﻿<?xml version="1.0" encoding="utf-8" standalone='yes'?>

<WindowsPerformanceRecorder Version="1.0" Author="EcoSystem Assessments and Analysis" Team="EcoSystem Assessments and Analysis" Comments="IE" Company="Microsoft Corporation" Copyright="Microsoft Corporation" Tag="FAS">
    <Profiles>
        <!-- System Providers -->
        <SystemProvider Id="SystemProvider_IEMalwarePerf_Without_Stacks" Base="SystemProvider_CPU_Without_Stacks">
            <Keywords Operation="Add">
                <Keyword Value="DiskIO"/>
                <Keyword Value="FileIO"/>
                <Keyword Value="FileIOInit"/>
                <Keyword Value="Filename"/>
            </Keywords>
        </SystemProvider>
        <SystemProvider Id="SystemProvider_IEMalwarePerf" Base="SystemProvider_CPU">
            <Keywords Operation="Add">
                <Keyword Value="DiskIO"/>
                <Keyword Value="FileIO"/>
                <Keyword Value="FileIOInit"/>
                <Keyword Value="Filename"/>
            </Keywords>
            <Stacks Operation="Add">
                <Stack Value="FileCleanup"/>
                <Stack Value="FileClose"/>
                <Stack Value="FileCreate"/>
                <Stack Value="FileDelete"/>
                <Stack Value="FileDirEnum"/>
                <Stack Value="FileDirNotify"/>
                <Stack Value="FileFlush"/>
                <Stack Value="FileFSCTL"/>
                <Stack Value="FileOpEnd"/>
                <Stack Value="FileQueryInformation"/>
                <Stack Value="FileRead"/>
                <Stack Value="FileRename"/>
                <Stack Value="FileSetInformation"/>
                <Stack Value="FileWrite"/>
                <Stack Value="ThreadDCEnd"/>
            </Stacks>
        </SystemProvider>
        
        <!-- Event Providers -->
        <EventProvider Id="EventProvider_Microsoft-IE" Name="Microsoft-IE">
            <Keywords>
                <Keyword Value="0x00801300"/>
            </Keywords>
        </EventProvider>
        <EventProvider Id="EventProvider_Microsoft-IEFrame" Name="Microsoft-IEFrame">
            <Keywords>
                <Keyword Value="0x00000100"/>
            </Keywords>
        </EventProvider>
        <EventProvider Id="EventProvider_Microsoft-Windows-ProcessStateManager" Name="Microsoft-Windows-ProcessStateManager">
            <Keywords>
                <Keyword Value="0x00000000"/>
            </Keywords>
        </EventProvider>
        <EventProvider Id="EventProvider_PerfTrack" Name="PerfTrack" />
        <EventProvider Id="EventProvider_PerfTrack_MSHTML" Name="ffdb9886-80f3-4540-aa8b-b85192217ddf"/>

        <EventProvider Id="EventProvider_Microsoft-Windows-TCPIP" Name="Microsoft-Windows-TCPIP" />
        <EventProvider Id="EventProvider_Microsoft-Windows-WinINet" Name="Microsoft-Windows-WinINet">
            <Keywords>
                <Keyword Value="0x00000000"/>
            </Keywords>
        </EventProvider>
        <EventProvider Id="EventProvider_Microsoft-Windows-Win32k" Name="Microsoft-Windows-Win32k" NonPagedMemory="true">
            <Keywords>
                <Keyword Value="0x00002000"/>
            </Keywords>
        </EventProvider>

        <!-- Profiles -->
        <Profile Id="IEMalwarePerf.Light.File" Base="BaseProfile.Light" LoggingMode="File" Name="IEMalwarePerf" DetailLevel="Light" Description="IEMalwarePerf Timing">
            <Collectors Operation="Add">
                <SystemCollectorId Value="SystemCollector_WPRSystemCollectorInFile">
                    <SystemProviderId Value="SystemProvider_IEMalwarePerf_Without_Stacks" />
                </SystemCollectorId>
                <EventCollectorId Value="EventCollector_WPREventCollectorInFile">
                    <EventProviders Operation="Add">
                        <EventProviderId Value="EventProvider_Microsoft-IE"/>
                        <EventProviderId Value="EventProvider_Microsoft-IEFrame"/>
                        <EventProviderId Value="EventProvider_Microsoft-Windows-TCPIP"/>
                        <EventProviderId Value="EventProvider_Microsoft-Windows-WinINet"/>
                        <EventProviderId Value="EventProvider_Microsoft-Windows-ProcessStateManager" />
                        <EventProviderId Value="EventProvider_PerfTrack"/>
                        <EventProviderId Value="EventProvider_PerfTrack_MSHTML" />
                        <EventProviderId Value="EventProvider_Microsoft-Windows-Win32k"/>
                        <EventProvider Id="Microsoft-Windows-AssessmentExecutionEngine"
                                       Name="6FE1CBF0-A23C-41FE-93BA-6929AC3AB4E7"/>
                    </EventProviders>
                </EventCollectorId>
            </Collectors>
        </Profile>

