XML schema for OS changes—Windows

<!-- Version: 2.08 -->re
<xs:schema xmlns:xs="http://www.w3.org/2001/XMLSchema" elementFormDefault="qualified">
<xs:include schemaLocation="CommonOSCDataSet.xsd"/>

<xs:complexType name="OSCChangeSet">
   <xs:sequence>
	<xs:element ref="analysis" minOccurs="0"/>
	   <xs:element ref="os" minOccurs="0"/>
	   <xs:element ref="os_monitor" minOccurs="0"/>
	   <xs:element ref="event_logger" minOccurs="0"/>
	   <xs:choice maxOccurs="unbounded" minOccurs="0">
	   <xs:element ref="apicall"/>
	   <xs:element ref="codeinjection"/>
	   <xs:element ref="driver"/>
	   <xs:element ref="exploitcode"/>
	   <xs:element ref="file"/>
	   <xs:element ref="folder"/>
	   <xs:element ref="heapspraying"/>
	   <xs:element ref="mutex"/>
	   <xs:element ref="network"/>
	   <xs:element ref="process"/>
	   <xs:element ref="process-packed"/>
	   <xs:element ref="processstats"/>
	   <xs:element ref="regkey"/>
	   <xs:element ref="uac"/>
	   <xs:element ref="keyloggerdetected"/>
	   <xs:element ref="HardwareAccessDetection"/>
	   <xs:element name="filetype" type="xs:string" minOccurs="0"/>
	   <xs:element ref="dll-loaded"/>
	   <xs:element ref="appexception"/>
	   <xs:element ref="debugcontrol"/>
	   <xs:element ref="hiddenproc"/>
	   <xs:element ref="dll-exports"/>
	   <xs:element ref="guestos-not-pingable"/>
	   <xs:element ref="SSDT"/>
	   <xs:element ref="spooler-dll-injection"/>
	   <xs:element ref="detection-monitor-killed"/>
	   <xs:element ref="started"/>
	   <xs:element ref="firefox"/>
	   <xs:element ref="AsyncKeyLogger"/>
	   <xs:element ref="CmdLine"/>
	   <xs:element ref="systemshutdown"/>
	   <xs:element ref="os-inactivity-send-keys"/>
	   <xs:element ref="dialog-dismissed"/>
	   <xs:element ref="dialog-detected"/>
	   <xs:element ref="new-dialog-popup"/>
	   <xs:element ref="api_patch"/>
	   <xs:element ref="thread"/>
	   <xs:element ref="stackpivot"/>
	   <xs:element ref="popup-dialog"/>
	   <xs:element ref="javacall"/>
	   <xs:element ref="javaevent"/>
	   <xs:element ref="eventlogcmd"/>
	   <xs:element ref="alive"/>
	   <xs:element ref="BootSectorModified"/>
	   <xs:element ref="application"/>
	   <xs:element ref="Ransom"/>
	   <xs:element ref="Infector"/>
	   <xs:element ref="Stealer"/>
	   <xs:element ref="appexception_data"/>
	   <xs:element ref="ProtectionChange"/>
	   <xs:element ref="EmbeddedObject"/>
	   <xs:element ref="custom-patch"/>
	   <xs:element ref="log"/>
	   <xs:element ref="Meterpreter"/>
	   <xs:element ref="browser-plugin-start"/>
	   <xs:element ref="high_cpu"/>
	   <xs:element ref="Quit"/>
	   <xs:element ref="invert_timing"/>
	   <xs:element ref="bugcheck"/>
	   <xs:element ref="FEChannel"/>
	   <xs:element ref="ProcessToken"/>
	   <xs:element ref="config-update"/>
	   <xs:element ref="internal-error"/>
	   <xs:element ref="SendMessage"/>
	   <xs:element ref="NullPageMapping"/>
	   <xs:element ref="kexploit"/>
	   <xs:element ref="KExploit"/>
	   <xs:element ref="Flash"/>
	   <xs:element ref="SMEP"/>
	   <xs:element ref="MSR"/>
	   <xs:element ref="action_fopen"/>
	   <xs:element ref="shellcode"/>
	   <xs:element ref="stackexec"/>
	   <xs:element ref="JSData"/>
	   <xs:element ref="FirstRpidMemOp"/>
	   <xs:element ref="MemBruteForce"/>
	   <xs:element ref="CmdOp"/>
	   <xs:element ref="MemInjectOp"/>
	   <xs:element ref="ExfilDetect"/>
	   <xs:element ref="Destructor"/>
	</xs:choice>
	<xs:element ref="ROP"/>
	<xs:element ref="end-of-report" minOccurs="0"/>
   </xs:sequence>
</xs:complexType>

<xs:element name="analysis">
   <xs:complexType>
	<xs:complexContent>
	   <xs:extension base="FeELEvent">
		<xs:all>
		   <xs:element name="rebootdependent" minOccurs="0" type="xs:string"/>
		   <xs:element name="spanalysis" minOccurs="0" type="xs:string"/>
		</xs:all>
		<xs:attribute name="mode" use="required" type="xs:string"/>
		<xs:attribute name="ftype" use="required" type="xs:string"/>
		<xs:attribute name="version" use="required" type="xs:string"/>
		<xs:attribute name="product" use="optional" type="xs:string"/>
		<xs:attribute name="type" use="optional" type="xs:string"/>
	   </xs:extension>
	</xs:complexContent>
   </xs:complexType>
</xs:element>

<xs:element name="os">
   <xs:complexType>
	<xs:complexContent>
	   <xs:extension base="FeELEvent">
		<xs:all>
		   <xs:element name="rebootdependent" minOccurs="0" type="xs:string"/>
		   <xs:element name="spanalysis" minOccurs="0" type="xs:string"/>
		</xs:all>
		<xs:attribute name="name" use="required" type="xs:string"/>
		<xs:attribute name="version" use="required" type="xs:string"/>
		<xs:attribute name="sp" use="optional" type="xs:string"/>
		<xs:attribute name="arch" use="optional" type="xs:string"/>
	   </xs:extension>
	</xs:complexContent>
   </xs:complexType>
</xs:element>

<xs:element name="os_monitor">
   <xs:complexType>
	<xs:complexContent>
	   <xs:extension base="FeELEvent">
		<xs:all>
		   <xs:element name="rebootdependent" minOccurs="0" type="xs:string"/>
		   <xs:element name="spanalysis" minOccurs="0" type="xs:string"/>
		</xs:all>
		<xs:attribute name="build" type="xs:integer"/>
		<xs:attribute name="date" type="xs:string"/>
		<xs:attribute name="time" type="xs:string"/>
		<xs:attribute name="version" use="optional" type="xs:string"/>
		<xs:attribute name="dtype" use="optional" type="xs:string"/>
	   </xs:extension>
	</xs:complexContent>
   </xs:complexType>
</xs:element>

<xs:element name="event_logger">
   <xs:complexType>
	<xs:complexContent>
	   <xs:extension base="FeELEvent">
		<xs:all>
		   <xs:element name="rebootdependent" minOccurs="0" type="xs:string"/>
		   <xs:element name="spanalysis" minOccurs="0" type="xs:string"/>
		</xs:all>
		<xs:attribute name="build" use="required" type="xs:string"/>
		<xs:attribute name="date" use="required" type="xs:string"/>
		<xs:attribute name="time" use="required" type="xs:string"/>
	   </xs:extension>
	</xs:complexContent>
   </xs:complexType>
</xs:element>

<xs:element name="keyloggerdetected">
   <xs:complexType>
	<xs:complexContent>
	   <xs:extension base="FeELEvent">
		<xs:all>
		   <xs:element ref="processinfo"/>
		   <xs:element name="idhook" type="xs:string" minOccurs="0"/>
		   <xs:element name="hookprocaddr" type="xs:string" minOccurs="0"/>
		   <xs:element name="moduleaddr" type="xs:string" minOccurs="0"/>
		   <xs:element name="threadid" type="xs:long" minOccurs="0"/>
		   <xs:element name="module-name" type="xs:string" minOccurs="0"/>
		   <xs:element ref="md5sum" minOccurs="0"/>
		   <xs:element ref="sha1sum" minOccurs="0"/>
		   <xs:element name="symbol-name" type="xs:string" minOccurs="0"/>
		   <xs:element name="symbol-displacement" type="xs:string" minOccurs="0"/>
		   <xs:element name="rebootdependent" minOccurs="0" type="xs:string"/>
		   <xs:element name="spanalysis" minOccurs="0" type="xs:string"/>
		</xs:all>
		<xs:attribute name="src_thread" use="optional" type="xs:string"/>
		<xs:attribute name="timestamp" use="optional" type="xs:integer"/>
		<xs:attribute name="repeat" use="optional" type="xs:integer"/>
	   </xs:extension>
	</xs:complexContent>
   </xs:complexType>
</xs:element>

<xs:element name="HardwareAccessDetection">
   <xs:complexType>
	<xs:complexContent>
	   <xs:extension base="FeELEvent">
		<xs:all>
		   <xs:element minOccurs="0" ref="processinfo"/>
		   <xs:element minOccurs="0" name="function" type="xs:string"/>
		   <xs:element minOccurs="0" name="device" type="xs:string"/>
		   <xs:element minOccurs="0" name="handle" type="xs:string"/>
		   <xs:element minOccurs="0" name="size" type="xs:string"/>
		   <xs:element minOccurs="0" ref="address"/>
		   <xs:element name="rebootdependent" minOccurs="0" type="xs:string"/>
		   <xs:element name="spanalysis" minOccurs="0" type="xs:string"/>
		</xs:all>
		<xs:attribute name="src_thread" use="optional" type="xs:string"/>
		<xs:attribute name="timestamp" use="optional" type="xs:integer"/>
		<xs:attribute name="repeat" use="optional" type="xs:string"/>
	   </xs:extension>
	</xs:complexContent>
   </xs:complexType>
</xs:element>

<xs:element name="api_trace">
   <xs:complexType>
	<xs:complexContent>
	   <xs:extension base="FeELEvent">
		<xs:all>
		   <xs:element minOccurs="0" ref="processinfo"/>
		   <xs:element name="apilib" minOccurs="0" type="xs:string"/>
		   <xs:element name="apiname" minOccurs="0" type="xs:string"/>
		   <xs:element name="ip" minOccurs="0" type="xs:string"/>
		   <xs:element name="rebootdependent" minOccurs="0" type="xs:string"/>
		   <xs:element name="spanalysis" minOccurs="0" type="xs:string"/>
		</xs:all>
		<xs:attribute name="dtype" use="optional" type="xs:string"/>
	   </xs:extension>
	</xs:complexContent>
   </xs:complexType>
</xs:element>

<xs:element name="foreign_file_load">
   <xs:complexType>
	<xs:complexContent>
	   <xs:extension base="FeELEvent">
		<xs:all>
		   <xs:element name="file" type="xs:string" minOccurs="0"/>
		   <xs:element ref="into" minOccurs="0"/>
		   <xs:element name="rebootdependent" minOccurs="0" type="xs:string"/>
		   <xs:element name="spanalysis" minOccurs="0" type="xs:string"/>
		</xs:all>
		<xs:attribute name="dtype" use="optional" type="xs:string"/>
	   </xs:extension>
	</xs:complexContent>
   </xs:complexType>
</xs:element>

<xs:element name="low_level_sleep">
   <xs:complexType>
	<xs:complexContent>
	   <xs:extension base="FeELEvent">
		<xs:all>
		   <xs:element minOccurs="0" ref="processinfo"/>
		   <xs:element name="rebootdependent" minOccurs="0" type="xs:string"/>
		   <xs:element name="spanalysis" minOccurs="0" type="xs:string"/>
		</xs:all>
		<xs:attribute name="dtype" use="optional" type="xs:string"/>
	   </xs:extension>
	</xs:complexContent>
   </xs:complexType>
</xs:element>

<xs:element name="dll-loaded">
   <xs:complexType>
	<xs:complexContent>
	   <xs:extension base="FeELEvent">
		<xs:all>
		   <xs:element ref="processinfo" minOccurs="0"/>
		   <xs:element name="dllpath" type="xs:string" minOccurs="0"/>
		   <xs:element ref="md5sum" minOccurs="0"/>
		   <xs:element ref="sha1sum" minOccurs="0"/>
		   <xs:element name="rebootdependent" minOccurs="0" type="xs:string"/>
		   <xs:element name="spanalysis" minOccurs="0" type="xs:string"/>
		</xs:all>
		<xs:attribute name="src_thread" use="optional" type="xs:string"/>
		<xs:attribute name="timestamp" use="optional" type="xs:integer"/>
		<xs:attribute name="repeat" use="optional" type="xs:integer"/>
	   </xs:extension>
	</xs:complexContent>
   </xs:complexType>
</xs:element>

<xs:element name="apicall">
   <xs:complexType>
	<xs:complexContent>
	   <xs:extension base="FeELEvent">
		<xs:all>
		   <xs:element ref="processinfo"/>
		   <xs:element ref="dllname"/>
		   <xs:element ref="apiname"/>
		   <xs:element ref="address"/>
		   <xs:element ref="params" minOccurs="0"/>
		   <xs:element name="options" type="xs:string" minOccurs="0"/>
		   <xs:element name="assembly" type="xs:string" minOccurs="0"/>
		   <xs:element ref="callsites" minOccurs="0"/>
		   <xs:element name="rebootdependent" minOccurs="0" type="xs:string"/>
		   <xs:element name="spanalysis" minOccurs="0" type="xs:string"/>
		</xs:all>
		<xs:attribute name="dtype" use="optional" type="xs:string"/>
		<xs:attribute name="type" use="optional" type="xs:string"/>
		<xs:attribute name="repeat" use="optional" type="xs:long"/>
		<xs:attribute name="src_thread" use="optional" type="xs:string"/>
		<xs:attribute name="timestamp" use="optional" type="xs:integer"/>
	   </xs:extension>
	</xs:complexContent>
   </xs:complexType>
</xs:element>

<xs:element name="from">
   <xs:complexType>
	<xs:sequence>
	   <xs:element ref="processinfo"/>
	</xs:sequence>
	<xs:attribute name="tainted" use="optional" type="xs:string"/>
   </xs:complexType>
</xs:element>
<xs:element name="into">
   <xs:complexType>
	<xs:sequence>
	   <xs:element ref="processinfo"/>
	</xs:sequence>
	<xs:attribute name="tainted" use="optional" type="xs:string"/>
   </xs:complexType>
</xs:element>

<xs:element name="vbr_change">
   <xs:complexType>
	<xs:complexContent>
	   <xs:extension base="FeELEvent">
		<xs:all>
		   <xs:element ref="processinfo" minOccurs="0"/>
		   <xs:element name="partition" minOccurs="0" type="xs:integer"/>
		   <xs:element name="md5_original" minOccurs="0" type="xs:string"/>
		   <xs:element name="md5_current" minOccurs="0" type="xs:string"/>
		   <xs:element name="rebootdependent" minOccurs="0" type="xs:string"/>
		   <xs:element name="spanalysis" minOccurs="0" type="xs:string"/>
		</xs:all>
		<xs:attribute name="dtype" use="required" type="xs:string"/>
	   </xs:extension>
	</xs:complexContent>
   </xs:complexType>
</xs:element>

<xs:element name="prop">
   <xs:complexType>
	<xs:simpleContent>
	   <xs:extension base="xs:string">
		<xs:attribute name="pname" use="optional" type="xs:string"/>
		<xs:attribute name="chunk" use="optional" type="xs:integer"/>
	   </xs:extension>
	</xs:simpleContent>
   </xs:complexType>
</xs:element>

<xs:element name="doc_summary">
   <xs:complexType>
	<xs:complexContent>
	   <xs:extension base="FeELEvent">
		<xs:sequence>
		   <xs:element ref="processinfo" minOccurs="0"/>
		   <xs:element minOccurs="0" maxOccurs="unbounded" ref="prop"/>
		   <xs:element name="rebootdependent" minOccurs="0" type="xs:string"/>
		   <xs:element name="spanalysis" minOccurs="0" type="xs:string"/>
		</xs:sequence>
		<xs:attribute name="Application" use="optional" type="xs:string"/>
		<xs:attribute name="timestamp" use="optional" type="xs:integer"/>
		<xs:attribute name="mode" use="optional" type="xs:string"/>
		<xs:attribute name="count" use="optional" type="xs:integer"/>
		<xs:attribute name="close-handler" use="optional" type="xs:integer"/>
		<xs:attribute name="open-handler" use="optional" type="xs:integer"/>
		<xs:attribute name="macro-protected" use="optional" type="xs:string"/>
	   </xs:extension>
	</xs:complexContent>
   </xs:complexType>
</xs:element>

<xs:element name="xaw_bin">
   <xs:complexType>
	<xs:complexContent>
	   <xs:extension base="FeELEvent">
		<xs:all>
		   <xs:element ref="processinfo" minOccurs="0"/>
		   <xs:element name="InstructionPointer" minOccurs="0" type="xs:string"/>
		   <xs:element name="WritingModule" minOccurs="0" type="xs:string"/>
		   <xs:element name="WrittenModule" minOccurs="0" type="xs:string"/>
		   <xs:element name="rebootdependent" minOccurs="0" type="xs:string"/>
		   <xs:element name="spanalysis" minOccurs="0" type="xs:string"/>
		</xs:all>
		<xs:attribute name="dtype" use="required" type="xs:string"/>
		<xs:attribute name="type" use="required" type="xs:string"/>
	   </xs:extension>
	</xs:complexContent>
   </xs:complexType>
</xs:element>

<xs:element name="kci">
   <xs:complexType>
	<xs:complexContent>
	   <xs:extension base="FeELEvent">
		<xs:all>
		   <xs:element ref="processinfo" minOccurs="0"/>
		   <xs:element name="InstructionPointer" minOccurs="0" type="xs:string"/>
		   <xs:element name="rebootdependent" minOccurs="0" type="xs:string"/>
		   <xs:element name="spanalysis" minOccurs="0" type="xs:string"/>
		</xs:all>
		<xs:attribute name="dtype" use="required" type="xs:string"/>
		<xs:attribute name="type" use="required" type="xs:string"/>
	   </xs:extension>
	</xs:complexContent>
   </xs:complexType>
</xs:element>

<xs:element name="mbr_change">
   <xs:complexType>
	<xs:complexContent>
	   <xs:extension base="FeELEvent">
		<xs:all>
		   <xs:element ref="processinfo" minOccurs="0"/>
		   <xs:element name="md5_original" minOccurs="0" type="xs:string"/>
		   <xs:element name="md5_current" minOccurs="0" type="xs:string"/>
		   <xs:element name="rebootdependent" minOccurs="0" type="xs:string"/>
		   <xs:element name="spanalysis" minOccurs="0" type="xs:string"/>
		</xs:all>
		<xs:attribute name="dtype" use="required" type="xs:string"/>
	   </xs:extension>
	</xs:complexContent>
   </xs:complexType>
</xs:element>

