Microsoft-Windows-COM-Perf

Event	Title	Channel	Sample	Rule
1	Windows_Runtime_ActivateInstance_InProc	CreateInstance	Y	N
2	Windows_Runtime_ActivateInstance_InProc	CreateInstance	Y	N
3	Windows_Runtime_ActivateInstance_OutOfProc	CreateInstance	Y	N
4	Windows_Runtime_ActivateInstance_OutOfProc	CreateInstance	Y	N
5	COM_CreateInstanceStart	CreateInstance	Y	N
6	COM_CreateInstanceStop	CreateInstance	Y	N
7	Windows_Runtime_GetActivationFactory_InProcStart	CreateInstance	Y	N
8	Windows_Runtime_GetActivationFactory_InProcStop	CreateInstance	Y	N
9	Windows_Runtime_GetActivationFactory_OutOfProc	CreateInstance	Y	N
10	Windows_Runtime_GetActivationFactory_OutOfProc	CreateInstance	Y	N
11	COM_GetClassObjectStart	CreateInstance	Y	N
12	COM_GetClassObjectStop	CreateInstance	Y	N
13	ExtensionCatalog_RoGetExtensionRegistrationStart	ExtensionCatalog	N	N
14	ExtensionCatalog_RoGetExtensionRegistrationStop	ExtensionCatalog	N	N
15	ExtensionCatalog_RoGetExtensionRegistrationByExtensionIdStart	ExtensionCatalog	N	N
16	ExtensionCatalog_RoGetExtensionRegistrationByExtensionIdStop	ExtensionCatalog	N	N
17	ExtensionCatalog_QueryCatalogStart	ExtensionCatalog	N	N
18	ExtensionCatalog_QueryCatalogStop	ExtensionCatalog	N	N
19	ExtensionCatalog_QueryCatalogByPackageFamilyStart	ExtensionCatalog	N	N
20	ExtensionCatalog_QueryCatalogByPackageFamilyStop	ExtensionCatalog	N	N
21	ExtensionCatalog_CustomPropertyLookupStart	ExtensionCatalog	N	N
22	ExtensionCatalog_CustomPropertyLookupStop	ExtensionCatalog	N	N
23	ExtensionCatalog_MoveNextStart	ExtensionCatalog	N	N
24	ExtensionCatalog_MoveNextStop	ExtensionCatalog	N	N
25	COM_CreateInstance_AppStart	CreateInstance	N	N
26	COM_CreateInstance_AppStop	CreateInstance	N	N
27	Windows_Runtime_BrokeredActivateInstanceStart	CreateInstance	N	N
28	Windows_Runtime_BrokeredActivateInstanceStop	CreateInstance	N	N
29	Windows_Runtime_BrokeredGetActivationFactoryStart	CreateInstance	N	N
30	Windows_Runtime_BrokeredGetActivationFactoryStop	CreateInstance	N	N
31	Windows_Runtime_GetActivationFactory_InprocServerImplStart	CreateInstance	Y	N
32	Windows_Runtime_GetActivationFactory_InprocServerImplStop	CreateInstance	Y	N
33	Windows_Runtime_ActivateInstance_InprocServerImpl	CreateInstance	Y	N
34	Windows_Runtime_ActivateInstance_InprocServerImpl	CreateInstance	Y	N
35	COM_GetClassFactory_InprocServerImplStart	CreateInstance	Y	N
36	COM_GetClassFactory_InprocServerImplStop	CreateInstance	Y	N
37	COM_CreateInstance_InprocServerImplStart	CreateInstance	N	N
38	COM_CreateInstance_InprocServerImplStop	CreateInstance	N	N
39	COM_ClientSyncCallStart_V1	Call	Y	N
40	COM_ClientSyncCallStop	Call	Y	N
41	COM_ClientAsyncCallStart_V1	Call	N	N
42	COM_ClientAsyncCallStop	Call	N	N
43	COM_ServerSyncCallStart_V2	Call	Y	N
44	COM_ServerSyncCallStop	Call	Y	N
45	COM_ServerAsyncCallStart_V1	Call	N	N
46	COM_ServerAsyncCallStop	Call	N	N
47	COM_FreeUnusedLibrary	FreeUnusedLibrary	Y	N
48	COM_ApartmentUninitialize	ApartmentUninitialize	Y	N
49	COM_ApartmentInitialize	ApartmentInitialize	Y	N
50	Windows_Runtime_DesktopBrokeredActivateInstanceStart	CreateInstance	N	N
51	Windows_Runtime_DesktopBrokeredActivateInstanceStop	CreateInstance	N	N
52	Windows_Runtime_DesktopBrokeredGetActivationFactoryStart	CreateInstance	N	N
53	Windows_Runtime_DesktopBrokeredGetActivationFactoryStop	CreateInstance	N	N
54	ExtensionCatalog_RoGetExtensionRegistrationForLaunchContractsStart	ExtensionCatalog	N	N
55	ExtensionCatalog_RoGetExtensionRegistrationForLaunchContractsStop	ExtensionCatalog	N	N

