, ItemGUID SystemThread, ItemULong } E7D21C91-3CBE-4340-B605-0EBB0FE32E2F ActivityTimeout #version 0 #type Event 0 { ProcessId, ItemULong ApplicationID, ItemGUID PartitionID, ItemGUID

AppInstanceID, ItemGUID ComputerName, ItemWChar[256] Current, ItemGUID Entered, ItemGUID SystemThread, ItemULong Timeout, ItemULong } F2013085-1572-490b-93BE-BE3AB406955C ActivityReenter #version 0 #type Event 0 { ProcessId, ItemULong ApplicationID, ItemGUID PartitionID, ItemGUID AppInstanceID, ItemGUID ComputerName, ItemWChar[256] Current, ItemGUID SystemThread, ItemULong CallDepth, ItemULong } C589CFD4-D3AC-4cdd-B157-22C53234A63A ActivityLeave #version 0 #type Event 0 { ProcessId, ItemULong ApplicationID, ItemGUID PartitionID, ItemGUID AppInstanceID, ItemGUID ComputerName, ItemWChar[256] Current, ItemGUID Left, ItemGUID } 53F94E5B-7F22-4d2b-A1CC-510BEF6FA833 ActivityLeaveSame #version 0 #type Event 0 { ProcessId, ItemULong ApplicationID, ItemGUID PartitionID, ItemGUID AppInstanceID, ItemGUID ComputerName, ItemWChar[256] Current, ItemGUID CallDepth, ItemULong } 7172CA53-633A-4f56-A947-07567258849E IISRequestInfo #version 0 #type Event 0 { ProcessId, ItemULong ApplicationID, ItemGUID PartitionID, ItemGUID AppInstanceID, ItemGUID ComputerName, ItemWChar[256] ObjectID, ItemULongLong ClientIP, ItemWChar[16] ServerIP, ItemWChar[16]

URL, ItemWChar[128] } 4F0960DD-568B-4391-9F72-134C5670E7C8 QCRecord #version 0 #type Event 0 { ProcessId, ItemULong ApplicationID, ItemGUID PartitionID, ItemGUID AppInstanceID, ItemGUID ComputerName, ItemWChar[256] ObjectID, ItemULongLong Queue, ItemWChar[60] MsgID, ItemGUID Wor flow, ItemGUID MSMQhresult, ItemLong } 71925AE2-8133-425d-BF0D-21662BAFF1FC QCQueueOpen #version 0 #type Event 0 { ProcessId, ItemULong ApplicationID, ItemGUID PartitionID, ItemGUID AppInstanceID, ItemGUID ComputerName, ItemWChar[256] Queue, ItemWChar[60] QueueID, ItemULongULong MSMQhresult, ItemLong } 71955D87-4448-4e7b-BA4E-7873C11AABA3 QCReceive #version