<xs:element name="code_injection">
   <xs:complexType>
	<xs:complexContent>
	   <xs:extension base="FeELEvent">
		<xs:all>
		   <xs:element ref="from" minOccurs="0"/>
		   <xs:element ref="into" minOccurs="0"/>
		   <xs:element name="ip" minOccurs="0" type="xs:string"/>
		   <xs:element name="rebootdependent" minOccurs="0" type="xs:string"/>
		   <xs:element name="spanalysis" minOccurs="0" type="xs:string"/>
		</xs:all>
		<xs:attribute name="dtype" use="required" type="xs:string"/>
	   </xs:extension>
	</xs:complexContent>
   </xs:complexType>
</xs:element>

<xs:element name="dll_load">
   <xs:complexType>
	<xs:complexContent>
	   <xs:extension base="FeELEvent">
		<xs:all>
		   <xs:element name="dll" minOccurs="0" type="xs:string"/>
		   <xs:element ref="into" minOccurs="0"/>
		   <xs:element name="rebootdependent" minOccurs="0" type="xs:string"/>
		   <xs:element name="spanalysis" minOccurs="0" type="xs:string"/>
		</xs:all>
		<xs:attribute name="dtype" use="required" type="xs:string"/>
	   </xs:extension>
	</xs:complexContent>
   </xs:complexType>
</xs:element>

<xs:element name="codeinjection">
   <xs:complexType>
	<xs:complexContent>
	   <xs:extension base="FeELEvent">
		<xs:all>
		   <xs:element ref="source" minOccurs="0"/>
		   <xs:element ref="target" minOccurs="0"/>
		   <xs:element name="rebootdependent" minOccurs="0" type="xs:string"/>
		   <xs:element ref="memory" minOccurs="0"/>
		   <xs:element ref="droppedfile" minOccurs="0"/>
		   <xs:element name="spanalysis" minOccurs="0" type="xs:string"/>
		</xs:all>
		<xs:attribute name="mode" use="required" type="xs:string"/>
		<xs:attribute name="src_thread" use="optional" type="xs:string"/>
		<xs:attribute name="suppressed" use="optional" type="xs:string"/>
		<xs:attribute name="timestamp" use="optional" type="xs:integer"/>
		<xs:attribute name="repeat" use="optional" type="xs:integer"/>
	   </xs:extension>
	</xs:complexContent>
   </xs:complexType>
</xs:element>

<xs:element name="source">
   <xs:complexType>
	<xs:sequence>
	   <xs:element ref="processinfo"/>
	</xs:sequence>
	<xs:attribute name="tainted" use="optional" type="xs:string"/>
   </xs:complexType>
</xs:element>

<xs:element name="target">
   <xs:complexType>
	<xs:sequence>
	   <xs:element name="internal_process" type="xs:string" minOccurs="0"/>
	   <xs:element ref="processinfo" minOccurs="0"/>
	</xs:sequence>
	<xs:attribute name="tainted" use="optional" type="xs:string"/>
   </xs:complexType>
</xs:element>

<xs:element name="driver">
   <xs:complexType>
	<xs:complexContent>
	   <xs:extension base="FeELEvent">
		<xs:all>
		   <xs:element minOccurs="0" name="ntstatus" type="xs:string"/>
		   <xs:element ref="processinfo"/>
		   <xs:element ref="registrypath"/>
		   <xs:element ref="driverimage"/>
		   <xs:element name="method" type="xs:string"/>
		   <xs:element name="rebootdependent" minOccurs="0" type="xs:string"/>
		   <xs:element name="spanalysis" minOccurs="0" type="xs:string"/>
		</xs:all>
		<xs:attribute name="mode" use="required" type="xs:string"/>
		<xs:attribute name="src_thread" use="optional" type="xs:string"/>
		<xs:attribute name="timestamp" use="optional" type="xs:integer"/>
		<xs:attribute name="repeat" use="optional" type="xs:integer"/>
	   </xs:extension>
	</xs:complexContent>
   </xs:complexType>
</xs:element>

<xs:element name="registrypath" type="xs:string"/>

<xs:element name="driverimage" type="xs:string"/>

<xs:element name="Attr">
   <xs:complexType>
	<xs:all>
	   <xs:element name="Value" minOccurs="0" type="xs:string"/>
	   <xs:element name="OldValue" minOccurs="0" type="xs:string"/>
	   <xs:element name="NewValue" minOccurs="0" type="xs:string"/>
	</xs:all>
	<xs:attribute name="name" use="optional" type="xs:string"/>
   </xs:complexType>
</xs:element>

<xs:element name="Element">
   <xs:complexType>
	<xs:sequence>
	   <xs:element ref="Attr" maxOccurs="unbounded" minOccurs="0"/>
	</xs:sequence>
   </xs:complexType>
</xs:element>

<xs:element name="AttrList">
   <xs:complexType>
	<xs:sequence>
	   <xs:element ref="Attr" maxOccurs="unbounded" minOccurs="0"/>
	</xs:sequence>
   </xs:complexType>
</xs:element>

<xs:element name="ElemList">
   <xs:complexType>
	<xs:sequence>
	   <xs:element ref="Element" maxOccurs="unbounded" minOccurs="0"/>
	</xs:sequence>
   </xs:complexType>
</xs:element>

<xs:element name="wmicontent">
   <xs:complexType>
	<xs:all>
	   <xs:element name="lang" minOccurs="0" type="xs:string"/>
	   <xs:element name="query" minOccurs="0" type="xs:string"/>
	   <xs:element name="flags" minOccurs="0" type="xs:string"/>
	   <xs:element name="iwbemcontext" minOccurs="0" type="xs:string"/>
	</xs:all>
   </xs:complexType>
</xs:element>

<xs:element name="wmicontents">
   <xs:complexType>
	<xs:sequence>
	   <xs:element ref="wmicontent" maxOccurs="unbounded" minOccurs="0"/>
	</xs:sequence>
   </xs:complexType>
</xs:element>

<xs:element name="NewHtmTag">
   <xs:complexType>
	<xs:complexContent>
	   <xs:extension base="FeELEvent">
		<xs:all>
		   <xs:element ref="processinfo"/>
		   <xs:element ref="AttrList" minOccurs="0" />
		   <xs:element name="rebootdependent" minOccurs="0" type="xs:string"/>
		   <xs:element name="spanalysis" minOccurs="0" type="xs:string"/>
		</xs:all>
		<xs:attribute name="new_tag" use="optional" type="xs:string"/>
		<xs:attribute name="type" use="optional" type="xs:string"/>
		<xs:attribute name="timestamp" use="optional" type="xs:integer"/>
	   </xs:extension>
	</xs:complexContent>
   </xs:complexType>
</xs:element>

<xs:element name="triggers">
   <xs:complexType>
	<xs:sequence>
	   <xs:element name="trigger" minOccurs="0" maxOccurs="unbounded" type="xs:string"/>
	</xs:sequence>
   </xs:complexType>
</xs:element>

<xs:element name="wmiquery">
   <xs:complexType>
	<xs:complexContent>
	   <xs:extension base="FeELEvent">
		<xs:all>
		   <xs:element ref="processinfo"/>
		   <xs:element ref="wmicontents" minOccurs="0"/>
		   <xs:element name="rebootdependent" minOccurs="0" type="xs:string"/>
		   <xs:element name="spanalysis" minOccurs="0" type="xs:string"/>
		</xs:all>
		<xs:attribute name="timestamp" use="optional" type="xs:integer"/>
	   </xs:extension>
	</xs:complexContent>
   </xs:complexType>
</xs:element>

<xs:element name="ProcessTelemetryReport">
   <xs:complexType>
	<xs:complexContent>
	   <xs:extension base="FeELEvent">
		<xs:all>
		   <xs:element ref="processinfo"/>
		   <xs:element ref="triggers" minOccurs="0"/>
		   <xs:element ref="telemetry_data" minOccurs="0"/>
		   <xs:element ref="memory_data" minOccurs="0"/>
		   <xs:element name="rebootdependent" minOccurs="0" type="xs:string"/>
		   <xs:element name="spanalysis" minOccurs="0" type="xs:string"/>
		</xs:all>
		<xs:attribute name="timestamp" use="optional" type="xs:integer"/>
	   </xs:extension>
	</xs:complexContent>
   </xs:complexType>
</xs:element>

<xs:element name="MeterpreterHostLaunched">
   <xs:complexType>
	<xs:complexContent>
	   <xs:extension base="FeELEvent">
		<xs:all>
		   <xs:element ref="processinfo"/>
		   <xs:element name="Name" minOccurs="0" type="xs:string"/>
		   <xs:element name="Baseaddress" minOccurs="0" type="xs:string"/>
		   <xs:element name="Size" minOccurs="0" type="xs:string"/>
		   <xs:element name="OEP" minOccurs="0" type="xs:string"/>
		   <xs:element name="assembly" minOccurs="0" type="xs:string"/>
		   <xs:element name="bytes" minOccurs="0" type="xs:string"/>
		   <xs:element name="rebootdependent" minOccurs="0" type="xs:string"/>
		   <xs:element name="spanalysis" minOccurs="0" type="xs:string"/>
		</xs:all>
		<xs:attribute name="timestamp" use="optional" type="xs:integer"/>
	   </xs:extension>
	</xs:complexContent>
   </xs:complexType>
</xs:element>

<xs:element name="ba-html">
   <xs:complexType>
	<xs:simpleContent>
	   <xs:extension base="xs:string">
		<xs:attribute name="chunk" use="optional" type="xs:integer"/>
	   </xs:extension>
	</xs:simpleContent>
   </xs:complexType>
</xs:element>

<xs:element name="ba-data">
   <xs:complexType>
	<xs:simpleContent>
	   <xs:extension base="xs:string">
		<xs:attribute name="field" use="optional" type="xs:string"/>
	   </xs:extension>
	</xs:simpleContent>
   </xs:complexType>
</xs:element>

<xs:element name="button">
   <xs:complexType>
	<xs:complexContent>
	   <xs:extension base="FeELEvent">
		<xs:attribute name="name" use="optional" type="xs:string"/>
		<xs:attribute name="class-name" use="optional" type="xs:string"/>
		<xs:attribute name="title" use="optional" type="xs:string"/>
		<xs:attribute name="place-holder" use="optional" type="xs:string"/>
		<xs:attribute name="alt" use="optional" type="xs:string"/>
	   </xs:extension>
	</xs:complexContent>
   </xs:complexType>
</xs:element>

<xs:element name="buttons">
   <xs:complexType>
	<xs:complexContent>
	   <xs:extension base="FeELEvent">
		<xs:sequence>
		   <xs:element ref="button" minOccurs="0" maxOccurs="unbounded" />
		</xs:sequence>
		<xs:attribute name="count" use="optional" type="xs:integer"/>
	   </xs:extension>
	</xs:complexContent>
   </xs:complexType>
</xs:element>

<xs:element name="text">
   <xs:complexType>
	<xs:complexContent>
	   <xs:extension base="FeELEvent">
		<xs:attribute name="name" use="optional" type="xs:string"/>
		<xs:attribute name="class-name" use="optional" type="xs:string"/>
		<xs:attribute name="title" use="optional" type="xs:string"/>
		<xs:attribute name="place-holder" use="optional" type="xs:string"/>
		<xs:attribute name="alt" use="optional" type="xs:string"/>
		<xs:attribute name="max-length" use="optional" type="xs:integer"/>
		<xs:attribute name="match-type" use="optional" type="xs:string"/>
		<xs:attribute name="matched-key" use="optional" type="xs:string"/>
		<xs:attribute name="matched-field" use="optional" type="xs:string"/>
		<xs:attribute name="new-value" use="optional" type="xs:string"/>
	   </xs:extension>
	</xs:complexContent>
   </xs:complexType>
</xs:element>

<xs:element name="password-text-fields">
   <xs:complexType>
	<xs:complexContent>
	   <xs:extension base="FeELEvent">
		<xs:sequence>
		   <xs:element ref="text" minOccurs="0" maxOccurs="unbounded" />
		</xs:sequence>
		<xs:attribute name="count" use="optional" type="xs:integer"/>
	   </xs:extension>
	</xs:complexContent>
   </xs:complexType>
</xs:element>

<xs:element name="ba-form-attributes">
   <xs:complexType>
	<xs:complexContent>
	   <xs:extension base="FeELEvent">
		<xs:attribute name="form-action" use="optional" type="xs:string"/>
		<xs:attribute name="name" use="optional" type="xs:string"/>
		<xs:attribute name="class-name" use="optional" type="xs:string"/>
		<xs:attribute name="title" use="optional" type="xs:string"/>
		<xs:attribute name="place-holder" use="optional" type="xs:string"/>
		<xs:attribute name="alt" use="optional" type="xs:string"/>
	   </xs:extension>
	</xs:complexContent>
   </xs:complexType>
</xs:element>

<xs:element name="submit-try">
   <xs:complexType>
	<xs:complexContent>
	   <xs:extension base="FeELEvent">
		<xs:attribute name="type" use="optional" type="xs:string"/>
		<xs:attribute name="form-submitted" use="optional" type="xs:string"/>
		<xs:attribute name="post-request-observed" use="optional" type="xs:string"/>
		<xs:attribute name="button-index" use="optional" type="xs:integer"/>
		<xs:attribute name="status-bar-text" use="optional" type="xs:string"/>
		<xs:attribute name="new-url-location" use="optional" type="xs:string"/>
	   </xs:extension>
	</xs:complexContent>
   </xs:complexType>
</xs:element>

<xs:element name="submit-details">
   <xs:complexType>
	<xs:complexContent>
	   <xs:extension base="FeELEvent">
		<xs:sequence>
		   <xs:element ref="submit-try" minOccurs="0" maxOccurs="unbounded" />
		</xs:sequence>
		<xs:attribute name="count" use="optional" type="xs:integer"/>
	   </xs:extension>
	</xs:complexContent>
   </xs:complexType>
</xs:element>

<xs:element name="input-fields">
   <xs:complexType>
	<xs:complexContent>
	   <xs:extension base="FeELEvent">
		<xs:sequence>
		   <xs:element ref="text" minOccurs="0" maxOccurs="unbounded" />
		</xs:sequence>
		<xs:attribute name="count" use="optional" type="xs:integer"/>
	   </xs:extension>
	</xs:complexContent>
   </xs:complexType>
</xs:element>

<xs:element name="select">
   <xs:complexType>
	<xs:complexContent>
	   <xs:extension base="FeELEvent">
		<xs:attribute name="name" use="optional" type="xs:string"/>
		<xs:attribute name="class-name" use="optional" type="xs:string"/>
		<xs:attribute name="title" use="optional" type="xs:string"/>
		<xs:attribute name="place-holder" use="optional" type="xs:string"/>
		<xs:attribute name="alt" use="optional" type="xs:string"/>
		<xs:attribute name="select-index" use="optional" type="xs:integer"/>
		<xs:attribute name="select-text" use="optional" type="xs:string"/>
	   </xs:extension>
	</xs:complexContent>
   </xs:complexType>
</xs:element>

<xs:element name="select-box">
   <xs:complexType>
	<xs:complexContent>
	   <xs:extension base="FeELEvent">
		<xs:sequence>
		   <xs:element ref="select" minOccurs="0" maxOccurs="unbounded" />
		</xs:sequence>
		<xs:attribute name="count" use="optional" type="xs:integer"/>
	   </xs:extension>
	</xs:complexContent>
   </xs:complexType>
</xs:element>

<xs:element name="hyperlinks">
   <xs:complexType>
	<xs:complexContent>
	   <xs:extension base="FeELEvent">
		<xs:sequence>
		   <xs:element name="link" type="xs:string" minOccurs="0" maxOccurs="unbounded" />
		</xs:sequence>
		<xs:attribute name="count" use="optional" type="xs:integer"/>
	   </xs:extension>
	</xs:complexContent>
   </xs:complexType>
</xs:element>

<xs:element name="ba-form-data">
   <xs:complexType>
	<xs:complexContent>
	   <xs:extension base="FeELEvent">
		<xs:all>
		   <xs:element ref="submit-details" minOccurs="0" />
		   <xs:element ref="buttons" minOccurs="0" />
		   <xs:element ref="password-text-fields" minOccurs="0" />
		   <xs:element ref="input-fields" minOccurs="0" />
		   <xs:element ref="ba-form-attributes" minOccurs="0" />
		   <xs:element ref="hyperlinks" minOccurs="0" />
		   <xs:element ref="select-box" minOccurs="0" />
		   <xs:element name="rebootdependent" minOccurs="0" type="xs:string"/>
		   <xs:element name="spanalysis" minOccurs="0" type="xs:string"/>
		</xs:all>
		<xs:attribute name="timestamp" use="optional" type="xs:integer"/>
		<xs:attribute name="form-number" use="optional" type="xs:integer"/>
	   </xs:extension>
	</xs:complexContent>
   </xs:complexType>
</xs:element>

<xs:element name="ba-post-data">
   <xs:complexType>
	<xs:complexContent>
	   <xs:extension base="FeELEvent">
		<xs:sequence>
		   <xs:element ref="ba-data" minOccurs="0" maxOccurs="unbounded" />
		   <xs:element name="rebootdependent" minOccurs="0" type="xs:string"/>
		   <xs:element name="spanalysis" minOccurs="0" type="xs:string"/>
		</xs:sequence>
		<xs:attribute name="timestamp" use="optional" type="xs:integer"/>
	   </xs:extension>
	</xs:complexContent>
   </xs:complexType>
</xs:element>

<xs:element name="browser-automation">
   <xs:complexType>
	<xs:complexContent>
	   <xs:extension base="FeELEvent">
		<xs:all>
		   <xs:element name="url" minOccurs="0" type="xs:string"/>
		   <xs:element name="statusbar-text-on-load" minOccurs="0" type="xs:string"/>
		   <xs:element name="total-number-of-elements" minOccurs="0" type="xs:integer"/>
		   <xs:element name="number-of-forms" minOccurs="0" type="xs:integer"/>
		   <xs:element name="rebootdependent" minOccurs="0" type="xs:string"/>
		   <xs:element name="spanalysis" minOccurs="0" type="xs:string"/>
		</xs:all>
		<xs:attribute name="timestamp" use="optional" type="xs:integer"/>
	   </xs:extension>
	</xs:complexContent>
   </xs:complexType>
</xs:element>

<xs:element name="browser-automation-html">
   <xs:complexType>
	<xs:complexContent>
	   <xs:extension base="FeELEvent">
		<xs:all>
		   <xs:element ref="ba-html" minOccurs="0" />
		   <xs:element name="rebootdependent" minOccurs="0" type="xs:string"/>
		   <xs:element name="spanalysis" minOccurs="0" type="xs:string"/>
		</xs:all>
		<xs:attribute name="timestamp" use="optional" type="xs:integer"/>
		<xs:attribute name="form-number" use="optional" type="xs:integer"/>
	   </xs:extension>
	</xs:complexContent>
   </xs:complexType>
</xs:element>