Event ID 1: Windows_Runtime_ActivateInstance_InProc

Channel: CreateInstance
Level: Informational
Task: Windows_Runtime_ActivateInstance_InProc
Opcode: Start

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-COM-Perf",
    "guid": "{B8D6861B-D20F-4EEC-BBAE-87E0DD80602B}",
    "event_source_name": "",
    "event_id": 1,
    "version": 0,
    "level": 4,
    "task": 1,
    "opcode": 1,
    "keywords": "0x0000000000000000",
    "time_created": "2026-06-02T05:14:44.109+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 4872,
      "thread_id": 5408
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": "Windows_Runtime_ActivateInstance_InProc"
}

Event ID 2: Windows_Runtime_ActivateInstance_InProc

Channel: CreateInstance
Level: Informational
Task: Windows_Runtime_ActivateInstance_InProc
Opcode: Stop

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-COM-Perf",
    "guid": "{B8D6861B-D20F-4EEC-BBAE-87E0DD80602B}",
    "event_source_name": "",
    "event_id": 2,
    "version": 0,
    "level": 4,
    "task": 1,
    "opcode": 2,
    "keywords": "0x0000000000000000",
    "time_created": "2026-06-02T05:14:44.109+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 4872,
      "thread_id": 5408
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": "Windows_Runtime_ActivateInstance_InProc"
}

Event ID 3: Windows_Runtime_ActivateInstance_OutOfProc

Channel: CreateInstance
Level: Informational
Task: Windows_Runtime_ActivateInstance_OutOfProc
Opcode: Start

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-COM-Perf",
    "guid": "{B8D6861B-D20F-4EEC-BBAE-87E0DD80602B}",
    "event_source_name": "",
    "event_id": 3,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 1,
    "keywords": "0x0000000000000000",
    "time_created": "2026-06-02T05:19:36.486+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 21480,
      "thread_id": 17688
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": "Windows_Runtime_ActivateInstance_OutOfProc"
}

Event ID 4: Windows_Runtime_ActivateInstance_OutOfProc

Channel: CreateInstance
Level: Informational
Task: Windows_Runtime_ActivateInstance_OutOfProc
Opcode: Stop

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-COM-Perf",
    "guid": "{B8D6861B-D20F-4EEC-BBAE-87E0DD80602B}",
    "event_source_name": "",
    "event_id": 4,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 2,
    "keywords": "0x0000000000000000",
    "time_created": "2026-06-02T05:19:36.501+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 21480,
      "thread_id": 17688
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": "Windows_Runtime_ActivateInstance_OutOfProc"
}

Event ID 5: COM_CreateInstanceStart

Channel: CreateInstance
Level: Informational
Task: COM_CreateInstance
Opcode: Start

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-COM-Perf",
    "guid": "{b8d6861b-d20f-4eec-bbae-87e0dd80602b}",
    "event_source_name": "",
    "event_id": "5",
    "version": "0",
    "level": "4",
    "task": "5",
    "opcode": "1",
    "keywords": 4611686018427387904,
    "time_created": "2026-03-15T04:33:21.215590600+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{bb8e93ce-8090-42ed-989b-719baa7c5499}"
    },
    "execution": {
      "process_id": "7284",
      "thread_id": "6724"
    },
    "channel": "Microsoft-Windows-COM/CreateInstance",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": ""
}

Event ID 6: COM_CreateInstanceStop

Channel: CreateInstance
Level: Informational
Task: COM_CreateInstance
Opcode: Stop

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-COM-Perf",
    "guid": "{b8d6861b-d20f-4eec-bbae-87e0dd80602b}",
    "event_source_name": "",
    "event_id": "6",
    "version": "0",
    "level": "4",
    "task": "5",
    "opcode": "2",
    "keywords": 4611686018427387904,
    "time_created": "2026-03-15T04:33:21.215605400+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{bb8e93ce-8090-42ed-989b-719baa7c5499}"
    },
    "execution": {
      "process_id": "7284",
      "thread_id": "6724"
    },
    "channel": "Microsoft-Windows-COM/CreateInstance",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": ""
}

