Microsoft-Windows-AppHost
111 events across 5 channels
Event ID 101: The App Host failed to launch because a problem occurred while loading the app files and settings.
#Description
The App Host failed to launch because a problem occurred while loading the app files and settings. Ensure that the app is properly installed or try reinstalling the app.
Message #
Event ID 102: The App Host has encountered an unexpected error and will terminate.
#Event ID 112: WWAJSE report submitted with parameters 1: <param1> 2: <param2> 3: <param3> 4: <param4> 5: <param5> 6: <param6>.
#Description
WWAJSE report submitted with parameters 1: <param1> 2: <param2> 3: <param3> 4: <param4> 5: <param5> 6: <param6>. (PID: <PID>. Process Creation Time: <ProcessCreationTime>. App Binary Path: <ApplicationBinaryPath>.) Report Id: <ReportId>.
Message #
Fields #
| Name | Description |
|---|---|
WWAJSERacReportEvent.param1 UnicodeString | |
WWAJSERacReportEvent.param2 UnicodeString | |
WWAJSERacReportEvent.param3 UnicodeString | |
WWAJSERacReportEvent.param4 UnicodeString | |
WWAJSERacReportEvent.param5 UnicodeString | |
WWAJSERacReportEvent.param6 UnicodeString | |
WWAJSERacReportEvent.PID Int32 | |
WWAJSERacReportEvent.ProcessCreationTime UnicodeString | |
WWAJSERacReportEvent.ApplicationBinaryPath UnicodeString | |
WWAJSERacReportEvent.ReportId UnicodeString | |
param1 UnicodeString | |
param2 UnicodeString | |
param3 UnicodeString | |
param4 UnicodeString | |
param5 UnicodeString | |
param6 UnicodeString | |
PID Int32 | |
ProcessCreationTime UnicodeString | |
ApplicationBinaryPath UnicodeString | |
ReportId UnicodeString |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-AppHost",
"guid": "{98E0765D-8C42-44A3-A57B-760D7F93225A}",
"event_source_name": "",
"event_id": 112,
"version": 0,
"level": 4,
"task": 8,
"opcode": 14,
"keywords": -9223372036854775807,
"time_created": "2026-05-30T01:59:53.2155499+00:00",
"event_record_id": 4,
"correlation": {},
"execution": {
"process_id": 8300,
"thread_id": 704
},
"channel": "Microsoft-Windows-AppHost/Admin",
"computer": "JD-DC01-2022.ludus.domain",
"security": {
"user_id": "S-1-5-21-1006758700-2167138679-1475694448-1105"
}
},
"user_data": {
"WWAJSERacReportEvent": {
"param1": "Microsoft.Windows.CloudExperienceHost_10.0.20348.1_neutral_neutral_cw5n1h2txyewy",
"param2": "App",
"param3": "f675",
"param4": "FFFFFFFD",
"param5": "(null)",
"param6": "0_0",
"PID": "8300",
"ProcessCreationTime": "1dcefd80069de95",
"ApplicationBinaryPath": "C:\\Windows\\system32\\wwahost.exe",
"ReportId": "5464222b-d126-4816-a885-60fc1cf0bf9e"
}
},
"message": "WWAJSE report submitted with parameters 1: <Microsoft.Windows.CloudExperienceHost_10.0.20348.1_neutral_neutral_cw5n1h2txyewy> 2: <App> 3: <f675> 4: <FFFFFFFD> 5: <(null)> 6: <0_0>. (PID: <8300>. Process Creation Time: <1dcefd80069de95>. App Binary Path: <C:\\Windows\\system32\\wwahost.exe>.) Report Id: <5464222b-d126-4816-a885-60fc1cf0bf9e>"
}
Event ID 121: The App Host failed to enumerate WinRT namespaces due to an issue with a winmd file.
#Description
The App Host failed to enumerate WinRT namespaces due to an issue with a winmd file. If you have third party winmd files ensure they are not corrupt and that their filenames match their corresponding namespace names.