<xs:element name="HtmTag">
   <xs:complexType>
	<xs:complexContent>
	   <xs:extension base="FeELEvent">
		<xs:all>
		   <xs:element ref="processinfo"/>
		   <xs:element name="HtmSize" type="xs:integer"/>
		   <xs:element ref="ElemList" minOccurs="0" />
		   <xs:element name="rebootdependent" minOccurs="0" type="xs:string"/>
		   <xs:element name="spanalysis" minOccurs="0" type="xs:string"/>
		</xs:all>
		<xs:attribute name="mode" use="optional" type="xs:string"/>
		<xs:attribute name="type" use="optional" type="xs:string"/>
		<xs:attribute name="timestamp" use="optional" type="xs:integer"/>
	   </xs:extension>
	</xs:complexContent>
   </xs:complexType>
</xs:element>

<xs:element name="exploitcode">
   <xs:complexType>
	<xs:complexContent>
	   <xs:extension base="FeELEvent">
		<xs:all>
		   <xs:element ref="processinfo"/>
		   <xs:element ref="dllname"/>
		   <xs:element ref="apiname"/>
		   <xs:element ref="address"/>
		   <xs:element ref="params" minOccurs="0"/>
		   <xs:element ref="callstack" minOccurs="0"/>
		   <xs:element name="rebootdependent" minOccurs="0" type="xs:string"/>
		   <xs:element name="spanalysis" minOccurs="0" type="xs:string"/>
		</xs:all>
		<xs:attribute name="protection" use="optional" type="xs:string"/>
		<xs:attribute name="suppressed" use="optional" type="xs:string"/>
		<xs:attribute name="src_thread" use="optional" type="xs:string"/>
		<xs:attribute name="timestamp" use="optional" type="xs:integer"/>
		<xs:attribute name="repeat" use="optional" type="xs:integer"/>
	   </xs:extension>
	</xs:complexContent>
   </xs:complexType>
</xs:element>

<xs:element name="file">
   <xs:complexType>
	<xs:complexContent>
	   <xs:extension base="FeELEvent">
		<xs:all>
		   <xs:element ref="values" minOccurs="0"/>
		   <xs:element ref="value" minOccurs="0"/>
		   <xs:element minOccurs="0" name="filedes"/>
		   <xs:element minOccurs="0" ref="filesize"/>
		   <xs:element ref="md5sum" minOccurs="0"/>
		   <xs:element ref="sha1sum" minOccurs="0"/>
		   <xs:element minOccurs="0" name="target" type="xs:string"/>
		   <xs:element ref="processinfo"/>
		   <xs:element minOccurs="0" name="old_name" type="xs:string"/>
		   <xs:element minOccurs="0" name="new_name" type="xs:string"/>
		   <xs:element minOccurs="0" name="creationTime" type="xs:string"/>
		   <xs:element minOccurs="0" name="lastWriteTime" type="xs:string"/>
		   <xs:element minOccurs="0" name="changeTime" type="xs:string"/>
		   <xs:element minOccurs="0" name="newCreationTime" type="xs:string"/>
		   <xs:element minOccurs="0" name="newLastWriteTime" type="xs:string"/>
		   <xs:element minOccurs="0" name="newChangeTime" type="xs:string"/>
		   <xs:element minOccurs="0" ref="fid"/>
		   <xs:element minOccurs="0" name="perm" type="xs:string"/>
		   <xs:element minOccurs="0" name="failure" type="xs:string"/>
		   <xs:element minOccurs="0" name="ntstatus" type="xs:string"/>
		   <xs:element minOccurs="0" ref="EaName"/>
		   <xs:element minOccurs="0" name="EaValueLength" type="xs:string"/>
		   <xs:element minOccurs="0" name="EaValue" type="xs:string"/>
		   <xs:element minOccurs="0" name="CreateOptions" type="xs:string"/>
		   <xs:element minOccurs="0" ref="PE"/>
		   <xs:element minOccurs="0" name="content_after" type="xs:string"/>
		   <xs:element minOccurs="0" name="job_target" type="xs:string"/>
		   <xs:element minOccurs="0" name="job_parameter" type="xs:string"/>
		   <xs:element minOccurs="0" name="job_workingdir" type="xs:string"/>
		   <xs:element minOccurs="0" name="file_content" type="xs:string"/>
		   <xs:element minOccurs="0" name="old_target" type="xs:string"/>
		   <xs:element minOccurs="0" name="new_target" type="xs:string"/>
		   <xs:element name="source" minOccurs="0" type="xs:string"/>
		   <xs:element name="settime" minOccurs="0" type="xs:string"/>
		   <xs:element name="rebootdependent" minOccurs="0" type="xs:string"/>
		   <xs:element name="spanalysis" minOccurs="0" type="xs:string"/>
		</xs:all>
		<xs:attribute name="mode" use="required" type="xs:string"/>
		<xs:attribute name="src_thread" use="optional" type="xs:string"/>
		<xs:attribute name="type" use="optional" type="xs:string"/>
		<xs:attribute name="timestamp" use="optional" type="xs:integer"/>
		<xs:attribute name="repeat" use="optional" type="xs:integer"/>
	   </xs:extension>
	</xs:complexContent>
   </xs:complexType>
</xs:element>

<xs:element name="EaName">
   <xs:complexType>
	<xs:simpleContent>
	   <xs:extension base="xs:string">
		<xs:attribute name="Index" use="required" type="xs:long"/>
		<xs:attribute name="Count" use="required" type="xs:long"/>
	   </xs:extension>
	</xs:simpleContent>
   </xs:complexType>
</xs:element>

<xs:element name="folder">
   <xs:complexType>
	<xs:complexContent>
	   <xs:extension base="FeELEvent">
		<xs:all>
		   <xs:element ref="value" minOccurs="0"/>
		   <xs:element minOccurs="0" name="old_name" type="xs:string"/>
		   <xs:element minOccurs="0" name="new_name" type="xs:string"/>
		   <xs:element minOccurs="0" name="creationTime" type="xs:string"/>
		   <xs:element minOccurs="0" name="lastWriteTime" type="xs:string"/>
		   <xs:element minOccurs="0" name="changeTime" type="xs:string"/>
		   <xs:element minOccurs="0" name="newCreationTime" type="xs:string"/>
		   <xs:element minOccurs="0" name="newLastWriteTime" type="xs:string"/>
		   <xs:element minOccurs="0" name="newChangeTime" type="xs:string"/>
		   <xs:element ref="processinfo"/>
		   <xs:element minOccurs="0" name="ntstatus" type="xs:string"/>
		   <xs:element minOccurs="0" ref="EaName"/>
		   <xs:element minOccurs="0" name="EaValueLength" type="xs:string"/>
		   <xs:element minOccurs="0" name="EaValue" type="xs:string"/>
		   <xs:element minOccurs="0" name="CreateOptions" type="xs:string"/>
		   <xs:element name="rebootdependent" minOccurs="0" type="xs:string"/>
		   <xs:element name="spanalysis" minOccurs="0" type="xs:string"/>
		</xs:all>
		<xs:attribute name="mode" use="required" type="xs:string"/>
		<xs:attribute name="src_thread" use="optional" type="xs:string"/>
		<xs:attribute name="type" use="optional" type="xs:string"/>
		<xs:attribute name="timestamp" use="optional" type="xs:integer"/>
		<xs:attribute name="repeat" use="optional" type="xs:integer"/>
	   </xs:extension>
	</xs:complexContent>
   </xs:complexType>
</xs:element>

<xs:element name="Entry">
   <xs:complexType>
	<xs:all>
	   <xs:element minOccurs="0" name="Byte" type="xs:string"/>
	   <xs:element minOccurs="0" name="Count" type="xs:integer"/>
	   <xs:element minOccurs="0" name="Percentage" type="xs:integer"/>
	   <xs:element minOccurs="0" name="FirstOffset" type="xs:string"/>
	   <xs:element minOccurs="0" name="IsNOP" type="xs:string"/>
	</xs:all>
   </xs:complexType>
</xs:element>

<xs:element name="BytesList">
   <xs:complexType>
	<xs:sequence>
	   <xs:element ref="Entry" maxOccurs="unbounded" minOccurs="0"/>
	</xs:sequence>
	<xs:attribute name="Count" use="optional" type="xs:integer"/>
	<xs:attribute name="Distinct" use="optional" type="xs:integer"/>
   </xs:complexType>
</xs:element>

<xs:element name="heapspraying">
   <xs:complexType>
	<xs:complexContent>
	   <xs:extension base="FeELEvent">
		<xs:all>
		   <xs:element ref="processinfo" minOccurs="0"/>
		   <xs:element ref="pattern" minOccurs="0"/>
		   <xs:element ref="blocksize" minOccurs="0"/>
		   <xs:element ref="address" minOccurs="0"/>
		   <xs:element ref="shellcodesize" minOccurs="0"/>
		   <xs:element ref="region" minOccurs="0"/>
		   <xs:element ref="regionsize" minOccurs="0"/>
		   <xs:element name="javascript" type="xs:string" minOccurs="0" />
		   <xs:element ref="bytesreceived" minOccurs="0"/>
		   <xs:element ref="totalmemory" minOccurs="0"/>
		   <xs:element ref="lastbytesreceived" minOccurs="0"/>
		   <xs:element ref="lasttotalmemory" minOccurs="0"/>
		   <xs:element ref="incrementCount" minOccurs="0"/>
		   <xs:element name="BaseAddress" type="xs:string" minOccurs="0" />
		   <xs:element name="Size" type="xs:string" minOccurs="0" />
		   <xs:element name="CUnit" type="xs:string" minOccurs="0" />
		   <xs:element name="CCount" type="xs:integer" minOccurs="0" />
		   <xs:element name="RUnit" type="xs:string" minOccurs="0" />
		   <xs:element name="RCount" type="xs:integer" minOccurs="0" />
		   <xs:element name="ProcessedRCount" type="xs:integer" minOccurs="0" />
		   <xs:element name="TotalRCount" type="xs:integer" minOccurs="0" />
		   <xs:element name="Processed" type="xs:string" minOccurs="0" />
		   <xs:element name="RegionSize" type="xs:string" minOccurs="0" />
		   <xs:element name="RegionCount" type="xs:string" minOccurs="0" />
		   <xs:element name="TotalSize" type="xs:string" minOccurs="0" />
		   <xs:element name="DNA" type="xs:integer" minOccurs="0" />
		   <xs:element name="ChunkSize" type="xs:string" minOccurs="0" />
		   <xs:element name="ChunkCount" type="xs:integer" minOccurs="0" />
		   <xs:element name="HashSize" type="xs:string" minOccurs="0" />
		   <xs:element name="HashRegionCount" type="xs:string" minOccurs="0" />
		   <xs:element name="TotalRegionCount" type="xs:string" minOccurs="0" />
		   <xs:element name="Similarity" type="xs:string" minOccurs="0" />
		   <xs:element ref="BytesList" minOccurs="0" />
		   <xs:element name="HSPA_ALGO_OPTIONS" type="xs:string" minOccurs="0" />
		   <xs:element name="HSPA_SCANPASS_LIMIT" type="xs:string" minOccurs="0" />
		   <xs:element name="HSPA_SCAN_INTERVAL" type="xs:string" minOccurs="0" />
		   <xs:element name="SIZE_FREQUENCY_THRESHOLD" type="xs:string" minOccurs="0" />
		   <xs:element name="MIN_MULTIREG_REGION_SIZE" type="xs:string" minOccurs="0" />
		   <xs:element name="MIN_MULTIREG_ALLOC_SIZE" type="xs:string" minOccurs="0" />
		   <xs:element name="MIN_BIG_REGION_TO_REPORT" type="xs:string" minOccurs="0" />
		   <xs:element name="BIG_REGION_CHUNK_SIZE" type="xs:string" minOccurs="0" />
		   <xs:element name="MIN_BIG_REGION_SIMSIZE" type="xs:string" minOccurs="0" />
		   <xs:element name="HDR_BYTES_TO_IGNORE" type="xs:string" minOccurs="0" />
		   <xs:element name="BUF_DATAFREQ_SIZE_LIMIT" type="xs:string" minOccurs="0" />
		   <xs:element name="MAX_BYTES_INFO_TO_REPORT" type="xs:string" minOccurs="0" />
		   <xs:element name="TOTAL_BYTE_PERCENT_TO_REPORT" type="xs:string" minOccurs="0" />
		   <xs:element name="BUF_SCANSIZE_LIMIT" type="xs:string" minOccurs="0" />
		   <xs:element name="PERCENT_SIZE_TO_HASH" type="xs:string" minOccurs="0" />
		   <xs:element name="MIN_SIZE_TO_HASH" type="xs:string" minOccurs="0" />
		   <xs:element name="MAX_SIZE_TO_HASH" type="xs:string" minOccurs="0" />
		   <xs:element name="SIMILARITY_SCORE_THRESHOLD" type="xs:string" minOccurs="0" />
		   <xs:element name="PARALLEL_MULTIREG_PROCESSING" type="xs:string" minOccurs="0" />
		   <xs:element name="PARALLEL_THR_COUNT" type="xs:string" minOccurs="0" />
		   <xs:element name="Q_FINISH_WAIT" type="xs:string" minOccurs="0" />
		   <xs:element name="MEM_PREFETCH" type="xs:string" minOccurs="0" />
		   <xs:element name="XP_HS_THRESHOLD" type="xs:string" minOccurs="0" />
		   <xs:element name="W7_HS_THRESHOLD" type="xs:string" minOccurs="0" />
		   <xs:element name="HS_DELTA" type="xs:string" minOccurs="0" />
		   <xs:element name="rebootdependent" minOccurs="0" type="xs:string"/>
		   <xs:element name="spanalysis" minOccurs="0" type="xs:string"/>
		</xs:all>
		<xs:attribute name="name" use="optional" type="xs:string"/>
		<xs:attribute name="mode" use="optional" type="xs:string"/>
		<xs:attribute name="type" use="required" type="xs:string"/>
		<xs:attribute name="src_thread" use="optional" type="xs:string"/>
		<xs:attribute name="timestamp" use="optional" type="xs:integer"/>
		<xs:attribute name="repeat" use="optional" type="xs:integer"/>
	   </xs:extension>
	</xs:complexContent>
   </xs:complexType>
</xs:element>

<xs:element name="pattern" type="xs:string"/>
<xs:element name="blocksize" type="xs:string"/>
<xs:element name="lastbytesreceived" type="xs:string"/>
<xs:element name="lasttotalmemory" type="xs:string"/>
<xs:element name="incrementCount" type="xs:string"/>

<xs:element name="mutex">
   <xs:complexType>
	<xs:complexContent>
	   <xs:extension base="FeELEvent">
		<xs:all>
		   <xs:element ref="value"/>
		   <xs:element ref="processinfo"/>
		   <xs:element name="rebootdependent" minOccurs="0" type="xs:string"/>
		   <xs:element name="spanalysis" minOccurs="0" type="xs:string"/>
		</xs:all>
		<xs:attribute name="src_thread" use="optional" type="xs:string"/>
		<xs:attribute name="timestamp" use="optional" type="xs:integer"/>
		<xs:attribute name="repeat" use="optional" type="xs:integer"/>
	   </xs:extension>
	</xs:complexContent>
   </xs:complexType>
</xs:element>

<xs:element name="network">
   <xs:complexType>
	<xs:complexContent>
	   <xs:extension base="FeELEvent">
		<xs:sequence>
		   <xs:element minOccurs="0" ref="processinfo"/>
		   <xs:element minOccurs="0" ref="protocol_type"/>
		   <xs:element minOccurs="0" ref="destination_port"/>
		   <xs:element minOccurs="0" ref="listen_port"/>
		   <xs:element minOccurs="0" name="qtype" type="xs:string"/>
		   <xs:element minOccurs="0" name="winsock_res" type="xs:string"/>
		   <xs:element minOccurs="0" name="dns_response_code" type="xs:string"/>
		   <xs:element minOccurs="0" name="hostname" type="xs:string"/>
		   <xs:element minOccurs="0" name="answer_number" type="xs:string"/>
		   <xs:element minOccurs="0" maxOccurs="unbounded" ref="ipaddress"/>
		   <xs:element name="http_request" type="xs:string" minOccurs="0"/>
		   <xs:element name="rebootdependent" minOccurs="0" type="xs:string"/>
		   <xs:element name="spanalysis" minOccurs="0" type="xs:string"/>
		</xs:sequence>
		<xs:attribute name="mode" use="required" type="xs:string"/>
		<xs:attribute name="src_thread" use="optional" type="xs:string"/>
		<xs:attribute name="timestamp" use="optional" type="xs:integer"/>
		<xs:attribute name="repeat" use="optional" type="xs:integer"/>
	   </xs:extension>
	</xs:complexContent>
   </xs:complexType>
</xs:element>

<xs:element name="protocol_type" type="xs:string"/>
<xs:element name="destination_port" type="xs:string"/>
<xs:element name="listen_port" type="xs:string"/>
<xs:element name="ipaddress" type="xs:string"/>
<xs:element name="http_request" type="xs:string"/>

<xs:element name="process_target">
   <xs:complexType>
	<xs:sequence>
	   <xs:element name="internal_process" type="xs:string" minOccurs="0"/>
	</xs:sequence>
   </xs:complexType>
</xs:element>

<xs:element name="duplicate_source">
   <xs:complexType>
	<xs:all>
	   <xs:element ref="processinfo"  minOccurs="0"/>
	   <xs:element name="internal_process" type="xs:string" minOccurs="0"/>
	</xs:all>
   </xs:complexType>
</xs:element>

<xs:element name="duplicate_target">
   <xs:complexType>
	<xs:all>
	   <xs:element ref="processinfo" minOccurs="0"/>
	   <xs:element name="internal_process" type="xs:string" minOccurs="0"/>
	</xs:all>
	<xs:attribute name="tainted" use="optional" type="xs:string"/>
   </xs:complexType>
</xs:element>

<xs:element name="memory_data">
   <xs:complexType>
	<xs:all>
	   <xs:element type="xs:string" name="PeakVirtualSize" minOccurs="0"/>
	   <xs:element type="xs:string" name="VirtualSize" minOccurs="0"/>
	   <xs:element type="xs:string" name="PageFaultCount" minOccurs="0"/>
	   <xs:element type="xs:string" name="PeakWorkingSetSize" minOccurs="0"/>
	   <xs:element type="xs:string" name="WorkingSetSize" minOccurs="0"/>
	   <xs:element type="xs:string" name="QuotaPeakPagedPoolUsage" minOccurs="0"/>
	   <xs:element type="xs:string" name="QuotaPagedPoolUsage" minOccurs="0"/>
	   <xs:element type="xs:string" name="QuotaPeakNonPagedPoolUsage" minOccurs="0"/>
	   <xs:element type="xs:string" name="QuotaNonPagedPoolUsage" minOccurs="0"/>
	   <xs:element type="xs:string" name="PagefileUsage" minOccurs="0"/>
	   <xs:element type="xs:string" name="PeakPagefileUsage" minOccurs="0"/>
	   <xs:element type="xs:string" name="PrivateUsage" minOccurs="0"/>
	</xs:all>
   </xs:complexType>
</xs:element>