Event ID 7: Windows_Runtime_GetActivationFactory_InProcStart

Channel: CreateInstance
Level: Informational
Task: Windows_Runtime_GetActivationFactory_InProc
Opcode: Start

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-COM-Perf",
    "guid": "{b8d6861b-d20f-4eec-bbae-87e0dd80602b}",
    "event_source_name": "",
    "event_id": "7",
    "version": "0",
    "level": "4",
    "task": "3",
    "opcode": "1",
    "keywords": 9223372036854775808,
    "time_created": "2026-03-15T23:27:29.195525300+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "9256",
      "thread_id": "9388"
    },
    "channel": "Microsoft-Windows-Runtime/CreateInstance",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": ""
}

Event ID 8: Windows_Runtime_GetActivationFactory_InProcStop

Channel: CreateInstance
Level: Informational
Task: Windows_Runtime_GetActivationFactory_InProc
Opcode: Stop

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-COM-Perf",
    "guid": "{b8d6861b-d20f-4eec-bbae-87e0dd80602b}",
    "event_source_name": "",
    "event_id": "8",
    "version": "0",
    "level": "4",
    "task": "3",
    "opcode": "2",
    "keywords": 9223372036854775808,
    "time_created": "2026-03-15T23:27:29.195535600+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "9256",
      "thread_id": "9388"
    },
    "channel": "Microsoft-Windows-Runtime/CreateInstance",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": ""
}

Event ID 9: Windows_Runtime_GetActivationFactory_OutOfProc

Channel: CreateInstance
Level: Informational
Task: Windows_Runtime_GetActivationFactory_OutOfProc
Opcode: Start

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-COM-Perf",
    "guid": "{B8D6861B-D20F-4EEC-BBAE-87E0DD80602B}",
    "event_source_name": "",
    "event_id": 9,
    "version": 0,
    "level": 4,
    "task": 4,
    "opcode": 1,
    "keywords": "0x0000000000000000",
    "time_created": "2026-06-02T05:14:43.611+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 2196,
      "thread_id": 22068
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": "Windows_Runtime_GetActivationFactory_OutOfProc"
}

Event ID 10: Windows_Runtime_GetActivationFactory_OutOfProc

Channel: CreateInstance
Level: Informational
Task: Windows_Runtime_GetActivationFactory_OutOfProc
Opcode: Stop

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-COM-Perf",
    "guid": "{B8D6861B-D20F-4EEC-BBAE-87E0DD80602B}",
    "event_source_name": "",
    "event_id": 10,
    "version": 0,
    "level": 4,
    "task": 4,
    "opcode": 2,
    "keywords": "0x0000000000000000",
    "time_created": "2026-06-02T05:14:43.615+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 2196,
      "thread_id": 22068
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": "Windows_Runtime_GetActivationFactory_OutOfProc"
}

Event ID 11: COM_GetClassObjectStart

Channel: CreateInstance
Level: Informational
Task: COM_GetClassObject
Opcode: Start

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-COM-Perf",
    "guid": "{b8d6861b-d20f-4eec-bbae-87e0dd80602b}",
    "event_source_name": "",
    "event_id": "11",
    "version": "0",
    "level": "4",
    "task": "7",
    "opcode": "1",
    "keywords": 4611686018427387904,
    "time_created": "2026-03-15T04:33:21.215516200+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{bb8e93ce-8090-42ed-989b-719baa7c5499}"
    },
    "execution": {
      "process_id": "4020",
      "thread_id": "2900"
    },
    "channel": "Microsoft-Windows-COM/CreateInstance",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": ""
}

Event ID 12: COM_GetClassObjectStop

Channel: CreateInstance
Level: Informational
Task: COM_GetClassObject
Opcode: Stop

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-COM-Perf",
    "guid": "{b8d6861b-d20f-4eec-bbae-87e0dd80602b}",
    "event_source_name": "",
    "event_id": "12",
    "version": "0",
    "level": "4",
    "task": "7",
    "opcode": "2",
    "keywords": 4611686018427387904,
    "time_created": "2026-03-15T04:33:21.215521300+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{bb8e93ce-8090-42ed-989b-719baa7c5499}"
    },
    "execution": {
      "process_id": "4020",
      "thread_id": "2900"
    },
    "channel": "Microsoft-Windows-COM/CreateInstance",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": ""
}

