Microsoft-IE
Event ID 1: Mshtml_CDoc_OnPaintStart_V1
#Fields #
| Name | Description |
|---|---|
DOC Pointer | |
Markup Pointer | |
left Int32 | |
top Int32 | |
right Int32 | |
bottom Int32 | |
EventContextId UInt64 |
Example Event #
{
"system": {
"provider": "Microsoft-IE",
"guid": "{9e3b3947-ca5d-4614-91a2-7b624e0e7244}",
"event_source_name": "",
"event_id": 1,
"version": 1,
"level": 0,
"task": 1,
"opcode": 1,
"keywords": "0x4000100",
"time_created": "2026-07-19T04:12:46.617295200+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 5248,
"thread_id": 3912
},
"channel": "Unknown",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"DOC": "0x1DA00478000",
"Markup": "0x1DA004B8000",
"left": "138",
"top": "161",
"right": "890",
"bottom": "677",
"EventContextId": "2035819446272"
},
"message": ""
}
Event ID 2: Mshtml_CDoc_OnPaintStop_V1
#Fields #
| Name | Description |
|---|---|
HWND Pointer | |
Flags UInt32 | |
EventContextId UInt64 |
Example Event #
{
"system": {
"provider": "Microsoft-IE",
"guid": "{9e3b3947-ca5d-4614-91a2-7b624e0e7244}",
"event_source_name": "",
"event_id": 2,
"version": 1,
"level": 0,
"task": 1,
"opcode": 2,
"keywords": "0x4000100",
"time_created": "2026-07-19T04:12:46.617436100+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 5248,
"thread_id": 3912
},
"channel": "Unknown",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"HWND": "0x18B00E6",
"Flags": "0x0",
"EventContextId": "2035819446272"
},
"message": ""
}
Event ID 3: Mshtml_CMarkup_LayoutStart_V1
#Fields #
| Name | Description |
|---|---|
View Pointer | |
grfLAYOUT UInt32 | |
EventContextId UInt64 |
Example Event #
{
"system": {
"provider": "Microsoft-IE",
"guid": "{9e3b3947-ca5d-4614-91a2-7b624e0e7244}",
"event_source_name": "",
"event_id": 3,
"version": 1,
"level": 0,
"task": 2,
"opcode": 1,
"keywords": "0x4000100",
"time_created": "2026-07-19T04:12:46.483955400+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 5248,
"thread_id": 3912
},
"channel": "Unknown",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"View": "0x1DA00478000",
"grfLAYOUT": "256",
"EventContextId": "2035819446272"
},
"message": ""
}
Event ID 4: Mshtml_CMarkup_LayoutStop_V1
#Fields #
| Name | Description |
|---|---|
DOC Pointer | |
Flags UInt32 | |
EventContextId UInt64 |
Example Event #
{
"system": {
"provider": "Microsoft-IE",
"guid": "{9e3b3947-ca5d-4614-91a2-7b624e0e7244}",
"event_source_name": "",
"event_id": 4,
"version": 1,
"level": 0,
"task": 2,
"opcode": 2,
"keywords": "0x4000100",
"time_created": "2026-07-19T04:12:46.484457400+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 5248,
"thread_id": 3912
},
"channel": "Unknown",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"DOC": "0x1DA00478000",
"Flags": "0x0",
"EventContextId": "2035819446272"
},
"message": ""
}
Event ID 6: Mshtml_CMarkup_OnLoadStatusDone
#Fields #
| Name | Description |
|---|---|
AddressName UnicodeString |
Example Event #
{
"system": {
"provider": "Microsoft-IE",
"guid": "{9e3b3947-ca5d-4614-91a2-7b624e0e7244}",
"event_source_name": "",
"event_id": 6,
"version": 0,
"level": 0,
"task": 4,
"opcode": 0,
"keywords": "0x4000100",
"time_created": "2026-07-19T04:12:46.608147500+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 5248,
"thread_id": 3912
},
"channel": "Unknown",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"AddressName": "file:///C:/Users/Public/catalog-ie.hta"
},
"message": ""
}
Event ID 7: Mshtml_CMarkup_DOMContentLoadedEvent_Start_V1
#Fields #
| Name | Description |
|---|---|
AddressName | |
EventContextId |
Event ID 8: Mshtml_CMarkup_DOMContentLoadedEvent_Stop_V1
#Fields #
| Name | Description |
|---|---|
AddressName | |
EventContextId |
Event ID 9: Mshtml_CMarkup_LoadEvent_Start_V1
#Fields #
| Name | Description |
|---|---|
AddressName UnicodeString | |
EventContextId UInt64 |
Example Event #
{
"system": {
"provider": "Microsoft-IE",
"guid": "{9e3b3947-ca5d-4614-91a2-7b624e0e7244}",
"event_source_name": "",
"event_id": 9,
"version": 1,
"level": 0,
"task": 7,
"opcode": 1,
"keywords": "0x4000100",
"time_created": "2026-07-19T04:12:46.608027200+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 5248,
"thread_id": 3912
},
"channel": "Unknown",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"AddressName": "file:///C:/Users/Public/catalog-ie.hta",
"EventContextId": "2035819446272"
},
"message": ""
}
Event ID 10: Mshtml_CMarkup_LoadEvent_Stop_V1
#Fields #
| Name | Description |
|---|---|
AddressName UnicodeString | |
EventContextId UInt64 |
Example Event #
{
"system": {
"provider": "Microsoft-IE",
"guid": "{9e3b3947-ca5d-4614-91a2-7b624e0e7244}",
"event_source_name": "",
"event_id": 10,
"version": 1,
"level": 0,
"task": 8,
"opcode": 2,
"keywords": "0x4000100",
"time_created": "2026-07-19T04:12:46.608125200+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 5248,
"thread_id": 3912
},
"channel": "Unknown",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"AddressName": "file:///C:/Users/Public/catalog-ie.hta",
"EventContextId": "2035819446272"
},
"message": ""
}
Event ID 39: Mshtml_CDwnBindData_BindStart
#Fields #
| Name | Description |
|---|---|
Flags UInt32 | |
Text UnicodeString |
Example Event #
{
"system": {
"provider": "Microsoft-IE",
"guid": "{9e3b3947-ca5d-4614-91a2-7b624e0e7244}",
"event_source_name": "",
"event_id": 39,
"version": 0,
"level": 0,
"task": 36,
"opcode": 1,
"keywords": "0x100",
"time_created": "2026-07-19T04:12:46.475948400+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 5248,
"thread_id": 3912
},
"channel": "Unknown",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"Flags": "0x873F8820",
"Text": "file:///C:/Users/Public/catalog-ie.hta"
},
"message": ""
}
Event ID 40: Mshtml_CDwnBindData_BindStop
#Fields #
| Name | Description |
|---|---|
dwCode UInt32 | |
dwPos UInt32 | |
dwMax UInt32 | |
Text UnicodeString |
Example Event #
{
"system": {
"provider": "Microsoft-IE",
"guid": "{9e3b3947-ca5d-4614-91a2-7b624e0e7244}",
"event_source_name": "",
"event_id": 40,
"version": 0,
"level": 0,
"task": 36,
"opcode": 2,
"keywords": "0x100",
"time_created": "2026-07-19T04:12:46.477494500+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 5248,
"thread_id": 3912
},
"channel": "Unknown",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"dwCode": "0",
"dwPos": "1",
"dwMax": "0",
"Text": "file:///C:/Users/Public/catalog-ie.hta"
},
"message": ""
}
Event ID 41: Mshtml_CHtmPre_Suspend
#Fields #
| Name | Description |
|---|---|
DOC Pointer | |
HtmlTag UnicodeString |
Example Event #
{
"system": {
"provider": "Microsoft-IE",
"guid": "{9e3b3947-ca5d-4614-91a2-7b624e0e7244}",
"event_source_name": "",
"event_id": 41,
"version": 0,
"level": 0,
"task": 37,
"opcode": 0,
"keywords": "0x100",
"time_created": "2026-07-19T04:12:46.478756100+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 5248,
"thread_id": 11188
},
"channel": "Unknown",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"DOC": "0x1DA00478000",
"HtmlTag": "SCRIPT"
},
"message": ""
}
Event ID 44: Mshtml_HtmPost_PostManKillTimer
#Fields #
| Name | Description |
|---|---|
dw UInt32 | |
HWND Pointer |
Example Event #
{
"system": {
"provider": "Microsoft-IE",
"guid": "{9e3b3947-ca5d-4614-91a2-7b624e0e7244}",
"event_source_name": "",
"event_id": 44,
"version": 0,
"level": 0,
"task": 40,
"opcode": 0,
"keywords": "0x1200",
"time_created": "2026-07-19T04:12:46.487168900+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 5248,
"thread_id": 3912
},
"channel": "Unknown",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"dw": "0",
"HWND": "0xD400F0"
},
"message": ""
}
Event ID 48: Mshtml_HtmPost_SetFlag
#Fields #
| Name | Description |
|---|---|
HTMPOST Pointer | |
Flags UInt32 | |
Line UInt32 | |
Offset UInt32 |
Example Event #
{
"system": {
"provider": "Microsoft-IE",
"guid": "{9e3b3947-ca5d-4614-91a2-7b624e0e7244}",
"event_source_name": "",
"event_id": 48,
"version": 0,
"level": 0,
"task": 43,
"opcode": 0,
"keywords": "0x1200",
"time_created": "2026-07-19T04:12:46.478363400+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 5248,
"thread_id": 3912
},
"channel": "Unknown",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"HTMPOST": "0x1DA00460640",
"Flags": "0x800",
"Line": "0",
"Offset": "0"
},
"message": ""
}
Event ID 49: Mshtml_HtmPost_ClearFlag
#Fields #
| Name | Description |
|---|---|
HTMPOST Pointer | |
Flags UInt32 | |
Line UInt32 | |
Offset UInt32 |
Example Event #
{
"system": {
"provider": "Microsoft-IE",
"guid": "{9e3b3947-ca5d-4614-91a2-7b624e0e7244}",
"event_source_name": "",
"event_id": 49,
"version": 0,
"level": 0,
"task": 44,
"opcode": 0,
"keywords": "0x1200",
"time_created": "2026-07-19T04:12:46.478444000+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 5248,
"thread_id": 3912
},
"channel": "Unknown",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"HTMPOST": "0x1DA00460640",
"Flags": "0x80",
"Line": "0",
"Offset": "0"
},
"message": ""
}
Event ID 50: Mshtml_HtmPost_AbandonTimeslice
#Fields #
| Name | Description |
|---|---|
HTMPOST Pointer | |
OneExec2PT3ST4Run UInt32 |
Example Event #
{
"system": {
"provider": "Microsoft-IE",
"guid": "{9e3b3947-ca5d-4614-91a2-7b624e0e7244}",
"event_source_name": "",
"event_id": 50,
"version": 0,
"level": 0,
"task": 45,
"opcode": 0,
"keywords": "0x1200",
"time_created": "2026-07-19T04:20:10.748704200+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 5468,
"thread_id": 8344
},
"channel": "Unknown",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"HTMPOST": "0x24980360640",
"OneExec2PT3ST4Run": "1"
},
"message": ""
}
Event ID 53: Mshtml_HtmPost_OnPostDone
#Fields #
| Name | Description |
|---|---|
HTMPOST Pointer | |
Error UInt32 |
Example Event #
{
"system": {
"provider": "Microsoft-IE",
"guid": "{9e3b3947-ca5d-4614-91a2-7b624e0e7244}",
"event_source_name": "",
"event_id": 53,
"version": 0,
"level": 0,
"task": 47,
"opcode": 0,
"keywords": "0x1200",
"time_created": "2026-07-19T04:12:46.606118000+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 5248,
"thread_id": 3912
},
"channel": "Unknown",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"HTMPOST": "0x1DA00460640",
"Error": "0x0"
},
"message": ""
}
Event ID 54: Mshtml_CScriptElement_CommitCode
#Fields #
| Name | Description |
|---|---|
Length UInt32 | |
Script UnicodeString | |
IsInline Boolean |
Example Event #
{
"system": {
"provider": "Microsoft-IE",
"guid": "{9e3b3947-ca5d-4614-91a2-7b624e0e7244}",
"event_source_name": "",
"event_id": 54,
"version": 0,
"level": 0,
"task": 48,
"opcode": 0,
"keywords": "0x100",
"time_created": "2026-07-19T04:12:46.488451700+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 5248,
"thread_id": 3912
},
"channel": "Unknown",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"Length": "142",
"Script": "for(var i=0;i<20;i++){var d=document.createElement(\"div\");d.innerText=\"item\"+i;document.body.appendChild(d);}document.title=\"catalog-updated\";",
"IsInline": "true"
},
"message": ""
}
Event ID 55: Mshtml_CHtmRootParseCtx_ElementsAdded
#Fields #
| Name | Description |
|---|---|
SourceIndex UInt32 | |
NumElemsAdded UInt32 |
Example Event #
{
"system": {
"provider": "Microsoft-IE",
"guid": "{9e3b3947-ca5d-4614-91a2-7b624e0e7244}",
"event_source_name": "",
"event_id": 55,
"version": 0,
"level": 0,
"task": 49,
"opcode": 0,
"keywords": "0x200",
"time_created": "2026-07-19T04:12:46.487480200+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 5248,
"thread_id": 3912
},
"channel": "Unknown",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"SourceIndex": "1",
"NumElemsAdded": "1"
},
"message": ""
}
Event ID 56: Mshtml_CMarkup_InvalDoc
#Fields #
| Name | Description |
|---|---|
Markup Pointer |
Example Event #
{
"system": {
"provider": "Microsoft-IE",
"guid": "{9e3b3947-ca5d-4614-91a2-7b624e0e7244}",
"event_source_name": "",
"event_id": 56,
"version": 0,
"level": 0,
"task": 50,
"opcode": 0,
"keywords": "0x200",
"time_created": "2026-07-19T04:12:46.488211600+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 5248,
"thread_id": 3912
},
"channel": "Unknown",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"Markup": "0x1DA004B8000"
},
"message": ""
}
Event ID 57: Mshtml_NotifyGoesInteractiveStart
#Fields #
| Name | Description |
|---|---|
Markup Pointer |
Example Event #
{
"system": {
"provider": "Microsoft-IE",
"guid": "{9e3b3947-ca5d-4614-91a2-7b624e0e7244}",
"event_source_name": "",
"event_id": 57,
"version": 0,
"level": 0,
"task": 51,
"opcode": 1,
"keywords": "0x1200",
"time_created": "2026-07-19T04:12:46.488178200+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 5248,
"thread_id": 3912
},
"channel": "Unknown",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"Markup": "0x1DA004B8000"
},
"message": ""
}
Event ID 58: Mshtml_NotifyGoesInteractiveStop
#Fields #
| Name | Description |
|---|---|
Markup Pointer |
Example Event #
{
"system": {
"provider": "Microsoft-IE",
"guid": "{9e3b3947-ca5d-4614-91a2-7b624e0e7244}",
"event_source_name": "",
"event_id": 58,
"version": 0,
"level": 0,
"task": 51,
"opcode": 2,
"keywords": "0x1200",
"time_created": "2026-07-19T04:12:46.488296600+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 5248,
"thread_id": 3912
},
"channel": "Unknown",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"Markup": "0x1DA004B8000"
},
"message": ""
}
Event ID 61: Mshtml_CMarkup_UnloadContentsStart
#Fields #
| Name | Description |
|---|---|
Markup Pointer |
Example Event #
{
"system": {
"provider": "Microsoft-IE",
"guid": "{9e3b3947-ca5d-4614-91a2-7b624e0e7244}",
"event_source_name": "",
"event_id": 61,
"version": 0,
"level": 0,
"task": 53,
"opcode": 1,
"keywords": "0x4000200",
"time_created": "2026-07-19T04:12:46.558285400+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 5248,
"thread_id": 3912
},
"channel": "Unknown",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"Markup": "0x1DA004B8E00"
},
"message": ""
}
Event ID 62: Mshtml_CMarkup_UnloadContentsStop
#Fields #
| Name | Description |
|---|---|
Markup Pointer | |
HR UInt32 |
Example Event #
{
"system": {
"provider": "Microsoft-IE",
"guid": "{9e3b3947-ca5d-4614-91a2-7b624e0e7244}",
"event_source_name": "",
"event_id": 62,
"version": 0,
"level": 0,
"task": 53,
"opcode": 2,
"keywords": "0x4000200",
"time_created": "2026-07-19T04:12:46.558334700+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 5248,
"thread_id": 3912
},
"channel": "Unknown",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"Markup": "0x1DA004B8E00",
"HR": "0x0"
},
"message": ""
}
Event ID 65: Mshtml_CDoc_Running2InplaceInvalDoc
#Fields #
| Name | Description |
|---|---|
CDoc Pointer |
Example Event #
{
"system": {
"provider": "Microsoft-IE",
"guid": "{9e3b3947-ca5d-4614-91a2-7b624e0e7244}",
"event_source_name": "",
"event_id": 65,
"version": 0,
"level": 0,
"task": 55,
"opcode": 0,
"keywords": "0x200",
"time_created": "2026-07-19T04:12:46.484866200+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 5248,
"thread_id": 3912
},
"channel": "Unknown",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"CDoc": "0x1DA00478000"
},
"message": ""
}
Event ID 66: Mshtml_CView_InvalidateRect
#Fields #
| Name | Description |
|---|---|
CView | |
fSynchronousRedraw | |
left | |
top | |
right | |
bottom | |
fInvalChildWindows | |
fPostRender |
Event ID 67: Mshtml_CView_InvalidateRgn
#Fields #
| Name | Description |
|---|---|
CView | |
fSynchronousRedraw | |
left | |
top | |
right | |
bottom | |
fInvalChildWindows | |
fPostRender |
Event ID 68: Mshtml_CDoc_Invalidate
#Fields #
| Name | Description |
|---|---|
HRGN UInt32 | |
dwFlags UInt32 | |
left UInt32 | |
top UInt32 | |
right UInt32 | |
bottom UInt32 | |
NoUpdSink UInt32 |
Example Event #
{
"system": {
"provider": "Microsoft-IE",
"guid": "{9e3b3947-ca5d-4614-91a2-7b624e0e7244}",
"event_source_name": "",
"event_id": 68,
"version": 0,
"level": 0,
"task": 58,
"opcode": 0,
"keywords": "0x200",
"time_created": "2026-07-19T04:12:46.488228400+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 5248,
"thread_id": 3912
},
"channel": "Unknown",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"HRGN": "0",
"dwFlags": "0x1",
"left": "0",
"top": "0",
"right": "0",
"bottom": "0",
"NoUpdSink": "0"
},
"message": ""
}
Event ID 73: Mshtml_HtmPre_RunStart
#Fields #
| Name | Description |
|---|---|
CHtmPrePtr Pointer | |
Object UInt64 |
Example Event #
{
"system": {
"provider": "Microsoft-IE",
"guid": "{9e3b3947-ca5d-4614-91a2-7b624e0e7244}",
"event_source_name": "",
"event_id": 73,
"version": 0,
"level": 0,
"task": 62,
"opcode": 1,
"keywords": "0x4001100",
"time_created": "2026-07-19T04:12:46.478684000+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 5248,
"thread_id": 11188
},
"channel": "Unknown",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"CHtmPrePtr": "0x1DA004B1000",
"Object": "2035819446272"
},
"message": ""
}
Event ID 74: Mshtml_HtmPre_RunStop
#Fields #
| Name | Description |
|---|---|
HR UInt32 | |
CHtmPrePtr Pointer | |
fDataPend UInt32 | |
fSuspended UInt32 | |
Object UInt64 |
Example Event #
{
"system": {
"provider": "Microsoft-IE",
"guid": "{9e3b3947-ca5d-4614-91a2-7b624e0e7244}",
"event_source_name": "",
"event_id": 74,
"version": 0,
"level": 0,
"task": 62,
"opcode": 2,
"keywords": "0x4001100",
"time_created": "2026-07-19T04:12:46.478835000+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 5248,
"thread_id": 11188
},
"channel": "Unknown",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"HR": "0x0",
"CHtmPrePtr": "0x1DA004B1000",
"fDataPend": "0",
"fSuspended": "1",
"Object": "2035819446272"
},
"message": ""
}
Event ID 79: Mshtml_CDwnTaskExec_ThreadExecBail
#Fields #
| Name | Description |
|---|---|
CDwnTaskPtr Pointer | |
Zero UInt32 |
Example Event #
{
"system": {
"provider": "Microsoft-IE",
"guid": "{9e3b3947-ca5d-4614-91a2-7b624e0e7244}",
"event_source_name": "",
"event_id": 79,
"version": 0,
"level": 0,
"task": 65,
"opcode": 0,
"keywords": "0x100",
"time_created": "2026-07-19T04:12:46.478924000+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 5248,
"thread_id": 11188
},
"channel": "Unknown",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"CDwnTaskPtr": "0x1DA0045C420",
"Zero": "0"
},
"message": ""
}
Event ID 80: Mshtml_CDwnTaskExec_ThreadExecRunStart
#Fields #
| Name | Description |
|---|---|
CDwnTaskPtr Pointer | |
Zero UInt32 |
Example Event #
{
"system": {
"provider": "Microsoft-IE",
"guid": "{9e3b3947-ca5d-4614-91a2-7b624e0e7244}",
"event_source_name": "",
"event_id": 80,
"version": 0,
"level": 0,
"task": 66,
"opcode": 1,
"keywords": "0x100",
"time_created": "2026-07-19T04:12:46.478665700+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 5248,
"thread_id": 11188
},
"channel": "Unknown",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"CDwnTaskPtr": "0x1DA0045C420",
"Zero": "0"
},
"message": ""
}