<xs:element name="telemetry_data">
   <xs:complexType>
	<xs:all>
	   <xs:element type="xs:integer" name="child_process_count" minOccurs="0"/>
	   <xs:element type="xs:integer" name="local_thread_count" minOccurs="0"/>
	   <xs:element type="xs:integer" name="remote_thread_count" minOccurs="0"/>
	   <xs:element type="xs:integer" name="mutex_create_count" minOccurs="0"/>
	   <xs:element type="xs:integer" name="file_failed_count" minOccurs="0"/>
	   <xs:element type="xs:integer" name="file_open_count" minOccurs="0"/>
	   <xs:element type="xs:integer" name="file_create_count" minOccurs="0"/>
	   <xs:element type="xs:integer" name="file_modify_count" minOccurs="0"/>
	   <xs:element type="xs:integer" name="http_req_count" minOccurs="0"/>
	</xs:all>
   </xs:complexType>
</xs:element>

<xs:element name="process">
   <xs:complexType>
	<xs:complexContent>
	   <xs:extension base="FeELEvent">
		<xs:all>
		   <xs:element ref="value" minOccurs="0"/>
		   <xs:element ref="pid" minOccurs="0"/>
		   <xs:element ref="ppid" minOccurs="0"/>
		   <xs:element ref="parentname" minOccurs="0"/>
		   <xs:element ref="cmdline" minOccurs="0"/>
		   <xs:element ref="filesize" minOccurs="0"/>
		   <xs:element ref="md5sum" minOccurs="0"/>
		   <xs:element ref="sha1sum" minOccurs="0"/>
		   <xs:element name="packed" type="xs:string" minOccurs="0"/>
		   <xs:element name="desiredaccess" type="xs:string" minOccurs="0"/>
		   <xs:element name="ntstatus" type="xs:string" minOccurs="0"/>
		   <xs:element ref="target" minOccurs="0"/>
		   <xs:element ref="duplicate_source" minOccurs="0"/>
		   <xs:element ref="duplicate_target" minOccurs="0"/>
		   <xs:element name="InheritHandle" type="xs:string" minOccurs="0"/>
		   <xs:element name="Options" type="xs:string" minOccurs="0"/>
		   <xs:element ref="source" minOccurs="0"/>
		   <xs:element minOccurs="0" name="gui" type="xs:string"/>
		   <xs:element minOccurs="0" ref="fid"/>
		   <xs:element name="args" type="xs:string" minOccurs="0"/>
		   <xs:element name="app_version" type="xs:string" minOccurs="0"/>
		   <xs:element name="app_short_version" type="xs:string" minOccurs="0"/>
		   <xs:element name="app_crash_info" type="xs:string" minOccurs="0"/>
		   <xs:element name="code_type" type="xs:string" minOccurs="0"/>
		   <xs:element name="signal" minOccurs="0"/>
		   <xs:element name="signal_code" minOccurs="0"/>
		   <xs:element name="trapno" minOccurs="0"/>
		   <xs:element name="err" minOccurs="0"/>
		   <xs:element name="cpu_num" minOccurs="0"/>
		   <xs:element name="faultvaddr" minOccurs="0"/>
		   <xs:element name="exception_type" minOccurs="0"/>
		   <xs:element name="exception_code" minOccurs="0"/>
		   <xs:element name="register_dump" type="xs:string" minOccurs="0"/>
		   <xs:element name="crash_stack" type="xs:string" minOccurs="0"/>
		   <xs:element ref="telemetry_data" minOccurs="0"/>
		   <xs:element ref="memory_data" minOccurs="0"/>
		   <xs:element name="rebootdependent" minOccurs="0" type="xs:string"/>
		   <xs:element name="spanalysis" minOccurs="0" type="xs:string"/>
		</xs:all>
		<xs:attribute name="mode" use="required" type="xs:string"/>
		<xs:attribute name="src_thread" use="optional" type="xs:string"/>
		<xs:attribute name="timestamp" use="optional" type="xs:integer"/>
		<xs:attribute name="repeat" use="optional" type="xs:string"/>
		<xs:attribute name="type" use="optional" type="xs:string"/>
		<xs:attribute name="tType" use="optional" type="xs:string"/>
	   </xs:extension>
	</xs:complexContent>
   </xs:complexType>
</xs:element>

<xs:element name="ppid" type="xs:integer"/>
<xs:element name="parentname" type="xs:string"/>
<xs:element name="cmdline" type="xs:string"/>

<xs:element name="process-packed">
   <xs:complexType>
	<xs:complexContent>
	   <xs:extension base="FeELEvent">
		<xs:sequence>
		   <xs:element ref="processinfo"/>
		   <xs:element name="rebootdependent" minOccurs="0" type="xs:string"/>
		   <xs:element name="spanalysis" minOccurs="0" type="xs:string"/>
		</xs:sequence>
		<xs:attribute name="src_thread" use="optional" type="xs:string"/>
		<xs:attribute name="timestamp" use="optional" type="xs:integer"/>
		<xs:attribute name="repeat" use="optional" type="xs:integer"/>
	   </xs:extension>
	</xs:complexContent>
   </xs:complexType>
</xs:element>

<xs:element name="processstats">
   <xs:complexType>
	<xs:complexContent>
	   <xs:extension base="FeELEvent">
		<xs:sequence>
		   <xs:element ref="processinfo"/>
		   <xs:element ref="bytesreceived"/>
		   <xs:element ref="totalmemory"/>
		   <xs:element ref="id"/>
		   <xs:element ref="deltatime"/>
		   <xs:element name="rebootdependent" minOccurs="0" type="xs:string"/>
		   <xs:element name="spanalysis" minOccurs="0" type="xs:string"/>
		</xs:sequence>
		<xs:attribute name="src_thread" use="optional" type="xs:string"/>
		<xs:attribute name="timestamp" use="optional" type="xs:integer"/>
		<xs:attribute name="repeat" use="optional" type="xs:integer"/>
	   </xs:extension>
	</xs:complexContent>
   </xs:complexType>
</xs:element>

<xs:element name="id" type="xs:string"/>
<xs:element name="deltatime" type="xs:string"/>

<xs:element name="regkey">
   <xs:complexType>
	<xs:complexContent>
	   <xs:extension base="FeELEvent">
		<xs:all>
		   <xs:element ref="value" minOccurs="0"/>
		   <xs:element ref="processinfo" minOccurs="0"/>
		   <xs:element name="rebootdependent" minOccurs="0" type="xs:string"/>
		   <xs:element name="spanalysis" minOccurs="0" type="xs:string"/>
		</xs:all>
		<xs:attribute name="mode" use="required" type="xs:string"/>
		<xs:attribute name="src_thread" use="optional" type="xs:string"/>
		<xs:attribute name="randomized" use="optional" type="xs:string"/>
		<xs:attribute name="timestamp" use="optional" type="xs:integer"/>
		<xs:attribute name="repeat" use="optional" type="xs:integer"/>
	   </xs:extension>
	</xs:complexContent>
   </xs:complexType>
</xs:element>

<xs:element name="os-inactivity-send-keys">
   <xs:complexType>
	<xs:complexContent>
	   <xs:extension base="FeELEvent">
		<xs:all>
		   <xs:element name="rebootdependent" minOccurs="0" type="xs:string"/>
		   <xs:element name="spanalysis" minOccurs="0" type="xs:string"/>
		</xs:all>
	   </xs:extension>
	</xs:complexContent>
   </xs:complexType>
</xs:element>

<xs:element name="guestos-not-pingable">
   <xs:complexType>
	<xs:complexContent>
	   <xs:extension base="FeELEvent">
		<xs:all>
		   <xs:element name="rebootdependent" minOccurs="0" type="xs:string"/>
		   <xs:element name="spanalysis" minOccurs="0" type="xs:string"/>
		</xs:all>
	   </xs:extension>
	</xs:complexContent>
   </xs:complexType>
</xs:element>

<xs:element name="detection-monitor-killed">
   <xs:complexType>
	<xs:complexContent>
	   <xs:extension base="FeELEvent">
		<xs:all>
		   <xs:element name="rebootdependent" minOccurs="0" type="xs:string"/>
		   <xs:element name="spanalysis" minOccurs="0" type="xs:string"/>
		</xs:all>
	   </xs:extension>
	</xs:complexContent>
   </xs:complexType>
</xs:element>

<xs:element name="end-of-report">
   <xs:complexType>
	<xs:complexContent>
	   <xs:extension base="FeELEvent">
		<xs:all>
		   <xs:element name="rebootdependent" minOccurs="0" type="xs:string"/>
		   <xs:element name="spanalysis" minOccurs="0" type="xs:string"/>
		</xs:all>
	   </xs:extension>
	</xs:complexContent>
   </xs:complexType>
</xs:element>

<xs:element name="processinfo">
   <xs:complexType>
	<xs:complexContent>
	   <xs:extension base="FeELEvent">
		<xs:all>
		   <xs:element ref="pid" minOccurs="0"/>
		   <xs:element ref="ppid" minOccurs="0"/>
		   <xs:element ref="tid" minOccurs="0"/>
		   <xs:element name="process_cpu" minOccurs="0" type="xs:string"/>
		   <xs:element ref="imagepath" minOccurs="0"/>
		   <xs:element ref="cmdline" minOccurs="0"/>
		   <xs:element ref="parentname" minOccurs="0"/>
		   <xs:element minOccurs="0" ref="md5sum"/>
		   <xs:element name="rebootdependent" minOccurs="0" type="xs:string"/>
		   <xs:element name="spanalysis" minOccurs="0" type="xs:string"/>
		</xs:all>
		<xs:attribute name="tainted" use="optional" type="xs:string"/>
	   </xs:extension>
	</xs:complexContent>
   </xs:complexType>
</xs:element>

<xs:element name="imagepath" type="xs:string"/>
<xs:element name="dllname" type="xs:string"/>
<xs:element name="apiname" type="xs:string"/>
<xs:element name="address" type="xs:string"/>
<xs:element name="caller_addr" type="xs:string"/>
<xs:element name="shellcodesize" type="xs:string"/>
<xs:element name="region" type="xs:string"/>
<xs:element name="regionsize" type="xs:string"/>
<xs:element name="StackAddress" type="xs:string"/>
<xs:element name="StackLimit" type="xs:string"/>
<xs:element name="StackBase" type="xs:string"/>
<xs:element name="StackBottom" type="xs:string"/>
<xs:element name="StackTop" type="xs:string"/>
<xs:element name="ExceptionList" type="xs:string"/>
<xs:element name="Self" type="xs:string"/>
<xs:element name="ClientId" type="xs:string"/>
<xs:element name="PEBAddress" type="xs:string"/>
<xs:element name="LastErrorValue" type="xs:string"/>
<xs:element name="LastStatusValue" type="xs:string"/>

<xs:element name="params">
   <xs:complexType>
	<xs:sequence>
	   <xs:element maxOccurs="unbounded" minOccurs="0" ref="param"/>
	   <xs:element minOccurs="0" ref="gadgets"/>
	</xs:sequence>
   </xs:complexType>
</xs:element>

<xs:element name="param">
   <xs:complexType>
	<xs:simpleContent>
	   <xs:extension base="xs:string">
		<xs:attribute name="id" use="required" type="xs:long"/>
	   </xs:extension>
	</xs:simpleContent>
   </xs:complexType>
</xs:element>

<xs:element name="gadgets">
   <xs:complexType>
	<xs:simpleContent>
	   <xs:extension base="xs:string">
		<xs:attribute name="enc" use="optional" type="xs:string"/>
	   </xs:extension>
	</xs:simpleContent>
   </xs:complexType>
</xs:element>

<xs:element name="callsites">
   <xs:complexType>
	<xs:sequence>
	   <xs:element maxOccurs="unbounded" minOccurs="0" ref="callsite-entry"/>
	</xs:sequence>
   </xs:complexType>
</xs:element>

<xs:element name="callsite-entry">
   <xs:complexType>
	<xs:all>
	   <xs:element name="address" minOccurs="0" type="xs:string" />
	   <xs:element name="module-name" minOccurs="0" type="xs:string" />
	   <xs:element name="count" minOccurs="0" type="xs:integer" />
	</xs:all>
   </xs:complexType>
</xs:element>

<xs:element name="callstack">
   <xs:complexType>
	<xs:sequence>
	   <xs:element minOccurs="0" maxOccurs="unbounded" ref="callstack-entry"/>
	   <xs:element minOccurs="0" maxOccurs="unbounded" ref="Frame"/>
	</xs:sequence>
   </xs:complexType>
</xs:element>

<xs:element name="callstack-entry">
   <xs:complexType>
	<xs:sequence>
	   <xs:element maxOccurs="unbounded" minOccurs="0" name="frame-number" type="xs:string"/>
	   <xs:element maxOccurs="unbounded" minOccurs="0" name="instruction-address" type="xs:string"/>
	   <xs:element maxOccurs="unbounded" minOccurs="0" name="module-name" type="xs:string"/>
	   <xs:element maxOccurs="unbounded" minOccurs="0" name="symbol-name" type="xs:string"/>
	   <xs:element maxOccurs="unbounded" minOccurs="0" name="symbol-displacement" type="xs:string"/>
	</xs:sequence>
   </xs:complexType>
</xs:element>

<xs:element name="fid">
   <xs:complexType>
	<xs:simpleContent>
	   <xs:extension base="xs:string">
		<xs:attribute name="ads" use="optional" type="xs:string"/>
	   </xs:extension>
	</xs:simpleContent>
   </xs:complexType>
</xs:element>

<xs:element name="Frame">
   <xs:complexType>
	<xs:all>
	   <xs:element minOccurs="0" name="Child-SP" type="xs:string"/>
	   <xs:element minOccurs="0" name="EBP" type="xs:string"/>
	   <xs:element minOccurs="0" name="Ret" type="xs:string"/>
	   <xs:element minOccurs="0" name="Arg1" type="xs:string"/>
	   <xs:element minOccurs="0" name="Arg2" type="xs:string"/>
	   <xs:element minOccurs="0" name="Arg3" type="xs:string"/>
	   <xs:element minOccurs="0" name="Arg4" type="xs:string"/>
	   <xs:element minOccurs="0" name="Symbol" type="xs:string"/>
	</xs:all>
	<xs:attribute name="number" use="required" type="xs:string"/>
   </xs:complexType>
</xs:element>

<xs:element name="Instructions">
   <xs:complexType>
	<xs:sequence>
	   <xs:element ref="Instruction" maxOccurs="unbounded" minOccurs="0"/>
	</xs:sequence>
   </xs:complexType>
</xs:element>

<xs:element name="Instruction">
   <xs:complexType>
	<xs:all>
	   <xs:element minOccurs="0" name="Address" type="xs:string"/>
	   <xs:element minOccurs="0" name="Opcode" type="xs:string"/>
	   <xs:element minOccurs="0" name="Mnemonic" type="xs:string"/>
	   <xs:element minOccurs="0" name="Arguments" type="xs:string"/>
	</xs:all>
	<xs:attribute name="Number" use="optional" type="xs:string"/>
	<xs:attribute name="EspOffset" use="optional" type="xs:string"/>
   </xs:complexType>
</xs:element>

<xs:element name="EIPInfo">
   <xs:complexType>
	<xs:all>
	   <xs:element minOccurs="0" name="InstructionPtr" type="xs:string"/>
	   <xs:element minOccurs="0" name="InstructionModule" type="xs:string"/>
	</xs:all>
   </xs:complexType>
</xs:element>

<xs:element name="teb">
   <xs:complexType>
	<xs:choice minOccurs="0" maxOccurs="unbounded">
	   <xs:sequence>
		<xs:element ref="ExceptionList" minOccurs="0"/>
		<xs:element ref="StackBase" minOccurs="0"/>
		<xs:element ref="StackLimit" minOccurs="0"/>
		<xs:element minOccurs="0" ref="Self"/>
		<xs:element minOccurs="0" ref="ClientId"/>
		<xs:element minOccurs="0" ref="PEBAddress"/>
		<xs:element minOccurs="0" ref="LastErrorValue"/>
		<xs:element minOccurs="0" ref="LastStatusValue"/>
	   </xs:sequence>
	</xs:choice>
   </xs:complexType>
</xs:element>

<xs:element name="registers">
   <xs:complexType>
	<xs:choice minOccurs="0" maxOccurs="unbounded">
	   <xs:sequence>
		<xs:choice>
		   <xs:sequence>
			<xs:element name="rax" type="xs:string" minOccurs="0"/>
			<xs:element name="rbx" type="xs:string" minOccurs="0"/>
			<xs:element name="rcx" type="xs:string" minOccurs="0"/>
			<xs:element name="rdx" type="xs:string" minOccurs="0"/>
			<xs:element name="rsi" type="xs:string" minOccurs="0"/>
			<xs:element name="rdi" type="xs:string" minOccurs="0"/>
			<xs:element name="rip" type="xs:string" minOccurs="0"/>
			<xs:element name="rsp" type="xs:string" minOccurs="0"/>
			<xs:element name="rbp" type="xs:string" minOccurs="0"/>
		   </xs:sequence>
		   <xs:sequence>
			<xs:element name="eax" type="xs:string" minOccurs="0"/>
			<xs:element name="ebx" type="xs:string" minOccurs="0"/>
			<xs:element name="ecx" type="xs:string" minOccurs="0"/>
			<xs:element name="edx" type="xs:string" minOccurs="0"/>
			<xs:element name="esi" type="xs:string" minOccurs="0"/>
			<xs:element name="edi" type="xs:string" minOccurs="0"/>
			<xs:element name="eip" type="xs:string" minOccurs="0"/>
			<xs:element name="esp" type="xs:string" minOccurs="0"/>
			<xs:element name="ebp" type="xs:string" minOccurs="0"/>
		   </xs:sequence>
		</xs:choice>
		   <xs:element name="r8" type="xs:string" minOccurs="0"/>
		   <xs:element name="r9" type="xs:string" minOccurs="0"/>
		   <xs:element name="r10" type="xs:string" minOccurs="0"/>
		   <xs:element name="r11" type="xs:string" minOccurs="0"/>
		   <xs:element name="r12" type="xs:string" minOccurs="0"/>
		   <xs:element name="r13" type="xs:string" minOccurs="0"/>
		   <xs:element name="r14" type="xs:string" minOccurs="0"/>
		   <xs:element name="r15" type="xs:string" minOccurs="0"/>
		   <xs:element name="iopl" type="xs:string" minOccurs="0"/>
		   <xs:element name="cs" type="xs:string" minOccurs="0"/>
		   <xs:element name="ss" type="xs:string" minOccurs="0"/>
		   <xs:element name="ds" type="xs:string" minOccurs="0"/>
		   <xs:element name="es" type="xs:string" minOccurs="0"/>
		   <xs:element name="fs" type="xs:string" minOccurs="0"/>
		   <xs:element name="gs" type="xs:string" minOccurs="0"/>
		   <xs:element name="efl" type="xs:string" minOccurs="0"/>
	   </xs:sequence>
		</xs:choice>
   </xs:complexType>
</xs:element>