        <Profile Id="IEMalwarePerf.Light.Memory" Base="BaseProfile.Light" LoggingMode="Memory" Name="IEMalwarePerf" DetailLevel="Light" Description="IEMalwarePerf Timing">
            <Collectors Operation="Add">
                <SystemCollectorId Value="SystemCollector_WPRSystemCollectorInMemory">
                    <SystemProviderId Value="SystemProvider_IEMalwarePerf_Without_Stacks" />
                </SystemCollectorId>
                <EventCollectorId Value="EventCollector_WPREventCollectorInMemoryMedium">
                    <EventProviders Operation="Add">
                        <EventProviderId Value="EventProvider_Microsoft-IE"/>
                        <EventProviderId Value="EventProvider_Microsoft-IEFrame"/>
                        <EventProviderId Value="EventProvider_Microsoft-Windows-TCPIP"/>
                        <EventProviderId Value="EventProvider_Microsoft-Windows-WinINet"/>
                        <EventProviderId Value="EventProvider_Microsoft-Windows-ProcessStateManager" />
                        <EventProviderId Value="EventProvider_PerfTrack"/>
                        <EventProviderId Value="EventProvider_PerfTrack_MSHTML" />
                        <EventProviderId Value="EventProvider_Microsoft-Windows-Win32k"/>
                        <EventProvider Id="Microsoft-Windows-AssessmentExecutionEngine"
                                       Name="6FE1CBF0-A23C-41FE-93BA-6929AC3AB4E7"/>
                    </EventProviders>
                </EventCollectorId>
            </Collectors>
        </Profile>

        <Profile Id="IEMalwarePerf.Verbose.File" Base="BaseProfile.Light" LoggingMode="File" Name="IEMalwarePerf" DetailLevel="Verbose" Description="IEMalwarePerf Diagnostic">
            <Collectors Operation="Add">
                <SystemCollectorId Value="SystemCollector_WPRSystemCollectorInFile">
                    <SystemProviderId Value="SystemProvider_IEMalwarePerf" />
                </SystemCollectorId>
                <EventCollectorId Value="EventCollector_WPREventCollectorInFile">
                    <EventProviders Operation="Add">
                        <EventProviderId Value="EventProvider_Microsoft-IE"/>
                        <EventProviderId Value="EventProvider_Microsoft-IEFrame"/>
                        <EventProviderId Value="EventProvider_Microsoft-Windows-TCPIP"/>
                        <EventProviderId Value="EventProvider_Microsoft-Windows-WinINet"/>
                        <EventProviderId Value="EventProvider_Microsoft-Windows-ProcessStateManager" />
                        <EventProviderId Value="EventProvider_PerfTrack"/>
                        <EventProviderId Value="EventProvider_PerfTrack_MSHTML" />
                        <EventProviderId Value="EventProvider_Microsoft-Windows-Win32k"/>
                        <EventProvider Id="Microsoft-Windows-AssessmentExecutionEngine"
                                       Name="6FE1CBF0-A23C-41FE-93BA-6929AC3AB4E7"/>
                    </EventProviders>
                </EventCollectorId>
            </Collectors>
        </Profile>

        <Profile Id="IEMalwarePerf.Verbose.Memory" Base="BaseProfile.Light" LoggingMode="Memory" Name="IEMalwarePerf" DetailLevel="Verbose" Description="IEMalwarePerf Diagnostic">
            <Collectors Operation="Add">
                <SystemCollectorId Value="SystemCollector_WPRSystemCollectorInMemory">
                    <SystemProviderId Value="SystemProvider_IEMalwarePerf" />
                </SystemCollectorId>
                <EventCollectorId Value="EventCollector_WPREventCollectorInMemoryLarge">
                    <EventProviders Operation="Add">
                        <EventProviderId Value="EventProvider_Microsoft-IE"/>
                        <EventProviderId Value="EventProvider_Microsoft-IEFrame"/>
                        <EventProviderId Value="EventProvider_Microsoft-Windows-TCPIP"/>
                        <EventProviderId Value="EventProvider_Microsoft-Windows-WinINet"/>
                        <EventProviderId Value="EventProvider_Microsoft-Windows-ProcessStateManager" />
                        <EventProviderId Value="EventProvider_PerfTrack"/>
                        <EventProviderId Value="EventProvider_PerfTrack_MSHTML" />
                        <EventProviderId Value="EventProvider_Microsoft-Windows-Win32k"/>
                        <EventProvider Id="Microsoft-Windows-AssessmentExecutionEngine"
                                       Name="6FE1CBF0-A23C-41FE-93BA-6929AC3AB4E7"/>
                    </EventProviders>
                </EventCollectorId>
            </Collectors>
        </Profile>
    </Profiles>

    <TraceMergeProperties>
        <TraceMergeProperty  Id="Default" Name="Default" Base="">
            <DeletePreMergedTraceFiles Value="true"/>
            <CustomEvents>
                <CustomEvent Value="ImageId"/>
                <CustomEvent Value="BuildInfo"/>
                <CustomEvent Value="VolumeMapping"/>
                <CustomEvent Value="EventMetadata"/>
                <CustomEvent Value="WinSAT"/>
                <CustomEvent Value="NetworkInterface"/>
            </CustomEvents>
        </TraceMergeProperty>
    </TraceMergeProperties>

</WindowsPerformanceRecorder>