Message #
Fields #
| Name | Description |
|---|---|
HResultErrorCode HexInt32 | |
PID Int32 | |
PackageFullName UnicodeString | |
AppUserModelId UnicodeString |
Event ID 122: The App Host failed to enumerate WinRT namespaces due to unknown error.
#Event ID 126: App <.
#Description
App <ApplicationName> crashed with an unhandled Javascript exception. App details are as follows: Display Name:<DisplayName>, AppUserModelId: <AppUserModelId> Package Identity:<PackageFullName> PID:<ProcessId>. The details of the JavaScript exception are as follows Exception Name:<ErrorType>, Description:<ErrorDescription>, HTML Document Path:<DocumentFile>, Source File Name:<SourceFile>, Source Line Number:<SourceLine>, Source Column Number:<SourceColumn>, and Stack Trace: StackTrace.
Message #
Fields #
| Name | Description |
|---|---|
DisplayName UnicodeString | |
ApplicationName UnicodeString | |
AppUserModelId UnicodeString | |
PackageFullName UnicodeString | |
ProcessId Int32 | |
ErrorType UnicodeString | |
ErrorDescription UnicodeString | |
DocumentFile UnicodeString | |
SourceFile UnicodeString | |
SourceLine Int32 | |
SourceColumn Int32 | |
StackTrace UnicodeString |
Event ID 127: App <.
#Description
App <WWATerminateApplication.ApplicationName> terminated itself by calling terminateApp API. App details are as follows: Display Name:<WWATerminateApplication.DisplayName>, AppUserModelId: <WWATerminateApplication.AppUserModelId> Package Identity:<WWATerminateApplication.PackageFullName> PID:<WWATerminateApplication.ProcessId>. The API was called from the context of the following HTML document: <WWATerminateApplication.DocumentFile>. Error object passed to terminateApp carried the following details Description:<WWATerminateApplication.ErrorDescription>, and Stack Trace:- WWATerminateApplication.StackTrace.
Message #
Fields #
| Name | Description |
|---|---|
WWATerminateApplication.DisplayName UnicodeString | |
WWATerminateApplication.ApplicationName UnicodeString | |
WWATerminateApplication.AppUserModelId UnicodeString | |
WWATerminateApplication.PackageFullName UnicodeString | |
WWATerminateApplication.ProcessId Int32 | |
WWATerminateApplication.ErrorDescription UnicodeString | |
WWATerminateApplication.DocumentFile UnicodeString | |
WWATerminateApplication.StackTrace UnicodeString | |
DisplayName UnicodeString | |
ApplicationName UnicodeString | |
AppUserModelId UnicodeString | |
PackageFullName UnicodeString | |
ProcessId Int32 | |
ErrorDescription UnicodeString | |
DocumentFile UnicodeString | |
StackTrace UnicodeString |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-AppHost",
"guid": "{98E0765D-8C42-44A3-A57B-760D7F93225A}",
"event_source_name": "",
"event_id": 127,
"version": 0,
"level": 2,
"task": 8,
"opcode": 12,
"keywords": -9223372036854775807,
"time_created": "2026-05-30T01:59:53.1373982+00:00",
"event_record_id": 3,
"correlation": {},
"execution": {
"process_id": 8300,
"thread_id": 12668
},
"channel": "Microsoft-Windows-AppHost/Admin",
"computer": "JD-DC01-2022.ludus.domain",
"security": {
"user_id": "S-1-5-21-1006758700-2167138679-1475694448-1105"
}
},
"user_data": {
"WWATerminateApplication": {
"DisplayName": "Microsoft account",
"ApplicationName": "App",
"AppUserModelId": "Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy!App",
"PackageFullName": "Microsoft.Windows.CloudExperienceHost_10.0.20348.1_neutral_neutral_cw5n1h2txyewy",
"ProcessId": "8300",
"ErrorDescription": "{\"setPromise\":\"[function]\"}",
"DocumentFile": "/default.html",