Event ID 13: ExtensionCatalog_RoGetExtensionRegistrationStart

Channel: ExtensionCatalog
Task: ExtensionCatalog_RoGetExtensionRegistration
Opcode: Start

Fields #

Name	Description
`ContractId` UnicodeString
`PackageId` UnicodeString
`ActivatableClassId` UnicodeString

Event ID 14: ExtensionCatalog_RoGetExtensionRegistrationStop

Channel: ExtensionCatalog
Task: ExtensionCatalog_RoGetExtensionRegistration
Opcode: Stop

Fields #

Name	Description
`HRESULT` Int32
`ContractId` UnicodeString
`PackageId` UnicodeString
`ActivatableClassId` UnicodeString
`InboxAppsRegistrationScope` Boolean

Event ID 15: ExtensionCatalog_RoGetExtensionRegistrationByExtensionIdStart

Channel: ExtensionCatalog
Task: ExtensionCatalog_RoGetExtensionRegistrationByExtensionId
Opcode: Start

Fields #

Name	Description
`ContractId` UnicodeString
`ExtensionId` UnicodeString

Event ID 16: ExtensionCatalog_RoGetExtensionRegistrationByExtensionIdStop

Channel: ExtensionCatalog
Task: ExtensionCatalog_RoGetExtensionRegistrationByExtensionId
Opcode: Stop

Fields #

Name	Description
`HRESULT` Int32
`ContractId` UnicodeString
`ExtensionId` UnicodeString
`InboxAppsRegistrationScope` Boolean

Event ID 17: ExtensionCatalog_QueryCatalogStart

Channel: ExtensionCatalog
Task: ExtensionCatalog_QueryCatalog
Opcode: Start

Fields #

Name	Description
`ContractId` UnicodeString

Event ID 18: ExtensionCatalog_QueryCatalogStop

Channel: ExtensionCatalog
Task: ExtensionCatalog_QueryCatalog
Opcode: Stop

Fields #

Name	Description
`HRESULT` Int32
`ContractId` UnicodeString

Event ID 19: ExtensionCatalog_QueryCatalogByPackageFamilyStart

Channel: ExtensionCatalog
Task: ExtensionCatalog_QueryCatalogByPackageFamily
Opcode: Start

Fields #

Name	Description
`ContractId` UnicodeString
`PackageFamilyName` UnicodeString

Event ID 20: ExtensionCatalog_QueryCatalogByPackageFamilyStop

Channel: ExtensionCatalog
Task: ExtensionCatalog_QueryCatalogByPackageFamily
Opcode: Stop

Fields #

Name	Description
`HRESULT` Int32
`ContractId` UnicodeString
`PackageFamilyName` UnicodeString

Event ID 21: ExtensionCatalog_CustomPropertyLookupStart

Channel: ExtensionCatalog
Task: ExtensionCatalog_CustomPropertyLookup
Opcode: Start

Fields #

Name	Description
`CustomPropertyKey` UnicodeString

Event ID 22: ExtensionCatalog_CustomPropertyLookupStop

Channel: ExtensionCatalog
Task: ExtensionCatalog_CustomPropertyLookup
Opcode: Stop

Fields #

Name	Description
`HRESULT` Int32
`CustomPropertyKey` UnicodeString

Event ID 23: ExtensionCatalog_MoveNextStart

Channel: ExtensionCatalog
Task: ExtensionCatalog_MoveNext
Opcode: Start

Fields #

Name	Description
`ContractId` UnicodeString

Event ID 24: ExtensionCatalog_MoveNextStop

Channel: ExtensionCatalog
Task: ExtensionCatalog_MoveNext
Opcode: Stop

Fields #

Name	Description
`HRESULT` Int32
`ContractId` UnicodeString
`PackageId` UnicodeString
`ActivatableClassId` UnicodeString
`InboxAppsRegistrationScope` Boolean

Event ID 25: COM_CreateInstance_AppStart

Channel: CreateInstance
Task: COM_CreateInstance_App
Opcode: Start

Event ID 26: COM_CreateInstance_AppStop

Channel: CreateInstance
Task: COM_CreateInstance_App
Opcode: Stop

Event ID 27: Windows_Runtime_BrokeredActivateInstanceStart

Channel: CreateInstance
Task: Windows_Runtime_BrokeredActivateInstance
Opcode: Start

Event ID 28: Windows_Runtime_BrokeredActivateInstanceStop

Channel: CreateInstance
Task: Windows_Runtime_BrokeredActivateInstance
Opcode: Stop