Event ID 81: Mshtml_CDwnTaskExec_ThreadExecRunStop
#Fields #
| Name | Description |
|---|---|
CDwnTaskPtr Pointer | |
Zero UInt32 |
Example Event #
{
"system": {
"provider": "Microsoft-IE",
"guid": "{9e3b3947-ca5d-4614-91a2-7b624e0e7244}",
"event_source_name": "",
"event_id": 81,
"version": 0,
"level": 0,
"task": 66,
"opcode": 2,
"keywords": "0x100",
"time_created": "2026-07-19T04:12:46.478846600+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 5248,
"thread_id": 11188
},
"channel": "Unknown",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"CDwnTaskPtr": "0x1DA0045C420",
"Zero": "0"
},
"message": ""
}
Event ID 82: Mshtml_CWindow_ScriptStart
#Fields #
| Name | Description |
|---|---|
CDoc Pointer | |
Nesting UInt32 |
Example Event #
{
"system": {
"provider": "Microsoft-IE",
"guid": "{9e3b3947-ca5d-4614-91a2-7b624e0e7244}",
"event_source_name": "",
"event_id": 82,
"version": 0,
"level": 0,
"task": 67,
"opcode": 1,
"keywords": "0x4000100",
"time_created": "2026-07-19T04:12:46.488403700+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 5248,
"thread_id": 3912
},
"channel": "Unknown",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"CDoc": "0x1DA00478000",
"Nesting": "1"
},
"message": ""
}
Event ID 83: Mshtml_CWindow_ScriptStop
#Fields #
| Name | Description |
|---|---|
CDoc Pointer | |
Nesting UInt32 |
Example Event #
{
"system": {
"provider": "Microsoft-IE",
"guid": "{9e3b3947-ca5d-4614-91a2-7b624e0e7244}",
"event_source_name": "",
"event_id": 83,
"version": 0,
"level": 0,
"task": 67,
"opcode": 2,
"keywords": "0x4000100",
"time_created": "2026-07-19T04:12:46.596318000+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 5248,
"thread_id": 3912
},
"channel": "Unknown",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"CDoc": "0x1DA00478000",
"Nesting": "2"
},
"message": ""
}
Event ID 84: Mshtml_CWindow_CommitCodeLightStart_V1
#Fields #
| Name | Description |
|---|---|
CDoc Pointer | |
EventContextId UInt64 |
Example Event #
{
"system": {
"provider": "Microsoft-IE",
"guid": "{9e3b3947-ca5d-4614-91a2-7b624e0e7244}",
"event_source_name": "",
"event_id": 84,
"version": 1,
"level": 0,
"task": 68,
"opcode": 1,
"keywords": "0x4000100",
"time_created": "2026-07-19T04:12:46.488439100+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 5248,
"thread_id": 3912
},
"channel": "Unknown",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"CDoc": "0x1DA00478000",
"EventContextId": "2035819446272"
},
"message": ""
}
Event ID 85: Mshtml_CWindow_CommitCodeLightStop_V1
#Fields #
| Name | Description |
|---|---|
CDoc Pointer | |
HR UInt32 | |
EventContextId UInt64 |
Example Event #
{
"system": {
"provider": "Microsoft-IE",
"guid": "{9e3b3947-ca5d-4614-91a2-7b624e0e7244}",
"event_source_name": "",
"event_id": 85,
"version": 1,
"level": 0,
"task": 68,
"opcode": 2,
"keywords": "0x4000100",
"time_created": "2026-07-19T04:12:46.596472300+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 5248,
"thread_id": 3912
},
"channel": "Unknown",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"CDoc": "0x1DA00478000",
"HR": "0x0",
"EventContextId": "2035819446272"
},
"message": ""
}
Event ID 86: Mshtml_HtmPost_PostManExecuteStart
#Fields #
| Name | Description |
|---|---|
PtrIn Pointer | |
dwTimeout UInt32 |
Example Event #
{
"system": {
"provider": "Microsoft-IE",
"guid": "{9e3b3947-ca5d-4614-91a2-7b624e0e7244}",
"event_source_name": "",
"event_id": 86,
"version": 0,
"level": 0,
"task": 69,
"opcode": 1,
"keywords": "0x4001100",
"time_created": "2026-07-19T04:12:46.487132800+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 5248,
"thread_id": 3912
},
"channel": "Unknown",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"PtrIn": "0x1DA00460640",
"dwTimeout": "65007950"
},
"message": ""
}
Event ID 87: Mshtml_HtmPost_PostManExecuteStop
#Fields #
| Name | Description |
|---|---|
PtrOut Pointer | |
ExitCode UInt32 |
Example Event #
{
"system": {
"provider": "Microsoft-IE",
"guid": "{9e3b3947-ca5d-4614-91a2-7b624e0e7244}",
"event_source_name": "",
"event_id": 87,
"version": 0,
"level": 0,
"task": 69,
"opcode": 2,
"keywords": "0x4001100",
"time_created": "2026-07-19T04:12:46.596621800+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 5248,
"thread_id": 3912
},
"channel": "Unknown",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"PtrOut": "0x1DA00460640",
"ExitCode": "0x0"
},
"message": ""
}
Event ID 88: Mshtml_HtmPost_ExecStart_V1
#Fields #
| Name | Description |
|---|---|
PtrIn Pointer | |
dwTimeout UInt32 | |
Object UInt64 | |
EventContextId UInt64 |
Example Event #
{
"system": {
"provider": "Microsoft-IE",
"guid": "{9e3b3947-ca5d-4614-91a2-7b624e0e7244}",
"event_source_name": "",
"event_id": 88,
"version": 1,
"level": 0,
"task": 70,
"opcode": 1,
"keywords": "0x4001100",
"time_created": "2026-07-19T04:12:46.487277800+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 5248,
"thread_id": 3912
},
"channel": "Unknown",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"PtrIn": "0x1DA00460640",
"dwTimeout": "65007950",
"Object": "2035819446272",
"EventContextId": "2035819446272"
},
"message": ""
}
Event ID 89: Mshtml_HtmPost_ExecStop_V1
#Fields #
| Name | Description |
|---|---|
PtrOut Pointer | |
ExitCode UInt32 | |
Object UInt64 | |
EventContextId UInt64 |
Example Event #
{
"system": {
"provider": "Microsoft-IE",
"guid": "{9e3b3947-ca5d-4614-91a2-7b624e0e7244}",
"event_source_name": "",
"event_id": 89,
"version": 1,
"level": 0,
"task": 70,
"opcode": 2,
"keywords": "0x4001100",
"time_created": "2026-07-19T04:12:46.596568000+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 5248,
"thread_id": 3912
},
"channel": "Unknown",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"PtrOut": "0x1DA00460640",
"ExitCode": "0x0",
"Object": "2035819446272",
"EventContextId": "2035819446272"
},
"message": ""
}
Event ID 91: Mshtml_OnQuiescence
#Event ID 100: Mshtml_CDoc_PaintRect
#Fields #
| Name | Description |
|---|---|
left UInt32 | |
top UInt32 | |
right UInt32 | |
bottom UInt32 |
Example Event #
{
"system": {
"provider": "Microsoft-IE",
"guid": "{9e3b3947-ca5d-4614-91a2-7b624e0e7244}",
"event_source_name": "",
"event_id": 100,
"version": 0,
"level": 0,
"task": 78,
"opcode": 0,
"keywords": "0x200",
"time_created": "2026-07-19T04:12:46.648567000+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 5248,
"thread_id": 3912
},
"channel": "Unknown",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"left": "0",
"top": "0",
"right": "0",
"bottom": "0"
},
"message": ""
}
Event ID 117: Mshtml_DOM_Marshalling_GetDispIDStart
#Fields #
| Name | Description |
|---|---|
Thunk Pointer | |
GrfDex UInt32 | |
Zero1 UInt32 | |
Zero2 UInt32 |
Example Event #
{
"system": {
"provider": "Microsoft-IE",
"guid": "{9e3b3947-ca5d-4614-91a2-7b624e0e7244}",
"event_source_name": "",
"event_id": 117,
"version": 0,
"level": 0,
"task": 87,
"opcode": 1,
"keywords": "0x2000",
"time_created": "2026-07-19T04:12:46.505053200+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 5248,
"thread_id": 3912
},
"channel": "Unknown",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"Thunk": "0x1DA00464200",
"GrfDex": "268435457",
"Zero1": "0",
"Zero2": "0"
},
"message": ""
}
Event ID 118: Mshtml_DOM_Marshalling_GetDispIDStop
#Fields #
| Name | Description |
|---|---|
Thunk Pointer | |
hr UInt32 | |
DispID UInt32 | |
Versioned UInt32 |
Example Event #
{
"system": {
"provider": "Microsoft-IE",
"guid": "{9e3b3947-ca5d-4614-91a2-7b624e0e7244}",
"event_source_name": "",
"event_id": 118,
"version": 0,
"level": 0,
"task": 87,
"opcode": 2,
"keywords": "0x2000",
"time_created": "2026-07-19T04:12:46.505224800+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 5248,
"thread_id": 3912
},
"channel": "Unknown",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"Thunk": "0x1DA004B0400",
"hr": "0x0",
"DispID": "1151",
"Versioned": "1"
},
"message": ""
}
Event ID 119: Mshtml_DOM_Marshalling_InvokeExStart
#Fields #
| Name | Description |
|---|---|
Thunk Pointer | |
DispID UInt32 |
Example Event #
{
"system": {
"provider": "Microsoft-IE",
"guid": "{9e3b3947-ca5d-4614-91a2-7b624e0e7244}",
"event_source_name": "",
"event_id": 119,
"version": 0,
"level": 0,
"task": 88,
"opcode": 1,
"keywords": "0x2000",
"time_created": "2026-07-19T04:12:46.518163200+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 5248,
"thread_id": 3912
},
"channel": "Unknown",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"Thunk": "0x1DA00490730",
"DispID": "1151"
},
"message": ""
}
Event ID 120: Mshtml_DOM_Marshalling_InvokeExStop
#Fields #
| Name | Description |
|---|---|
Thunk Pointer | |
DispID UInt32 | |
Derived UInt32 | |
hr UInt32 |
Example Event #
{
"system": {
"provider": "Microsoft-IE",
"guid": "{9e3b3947-ca5d-4614-91a2-7b624e0e7244}",
"event_source_name": "",
"event_id": 120,
"version": 0,
"level": 0,
"task": 88,
"opcode": 2,
"keywords": "0x2000",
"time_created": "2026-07-19T04:12:46.518220400+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 5248,
"thread_id": 3912
},
"channel": "Unknown",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"Thunk": "0x1DA00490730",
"DispID": "1151",
"Derived": "1",
"hr": "0x0"
},
"message": ""
}
Event ID 121: Mshtml_DOM_Marshalling_NativeStart
#Fields #
| Name | Description |
|---|---|
VTable Pointer | |
MethodType UInt32 |
Example Event #
{
"system": {
"provider": "Microsoft-IE",
"guid": "{9e3b3947-ca5d-4614-91a2-7b624e0e7244}",
"event_source_name": "",
"event_id": 121,
"version": 0,
"level": 0,
"task": 89,
"opcode": 1,
"keywords": "0x2000",
"time_created": "2026-07-19T04:12:46.518202000+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 5248,
"thread_id": 3912
},
"channel": "Unknown",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"VTable": "0x7FF8BA23F5D8",
"MethodType": "0"
},
"message": ""
}
Event ID 122: Mshtml_DOM_Marshalling_NativeStop
#Fields #
| Name | Description |
|---|---|
Instance Pointer | |
OptionalArgs UInt32 |
Example Event #
{
"system": {
"provider": "Microsoft-IE",
"guid": "{9e3b3947-ca5d-4614-91a2-7b624e0e7244}",
"event_source_name": "",
"event_id": 122,
"version": 0,
"level": 0,
"task": 89,
"opcode": 2,
"keywords": "0x2000",
"time_created": "2026-07-19T04:12:46.518204300+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 5248,
"thread_id": 3912
},
"channel": "Unknown",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"Instance": "0x1DA00464230",
"OptionalArgs": "0"
},
"message": ""
}
Event ID 123: Mshtml_CSS_ParserStart_V2
#Fields #
| Name | Description |
|---|---|
Parser Pointer | |
ParserType UInt32 | |
ParseType UInt32 | |
URL UnicodeString | |
IsInline Boolean | |
EventContextId UInt64 |
Example Event #
{
"system": {
"provider": "Microsoft-IE",
"guid": "{9e3b3947-ca5d-4614-91a2-7b624e0e7244}",
"event_source_name": "",
"event_id": 123,
"version": 2,
"level": 0,
"task": 90,
"opcode": 1,
"keywords": "0x1200",
"time_created": "2026-07-19T04:12:46.457850500+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 5248,
"thread_id": 3912
},
"channel": "Unknown",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"Parser": "0x1DA004E0000",
"ParserType": "1",
"ParseType": "0",
"URL": "NULL",
"IsInline": "true",
"EventContextId": "0"
},
"message": ""
}
Event ID 124: Mshtml_CSS_ParserStop_V2
#Fields #
| Name | Description |
|---|---|
Parser Pointer | |
ParserType UInt32 | |
ParseType UInt32 | |
URL UnicodeString | |
IsInline Boolean | |
EventContextId UInt64 |
Example Event #
{
"system": {
"provider": "Microsoft-IE",
"guid": "{9e3b3947-ca5d-4614-91a2-7b624e0e7244}",
"event_source_name": "",
"event_id": 124,
"version": 2,
"level": 0,
"task": 90,
"opcode": 2,
"keywords": "0x1200",
"time_created": "2026-07-19T04:12:46.457962900+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 5248,
"thread_id": 3912
},
"channel": "Unknown",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"Parser": "0x1DA004E0000",
"ParserType": "1",
"ParseType": "0",
"URL": "NULL",
"IsInline": "true",
"EventContextId": "0"
},
"message": ""
}
Event ID 125: Mshtml_FormatCalculation_ComputeFormatsStart_V1
#Fields #
| Name | Description |
|---|---|
TreeNode Pointer | |
NodeType UInt32 | |
EventContextId UInt64 |
Example Event #
{
"system": {
"provider": "Microsoft-IE",
"guid": "{9e3b3947-ca5d-4614-91a2-7b624e0e7244}",
"event_source_name": "",
"event_id": 125,
"version": 1,
"level": 0,
"task": 91,
"opcode": 1,
"keywords": "0x800",
"time_created": "2026-07-19T04:12:46.483839200+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 5248,
"thread_id": 3912
},
"channel": "Unknown",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"TreeNode": "0x1DA004C0000",
"NodeType": "1",
"EventContextId": "2035819446272"
},
"message": ""
}
Event ID 126: Mshtml_FormatCalculation_ComputeFormatsStop_V1
#Fields #
| Name | Description |
|---|---|
TreeNode Pointer | |
NodeType UInt32 | |
EventContextId UInt64 |
Example Event #
{
"system": {
"provider": "Microsoft-IE",
"guid": "{9e3b3947-ca5d-4614-91a2-7b624e0e7244}",
"event_source_name": "",
"event_id": 126,
"version": 1,
"level": 0,
"task": 91,
"opcode": 2,
"keywords": "0x800",
"time_created": "2026-07-19T04:12:46.483909000+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 5248,
"thread_id": 3912
},
"channel": "Unknown",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"TreeNode": "0x1DA004C0000",
"NodeType": "1",
"EventContextId": "2035819446272"
},
"message": ""
}
Event ID 129: JScript_ParseStart
#Fields #
| Name | Description |
|---|---|
Element Pointer | |
Zero UInt32 |
Example Event #
{
"system": {
"provider": "Microsoft-IE",
"guid": "{9e3b3947-ca5d-4614-91a2-7b624e0e7244}",
"event_source_name": "",
"event_id": 129,
"version": 0,
"level": 0,
"task": 93,
"opcode": 1,
"keywords": "0x8000",
"time_created": "2026-07-19T04:12:46.504341000+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 5248,
"thread_id": 3912
},
"channel": "Unknown",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"Element": "0x1DA006940D0",
"Zero": "0"
},
"message": ""
}
Event ID 130: JScript_ParseStop
#Fields #
| Name | Description |
|---|---|
Element Pointer | |
Zero UInt32 |
Example Event #
{
"system": {
"provider": "Microsoft-IE",
"guid": "{9e3b3947-ca5d-4614-91a2-7b624e0e7244}",
"event_source_name": "",
"event_id": 130,
"version": 0,
"level": 0,
"task": 93,
"opcode": 2,
"keywords": "0x8000",
"time_created": "2026-07-19T04:12:46.504433900+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 5248,
"thread_id": 3912
},
"channel": "Unknown",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"Element": "0x1DA006940D0",
"Zero": "0"
},
"message": ""
}
Event ID 131: JScript_RunStart
#Fields #
| Name | Description |
|---|---|
Element Pointer | |
Zero UInt32 |
Example Event #
{
"system": {
"provider": "Microsoft-IE",
"guid": "{9e3b3947-ca5d-4614-91a2-7b624e0e7244}",
"event_source_name": "",
"event_id": 131,
"version": 0,
"level": 0,
"task": 94,
"opcode": 1,
"keywords": "0x4400000",
"time_created": "2026-07-19T04:12:46.503401800+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 5248,
"thread_id": 3912
},
"channel": "Unknown",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"Element": "0x1DA00690080",
"Zero": "0"
},
"message": ""
}
Event ID 132: JScript_RunStop
#Fields #
| Name | Description |
|---|---|
Element Pointer | |
Zero UInt32 |
Example Event #
{
"system": {
"provider": "Microsoft-IE",
"guid": "{9e3b3947-ca5d-4614-91a2-7b624e0e7244}",
"event_source_name": "",
"event_id": 132,
"version": 0,
"level": 0,
"task": 94,
"opcode": 2,
"keywords": "0x4400000",
"time_created": "2026-07-19T04:12:46.503485500+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 5248,
"thread_id": 3912
},
"channel": "Unknown",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"Element": "0x1DA00690080",
"Zero": "0"
},
"message": ""
}
Event ID 137: Mshtml_View_RenderViewStart
#Fields #
| Name | Description |
|---|---|
View Pointer |
Example Event #
{
"system": {
"provider": "Microsoft-IE",
"guid": "{9e3b3947-ca5d-4614-91a2-7b624e0e7244}",
"event_source_name": "",
"event_id": 137,
"version": 0,
"level": 0,
"task": 97,
"opcode": 1,
"keywords": "0x4001200",
"time_created": "2026-07-19T04:12:46.648580600+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 5248,
"thread_id": 3912
},
"channel": "Unknown",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"View": "0x1DA00478000"
},
"message": ""
}
Event ID 138: Mshtml_View_RenderViewStop
#Fields #
| Name | Description |
|---|---|
View Pointer | |
Exit UInt32 |
Example Event #
{
"system": {
"provider": "Microsoft-IE",
"guid": "{9e3b3947-ca5d-4614-91a2-7b624e0e7244}",
"event_source_name": "",
"event_id": 138,
"version": 0,
"level": 0,
"task": 97,
"opcode": 2,
"keywords": "0x4001200",
"time_created": "2026-07-19T04:12:46.648660000+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 5248,
"thread_id": 3912
},
"channel": "Unknown",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"View": "0x1DA00478000",
"Exit": "1"
},
"message": ""
}
Event ID 139: Mshtml_View_OnViewQ
#Fields #
| Name | Description |
|---|---|
View Pointer |
Example Event #
{
"system": {
"provider": "Microsoft-IE",
"guid": "{9e3b3947-ca5d-4614-91a2-7b624e0e7244}",
"event_source_name": "",
"event_id": 139,
"version": 0,
"level": 0,
"task": 98,
"opcode": 0,
"keywords": "0x1000",
"time_created": "2026-07-19T04:12:46.483634000+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 5248,
"thread_id": 3912
},
"channel": "Unknown",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"View": "0x1DA00478000"
},
"message": ""
}
Event ID 140: Mshtml_View_OnViewD
#Fields #
| Name | Description |
|---|---|
View Pointer |
Example Event #
{
"system": {
"provider": "Microsoft-IE",
"guid": "{9e3b3947-ca5d-4614-91a2-7b624e0e7244}",
"event_source_name": "",
"event_id": 140,
"version": 0,
"level": 0,
"task": 99,
"opcode": 0,
"keywords": "0x1000",
"time_created": "2026-07-19T04:12:46.483991300+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 5248,
"thread_id": 3912
},
"channel": "Unknown",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"View": "0x1DA00478000"
},
"message": ""
}
Event ID 152: Mshtml_Ole_OleLayout_DrawStop
#Event ID 153: Mshtml_ScrollEvent
#Event ID 154: Mshtml_ZoomEvent
#Example Event #
{
"system": {
"channel": "Unknown",
"computer": "10.2.10.21",
"correlation": {},
"event_id": 154,
"event_record_id": 0,
"event_source_name": "",
"execution": {
"process_id": 10004,
"thread_id": 7236
},
"guid": "",
"keywords": 0,
"level": 4,
"opcode": 0,
"provider": "Microsoft-IE",
"security": {
"user_id": ""
},
"task": 0,
"time_created": "2026-07-21 22:09:33.138Z",
"version": 0
},
"event_data": {},
"message": ""
}
Event ID 155: Mshtml_PrintPreviewStart
#Event ID 156: Mshtml_PrintPreviewStop
#Event ID 159: Mshtml_CssLayout_BuildBlocksStart
#Event ID 160: Mshtml_CssLayout_BuildBlocksStop
#Event ID 161: Mshtml_CssLayout_BuildLayoutStart
#Example Event #
{
"system": {
"channel": "Unknown",
"computer": "10.2.10.21",
"correlation": {},
"event_id": 161,
"event_record_id": 0,
"event_source_name": "",
"execution": {
"process_id": 10004,
"thread_id": 7236
},
"guid": "",
"keywords": 0,
"level": 4,
"opcode": 1,
"provider": "Microsoft-IE",
"security": {
"user_id": ""
},
"task": 0,
"time_created": "2026-07-21 22:09:33.455Z",
"version": 0
},
"event_data": {},
"message": ""
}
Event ID 162: Mshtml_CssLayout_BuildLayoutStop
#Example Event #
{
"system": {
"channel": "Unknown",
"computer": "10.2.10.21",
"correlation": {},
"event_id": 162,
"event_record_id": 0,
"event_source_name": "",
"execution": {
"process_id": 10004,
"thread_id": 7236
},
"guid": "",
"keywords": 0,
"level": 4,
"opcode": 2,
"provider": "Microsoft-IE",
"security": {
"user_id": ""
},
"task": 0,
"time_created": "2026-07-21 22:09:33.859Z",
"version": 0
},
"event_data": {},
"message": ""
}
Event ID 163: Mshtml_CssLayout_BuildDisplayStart
#Example Event #
{
"system": {
"provider": "Microsoft-IE",
"guid": "{9e3b3947-ca5d-4614-91a2-7b624e0e7244}",
"event_source_name": "",
"event_id": 163,
"version": 0,
"level": 0,
"task": 112,
"opcode": 1,
"keywords": "0x800",
"time_created": "2026-07-19T04:12:46.484020500+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 5248,
"thread_id": 3912
},
"channel": "Unknown",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {},
"message": ""
}
Event ID 164: Mshtml_CssLayout_BuildDisplayStop
#Example Event #
{
"system": {
"provider": "Microsoft-IE",
"guid": "{9e3b3947-ca5d-4614-91a2-7b624e0e7244}",
"event_source_name": "",
"event_id": 164,
"version": 0,
"level": 0,
"task": 112,
"opcode": 2,
"keywords": "0x800",
"time_created": "2026-07-19T04:12:46.484097700+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 5248,
"thread_id": 3912
},
"channel": "Unknown",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {},
"message": ""
}
Event ID 168: JScript_ByteCodeGenStart
#Fields #
| Name | Description |
|---|---|
Element Pointer | |
Zero UInt32 |
Example Event #
{
"system": {
"provider": "Microsoft-IE",
"guid": "{9e3b3947-ca5d-4614-91a2-7b624e0e7244}",
"event_source_name": "",
"event_id": 168,
"version": 0,
"level": 0,
"task": 115,
"opcode": 1,
"keywords": "0x8000",
"time_created": "2026-07-19T04:12:46.504453700+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 5248,
"thread_id": 3912
},
"channel": "Unknown",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"Element": "0x1DA006940D0",
"Zero": "0"
},
"message": ""
}
Event ID 169: JScript_ByteCodeGenStop
#Fields #
| Name | Description |
|---|---|
Element Pointer | |
Zero UInt32 |
Example Event #
{
"system": {
"provider": "Microsoft-IE",
"guid": "{9e3b3947-ca5d-4614-91a2-7b624e0e7244}",
"event_source_name": "",
"event_id": 169,
"version": 0,
"level": 0,
"task": 115,
"opcode": 2,
"keywords": "0x8000",
"time_created": "2026-07-19T04:12:46.504593100+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 5248,
"thread_id": 3912
},
"channel": "Unknown",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"Element": "0x1DA006940D0",
"Zero": "0"
},
"message": ""
}
Event ID 170: JScript_NativeCodeGenStart
#Fields #
| Name | Description |
|---|---|
Element Pointer | |
Zero UInt32 |
Example Event #
{
"system": {
"provider": "Microsoft-IE",
"guid": "{9e3b3947-ca5d-4614-91a2-7b624e0e7244}",
"event_source_name": "",
"event_id": 170,
"version": 0,
"level": 0,
"task": 116,
"opcode": 1,
"keywords": "0x8000",
"time_created": "2026-07-19T04:12:46.503025400+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 5248,
"thread_id": 12256
},
"channel": "Unknown",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"Element": "0x1DA006AAF40",
"Zero": "0"
},
"message": ""
}
Event ID 171: JScript_NativeCodeGenStop
#Fields #
| Name | Description |
|---|---|
Element Pointer | |
Zero UInt32 |
Example Event #
{
"system": {
"provider": "Microsoft-IE",
"guid": "{9e3b3947-ca5d-4614-91a2-7b624e0e7244}",
"event_source_name": "",
"event_id": 171,
"version": 0,
"level": 0,
"task": 116,
"opcode": 2,
"keywords": "0x8000",
"time_created": "2026-07-19T04:12:46.503040800+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 5248,
"thread_id": 12256
},
"channel": "Unknown",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"Element": "0x1DA006AAF40",
"Zero": "0"
},
"message": ""
}
Event ID 172: JScript_NativeCodeGenDelayStart
#Fields #
| Name | Description |
|---|---|
Element Pointer | |
Zero UInt32 |
Example Event #
{
"system": {
"provider": "Microsoft-IE",
"guid": "{9e3b3947-ca5d-4614-91a2-7b624e0e7244}",
"event_source_name": "",
"event_id": 172,
"version": 0,
"level": 0,
"task": 117,
"opcode": 1,
"keywords": "0x8000",
"time_created": "2026-07-19T04:12:46.504800700+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 5248,
"thread_id": 3912
},
"channel": "Unknown",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"Element": "0x8888BEDEF0",
"Zero": "0"
},
"message": ""
}
Event ID 173: JScript_NativeCodeGenDelayStop
#Fields #
| Name | Description |
|---|---|
Element Pointer | |
Zero UInt32 |
Example Event #
{
"system": {
"provider": "Microsoft-IE",
"guid": "{9e3b3947-ca5d-4614-91a2-7b624e0e7244}",
"event_source_name": "",
"event_id": 173,
"version": 0,
"level": 0,
"task": 117,
"opcode": 2,
"keywords": "0x8000",
"time_created": "2026-07-19T04:12:46.504820000+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 5248,
"thread_id": 3912
},
"channel": "Unknown",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"Element": "0x8888BEDEF0",
"Zero": "0"
},
"message": ""
}
Event ID 174: JScript_CallOutStart
#Fields #
| Name | Description |
|---|---|
Element Pointer | |
Zero UInt32 |
Example Event #
{
"system": {
"provider": "Microsoft-IE",
"guid": "{9e3b3947-ca5d-4614-91a2-7b624e0e7244}",
"event_source_name": "",
"event_id": 174,
"version": 0,
"level": 0,
"task": 118,
"opcode": 1,
"keywords": "0x400000",
"time_created": "2026-07-19T04:12:46.503420000+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 5248,
"thread_id": 3912
},
"channel": "Unknown",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"Element": "0x1DA00690080",
"Zero": "0"
},
"message": ""
}
Event ID 175: JScript_CallOutStop
#Fields #
| Name | Description |
|---|---|
Element Pointer | |
Zero UInt32 |
Example Event #
{
"system": {
"provider": "Microsoft-IE",
"guid": "{9e3b3947-ca5d-4614-91a2-7b624e0e7244}",
"event_source_name": "",
"event_id": 175,
"version": 0,
"level": 0,
"task": 118,
"opcode": 2,
"keywords": "0x400000",
"time_created": "2026-07-19T04:12:46.503438700+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 5248,
"thread_id": 3912
},
"channel": "Unknown",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"Element": "0x1DA00690080",
"Zero": "0"
},
"message": ""
}
Event ID 176: Mshtml_Dx_DeviceCreateStart
#Example Event #
{
"system": {
"provider": "Microsoft-IE",
"guid": "{9e3b3947-ca5d-4614-91a2-7b624e0e7244}",
"event_source_name": "",
"event_id": 176,
"version": 0,
"level": 0,
"task": 119,
"opcode": 1,
"keywords": "0x4001400",
"time_created": "2026-07-19T04:12:46.540765600+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 5248,
"thread_id": 3912
},
"channel": "Unknown",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {},
"message": ""
}
Event ID 177: Mshtml_Dx_DeviceCreateStop
#Example Event #
{
"system": {
"provider": "Microsoft-IE",
"guid": "{9e3b3947-ca5d-4614-91a2-7b624e0e7244}",
"event_source_name": "",
"event_id": 177,
"version": 0,
"level": 0,
"task": 119,
"opcode": 2,
"keywords": "0x4001400",
"time_created": "2026-07-19T04:12:46.547114000+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 5248,
"thread_id": 3912
},
"channel": "Unknown",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {},
"message": ""
}
Event ID 178: Mshtml_Dx_TargetSurfaceEnsureStart
#Fields #
| Name | Description |
|---|---|
RenderTarget Pointer | |
TargetSurfaceBaseType UInt32 | |
TargetSurfaceSubType UInt32 |
Example Event #
{
"system": {
"channel": "Unknown",
"computer": "10.2.10.21",
"correlation": {},
"event_id": 178,
"event_record_id": 0,
"event_source_name": "",
"execution": {
"process_id": 10004,
"thread_id": 7236
},
"guid": "",
"keywords": 0,
"level": 4,
"opcode": 1,
"provider": "Microsoft-IE",
"security": {
"user_id": ""
},
"task": 0,
"time_created": "2026-07-21 22:09:33.898Z",
"version": 0
},
"event_data": {
"RenderTarget": "0x21C47AFD0D0",
"TargetSurfaceBaseType": 0,
"TargetSurfaceSubType": 0
},
"message": ""
}
Event ID 179: Mshtml_Dx_TargetSurfaceEnsureStop
#Fields #
| Name | Description |
|---|---|
RenderTarget Pointer |
Example Event #
{
"system": {
"channel": "Unknown",
"computer": "10.2.10.21",
"correlation": {},
"event_id": 179,
"event_record_id": 0,
"event_source_name": "",
"execution": {
"process_id": 10004,
"thread_id": 7236
},
"guid": "",
"keywords": 0,
"level": 4,
"opcode": 2,
"provider": "Microsoft-IE",
"security": {
"user_id": ""
},
"task": 0,
"time_created": "2026-07-21 22:09:33.898Z",
"version": 0
},
"event_data": {
"RenderTarget": "0x21C47AFD0D0"
},
"message": ""
}
Event ID 180: Mshtml_CImgTask_Decoded
#Fields #
| Name | Description |
|---|---|
ImgInfo | |
ImgTask | |
ImgCacheEntry | |
Width | |
Height | |
CompressedSize | |
BitCount | |
ChromaSubsampling | |
URL |
Event ID 181: Mshtml_CImgCacheEntry_Attach
#Fields #
| Name | Description |
|---|---|
ImgCacheEntry | |
ImgInfo | |
FrameIndex | |
ImgBits | |
ImgBitsSize | |
Width | |
Height | |
BitCount | |
IsSolidColor | |
IsTransparent |
Event ID 185: Mshtml_CDwnInfo_CacheHit
#Fields #
| Name | Description |
|---|---|
DwnInfo | |
HitDwnInfo | |
IsHitDwnInfoActive | |
URL |
Event ID 186: Mshtml_Image_Draw
#Fields #
| Name | Description |
|---|---|
ImgCacheEntry | |
DestLeft | |
DestTop | |
DestRight | |
DestBottom | |
ScaledSizeWidth | |
ScaledSizeHeight | |
TranslateX | |
TranslateY | |
Opacity | |
Tiled | |
UnscaledSizeWidth | |
UnscaledSizeHeight |
Event ID 187: Mshtml_CImgInfo_Destroy
#Fields #
| Name | Description |
|---|---|
DwnInfo Pointer | |
DecodeFlags UInt32 |
Example Event #
{
"system": {
"provider": "Microsoft-IE",
"guid": "{9e3b3947-ca5d-4614-91a2-7b624e0e7244}",
"event_source_name": "",
"event_id": 187,
"version": 0,
"level": 0,
"task": 128,
"opcode": 0,
"keywords": "0x200",
"time_created": "2026-07-19T04:14:16.359884000+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 13720,
"thread_id": 12380
},
"channel": "Unknown",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"DwnInfo": "0x234004FC460",
"DecodeFlags": "0x0"
},
"message": ""
}
Event ID 188: Mshtml_Print_DocumentStart
#Event ID 189: Mshtml_Print_DocumentStop
#Event ID 190: Mshtml_Print_PageStart
#Event ID 191: Mshtml_Print_PageStop
#Event ID 193: Mshtml_Scroll_SetOffsetStop
#Event ID 194: Mshtml_Scroll_Frame
#Fields #
| Name | Description |
|---|---|
TimeSinceStartUs | |
ExpectedFrameTimeUs | |
LastScrollTimeUs |
Event ID 195: Mshtml_Scroll_WaitForNextFrameStart
#Event ID 196: Mshtml_Scroll_WaitForNextFrameStop
#Event ID 201: Mshtml_AlignedTimer_Setup_V1
#Fields #
| Name | Description |
|---|---|
Object Pointer | |
TimerId UInt32 | |
DeltaMs Int32 | |
PeriodMs Int32 | |
CurrentTimeMs UInt64 | |
Flags HexInt32 | |
Callback Pointer |
Example Event #
{
"system": {
"provider": "Microsoft-IE",
"guid": "{9e3b3947-ca5d-4614-91a2-7b624e0e7244}",
"event_source_name": "",
"event_id": 201,
"version": 1,
"level": 0,
"task": 138,
"opcode": 0,
"keywords": "0x800000",
"time_created": "2026-07-19T04:12:46.484141700+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 5248,
"thread_id": 3912
},
"channel": "Unknown",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"Object": "0x1DA004C8000",
"TimerId": "208",
"DeltaMs": "500",
"PeriodMs": "500",
"CurrentTimeMs": "27",
"Flags": "0x0",
"Callback": "0x7FF8B975E660"
},
"message": ""
}
Event ID 202: Mshtml_AlignedTimer_Kill_V1
#Fields #
| Name | Description |
|---|---|
Object Pointer | |
TimerId UInt32 | |
DeltaMs Int32 | |
PeriodMs Int32 | |
CurrentTimeMs UInt64 | |
Flags HexInt32 | |
Callback Pointer |
Example Event #
{
"system": {
"provider": "Microsoft-IE",
"guid": "{9e3b3947-ca5d-4614-91a2-7b624e0e7244}",
"event_source_name": "",
"event_id": 202,
"version": 1,
"level": 0,
"task": 139,
"opcode": 0,
"keywords": "0x800000",
"time_created": "2026-07-19T04:12:46.617515900+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 5248,
"thread_id": 3912
},
"channel": "Unknown",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"Object": "0x1DA004C8000",
"TimerId": "208",
"DeltaMs": "0",
"PeriodMs": "0",
"CurrentTimeMs": "160",
"Flags": "0x0",
"Callback": "0x7FF8B975E660"
},
"message": ""
}
Event ID 203: Mshtml_AlignedTimer_Fire_V1
#Fields #
| Name | Description |
|---|---|
Object Pointer | |
TimerId UInt32 | |
DeltaMs Int32 | |
PeriodMs Int32 | |
CurrentTimeMs UInt64 | |
Flags HexInt32 | |
Callback Pointer |
Example Event #
{
"system": {
"provider": "Microsoft-IE",
"guid": "{9e3b3947-ca5d-4614-91a2-7b624e0e7244}",
"event_source_name": "",
"event_id": 203,
"version": 1,
"level": 0,
"task": 140,
"opcode": 0,
"keywords": "0x800000",
"time_created": "2026-07-19T04:20:10.765033000+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 5468,
"thread_id": 8344
},
"channel": "Unknown",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"Object": "0x249803B0400",
"TimerId": "2",
"DeltaMs": "269",
"PeriodMs": "10",
"CurrentTimeMs": "408",
"Flags": "0x80000001",
"Callback": "0x7FF8B965F210"
},
"message": ""
}
Event ID 204: Mshtml_AlignedBeat_Setup
#Fields #
| Name | Description |
|---|---|
Object UInt64 | |
CurrentTimeMs UInt64 | |
DeltaMs Int32 | |
BeatPeriodMs UInt32 | |
RefreshMultipleUs UInt32 |
Example Event #
{
"system": {
"provider": "Microsoft-IE",
"guid": "{9e3b3947-ca5d-4614-91a2-7b624e0e7244}",
"event_source_name": "",
"event_id": 204,
"version": 0,
"level": 0,
"task": 141,
"opcode": 0,
"keywords": "0x800000",
"time_created": "2026-07-19T04:12:46.484436700+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 5248,
"thread_id": 3912
},
"channel": "Unknown",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"Object": "2035819511808",
"CurrentTimeMs": "27",
"DeltaMs": "1",
"BeatPeriodMs": "15",
"RefreshMultipleUs": "0"
},
"message": ""
}
Event ID 205: Mshtml_AlignedBeat_Kill
#Fields #
| Name | Description |
|---|---|
Object UInt64 | |
CurrentTimeMs UInt64 | |
DeltaMs Int32 | |
BeatPeriodMs UInt32 | |
RefreshMultipleUs UInt32 |
Example Event #
{
"system": {
"provider": "Microsoft-IE",
"guid": "{9e3b3947-ca5d-4614-91a2-7b624e0e7244}",
"event_source_name": "",
"event_id": 205,
"version": 0,
"level": 0,
"task": 142,
"opcode": 0,
"keywords": "0x800000",
"time_created": "2026-07-19T04:12:46.679302400+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 5248,
"thread_id": 3912
},
"channel": "Unknown",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"Object": "2035819511808",
"CurrentTimeMs": "222",
"DeltaMs": "0",
"BeatPeriodMs": "15",
"RefreshMultipleUs": "0"
},
"message": ""
}
Event ID 206: Mshtml_AlignedBeat_FireStart
#Fields #
| Name | Description |
|---|---|
Object UInt64 | |
CurrentTimeMs UInt64 | |
DeltaMs Int32 | |
BeatPeriodMs UInt32 | |
RefreshMultipleUs UInt32 |
Example Event #
{
"system": {
"provider": "Microsoft-IE",
"guid": "{9e3b3947-ca5d-4614-91a2-7b624e0e7244}",
"event_source_name": "",
"event_id": 206,
"version": 0,
"level": 0,
"task": 143,
"opcode": 1,
"keywords": "0x800000",
"time_created": "2026-07-19T04:12:46.616753100+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 5248,
"thread_id": 3912
},
"channel": "Unknown",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"Object": "2035819511808",
"CurrentTimeMs": "159",
"DeltaMs": "131",
"BeatPeriodMs": "15",
"RefreshMultipleUs": "0"
},
"message": ""
}
Event ID 210: Mshtml_MsPerformance_FullyLoaded
#Event ID 215: Mshtml_LowPriMethodCall_Watchdog
#Example Event #
{
"system": {
"provider": "Microsoft-IE",
"guid": "{9e3b3947-ca5d-4614-91a2-7b624e0e7244}",
"event_source_name": "",
"event_id": 215,
"version": 0,
"level": 0,
"task": 152,
"opcode": 0,
"keywords": "0x800000",
"time_created": "2026-07-19T04:12:46.616642600+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 5248,
"thread_id": 3912
},
"channel": "Unknown",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {},
"message": ""
}
Event ID 226: Mshtml_MediaEngine_VideoMediaType
#Fields #
| Name | Description |
|---|---|
MediaEngineID | |
format | |
width | |
height | |
frameratenum | |
framerateden |
Event ID 227: Mshtml_MediaEngine_AudioMediaType
#Fields #
| Name | Description |
|---|---|
MediaEngineID | |
numchannels | |
samplespersec | |
bitspersample |
Event ID 235: Mshtml_MediaEngine_AudioDataPresented
#Fields #
| Name | Description |
|---|---|
MediaEngineID | |
sampletime | |
dataPresented |
Event ID 238: Mshtml_CImgTask_LazyDecoded
#Fields #
| Name | Description |
|---|---|
ImgInfo | |
ImgTask | |
ImgCacheEntry | |
Width | |
Height | |
CompressedSize | |
BitCount | |
ChromaSubsampling | |
URL |
Event ID 240: Mshtml_CPaintController_NotReadyToPaint
#Event ID 241: Mshtml_AlignedBeat_FireStop
#Example Event #
{
"system": {
"provider": "Microsoft-IE",
"guid": "{9e3b3947-ca5d-4614-91a2-7b624e0e7244}",
"event_source_name": "",
"event_id": 241,
"version": 0,
"level": 0,
"task": 143,
"opcode": 2,
"keywords": "0x800000",
"time_created": "2026-07-19T04:12:46.617648500+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 5248,
"thread_id": 3912
},
"channel": "Unknown",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {},
"message": ""
}
Event ID 242: Mshtml_CTimerMan_WaitStart
#Fields #
| Name | Description |
|---|---|
TimerMan Pointer | |
Info UInt32 |
Example Event #
{
"system": {
"provider": "Microsoft-IE",
"guid": "{9e3b3947-ca5d-4614-91a2-7b624e0e7244}",
"event_source_name": "",
"event_id": 242,
"version": 0,
"level": 0,
"task": 174,
"opcode": 1,
"keywords": "0x800000",
"time_created": "2026-07-19T04:12:46.484561200+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 5248,
"thread_id": 14316
},
"channel": "Unknown",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"TimerMan": "0x1DA004CC000",
"Info": "1"
},
"message": ""
}
Event ID 243: Mshtml_CTimerMan_WaitStop
#Fields #
| Name | Description |
|---|---|
TimerMan Pointer | |
Info UInt32 |
Example Event #
{
"system": {
"provider": "Microsoft-IE",
"guid": "{9e3b3947-ca5d-4614-91a2-7b624e0e7244}",
"event_source_name": "",
"event_id": 243,
"version": 0,
"level": 0,
"task": 174,
"opcode": 2,
"keywords": "0x800000",
"time_created": "2026-07-19T04:12:46.484575600+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 5248,
"thread_id": 14316
},
"channel": "Unknown",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"TimerMan": "0x1DA004CC000",
"Info": "0"
},
"message": ""
}
Event ID 246: Mshtml_CPaintController_CanNotPaintNow
#Fields #
| Name | Description |
|---|---|
Object UInt64 | |
Value UInt64 |
Example Event #
{
"system": {
"provider": "Microsoft-IE",
"guid": "{9e3b3947-ca5d-4614-91a2-7b624e0e7244}",
"event_source_name": "",
"event_id": 246,
"version": 0,
"level": 0,
"task": 176,
"opcode": 0,
"keywords": "0x200",
"time_created": "2026-07-19T04:12:46.617382600+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 5248,
"thread_id": 3912
},
"channel": "Unknown",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"Object": "2035819495424",
"Value": "128"
},
"message": ""
}
Event ID 338: Mshtml_CTouchHelper_HandleTouchMessageStart
#Fields #
| Name | Description |
|---|---|
Doc | |
MessageId | |
PointerId |
Event ID 339: Mshtml_CTouchHelper_HandleTouchMessageStop
#Fields #
| Name | Description |
|---|---|
Doc | |
MessageId | |
PointerId |
Event ID 342: Mshtml_Animations_UpdateStart
#Fields #
| Name | Description |
|---|---|
TotalStoryboardCount | |
IndependentStoryboardCount |
Event ID 343: Mshtml_Animations_UpdateStop
#Fields #
| Name | Description |
|---|---|
NumberOfUpdates | |
NumberOfUpdateSkips |
Event ID 354: Mshtml_MediaElement_VolumeChangeStart354
#Fields #
| Name | Description |
|---|---|
MediaElementId | |
PositionInPercentage |
Event ID 357: Mshtml_MediaElement_SeekStart357
#Fields #
| Name | Description |
|---|---|
MediaElementId | |
TimeDurationInSecs |
Event ID 358: Mshtml_MediaElement_SeekStart358
#Fields #
| Name | Description |
|---|---|
MediaElementId | |
PositionInPercentage |
Event ID 367: Mshtml_HTMLSpell_InitSpellerStart
#Event ID 368: Mshtml_HTMLSpell_InitSpellerStop
#Event ID 369: Mshtml_HTMLSpell_SpellCheckingEngineStart
#Event ID 370: Mshtml_HTMLSpell_SpellCheckingEngineStop
#Event ID 383: Mshtml_Composition_LayerManager_InitializeStart
#Example Event #
{
"system": {
"provider": "Microsoft-IE",
"guid": "{9e3b3947-ca5d-4614-91a2-7b624e0e7244}",
"event_source_name": "",
"event_id": 383,
"version": 0,
"level": 0,
"task": 227,
"opcode": 1,
"keywords": "0x10000000",
"time_created": "2026-07-19T04:12:46.483682300+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 5248,
"thread_id": 3912
},
"channel": "Unknown",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {},
"message": ""
}
Event ID 384: Mshtml_Composition_LayerManager_InitializeStop
#Example Event #
{
"system": {
"provider": "Microsoft-IE",
"guid": "{9e3b3947-ca5d-4614-91a2-7b624e0e7244}",
"event_source_name": "",
"event_id": 384,
"version": 0,
"level": 0,
"task": 227,
"opcode": 2,
"keywords": "0x10000000",
"time_created": "2026-07-19T04:12:46.483700500+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 5248,
"thread_id": 3912
},
"channel": "Unknown",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {},
"message": ""
}
Event ID 385: Mshtml_Composition_Destination_PreRenderStart
#Example Event #
{
"system": {
"channel": "Unknown",
"computer": "10.2.10.21",
"correlation": {},
"event_id": 385,
"event_record_id": 0,
"event_source_name": "",
"execution": {
"process_id": 10004,
"thread_id": 7236
},
"guid": "",
"keywords": 0,
"level": 4,
"opcode": 1,
"provider": "Microsoft-IE",
"security": {
"user_id": ""
},
"task": 0,
"time_created": "2026-07-21 22:09:33.897Z",
"version": 0
},
"event_data": {},
"message": ""
}
Event ID 386: Mshtml_Composition_Destination_PreRenderStop
#Example Event #
{
"system": {
"channel": "Unknown",
"computer": "10.2.10.21",
"correlation": {},
"event_id": 386,
"event_record_id": 0,
"event_source_name": "",
"execution": {
"process_id": 10004,
"thread_id": 7236
},
"guid": "",
"keywords": 0,
"level": 4,
"opcode": 2,
"provider": "Microsoft-IE",
"security": {
"user_id": ""
},
"task": 0,
"time_created": "2026-07-21 22:09:33.898Z",
"version": 0
},
"event_data": {},
"message": ""
}
Event ID 387: Mshtml_Composition_Destination_RenderLayerStart
#Example Event #
{
"system": {
"channel": "Unknown",
"computer": "10.2.10.21",
"correlation": {},
"event_id": 387,
"event_record_id": 0,
"event_source_name": "",
"execution": {
"process_id": 10004,
"thread_id": 7236
},
"guid": "",
"keywords": 0,
"level": 4,
"opcode": 1,
"provider": "Microsoft-IE",
"security": {
"user_id": ""
},
"task": 0,
"time_created": "2026-07-21 22:09:33.898Z",
"version": 0
},
"event_data": {},
"message": ""
}
Event ID 388: Mshtml_Composition_Destination_RenderLayerStop
#Example Event #
{
"system": {
"channel": "Unknown",
"computer": "10.2.10.21",
"correlation": {},
"event_id": 388,
"event_record_id": 0,
"event_source_name": "",
"execution": {
"process_id": 10004,
"thread_id": 7236
},
"guid": "",
"keywords": 0,
"level": 4,
"opcode": 2,
"provider": "Microsoft-IE",
"security": {
"user_id": ""
},
"task": 0,
"time_created": "2026-07-21 22:09:33.903Z",
"version": 0
},
"event_data": {},
"message": ""
}
Event ID 389: Mshtml_Composition_Create_LayerStart
#Event ID 390: Mshtml_Composition_Create_LayerStop
#Event ID 391: Mshtml_Composition_Destroy_Layer_GroupStart
#Event ID 392: Mshtml_Composition_Destroy_Layer_GroupStop
#Event ID 393: Mshtml_Composition_Destroy_All_LayersStart
#Event ID 394: Mshtml_Composition_Destroy_All_LayersStop
#Event ID 395: Mshtml_Composition_Update_Implicit_LayersStart
#Event ID 396: Mshtml_Composition_Update_Implicit_LayersStop
#Event ID 397: Mshtml_Composition_Layer_Invalidate
#Fields #
| Name | Description |
|---|---|
DispNode Pointer | |
DispLayer Pointer | |
left Int32 | |
top Int32 | |
right Int32 | |
bottom Int32 | |
ElementDDTId UInt64 |
Example Event #
{
"system": {
"channel": "Unknown",
"computer": "10.2.10.21",
"correlation": {},
"event_id": 397,
"event_record_id": 0,
"event_source_name": "",
"execution": {
"process_id": 10004,
"thread_id": 7236
},
"guid": "",
"keywords": 0,
"level": 4,
"opcode": 0,
"provider": "Microsoft-IE",
"security": {
"user_id": ""
},
"task": 0,
"time_created": "2026-07-21 22:09:33.220Z",
"version": 0
},
"event_data": {
"DispLayer": "0x21C5BAF39C0",
"DispNode": "0x21C46A52CF0",
"ElementDDTId": 0,
"bottom": 100,
"left": 0,
"right": 100,
"top": 0
},
"message": ""
}
Event ID 398: Mshtml_CTouchHelper_DispatchGestureEventStart
#Event ID 399: Mshtml_CTouchHelper_DispatchGestureEventStop
#Event ID 400: Mshtml_CTouchHelper_DispatchGestureEventStart400
#Event ID 401: Mshtml_CTouchHelper_DispatchGestureEventStop401
#Event ID 402: Mshtml_CTouchHelper_DispatchGestureEventStart402
#Event ID 403: Mshtml_CTouchHelper_DispatchGestureEventStop403
#Event ID 404: Mshtml_MediaElement_PlayTo_ConnectStart
#Fields #
| Name | Description |
|---|---|
MediaElementId | |
MediaElementIdAttribute |
Event ID 405: Mshtml_MediaElement_PlayTo_ConnectStop
#Fields #
| Name | Description |
|---|---|
MediaElementId | |
MediaElementIdAttribute | |
UniqueDeviceName | |
FriendlyDeviceName |
Event ID 406: Mshtml_MediaElement_PlayTo_DisconnectStart
#Fields #
| Name | Description |
|---|---|
MediaElementId | |
MediaElementIdAttribute | |
UniqueDeviceName | |
FriendlyDeviceName |
Event ID 407: Mshtml_MediaElement_PlayTo_DisconnectStop
#Fields #
| Name | Description |
|---|---|
MediaElementId | |
MediaElementIdAttribute |
Event ID 408: Mshtml_Animations_AnimatingStart_V1
#Fields #
| Name | Description |
|---|---|
AnimationClientObject | |
StoryboardObject | |
TreeNode | |
DurationInSeconds | |
DelayInSeconds | |
NumberOfProperties | |
AnimationName | |
DDTObject |
Event ID 410: Mshtml_Animations_TransitioningStart_V1
#Fields #
| Name | Description |
|---|---|
TransitionClientObject | |
StoryboardObject | |
TreeNode | |
DurationInSeconds | |
DelayInSeconds | |
DISPID | |
IsReversal | |
DDTObject |
Event ID 411: Mshtml_Animations_TransitioningStop
#Fields #
| Name | Description |
|---|---|
AnimationClientObject | |
TreeNode | |
DISPID |
Event ID 412: Mshtml_HTMLSpell_NotifyStart
#Event ID 413: Mshtml_HTMLSpell_NotifyStop
#Event ID 414: Mshtml_HTMLSpell_CreateSpellerStart
#Event ID 415: Mshtml_HTMLSpell_CreateSpellerStop
#Event ID 430: Mshtml_SetTimeout_Url
#Fields #
| Name | Description |
|---|---|
WindowObject Pointer | |
IsPrimary UInt32 | |
URL UnicodeString |
Example Event #
{
"system": {
"provider": "Microsoft-IE",
"guid": "{9e3b3947-ca5d-4614-91a2-7b624e0e7244}",
"event_source_name": "",
"event_id": 430,
"version": 0,
"level": 0,
"task": 247,
"opcode": 0,
"keywords": "0x800000",
"time_created": "2026-07-19T04:20:10.485525500+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 5468,
"thread_id": 8344
},
"channel": "Unknown",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"WindowObject": "0x249803B0400",
"IsPrimary": "1",
"URL": "file:///C:/Users/Public/catalog-ie-features.hta"
},
"message": ""
}
Event ID 431: Mshtml_FormsTimer_Set
#Fields #
| Name | Description |
|---|---|
Object Pointer | |
TimerId UInt32 | |
Callback Pointer | |
Timeout UInt32 |
Example Event #
{
"system": {
"provider": "Microsoft-IE",
"guid": "{9e3b3947-ca5d-4614-91a2-7b624e0e7244}",
"event_source_name": "",
"event_id": 431,
"version": 0,
"level": 0,
"task": 248,
"opcode": 0,
"keywords": "0x800000",
"time_created": "2026-07-19T04:12:46.484240700+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 5248,
"thread_id": 3912
},
"channel": "Unknown",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"Object": "0x1DA004C8000",
"TimerId": "206",
"Callback": "0x7FF8B9466780",
"Timeout": "500"
},
"message": ""
}
Event ID 432: Mshtml_FormsTimer_Reset
#Fields #
| Name | Description |
|---|---|
Object Pointer | |
TimerId UInt32 | |
Callback Pointer | |
Timeout UInt32 |
Example Event #
{
"system": {
"provider": "Microsoft-IE",
"guid": "{9e3b3947-ca5d-4614-91a2-7b624e0e7244}",
"event_source_name": "",
"event_id": 432,
"version": 0,
"level": 0,
"task": 249,
"opcode": 0,
"keywords": "0x800000",
"time_created": "2026-07-19T04:20:10.485598400+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 5468,
"thread_id": 8344
},
"channel": "Unknown",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"Object": "0x249803C8000",
"TimerId": "206",
"Callback": "0x7FF8B9466780",
"Timeout": "20"
},
"message": ""
}
Event ID 433: Mshtml_FormsTimer_Kill
#Fields #
| Name | Description |
|---|---|
Object Pointer | |
TimerId UInt32 | |
Callback Pointer | |
Timeout UInt32 |
Example Event #
{
"system": {
"provider": "Microsoft-IE",
"guid": "{9e3b3947-ca5d-4614-91a2-7b624e0e7244}",
"event_source_name": "",
"event_id": 433,
"version": 0,
"level": 0,
"task": 250,
"opcode": 0,
"keywords": "0x800000",
"time_created": "2026-07-19T04:12:46.616674400+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 5248,
"thread_id": 3912
},
"channel": "Unknown",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"Object": "0x1DA0045C130",
"TimerId": "52737",
"Callback": "0x7FF8B9473950",
"Timeout": "10"
},
"message": ""
}
Event ID 434: Mshtml_FormsTimer_OnTimer
#Fields #
| Name | Description |
|---|---|
Object Pointer | |
TimerId UInt32 | |
Callback Pointer | |
Timeout UInt32 |
Example Event #
{
"system": {
"provider": "Microsoft-IE",
"guid": "{9e3b3947-ca5d-4614-91a2-7b624e0e7244}",
"event_source_name": "",
"event_id": 434,
"version": 0,
"level": 0,
"task": 251,
"opcode": 0,
"keywords": "0x800000",
"time_created": "2026-07-19T04:12:46.616612000+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 5248,
"thread_id": 3912
},
"channel": "Unknown",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"Object": "0x1DA0045C130",
"TimerId": "52737",
"Callback": "0x7FF8B9473950",
"Timeout": "10"
},
"message": ""
}
Event ID 437: Mshtml_MediaElement_VisualizationStart
#Fields #
| Name | Description |
|---|---|
MediaElementId | |
AnimationGroupId | |
VisualizationId |
Event ID 438: Mshtml_MediaElement_VisualizationStop
#Fields #
| Name | Description |
|---|---|
MediaElementId | |
AnimationGroupId | |
VisualizationId |
Event ID 439: Mshtml_MediaElement_Buffering
#Fields #
| Name | Description |
|---|---|
MediaElementId | |
StartTimeDurationInSecs | |
EndTimeDurationInSecs | |
ProgressStartLevelInPercentage | |
ProgressEndLevelInPercentage |
Event ID 442: Mshtml_TouchSelection_CaretShown
#Event ID 443: Mshtml_TouchSelection_CaretHidden
#Event ID 444: Mshtml_TouchSelection_CaretPlacementStart
#Event ID 445: Mshtml_TouchSelection_CaretPlacementStop
#Event ID 446: Mshtml_TouchSelection_TouchSelectionManipulation_InitiationStart
#Event ID 447: Mshtml_TouchSelection_TouchSelectionManipulation_InitiationStop
#Event ID 448: Mshtml_TouchSelection_TouchSelectionManipulation_CompletionStart
#Event ID 449: Mshtml_TouchSelection_TouchSelectionManipulation_CompletionStop
#Event ID 450: Mshtml_HTMLSpell_ShowContextMenuStart
#Event ID 451: Mshtml_HTMLSpell_ShowContextMenuStop
#Event ID 452: Mshtml_HTMLSpell_ContextMenuInvokeStart
#Event ID 453: Mshtml_HTMLSpell_ContextMenuInvokeStop
#Event ID 462: Mshtml_IndependentAnimation_Start
#Fields #
| Name | Description |
|---|---|
AnimationID | |
AnimationInstanceObject | |
AnimationPropertyId | |
IsTransition | |
QPCScheduleTime |
Event ID 463: Mshtml_IndependentAnimation_Stop
#Fields #
| Name | Description |
|---|---|
AnimationID | |
AnimationInstanceObject | |
TreeNode | |
PreviousAnimationState |
Event ID 464: Mshtml_IndependentAnimation_Candidacy_Failure_V2
#Fields #
| Name | Description |
|---|---|
CIndependentAnimation | |
ReasonCode | |
Description |
Event ID 465: Mshtml_Composition_Layer_PaintRect
#Fields #
| Name | Description |
|---|---|
DispNode Pointer | |
DispLayer Pointer | |
left Int32 | |
top Int32 | |
right Int32 | |
bottom Int32 | |
ElementDDTId UInt64 |
Example Event #
{
"system": {
"channel": "Unknown",
"computer": "10.2.10.21",
"correlation": {},
"event_id": 465,
"event_record_id": 0,
"event_source_name": "",
"execution": {
"process_id": 10004,
"thread_id": 7236
},
"guid": "",
"keywords": 0,
"level": 4,
"opcode": 0,
"provider": "Microsoft-IE",
"security": {
"user_id": ""
},
"task": 0,
"time_created": "2026-07-21 22:09:33.898Z",
"version": 0
},
"event_data": {
"DispLayer": "0x21C5BAF38F0",
"DispNode": "0x21C46A20800",
"ElementDDTId": 0,
"bottom": 1,
"left": 0,
"right": 1,
"top": 0
},
"message": ""
}
Event ID 468: Mshtml_CActiveScriptHolder_Construct
#Fields #
| Name | Description |
|---|---|
CActiveScriptHolder Pointer | |
CMarkup Pointer |
Example Event #
{
"system": {
"provider": "Microsoft-IE",
"guid": "{9e3b3947-ca5d-4614-91a2-7b624e0e7244}",
"event_source_name": "",
"event_id": 468,
"version": 0,
"level": 0,
"task": 269,
"opcode": 0,
"keywords": "0x1000",
"time_created": "2026-07-19T04:12:46.502134700+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 5248,
"thread_id": 3912
},
"channel": "Unknown",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"CActiveScriptHolder": "0x1DA004A83C0",
"CMarkup": "0x1DA004B8000"
},
"message": ""
}
Event ID 470: Mshtml_CJScript9Holder_TypeSystem_InitStart
#Fields #
| Name | Description |
|---|---|
CActiveScriptHolder | |
CMarkup |
Event ID 471: Mshtml_CJScript9Holder_TypeSystem_InitStop
#Fields #
| Name | Description |
|---|---|
CActiveScriptHolder | |
CMarkup | |
HR |
Event ID 472: Mshtml_CScriptCollection_WebOC_FirstScriptExecutionEventStart
#Fields #
| Name | Description |
|---|---|
CScriptCollection Pointer | |
CMarkup Pointer |
Example Event #
{
"system": {
"provider": "Microsoft-IE",
"guid": "{9e3b3947-ca5d-4614-91a2-7b624e0e7244}",
"event_source_name": "",
"event_id": 472,
"version": 0,
"level": 0,
"task": 272,
"opcode": 1,
"keywords": "0x1000",
"time_created": "2026-07-19T04:12:46.504703700+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 5248,
"thread_id": 3912
},
"channel": "Unknown",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"CScriptCollection": "0x1DA00460500",
"CMarkup": "0x1DA004B8000"
},
"message": ""
}
Event ID 473: Mshtml_CScriptCollection_WebOC_FirstScriptExecutionEventStop
#Fields #
| Name | Description |
|---|---|
CScriptCollection Pointer | |
CMarkup Pointer |
Example Event #
{
"system": {
"provider": "Microsoft-IE",
"guid": "{9e3b3947-ca5d-4614-91a2-7b624e0e7244}",
"event_source_name": "",
"event_id": 473,
"version": 0,
"level": 0,
"task": 272,
"opcode": 2,
"keywords": "0x1000",
"time_created": "2026-07-19T04:12:46.504774700+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 5248,
"thread_id": 3912
},
"channel": "Unknown",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"CScriptCollection": "0x1DA00460500",
"CMarkup": "0x1DA004B8000"
},
"message": ""
}
Event ID 474: Mshtml_CScriptCollection_DevToolbar_FirstScriptExecutionEventStart
#Fields #
| Name | Description |
|---|---|
CScriptCollection | |
CMarkup |
Event ID 475: Mshtml_CScriptCollection_DevToolbar_FirstScriptExecutionEventStop
#Fields #
| Name | Description |
|---|---|
CScriptCollection | |
CMarkup |
Event ID 476: Mshtml_CActiveScriptHolder_WebPlatform_NewScriptEngineEventStart
#Fields #
| Name | Description |
|---|---|
CActiveScriptHolder | |
CMarkup |
Event ID 477: Mshtml_CActiveScriptHolder_WebPlatform_NewScriptEngineEventStop
#Fields #
| Name | Description |
|---|---|
CActiveScriptHolder | |
CMarkup |
Event ID 478: JScript_Parse
#Fields #
| Name | Description |
|---|---|
ScriptContext Pointer | |
FunctionId UInt32 | |
Undefer Boolean |
Example Event #
{
"system": {
"provider": "Microsoft-IE",
"guid": "{9e3b3947-ca5d-4614-91a2-7b624e0e7244}",
"event_source_name": "",
"event_id": 478,
"version": 0,
"level": 0,
"task": 93,
"opcode": 0,
"keywords": "0x400000",
"time_created": "2026-07-19T04:14:16.398733200+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 13720,
"thread_id": 12064
},
"channel": "Unknown",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"ScriptContext": "0x23400813750",
"FunctionId": "1",
"Undefer": "false"
},
"message": ""
}
Event ID 480: Mshtml_CView_HitTest_MessageContextStart
#Fields #
| Name | Description |
|---|---|
View | |
ContextElement | |
Flags | |
MessageId | |
left | |
top | |
right | |
bottom |
Event ID 483: Mshtml_CView_ExecuteInvalidationTasksStop
#Fields #
| Name | Description |
|---|---|
View | |
UniqueSubtrees | |
UpdatedSubtrees |
Event ID 484: Mshtml_DisplayTreeOpenStart
#Fields #
| Name | Description |
|---|---|
CDispNode Pointer |
Example Event #
{
"system": {
"provider": "Microsoft-IE",
"guid": "{9e3b3947-ca5d-4614-91a2-7b624e0e7244}",
"event_source_name": "",
"event_id": 484,
"version": 0,
"level": 0,
"task": 278,
"opcode": 1,
"keywords": "0x800",
"time_created": "2026-07-19T04:12:46.483616300+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 5248,
"thread_id": 3912
},
"channel": "Unknown",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"CDispNode": "0x1DA004B1800"
},
"message": ""
}
Event ID 485: Mshtml_DisplayTreeOpenStop
#Fields #
| Name | Description |
|---|---|
CDispNode Pointer |
Example Event #
{
"system": {
"provider": "Microsoft-IE",
"guid": "{9e3b3947-ca5d-4614-91a2-7b624e0e7244}",
"event_source_name": "",
"event_id": 485,
"version": 0,
"level": 0,
"task": 278,
"opcode": 2,
"keywords": "0x800",
"time_created": "2026-07-19T04:12:46.484085200+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 5248,
"thread_id": 3912
},
"channel": "Unknown",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"CDispNode": "0x1DA004B1800"
},
"message": ""
}
Event ID 486: Mshtml_CDirectManipulationHandler_TouchHandler_Configuration
#Fields #
| Name | Description |
|---|---|
CDoc Pointer | |
CElement Pointer | |
ElementTag UInt32 | |
PrimaryTouchHandler Boolean | |
IndpendentlyComposed Boolean | |
TouchConfiguration UInt32 |
Example Event #
{
"system": {
"channel": "Unknown",
"computer": "10.2.10.21",
"correlation": {},
"event_id": 486,
"event_record_id": 0,
"event_source_name": "",
"execution": {
"process_id": 10004,
"thread_id": 7236
},
"guid": "",
"keywords": 0,
"level": 4,
"opcode": 0,
"provider": "Microsoft-IE",
"security": {
"user_id": ""
},
"task": 0,
"time_created": "2026-07-21 22:09:33.896Z",
"version": 0
},
"event_data": {
"CDoc": "0x21C46C40020",
"CElement": "0x21C46A0E340",
"Element Tag": 93,
"Indpendently Composed": true,
"Primary Touch Handler": true,
"Touch Configuration": 0
},
"message": ""
}
Example keys not documented in the fields table: Element Tag, Indpendently Composed, Primary Touch Handler, Touch Configuration
Event ID 493: Mshtml_Animations_AnimatingStop493_V2
#Fields #
| Name | Description |
|---|---|
AnimationClientObject | |
TreeNode | |
ReasonCode | |
Description |
Event ID 497: Mshtml_Composition_Max_ImplicitLayers_Exceeded
#Event ID 499: Mshtml_Composition_Destination_PreRender
#Fields #
| Name | Description |
|---|---|
DispNode Pointer | |
DispLayer Pointer | |
SBLayer Pointer | |
LayerWidth Int32 | |
LayerHeight Int32 | |
GlobalLayerLeft Int32 | |
GlobalLayerTop Int32 | |
GlobalLayerRight Int32 | |
GlobalLayerBottom Int32 | |
DestinationType Int32 | |
Flags UInt32 | |
TransformM11 Float | |
TransformM12 Float | |
TransformM21 Float | |
TransformM22 Float | |
TransformDx Float | |
TransformDy Float |
Example Event #
{
"system": {
"channel": "Unknown",
"computer": "10.2.10.21",
"correlation": {},
"event_id": 499,
"event_record_id": 0,
"event_source_name": "",
"execution": {
"process_id": 10004,
"thread_id": 7236
},
"guid": "",
"keywords": 0,
"level": 4,
"opcode": 0,
"provider": "Microsoft-IE",
"security": {
"user_id": ""
},
"task": 0,
"time_created": "2026-07-21 22:09:33.898Z",
"version": 0
},
"event_data": {
"DestinationType": 0,
"DispLayer": "0x21C5BAF34B0",
"DispNode": "0x21C46A20800",
"Flags": 13,
"GlobalLayerBottom": 1,
"GlobalLayerLeft": 0,
"GlobalLayerRight": 1,
"GlobalLayerTop": 0,
"LayerHeight": 1,
"LayerWidth": 1,
"SBLayer": "0x21C5BAF38F0",
"TransformDx": 0.0,
"TransformDy": 0.0,
"TransformM11": 1.0,
"TransformM12": 0.0,
"TransformM21": 0.0,
"TransformM22": 1.0
},
"message": ""
}
Event ID 501: Mshtml_Composition_Create_SBLayer_Surface
#Fields #
| Name | Description |
|---|---|
SBLayer | |
DCompSurface | |
Width | |
Height | |
AlphaMode | |
Flags |
Event ID 504: Mshtml_Composition_Destination_Invalid_Region
#Fields #
| Name | Description |
|---|---|
Object Pointer | |
RectsLength UInt16 | |
Rects Binary |
Example Event #
{
"system": {
"channel": "Unknown",
"computer": "10.2.10.21",
"correlation": {},
"event_id": 504,
"event_record_id": 0,
"event_source_name": "",
"execution": {
"process_id": 10004,
"thread_id": 7236
},
"guid": "",
"keywords": 0,
"level": 4,
"opcode": 0,
"provider": "Microsoft-IE",
"security": {
"user_id": ""
},
"task": 0,
"time_created": "2026-07-21 22:09:33.898Z",
"version": 0
},
"event_data": {
"Object": "0x21C5BAF38F0",
"Rects": "00000000000000000100000001000000",
"RectsLength": 16
},
"message": ""
}
Event ID 506: Mshtml_Composition_Scroller_PVR
#Fields #
| Name | Description |
|---|---|
Scroller Pointer | |
RectType Int32 | |
left Int32 | |
top Int32 | |
right Int32 | |
bottom Int32 |
Example Event #
{
"system": {
"channel": "Unknown",
"computer": "10.2.10.21",
"correlation": {},
"event_id": 506,
"event_record_id": 0,
"event_source_name": "",
"execution": {
"process_id": 10004,
"thread_id": 7236
},
"guid": "",
"keywords": 0,
"level": 4,
"opcode": 0,
"provider": "Microsoft-IE",
"security": {
"user_id": ""
},
"task": 0,
"time_created": "2026-07-21 22:09:33.898Z",
"version": 0
},
"event_data": {
"RectType": 0,
"Scroller": "0x21C47BF5450",
"bottom": 1,
"left": 0,
"right": 1,
"top": 0
},
"message": ""
}
Event ID 507: FlipAhead_UpdateTargetStart
#Event ID 508: FlipAhead_UpdateTargetStop
#Fields #
| Name | Description |
|---|---|
Success | |
MatchType | |
Uri | |
TextContent | |
FileVersion | |
RuleID |
Event ID 509: FlipAhead_UpdateTarget
#Event ID 510: FlipAhead_InvokeTarget
#Fields #
| Name | Description |
|---|---|
Success | |
MatchType | |
Uri | |
TextContent | |
FileVersion | |
RuleID |
Event ID 511: Mshtml_Animations_HighQualityScale_Limited
#Event ID 512: Mshtml_CView_ExecuteInvalidationTasks_Stats
#Fields #
| Name | Description |
|---|---|
CView | |
ElementsInvalidated | |
InvalidationFlags |
Event ID 513: Mshtml_XML_Http_Request_Open_Sync_On_UI_Thread
#Fields #
| Name | Description |
|---|---|
URL UnicodeString |
Example Event #
{
"system": {
"provider": "Microsoft-IE",
"guid": "{9e3b3947-ca5d-4614-91a2-7b624e0e7244}",
"event_source_name": "",
"event_id": 513,
"version": 0,
"level": 0,
"task": 310,
"opcode": 0,
"keywords": "0x1000",
"time_created": "2026-07-19T04:14:16.430973700+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 13720,
"thread_id": 12064
},
"channel": "Unknown",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"URL": "http://127.0.0.1:18101/no"
},
"message": ""
}
Event ID 514: Mshtml_Composition_Layer_Candidacy_Failure
#Fields #
| Name | Description |
|---|---|
DispNode Pointer | |
NodeDescription UnicodeString | |
ReasonCode Int32 | |
ReasonDescription UnicodeString | |
DispNode2 Pointer | |
NodeDescription2 UnicodeString | |
CandidacyCode Int32 |
Example Event #
{
"system": {
"channel": "Unknown",
"computer": "10.2.10.21",
"correlation": {},
"event_id": 514,
"event_record_id": 0,
"event_source_name": "",
"execution": {
"process_id": 10004,
"thread_id": 7236
},
"guid": "",
"keywords": 0,
"level": 4,
"opcode": 0,
"provider": "Microsoft-IE",
"security": {
"user_id": ""
},
"task": 0,
"time_created": "2026-07-21 22:09:33.895Z",
"version": 0
},
"event_data": {
"CandidacyCode": 0,
"DispNode": "0x21C5B563C80",
"DispNode2": "0x0",
"NodeDescription": "<expanded-view-content#DIV.expanded-view-content js-scroll-root tooltip-scroll-area vertical-scrollable default-scrollbar-disabled paging-vertical> Scroller(LayoutBuilder)",
"NodeDescription2": "(null)",
"ReasonCode": 2,
"ReasonDescription": "Not scrollable"
},
"message": ""
}
Event ID 515: Mshtml_Composition_Layer_Dependent_Subtree
#Fields #
| Name | Description |
|---|---|
DispNode | |
NodeDescription | |
HasDependentCompositionEffect | |
HasRoundedBorders |
Event ID 516: Mshtml_Composition_Layer_Reverted
#Fields #
| Name | Description |
|---|---|
DispNode | |
NodeDescription | |
ReasonCode |
Event ID 521: Mshtml_Animations_TimerStart
#Event ID 522: Mshtml_Animations_TimerStop
#Event ID 523: Mshtml_Animations_InstanceStart
#Fields #
| Name | Description |
|---|---|
AnimationInstanceObject | |
AnimationStoryboardObject | |
DISPID | |
IsTransition |
Event ID 525: Mshtml_Canvas_Operation
#Fields #
| Name | Description |
|---|---|
CHTMLCanvasElement | |
Operation | |
canvasWidth | |
canvasHeight | |
DestLeft | |
DestTop | |
ScaledSizeWidth | |
ScaledSizeHeight |
Event ID 526: Mshtml_EventDebug_DOM_Event_DispatchStart_V1
#Fields #
| Name | Description |
|---|---|
EventType | |
EventParam | |
EventTarget | |
EventContextId |
Event ID 527: Mshtml_EventDebug_DOM_Event_DispatchStop_V1
#Fields #
| Name | Description |
|---|---|
EventType | |
EventParam | |
EventTarget | |
PropagationStatus | |
EventContextId |
Event ID 528: Mshtml_EventDebug_DOM_Event_Invoke_CallbackStart_V1
#Fields #
| Name | Description |
|---|---|
EventType | |
EventParam | |
EventTarget | |
EventPhase | |
PropagationStatus | |
ListenerUsesCapture | |
FunctionId | |
Object | |
ScriptContextId |
Event ID 529: Mshtml_EventDebug_DOM_Event_Invoke_CallbackStop_V1
#Fields #
| Name | Description |
|---|---|
EventType | |
EventParam | |
EventTarget | |
EventPhase | |
PropagationStatus | |
ListenerUsesCapture | |
FunctionId | |
Object | |
ScriptContextId |
Event ID 530: Mshtml_EventDebug_Timer_Invoke_CallbackStart_V2
#Fields #
| Name | Description |
|---|---|
TimerType | |
CallbackCookie | |
FunctionId | |
TimeoutValue | |
ScriptContextId | |
EventContextId |
Event ID 531: Mshtml_EventDebug_Timer_Invoke_CallbackStop_V2
#Fields #
| Name | Description |
|---|---|
TimerType | |
CallbackCookie | |
FunctionId | |
TimeoutValue | |
ScriptContextId | |
EventContextId |
Event ID 532: Mshtml_DynamicDependencyTracker
#Fields #
| Name | Description |
|---|---|
ACount UInt16 | |
objectInstance UInt64 | |
property UInt64 | |
StringValue UnicodeString |
Example Event #
{
"system": {
"provider": "Microsoft-IE",
"guid": "{9e3b3947-ca5d-4614-91a2-7b624e0e7244}",
"event_source_name": "",
"event_id": 532,
"version": 0,
"level": 0,
"task": 321,
"opcode": 0,
"keywords": "0x4000",
"time_created": "2026-07-19T04:12:46.456533600+00:00",
"event_record_id": 0,
"correlation": {
"ActivityID": "BF440000-0BF1-0001-C0FE-53BFF10BDD01"
},
"execution": {
"process_id": 5248,
"thread_id": 3912
},
"channel": "Unknown",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"ACount": "65521",
"objectInstance": "2035819151584",
"property": "8386097230838235136",
"StringValue": "root"
},
"message": ""
}
Event ID 533: Mshtml_DynamicDependencyTrackerStart
#Fields #
| Name | Description |
|---|---|
ACount UInt16 | |
A Binary |
Example Event #
{
"system": {
"provider": "Microsoft-IE",
"guid": "{9e3b3947-ca5d-4614-91a2-7b624e0e7244}",
"event_source_name": "",
"event_id": 533,
"version": 0,
"level": 0,
"task": 321,
"opcode": 1,
"keywords": "0x4000",
"time_created": "2026-07-19T04:12:46.483526300+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 5248,
"thread_id": 3912
},
"channel": "Unknown",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"ACount": "24",
"A": "0x0000006B73615421746E656D75636F4400000000060304C0"
},
"message": ""
}
Event ID 534: Mshtml_DynamicDependencyTrackerStop
#Fields #
| Name | Description |
|---|---|
ACount UInt16 | |
A Binary |
Example Event #
{
"system": {
"provider": "Microsoft-IE",
"guid": "{9e3b3947-ca5d-4614-91a2-7b624e0e7244}",
"event_source_name": "",
"event_id": 534,
"version": 0,
"level": 0,
"task": 321,
"opcode": 2,
"keywords": "0x4000",
"time_created": "2026-07-19T04:12:46.483836300+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 5248,
"thread_id": 3912
},
"channel": "Unknown",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"ACount": "24",
"A": "0x0000006B73615421746E656D75636F4400000000040304C0"
},
"message": ""
}
Event ID 535: Mshtml_DynamicDependencyTracker535
#Fields #
| Name | Description |
|---|---|
ACount UInt16 | |
A Binary |
Example Event #
{
"system": {
"provider": "Microsoft-IE",
"guid": "{9e3b3947-ca5d-4614-91a2-7b624e0e7244}",
"event_source_name": "",
"event_id": 535,
"version": 0,
"level": 0,
"task": 321,
"opcode": 0,
"keywords": "0x4000",
"time_created": "2026-07-19T04:12:46.478820400+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 5248,
"thread_id": 11188
},
"channel": "Unknown",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"ACount": "32",
"A": "0x747365757165522100000000000303C0746E656D75636F4400000000030904C0"
},
"message": ""
}
Event ID 536: Mshtml_DMTouchTarget_SetContentRect
#Fields #
| Name | Description |
|---|---|
left | |
top | |
right | |
bottom | |
TouchTarget | |
Scenario |
Event ID 549: Mshtml_Composition_IR_Enabled
#Event ID 550: Mshtml_Composition_IR_Disabled
#Fields #
| Name | Description |
|---|---|
ContentTypes UInt64 |
Example Event #
{
"system": {
"provider": "Microsoft-IE",
"guid": "{9e3b3947-ca5d-4614-91a2-7b624e0e7244}",
"event_source_name": "",
"event_id": 550,
"version": 0,
"level": 0,
"task": 328,
"opcode": 0,
"keywords": "0x10000200",
"time_created": "2026-07-19T04:12:46.617136100+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 5248,
"thread_id": 3912
},
"channel": "Unknown",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"ContentTypes": "4611686018427387904"
},
"message": ""
}
Event ID 554: Mshtml_Scheduler_API
#Event ID 555: Mshtml_RenderTask_Queued
#Fields #
| Name | Description |
|---|---|
RenderTask Pointer | |
QueueDepth UInt32 | |
OnUIThread Boolean | |
Async Boolean | |
Description UnicodeString |
Example Event #
{
"system": {
"provider": "Microsoft-IE",
"guid": "{9e3b3947-ca5d-4614-91a2-7b624e0e7244}",
"event_source_name": "",
"event_id": 555,
"version": 0,
"level": 0,
"task": 331,
"opcode": 0,
"keywords": "0x10000200",
"time_created": "2026-07-19T04:12:46.617164900+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 5248,
"thread_id": 3912
},
"channel": "Unknown",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"RenderTask": "0x1DA004945A0",
"QueueDepth": "0",
"OnUIThread": "false",
"Async": "false",
"Description": "ApplyPSP"
},
"message": ""
}
Event ID 556: Mshtml_RenderTask_ProcessingStart
#Fields #
| Name | Description |
|---|---|
RenderTask Pointer | |
Skipped Boolean |
Example Event #
{
"system": {
"provider": "Microsoft-IE",
"guid": "{9e3b3947-ca5d-4614-91a2-7b624e0e7244}",
"event_source_name": "",
"event_id": 556,
"version": 0,
"level": 0,
"task": 332,
"opcode": 1,
"keywords": "0x10000200",
"time_created": "2026-07-19T04:12:46.617196000+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 5248,
"thread_id": 3912
},
"channel": "Unknown",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"RenderTask": "0x1DA004945A0",
"Skipped": "false"
},
"message": ""
}
Event ID 557: Mshtml_RenderTask_ProcessingStop
#Fields #
| Name | Description |
|---|---|
RenderTask Pointer | |
Skipped Boolean |
Example Event #
{
"system": {
"provider": "Microsoft-IE",
"guid": "{9e3b3947-ca5d-4614-91a2-7b624e0e7244}",
"event_source_name": "",
"event_id": 557,
"version": 0,
"level": 0,
"task": 332,
"opcode": 2,
"keywords": "0x10000200",
"time_created": "2026-07-19T04:12:46.617243300+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 5248,
"thread_id": 3912
},
"channel": "Unknown",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"RenderTask": "0x1DA004945A0",
"Skipped": "false"
},
"message": ""
}
Event ID 558: Mshtml_RenderTask_RenderThreadStateUpdate
#Fields #
| Name | Description |
|---|---|
RenderThread | |
State | |
ExtraInfo |
Event ID 559: Mshtml_FormatDetectionStart
#Example Event #
{
"system": {
"channel": "Unknown",
"computer": "10.2.10.21",
"correlation": {},
"event_id": 559,
"event_record_id": 0,
"event_source_name": "",
"execution": {
"process_id": 10004,
"thread_id": 7236
},
"guid": "",
"keywords": 0,
"level": 4,
"opcode": 1,
"provider": "Microsoft-IE",
"security": {
"user_id": ""
},
"task": 0,
"time_created": "2026-07-21 22:09:33.912Z",
"version": 0
},
"event_data": {},
"message": ""
}
Event ID 560: Mshtml_FormatDetectionStop
#Example Event #
{
"system": {
"channel": "Unknown",
"computer": "10.2.10.21",
"correlation": {},
"event_id": 560,
"event_record_id": 0,
"event_source_name": "",
"execution": {
"process_id": 10004,
"thread_id": 7236
},
"guid": "",
"keywords": 0,
"level": 4,
"opcode": 2,
"provider": "Microsoft-IE",
"security": {
"user_id": ""
},
"task": 0,
"time_created": "2026-07-21 22:09:34.038Z",
"version": 0
},
"event_data": {},
"message": ""
}
Event ID 561: Mshtml_FormatDetection_LanguageChange
#Event ID 562: Mshtml_FormatDetection_EntityFound
#Fields #
| Name | Description |
|---|---|
EntityType | |
StartIndex | |
EndIndex |
Event ID 563: Mshtml_FormatDetection_TextExtractionStart
#Example Event #
{
"system": {
"channel": "Unknown",
"computer": "10.2.10.21",
"correlation": {},
"event_id": 563,
"event_record_id": 0,
"event_source_name": "",
"execution": {
"process_id": 10004,
"thread_id": 7236
},
"guid": "",
"keywords": 0,
"level": 4,
"opcode": 1,
"provider": "Microsoft-IE",
"security": {
"user_id": ""
},
"task": 0,
"time_created": "2026-07-21 22:09:33.912Z",
"version": 0
},
"event_data": {},
"message": ""
}
Event ID 564: Mshtml_FormatDetection_TextExtractionStop
#Example Event #
{
"system": {
"channel": "Unknown",
"computer": "10.2.10.21",
"correlation": {},
"event_id": 564,
"event_record_id": 0,
"event_source_name": "",
"execution": {
"process_id": 10004,
"thread_id": 7236
},
"guid": "",
"keywords": 0,
"level": 4,
"opcode": 2,
"provider": "Microsoft-IE",
"security": {
"user_id": ""
},
"task": 0,
"time_created": "2026-07-21 22:09:33.912Z",
"version": 0
},
"event_data": {},
"message": ""
}
Event ID 565: Mshtml_FormatDetection_EntityExtractionStart
#Example Event #
{
"system": {
"channel": "Unknown",
"computer": "10.2.10.21",
"correlation": {},
"event_id": 565,
"event_record_id": 0,
"event_source_name": "",
"execution": {
"process_id": 10004,
"thread_id": 3124
},
"guid": "",
"keywords": 0,
"level": 4,
"opcode": 1,
"provider": "Microsoft-IE",
"security": {
"user_id": ""
},
"task": 0,
"time_created": "2026-07-21 22:09:34.038Z",
"version": 0
},
"event_data": {},
"message": ""
}
Event ID 566: Mshtml_FormatDetection_EntityExtractionStop
#Example Event #
{
"system": {
"channel": "Unknown",
"computer": "10.2.10.21",
"correlation": {},
"event_id": 566,
"event_record_id": 0,
"event_source_name": "",
"execution": {
"process_id": 10004,
"thread_id": 3124
},
"guid": "",
"keywords": 0,
"level": 4,
"opcode": 2,
"provider": "Microsoft-IE",
"security": {
"user_id": ""
},
"task": 0,
"time_created": "2026-07-21 22:09:34.038Z",
"version": 0
},
"event_data": {},
"message": ""
}
Event ID 567: Mshtml_FormatDetection_EntityHighlightingStart
#Example Event #
{
"system": {
"channel": "Unknown",
"computer": "10.2.10.21",
"correlation": {},
"event_id": 567,
"event_record_id": 0,
"event_source_name": "",
"execution": {
"process_id": 10004,
"thread_id": 7236
},
"guid": "",
"keywords": 0,
"level": 4,
"opcode": 1,
"provider": "Microsoft-IE",
"security": {
"user_id": ""
},
"task": 0,
"time_created": "2026-07-21 22:09:34.038Z",
"version": 0
},
"event_data": {},
"message": ""
}
Event ID 568: Mshtml_FormatDetection_EntityHighlightingStop
#Example Event #
{
"system": {
"channel": "Unknown",
"computer": "10.2.10.21",
"correlation": {},
"event_id": 568,
"event_record_id": 0,
"event_source_name": "",
"execution": {
"process_id": 10004,
"thread_id": 7236
},
"guid": "",
"keywords": 0,
"level": 4,
"opcode": 2,
"provider": "Microsoft-IE",
"security": {
"user_id": ""
},
"task": 0,
"time_created": "2026-07-21 22:09:34.038Z",
"version": 0
},
"event_data": {},
"message": ""
}
Event ID 575: Mshtml_EventDebug_XmlHttpRequest_Open
#Fields #
| Name | Description |
|---|---|
XHR Pointer | |
Method UnicodeString | |
Url UnicodeString |
Example Event #
{
"system": {
"provider": "Microsoft-IE",
"guid": "{9e3b3947-ca5d-4614-91a2-7b624e0e7244}",
"event_source_name": "",
"event_id": 575,
"version": 0,
"level": 0,
"task": 346,
"opcode": 0,
"keywords": "0x10",
"time_created": "2026-07-19T04:14:16.408888500+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 13720,
"thread_id": 12064
},
"channel": "Unknown",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"XHR": "0x23400498550",
"Method": "GET",
"Url": "http://127.0.0.1:18101/no"
},
"message": ""
}
Event ID 577: Mshtml_ElementRundownStart
#Event ID 578: Mshtml_ElementRundownStop
#Event ID 579: Mshtml_EventDebug_MediaQuery_Invoke_CallbackStart_V1
#Fields #
| Name | Description |
|---|---|
MediaQuery | |
FunctionId | |
ScriptContextId | |
EventContextId |
Event ID 580: Mshtml_EventDebug_MediaQuery_Invoke_CallbackStop_V1
#Fields #
| Name | Description |
|---|---|
MediaQuery | |
FunctionId | |
ScriptContextId | |
EventContextId |
Event ID 595: Mshtml_View_LinkHighlightShowStart
#Event ID 596: Mshtml_View_LinkHighlightShowStop
#Event ID 597: Mshtml_View_LinkHighlightHideStart
#Event ID 598: Mshtml_View_LinkHighlightHideStop
#Event ID 599: Mshtml_View_LinkHighlightStartFromNormalEventStart
#Event ID 600: Mshtml_View_LinkHighlightStartFromNormalEventStop
#Event ID 601: Mshtml_View_LinkHighlightStartFromQueryContinueStart
#Event ID 602: Mshtml_View_LinkHighlightStartFromQueryContinueStop
#Event ID 603: Mshtml_View_LinkHighlightTimerPaintStop
#Event ID 604: Mshtml_View_LinkHighlightTimerPaintStop604
#Event ID 605: Mshtml_View_LinkHighlightPointerUpdateCancelStop
#Event ID 606: Mshtml_View_LinkHighlightPointerUpdateCancelStop606
#Event ID 607: Mshtml_Phone_DoubleTapStart
#Event ID 608: Mshtml_Phone_DoubleTapStop
#Event ID 609: Mshtml_CDoc_Navigation_V1
#Fields #
| Name | Description |
|---|---|
CDoc Pointer | |
CMarkup Pointer | |
URL UnicodeString | |
EventContextId UInt64 | |
CDoc* | |
CMarkup* |
Example Event #
{
"system": {
"provider": "Microsoft-IE",
"guid": "{9e3b3947-ca5d-4614-91a2-7b624e0e7244}",
"event_source_name": "",
"event_id": 609,
"version": 1,
"level": 0,
"task": 364,
"opcode": 0,
"keywords": "0x1100",
"time_created": "2026-07-19T04:12:46.478549000+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 5248,
"thread_id": 3912
},
"channel": "Unknown",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"CDoc*": "0x1DA00478000",
"CMarkup*": "0x1DA004B8000",
"URL": "file:///C:/Users/Public/catalog-ie.hta",
"EventContextId": "2035819446272"
},
"message": ""
}
Event ID 616: Mshtml_RenderTask_ApplyPSPStart
#Fields #
| Name | Description |
|---|---|
RenderTask Pointer |
Example Event #
{
"system": {
"provider": "Microsoft-IE",
"guid": "{9e3b3947-ca5d-4614-91a2-7b624e0e7244}",
"event_source_name": "",
"event_id": 616,
"version": 0,
"level": 0,
"task": 367,
"opcode": 1,
"keywords": "0x10000200",
"time_created": "2026-07-19T04:12:46.617216600+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 5248,
"thread_id": 3912
},
"channel": "Unknown",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"RenderTask": "0x1DA004945A0"
},
"message": ""
}
Event ID 617: Mshtml_RenderTask_ApplyPSPStop
#Fields #
| Name | Description |
|---|---|
RenderTask Pointer |
Example Event #
{
"system": {
"provider": "Microsoft-IE",
"guid": "{9e3b3947-ca5d-4614-91a2-7b624e0e7244}",
"event_source_name": "",
"event_id": 617,
"version": 0,
"level": 0,
"task": 367,
"opcode": 2,
"keywords": "0x10000200",
"time_created": "2026-07-19T04:12:46.617230600+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 5248,
"thread_id": 3912
},
"channel": "Unknown",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"RenderTask": "0x1DA004945A0"
},
"message": ""
}
Event ID 618: Mshtml_CDoc_PrepareForSetVisibleStart
#Fields #
| Name | Description |
|---|---|
IsDocVisible | |
NotifyFrame | |
HR |
Event ID 637: Mshtml_CGarbageTracker_CollectGarbage
#Fields #
| Name | Description |
|---|---|
CGarbageTracker | |
ResourceType | |
Reason | |
RequestedGCType | |
GCType |
Event ID 640: Mshtml_CDoc_HostPaintUpdateNotificationStart
#Fields #
| Name | Description |
|---|---|
CDoc | |
PrimaryCMarkup | |
SourceContext |
Event ID 640: Mshtml_CDoc_HostPaintUpdateNotificationStart
#Fields #
| Name | Description |
|---|---|
CDoc Pointer | |
PrimaryCMarkup Pointer | |
SourceContext UInt32 | |
CDoc* | |
Primary CMarkup* | |
Source Context |
Example Event #
{
"system": {
"provider": "Microsoft-IE",
"guid": "{9e3b3947-ca5d-4614-91a2-7b624e0e7244}",
"event_source_name": "",
"event_id": 640,
"version": 0,
"level": 0,
"task": 380,
"opcode": 1,
"keywords": "0x1000",
"time_created": "2026-07-19T04:12:46.606374500+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 5248,
"thread_id": 3912
},
"channel": "Unknown",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"CDoc*": "0x1DA00478000",
"Primary CMarkup*": "0x1DA004B8000",
"Source Context": "10"
},
"message": ""
}
Event ID 641: Mshtml_CDoc_HostPaintUpdateNotificationStop
#Fields #
| Name | Description |
|---|---|
CDoc | |
PrimaryCMarkup | |
SourceContext |
Event ID 641: Mshtml_CDoc_HostPaintUpdateNotificationStop
#Fields #
| Name | Description |
|---|---|
CDoc Pointer | |
PrimaryCMarkup Pointer | |
SourceContext UInt32 | |
CDoc* | |
Primary CMarkup* | |
Source Context |
Example Event #
{
"system": {
"provider": "Microsoft-IE",
"guid": "{9e3b3947-ca5d-4614-91a2-7b624e0e7244}",
"event_source_name": "",
"event_id": 641,
"version": 0,
"level": 0,
"task": 380,
"opcode": 2,
"keywords": "0x1000",
"time_created": "2026-07-19T04:12:46.617464600+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 5248,
"thread_id": 3912
},
"channel": "Unknown",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"CDoc*": "0x1DA00478000",
"Primary CMarkup*": "0x1DA004B8000",
"Source Context": "10"
},
"message": ""
}
Event ID 642: Mshtml_CDoc_HostPaintUpdateNotification_IgnoredRequest
#Fields #
| Name | Description |
|---|---|
CDoc | |
PrimaryCMarkup | |
SourceContext |
Event ID 642: Mshtml_CDoc_HostPaintUpdateNotification_IgnoredRequest
#Fields #
| Name | Description |
|---|---|
CDoc Pointer | |
PrimaryCMarkup Pointer | |
SourceContext UInt32 | |
CDoc* | |
Primary CMarkup* | |
Source Context |
Example Event #
{
"system": {
"provider": "Microsoft-IE",
"guid": "{9e3b3947-ca5d-4614-91a2-7b624e0e7244}",
"event_source_name": "",
"event_id": 642,
"version": 0,
"level": 0,
"task": 381,
"opcode": 0,
"keywords": "0x1000",
"time_created": "2026-07-19T04:12:46.478563100+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 5248,
"thread_id": 3912
},
"channel": "Unknown",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"CDoc*": "0x1DA00478000",
"Primary CMarkup*": "0x1DA004B8000",
"Source Context": "2"
},
"message": ""
}
Event ID 643: Mshtml_EventDebug_MutationObserverCallbackStart_V1
#Fields #
| Name | Description |
|---|---|
FunctionId | |
ScriptContextId | |
EventContextId |
Event ID 644: Mshtml_EventDebug_MutationObserverCallbackStop_V1
#Fields #
| Name | Description |
|---|---|
EventContextId |
Event ID 645: Mshtml_EventDebug_MutationObserverCallback_V1
#Fields #
| Name | Description |
|---|---|
TargetElementDdtId | |
Type | |
ChangedAttributeName | |
AddedChildCount | |
RemovedChildCount | |
EventContextId |
Event ID 647: Mshtml_Generic_Diagnosis_Win_Error
#Fields #
| Name | Description |
|---|---|
WinErrorDescription | |
ThisPtr | |
WinError |
Event ID 648: Mshtml_Generic_Diagnosis_Trace_Hr_Error
#Fields #
| Name | Description |
|---|---|
ErrorDescription AnsiString | |
ThisPtr Pointer | |
HR Int32 |
Event ID 649: Mshtml_Generic_Diagnosis
#Fields #
| Name | Description |
|---|---|
InfoDescription AnsiString | |
ThisPtr Pointer |
Event ID 650: Mshtml_Generic_Diagnosis_Info1
#Fields #
| Name | Description |
|---|---|
InfoDescription AnsiString | |
StringParam UnicodeString | |
ThisPtr Pointer |
Event ID 651: Mshtml_Generic_Diagnosis_Warn0
#Fields #
| Name | Description |
|---|---|
WarningDescription AnsiString | |
StringParam UnicodeString | |
ThisPtr Pointer |
Event ID 652: Mshtml_Generic_Diagnosis_Warn1
#Fields #
| Name | Description |
|---|---|
WarningDescription AnsiString | |
DwordParam UInt32 | |
ThisPtr Pointer |
Event ID 653: Mshtml_Generic_DiagnosisStart
#Fields #
| Name | Description |
|---|---|
InfoDescription AnsiString | |
ThisPtr Pointer |
Event ID 654: Mshtml_Generic_DiagnosisStop
#Fields #
| Name | Description |
|---|---|
ErrorDescription AnsiString | |
ThisPtr Pointer | |
HR Int32 |
Event ID 655: Mshtml_Video_SizingStart
#Fields #
| Name | Description |
|---|---|
Width UInt32 | |
Height UInt32 | |
PresenterWidth UInt32 | |
PresenterHeight UInt32 | |
ScaleFactor Float | |
DisableDComp UInt32 | |
DCompState UInt32 | |
ThisPtr Pointer |
Event ID 656: Mshtml_Video_SizingStop
#Fields #
| Name | Description |
|---|---|
Width UInt32 | |
Height UInt32 | |
PresenterWidth UInt32 | |
PresenterHeight UInt32 | |
ScaleFactor Float | |
DisableDComp UInt32 | |
DCompState UInt32 | |
ThisPtr Pointer |
Event ID 657: Mshtml_CDoc_UpdateUnitInfo
#Fields #
| Name | Description |
|---|---|
CDoc Pointer | |
BaseOpticalZoom Float | |
BaseOpticalZoomDefault Float | |
HostDpiAware Boolean | |
StaticViewportSizeApplied Boolean | |
AtViewportHasDeviceWidthOrHeight Boolean |
Event ID 657: Mshtml_CDoc_UpdateUnitInfo
#Fields #
| Name | Description |
|---|---|
CDoc Pointer | |
BaseOpticalZoom Float | |
BaseOpticalZoomDefault Float | |
HostDpiAware Boolean | |
StaticViewportSizeApplied Boolean | |
AtViewportHasDeviceWidthOrHeight Boolean | |
CDoc* |
Example Event #
{
"system": {
"provider": "Microsoft-IE",
"guid": "{9e3b3947-ca5d-4614-91a2-7b624e0e7244}",
"event_source_name": "",
"event_id": 657,
"version": 0,
"level": 0,
"task": 385,
"opcode": 0,
"keywords": "0x1000",
"time_created": "2026-07-19T04:12:46.461065200+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 5248,
"thread_id": 3912
},
"channel": "Unknown",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"CDoc*": "0x1DA00478000",
"BaseOpticalZoom": "1.000000",
"BaseOpticalZoomDefault": "1.000000",
"HostDpiAware": "false",
"StaticViewportSizeApplied": "false",
"AtViewportHasDeviceWidthOrHeight": "false"
},
"message": ""
}
Event ID 658: Mshtml_CView_UpdateRootScrollerSizeAndZoom
#Fields #
| Name | Description |
|---|---|
CView Pointer | |
VisualViewportWidth Int32 | |
VisualViewportHeight Int32 | |
LayoutViewportWidth Int32 | |
LayoutViewportHeight Int32 | |
BaseOpticalZoom Float | |
IsClamping Boolean | |
HasAtViewportRule Boolean | |
HasDeviceWidthOrHeight Boolean | |
ViewportControllerEnabled Boolean | |
HasHorizontalScrollbar Boolean | |
HasVerticalScrollbar Boolean | |
UpdateUnitInfoZoomOnly Boolean |
Event ID 658: Mshtml_CView_UpdateRootScrollerSizeAndZoom
#Fields #
| Name | Description |
|---|---|
CView Pointer | |
VisualViewportWidth Int32 | |
VisualViewportHeight Int32 | |
LayoutViewportWidth Int32 | |
LayoutViewportHeight Int32 | |
BaseOpticalZoom Float | |
IsClamping Boolean | |
HasAtViewportRule Boolean | |
HasDeviceWidthOrHeight Boolean | |
ViewportControllerEnabled Boolean | |
HasHorizontalScrollbar Boolean | |
HasVerticalScrollbar Boolean | |
UpdateUnitInfoZoomOnly Boolean | |
CView* |
Example Event #
{
"system": {
"provider": "Microsoft-IE",
"guid": "{9e3b3947-ca5d-4614-91a2-7b624e0e7244}",
"event_source_name": "",
"event_id": 658,
"version": 0,
"level": 0,
"task": 386,
"opcode": 0,
"keywords": "0x1000",
"time_created": "2026-07-19T04:12:46.554199000+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 5248,
"thread_id": 3912
},
"channel": "Unknown",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"CView*": "0x1DA004788D8",
"VisualViewportWidth": "75200",
"VisualViewportHeight": "51600",
"LayoutViewportWidth": "75200",
"LayoutViewportHeight": "51600",
"BaseOpticalZoom": "1.000000",
"IsClamping": "false",
"HasAtViewportRule": "false",
"HasDeviceWidthOrHeight": "false",
"ViewportControllerEnabled": "false",
"HasHorizontalScrollbar": "false",
"HasVerticalScrollbar": "false",
"UpdateUnitInfoZoomOnly": "false"
},
"message": ""
}
Event ID 659: Mshtml_CView_SetFixedLayoutWidth
#Fields #
| Name | Description |
|---|---|
CView Pointer | |
FixedLayoutWidthOld Float | |
FixedLayoutWidthNew Float |
Event ID 659: Mshtml_CView_SetFixedLayoutWidth
#Fields #
| Name | Description |
|---|---|
CView Pointer | |
FixedLayoutWidthOld Float | |
FixedLayoutWidthNew Float | |
CView* |
Example Event #
{
"system": {
"provider": "Microsoft-IE",
"guid": "{9e3b3947-ca5d-4614-91a2-7b624e0e7244}",
"event_source_name": "",
"event_id": 659,
"version": 0,
"level": 0,
"task": 387,
"opcode": 0,
"keywords": "0x1000",
"time_created": "2026-07-19T04:12:46.483803900+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 5248,
"thread_id": 3912
},
"channel": "Unknown",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"CView*": "0x1DA004788D8",
"FixedLayoutWidthOld": "0.000000",
"FixedLayoutWidthNew": "752.000000"
},
"message": ""
}
Event ID 660: Mshtml_CView_SetViewportMode_FixedLayoutWidth
#Fields #
| Name | Description |
|---|---|
CView Pointer | |
IsEnabled Boolean |
Event ID 661: Mshtml_CView_SetViewportMode_VisualHeightExclusion
#Fields #
| Name | Description |
|---|---|
CView Pointer | |
IsEnabled Boolean |
Event ID 662: Mshtml_CDMScrollableTouchTarget_OnViewportStatusChanged
#Fields #
| Name | Description |
|---|---|
PreviousStatus UInt32 | |
CurrentStatus UInt32 | |
TouchTargetPtr Pointer |
Event ID 663: Mshtml_CDMScrollableTouchTarget_BeginInteraction
#Fields #
| Name | Description |
|---|---|
ManualGestureConfiguration UInt32 | |
PointerID UInt16 | |
IsIHTThread Boolean | |
CDMScrollableTouchTarget Pointer |
Event ID 664: Mshtml_CDMTouchTarget_InputTransform
#Fields #
| Name | Description |
|---|---|
IsIHTThread Boolean | |
mat_11 Float | |
mat_12 Float | |
mat_21 Float | |
mat_22 Float | |
mat_31 Float | |
mat_32 Float | |
CDMTouchTarget Pointer |
Event ID 665: Mshtml_CDMTouchTarget_DisplayTransform
#Fields #
| Name | Description |
|---|---|
IsIHTThread Boolean | |
mat_11 Float | |
mat_12 Float | |
mat_21 Float | |
mat_22 Float | |
mat_31 Float | |
mat_32 Float | |
CDMTouchTarget Pointer |
Event ID 666: Mshtml_IndependentHitTest_HitTestPointer
#Fields #
| Name | Description |
|---|---|
HwndWorker Pointer | |
PointerID UInt16 | |
ClientX UInt32 | |
ClientY UInt32 |
Event ID 667: Mshtml_CDMScrollableTouchTargetHandler_ContentState
#Fields #
| Name | Description |
|---|---|
ViewportOffsetWidth Float | |
ViewportOffsetHeight Float | |
LayoutViewportOffsetWidth Float | |
LayoutViewportOffsetHeight Float | |
ZoomLevel Float | |
CDMScrollableTouchTargetHandler Pointer |
Event ID 668: Mshtml_CDMScrollableTouchTargetHandler_ContentState668
#Fields #
| Name | Description |
|---|---|
ViewportOffsetWidth Float | |
ViewportOffsetHeight Float | |
ZoomLevel Float | |
CDMScrollableTouchTargetHandler Pointer |
Event ID 669: Mshtml_CDMScrollableTouchTargetHandler_StartTarget
#Fields #
| Name | Description |
|---|---|
MsgID UInt32 | |
CDMScrollableTouchTargetHandler Pointer |
Event ID 670: Mshtml_CDMTouchTargetHandler_ApplyViewportStatusChange
#Fields #
| Name | Description |
|---|---|
FromStatus UInt32 | |
ToStatus UInt32 | |
CDMTouchTargetHandler Pointer |
Event ID 671: Mshtml_TouchDiagnosis_GenericInfo_Output
#Fields #
| Name | Description |
|---|---|
GenericInfo UInt32 | |
ThisPtr Pointer |
Event ID 672: Mshtml_CDMCrossSlideDraggableTouchTarget_AssignDispLayerImpl
#Fields #
| Name | Description |
|---|---|
IDispLayer Pointer | |
CDMCrossSlideDraggableTouchTarget Pointer |
Event ID 673: Mshtml_CDMCrossSlideDraggableTouchTarget_AssignDispLayerWithDragState
#Fields #
| Name | Description |
|---|---|
IDispLayer Pointer | |
fIsDraggingRequested Boolean | |
CDMCrossSlideDraggableTouchTarget Pointer |
Event ID 674: Mshtml_CDMCrossSlideDraggableTouchTarget_SetupLayerForDragging
#Fields #
| Name | Description |
|---|---|
IDispLayer Pointer | |
CDMCrossSlideDraggableTouchTarget Pointer |
Event ID 675: Mshtml_CDMCrossSlideDraggableTouchTarget_ClearLayerFromDragging
#Fields #
| Name | Description |
|---|---|
IDispLayer Pointer | |
CDMCrossSlideDraggableTouchTarget Pointer |
Event ID 676: Mshtml_CDMCrossSlideDraggableTouchTargetHandler_UpdateCrossSlideOffset
#Fields #
| Name | Description |
|---|---|
ViewportOffsetWidth Float | |
ViewportOffsetHeight Float | |
ZoomLevel Float | |
CDMCrossSlideDraggableTouchTargetHandler Pointer |
Event ID 677: Mshtml_CDMHoldDraggableTouchTarget_OnInteraction
#Fields #
| Name | Description |
|---|---|
DManipInteractionType UInt32 | |
CDMHoldDraggableTouchTarget Pointer |
Event ID 678: Mshtml_CDMDraggableTouchTarget_SetDragDropConfiguration
#Fields #
| Name | Description |
|---|---|
DManipDragDropConfiguration UInt32 | |
CDMDraggableTouchTarget Pointer |
Event ID 679: Mshtml_CDMDraggableTouchTarget_OnDragDropStatusChangeImp
#Fields #
| Name | Description |
|---|---|
PreviousStatus UInt32 | |
CurrentStatus UInt32 | |
CDMDraggableTouchTarget Pointer |
Event ID 680: Mshtml_CDMDraggableTouchTarget_BeginInteraction
#Fields #
| Name | Description |
|---|---|
PointerID UInt16 | |
IsIHTThread Boolean | |
CDMDraggableTouchTarget Pointer |
Event ID 681: Mshtml_CDMDraggableTouchTarget_HandleDragStateChanges
#Fields #
| Name | Description |
|---|---|
fIsDraggingRequested Boolean | |
fIsPreviewCurrentlyDisplayed Boolean | |
CDMDraggableTouchTarget Pointer |
Event ID 682: Mshtml_CDMDraggableTouchTarget_ReturnTargetToOriginalLocation
#Fields #
| Name | Description |
|---|---|
rcWidth Int32 | |
rcHeight Int32 | |
CDMDraggableTouchTarget Pointer |
Event ID 683: Mshtml_CDMDraggableTouchTarget_OnViewportStatusChanged
#Fields #
| Name | Description |
|---|---|
PreviousStatus UInt32 | |
CurrentStatus UInt32 | |
TouchTargetPtr Pointer |
Event ID 684: Mshtml_CDMDraggableTouchTarget_ProcessTouchTargetStatusChange
#Fields #
| Name | Description |
|---|---|
fTouchStarting Boolean | |
CDMDraggableTouchTarget Pointer |
Event ID 685: Mshtml_CDMDraggableTouchTargetHandler_OnDragInitiated
#Fields #
| Name | Description |
|---|---|
CElement Pointer | |
CDMDraggableTouchTargetHandler Pointer |
Event ID 686: Mshtml_CStorage
#Fields #
| Name | Description |
|---|---|
SharedMemoryHandle UInt32 | |
TotalBufferSizeInBytes UInt32 |
Event ID 687: Mshtml_CStorage687
#Fields #
| Name | Description |
|---|---|
FailureHresult HexInt32 | |
TotalBufferSizeInBytes UInt32 |
Event ID 689: Mshtml_CStorage689
#Fields #
| Name | Description |
|---|---|
SharedMemoryHandle UInt32 | |
FailureHresult HexInt32 |
Event ID 690: Mshtml_CStorage690
#Fields #
| Name | Description |
|---|---|
FailureReason UInt32 | Known values
|
FailureHresult HexInt32 | |
TargetURL UnicodeString | |
EmulationMode UInt32 |
Example Event #
{
"system": {
"provider": "Microsoft-IE",
"guid": "{9e3b3947-ca5d-4614-91a2-7b624e0e7244}",
"event_source_name": "",
"event_id": 690,
"version": 0,
"level": 0,
"task": 413,
"opcode": 0,
"keywords": "0x1000",
"time_created": "2026-07-19T04:20:10.479093800+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 5468,
"thread_id": 8344
},
"channel": "Unknown",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"FailureReason": "4",
"FailureHresult": "0x1",
"TargetURL": "NULL",
"EmulationMode": "7"
},
"message": ""
}
Event ID 691: Mshtml_CTouchHelper_OnPointerMessage_StartDoubleTapTimer
#Event ID 692: Mshtml_CTouchHelper_DoubleTapOnTick_CommitDeferredActionsForDoubleTapZoomCancel
#Event ID 693: Mshtml_CTouchHelper_PreFilterMessageForCapture_CommitDeferredActionsForDoubleTapZoomCancel
#Event ID 694: Mshtml_CTouchHelper_PreFilterMessageForCapture_CommitDeferredActionsForDoubleTapZoom
#Fields #
| Name | Description |
|---|---|
pNodeFirstTap Pointer | |
pointX Int32 | |
pointY Int32 |
Event ID 695: Mshtml_CDoubleTap_PanAndZoom
#Fields #
| Name | Description |
|---|---|
Reason UInt32 | |
DesiredOffsetX Float | |
DesiredOffsetY Float | |
DesiredZoomFactor Float |
Event ID 696: Mshtml_CDoubleTap_IsDoubleTapAllowed
#Fields #
| Name | Description |
|---|---|
pNodeHit Pointer | |
fAllowed Boolean |
Event ID 697: Mshtml_CTouchHelper_IsDoubleClick
#Fields #
| Name | Description |
|---|---|
fPotentialDoubleTap Boolean | |
fDoubleTapTimerPending Boolean | |
pMessageTime UInt32 | |
MaxTimeForSecondTap UInt64 | |
FirstTapPointX Int32 | |
FirstTapPointY Int32 | |
SecondTapPointX Int32 | |
SecondTapPointY Int32 | |
fIsDoubleClick Boolean |
Event ID 698: Mshtml_Animations_Instance
#Fields #
| Name | Description |
|---|---|
AnimationClientObject Pointer | |
AnimationInstanceObject Pointer | |
DISPID UInt32 |
Event ID 699: Mshtml_Animations_Instance699
#Fields #
| Name | Description |
|---|---|
DispNode Pointer | |
IndAnimationInstanceObject Pointer | |
DISPID UInt32 |
Event ID 700: Mshtml_CTouchHelper_HandleTouchMessage_Info
#Fields #
| Name | Description |
|---|---|
Msg HexInt32 | |
TimeStamp UInt64 | |
PointerId UInt32 | |
FrameId UInt32 | |
PointerType UInt32 | |
ScreenX UInt32 | |
ScreenY UInt32 | |
ClientX UInt32 | |
ClientY UInt32 | |
ButtonChanged UInt32 | |
ButtonState HexInt32 | |
PointerFlags HexInt32 |
Event ID 701: Mshtml_DragAndDrop_Fire_DragEnd
#Fields #
| Name | Description |
|---|---|
Element Pointer | |
DropEffect Int32 | |
ScreenLocationX Int32 | |
ScreenLocationY Int32 |
Event ID 702: Mshtml_DragAndDrop_Fire_DragEnter
#Fields #
| Name | Description |
|---|---|
Element Pointer | |
DropEffect Int32 | |
ScreenLocationX Int32 | |
ScreenLocationY Int32 |
Event ID 703: Mshtml_DragAndDrop_Fire_DragOver
#Fields #
| Name | Description |
|---|---|
Element Pointer | |
DropEffect Int32 | |
ScreenLocationX Int32 | |
ScreenLocationY Int32 |
Event ID 706: Mshtml_DragAndDrop_Fire_Drag
#Fields #
| Name | Description |
|---|---|
Element Pointer | |
DropEffect Int32 | |
ScreenLocationX Int32 | |
ScreenLocationY Int32 |
Event ID 707: Mshtml_DragAndDrop_Fire_DragLeave
#Fields #
| Name | Description |
|---|---|
Element Pointer | |
DropEffect Int32 | |
ScreenLocationX Int32 | |
ScreenLocationY Int32 |
Event ID 708: Mshtml_Post_MSManipulationStateChange
#Fields #
| Name | Description |
|---|---|
Element Pointer | |
PreviousState UInt32 | |
CurrentState UInt32 |
Event ID 709: Mshtml_Fire_MSManipulationStateChange
#Fields #
| Name | Description |
|---|---|
Element Pointer | |
PreviousState UInt32 | |
CurrentState UInt32 |
Event ID 711: Mshtml_CDragPreview_RenderPreviewStop
#Fields #
| Name | Description |
|---|---|
DragPreview Pointer | |
FailureHresult HexInt32 |
Event ID 713: Mshtml_CDragPreview_InitializeStop
#Fields #
| Name | Description |
|---|---|
DragPreview Pointer | |
FailureHresult HexInt32 |
Event ID 715: Mshtml_CDragPreview_CreateSurfaceStop
#Fields #
| Name | Description |
|---|---|
DragPreview Pointer | |
FailureHresult HexInt32 |
Event ID 717: Mshtml_CDragPreview_HookupStop
#Fields #
| Name | Description |
|---|---|
DragPreview Pointer | |
FailureHresult HexInt32 |
Event ID 718: Mshtml_CTouchDragDropHelper_DragInitiatedStart
#Fields #
| Name | Description |
|---|---|
TouchDragDropHelper Pointer | |
Element Pointer |
Event ID 719: Mshtml_CTouchDragDropHelper_DragInitiatedStop
#Fields #
| Name | Description |
|---|---|
TouchDragDropHelper Pointer | |
Element Pointer | |
FailureHresult HexInt32 |
Event ID 720: Mshtml_CTouchDragDropHelper_DragCancelledStart
#Fields #
| Name | Description |
|---|---|
TouchDragDropHelper Pointer |
Event ID 721: Mshtml_CTouchDragDropHelper_DragCancelledStop
#Fields #
| Name | Description |
|---|---|
TouchDragDropHelper Pointer | |
FailureHresult HexInt32 |
Event ID 722: Mshtml_CTouchDragDropHelper_OnDraggingStart
#Fields #
| Name | Description |
|---|---|
TouchDragDropHelper Pointer |
Event ID 723: Mshtml_CTouchDragDropHelper_OnDraggingStop
#Fields #
| Name | Description |
|---|---|
TouchDragDropHelper Pointer | |
FailureHresult HexInt32 |
Event ID 724: Mshtml_CTouchDragDropHelper_OnDroppedStart
#Fields #
| Name | Description |
|---|---|
TouchDragDropHelper Pointer |
Event ID 725: Mshtml_CTouchDragDropHelper_OnDroppedStop
#Fields #
| Name | Description |
|---|---|
TouchDragDropHelper Pointer | |
FailureHresult HexInt32 |
Event ID 726: Mshtml_CTouchDragDropHelper_ShutdownStart
#Fields #
| Name | Description |
|---|---|
TouchDragDropHelper Pointer |
Event ID 727: Mshtml_CTouchDragDropHelper_ShutdownStop
#Fields #
| Name | Description |
|---|---|
TouchDragDropHelper Pointer |
Event ID 728: Mshtml_Prerendering728
#Fields #
| Name | Description |
|---|---|
FlipAhead_Target_URL UnicodeString | |
Target_Source_Method UInt32 |
Event ID 729: Mshtml_DMTouchTargetHandler_TouchEnd
#Event ID 730: Mshtml_WebOCEvents_BeforeNavigate
#Fields #
| Name | Description |
|---|---|
CMarkup Pointer | |
Canceled Boolean |
Event ID 731: Mshtml_WebOCEvents_BeforeNavigateRefresh
#Fields #
| Name | Description |
|---|---|
CMarkup Pointer | |
RefreshLevel UInt32 | |
Canceled Boolean |
Event ID 732: Mshtml_WebOCEvents_NavigateComplete
#Fields #
| Name | Description |
|---|---|
CMarkup Pointer | |
CMarkup* |
Example Event #
{
"system": {
"provider": "Microsoft-IE",
"guid": "{9e3b3947-ca5d-4614-91a2-7b624e0e7244}",
"event_source_name": "",
"event_id": 732,
"version": 0,
"level": 0,
"task": 443,
"opcode": 0,
"keywords": "0x2",
"time_created": "2026-07-19T04:12:46.605464600+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 5248,
"thread_id": 3912
},
"channel": "Unknown",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"CMarkup*": "0x1DA004B8000"
},
"message": ""
}
Event ID 735: Mshtml_WebOCEvents_DocumentComplete
#Fields #
| Name | Description |
|---|---|
CMarkup Pointer | |
CMarkup* |
Example Event #
{
"system": {
"provider": "Microsoft-IE",
"guid": "{9e3b3947-ca5d-4614-91a2-7b624e0e7244}",
"event_source_name": "",
"event_id": 735,
"version": 0,
"level": 0,
"task": 446,
"opcode": 0,
"keywords": "0x2",
"time_created": "2026-07-19T04:12:46.607982800+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 5248,
"thread_id": 3912
},
"channel": "Unknown",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"CMarkup*": "0x1DA004B8000"
},
"message": ""
}
Event ID 736: Mshtml_WebOCEvents_NavigateError
#Fields #
| Name | Description |
|---|---|
CMarkup Pointer | |
hrReason UInt32 |
Event ID 737: Mshtml_WebOCEvents_NavigateRedirected
#Fields #
| Name | Description |
|---|---|
CMarkup Pointer | |
RedirectURL UnicodeString | |
StatusCode UInt32 | NTSTATUS reference |
Canceled Boolean |
Event ID 740: Mshtml_MemoryProtector_ReclaimMemoryWithoutProtectionStart
#Fields #
| Name | Description |
|---|---|
CMemoryProtector Pointer | |
StackSize UInt64 | |
Blocks UInt64 | |
Bytes UInt64 |
Event ID 741: Mshtml_MemoryProtector_ReclaimMemoryWithoutProtectionStop
#Fields #
| Name | Description |
|---|---|
CMemoryProtector Pointer |
Event ID 742: Mshtml_MemoryProtector_SyncMarkStart
#Fields #
| Name | Description |
|---|---|
CMemoryProtector Pointer | |
StackSize UInt64 | |
Blocks UInt64 | |
Bytes UInt64 |
Event ID 744: Mshtml_MemoryProtector_ReclaimUnmarkedStart
#Fields #
| Name | Description |
|---|---|
CMemoryProtector Pointer | |
Blocks UInt64 | |
Bytes UInt64 |
Event ID 745: Mshtml_MemoryProtector_ReclaimUnmarkedStop
#Fields #
| Name | Description |
|---|---|
CMemoryProtector Pointer | |
MarkedBlocks UInt64 | |
MarkedBytes UInt64 |
Event ID 746: Edgehtml_HtmlPopup
#Fields #
| Name | Description |
|---|---|
HRESULT UInt32 | |
Left UInt32 | |
Right UInt32 | |
Top UInt32 | |
Bottom UInt32 |
Event ID 747: Mshtml_CSP_AddPolicyStart
#Fields #
| Name | Description |
|---|---|
CContentSecurityPolicy Pointer | |
PolicyType UInt32 |
Event ID 748: Mshtml_CSP_AddPolicyStop
#Fields #
| Name | Description |
|---|---|
CContentSecurityPolicy Pointer | |
PolicyType UInt32 | |
Added Boolean |
Event ID 749: Mshtml_CSP_CheckPolicyStart
#Fields #
| Name | Description |
|---|---|
CContentSecurityPolicy Pointer | |
ResourceDirectiveType UInt32 |
Event ID 750: Mshtml_CSP_CheckPolicyStop
#Fields #
| Name | Description |
|---|---|
CContentSecurityPolicy Pointer | |
ResourceDirectiveType UInt32 | |
Allowed Boolean |
Event ID 751: EdgeHTML_Webview_AppPermissionResponse
#Fields #
| Name | Description |
|---|---|
URL UnicodeString | |
PermissionType UInt32 | |
PermissionState UInt32 | |
IsPrimaryResponse Boolean |
Event ID 752: Mshtml_Download_Initiator
#Fields #
| Name | Description |
|---|---|
DownloadedURL UnicodeString | |
BindInfo Pointer | |
CHtmPre Pointer | |
CPre Pointer | |
CDoc Pointer | |
CWindow Pointer | |
WindowURL UnicodeString | |
URL UnicodeString | |
Line UInt32 | |
Offset UInt32 | |
Speculative Boolean | |
LookAhead Boolean | |
PreParserRestarted Boolean | |
Context UInt32 | |
Initiator UInt32 | |
Source UInt32 | |
LookAheadCount UInt32 |
Example Event #
{
"system": {
"provider": "Microsoft-IE",
"guid": "{9e3b3947-ca5d-4614-91a2-7b624e0e7244}",
"event_source_name": "",
"event_id": 752,
"version": 0,
"level": 0,
"task": 459,
"opcode": 0,
"keywords": "0x2000001000",
"time_created": "2026-07-19T04:12:46.477015200+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 5248,
"thread_id": 3912
},
"channel": "Unknown",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"DownloadedURL": "file:///C:/Users/Public/catalog-ie.hta",
"BindInfo": "0x1DA457BAC40",
"CHtmPre": "0x0",
"CPre": "0x0",
"CDoc": "0x1DA00478000",
"CWindow": "0x1DA004B0400",
"WindowURL": "file:///C:/Users/Public/catalog-ie.hta",
"URL": "NULL",
"Line": "0",
"Offset": "0",
"Speculative": "false",
"LookAhead": "false",
"PreParserRestarted": "false",
"Context": "0",
"Initiator": "80",
"Source": "2",
"LookAheadCount": "0"
},
"message": ""
}
Event ID 757: Mshtml_Ortc_Connectivity_Check
#Fields #
| Name | Description |
|---|---|
ICEState UnicodeString | |
ThisPtr Pointer |
Event ID 759: Mshtml_Ortc_Create_Render_Sample_Queue
#Fields #
| Name | Description |
|---|---|
SampleQueueType AnsiString | |
ThisPtr Pointer |
Event ID 760: Mshtml_Ortc_Render_Sample_Dropped
#Fields #
| Name | Description |
|---|---|
DroppedSampleCount UInt64 | |
ThisPtr Pointer |
Event ID 761: Mshtml_Ortc_Audio_Render_Sample_Time_Push
#Fields #
| Name | Description |
|---|---|
SampleCount UInt64 | |
CurrentTimeMSec UInt64 | |
ThisPtr Pointer |
Event ID 762: Mshtml_Ortc_Audio_Render_Sample_Time_Pull
#Fields #
| Name | Description |
|---|---|
SampleCount UInt64 | |
CurrentTimeMSec UInt64 | |
ThisPtr Pointer |
Event ID 763: Mshtml_Ortc_Audio_Render_Sample_Time_Delivery
#Fields #
| Name | Description |
|---|---|
SampleCount UInt64 | |
CurrentTimeMSec UInt64 | |
ThisPtr Pointer |
Event ID 764: Mshtml_Ortc_Video_Render_Sample_Time_Push
#Fields #
| Name | Description |
|---|---|
SampleCount UInt64 | |
CurrentTimeMSec UInt64 | |
ThisPtr Pointer |
Event ID 765: Mshtml_Ortc_Video_Render_Sample_Time_Pull
#Fields #
| Name | Description |
|---|---|
SampleCount UInt64 | |
CurrentTimeMSec UInt64 | |
ThisPtr Pointer |
Event ID 766: Mshtml_Ortc_Video_Render_Sample_Time_Delivery
#Fields #
| Name | Description |
|---|---|
SampleCount UInt64 | |
CurrentTimeMSec UInt64 | |
ThisPtr Pointer |
Event ID 767: Mshtml_Selectors_Api_Query_Selector
#Fields #
| Name | Description |
|---|---|
SelectorType UInt32 | |
Selector UnicodeString | |
TargetType UInt32 | |
Target Pointer | |
IsQueryAll Boolean |
Event ID 768: Mshtml_Image_Pooling_Budget_EnforceStart
#Fields #
| Name | Description |
|---|---|
Type UInt32 | |
Budget UInt32 | |
Current UInt32 |
Event ID 769: Mshtml_Image_Pooling_Budget_EnforceStop
#Fields #
| Name | Description |
|---|---|
Type UInt32 | |
Budget UInt32 | |
Current UInt32 |
Event ID 770: Mshtml_Ortc_Set_Video_Size_Preference
#Fields #
| Name | Description |
|---|---|
Width UInt32 | |
Height UInt32 | |
VideoElement Pointer | |
RemoteMediaStreamTrack Pointer | |
ThisPtr Pointer |
Event ID 771: Mshtml_Ortc_Audio_Drift_Render_Sample_Dropped
#Fields #
| Name | Description |
|---|---|
DriftedTimeMSec UInt64 | |
LastSampleEndTimeMSec UInt64 | |
CurrentPresentationClockTimeMSec UInt64 | |
AudioDriftDroppedSampleCount UInt64 | |
ThisPtr Pointer |
Event ID 772: Mshtml_Ortc_Audio_Clock_Stall_Render_Sample_Dropped
#Fields #
| Name | Description |
|---|---|
LastSampleEndTimeMSec UInt64 | |
CurrentPresentationClockTimeMSec UInt64 | |
AudioDriftDroppedSampleCount UInt64 | |
ThisPtr Pointer |
Event ID 773: Mshtml_Ortc_Capture_Sample_Requested
#Fields #
| Name | Description |
|---|---|
SampleRequstedCount UInt64 | |
SampleDeliveredCount UInt64 | |
SampleReceivedCount UInt64 | |
SampleDroppedCount UInt64 | |
TrackKind UInt32 | |
ThisPtr Pointer |
Event ID 774: Mshtml_Ortc_Capture_Sample_Delivered
#Fields #
| Name | Description |
|---|---|
SampleRequstedCount UInt64 | |
SampleDeliveredCount UInt64 | |
SampleReceivedCount UInt64 | |
SampleDroppedCount UInt64 | |
TrackKind UInt32 | |
ThisPtr Pointer |
Event ID 775: Mshtml_Ortc_Capture_Sample_Received
#Fields #
| Name | Description |
|---|---|
SampleRequstedCount UInt64 | |
SampleDeliveredCount UInt64 | |
SampleReceivedCount UInt64 | |
SampleDroppedCount UInt64 | |
TrackKind UInt32 | |
ThisPtr Pointer |
Event ID 776: Mshtml_Ortc_Capture_Sample_Dropped
#Fields #
| Name | Description |
|---|---|
SampleRequstedCount UInt64 | |
SampleDeliveredCount UInt64 | |
SampleReceivedCount UInt64 | |
SampleDroppedCount UInt64 | |
TrackKind UInt32 | |
ThisPtr Pointer |
Event ID 777: Mshtml_Ortc_Ice_Transport_StatsStart
#Fields #
| Name | Description |
|---|---|
OutstandingStatsRequestCount UInt64 | |
HrTask HexInt32 | |
ThisPtr Pointer |
Event ID 778: Mshtml_Ortc_Ice_Transport_StatsStop
#Fields #
| Name | Description |
|---|---|
OutstandingStatsRequestCount UInt64 | |
HrTask HexInt32 | |
ThisPtr Pointer |
Event ID 779: Mshtml_Ortc_Sender_StatsStart
#Fields #
| Name | Description |
|---|---|
OutstandingStatsRequestCount UInt64 | |
HrTask HexInt32 | |
ThisPtr Pointer |
Event ID 780: Mshtml_Ortc_Sender_StatsStop
#Fields #
| Name | Description |
|---|---|
OutstandingStatsRequestCount UInt64 | |
HrTask HexInt32 | |
ThisPtr Pointer |
Event ID 781: Mshtml_Ortc_Receiver_StatsStart
#Fields #
| Name | Description |
|---|---|
OutstandingStatsRequestCount UInt64 | |
HrTask HexInt32 | |
ThisPtr Pointer |
Event ID 782: Mshtml_Ortc_Receiver_StatsStop
#Fields #
| Name | Description |
|---|---|
OutstandingStatsRequestCount UInt64 | |
HrTask HexInt32 | |
ThisPtr Pointer |
Event ID 783: Mshtml_Media_Capture_Sample_Requested
#Fields #
| Name | Description |
|---|---|
SampleRequstedCount UInt64 | |
SampleDeliveredCount UInt64 | |
SampleReceivedCount UInt64 | |
SampleDroppedCount UInt64 | |
TrackKind UInt32 | |
ThisPtr Pointer |
Event ID 784: Mshtml_Media_Capture_Sample_Delivered
#Fields #
| Name | Description |
|---|---|
SampleRequstedCount UInt64 | |
SampleDeliveredCount UInt64 | |
SampleReceivedCount UInt64 | |
SampleDroppedCount UInt64 | |
TrackKind UInt32 | |
ThisPtr Pointer |
Event ID 785: Mshtml_Media_Capture_Sample_Received
#Fields #
| Name | Description |
|---|---|
SampleRequstedCount UInt64 | |
SampleDeliveredCount UInt64 | |
SampleReceivedCount UInt64 | |
SampleDroppedCount UInt64 | |
TrackKind UInt32 | |
ThisPtr Pointer |
Event ID 786: Mshtml_Media_Capture_Sample_Dropped
#Fields #
| Name | Description |
|---|---|
SampleRequstedCount UInt64 | |
SampleDeliveredCount UInt64 | |
SampleReceivedCount UInt64 | |
SampleDroppedCount UInt64 | |
TrackKind UInt32 | |
ThisPtr Pointer |
Event ID 807: WebPlatStorageServer807
#Fields #
| Name | Description |
|---|---|
ProcessName UnicodeString | |
PID UInt32 | |
FileName UnicodeString |
Event ID 808: Mshtml_AlignedTimer_ProcessingStart
#Fields #
| Name | Description |
|---|---|
CurrentRound UInt64 | |
CallsToProcess UInt64 | |
CurrentTimeMs UInt64 |
Example Event #
{
"system": {
"channel": "Unknown",
"computer": "10.2.10.21",
"correlation": {},
"event_id": 808,
"event_record_id": 0,
"event_source_name": "",
"execution": {
"process_id": 10004,
"thread_id": 7236
},
"guid": "",
"keywords": 0,
"level": 4,
"opcode": 1,
"provider": "Microsoft-IE",
"security": {
"user_id": ""
},
"task": 0,
"time_created": "2026-07-21 22:09:33.911Z",
"version": 0
},
"event_data": {
"CallsToProcess": 2,
"CurrentRound": 7408,
"CurrentTimeMs": 45452191
},
"message": ""
}
Event ID 809: Mshtml_AlignedTimer_ProcessingStop
#Fields #
| Name | Description |
|---|---|
CurrentRound UInt64 | |
CallsToProcess UInt64 | |
CurrentTimeMs UInt64 |
Example Event #
{
"system": {
"channel": "Unknown",
"computer": "10.2.10.21",
"correlation": {},
"event_id": 809,
"event_record_id": 0,
"event_source_name": "",
"execution": {
"process_id": 10004,
"thread_id": 7236
},
"guid": "",
"keywords": 0,
"level": 4,
"opcode": 2,
"provider": "Microsoft-IE",
"security": {
"user_id": ""
},
"task": 0,
"time_created": "2026-07-21 22:09:33.911Z",
"version": 0
},
"event_data": {
"CallsToProcess": 1,
"CurrentRound": 7408,
"CurrentTimeMs": 45452191
},
"message": ""
}
Event ID 810: Mshtml_AlignedTimer_Fire810_V2
#Fields #
| Name | Description |
|---|---|
Object Pointer | |
TimerId UInt32 | |
DeltaMs Int32 | |
PeriodMs Int32 | |
CurrentTimeMs UInt64 | |
Flags HexInt32 | |
Callback Pointer | |
Visibility Boolean | |
TimerRound UInt32 |
Example Event #
{
"system": {
"channel": "Unknown",
"computer": "10.2.10.21",
"correlation": {},
"event_id": 810,
"event_record_id": 0,
"event_source_name": "",
"execution": {
"process_id": 10004,
"thread_id": 7236
},
"guid": "",
"keywords": 0,
"level": 4,
"opcode": 0,
"provider": "Microsoft-IE",
"security": {
"user_id": ""
},
"task": 0,
"time_created": "2026-07-21 22:09:33.911Z",
"version": 0
},
"event_data": {
"Callback": "0x0",
"CurrentTimeMs": 45452191,
"DeltaMs": 155,
"Flags": "00040000",
"Object": "0x21C46A18518",
"PeriodMs": 100,
"TimerId": 0,
"TimerRound": 7408,
"Visibility": true
},
"message": ""
}
Event ID 811: Mshtml_CBase_AddPrivateRef
#Fields #
| Name | Description |
|---|---|
JsVarInstance Pointer | |
ThisPointer Pointer | |
SSN UInt32 | |
RefAfterChange UInt32 |
Example Event #
{
"system": {
"channel": "Unknown",
"computer": "10.2.10.21",
"correlation": {},
"event_id": 811,
"event_record_id": 0,
"event_source_name": "",
"execution": {
"process_id": 10004,
"thread_id": 7236
},
"guid": "",
"keywords": 0,
"level": 4,
"opcode": 0,
"provider": "Microsoft-IE",
"security": {
"user_id": ""
},
"task": 0,
"time_created": "2026-07-21 22:09:33.137Z",
"version": 0
},
"event_data": {
"JsVarInstance": "0x0",
"RefAfterChange": 20,
"SSN": 0,
"ThisPointer": "0x21C46A10000"
},
"message": ""
}
Event ID 812: Mshtml_CBase_ReleasePrivateRef
#Fields #
| Name | Description |
|---|---|
JsVarInstance Pointer | |
ThisPointer Pointer | |
SSN UInt32 | |
RefAfterChange UInt32 |
Example Event #
{
"system": {
"channel": "Unknown",
"computer": "10.2.10.21",
"correlation": {},
"event_id": 812,
"event_record_id": 0,
"event_source_name": "",
"execution": {
"process_id": 10004,
"thread_id": 7236
},
"guid": "",
"keywords": 0,
"level": 4,
"opcode": 0,
"provider": "Microsoft-IE",
"security": {
"user_id": ""
},
"task": 0,
"time_created": "2026-07-21 22:09:33.137Z",
"version": 0
},
"event_data": {
"JsVarInstance": "0x0",
"RefAfterChange": 19,
"SSN": 0,
"ThisPointer": "0x21C46A10000"
},
"message": ""
}
Event ID 813: Mshtml_CBase_AddInternalRef
#Fields #
| Name | Description |
|---|---|
JsVarInstance Pointer | |
ThisPointer Pointer | |
SSN UInt32 | |
RefAfterChange UInt32 |
Example Event #
{
"system": {
"channel": "Unknown",
"computer": "10.2.10.21",
"correlation": {},
"event_id": 813,
"event_record_id": 0,
"event_source_name": "",
"execution": {
"process_id": 10004,
"thread_id": 7236
},
"guid": "",
"keywords": 0,
"level": 4,
"opcode": 0,
"provider": "Microsoft-IE",
"security": {
"user_id": ""
},
"task": 0,
"time_created": "2026-07-21 22:09:33.455Z",
"version": 0
},
"event_data": {
"JsVarInstance": "0x0",
"RefAfterChange": 2,
"SSN": 0,
"ThisPointer": "0x21C46A0E340"
},
"message": ""
}
Event ID 814: Mshtml_CBase_ReleaseInternalRef
#Fields #
| Name | Description |
|---|---|
JsVarInstance Pointer | |
ThisPointer Pointer | |
SSN UInt32 | |
RefAfterChange UInt32 |
Example Event #
{
"system": {
"channel": "Unknown",
"computer": "10.2.10.21",
"correlation": {},
"event_id": 814,
"event_record_id": 0,
"event_source_name": "",
"execution": {
"process_id": 10004,
"thread_id": 7236
},
"guid": "",
"keywords": 0,
"level": 4,
"opcode": 0,
"provider": "Microsoft-IE",
"security": {
"user_id": ""
},
"task": 0,
"time_created": "2026-07-21 22:09:33.457Z",
"version": 0
},
"event_data": {
"JsVarInstance": "0x0",
"RefAfterChange": 0,
"SSN": 0,
"ThisPointer": "0x21C588F5330"
},
"message": ""
}
Event ID 815: Mshtml_CBase_AddSubRef
#Fields #
| Name | Description |
|---|---|
JsVarInstance Pointer | |
ThisPointer Pointer | |
SSN UInt32 | |
RefAfterChange UInt32 |
Example Event #
{
"system": {
"channel": "Unknown",
"computer": "10.2.10.21",
"correlation": {},
"event_id": 815,
"event_record_id": 0,
"event_source_name": "",
"execution": {
"process_id": 10004,
"thread_id": 7236
},
"guid": "",
"keywords": 0,
"level": 4,
"opcode": 0,
"provider": "Microsoft-IE",
"security": {
"user_id": ""
},
"task": 0,
"time_created": "2026-07-21 22:09:33.136Z",
"version": 0
},
"event_data": {
"JsVarInstance": "0x0",
"RefAfterChange": 2140,
"SSN": 0,
"ThisPointer": "0x21C46C40020"
},
"message": ""
}
Event ID 816: Mshtml_CBase_ReleaseSubRef
#Fields #
| Name | Description |
|---|---|
JsVarInstance Pointer | |
ThisPointer Pointer | |
SSN UInt32 | |
RefAfterChange UInt32 |
Example Event #
{
"system": {
"channel": "Unknown",
"computer": "10.2.10.21",
"correlation": {},
"event_id": 816,
"event_record_id": 0,
"event_source_name": "",
"execution": {
"process_id": 10004,
"thread_id": 7236
},
"guid": "",
"keywords": 0,
"level": 4,
"opcode": 0,
"provider": "Microsoft-IE",
"security": {
"user_id": ""
},
"task": 0,
"time_created": "2026-07-21 22:09:33.138Z",
"version": 0
},
"event_data": {
"JsVarInstance": "0x0",
"RefAfterChange": 2140,
"SSN": 0,
"ThisPointer": "0x21C46C40020"
},
"message": ""
}
Event ID 817: WebPlatStorageServer_Handle
#Fields #
| Name | Description |
|---|---|
StorageCategory UInt8 | |
HandleType UInt32 | |
Handle Pointer |
Event ID 818: WebPlatStorageServer_Handle818
#Fields #
| Name | Description |
|---|---|
StorageCategory UInt8 | |
HandleType UInt32 | |
Handle Pointer |
Event ID 819: WebPlatStorageServer_Handle819
#Fields #
| Name | Description |
|---|---|
StorageCategory UInt8 | |
HandleType UInt32 | |
Handle Pointer |
Event ID 820: WebPlatStorageServer_RPC_MethodStart
#Fields #
| Name | Description |
|---|---|
StorageCategory UInt8 | |
Method UInt32 |
Event ID 821: WebPlatStorageServer_RPC_MethodStop
#Fields #
| Name | Description |
|---|---|
StorageCategory UInt8 | |
Method UInt32 | |
HR UInt32 |
Event ID 822: Mshtml_Gwnd_TaskStart
#Fields #
| Name | Description |
|---|---|
TaskName AnsiString | |
ObjectPointer Pointer | |
DelayTime UInt32 |
Example Event #
{
"system": {
"channel": "Unknown",
"computer": "10.2.10.21",
"correlation": {},
"event_id": 822,
"event_record_id": 0,
"event_source_name": "",
"execution": {
"process_id": 10004,
"thread_id": 7236
},
"guid": "",
"keywords": 0,
"level": 4,
"opcode": 1,
"provider": "Microsoft-IE",
"security": {
"user_id": ""
},
"task": 0,
"time_created": "2026-07-21 22:09:33.239Z",
"version": 0
},
"event_data": {
"DelayTime": 23856,
"ObjectPointer": "0x21C46C40020",
"TaskName": "CServer::SendOnDataChange"
},
"message": ""
}
Event ID 823: Mshtml_Gwnd_TaskStop
#Fields #
| Name | Description |
|---|---|
TaskName AnsiString | |
ScriptExecutionTime UInt32 | |
IsIgnoredInTelemetry Boolean |
Example Event #
{
"system": {
"channel": "Unknown",
"computer": "10.2.10.21",
"correlation": {},
"event_id": 823,
"event_record_id": 0,
"event_source_name": "",
"execution": {
"process_id": 10004,
"thread_id": 7236
},
"guid": "",
"keywords": 0,
"level": 4,
"opcode": 2,
"provider": "Microsoft-IE",
"security": {
"user_id": ""
},
"task": 0,
"time_created": "2026-07-21 22:09:33.239Z",
"version": 0
},
"event_data": {
"IsIgnoredInTelemetry": false,
"ScriptExecutionTime": 0,
"TaskName": "CServer::SendOnDataChange"
},
"message": ""
}
Event ID 824: Mshtml_Gwnd_Task_Queued
#Fields #
| Name | Description |
|---|---|
TaskName AnsiString | |
ObjectPointer Pointer |
Example Event #
{
"system": {
"channel": "Unknown",
"computer": "10.2.10.21",
"correlation": {},
"event_id": 824,
"event_record_id": 0,
"event_source_name": "",
"execution": {
"process_id": 10004,
"thread_id": 7236
},
"guid": "",
"keywords": 0,
"level": 4,
"opcode": 0,
"provider": "Microsoft-IE",
"security": {
"user_id": ""
},
"task": 0,
"time_created": "2026-07-21 22:09:33.215Z",
"version": 0
},
"event_data": {
"ObjectPointer": "0x21C46C40020",
"TaskName": "CServer::SendOnDataChange"
},
"message": ""
}
Event ID 825: Mshtml_Input_TaskStart
#Fields #
| Name | Description |
|---|---|
TaskName AnsiString | |
ObjectPointer Pointer | |
DelayTime UInt32 |
Event ID 826: Mshtml_Input_TaskStop
#Fields #
| Name | Description |
|---|---|
TaskName AnsiString | |
ScriptExecutionTime UInt32 | |
IsIgnoredInTelemetry Boolean |
Event ID 833: Mshtml_EventLoop_QueueSentinel
#Fields #
| Name | Description |
|---|---|
Priority Int32 |
Example Event #
{
"system": {
"channel": "Unknown",
"computer": "10.2.10.21",
"correlation": {},
"event_id": 833,
"event_record_id": 0,
"event_source_name": "",
"execution": {
"process_id": 10004,
"thread_id": 7236
},
"guid": "",
"keywords": 0,
"level": 4,
"opcode": 0,
"provider": "Microsoft-IE",
"security": {
"user_id": ""
},
"task": 0,
"time_created": "2026-07-21 22:09:33.227Z",
"version": 0
},
"event_data": {
"Priority": 2
},
"message": ""
}
Event ID 834: Mshtml_EventLoop_OnSentinelFired
#Fields #
| Name | Description |
|---|---|
Priority Int32 | |
NestingLevel Int32 |
Example Event #
{
"system": {
"channel": "Unknown",
"computer": "10.2.10.21",
"correlation": {},
"event_id": 834,
"event_record_id": 0,
"event_source_name": "",
"execution": {
"process_id": 10004,
"thread_id": 7236
},
"guid": "",
"keywords": 0,
"level": 4,
"opcode": 0,
"provider": "Microsoft-IE",
"security": {
"user_id": ""
},
"task": 0,
"time_created": "2026-07-21 22:09:33.239Z",
"version": 0
},
"event_data": {
"NestingLevel": 0,
"Priority": 2
},
"message": ""
}
Event ID 835: Mshtml_EventLoop_RunReadiedTasksStart
#Fields #
| Name | Description |
|---|---|
TaskQueueIndex Int32 | |
NestingLevel Int32 | |
TaskConsideredReadyTimeInUs UInt64 |
Example Event #
{
"system": {
"channel": "Unknown",
"computer": "10.2.10.21",
"correlation": {},
"event_id": 835,
"event_record_id": 0,
"event_source_name": "",
"execution": {
"process_id": 10004,
"thread_id": 7236
},
"guid": "",
"keywords": 0,
"level": 4,
"opcode": 1,
"provider": "Microsoft-IE",
"security": {
"user_id": ""
},
"task": 0,
"time_created": "2026-07-21 22:09:33.136Z",
"version": 0
},
"event_data": {
"NestingLevel": 0,
"TaskConsideredReadyTimeInUs": 18446744073709551615,
"TaskQueueIndex": 5
},
"message": ""
}
Event ID 836: Mshtml_EventLoop_RunReadiedTasksStop
#Fields #
| Name | Description |
|---|---|
TaskQueueIndex Int32 | |
NestingLevel Int32 | |
TaskConsideredReadyTimeInUs UInt64 |
Example Event #
{
"system": {
"channel": "Unknown",
"computer": "10.2.10.21",
"correlation": {},
"event_id": 836,
"event_record_id": 0,
"event_source_name": "",
"execution": {
"process_id": 10004,
"thread_id": 7236
},
"guid": "",
"keywords": 0,
"level": 4,
"opcode": 2,
"provider": "Microsoft-IE",
"security": {
"user_id": ""
},
"task": 0,
"time_created": "2026-07-21 22:09:33.136Z",
"version": 0
},
"event_data": {
"NestingLevel": 0,
"TaskConsideredReadyTimeInUs": 18446744073709551615,
"TaskQueueIndex": 5
},
"message": ""
}
Event ID 837: Mshtml_EventLoop_PerformMicrotaskCheckpointStart
#Fields #
| Name | Description |
|---|---|
IsPerformingMicrotaskCheckpoint Boolean |
Example Event #
{
"system": {
"channel": "Unknown",
"computer": "10.2.10.21",
"correlation": {},
"event_id": 837,
"event_record_id": 0,
"event_source_name": "",
"execution": {
"process_id": 10004,
"thread_id": 7236
},
"guid": "",
"keywords": 0,
"level": 4,
"opcode": 1,
"provider": "Microsoft-IE",
"security": {
"user_id": ""
},
"task": 0,
"time_created": "2026-07-21 22:09:33.136Z",
"version": 0
},
"event_data": {
"IsPerformingMicrotaskCheckpoint": false
},
"message": ""
}
Event ID 838: Mshtml_EventLoop_PerformMicrotaskCheckpointStop
#Fields #
| Name | Description |
|---|---|
IsPerformingMicrotaskCheckpoint Boolean |
Example Event #
{
"system": {
"channel": "Unknown",
"computer": "10.2.10.21",
"correlation": {},
"event_id": 838,
"event_record_id": 0,
"event_source_name": "",
"execution": {
"process_id": 10004,
"thread_id": 7236
},
"guid": "",
"keywords": 0,
"level": 4,
"opcode": 2,
"provider": "Microsoft-IE",
"security": {
"user_id": ""
},
"task": 0,
"time_created": "2026-07-21 22:09:33.136Z",
"version": 0
},
"event_data": {
"IsPerformingMicrotaskCheckpoint": false
},
"message": ""
}
Event ID 839: Mshtml_EventLoop_YieldTaskExecution
#Fields #
| Name | Description |
|---|---|
TaskQueueIndex Int32 | |
PendingTaskCount Int32 |
Example Event #
{
"system": {
"channel": "Unknown",
"computer": "10.2.10.21",
"correlation": {},
"event_id": 839,
"event_record_id": 0,
"event_source_name": "",
"execution": {
"process_id": 10004,
"thread_id": 7236
},
"guid": "",
"keywords": 0,
"level": 4,
"opcode": 0,
"provider": "Microsoft-IE",
"security": {
"user_id": ""
},
"task": 0,
"time_created": "2026-07-21 22:09:33.905Z",
"version": 0
},
"event_data": {
"PendingTaskCount": 2,
"TaskQueueIndex": 1
},
"message": ""
}
Event ID 840: Mshtml_WebRTC_Ice_Connection_State
#Fields #
| Name | Description |
|---|---|
State UnicodeString | |
ThisPtr Pointer |
Event ID 841: Mshtml_WebRTC_Ice_Gathering_State
#Fields #
| Name | Description |
|---|---|
State UnicodeString | |
ThisPtr Pointer |
Event ID 842: Mshtml_WebRTC_Signaling_State
#Fields #
| Name | Description |
|---|---|
State UnicodeString | |
ThisPtr Pointer |
Event ID 843: Mshtml_WebRTC_Gathered_Ice_Candidate
#Fields #
| Name | Description |
|---|---|
Candidate UnicodeString | |
Mid UnicodeString | |
SdpMLineIndex UInt16 | |
ThisPtr Pointer |
Event ID 844: Mshtml_WebRTC_Add_Ice_Candidate
#Fields #
| Name | Description |
|---|---|
Candidate UnicodeString | |
Mid UnicodeString | |
SdpMLineIndex UInt16 | |
ThisPtr Pointer |
Event ID 845: Mshtml_ElementFromPointCache_Hit
#Fields #
| Name | Description |
|---|---|
WindowObject Pointer | |
X Float | |
Y Float | |
Flags Int32 | |
DocumentObject Pointer | |
RelativeToLayoutViewport Boolean | |
SameMarkup Boolean | |
ClipToViewport Boolean |
Event ID 846: Mshtml_ElementFromPointCache_Miss
#Fields #
| Name | Description |
|---|---|
WindowObject Pointer | |
X Float | |
Y Float | |
Flags Int32 | |
DocumentObject Pointer | |
RelativeToLayoutViewport Boolean | |
SameMarkup Boolean | |
ClipToViewport Boolean |
Event ID 847: Mshtml_PowerStateController_Register
#Fields #
| Name | Description |
|---|---|
CPowerStateController Pointer | |
CDoc Pointer |
Event ID 848: Mshtml_PowerStateController_Unregister
#Fields #
| Name | Description |
|---|---|
CPowerStateController Pointer | |
CDoc Pointer |
Event ID 849: Mshtml_PowerStateController_Visible
#Fields #
| Name | Description |
|---|---|
CPowerStateController Pointer | |
CDoc Pointer |
Event ID 850: Mshtml_PowerStateController_Invisible
#Fields #
| Name | Description |
|---|---|
CPowerStateController Pointer | |
CDoc Pointer |
Event ID 851: Mshtml_PowerStateController_LowPowerState
#Fields #
| Name | Description |
|---|---|
CPowerStateController Pointer | |
CDoc Pointer |
Event ID 852: Mshtml_PowerStateController_NormalPowerState
#Fields #
| Name | Description |
|---|---|
CPowerStateController Pointer | |
CDoc Pointer |
Event ID 853: Mshtml_EventLoop_MessageGroupCallbackRePost
#Example Event #
{
"system": {
"channel": "Unknown",
"computer": "10.2.10.21",
"correlation": {},
"event_id": 853,
"event_record_id": 0,
"event_source_name": "",
"execution": {
"process_id": 10004,
"thread_id": 7236
},
"guid": "",
"keywords": 0,
"level": 4,
"opcode": 0,
"provider": "Microsoft-IE",
"security": {
"user_id": ""
},
"task": 0,
"time_created": "2026-07-21 22:09:33.224Z",
"version": 0
},
"event_data": {},
"message": ""
}
Event ID 854: Mshtml_EventLoop_MessageGroupCallbackStop
#Fields #
| Name | Description |
|---|---|
AllowExecution Boolean |
Example Event #
{
"system": {
"channel": "Unknown",
"computer": "10.2.10.21",
"correlation": {},
"event_id": 854,
"event_record_id": 0,
"event_source_name": "",
"execution": {
"process_id": 10004,
"thread_id": 7236
},
"guid": "",
"keywords": 0,
"level": 4,
"opcode": 0,
"provider": "Microsoft-IE",
"security": {
"user_id": ""
},
"task": 0,
"time_created": "2026-07-21 22:09:33.293Z",
"version": 0
},
"event_data": {
"AllowExecution": true
},
"message": ""
}
Event ID 855: Mshtml_EventLoop_MessageGroupEnable
#Example Event #
{
"system": {
"channel": "Unknown",
"computer": "10.2.10.21",
"correlation": {},
"event_id": 855,
"event_record_id": 0,
"event_source_name": "",
"execution": {
"process_id": 10004,
"thread_id": 7236
},
"guid": "",
"keywords": 0,
"level": 4,
"opcode": 0,
"provider": "Microsoft-IE",
"security": {
"user_id": ""
},
"task": 0,
"time_created": "2026-07-21 22:09:33.215Z",
"version": 0
},
"event_data": {},
"message": ""
}
Event ID 856: Mshtml_EventLoop_MessageGroupAlreadyQueued
#Example Event #
{
"system": {
"channel": "Unknown",
"computer": "10.2.10.21",
"correlation": {},
"event_id": 856,
"event_record_id": 0,
"event_source_name": "",
"execution": {
"process_id": 10004,
"thread_id": 6600
},
"guid": "",
"keywords": 0,
"level": 4,
"opcode": 0,
"provider": "Microsoft-IE",
"security": {
"user_id": ""
},
"task": 0,
"time_created": "2026-07-21 22:09:33.221Z",
"version": 0
},
"event_data": {},
"message": ""
}
Event ID 857: Mshtml_EventLoop_DriveRegularTasksFromLow
#Fields #
| Name | Description |
|---|---|
CancelledLowPri Boolean |
Event ID 858: Mshtml_EventLoop_DriveRegularTasks
#Example Event #
{
"system": {
"channel": "Unknown",
"computer": "10.2.10.21",
"correlation": {},
"event_id": 858,
"event_record_id": 0,
"event_source_name": "",
"execution": {
"process_id": 10004,
"thread_id": 7236
},
"guid": "",
"keywords": 0,
"level": 4,
"opcode": 0,
"provider": "Microsoft-IE",
"security": {
"user_id": ""
},
"task": 0,
"time_created": "2026-07-21 22:09:33.239Z",
"version": 0
},
"event_data": {},
"message": ""
}
Event ID 860: Mshtml_Canvas_CommandListStart
#Fields #
| Name | Description |
|---|---|
CommandList Pointer | |
NumCommands UInt32 | |
BytesUsed UInt32 |
Event ID 861: Mshtml_Canvas_CommandListStop
#Event ID 863: Edgehtml_Extensions_WrxMessageStart
#Fields #
| Name | Description |
|---|---|
To Binary | |
From Binary | |
PayloadSize UInt32 | |
Header UInt32 |
Event ID 865: Edgehtml_Extensions_WrxMessageStop
#Event ID 866: Mshtml_Container_Size
#Fields #
| Name | Description |
|---|---|
Container Pointer | |
Capacity UInt32 | |
InUse UInt32 |
Example Event #
{
"system": {
"channel": "Unknown",
"computer": "10.2.10.21",
"correlation": {},
"event_id": 866,
"event_record_id": 0,
"event_source_name": "",
"execution": {
"process_id": 10004,
"thread_id": 7236
},
"guid": "",
"keywords": 0,
"level": 4,
"opcode": 0,
"provider": "Microsoft-IE",
"security": {
"user_id": ""
},
"task": 0,
"time_created": "2026-07-21 22:09:33.136Z",
"version": 0
},
"event_data": {
"Capacity": 0,
"Container": "0x74C1FFEE90",
"InUse": 0
},
"message": ""
}
Event ID 867: Mshtml_AlignedBeat_Timer_Beat
#Fields #
| Name | Description |
|---|---|
Object UInt64 | |
Value UInt64 |
Example Event #
{
"system": {
"channel": "Unknown",
"computer": "10.2.10.21",
"correlation": {},
"event_id": 867,
"event_record_id": 0,
"event_source_name": "",
"execution": {
"process_id": 10004,
"thread_id": 7236
},
"guid": "",
"keywords": 0,
"level": 4,
"opcode": 0,
"provider": "Microsoft-IE",
"security": {
"user_id": ""
},
"task": 0,
"time_created": "2026-07-21 22:09:33.295Z",
"version": 0
},
"event_data": {
"Object": 2320467480576,
"Value": 45451575
},
"message": ""
}
Provenance
ETW provider GUID 9e3b3947-ca5d-4614-91a2-7b624e0e7244
Defined in edgehtml.dll, which carries the event manifest.
- WS2022-20348.4893, schema read from the registered manifest, binary version 11.00.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB
- Win11-26200.6584, schema read from the registered manifest, binary version 11.00.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB
- JD-WIN11-22H2-1-native-20260719, sample captured from a live trace, binary version 11.00.22621.1, captured 2026-07-19
Native ETL capture of controlled local mshta HTML workloads; identifiers were sanitized in catalog examples.