"StackTrace": "Error: Scenario not set. If you are in debug mode, please launch with a URI.\n at AppManager.prototype._crashCxh (ms-appx://microsoft.windows.cloudexperiencehost/js/appManager.js:203:13)\n at AppManager.prototype._setScenario (ms-appx://microsoft.windows.cloudexperiencehost/js/appManager.js:369:17)\n at AppManager.prototype.initialize (ms-appx://microsoft.windows.cloudexperiencehost/js/appManager.js:75:13)\n at Anonymous function (ms-appx://microsoft.windows.cloudexperiencehost/js/default.js:46:13)\n at p (ms-appx://microsoft.windows.cloudexperiencehost/Microsoft.WinJS-reduced/js/base.js:2:37380)\n at M.enter (ms-appx://microsoft.windows.cloudexperiencehost/Microsoft.WinJS-reduced/js/base.js:2:40967)\n at _run (ms-appx://microsoft.windows.cloudexperiencehost/Microsoft.WinJS-reduced/js/base.js:2:42792)\n at _completed (ms-appx://microsoft.windows.cloudexperiencehost/Microsoft.WinJS-reduced/js/base.js:2:42233)\n at Anonymous function (ms-appx://microsoft.windows.cloudexperiencehost/core/js/require-helpers.js:12:13)\n at l.execCb (ms-appx://microsoft.windows.cloudexperiencehost/lib/require.js:26:290)\n"
}
},
"message": "App <App> terminated itself by calling terminateApp API. App details are as follows: Display Name:<Microsoft account>, AppUserModelId: <Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy!App> Package Identity:<Microsoft.Windows.CloudExperienceHost_10.0.20348.1_neutral_neutral_cw5n1h2txyewy> PID:<8300>. The API was called from the context of the following HTML document: </default.html>. Error object passed to terminateApp carried the following details Description:<{\"setPromise\":\"[function]\"}>, and Stack Trace:- Error: Scenario not set. If you are in debug mode, please launch with a URI.\n at AppManager.prototype._crashCxh (ms-appx://microsoft.windows.cloudexperiencehost/js/appManager.js:203:13)\n at AppManager.prototype._setScenario (ms-appx://microsoft.windows.cloudexperiencehost/js/appManager.js:369:17)\n at AppManager.prototype.initialize (ms-appx://microsoft.windows.cloudexperiencehost/js/appManager.js:75:13)\n at Anonymous function (ms-appx://microsoft.windows.cloudexperiencehost/js/default.js:46:13)\n at p (ms-appx://microsoft.windows.cloudexperiencehost/Microsoft.WinJS-reduced/js/base.js:2:37380)\n at M.enter (ms-appx://microsoft.windows.cloudexperiencehost/Microsoft.WinJS-reduced/js/base.js:2:40967)\n at _run (ms-appx://microsoft.windows.cloudexperiencehost/Microsoft.WinJS-reduced/js/base.js:2:42792)\n at _completed (ms-appx://microsoft.windows.cloudexperiencehost/Microsoft.WinJS-reduced/js/base.js:2:42233)\n at Anonymous function (ms-appx://microsoft.windows.cloudexperiencehost/core/js/require-helpers.js:12:13)\n at l.execCb (ms-appx://microsoft.windows.cloudexperiencehost/lib/require.js:26:290)\r\n."
}
Event ID 128: This app was closed because of a critical infrastructure failure.
#Event ID 129: This app was closed because one or more packages were modified.
#Event ID 131: App <.
#Description
App <ApplicationName> terminated itself by window.close() API, which is not recommended. App details are as follows: Display Name:<DisplayName>, AppUserModelId: <AppUserModelId> Package Identity:<PackageFullName> PID:<ProcessId>. The API was called from the context of the following HTML document: <DocumentFile>
Message #
Fields #
| Name | Description |
|---|---|
DisplayName UnicodeString | |
ApplicationName UnicodeString | |
AppUserModelId UnicodeString | |
PackageFullName UnicodeString | |
ProcessId Int32 | |
DocumentFile UnicodeString |
Event ID 132: App <.