Event ID 29: Windows_Runtime_BrokeredGetActivationFactoryStart

Channel: CreateInstance
Task: Windows_Runtime_BrokeredGetActivationFactory
Opcode: Start

Event ID 30: Windows_Runtime_BrokeredGetActivationFactoryStop

Channel: CreateInstance
Task: Windows_Runtime_BrokeredGetActivationFactory
Opcode: Stop

Event ID 31: Windows_Runtime_GetActivationFactory_InprocServerImplStart

Channel: CreateInstance
Level: Informational
Task: Windows_Runtime_GetActivationFactory_InprocServerImpl
Opcode: Start

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-COM-Perf",
    "guid": "{b8d6861b-d20f-4eec-bbae-87e0dd80602b}",
    "event_source_name": "",
    "event_id": "31",
    "version": "0",
    "level": "4",
    "task": "16",
    "opcode": "1",
    "keywords": 9223372036854775808,
    "time_created": "2026-03-15T23:27:29.195529400+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "9256",
      "thread_id": "9388"
    },
    "channel": "Microsoft-Windows-Runtime/CreateInstance",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": ""
}

Event ID 32: Windows_Runtime_GetActivationFactory_InprocServerImplStop

Channel: CreateInstance
Level: Informational
Task: Windows_Runtime_GetActivationFactory_InprocServerImpl
Opcode: Stop

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-COM-Perf",
    "guid": "{b8d6861b-d20f-4eec-bbae-87e0dd80602b}",
    "event_source_name": "",
    "event_id": "32",
    "version": "0",
    "level": "4",
    "task": "16",
    "opcode": "2",
    "keywords": 9223372036854775808,
    "time_created": "2026-03-15T23:27:29.195534200+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "9256",
      "thread_id": "9388"
    },
    "channel": "Microsoft-Windows-Runtime/CreateInstance",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": ""
}

Event ID 33: Windows_Runtime_ActivateInstance_InprocServerImpl

Channel: CreateInstance
Level: Informational
Task: Windows_Runtime_ActivateInstance_InprocServerImpl
Opcode: Start

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-COM-Perf",
    "guid": "{B8D6861B-D20F-4EEC-BBAE-87E0DD80602B}",
    "event_source_name": "",
    "event_id": 33,
    "version": 0,
    "level": 4,
    "task": 17,
    "opcode": 1,
    "keywords": "0x0000000000000000",
    "time_created": "2026-06-02T05:14:44.109+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 4872,
      "thread_id": 5408
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": "Windows_Runtime_ActivateInstance_InprocServerImpl"
}

Event ID 34: Windows_Runtime_ActivateInstance_InprocServerImpl

Channel: CreateInstance
Level: Informational
Task: Windows_Runtime_ActivateInstance_InprocServerImpl
Opcode: Stop

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-COM-Perf",
    "guid": "{B8D6861B-D20F-4EEC-BBAE-87E0DD80602B}",
    "event_source_name": "",
    "event_id": 34,
    "version": 0,
    "level": 4,
    "task": 17,
    "opcode": 2,
    "keywords": "0x0000000000000000",
    "time_created": "2026-06-02T05:14:44.109+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 4872,
      "thread_id": 5408
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": "Windows_Runtime_ActivateInstance_InprocServerImpl"
}

Event ID 35: COM_GetClassFactory_InprocServerImplStart

Channel: CreateInstance
Level: Informational
Task: COM_GetClassFactory_InprocServerImpl
Opcode: Start

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-COM-Perf",
    "guid": "{b8d6861b-d20f-4eec-bbae-87e0dd80602b}",
    "event_source_name": "",
    "event_id": "35",
    "version": "0",
    "level": "4",
    "task": "18",
    "opcode": "1",
    "keywords": 4611686018427387904,
    "time_created": "2026-03-15T04:33:21.215510000+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{bb8e93ce-8090-42ed-989b-719baa7c5499}"
    },
    "execution": {
      "process_id": "4020",
      "thread_id": "2900"
    },
    "channel": "Microsoft-Windows-COM/CreateInstance",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": ""
}

Event ID 36: COM_GetClassFactory_InprocServerImplStop

Channel: CreateInstance
Level: Informational
Task: COM_GetClassFactory_InprocServerImpl
Opcode: Stop

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-COM-Perf",
    "guid": "{b8d6861b-d20f-4eec-bbae-87e0dd80602b}",
    "event_source_name": "",
    "event_id": "36",
    "version": "0",
    "level": "4",
    "task": "18",
    "opcode": "2",
    "keywords": 4611686018427387904,
    "time_created": "2026-03-15T04:33:21.215512100+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{bb8e93ce-8090-42ed-989b-719baa7c5499}"
    },
    "execution": {
      "process_id": "4020",
      "thread_id": "2900"
    },
    "channel": "Microsoft-Windows-COM/CreateInstance",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": ""
}