<xs:element name="appexception">
   <xs:complexType>
	<xs:complexContent>
	   <xs:extension base="FeELEvent">
		<xs:all>
		   <xs:element ref="processinfo"/>
		   <xs:element minOccurs="0" name="processor" type="xs:string"/>
		   <xs:element minOccurs="0" name="exception_faulting_address" type="xs:string"/>
		   <xs:element minOccurs="0" name="exception_code" type="xs:string"/>
		   <xs:element minOccurs="0" name="exception_level" type="xs:string"/>
		   <xs:element minOccurs="0" name="exception_type" type="xs:string"/>
		   <xs:element minOccurs="0" ref="EIPInfo"/>
		   <xs:element minOccurs="0" name="InstructionPtr" type="xs:string"/>
		   <xs:element ref="StackAddress" minOccurs="0"/>
		   <xs:element ref="StackBottom" minOccurs="0"/>
		   <xs:element ref="StackTop" minOccurs="0"/>
		   <xs:element minOccurs="0" name="StackRegionBase" type="xs:string"/>
		   <xs:element minOccurs="0" name="StackRegionLimit" type="xs:string"/>
		   <xs:element minOccurs="0" name="StackPtr" type="xs:string"/>
		   <xs:element minOccurs="0" ref="Instructions"/>
		   <xs:element minOccurs="0" name="Skip" type="xs:string"/>
		   <xs:element minOccurs="0" name="instruction_address" type="xs:string"/>
		   <xs:element minOccurs="0" name="instruction_module" type="xs:string"/>
		   <xs:element minOccurs="0" name="faulting_instruction" type="xs:string"/>
		   <xs:element minOccurs="0" name="FaultingInstruction" type="xs:string"/>
		   <xs:element minOccurs="0" name="FaultingAddress" type="xs:string"/>
		   <xs:element minOccurs="0" name="description" type="xs:string"/>
		   <xs:element minOccurs="0" name="classification" type="xs:string"/>
		   <xs:element minOccurs="0" ref="registers"/>
		   <xs:element minOccurs="0" ref="teb"/>
		   <xs:element minOccurs="0" ref="callstack"/>
		   <xs:element minOccurs="0" name="bug_title" type="xs:string"/>
		   <xs:element name="rebootdependent" minOccurs="0" type="xs:string"/>
		   <xs:element name="spanalysis" minOccurs="0" type="xs:string"/>
		   <xs:element minOccurs="0" name="Address" type="xs:string"/>
		   <xs:element minOccurs="0" name="Content" type="xs:string"/>
		</xs:all>
		<xs:attribute name="mode" use="optional" type="xs:string"/>
		<xs:attribute name="type" use="optional" type="xs:string"/>
		<xs:attribute name="suppressed" use="optional" type="xs:string"/>
		<xs:attribute name="reason" use="optional" type="xs:string"/>
		<xs:attribute name="src_thread" use="optional" type="xs:string"/>
		<xs:attribute name="timestamp" use="optional" type="xs:integer"/>
		<xs:attribute name="repeat" use="optional" type="xs:integer"/>
	   </xs:extension>
	</xs:complexContent>
   </xs:complexType>
</xs:element>

<xs:element name="appexception_data">
   <xs:complexType>
	<xs:complexContent>
	   <xs:extension base="FeELEvent">
		<xs:all>
		   <xs:element ref="processinfo"/>
		   <xs:element minOccurs="0" name="data" type="xs:string"/>
		   <xs:element name="rebootdependent" minOccurs="0" type="xs:string"/>
		   <xs:element name="spanalysis" minOccurs="0" type="xs:string"/>
		</xs:all>
		<xs:attribute name="mode" use="optional" type="xs:string"/>
		<xs:attribute name="sequence" use="optional" type="xs:string"/>
		<xs:attribute name="src_thread" use="optional" type="xs:string"/>
		<xs:attribute name="timestamp" use="optional" type="xs:integer"/>
		<xs:attribute name="repeat" use="optional" type="xs:integer"/>
	   </xs:extension>
	</xs:complexContent>
   </xs:complexType>
</xs:element>

<xs:element name="debugcontrol">
   <xs:complexType>
	<xs:complexContent>
	   <xs:extension base="FeELEvent">
		<xs:all>
		   <xs:element minOccurs="0" name="ntstatus" type="xs:string"/>
		   <xs:element ref="processinfo"/>
		   <xs:element minOccurs="0" name="controlcode" type="xs:string"/>
		   <xs:element minOccurs="0" name="codedescription" type="xs:string"/>
		   <xs:element name="rebootdependent" minOccurs="0" type="xs:string"/>
		   <xs:element name="spanalysis" minOccurs="0" type="xs:string"/>
		</xs:all>
		<xs:attribute name="src_thread" use="optional" type="xs:string"/>
		<xs:attribute name="timestamp" use="optional" type="xs:integer"/>
		<xs:attribute name="mode" use="optional" type="xs:string"/>
		<xs:attribute name="repeat" use="optional" type="xs:integer"/>
	   </xs:extension>
	</xs:complexContent>
   </xs:complexType>
</xs:element>

<xs:element name="SUSPICIOUS_OBJECT_CREATION">
   <xs:complexType>
	<xs:complexContent>
	   <xs:extension base="FeELEvent">
		<xs:all>
		   <xs:element ref="processinfo"/>
		   <xs:element minOccurs="0" name="clsid" type="xs:string"/>
		   <xs:element minOccurs="0" name="desc" type="xs:string"/>
		   <xs:element minOccurs="0" name="progid" type="xs:string"/>
		   <xs:element name="rebootdependent" minOccurs="0" type="xs:string"/>
		   <xs:element name="spanalysis" minOccurs="0" type="xs:string"/>
		</xs:all>
		<xs:attribute name="mode" use="optional" type="xs:string"/>
		<xs:attribute name="src_thread" use="optional" type="xs:string"/>
		<xs:attribute name="timestamp" use="optional" type="xs:integer"/>
		<xs:attribute name="repeat" use="optional" type="xs:integer"/>
		<xs:attribute name="dtype" use="optional" type="xs:string"/>
	   </xs:extension>
	</xs:complexContent>
   </xs:complexType>
</xs:element>

<xs:element name="hiddenproc">
   <xs:complexType>
	<xs:complexContent>
	   <xs:extension base="FeELEvent">
		<xs:all>
		   <xs:element ref="processinfo"/>
		   <xs:element minOccurs="0" name="imagename" type="xs:string"/>
		   <xs:element name="rebootdependent" minOccurs="0" type="xs:string"/>
		   <xs:element name="spanalysis" minOccurs="0" type="xs:string"/>
		</xs:all>
		<xs:attribute name="mode" use="optional" type="xs:string"/>
		<xs:attribute name="src_thread" use="optional" type="xs:string"/>
		<xs:attribute name="timestamp" use="optional" type="xs:integer"/>
		<xs:attribute name="repeat" use="optional" type="xs:integer"/>
		<xs:attribute name="dtype" use="optional" type="xs:string"/>
	   </xs:extension>
	</xs:complexContent>
   </xs:complexType>
</xs:element>

<xs:element name="dll-exports">
   <xs:complexType>
	<xs:complexContent>
	   <xs:extension base="FeELEvent">
		<xs:all>
		   <xs:element ref="dllname"/>
		   <xs:element minOccurs="0" ref="exports"/>
		   <xs:element name="rebootdependent" minOccurs="0" type="xs:string"/>
		   <xs:element name="spanalysis" minOccurs="0" type="xs:string"/>
		</xs:all>
		<xs:attribute name="src_thread" use="optional" type="xs:string"/>
		<xs:attribute name="timestamp" use="optional" type="xs:integer"/>
		<xs:attribute name="repeat" use="optional" type="xs:integer"/>
	   </xs:extension>
	</xs:complexContent>
   </xs:complexType>
</xs:element>

<xs:element name="exports">
   <xs:complexType>
	<xs:sequence>
	   <xs:element name="export-function" type="xs:string" maxOccurs="unbounded" minOccurs="0"/>
	</xs:sequence>
	<xs:attribute name="TotalCount" use="optional" type="xs:integer"/>
	<xs:attribute name="ValidName" use="optional" type="xs:string"/>
   </xs:complexType>
</xs:element>

<xs:element name="AsyncKeyLogger">
   <xs:complexType>
	<xs:complexContent>
	   <xs:extension base="FeELEvent">
		<xs:all>
		   <xs:element ref="processinfo"/>
		   <xs:element name="ProbePattern" type="xs:string"/>
		   <xs:element name="Yields" type="xs:string"/>
		   <xs:element name="Probes" type="xs:string"/>
		   <xs:element name="KeyLoggerType" type="xs:string" minOccurs="0" />
		   <xs:element name="rebootdependent" minOccurs="0" type="xs:string"/>
		   <xs:element name="spanalysis" minOccurs="0" type="xs:string"/>
		</xs:all>
		<xs:attribute name="name" use="required" type="xs:string"/>
		<xs:attribute name="src_thread" use="optional" type="xs:string"/>
		<xs:attribute name="timestamp" use="optional" type="xs:integer"/>
		<xs:attribute name="repeat" use="optional" type="xs:integer"/>
	   </xs:extension>
	</xs:complexContent>
   </xs:complexType>
</xs:element>

<xs:element name="CmdLine">
   <xs:complexType>
	<xs:complexContent>
	   <xs:extension base="FeELEvent">
		<xs:sequence>
		   <xs:element ref="value"/>
		   <xs:element name="ExitCode" type="xs:string"/>
		   <xs:element name="rebootdependent" minOccurs="0" type="xs:string"/>
		   <xs:element name="spanalysis" minOccurs="0" type="xs:string"/>
		</xs:sequence>
		<xs:attribute name="timestamp" use="optional" type="xs:integer"/>
	   </xs:extension>
	</xs:complexContent>
   </xs:complexType>
</xs:element>

<xs:element name="spooler-dll-injection">
   <xs:complexType>
	<xs:complexContent>
	   <xs:extension base="FeELEvent">
		<xs:all>
		   <xs:element ref="processinfo" minOccurs="0"/>
		   <xs:element ref="dllname" minOccurs="0"/>
		   <xs:element ref="apiname" minOccurs="0"/>
		   <xs:element ref="address" minOccurs="0"/>
		   <xs:element ref="params" minOccurs="0"/>
		   <xs:element name="rebootdependent" minOccurs="0" type="xs:string"/>
		   <xs:element name="spanalysis" minOccurs="0" type="xs:string"/>
		</xs:all>
		<xs:attribute name="src_thread" use="optional" type="xs:string"/>
		<xs:attribute name="timestamp" use="optional" type="xs:integer"/>
		<xs:attribute name="repeat" use="optional" type="xs:integer"/>
	   </xs:extension>
	</xs:complexContent>
   </xs:complexType>
</xs:element>

<xs:element name="firefox">
   <xs:complexType>
	<xs:complexContent>
	   <xs:extension base="FeELEvent">
		<xs:all>
		   <xs:element name="old_homepage" type="xs:string" minOccurs="0"/>
		   <xs:element name="new_homepage" type="xs:string" minOccurs="0"/>
		   <xs:element ref="pid" minOccurs="0"/>
		   <xs:element name="rebootdependent" minOccurs="0" type="xs:string"/>
		   <xs:element name="spanalysis" minOccurs="0" type="xs:string"/>
		</xs:all>
		<xs:attribute name="mode" use="required" type="xs:string"/>
		<xs:attribute name="src_thread" use="optional" type="xs:string"/>
		<xs:attribute name="timestamp" use="optional" type="xs:integer"/>
		<xs:attribute name="repeat" use="optional" type="xs:integer"/>
	   </xs:extension>
	</xs:complexContent>
   </xs:complexType>
</xs:element>

<xs:element name="systemshutdown">
   <xs:complexType>
	<xs:complexContent>
	   <xs:extension base="FeELEvent">
		<xs:all>
		   <xs:element ref="processinfo" minOccurs="0"/>
		   <xs:element name="action" type="xs:string"/>
		   <xs:element name="actiondescription" type="xs:string"/>
		   <xs:element name="rebootdependent" minOccurs="0" type="xs:string"/>
		   <xs:element name="spanalysis" minOccurs="0" type="xs:string"/>
		</xs:all>
		<xs:attribute name="src_thread" use="optional" type="xs:string"/>
		<xs:attribute name="timestamp" use="optional" type="xs:integer"/>
		<xs:attribute name="repeat" use="optional" type="xs:integer"/>
	   </xs:extension>
	</xs:complexContent>
   </xs:complexType>
</xs:element>

<xs:element name="SSDT">
   <xs:complexType>
	<xs:complexContent>
	   <xs:extension base="FeELEvent">
		<xs:all>
		   <xs:element ref="processinfo" minOccurs="0"/>
		   <xs:element name="GPA" minOccurs="0" type="xs:string"/>
		   <xs:element name="function" minOccurs="0" type="xs:string"/>
		   <xs:element name="newvalue" minOccurs="0" type="xs:string"/>
		   <xs:element name="target" minOccurs="0" type="xs:string"/>
		   <xs:element name="mode" minOccurs="0" type="xs:string"/>
		   <xs:element name="value" minOccurs="0" type="xs:string"/>
		   <xs:element name="rebootdependent" minOccurs="0" type="xs:string"/>
		   <xs:element name="spanalysis" minOccurs="0" type="xs:string"/>
		</xs:all>
		<xs:attribute type="xs:integer" name="timestamp" use="optional"/>
		<xs:attribute name="dtype" use="optional" type="xs:string"/>
		<xs:attribute name="src_thread" use="optional" type="xs:string"/>
		<xs:attribute name="repeat" use="optional" type="xs:integer"/>
	   </xs:extension>
	</xs:complexContent>
   </xs:complexType>
</xs:element>

<xs:element name="started" type="xs:string"/>

<xs:element name="values">
   <xs:complexType>
	<xs:sequence>
	   <xs:element ref="value" maxOccurs="unbounded" minOccurs="0"/>
	</xs:sequence>
   </xs:complexType>
</xs:element>

<xs:element name="value">
   <xs:complexType>
	<xs:simpleContent>
	   <xs:extension base="xs:string">
		<xs:attribute name="result" use="optional" type="xs:string"/>
		<xs:attribute name="action" use="optional" type="xs:string"/>
	   </xs:extension>
	</xs:simpleContent>
   </xs:complexType>
</xs:element>

<xs:element name="bytesreceived" type="xs:string"/>
<xs:element name="totalmemory" type="xs:string"/>
<xs:element name="filesize" type="xs:string"/>
<xs:element name="md5sum" type="xs:string"/>
<xs:element name="sha1sum" type="xs:string"/>
<xs:element name="pid" type="xs:integer"/>
<xs:element name="tid" type="xs:string"/>
<xs:element name="current_tid" type="xs:string"/>
<xs:element name="hidden_tid" type="xs:string"/>

<xs:element name="uac">
   <xs:complexType>
	<xs:complexContent>
	   <xs:extension base="FeELEvent">
		<xs:all>
		   <xs:element ref="value" minOccurs="0"/>
		   <xs:element minOccurs="0" name="status" type="xs:string"/>
		   <xs:element minOccurs="0" name="accountenabled" type="xs:string"/>
		   <xs:element minOccurs="0" name="accountcreated" type="xs:string"/>
		   <xs:element minOccurs="0" name="accountname" type="xs:string"/>
		   <xs:element minOccurs="0" name="passwordchange" type="xs:string"/>
		   <xs:element minOccurs="0" name="group" type="xs:string"/>
		   <xs:element minOccurs="0" name="memberadded" type="xs:string"/>
		   <xs:element minOccurs="0" name="memberremoved" type="xs:string"/>
		   <xs:element name="rebootdependent" minOccurs="0" type="xs:string"/>
		   <xs:element name="spanalysis" minOccurs="0" type="xs:string"/>
		</xs:all>
		<xs:attribute name="mode" type="xs:string"/>
		<xs:attribute name="src_thread" use="optional" type="xs:string"/>
		<xs:attribute name="timestamp" use="optional" type="xs:integer"/>
		<xs:attribute name="repeat" use="optional" type="xs:integer"/>
	   </xs:extension>
	</xs:complexContent>
   </xs:complexType>
</xs:element>

<xs:element name="dialog-dismissed">
   <xs:complexType>
	<xs:complexContent>
	   <xs:extension base="FeELEvent">
		<xs:all>
		   <xs:element ref="processinfo" minOccurs="0"/>
		   <xs:element ref="pid" minOccurs="0"/>
		   <xs:element name="dlg-id" type="xs:string" minOccurs="0"/>
		   <xs:element name="note" type="xs:string" minOccurs="0"/>
		   <xs:element name="hwnd" type="xs:string" minOccurs="0"/>
		   <xs:element name="rebootdependent" minOccurs="0" type="xs:string"/>
		   <xs:element name="spanalysis" minOccurs="0" type="xs:string"/>
		</xs:all>
		<xs:attribute name="timestamp" use="optional" type="xs:integer"/>
		<xs:attribute name="repeat" use="optional" type="xs:integer"/>
		<xs:attribute name="windowless" use="optional" type="xs:string"/>
	   </xs:extension>
	</xs:complexContent>
   </xs:complexType>
</xs:element>

<xs:element name="dialog-detected">
   <xs:complexType>
	<xs:complexContent>
	   <xs:extension base="FeELEvent">
		<xs:all>
		   <xs:element ref="processinfo" minOccurs="0"/>
		   <xs:element name="hwnd" type="xs:string" minOccurs="0"/>
		   <xs:element name="dlg-id" type="xs:string" minOccurs="0"/>
		   <xs:element name="rebootdependent" minOccurs="0" type="xs:string"/>
		   <xs:element name="spanalysis" minOccurs="0" type="xs:string"/>
		</xs:all>
		<xs:attribute name="timestamp" use="optional" type="xs:integer"/>
		<xs:attribute name="repeat" use="optional" type="xs:integer"/>
		<xs:attribute name="windowless" use="optional" type="xs:string"/>
	   </xs:extension>
	</xs:complexContent>
   </xs:complexType>
</xs:element>

<xs:element name="text-fields">
   <xs:complexType>
	<xs:sequence>
	   <xs:element ref="text-field" maxOccurs="unbounded" minOccurs="0"/>
	</xs:sequence>
   </xs:complexType>
</xs:element>

<xs:element name="text-field">
   <xs:complexType>
	<xs:simpleContent>
	   <xs:extension base="xs:string">
		<xs:attribute name="id" use="required" type="xs:integer"/>
	   </xs:extension>
	</xs:simpleContent>
   </xs:complexType>
</xs:element>

<xs:element name="new-dialog-popup">
   <xs:complexType>
	<xs:complexContent>
	   <xs:extension base="FeELEvent">
		<xs:all>
		   <xs:element ref="processinfo" minOccurs="0"/>
		   <xs:element name="hwnd" type="xs:string" minOccurs="0"/>
		   <xs:element name="title" type="xs:string" minOccurs="0"/>
		   <xs:element name="window-class" type="xs:string" minOccurs="0"/>
		   <xs:element name="size-width" type="xs:integer" minOccurs="0"/>
		   <xs:element name="size-height" type="xs:integer" minOccurs="0"/>
		   <xs:element name="position-x" type="xs:integer" minOccurs="0"/>
		   <xs:element name="position-y" type="xs:integer" minOccurs="0"/>
		   <xs:element name="visible" type="xs:string" minOccurs="0"/>
		   <xs:element name="topmost" type="xs:string" minOccurs="0"/>
		   <xs:element ref="text-fields" minOccurs="0"/>
		   <xs:element name="rebootdependent" minOccurs="0" type="xs:string"/>
		   <xs:element name="spanalysis" minOccurs="0" type="xs:string"/>
		</xs:all>
		<xs:attribute name="timestamp" use="optional" type="xs:integer"/>
		<xs:attribute name="repeat" use="optional" type="xs:integer"/>
	   </xs:extension>
	</xs:complexContent>
   </xs:complexType>
</xs:element>