#Description
App <ApplicationName> was terminated due to a navigation error with target url <TargetUrl> and error code <ErrorCode>. App details are as follows: Display Name:<DisplayName>, AppUserModelId: <AppUserModelId> Package Identity:<PackageFullName> PID:<ProcessId>. The Navigation was initiated from the context of the following HTML document: <DocumentFile>
Message #
Fields #
| Name | Description |
|---|---|
DisplayName UnicodeString | |
ApplicationName UnicodeString | |
AppUserModelId UnicodeString | |
PackageFullName UnicodeString | |
ProcessId Int32 | |
DocumentFile UnicodeString | |
TargetUrl UnicodeString | |
ErrorCode UnicodeString |
Event ID 133: The App Host could not start because the host module Module::Function failed with HResult.
#Event ID 134: The App Host could not start because the web module WebInstance::Module::Function failed with HResult.
#Event ID 135: The App Host could not start because the platform (WebInstance) failed with HResult.
#Event ID 136: The App Host could not start because WinRT failed to initialize with HResult.
#Event ID 137: Pending resume event was signaled to the Host.
#Event ID 500: Infrastructure.LifecycleAppHostOperationSucceeded
#Fields #
| Name | Description |
|---|---|
Function UnicodeString | |
Module UnicodeString | |
PID Int32 | |
PackageFullName UnicodeString | |
AppUserModelId UnicodeString |
Event ID 502: Infrastructure.LifecycleAppHostOperationSucceeded502
#Fields #
| Name | Description |
|---|---|
Function UnicodeString | |
Module UnicodeString | |
WebInstance Int32 | |
PID Int32 | |
PackageFullName UnicodeString | |
AppUserModelId UnicodeString |
Event ID 504: Infrastructure.LifecycleAppHostOperationSucceeded504
#Fields #
| Name | Description |
|---|---|
Action UnicodeString | |
WebInstance Int32 | |
PID Int32 | |
PackageFullName UnicodeString | |
AppUserModelId UnicodeString |
Event ID 506: SuspendingAppHostInformation
#Fields #
| Name | Description |
|---|---|
PID Int32 | |
PackageFullName UnicodeString | |
AppUserModelId UnicodeString |
Event ID 507: SuspendingAppHostInformation507
#Fields #
| Name | Description |
|---|---|
PID Int32 | |
PackageFullName UnicodeString | |
AppUserModelId UnicodeString |
Event ID 508: SuspendingAppHostInformation508
#Fields #
| Name | Description |
|---|---|
PID Int32 | |
PackageFullName UnicodeString | |
AppUserModelId UnicodeString |
Event ID 509: SuspendingAppHostInformation509
#Fields #
| Name | Description |
|---|---|
WindowType Int32 | |
WebPlatformSuspendDownloadPending Boolean | |
WebPlatformCleanupPending Boolean | |
WerReportDuringSuspend Boolean | |
suspendSubdownloadsCount Int32 | |
NewTimeout Int32 | |
CurrentTimeout Int32 | |
PID Int32 | |
TID Int32 | |
PackageFullName UnicodeString | |
AppUserModelId UnicodeString |
Event ID 511: SuspendingAppHostInformation511
#Fields #
| Name | Description |
|---|---|
PID Int32 | |
PackageFullName UnicodeString | |
AppUserModelId UnicodeString |
Event ID 512: SuspendingAppHostInformation512
#Fields #
| Name | Description |
|---|---|
PID Int32 | |
PackageFullName UnicodeString | |
AppUserModelId UnicodeString |
Event ID 513: SuspendingAppHostInformation513
#Fields #
| Name | Description |
|---|---|
PID Int32 | |
PackageFullName UnicodeString | |
AppUserModelId UnicodeString |
Event ID 514: Activation.ModuleInitializationAppHostInformation
#Fields #
| Name | Description |
|---|---|
PackageFullName UnicodeString | |
OSVersion HexInt64 | |
WebPlatformVersion HexInt64 | |
ScriptProjectionVersion HexInt32 |
Event ID 515: The App has subdownloads remaining to complete during suspension.
#Description
The App has subdownloads remaining to complete during suspension. Host has requested the system for more time.
Message #
Fields #
| Name | Description |
|---|---|
MainWebInstanceInitializeTime UInt64 | |
AppSuspendHandlerInvoked UInt64 | |
AppSuspendHandlerCompleted UInt64 | |
WebPlatformSuspendDownloadPending Boolean | |
WebPlatformSuspendDownloadCount Int32 | |
WebPlatformSuspendDownloadWaitStart UInt64 | |
WebPlatformCleanupPending Boolean | |
WebPlatformCleanupStart UInt64 | |
CurrentSuspendingTimeout Int32 | |
NewSuspendingTimeout Int32 | |
PID Int32 | |
PackageFullName UnicodeString | |
AppUserModelId UnicodeString |
Event ID 516: SuspendingInternalPlmTimeoutExprationAppHostInformation
#Fields #
| Name | Description |
|---|---|
WindowType Int32 | |
WebPlatformSuspendDownloadPending Boolean | |
WebPlatformCleanupPending Boolean | |
suspendSubdownloadsCount Int32 | |
PID Int32 | |
TID Int32 | |
PackageFullName UnicodeString | |
AppUserModelId UnicodeString |
Event ID 517: SuspendingSubDownloadsAppHostInformation
#Fields #
| Name | Description |
|---|---|
WindowType Int32 | |
WebPlatformSuspendDownloadPending Boolean | |
WebPlatformCleanupPending Boolean | |
PID Int32 | |
TID Int32 | |
PackageFullName UnicodeString | |
AppUserModelId UnicodeString |
Event ID 518: SuspendingGarbageCollectionAppHostInformation
#Fields #
| Name | Description |
|---|---|
WindowType Int32 | |
WebPlatformSuspendDownloadPending Boolean | |
WebPlatformCleanupPending Boolean | |
PID Int32 | |
TID Int32 | |
PackageFullName UnicodeString | |
AppUserModelId UnicodeString |
Event ID 1001: Navigation.NavigationDomain.DecisionStart
#Event ID 1002: Navigation.NavigationDomain.DecisionStop
#Event ID 1003: MswwaProtocol.PackageToFileUriStart
#Event ID 1004: MswwaProtocol.PackageToFileUriStop
#Event ID 1007: Activation.ModuleInitializationStart
#Event ID 1008: Activation.ModuleInitializationStop
#Event ID 1009: Infrastructure.Host.SetupStart
#Event ID 1010: Infrastructure.Host.SetupStop
#Event ID 1011: NavigationStart
#Fields #
| Name | Description |
|---|---|
ObjectWWA UInt64 | |
Counter UInt32 | |
PackageFullName UnicodeString | |
AppID UnicodeString | |
NavigationInfo HexInt32 |
Event ID 1012: NavigationStop
#Fields #
| Name | Description |
|---|---|
ObjectWWA UInt64 | |
Counter UInt32 | |
PackageFullName UnicodeString | |
AppID UnicodeString | |
NavigationInfo HexInt32 |
Event ID 1015: Telemetry.WERReportingStart
#Event ID 1016: Telemetry.WERReportingStop
#Event ID 1017: Infrastructure.Host.UptimeStart
#Event ID 1018: Infrastructure.Host.UptimeStop
#Event ID 1019: ApplicationActivateEventStart
#Fields #
| Name | Description |
|---|---|
PackageFullName UnicodeString | |
AppID UnicodeString | |
ContractID UnicodeString | |
IsReactivation UInt32 |
Event ID 1020: ApplicationActivateEventStop
#Fields #
| Name | Description |
|---|---|
PackageFullName UnicodeString | |
AppID UnicodeString | |
ContractID UnicodeString | |
IsReactivation UInt32 |
Event ID 1021: ApplicationTerminationStart
#Fields #
| Name | Description |
|---|---|
PackageFullName UnicodeString | |
AppID UnicodeString |
Event ID 1022: ApplicationTerminationStop
#Fields #
| Name | Description |
|---|---|
PackageFullName UnicodeString | |
AppID UnicodeString |
Event ID 1023: SuspendingStart
#Event ID 1024: SuspendingStop
#Event ID 1025: ResumingStart
#Event ID 1026: ResumingStop
#Event ID 1027: Infrastructure.WebInstance.SetupStart
#Event ID 1028: Infrastructure.WebInstance.SetupStop
#Event ID 1029: InputPanelShowStart
#Event ID 1030: InputPanelShowStop
#Event ID 1031: InputPanelHideStart
#Event ID 1032: InputPanelHideStop
#Event ID 1033: SuspendingSubDownloadsStart
#Event ID 1034: SuspendingSubDownloadsStop
#Event ID 1035: TerminateAppStart
#Event ID 1036: TerminateAppStop
#Event ID 1037: MswwaProtocol.AppDataToFileUriStart
#Event ID 1038: MswwaProtocol.AppDataToFileUriStop
#Event ID 1039: EvaluatePackageStart
#Event ID 1040: EvaluatePackageStop
#Event ID 1041: ResizeStart
#Event ID 1042: ResizeStop
#Event ID 1043: ViewStateStart
#Event ID 1044: ViewStateStop
#Event ID 1045: InputPanelResizeViewportStart
#Event ID 1046: InputPanelResizeViewportStop
#Event ID 1047: SuspendingGarbageCollectionStart
#Event ID 1048: SuspendingGarbageCollectionStop
#Event ID 1049: ThreadMrtInitializationStart
#Event ID 1050: ThreadMrtInitializationStop
#Event ID 1051: Infrastructure.Host.HostModulesInitializationStart
#Event ID 1052: Infrastructure.Host.HostModulesInitializationStop
#Event ID 1053: Infrastructure.Host.HostRunStart
#Event ID 1054: Infrastructure.Host.HostRunStop
#Event ID 1055: Infrastructure.WebInstance.InitializeStart
#Event ID 1056: Infrastructure.WebInstance.InitializeStop
#Event ID 1057: Infrastructure.WebInstance.DispatchStart
#Event ID 1058: Infrastructure.WebInstance.DispatchStop
#Event ID 1059: Infrastructure.WebInstance.RunStart
#Event ID 1060: Infrastructure.WebInstance.RunStop
#Event ID 1063: MemoryStatsOnSuspend
#Fields #
| Name | Description |
|---|---|
JSHeapSizeMB HexInt32 | |
TotalWorkingSetMBandPrivateCommitMB HexInt32 | |
PackageAgeS UInt32 | |
AppID UnicodeString | |
PackageFullName UnicodeString |
Event ID 1064: LayoutChangedStart
#Event ID 1065: LayoutChangedStop
#Event ID 1066: ApplicationActivateEvent
#Fields #
| Name | Description |
|---|---|
ToggleCount UInt32 | |
ToggleDetail UInt32 | |
PackageFullName UnicodeString | |
AppID UnicodeString |
Event ID 1069: LeavingBackgroundStart
#Event ID 1070: LeavingBackgroundStop
#Event ID 1071: EnteredBackgroundStart
#Event ID 1072: EnteredBackgroundStop
#Event ID 1073: BackgroundActivatedStart
#Event ID 1074: BackgroundActivatedStop
#Event ID 10000: SourceMessageId : Message.
#Event ID 10001: SourceMessageId : Message.
#Event ID 10002: SourceMessageId : Message.
#Event ID 10003: Suspending Deferral Increment.
#Event ID 10004: Suspending Deferral Decrement.
#Event ID 10005: Activation.CompleteActivationStart
#Event ID 10006: Activation.CompleteActivationStop
#Event ID 10009: NavigationStart10009
#Event ID 10010: NavigationStop10010
#Provenance
Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.
ETW provider GUID 98e0765d-8c42-44a3-a57b-760d7f93225a
Defined in wwahost.exe, which carries the event manifest.
Observed on:
- WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02
- Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02