Event ID 37: COM_CreateInstance_InprocServerImplStart

Channel: CreateInstance
Task: COM_CreateInstance_InprocServerImpl
Opcode: Start

Event ID 38: COM_CreateInstance_InprocServerImplStop

Channel: CreateInstance
Task: COM_CreateInstance_InprocServerImpl
Opcode: Stop

Event ID 39: COM_ClientSyncCallStart_V1

Channel: Call
Also via: realtime ETW trace
Level: Informational
Task: COM_ClientSyncCall
Opcode: Start

Fields #

Name	Description
`CallTraceId` UInt32
`TargetProcessId` UInt32	Process ID of the target process.
`TargetThreadId` UInt32	Thread ID in the target process.
`CausalityId` GUID
`TargetMethod` UInt32
`TargetInterface` GUID
`ProxyInterfacePointer` Pointer
`ProxyManagerIUnknown` Pointer
`IPID` GUID
`OID` UInt64
`CallerLogicalThreadId` GUID
`CallerReturnAddress` Pointer
`WinrtAsyncPatternMethodIndicator` UInt32
`FakeSync` Boolean

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-COM-Perf",
    "guid": "{b8d6861b-d20f-4eec-bbae-87e0dd80602b}",
    "event_source_name": "",
    "event_id": "39",
    "version": "1",
    "level": "4",
    "task": "20",
    "opcode": "1",
    "keywords": 1152921504606846976,
    "time_created": "2026-03-15T04:33:23.259139100+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{ba28d8a0-fac6-4470-a0d3-5a9342b1e9c9}"
    },
    "execution": {
      "process_id": "4020",
      "thread_id": "6644"
    },
    "channel": "Microsoft-Windows-COM/Call",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "CallTraceId": " 1657669",
    "TargetProcessId": "    7284",
    "TargetThreadId": "       0",
    "CausalityId": "{f30f8aa7-9eee-465c-a796-709143fbd8d6}",
    "TargetMethod": "      19",
    "TargetInterface": "{9556dc99-828c-11cf-a37e-00aa003240c7}",
    "ProxyInterfacePointer": "0x2B273AF84C0",
    "ProxyManagerIUnknown": "0x2B2743B66B0",
    "IPID": "{0000d409-1c74-0000-7528-2c3638aa99db}",
    "OID": "3999546768768185921",
    "CallerLogicalThreadId": "{f30f8aa7-9eee-465c-a796-709143fbd8d6}",
    "CallerReturnAddress": "0x7FFD6A484F90",
    "WinrtAsyncPatternMethodIndicator": "       0",
    "FakeSync": "false"
  },
  "message": ""
}

Event ID 40: COM_ClientSyncCallStop

Channel: Call
Also via: realtime ETW trace
Level: Informational
Task: COM_ClientSyncCall
Opcode: Stop

Fields #

Name	Description
`CallTraceId` UInt32
`HRESULT` Int32
`SourceOfHRESULT` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-COM-Perf",
    "guid": "{b8d6861b-d20f-4eec-bbae-87e0dd80602b}",
    "event_source_name": "",
    "event_id": "40",
    "version": "0",
    "level": "4",
    "task": "20",
    "opcode": "2",
    "keywords": 1152921504606846976,
    "time_created": "2026-03-15T04:33:25.322550200+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{5eaf07a3-cc7f-444e-b51e-3196a39e1e34}"
    },
    "execution": {
      "process_id": "4020",
      "thread_id": "6644"
    },
    "channel": "Microsoft-Windows-COM/Call",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "CallTraceId": " 1657692",
    "HRESULT": "0",
    "SourceOfHRESULT": "       1"
  },
  "message": ""
}

Event ID 41: COM_ClientAsyncCallStart_V1

Channel: Call
Task: COM_ClientAsyncCall
Opcode: Start

Fields #

Name	Description
`CallTraceId` UInt32
`TargetProcessId` UInt32	Process ID of the target process.
`TargetThreadId` UInt32	Thread ID in the target process.
`CausalityId` GUID
`TargetMethod` UInt32
`TargetInterface` GUID
`TargetInterfaceAsyncUuid` GUID
`ProxyInterfacePointer` Pointer
`ProxyManagerIUnknown` Pointer
`IPID` GUID
`OID` UInt64
`CallerLogicalThreadId` GUID
`CallerReturnAddress` Pointer