<xs:element name="popup-dialog">
   <xs:complexType>
	<xs:complexContent>
	   <xs:extension base="FeELEvent">
		<xs:choice maxOccurs="unbounded" minOccurs="0">
		   <xs:element name="title" type="xs:string" minOccurs="0"/>
		   <xs:element name="static" type="xs:string" minOccurs="0"/>
		   <xs:element ref="processinfo"  minOccurs="0"/>
		   <xs:element name="rebootdependent" minOccurs="0" type="xs:string"/>
		   <xs:element name="spanalysis" minOccurs="0" type="xs:string"/>
		</xs:choice>
		<xs:attribute name="src_thread" use="optional" type="xs:string"/>
		<xs:attribute name="timestamp" use="optional" type="xs:integer"/>
		<xs:attribute name="repeat" use="optional" type="xs:integer"/>
	   </xs:extension>
	</xs:complexContent>
   </xs:complexType>
</xs:element>

<xs:element name="thread">
   <xs:complexType>
	<xs:complexContent>
	   <xs:extension base="FeELEvent">
		<xs:all>
		   <xs:element name="desiredaccess" type="xs:string" minOccurs="0"/>
		   <xs:element name="ntstatus" type="xs:string" minOccurs="0"/>
		   <xs:element ref="processinfo" minOccurs="0"/>
		   <xs:element name="imagepath" type="xs:string" minOccurs="0"/>
		   <xs:element name="md5sum" type="xs:string" minOccurs="0"/>
		   <xs:element ref="source" minOccurs="0"/>
		   <xs:element ref="target" minOccurs="0"/>
		   <xs:element ref="tid" minOccurs="0"/>
		   <xs:element ref="current_tid" minOccurs="0"/>
		   <xs:element ref="hidden_tid" minOccurs="0"/>
		   <xs:element ref="duplicate_source" minOccurs="0"/>
		   <xs:element ref="duplicate_target" minOccurs="0"/>
		   <xs:element name="InheritHandle" type="xs:string" minOccurs="0"/>
		   <xs:element name="Options" type="xs:string" minOccurs="0"/>
		   <xs:element ref="apc_routine" minOccurs="0"/>
		   <xs:element ref="apc_routine_context" minOccurs="0"/>
		   <xs:element ref="apc_routine_context2" minOccurs="0"/>
		   <xs:element ref="start_Address" minOccurs="0"/>
		   <xs:element ref="win32_Start" minOccurs="0"/>
		   <xs:element ref="context" minOccurs="0"/>
		   <xs:element ref="context2" minOccurs="0"/>
		   <xs:element name="rebootdependent" minOccurs="0" type="xs:string"/>
		   <xs:element name="spanalysis" minOccurs="0" type="xs:string"/>
		</xs:all>
		<xs:attribute name="mode" use="optional" type="xs:string"/>
		<xs:attribute name="src_thread" use="optional" type="xs:string"/>
		<xs:attribute name="timestamp" use="optional" type="xs:integer"/>
		<xs:attribute name="repeat" use="optional" type="xs:integer"/>
	   </xs:extension>
	</xs:complexContent>
   </xs:complexType>
</xs:element>

<xs:element name="start_Address">
   <xs:complexType>
	<xs:complexContent>
	   <xs:extension base="FeELEvent">
		<xs:all>
		   <xs:element ref="memory" minOccurs="0"/>
		   <xs:element name="rebootdependent" minOccurs="0" type="xs:string"/>
		   <xs:element name="spanalysis" minOccurs="0" type="xs:string"/>
		</xs:all>
	   </xs:extension>
	</xs:complexContent>
   </xs:complexType>
</xs:element>

<xs:element name="win32_Start">
   <xs:complexType>
	<xs:complexContent>
	   <xs:extension base="FeELEvent">
		<xs:all>
		   <xs:element ref="memory" minOccurs="0"/>
		   <xs:element name="rebootdependent" minOccurs="0" type="xs:string"/>
		   <xs:element name="spanalysis" minOccurs="0" type="xs:string"/>
		</xs:all>
	   </xs:extension>
	</xs:complexContent>
   </xs:complexType>
</xs:element>

<xs:element name="context2">
   <xs:complexType>
	<xs:complexContent>
	   <xs:extension base="FeELEvent">
		<xs:all>
		   <xs:element ref="memory" minOccurs="0"/>
		   <xs:element name="rebootdependent" minOccurs="0" type="xs:string"/>
		   <xs:element name="spanalysis" minOccurs="0" type="xs:string"/>
		</xs:all>
	   </xs:extension>
	</xs:complexContent>
   </xs:complexType>
</xs:element>

<xs:element name="context">
   <xs:complexType>
	<xs:complexContent>
	   <xs:extension base="FeELEvent">
		<xs:all>
		   <xs:element ref="memory" minOccurs="0"/>
		   <xs:element name="rebootdependent" minOccurs="0" type="xs:string"/>
		   <xs:element name="spanalysis" minOccurs="0" type="xs:string"/>
		</xs:all>
	   </xs:extension>
	</xs:complexContent>
   </xs:complexType>
</xs:element>

<xs:element name="apc_routine">
   <xs:complexType mixed="true">
	<xs:complexContent>
	   <xs:extension base="FeELEvent">
		<xs:all>
		   <xs:element ref="memory" minOccurs="0"/>
		   <xs:element name="rebootdependent" minOccurs="0" type="xs:string"/>
		   <xs:element name="spanalysis" minOccurs="0" type="xs:string"/>
		</xs:all>
	   </xs:extension>
	</xs:complexContent>
   </xs:complexType>
</xs:element>

<xs:element name="apc_routine_context2">
   <xs:complexType mixed="true">
	<xs:complexContent>
	   <xs:extension base="FeELEvent">
		<xs:all>
		   <xs:element ref="memory" minOccurs="0"/>
		   <xs:element name="rebootdependent" minOccurs="0" type="xs:string"/>
		   <xs:element name="spanalysis" minOccurs="0" type="xs:string"/>
		</xs:all>
	   </xs:extension>
	</xs:complexContent>
   </xs:complexType>
</xs:element>

<xs:element name="apc_routine_context">
   <xs:complexType mixed="true">
	<xs:complexContent>
	   <xs:extension base="FeELEvent">
		<xs:all>
		   <xs:element ref="memory" minOccurs="0"/>
		   <xs:element name="rebootdependent" minOccurs="0" type="xs:string"/>
		   <xs:element name="spanalysis" minOccurs="0" type="xs:string"/>
		</xs:all>
	   </xs:extension>
	</xs:complexContent>
   </xs:complexType>
</xs:element>

<xs:element name="javacall">
   <xs:complexType>
	<xs:complexContent>
	   <xs:extension base="FeELEvent">
		<xs:all>
		   <xs:element ref="processinfo" minOccurs="0"/>
		   <xs:element name="class" type="xs:string" minOccurs="0"/>
		   <xs:element name="parentClass" type="xs:string" minOccurs="0"/>
		   <xs:element name="method" type="xs:string" minOccurs="0"/>
		   <xs:element name="parentMethod" type="xs:string" minOccurs="0"/>
		   <xs:element name="this" type="xs:string" minOccurs="0"/>
		   <xs:element ref="params" minOccurs="0"/>
		   <xs:element name="rebootdependent" minOccurs="0" type="xs:string"/>
		   <xs:element name="spanalysis" minOccurs="0" type="xs:string"/>
		</xs:all>
		<xs:attribute name="context" use="optional" type="xs:string"/>
		<xs:attribute name="repeat" use="optional" type="xs:integer"/>
		<xs:attribute name="src_thread" use="optional" type="xs:string"/>
		<xs:attribute name="timestamp" use="optional" type="xs:integer"/>
	   </xs:extension>
	</xs:complexContent>
   </xs:complexType>
</xs:element>

<xs:element name="javaevent">
   <xs:complexType>
	<xs:complexContent>
	   <xs:extension base="FeELEvent">
		<xs:all>
		   <xs:element name="id" type="xs:string" minOccurs="0"/>
		   <xs:element name="rebootdependent" minOccurs="0" type="xs:string"/>
		   <xs:element name="spanalsis" minOccurs="0" type="xs:string"/>
		</xs:all>
		<xs:attribute name="context" use="optional" type="xs:string"/>
		<xs:attribute name="src_thread" use="optional" type="xs:string"/>
		<xs:attribute name="timestamp" use="optional" type="xs:integer"/>
		<xs:attribute name="repeat" use="optional" type="xs:integer"/>
	   </xs:extension>
	</xs:complexContent>
   </xs:complexType>
</xs:element>

<xs:element name="eventlogcmd">
   <xs:complexType>
	<xs:complexContent>
	   <xs:extension base="FeELEvent">
		<xs:all>
		   <xs:element ref="value" minOccurs="0"/>
		   <xs:element name="exitcode" type="xs:string" minOccurs="0"/>
		   <xs:element name="rebootdependent" minOccurs="0" type="xs:string"/>
		   <xs:element name="spanalysis" minOccurs="0" type="xs:string"/>
		</xs:all>
		<xs:attribute name="context" use="optional" type="xs:string"/>
		<xs:attribute name="src_thread" use="optional" type="xs:string"/>
		<xs:attribute name="timestamp" use="optional" type="xs:integer"/>
		<xs:attribute name="repeat" use="optional" type="xs:integer"/>
	   </xs:extension>
	</xs:complexContent>
   </xs:complexType>
</xs:element>

<xs:element name="alive">
   <xs:complexType/>
</xs:element>

<xs:element name="BootSectorModified">
   <xs:complexType>
	<xs:complexContent>
	   <xs:extension base="FeELEvent">
		<xs:all>
		   <xs:element name="md5sum_original" type="xs:string" minOccurs="0"/>
		   <xs:element name="md5sum_orginal" type="xs:string" minOccurs="0"/>
		   <xs:element name="md5sum_current" type="xs:string" minOccurs="0"/>
		   <xs:element name="rebootdependent" minOccurs="0" type="xs:string"/>
		   <xs:element name="spanalysis" minOccurs="0" type="xs:string"/>
		</xs:all>
		<xs:attribute name="src_thread" use="optional" type="xs:string"/>
		<xs:attribute name="timestamp" use="optional" type="xs:integer"/>
		<xs:attribute name="repeat" use="optional" type="xs:integer"/>
	   </xs:extension>
	</xs:complexContent>
   </xs:complexType>
</xs:element>

<xs:element name="api_patch">
   <xs:complexType>
	<xs:complexContent>
	   <xs:extension base="FeELEvent">
		<xs:all>
		   <xs:element ref="source" minOccurs="0"/>
		   <xs:element ref="processinfo" minOccurs="0"/>
		   <xs:element minOccurs="0" ref="target"/>
		   <xs:element ref="dllname" minOccurs="0"/>
		   <xs:element ref="apiname" minOccurs="0"/>
		   <xs:element ref="address" minOccurs="0"/>
		   <xs:element ref="caller_addr" minOccurs="0"/>
		   <xs:element name="size" type="xs:string" minOccurs="0"/>
		   <xs:element name="rebootdependent" minOccurs="0" type="xs:string"/>
		   <xs:element name="spanalysis" minOccurs="0" type="xs:string"/>
		</xs:all>
		<xs:attribute name="src_thread" use="optional" type="xs:string"/>
		<xs:attribute name="timestamp" use="optional" type="xs:integer"/>
		<xs:attribute name="repeat" use="optional" type="xs:integer"/>
		<xs:attribute name="target" use="optional" type="xs:string"/>
	   </xs:extension>
	</xs:complexContent>
   </xs:complexType>
</xs:element>
<xs:element name="ROP">
   <xs:complexType>
	<xs:complexContent>
	   <xs:extension base="FeELEvent">
		<xs:all>
		   <xs:element ref="processinfo"/>
		   <xs:element ref="apiname"/>
		   <xs:element ref="address" minOccurs="0"/>
		   <xs:element ref="params" minOccurs="0"/>
		   <xs:element name="valid_call_instruction" type="xs:string" minOccurs="0"/>
		   <xs:element name="ModuleName" type="xs:string" minOccurs="0"/>
		   <xs:element name="ModuleBase" type="xs:string" minOccurs="0"/>
		   <xs:element name="CallerOffset" type="xs:string" minOccurs="0"/>
		   <xs:element name="PreviousBytes" type="xs:string" minOccurs="0"/>
		   <xs:element name="ForwardBytes" type="xs:string" minOccurs="0"/>
		   <xs:element ref="StackAddress" minOccurs="0"/>
		   <xs:element ref="StackLimit" minOccurs="0"/>
		   <xs:element ref="StackBase" minOccurs="0"/>
		   <xs:element name="rebootdependent" minOccurs="0" type="xs:string"/>
		   <xs:element name="spanalysis" minOccurs="0" type="xs:string"/>
		</xs:all>
		<xs:attribute name="type" use="optional" type="xs:string"/>
		<xs:attribute name="dtype" use="optional" type="xs:string"/>
		<xs:attribute name="mode" use="optional" type="xs:string"/>
		<xs:attribute name="src_thread" use="optional" type="xs:string"/>
		<xs:attribute name="sequenceId" use="optional" type="xs:string"/>
		<xs:attribute name="timestamp" use="optional" type="xs:integer"/>
		<xs:attribute name="repeat" use="optional" type="xs:integer"/>
	   </xs:extension>
	</xs:complexContent>
   </xs:complexType>
</xs:element>

<xs:element name="SuppressionData">
   <xs:complexType>
	<xs:all>
	   <xs:element name="SPStackBase" minOccurs="0" type="xs:string"/>
	   <xs:element name="SPStackEnd" minOccurs="0" type="xs:string"/>
	   <xs:element name="ExceptionRegionBase" minOccurs="0" type="xs:string"/>
	   <xs:element name="ExceptionRegionEnd" minOccurs="0" type="xs:string"/>
	   <xs:element name="ExceptionList" minOccurs="0" type="xs:string"/>
	   <xs:element name="ExceptionListMemType" minOccurs="0" type="xs:string"/>
	   <xs:element name="ExceptionListMemProtect" minOccurs="0" type="xs:string"/>
	</xs:all>
   </xs:complexType>
</xs:element>

<xs:element name="stackpivot">
   <xs:complexType>
	<xs:complexContent>
	   <xs:extension base="FeELEvent">
		<xs:all>
		   <xs:element ref="processinfo" minOccurs="0"/>
		   <xs:element ref="apiname" minOccurs="0"/>
		   <xs:element name="CallerAddress" minOccurs="0" type="xs:string"/>
		   <xs:element name="CallerModule" minOccurs="0" type="xs:string"/>
		   <xs:element ref="StackAddress" minOccurs="0"/>
		   <xs:element ref="StackBottom" minOccurs="0"/>
		   <xs:element ref="StackTop" minOccurs="0"/>
		   <xs:element ref="params" minOccurs="0"/>
		   <xs:element name="SuppressMode" minOccurs="0" type="xs:string"/>
		   <xs:element ref="SuppressionData" minOccurs="0"/>
		   <xs:element name="rebootdependent" minOccurs="0" type="xs:string"/>
		   <xs:element name="spanalysis" minOccurs="0" type="xs:string"/>
		</xs:all>
		<xs:attribute name="suppressed" use="optional" type="xs:string"/>
		<xs:attribute name="src_thread" use="optional" type="xs:string"/>
		<xs:attribute name="timestamp" use="optional" type="xs:integer"/>
		<xs:attribute name="dtype" use="optional" type="xs:string"/>
		<xs:attribute name="repeat" use="optional" type="xs:integer"/>
	   </xs:extension>
	</xs:complexContent>
   </xs:complexType>
</xs:element>

<xs:element name="application">
   <xs:complexType>
	<xs:complexContent>
	   <xs:extension base="FeELEvent">
		<xs:all>
		   <xs:element name="rebootdependent" minOccurs="0" type="xs:string"/>
		   <xs:element name="spanalysis" minOccurs="0" type="xs:string"/>
		</xs:all>
		<xs:attribute name="app-name" use="required" type="xs:string"/>
		<xs:attribute name="timestamp" use="optional" type="xs:string"/>
	   </xs:extension>
	</xs:complexContent>
   </xs:complexType>
</xs:element>

<xs:element name="Ransom">
   <xs:complexType>
	<xs:complexContent>
	   <xs:extension base="FeELEvent">
		<xs:all>
		   <xs:element ref="pattern"/>
		   <xs:element ref="value" minOccurs="0"/>
		   <xs:element ref="md5sum" minOccurs="0"/>
		   <xs:element name="rebootdependent" minOccurs="0" type="xs:string"/>
		   <xs:element name="spanalysis" minOccurs="0" type="xs:string"/>
		</xs:all>
		<xs:attribute name="timestamp" use="optional" type="xs:string"/>
		<xs:attribute name="repeat" use="optional" type="xs:integer"/>
	   </xs:extension>
	</xs:complexContent>
   </xs:complexType>
</xs:element>

<xs:element name="Infector">
   <xs:complexType>
	<xs:complexContent>
	   <xs:extension base="FeELEvent">
		<xs:all>
		   <xs:element ref="pattern"/>
		   <xs:element ref="value" minOccurs="0"/>
		   <xs:element ref="md5sum" minOccurs="0"/>
		   <xs:element name="rebootdependent" minOccurs="0" type="xs:string"/>
		   <xs:element name="spanalysis" minOccurs="0" type="xs:string"/>
		</xs:all>
		<xs:attribute name="timestamp" use="optional" type="xs:string"/>
		<xs:attribute name="repeat" use="optional" type="xs:integer"/>
	   </xs:extension>
	</xs:complexContent>
   </xs:complexType>
</xs:element>

<xs:element name="Stealer">
   <xs:complexType>
	<xs:complexContent>
	   <xs:extension base="FeELEvent">
		<xs:all>
		   <xs:element ref="value"/>
		   <xs:element name="newPath" type="xs:string"/>
		   <xs:element ref="md5sum" minOccurs="0"/>
		   <xs:element name="rebootdependent" minOccurs="0" type="xs:string"/>
		   <xs:element name="spanalysis" minOccurs="0" type="xs:string"/>
		</xs:all>
		<xs:attribute name="timestamp" use="optional" type="xs:string"/>
		<xs:attribute name="repeat" use="optional" type="xs:integer"/>
	   </xs:extension>
	</xs:complexContent>
   </xs:complexType>
</xs:element>

<xs:element name="ProtectionChange">
   <xs:complexType>
	<xs:complexContent>
	   <xs:extension base="FeELEvent">
		<xs:all>
		   <xs:element ref="processinfo" minOccurs="0"/>
		   <xs:element ref="apiname"/>
		   <xs:element minOccurs="0" name="CallerAddress" type="xs:string"/>
		   <xs:element minOccurs="0" name="CallerModule" type="xs:string"/>
		   <xs:element minOccurs="0" name="Address" type="xs:string"/>
		   <xs:element minOccurs="0" name="Base" type="xs:string"/>
		   <xs:element minOccurs="0" name="Limit" type="xs:string"/>
		   <xs:element minOccurs="0" name="Size" type="xs:string"/>
		   <xs:element minOccurs="0" name="NewProt" type="xs:string"/>
		   <xs:element name="rebootdependent" minOccurs="0" type="xs:string"/>
		   <xs:element name="spanalysis" minOccurs="0" type="xs:string"/>
		</xs:all>
		<xs:attribute name="mode" use="optional" type="xs:string"/>
		<xs:attribute name="timestamp" use="optional" type="xs:string"/>
		<xs:attribute name="repeat" use="optional" type="xs:integer"/>
	   </xs:extension>
	</xs:complexContent>
   </xs:complexType>
</xs:element>

<xs:element name="EmbeddedObject">
   <xs:complexType>
	<xs:complexContent>
	   <xs:extension base="FeELEvent">
		<xs:all>
		   <xs:element name="Application" type="xs:string"/>
		   <xs:element ref="pid"/>
		   <xs:element minOccurs="0" name="Page" type="xs:string"/>
		   <xs:element minOccurs="0" name="Slide" type="xs:string"/>
		   <xs:element minOccurs="0" name="Sheet" type="xs:string"/>
		   <xs:element name="Type" type="xs:string"/>
		   <xs:element name="CreatorID" type="xs:string"/>
		   <xs:element minOccurs="0" name="Name" type="xs:string"/>
		   <xs:element minOccurs="0" name="ProgID" type="xs:string"/>
		   <xs:element minOccurs="0" name="Visible" type="xs:string"/>
		   <xs:element minOccurs="0" name="Enabled" type="xs:string"/>
		   <xs:element minOccurs="0" name="AutoLoad" type="xs:string"/>
		   <xs:element minOccurs="0" name="ShowIcon" type="xs:string"/>
		   <xs:element minOccurs="0" name="IconLabel" type="xs:string"/>
		   <xs:element minOccurs="0" name="IconName" type="xs:string"/>
		   <xs:element minOccurs="0" name="IconPath" type="xs:string"/>
		   <xs:element minOccurs="0" name="LinkPath" type="xs:string"/>
		   <xs:element name="rebootdependent" minOccurs="0" type="xs:string"/>
		   <xs:element name="spanalysis" minOccurs="0" type="xs:string"/>
		</xs:all>
		<xs:attribute name="timestamp" use="optional" type="xs:string"/>
		<xs:attribute name="repeat" use="optional" type="xs:integer"/>
	   </xs:extension>
	</xs:complexContent>
   </xs:complexType>
</xs:element>

<xs:element name="memory">
   <xs:complexType>
	<xs:all>
	   <xs:element minOccurs="0" name="address" type="xs:string"/>
	   <xs:element minOccurs="0" name="modulename" type="xs:string"/>
	</xs:all>
	<xs:attribute name="type" use="optional" type="xs:string"/>
	<xs:attribute name="cs" use="optional" type="xs:string"/>
   </xs:complexType>
</xs:element>

<xs:element name="droppedfile">
   <xs:complexType>
	<xs:all>
	   <xs:element minOccurs="0" name="name" type="xs:string"/>
	   <xs:element minOccurs="0" name="path" type="xs:string"/>
	</xs:all>
   </xs:complexType>
</xs:element>

<xs:element name="memory-range">
   <xs:complexType>
	<xs:all>
	   <xs:element minOccurs="0" name="note" type="xs:string"/>
	   <xs:element minOccurs="0" name="address" type="xs:string"/>
	   <xs:element minOccurs="0" name="length" type="xs:string"/>
	   <xs:element minOccurs="0" name="value" type="xs:string"/>
	</xs:all>
   </xs:complexType>
</xs:element>

<xs:element name="memory-ranges">
   <xs:complexType>
	<xs:sequence>
	   <xs:element ref="memory-range" maxOccurs="unbounded" minOccurs="0"/>
	</xs:sequence>
   </xs:complexType>
</xs:element>

<xs:element name="custom-patch">
   <xs:complexType>
	<xs:complexContent>
	   <xs:extension base="FeELEvent">
		<xs:all>
		   <xs:element ref="processinfo" minOccurs="0"/>
		   <xs:element minOccurs="0" name="module-name" type="xs:string"/>
		   <xs:element minOccurs="0" name="function-name" type="xs:string"/>
		   <xs:element minOccurs="0" name="patch-offset" type="xs:string"/>
		   <xs:element minOccurs="0" name="patch-address" type="xs:string"/>
		   <xs:element minOccurs="0" ref="memory-ranges"/>
		   <xs:element name="rebootdependent" minOccurs="0" type="xs:string"/>
		  <xs:element name="spanalysis" minOccurs="0" type="xs:string"/>
		</xs:all>
		<xs:attribute name="timestamp" use="optional" type="xs:string"/>
		<xs:attribute name="repeat" use="optional" type="xs:integer"/>
	   </xs:extension>
	</xs:complexContent>
   </xs:complexType>
</xs:element>

<xs:element name="log">
   <xs:complexType>
	<xs:complexContent>
	   <xs:extension base="FeELEvent">
		<xs:all>
		   <xs:element minOccurs="0" name="severity" type="xs:string"/>
		   <xs:element minOccurs="0" name="module" type="xs:string"/>
		   <xs:element minOccurs="0" name="message" type="xs:string"/>
		   <xs:element minOccurs="0" name="gi-time" type="xs:string"/>
		   <xs:element name="rebootdependent" minOccurs="0" type="xs:string"/>
		   <xs:element name="spanalysis" minOccurs="0" type="xs:string"/>
		</xs:all>
		<xs:attribute name="timestamp" use="optional" type="xs:string"/>
		<xs:attribute name="repeat" use="optional" type="xs:integer"/>
	   </xs:extension>
	</xs:complexContent>
   </xs:complexType>
</xs:element>

<xs:element name="Meterpreter">
   <xs:complexType>
	<xs:complexContent>
	   <xs:extension base="FeELEvent">
		<xs:all>
		   <xs:element ref="processinfo" minOccurs="0"/>
		   <xs:element minOccurs="0" name="CallerAddress" type="xs:string"/>
		   <xs:element minOccurs="0" name="EndAddress" type="xs:string"/>
		   <xs:element minOccurs="0" name="Displacement" type="xs:string"/>
		   <xs:element minOccurs="0" name="MPUrl" type="xs:string"/>
		   <xs:element name="rebootdependent" minOccurs="0" type="xs:string"/>
		   <xs:element name="spanalysis" minOccurs="0" type="xs:string"/>
		</xs:all>
		<xs:attribute name="mode" use="optional" type="xs:string"/>
		<xs:attribute name="timestamp" use="optional" type="xs:string"/>
		<xs:attribute name="repeat" use="optional" type="xs:integer"/>
	   </xs:extension>
	</xs:complexContent>
   </xs:complexType>
</xs:element>

<xs:element name="browser-plugin-start">
   <xs:complexType>
	<xs:complexContent>
	   <xs:extension base="FeELEvent">
		<xs:all>
		   <xs:element minOccurs="0" name="browser" type="xs:string"/>
		   <xs:element minOccurs="0" name="jre" type="xs:string"/>
		   <xs:element minOccurs="0" name="flash" type="xs:string"/>
		   <xs:element name="rebootdependent" minOccurs="0" type="xs:string"/>
		   <xs:element name="spanalysis" minOccurs="0" type="xs:string"/>
		</xs:all>
		<xs:attribute name="timestamp" use="optional" type="xs:string"/>
		<xs:attribute name="repeat" use="optional" type="xs:integer"/>
	   </xs:extension>
	</xs:complexContent>
   </xs:complexType>
</xs:element>

<xs:element name="high_cpu">
   <xs:complexType>
	<xs:complexContent>
	   <xs:extension base="FeELEvent">
		<xs:all>
		   <xs:element minOccurs="0" name="total_cpu" type="xs:string"/>
		   <xs:element ref="processinfo" minOccurs="0"/>
		   <xs:element name="rebootdependent" minOccurs="0" type="xs:string"/>
		   <xs:element name="spanalysis" minOccurs="0" type="xs:string"/>
		</xs:all>
		<xs:attribute name="src_thread" use="optional" type="xs:string"/>
		<xs:attribute name="timestamp" use="optional" type="xs:string"/>
		<xs:attribute name="repeat" use="optional" type="xs:integer"/>
	   </xs:extension>
	</xs:complexContent>
   </xs:complexType>
</xs:element>

<xs:element name="Quit">
   <xs:complexType>
	<xs:complexContent>
	   <xs:extension base="FeELEvent">
		<xs:all>
		   <xs:element ref="processinfo" minOccurs="0"/>
		   <xs:element name="rebootdependent" minOccurs="0" type="xs:string"/>
		   <xs:element name="spanalysis" minOccurs="0" type="xs:string"/>
		</xs:all>
		<xs:attribute name="name" use="optional" type="xs:string"/>
		<xs:attribute name="timestamp" use="optional" type="xs:string"/>
	   </xs:extension>
	</xs:complexContent>
   </xs:complexType>
</xs:element>

<xs:element name="invert_timing">
   <xs:complexType>
	<xs:complexContent>
	   <xs:extension base="FeELEvent">
		<xs:all>
		   <xs:element ref="processinfo" minOccurs="0"/>
		   <xs:element ref="dllname"/>
		   <xs:element ref="apiname"/>
		   <xs:element ref="caller_addr" minOccurs="0"/>
		   <xs:element minOccurs="0" name="backward_offset" type="xs:integer"/>
		   <xs:element minOccurs="0" name="forward_offset" type="xs:integer"/>
		   <xs:element minOccurs="0" name="hex_code" type="xs:string"/>
		   <xs:element name="rebootdependent" minOccurs="0" type="xs:string"/>
		   <xs:element name="spanalysis" minOccurs="0" type="xs:string"/>
		</xs:all>
		<xs:attribute name="timestamp" use="optional" type="xs:string"/>
	   </xs:extension>
	</xs:complexContent>
   </xs:complexType>
</xs:element>

<xs:element name="bugcheck">
   <xs:complexType>
	<xs:complexContent>
	   <xs:extension base="FeELEvent">
		<xs:all>
		   <xs:element ref="value" minOccurs="0"/>
		   <xs:element name="rebootdependent" minOccurs="0" type="xs:string"/>
		   <xs:element name="spanalysis" minOccurs="0" type="xs:string"/>
		</xs:all>
		<xs:attribute name="type" use="optional" type="xs:string"/>
		<xs:attribute name="dtype" use="optional" type="xs:string"/>
		<xs:attribute name="timestamp" use="optional" type="xs:string"/>
	   </xs:extension>
	</xs:complexContent>
   </xs:complexType>
</xs:element>

<xs:element name="FEChannel">
   <xs:complexType>
	<xs:complexContent>
	   <xs:extension base="FeELEvent">
		<xs:all>
		   <xs:element ref="processinfo" minOccurs="0"/>
		   <xs:element name="rebootdependent" minOccurs="0" type="xs:string"/>
		   <xs:element name="spanalysis" minOccurs="0" type="xs:string"/>
		</xs:all>
		<xs:attribute name="type" use="optional" type="xs:string"/>
		<xs:attribute name="action" use="optional" type="xs:string"/>
		<xs:attribute name="timestamp" use="optional" type="xs:string"/>
	   </xs:extension>
	</xs:complexContent>
   </xs:complexType>
</xs:element>

<xs:element name="Privileges">
   <xs:complexType>
	<xs:sequence>
	   <xs:element name="Privilege" maxOccurs="unbounded" minOccurs="0" type="xs:string"/>
	</xs:sequence>
	<xs:attribute name="present" use="optional" type="xs:string"/>
   </xs:complexType>
</xs:element>

<xs:element name="SuperPrivileges">
   <xs:complexType>
	<xs:all>
	   <xs:element name="Value" minOccurs="0" type="xs:string"/>
	   <xs:element ref="Privileges" minOccurs="0"/>
	</xs:all>
	<xs:attribute name="present" use="optional" type="xs:string"/>
   </xs:complexType>
</xs:element>

<xs:element name="ProcessToken">
   <xs:complexType>
	<xs:complexContent>
	   <xs:extension base="FeELEvent">
		<xs:all>
		   <xs:element ref="processinfo" minOccurs="0"/>
		   <xs:element name="LogonSession" minOccurs="0" type="xs:string"/>
		   <xs:element name="User" minOccurs="0" type="xs:string"/>
		   <xs:element ref="SuperPrivileges" minOccurs="0"/>
		   <xs:element name="rebootdependent" minOccurs="0" type="xs:string"/>
		   <xs:element name="spanalysis" minOccurs="0" type="xs:string"/>
		</xs:all>
		<xs:attribute name="mode" use="optional" type="xs:string"/>
		<xs:attribute name="type" use="optional" type="xs:string"/>
		<xs:attribute name="dtype" use="optional" type="xs:string"/>
		<xs:attribute name="timestamp" use="optional" type="xs:string"/>
	   </xs:extension>
	</xs:complexContent>
   </xs:complexType>
</xs:element>

<xs:element name="config-update">
   <xs:complexType>
	<xs:complexContent>
	   <xs:extension base="FeELEvent">
		<xs:all>
		   <xs:element name="status" minOccurs="0" type="xs:string"/>
		   <xs:element name="update-requested" minOccurs="0" type="xs:string"/>
		   <xs:element name="files" minOccurs="0" type="xs:string"/>
		   <xs:element name="version" minOccurs="0" type="xs:string"/>
		   <xs:element name="error" minOccurs="0" type="xs:string"/>
		   <xs:element name="rebootdependent" minOccurs="0" type="xs:string"/>
		   <xs:element name="spanalysis" minOccurs="0" type="xs:string"/>
		</xs:all>
		<xs:attribute name="timestamp" use="optional" type="xs:string"/>
	   </xs:extension>
	</xs:complexContent>
   </xs:complexType>
</xs:element>

<xs:element name="raw-data">
   <xs:complexType>
	<xs:simpleContent>
	   <xs:extension base="xs:string">
		<xs:attribute name="chunk" use="optional" type="xs:integer"/>
	   </xs:extension>
	</xs:simpleContent>
   </xs:complexType>
</xs:element>

<xs:element name="critical-error">
   <xs:complexType>
	<xs:complexContent>
	   <xs:extension base="FeELEvent">
		<xs:sequence>
		   <xs:element name="error-id" minOccurs="0" type="xs:integer"/>
		   <xs:element name="error-string" minOccurs="0" type="xs:string"/>
		   <xs:element ref="raw-data" minOccurs="0" maxOccurs="unbounded"/>
		   <xs:element name="rebootdependent" minOccurs="0" type="xs:string"/>
		   <xs:element name="spanalysis" minOccurs="0" type="xs:string"/>
		</xs:sequence>
		<xs:attribute name="timestamp" use="optional" type="xs:integer"/>
	   </xs:extension>
	</xs:complexContent>
   </xs:complexType>
</xs:element>

<xs:element name="CmdInfo">
   <xs:complexType>
	<xs:complexContent>
	   <xs:extension base="FeELEvent">
		<xs:sequence>
		   <xs:element name="error-id" minOccurs="0" type="xs:integer"/>
		   <xs:element name="error-string" minOccurs="0" type="xs:string"/>
		   <xs:element ref="raw-data" minOccurs="0" maxOccurs="unbounded"/>
		   <xs:element name="rebootdependent" minOccurs="0" type="xs:string"/>
		   <xs:element name="spanalysis" minOccurs="0" type="xs:string"/>
		</xs:sequence>
		<xs:attribute name="timestamp" use="optional" type="xs:integer"/>
	   </xs:extension>
	</xs:complexContent>
   </xs:complexType>
</xs:element>

<xs:element name="internal-error">
   <xs:complexType>
	<xs:complexContent>
	   <xs:extension base="FeELEvent">
		<xs:all>
		   <xs:element ref="value" minOccurs="0"/>
		   <xs:element name="data" minOccurs="0" type="xs:string"/>
		   <xs:element name="rebootdependent" minOccurs="0" type="xs:string"/>
		   <xs:element name="spanalysis" minOccurs="0" type="xs:string"/>
		</xs:all>
		<xs:attribute name="timestamp" use="optional" type="xs:string"/>
	   </xs:extension>
	</xs:complexContent>
   </xs:complexType>
</xs:element>

<xs:element name="SendMessage">
   <xs:complexType>
	<xs:complexContent>
	   <xs:extension base="FeELEvent">
		<xs:all>
		   <xs:element ref="processinfo" minOccurs="0"/>
		   <xs:element name="MessageType" minOccurs="0" type="xs:string"/>
		   <xs:element name="rebootdependent" minOccurs="0" type="xs:string"/>
		   <xs:element name="spanalysis" minOccurs="0" type="xs:string"/>
		</xs:all>
		<xs:attribute name="type" use="optional" type="xs:string"/>
		<xs:attribute name="timestamp" use="optional" type="xs:string"/>
	   </xs:extension>
	</xs:complexContent>
   </xs:complexType>
</xs:element>

<xs:element name="NullPageMapping">
   <xs:complexType>
	<xs:complexContent>
	   <xs:extension base="FeELEvent">
		<xs:all>
		   <xs:element ref="processinfo" minOccurs="0"/>
		   <xs:element name="BaseAddress" type="xs:string" minOccurs="0" />
		   <xs:element name="Size" type="xs:string" minOccurs="0" />
		   <xs:element name="AllocType" type="xs:string" minOccurs="0" />
		   <xs:element name="Protect" type="xs:string" minOccurs="0" />
		   <xs:element name="rebootdependent" minOccurs="0" type="xs:string"/>
		   <xs:element name="spanalysis" minOccurs="0" type="xs:string"/>
		</xs:all>
		<xs:attribute name="mode" use="optional" type="xs:string"/>
		<xs:attribute name="timestamp" use="optional" type="xs:string"/>
		<xs:attribute name="dtype" use="optional" type="xs:string"/>
	   </xs:extension>
	</xs:complexContent>
   </xs:complexType>
</xs:element>

<xs:element name="kexploit">
   <xs:complexType>
	<xs:complexContent>
	   <xs:extension base="FeELEvent">
		<xs:all>
		   <xs:element ref="processinfo" minOccurs="0"/>
		   <xs:element name="Api" type="xs:string" minOccurs="0" />
		   <xs:element name="Caller" type="xs:string" minOccurs="0" />
		   <xs:element name="rebootdependent" minOccurs="0" type="xs:string"/>
		   <xs:element name="spanalysis" minOccurs="0" type="xs:string"/>
		</xs:all>
		<xs:attribute name="type" use="optional" type="xs:string"/>
		<xs:attribute name="timestamp" use="optional" type="xs:string"/>
	   </xs:extension>
	</xs:complexContent>
   </xs:complexType>
</xs:element>

<xs:element name="SystemTime">
   <xs:complexType>
	<xs:all>
	   <xs:element name="Value" minOccurs="0" type="xs:string"/>
	   <xs:element name="Time" minOccurs="0" type="xs:string"/>
	</xs:all>
   </xs:complexType>
</xs:element>
<xs:element name="PreviousTime">
   <xs:complexType>
	<xs:all>
	   <xs:element name="Value" minOccurs="0" type="xs:string"/>
	   <xs:element name="Time" minOccurs="0" type="xs:string"/>
	</xs:all>
   </xs:complexType>
</xs:element>
<xs:element name="SetSystemTime">
   <xs:complexType>
	<xs:complexContent>
	   <xs:extension base="FeELEvent">
		<xs:all>
		   <xs:element ref="processinfo" minOccurs="0"/>
		   <xs:element name="ntstatus" minOccurs="0" type="xs:string"/>
		   <xs:element ref="SystemTime" minOccurs="0"/>
		   <xs:element ref="PreviousTime" minOccurs="0"/>
		   <xs:element name="rebootdependent" minOccurs="0" type="xs:string"/>
		   <xs:element name="spanalysis" minOccurs="0" type="xs:string"/>
		</xs:all>
		<xs:attribute name="Allowed" use="optional" type="xs:string"/>
		<xs:attribute name="repeat" use="optional" type="xs:string"/>
		<xs:attribute name="timestamp" use="optional" type="xs:string"/>
	   </xs:extension>
	</xs:complexContent>
   </xs:complexType>
</xs:element>
<xs:element name="QuerySystemTime">
   <xs:complexType>
	<xs:complexContent>
	   <xs:extension base="FeELEvent">
		<xs:all>
		   <xs:element ref="processinfo" minOccurs="0"/>
		   <xs:element name="ntstatus" minOccurs="0" type="xs:string"/>
		   <xs:element ref="SystemTime" minOccurs="0"/>
		   <xs:element name="rebootdependent" minOccurs="0" type="xs:string"/>
		   <xs:element name="spanalysis" minOccurs="0" type="xs:string"/>
		</xs:all>
		<xs:attribute name="Allowed" use="optional" type="xs:string"/>
		<xs:attribute name="repeat" use="optional" type="xs:string"/>
		<xs:attribute name="timestamp" use="optional" type="xs:string"/>
	   </xs:extension>
	</xs:complexContent>
   </xs:complexType>
</xs:element>

<xs:element name="KExploit">
   <xs:complexType>
	<xs:complexContent>
	   <xs:extension base="FeELEvent">
		<xs:all>
		   <xs:element ref="processinfo" minOccurs="0"/>
		   <xs:element name="Api" type="xs:string" minOccurs="0" />
		   <xs:element name="Caller" type="xs:string" minOccurs="0" />
		   <xs:element name="CallerMemType" type="xs:string" minOccurs="0" />
		   <xs:element ref="params" minOccurs="0"/>
		   <xs:element ref="callstack" minOccurs="0"/>
		   <xs:element name="rebootdependent" minOccurs="0" type="xs:string"/>
		   <xs:element name="spanalysis" minOccurs="0" type="xs:string"/>
		</xs:all>
		<xs:attribute name="type" use="optional" type="xs:string"/>
		<xs:attribute name="timestamp" use="optional" type="xs:string"/>
	   </xs:extension>
	</xs:complexContent>
   </xs:complexType>
</xs:element>

<xs:element name="Method">
   <xs:complexType>
	<xs:all>
	   <xs:element minOccurs="0" name="Name" type="xs:string"/>
	   <xs:element minOccurs="0" name="Ptr" type="xs:string"/>
	</xs:all>
   </xs:complexType>
</xs:element>

<xs:element name="Vector">
   <xs:complexType>
	<xs:all>
	   <xs:element name="VectorSize" minOccurs="0" type="xs:string"/>
	   <xs:element name="PageBoundary" type="xs:string" minOccurs="0" />
	   <xs:element name="SizeFrequency" minOccurs="0" type="xs:string"/>
	</xs:all>
   </xs:complexType>
</xs:element>

<xs:element name="List">
   <xs:complexType>
	<xs:sequence>
	   <xs:element ref="Method" maxOccurs="unbounded" minOccurs="0"/>
	   <xs:element ref="Vector" maxOccurs="unbounded" minOccurs="0"/>
	</xs:sequence>
   </xs:complexType>
</xs:element>

<xs:element name="Flash">
   <xs:complexType>
	<xs:complexContent>
	   <xs:extension base="FeELEvent">
		<xs:all>
		   <xs:element ref="processinfo" minOccurs="0"/>
		   <xs:element name="Dll" type="xs:string" minOccurs="0" />
		   <xs:element ref="List" minOccurs="0" />
		   <xs:element name="VectorSize" type="xs:string" minOccurs="0" />
		   <xs:element name="PageBoundary" type="xs:string" minOccurs="0" />
		   <xs:element name="SizeFrequency" type="xs:integer" minOccurs="0" />
		   <xs:element name="TotalVectors" type="xs:integer" minOccurs="0" />
		   <xs:element name="SumVectorLengths" type="xs:string" minOccurs="0" />
		   <xs:element name="Method" type="xs:string" minOccurs="0" />
		   <xs:element name="Length" type="xs:string" minOccurs="0" />
		   <xs:element name="rebootdependent" minOccurs="0" type="xs:string"/>
		   <xs:element name="spanalysis" minOccurs="0" type="xs:string"/>
		</xs:all>
		<xs:attribute name="type" use="optional" type="xs:string"/>
		<xs:attribute name="timestamp" use="optional" type="xs:string"/>
	   </xs:extension>
	</xs:complexContent>
   </xs:complexType>
</xs:element>

<xs:element name="names">
   <xs:complexType>
	<xs:sequence>
	   <xs:element name="name" maxOccurs="unbounded" minOccurs="0" type="xs:string"/>
	</xs:sequence>
   </xs:complexType>
</xs:element>

<xs:element name="DllCharacteristics">
   <xs:complexType>
	<xs:all>
	   <xs:element minOccurs="0" ref="value"/>
	   <xs:element minOccurs="0" ref="names"/>
	</xs:all>
   </xs:complexType>
</xs:element>

<xs:element name="Characteristics">
   <xs:complexType>
	<xs:all>
	   <xs:element minOccurs="0" ref="value"/>
	   <xs:element minOccurs="0" ref="names"/>
	</xs:all>
   </xs:complexType>
</xs:element>

<xs:element name="PE">
   <xs:complexType>
	<xs:all>
	   <xs:element minOccurs="0" name="Dll" type="xs:string"/>
	   <xs:element minOccurs="0" name="Machine" type="xs:string"/>
	   <xs:element minOccurs="0" name="TimeDateStamp" type="xs:string"/>
	   <xs:element minOccurs="0" ref="Characteristics"/>
	   <xs:element minOccurs="0" name="Magic" type="xs:string"/>
	   <xs:element minOccurs="0" name="Subsystem" type="xs:string"/>
	   <xs:element minOccurs="0" ref="DllCharacteristics"/>
	</xs:all>
	<xs:attribute name="InspectionType" use="optional" type="xs:string"/>
   </xs:complexType>
</xs:element>

<xs:element name="SMEP">
   <xs:complexType>
	<xs:complexContent>
	   <xs:extension base="FeELEvent">
		<xs:all>
		   <xs:element ref="processinfo" minOccurs="0"/>
		   <xs:element name="ip" type="xs:string" minOccurs="0" />
		   <xs:element name="address" type="xs:string" minOccurs="0" />
		   <xs:element name="rebootdependent" minOccurs="0" type="xs:string"/>
		   <xs:element name="spanalysis" minOccurs="0" type="xs:string"/>
		</xs:all>
		<xs:attribute name="type" use="optional" type="xs:string"/>
		<xs:attribute name="dtype" use="optional" type="xs:string"/>
		<xs:attribute name="mode" use="optional" type="xs:string"/>
		<xs:attribute name="timestamp" use="optional" type="xs:string"/>
	   </xs:extension>
	</xs:complexContent>
   </xs:complexType>
</xs:element>

<xs:element name="msrinfo">
   <xs:complexType>
	<xs:all>
	   <xs:element name="type" type="xs:string" minOccurs="0" />
	   <xs:element name="address" type="xs:string" minOccurs="0" />
	   <xs:element name="content" type="xs:string" minOccurs="0" />
	</xs:all>
   </xs:complexType>
</xs:element>

<xs:element name="MSR">
   <xs:complexType>
	<xs:complexContent>
	   <xs:extension base="FeELEvent">
		<xs:all>
		   <xs:element ref="processinfo" minOccurs="0"/>
		   <xs:element name="ip" type="xs:string" minOccurs="0" />
		   <xs:element ref="msrinfo" minOccurs="0"/>
		   <xs:element name="rebootdependent" minOccurs="0" type="xs:string"/>
		   <xs:element name="spanalysis" minOccurs="0" type="xs:string"/>
		</xs:all>
		<xs:attribute name="type" use="optional" type="xs:string"/>
		<xs:attribute name="dtype" use="optional" type="xs:string"/>
		<xs:attribute name="mode" use="optional" type="xs:string"/>
		<xs:attribute name="timestamp" use="optional" type="xs:string"/>
	   </xs:extension>
	</xs:complexContent>
   </xs:complexType>
</xs:element>

<xs:element name="action_fopen">
   <xs:complexType>
	<xs:complexContent>
	   <xs:extension base="FeELEvent">
		<xs:all>
		   <xs:element name="ext" type="xs:string" minOccurs="0" />
		   <xs:element name="name" type="xs:string" minOccurs="0" />
		   <xs:element name="rebootdependent" minOccurs="0" type="xs:string"/>
		   <xs:element name="spanalysis" minOccurs="0" type="xs:string"/>
		</xs:all>
		<xs:attribute name="mode" use="optional" type="xs:string"/>
		<xs:attribute name="timestamp" use="optional" type="xs:string"/>
	   </xs:extension>
	</xs:complexContent>
   </xs:complexType>
</xs:element>

<xs:element name="shellcode">
   <xs:complexType>
	<xs:complexContent>
	   <xs:extension base="FeELEvent">
		<xs:all>
		   <xs:element ref="processinfo" minOccurs="0"/>
		   <xs:element name="ip" type="xs:string" minOccurs="0" />
		   <xs:element name="rebootdependent" minOccurs="0" type="xs:string"/>
		   <xs:element name="spanalysis" minOccurs="0" type="xs:string"/>
		</xs:all>
		<xs:attribute name="type" use="optional" type="xs:string"/>
		<xs:attribute name="dtype" use="optional" type="xs:string"/>
		<xs:attribute name="timestamp" use="optional" type="xs:string"/>
	   </xs:extension>
	</xs:complexContent>
   </xs:complexType>
</xs:element>

<xs:element name="stackexec">
   <xs:complexType>
	<xs:complexContent>
	   <xs:extension base="FeELEvent">
		<xs:all>
		   <xs:element ref="processinfo" minOccurs="0"/>
		   <xs:element ref="StackBase" minOccurs="0"/>
		   <xs:element ref="StackLimit" minOccurs="0"/>
		   <xs:element name="StackPointer" type="xs:string" minOccurs="0" />
		   <xs:element name="InstructionPointer" type="xs:string" minOccurs="0" />
		   <xs:element name="rebootdependent" minOccurs="0" type="xs:string"/>
		   <xs:element name="spanalysis" minOccurs="0" type="xs:string"/>
		</xs:all>
		<xs:attribute name="type" use="optional" type="xs:string"/>
		<xs:attribute name="dtype" use="optional" type="xs:string"/>
		<xs:attribute name="timestamp" use="optional" type="xs:string"/>
	   </xs:extension>
	</xs:complexContent>
   </xs:complexType>
</xs:element>

<xs:element name="Destructor">
   <xs:complexType>
	<xs:complexContent>
	   <xs:extension base="FeELEvent">
		<xs:all>
		   <xs:element ref="pattern" minOccurs="0"/>
		   <xs:element minOccurs="0" name="value" type="xs:string"/>
		   <xs:element minOccurs="0" name="md5sum" type="xs:string"/>
		   <xs:element name="rebootdependent" minOccurs="0" type="xs:string"/>
		   <xs:element name="spanalysis" minOccurs="0" type="xs:string"/>
		</xs:all>
		<xs:attribute name="timestamp" use="optional" type="xs:string"/>
	   </xs:extension>
	</xs:complexContent>
   </xs:complexType>
</xs:element>

<xs:element name="ExfilDetect">
   <xs:complexType>
	<xs:complexContent>
	   <xs:extension base="FeELEvent">
		<xs:all>
		   <xs:element ref="processinfo" minOccurs="0"/>
		   <xs:element minOccurs="0" name="Address" type="xs:string"/>
		   <xs:element minOccurs="0" name="Size" type="xs:string"/>
		   <xs:element minOccurs="0" name="Offset" type="xs:string"/>
		   <xs:element name="rebootdependent" minOccurs="0" type="xs:string"/>
		   <xs:element name="spanalysis" minOccurs="0" type="xs:string"/>
		</xs:all>
		<xs:attribute name="timestamp" use="optional" type="xs:string"/>
		<xs:attribute name="type" use="optional" type="xs:string"/>
	   </xs:extension>
	</xs:complexContent>
   </xs:complexType>
</xs:element>

<xs:element name="MemInjectOp">
   <xs:complexType>
	<xs:complexContent>
	   <xs:extension base="FeELEvent">
		<xs:all>
		   <xs:element ref="source" minOccurs="0"/>
		   <xs:element ref="target" minOccurs="0"/>
		   <xs:element minOccurs="0" name="Address" type="xs:string"/>
		   <xs:element minOccurs="0" name="Size" type="xs:string"/>
		   <xs:element name="rebootdependent" minOccurs="0" type="xs:string"/>
		   <xs:element name="spanalysis" minOccurs="0" type="xs:string"/>
		</xs:all>
		<xs:attribute name="timestamp" use="optional" type="xs:string"/>
		<xs:attribute name="mode" use="optional" type="xs:string"/>
	   </xs:extension>
	</xs:complexContent>
   </xs:complexType>
</xs:element>

<xs:element name="MemBruteForce">
   <xs:complexType>
	<xs:complexContent>
	   <xs:extension base="FeELEvent">
		<xs:all>
		   <xs:element ref="source" minOccurs="0"/>
		   <xs:element ref="target" minOccurs="0"/>
		   <xs:element minOccurs="0" name="Adjacency" type="xs:string"/>
		   <xs:element minOccurs="0" name="TotalCount" type="xs:string"/>
		   <xs:element name="rebootdependent" minOccurs="0" type="xs:string"/>
		   <xs:element name="spanalysis" minOccurs="0" type="xs:string"/>
		</xs:all>
		<xs:attribute name="timestamp" use="optional" type="xs:string"/>
		<xs:attribute name="mode" use="optional" type="xs:string"/>
	   </xs:extension>
	</xs:complexContent>
   </xs:complexType>
</xs:element>

<xs:element name="JSSymbols">
   <xs:complexType>
	<xs:complexContent>
	   <xs:extension base="FeELEvent">
		<xs:all>
		   <xs:element ref="processinfo" minOccurs="0"/>
		   <xs:element name="JStrLen" type="xs:string" minOccurs="0" />
		   <xs:element name="JList" type="xs:string" minOccurs="0" />
		   <xs:element name="JLeft" type="xs:string" minOccurs="0" />
		   <xs:element name="JRight" type="xs:string" minOccurs="0" />
		   <xs:element name="rebootdependent" minOccurs="0" type="xs:string"/>
		   <xs:element name="spanalysis" minOccurs="0" type="xs:string"/>
		</xs:all>
		<xs:attribute name="sequence" use="optional" type="xs:integer"/>
		<xs:attribute name="chunk" use="optional" type="xs:integer"/>
		<xs:attribute name="type" use="optional" type="xs:string"/>
		<xs:attribute name="timestamp" use="optional" type="xs:integer"/>
	   </xs:extension>
	</xs:complexContent>
   </xs:complexType>
</xs:element>

<xs:element name="JSData">
   <xs:complexType>
	<xs:complexContent>
	   <xs:extension base="FeELEvent">
		<xs:all>
		   <xs:element ref="processinfo" minOccurs="0"/>
		   <xs:element name="JSNote" type="xs:string" minOccurs="0" />
		   <xs:element name="JSSize" type="xs:string" minOccurs="0" />
		   <xs:element name="JScript" type="xs:string" minOccurs="0" />
		   <xs:element name="JSType" type="xs:string" minOccurs="0" />
		   <xs:element name="rebootdependent" minOccurs="0" type="xs:string"/>
		   <xs:element name="spanalysis" minOccurs="0" type="xs:string"/>
		</xs:all>
		<xs:attribute name="sequence" use="optional" type="xs:string"/>
		<xs:attribute name="chunk" use="optional" type="xs:string"/>
		<xs:attribute name="dtype" use="optional" type="xs:string"/>
		<xs:attribute name="timestamp" use="optional" type="xs:string"/>
	   </xs:extension>
	</xs:complexContent>
   </xs:complexType>
</xs:element>

<xs:element name="FirstRpidMemOp">
   <xs:complexType>
	<xs:complexContent>
	   <xs:extension base="FeELEvent">
		<xs:all>
		   <xs:element ref="source" minOccurs="0"/>
		   <xs:element ref="target" minOccurs="0"/>
		   <xs:element minOccurs="0" name="Address" type="xs:string"/>
		   <xs:element minOccurs="0" name="Size" type="xs:string"/>
		   <xs:element minOccurs="0" name="IsMinApplAddress" type="xs:string"/>
		   <xs:element name="rebootdependent" minOccurs="0" type="xs:string"/>
		   <xs:element name="spanalysis" minOccurs="0" type="xs:string"/>
		</xs:all>
		<xs:attribute name="timestamp" use="optional" type="xs:string"/>
		<xs:attribute name="mode" use="optional" type="xs:string"/>
	   </xs:extension>
	</xs:complexContent>
   </xs:complexType>
</xs:element>

<xs:element name="OpList">
   <xs:complexType>
	<xs:sequence>
	   <xs:element minOccurs="0" maxOccurs="unbounded" name="OpLine" type="xs:string"/>
	</xs:sequence>
   </xs:complexType>
</xs:element>
<xs:element name="CmdOp">
   <xs:complexType>
	<xs:complexContent>
	   <xs:extension base="FeELEvent">
		<xs:all>
		   <xs:element ref="processinfo"/>
		   <xs:element ref="OpList"/>
		   <xs:element name="rebootdependent" minOccurs="0" type="xs:string"/>
		   <xs:element name="spanalysis" minOccurs="0" type="xs:string"/>
		</xs:all>
		<xs:attribute name="timestamp" use="optional" type="xs:string"/>
	   </xs:extension>
	</xs:complexContent>
   </xs:complexType>
</xs:element>

</xs:schema>