Event ID 42: COM_ClientAsyncCallStop

Channel: Call
Task: COM_ClientAsyncCall
Opcode: Stop

Fields #

Name	Description
`CallTraceId` UInt32
`HRESULT` Int32
`SourceOfHRESULT` UInt32

Event ID 43: COM_ServerSyncCallStart_V2

Channel: Call
Also via: realtime ETW trace
Level: Informational
Task: COM_ServerSyncCall
Opcode: Start

Fields #

Name	Description
`CallTraceId` UInt32
`SourceProcessId` UInt32
`SourceThreadId` UInt32
`CausalityId` GUID
`TargetMethod` UInt32
`TargetInterface` GUID
`InterfacePointer` Pointer
`MethodAddress` Pointer
`ServerIUnknown` Pointer
`IPID` GUID
`OID` UInt64
`WinrtAsyncPatternMethodIndicator` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-COM-Perf",
    "guid": "{b8d6861b-d20f-4eec-bbae-87e0dd80602b}",
    "event_source_name": "",
    "event_id": "43",
    "version": "2",
    "level": "4",
    "task": "22",
    "opcode": "1",
    "keywords": 1152921504606846976,
    "time_created": "2026-03-15T04:33:21.215574700+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{7f29c7b7-c6e5-45f3-b006-ac5f75a40973}"
    },
    "execution": {
      "process_id": "7284",
      "thread_id": "6724"
    },
    "channel": "Microsoft-Windows-COM/Call",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "CallTraceId": "  689814",
    "SourceProcessId": "    4020",
    "SourceThreadId": "       0",
    "CausalityId": "{b5574a87-7c88-4fe1-b85b-682749eedd6f}",
    "TargetMethod": "      19",
    "TargetInterface": "{9556dc99-828c-11cf-a37e-00aa003240c7}",
    "InterfacePointer": "0x2535F4762E0",
    "MethodAddress": "0x7FF738171310",
    "ServerIUnknown": "0x2535F4762E0",
    "IPID": "{0000d409-1c74-0000-7528-2c3638aa99db}",
    "OID": "3999546768768185921",
    "WinrtAsyncPatternMethodIndicator": "       0"
  },
  "message": ""
}

Event ID 44: COM_ServerSyncCallStop

Channel: Call
Also via: realtime ETW trace
Level: Informational
Task: COM_ServerSyncCall
Opcode: Stop

Fields #

Name	Description
`CallTraceId` UInt32
`HRESULT` Int32
`ServerException` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-COM-Perf",
    "guid": "{b8d6861b-d20f-4eec-bbae-87e0dd80602b}",
    "event_source_name": "",
    "event_id": "44",
    "version": "0",
    "level": "4",
    "task": "22",
    "opcode": "2",
    "keywords": 1152921504606846976,
    "time_created": "2026-03-15T04:33:25.322506600+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{5eaf07a3-cc7f-444e-b51e-3196a39e1e34}"
    },
    "execution": {
      "process_id": "7284",
      "thread_id": "6724"
    },
    "channel": "Microsoft-Windows-COM/Call",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "CallTraceId": "  689857",
    "HRESULT": "0",
    "ServerException": "       0"
  },
  "message": ""
}

Event ID 45: COM_ServerAsyncCallStart_V1

Channel: Call
Task: COM_ServerAsyncCall
Opcode: Start

Fields #

Name	Description
`CallTraceId` UInt32
`SourceProcessId` UInt32
`SourceThreadId` UInt32
`CausalityId` GUID
`TargetMethod` UInt32
`TargetInterface` GUID
`TargetInterfaceAsyncUuid` GUID
`InterfacePointer` Pointer
`MethodAddress` Pointer
`ServerIUnknown` Pointer
`IPID` GUID
`OID` UInt64

Event ID 46: COM_ServerAsyncCallStop

Channel: Call
Task: COM_ServerAsyncCall
Opcode: Stop

Fields #

Name	Description
`CallTraceId` UInt32
`HRESULT` Int32
`ServerException` UInt32

Event ID 47: COM_FreeUnusedLibrary

Channel: FreeUnusedLibrary
Also via: realtime ETW trace
Level: Informational
Task: COM_FreeUnusedLibrary

Fields #

Name	Description
`ApartmentId64` UInt64
`AptId` UInt32
`AptKind` UInt8
`UnloadDelay` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-COM-Perf",
    "guid": "{b8d6861b-d20f-4eec-bbae-87e0dd80602b}",
    "event_source_name": "",
    "event_id": "47",
    "version": "0",
    "level": "4",
    "task": "24",
    "opcode": "0",
    "keywords": 576460752303423488,
    "time_created": "2026-03-15T23:27:28.521979700+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "12840",
      "thread_id": "3840"
    },
    "channel": "Microsoft-Windows-COM/FreeUnusedLibrary",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "ApartmentId64": "5",
    "AptId": "       0",
    "AptKind": "2",
    "UnloadDelay": "4294967295"
  },
  "message": ""
}

Event ID 48: COM_ApartmentUninitialize

Channel: ApartmentUninitialize
Also via: realtime ETW trace
Level: Informational
Task: COM_ApartmentUninitialize

Fields #

Name	Description
`ApartmentId64` UInt64
`AptId` UInt32
`AptKind` UInt8

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-COM-Perf",
    "guid": "{b8d6861b-d20f-4eec-bbae-87e0dd80602b}",
    "event_source_name": "",
    "event_id": "48",
    "version": "0",
    "level": "4",
    "task": "25",
    "opcode": "0",
    "keywords": 288230376151711744,
    "time_created": "2026-03-15T23:27:27.605190800+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "10408",
      "thread_id": "3732"
    },
    "channel": "Microsoft-Windows-COM/ApartmentUninitialize",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "ApartmentId64": "18446744069414584321",
    "AptId": "4294967295",
    "AptKind": "1"
  },
  "message": ""
}

Event ID 49: COM_ApartmentInitialize

Channel: ApartmentInitialize
Also via: realtime ETW trace
Level: Informational
Task: COM_ApartmentInitialize

Fields #

Name	Description
`ApartmentId64` UInt64
`AptId` UInt32
`AptKind` UInt8

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-COM-Perf",
    "guid": "{b8d6861b-d20f-4eec-bbae-87e0dd80602b}",
    "event_source_name": "",
    "event_id": "49",
    "version": "0",
    "level": "4",
    "task": "26",
    "opcode": "0",
    "keywords": 144115188075855872,
    "time_created": "2026-03-15T04:33:37.123009100+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "5820",
      "thread_id": "11756"
    },
    "channel": "Microsoft-Windows-COM/ApartmentInitialize",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "ApartmentId64": "0",
    "AptId": "   11756",
    "AptKind": "4"
  },
  "message": ""
}

Event ID 50: Windows_Runtime_DesktopBrokeredActivateInstanceStart

Channel: CreateInstance
Task: Windows_Runtime_DesktopBrokeredActivateInstance
Opcode: Start

Event ID 51: Windows_Runtime_DesktopBrokeredActivateInstanceStop

Channel: CreateInstance
Task: Windows_Runtime_DesktopBrokeredActivateInstance
Opcode: Stop

Event ID 52: Windows_Runtime_DesktopBrokeredGetActivationFactoryStart

Channel: CreateInstance
Task: Windows_Runtime_DesktopBrokeredGetActivationFactory
Opcode: Start

Event ID 53: Windows_Runtime_DesktopBrokeredGetActivationFactoryStop

Channel: CreateInstance
Task: Windows_Runtime_DesktopBrokeredGetActivationFactory
Opcode: Stop

Event ID 54: ExtensionCatalog_RoGetExtensionRegistrationForLaunchContractsStart

Channel: ExtensionCatalog
Task: ExtensionCatalog_RoGetExtensionRegistrationForLaunchContracts
Opcode: Start

Fields #

Name	Description
`ContractId` UnicodeString
`PackageId` UnicodeString

Event ID 55: ExtensionCatalog_RoGetExtensionRegistrationForLaunchContractsStop

Channel: ExtensionCatalog
Task: ExtensionCatalog_RoGetExtensionRegistrationForLaunchContracts
Opcode: Stop

Fields #

Name	Description
`HRESULT` Int32
`ContractId` UnicodeString
`PackageId` UnicodeString
`ActivatableClassId` UnicodeString
`InboxAppsRegistrationScope` Boolean

Provenance

ETW provider GUID {B8D6861B-D20F-4EEC-BBAE-87E0DD80602B}

Defined in combase.dll, which carries the event manifest.

WS2022-20348.4893, sample captured from a live trace, binary version 10.0.20348.2849, captured 2026-06-02 — Manifest XML pack, 1.9 MB
WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.2849, captured 2026-06-02 — Manifest XML pack, 1.9 MB
Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB