Microsoft-Windows-COM-Perf

55 events across 7 channels

Event	Title	Channel	Sample
1	Windows_Runtime_ActivateInstance_InProc	CreateInstance	Y
2	Windows_Runtime_ActivateInstance_InProc	CreateInstance	Y
3	Windows_Runtime_ActivateInstance_OutOfProc	CreateInstance	Y
4	Windows_Runtime_ActivateInstance_OutOfProc	CreateInstance	Y
5	COM_CreateInstanceStart	CreateInstance	Y
6	COM_CreateInstanceStop	CreateInstance	Y
7	Windows_Runtime_GetActivationFactory_InProcStart	CreateInstance	Y
8	Windows_Runtime_GetActivationFactory_InProcStop	CreateInstance	Y
9	Windows_Runtime_GetActivationFactory_OutOfProc	CreateInstance	Y
10	Windows_Runtime_GetActivationFactory_OutOfProc	CreateInstance	Y
11	COM_GetClassObjectStart	CreateInstance	Y
12	COM_GetClassObjectStop	CreateInstance	Y
13	ExtensionCatalog_RoGetExtensionRegistrationStart	ExtensionCatalog	N
14	ExtensionCatalog_RoGetExtensionRegistrationStop	ExtensionCatalog	N
15	ExtensionCatalog_RoGetExtensionRegistrationByExtensionIdStart	ExtensionCatalog	N
16	ExtensionCatalog_RoGetExtensionRegistrationByExtensionIdStop	ExtensionCatalog	N
17	ExtensionCatalog_QueryCatalogStart	ExtensionCatalog	N
18	ExtensionCatalog_QueryCatalogStop	ExtensionCatalog	N
19	ExtensionCatalog_QueryCatalogByPackageFamilyStart	ExtensionCatalog	N
20	ExtensionCatalog_QueryCatalogByPackageFamilyStop	ExtensionCatalog	N
21	ExtensionCatalog_CustomPropertyLookupStart	ExtensionCatalog	N
22	ExtensionCatalog_CustomPropertyLookupStop	ExtensionCatalog	N
23	ExtensionCatalog_MoveNextStart	ExtensionCatalog	N
24	ExtensionCatalog_MoveNextStop	ExtensionCatalog	N
25	COM_CreateInstance_AppStart	CreateInstance	N
26	COM_CreateInstance_AppStop	CreateInstance	N
27	Windows_Runtime_BrokeredActivateInstanceStart	CreateInstance	N
28	Windows_Runtime_BrokeredActivateInstanceStop	CreateInstance	N
29	Windows_Runtime_BrokeredGetActivationFactoryStart	CreateInstance	N
30	Windows_Runtime_BrokeredGetActivationFactoryStop	CreateInstance	N
31	Windows_Runtime_GetActivationFactory_InprocServerImplStart	CreateInstance	Y
32	Windows_Runtime_GetActivationFactory_InprocServerImplStop	CreateInstance	Y
33	Windows_Runtime_ActivateInstance_InprocServerImpl	CreateInstance	Y
34	Windows_Runtime_ActivateInstance_InprocServerImpl	CreateInstance	Y
35	COM_GetClassFactory_InprocServerImplStart	CreateInstance	Y
36	COM_GetClassFactory_InprocServerImplStop	CreateInstance	Y
37	COM_CreateInstance_InprocServerImplStart	CreateInstance	N
38	COM_CreateInstance_InprocServerImplStop	CreateInstance	N
39	COM_ClientSyncCallStart_V1	Call	Y
40	COM_ClientSyncCallStop	Call	Y
41	COM_ClientAsyncCallStart_V1	Call	N
42	COM_ClientAsyncCallStop	Call	N
43	COM_ServerSyncCallStart_V2	Call	Y
44	COM_ServerSyncCallStop	Call	Y
45	COM_ServerAsyncCallStart_V1	Call	N
46	COM_ServerAsyncCallStop	Call	N
47	COM_FreeUnusedLibrary	FreeUnusedLibrary	Y
48	COM_ApartmentUninitialize	ApartmentUninitialize	Y
49	COM_ApartmentInitialize	ApartmentInitialize	Y
50	Windows_Runtime_DesktopBrokeredActivateInstanceStart	CreateInstance	N
51	Windows_Runtime_DesktopBrokeredActivateInstanceStop	CreateInstance	N
52	Windows_Runtime_DesktopBrokeredGetActivationFactoryStart	CreateInstance	N
53	Windows_Runtime_DesktopBrokeredGetActivationFactoryStop	CreateInstance	N
54	ExtensionCatalog_RoGetExtensionRegistrationForLaunchContractsStart	ExtensionCatalog	N
55	ExtensionCatalog_RoGetExtensionRegistrationForLaunchContractsStop	ExtensionCatalog	N

Event ID 1: Windows_Runtime_ActivateInstance_InProc

Provider: Microsoft-Windows-COM-Perf
Channel: CreateInstance
Level: Informational
Task: Windows_Runtime_ActivateInstance_InProc
Opcode: Start

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-COM-Perf",
    "guid": "{B8D6861B-D20F-4EEC-BBAE-87E0DD80602B}",
    "event_source_name": "",
    "event_id": 1,
    "version": 0,
    "level": 4,
    "task": 1,
    "opcode": 1,
    "keywords": "0x0000000000000000",
    "time_created": "2026-06-02T05:14:44.109+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 4872,
      "thread_id": 5408
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": "Windows_Runtime_ActivateInstance_InProc"
}

Event ID 2: Windows_Runtime_ActivateInstance_InProc

Provider: Microsoft-Windows-COM-Perf
Channel: CreateInstance
Level: Informational
Task: Windows_Runtime_ActivateInstance_InProc
Opcode: Stop

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-COM-Perf",
    "guid": "{B8D6861B-D20F-4EEC-BBAE-87E0DD80602B}",
    "event_source_name": "",
    "event_id": 2,
    "version": 0,
    "level": 4,
    "task": 1,
    "opcode": 2,
    "keywords": "0x0000000000000000",
    "time_created": "2026-06-02T05:14:44.109+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 4872,
      "thread_id": 5408
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": "Windows_Runtime_ActivateInstance_InProc"
}

Event ID 3: Windows_Runtime_ActivateInstance_OutOfProc

Provider: Microsoft-Windows-COM-Perf
Channel: CreateInstance
Level: Informational
Task: Windows_Runtime_ActivateInstance_OutOfProc
Opcode: Start

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-COM-Perf",
    "guid": "{B8D6861B-D20F-4EEC-BBAE-87E0DD80602B}",
    "event_source_name": "",
    "event_id": 3,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 1,
    "keywords": "0x0000000000000000",
    "time_created": "2026-06-02T05:19:36.486+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 21480,
      "thread_id": 17688
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": "Windows_Runtime_ActivateInstance_OutOfProc"
}

Event ID 4: Windows_Runtime_ActivateInstance_OutOfProc

Provider: Microsoft-Windows-COM-Perf
Channel: CreateInstance
Level: Informational
Task: Windows_Runtime_ActivateInstance_OutOfProc
Opcode: Stop

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-COM-Perf",
    "guid": "{B8D6861B-D20F-4EEC-BBAE-87E0DD80602B}",
    "event_source_name": "",
    "event_id": 4,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 2,
    "keywords": "0x0000000000000000",
    "time_created": "2026-06-02T05:19:36.501+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 21480,
      "thread_id": 17688
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": "Windows_Runtime_ActivateInstance_OutOfProc"
}

Event ID 5: COM_CreateInstanceStart

Provider: Microsoft-Windows-COM-Perf
Channel: CreateInstance
Level: Informational
Task: COM_CreateInstance
Opcode: Start

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-COM-Perf",
    "guid": "{b8d6861b-d20f-4eec-bbae-87e0dd80602b}",
    "event_source_name": "",
    "event_id": "5",
    "version": "0",
    "level": "4",
    "task": "5",
    "opcode": "1",
    "keywords": 4611686018427387904,
    "time_created": "2026-03-15T04:33:21.215590600+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{bb8e93ce-8090-42ed-989b-719baa7c5499}"
    },
    "execution": {
      "process_id": "7284",
      "thread_id": "6724"
    },
    "channel": "Microsoft-Windows-COM/CreateInstance",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": ""
}

Event ID 6: COM_CreateInstanceStop

Provider: Microsoft-Windows-COM-Perf
Channel: CreateInstance
Level: Informational
Task: COM_CreateInstance
Opcode: Stop

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-COM-Perf",
    "guid": "{b8d6861b-d20f-4eec-bbae-87e0dd80602b}",
    "event_source_name": "",
    "event_id": "6",
    "version": "0",
    "level": "4",
    "task": "5",
    "opcode": "2",
    "keywords": 4611686018427387904,
    "time_created": "2026-03-15T04:33:21.215605400+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{bb8e93ce-8090-42ed-989b-719baa7c5499}"
    },
    "execution": {
      "process_id": "7284",
      "thread_id": "6724"
    },
    "channel": "Microsoft-Windows-COM/CreateInstance",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": ""
}

Event ID 7: Windows_Runtime_GetActivationFactory_InProcStart

Provider: Microsoft-Windows-COM-Perf
Channel: CreateInstance
Level: Informational
Task: Windows_Runtime_GetActivationFactory_InProc
Opcode: Start

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-COM-Perf",
    "guid": "{b8d6861b-d20f-4eec-bbae-87e0dd80602b}",
    "event_source_name": "",
    "event_id": "7",
    "version": "0",
    "level": "4",
    "task": "3",
    "opcode": "1",
    "keywords": 9223372036854775808,
    "time_created": "2026-03-15T23:27:29.195525300+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "9256",
      "thread_id": "9388"
    },
    "channel": "Microsoft-Windows-Runtime/CreateInstance",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": ""
}

Event ID 8: Windows_Runtime_GetActivationFactory_InProcStop

Provider: Microsoft-Windows-COM-Perf
Channel: CreateInstance
Level: Informational
Task: Windows_Runtime_GetActivationFactory_InProc
Opcode: Stop

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-COM-Perf",
    "guid": "{b8d6861b-d20f-4eec-bbae-87e0dd80602b}",
    "event_source_name": "",
    "event_id": "8",
    "version": "0",
    "level": "4",
    "task": "3",
    "opcode": "2",
    "keywords": 9223372036854775808,
    "time_created": "2026-03-15T23:27:29.195535600+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "9256",
      "thread_id": "9388"
    },
    "channel": "Microsoft-Windows-Runtime/CreateInstance",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": ""
}

Event ID 9: Windows_Runtime_GetActivationFactory_OutOfProc

Provider: Microsoft-Windows-COM-Perf
Channel: CreateInstance
Level: Informational
Task: Windows_Runtime_GetActivationFactory_OutOfProc
Opcode: Start

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-COM-Perf",
    "guid": "{B8D6861B-D20F-4EEC-BBAE-87E0DD80602B}",
    "event_source_name": "",
    "event_id": 9,
    "version": 0,
    "level": 4,
    "task": 4,
    "opcode": 1,
    "keywords": "0x0000000000000000",
    "time_created": "2026-06-02T05:14:43.611+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 2196,
      "thread_id": 22068
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": "Windows_Runtime_GetActivationFactory_OutOfProc"
}

Event ID 10: Windows_Runtime_GetActivationFactory_OutOfProc

Provider: Microsoft-Windows-COM-Perf
Channel: CreateInstance
Level: Informational
Task: Windows_Runtime_GetActivationFactory_OutOfProc
Opcode: Stop

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-COM-Perf",
    "guid": "{B8D6861B-D20F-4EEC-BBAE-87E0DD80602B}",
    "event_source_name": "",
    "event_id": 10,
    "version": 0,
    "level": 4,
    "task": 4,
    "opcode": 2,
    "keywords": "0x0000000000000000",
    "time_created": "2026-06-02T05:14:43.615+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 2196,
      "thread_id": 22068
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": "Windows_Runtime_GetActivationFactory_OutOfProc"
}

Event ID 11: COM_GetClassObjectStart

Provider: Microsoft-Windows-COM-Perf
Channel: CreateInstance
Level: Informational
Task: COM_GetClassObject
Opcode: Start

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-COM-Perf",
    "guid": "{b8d6861b-d20f-4eec-bbae-87e0dd80602b}",
    "event_source_name": "",
    "event_id": "11",
    "version": "0",
    "level": "4",
    "task": "7",
    "opcode": "1",
    "keywords": 4611686018427387904,
    "time_created": "2026-03-15T04:33:21.215516200+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{bb8e93ce-8090-42ed-989b-719baa7c5499}"
    },
    "execution": {
      "process_id": "4020",
      "thread_id": "2900"
    },
    "channel": "Microsoft-Windows-COM/CreateInstance",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": ""
}

Event ID 12: COM_GetClassObjectStop

Provider: Microsoft-Windows-COM-Perf
Channel: CreateInstance
Level: Informational
Task: COM_GetClassObject
Opcode: Stop

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-COM-Perf",
    "guid": "{b8d6861b-d20f-4eec-bbae-87e0dd80602b}",
    "event_source_name": "",
    "event_id": "12",
    "version": "0",
    "level": "4",
    "task": "7",
    "opcode": "2",
    "keywords": 4611686018427387904,
    "time_created": "2026-03-15T04:33:21.215521300+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{bb8e93ce-8090-42ed-989b-719baa7c5499}"
    },
    "execution": {
      "process_id": "4020",
      "thread_id": "2900"
    },
    "channel": "Microsoft-Windows-COM/CreateInstance",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": ""
}

Event ID 13: ExtensionCatalog_RoGetExtensionRegistrationStart

Provider: Microsoft-Windows-COM-Perf
Channel: ExtensionCatalog
Task: ExtensionCatalog_RoGetExtensionRegistration
Opcode: Start

Fields #

Name	Description
`ContractId` UnicodeString
`PackageId` UnicodeString
`ActivatableClassId` UnicodeString

Event ID 14: ExtensionCatalog_RoGetExtensionRegistrationStop

Provider: Microsoft-Windows-COM-Perf
Channel: ExtensionCatalog
Task: ExtensionCatalog_RoGetExtensionRegistration
Opcode: Stop

Fields #

Name	Description
`HRESULT` Int32
`ContractId` UnicodeString
`PackageId` UnicodeString
`ActivatableClassId` UnicodeString
`InboxAppsRegistrationScope` Boolean

Event ID 15: ExtensionCatalog_RoGetExtensionRegistrationByExtensionIdStart

Provider: Microsoft-Windows-COM-Perf
Channel: ExtensionCatalog
Task: ExtensionCatalog_RoGetExtensionRegistrationByExtensionId
Opcode: Start

Fields #

Name	Description
`ContractId` UnicodeString
`ExtensionId` UnicodeString

Event ID 16: ExtensionCatalog_RoGetExtensionRegistrationByExtensionIdStop

Provider: Microsoft-Windows-COM-Perf
Channel: ExtensionCatalog
Task: ExtensionCatalog_RoGetExtensionRegistrationByExtensionId
Opcode: Stop

Fields #

Name	Description
`HRESULT` Int32
`ContractId` UnicodeString
`ExtensionId` UnicodeString
`InboxAppsRegistrationScope` Boolean

Event ID 17: ExtensionCatalog_QueryCatalogStart

Provider: Microsoft-Windows-COM-Perf
Channel: ExtensionCatalog
Task: ExtensionCatalog_QueryCatalog
Opcode: Start

Fields #

Name	Description
`ContractId` UnicodeString

Event ID 18: ExtensionCatalog_QueryCatalogStop

Provider: Microsoft-Windows-COM-Perf
Channel: ExtensionCatalog
Task: ExtensionCatalog_QueryCatalog
Opcode: Stop

Fields #

Name	Description
`HRESULT` Int32
`ContractId` UnicodeString

Event ID 19: ExtensionCatalog_QueryCatalogByPackageFamilyStart

Provider: Microsoft-Windows-COM-Perf
Channel: ExtensionCatalog
Task: ExtensionCatalog_QueryCatalogByPackageFamily
Opcode: Start

Fields #

Name	Description
`ContractId` UnicodeString
`PackageFamilyName` UnicodeString

Event ID 20: ExtensionCatalog_QueryCatalogByPackageFamilyStop

Provider: Microsoft-Windows-COM-Perf
Channel: ExtensionCatalog
Task: ExtensionCatalog_QueryCatalogByPackageFamily
Opcode: Stop

Fields #

Name	Description
`HRESULT` Int32
`ContractId` UnicodeString
`PackageFamilyName` UnicodeString

Event ID 21: ExtensionCatalog_CustomPropertyLookupStart

Provider: Microsoft-Windows-COM-Perf
Channel: ExtensionCatalog
Task: ExtensionCatalog_CustomPropertyLookup
Opcode: Start

Fields #

Name	Description
`CustomPropertyKey` UnicodeString

Event ID 22: ExtensionCatalog_CustomPropertyLookupStop

Provider: Microsoft-Windows-COM-Perf
Channel: ExtensionCatalog
Task: ExtensionCatalog_CustomPropertyLookup
Opcode: Stop

Fields #

Name	Description
`HRESULT` Int32
`CustomPropertyKey` UnicodeString

Event ID 23: ExtensionCatalog_MoveNextStart

Provider: Microsoft-Windows-COM-Perf
Channel: ExtensionCatalog
Task: ExtensionCatalog_MoveNext
Opcode: Start

Fields #

Name	Description
`ContractId` UnicodeString

Event ID 24: ExtensionCatalog_MoveNextStop

Provider: Microsoft-Windows-COM-Perf
Channel: ExtensionCatalog
Task: ExtensionCatalog_MoveNext
Opcode: Stop

Fields #

Name	Description
`HRESULT` Int32
`ContractId` UnicodeString
`PackageId` UnicodeString
`ActivatableClassId` UnicodeString
`InboxAppsRegistrationScope` Boolean

Event ID 25: COM_CreateInstance_AppStart

Provider: Microsoft-Windows-COM-Perf
Channel: CreateInstance
Task: COM_CreateInstance_App
Opcode: Start

Event ID 26: COM_CreateInstance_AppStop

Provider: Microsoft-Windows-COM-Perf
Channel: CreateInstance
Task: COM_CreateInstance_App
Opcode: Stop

Event ID 27: Windows_Runtime_BrokeredActivateInstanceStart

Provider: Microsoft-Windows-COM-Perf
Channel: CreateInstance
Task: Windows_Runtime_BrokeredActivateInstance
Opcode: Start

Event ID 28: Windows_Runtime_BrokeredActivateInstanceStop

Provider: Microsoft-Windows-COM-Perf
Channel: CreateInstance
Task: Windows_Runtime_BrokeredActivateInstance
Opcode: Stop

Event ID 29: Windows_Runtime_BrokeredGetActivationFactoryStart

Provider: Microsoft-Windows-COM-Perf
Channel: CreateInstance
Task: Windows_Runtime_BrokeredGetActivationFactory
Opcode: Start

Event ID 30: Windows_Runtime_BrokeredGetActivationFactoryStop

Provider: Microsoft-Windows-COM-Perf
Channel: CreateInstance
Task: Windows_Runtime_BrokeredGetActivationFactory
Opcode: Stop

Event ID 31: Windows_Runtime_GetActivationFactory_InprocServerImplStart

Provider: Microsoft-Windows-COM-Perf
Channel: CreateInstance
Level: Informational
Task: Windows_Runtime_GetActivationFactory_InprocServerImpl
Opcode: Start

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-COM-Perf",
    "guid": "{b8d6861b-d20f-4eec-bbae-87e0dd80602b}",
    "event_source_name": "",
    "event_id": "31",
    "version": "0",
    "level": "4",
    "task": "16",
    "opcode": "1",
    "keywords": 9223372036854775808,
    "time_created": "2026-03-15T23:27:29.195529400+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "9256",
      "thread_id": "9388"
    },
    "channel": "Microsoft-Windows-Runtime/CreateInstance",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": ""
}

Event ID 32: Windows_Runtime_GetActivationFactory_InprocServerImplStop

Provider: Microsoft-Windows-COM-Perf
Channel: CreateInstance
Level: Informational
Task: Windows_Runtime_GetActivationFactory_InprocServerImpl
Opcode: Stop

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-COM-Perf",
    "guid": "{b8d6861b-d20f-4eec-bbae-87e0dd80602b}",
    "event_source_name": "",
    "event_id": "32",
    "version": "0",
    "level": "4",
    "task": "16",
    "opcode": "2",
    "keywords": 9223372036854775808,
    "time_created": "2026-03-15T23:27:29.195534200+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "9256",
      "thread_id": "9388"
    },
    "channel": "Microsoft-Windows-Runtime/CreateInstance",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": ""
}

Event ID 33: Windows_Runtime_ActivateInstance_InprocServerImpl

Provider: Microsoft-Windows-COM-Perf
Channel: CreateInstance
Level: Informational
Task: Windows_Runtime_ActivateInstance_InprocServerImpl
Opcode: Start

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-COM-Perf",
    "guid": "{B8D6861B-D20F-4EEC-BBAE-87E0DD80602B}",
    "event_source_name": "",
    "event_id": 33,
    "version": 0,
    "level": 4,
    "task": 17,
    "opcode": 1,
    "keywords": "0x0000000000000000",
    "time_created": "2026-06-02T05:14:44.109+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 4872,
      "thread_id": 5408
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": "Windows_Runtime_ActivateInstance_InprocServerImpl"
}

Event ID 34: Windows_Runtime_ActivateInstance_InprocServerImpl

Provider: Microsoft-Windows-COM-Perf
Channel: CreateInstance
Level: Informational
Task: Windows_Runtime_ActivateInstance_InprocServerImpl
Opcode: Stop

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-COM-Perf",
    "guid": "{B8D6861B-D20F-4EEC-BBAE-87E0DD80602B}",
    "event_source_name": "",
    "event_id": 34,
    "version": 0,
    "level": 4,
    "task": 17,
    "opcode": 2,
    "keywords": "0x0000000000000000",
    "time_created": "2026-06-02T05:14:44.109+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 4872,
      "thread_id": 5408
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": "Windows_Runtime_ActivateInstance_InprocServerImpl"
}

Event ID 35: COM_GetClassFactory_InprocServerImplStart

Provider: Microsoft-Windows-COM-Perf
Channel: CreateInstance
Level: Informational
Task: COM_GetClassFactory_InprocServerImpl
Opcode: Start

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-COM-Perf",
    "guid": "{b8d6861b-d20f-4eec-bbae-87e0dd80602b}",
    "event_source_name": "",
    "event_id": "35",
    "version": "0",
    "level": "4",
    "task": "18",
    "opcode": "1",
    "keywords": 4611686018427387904,
    "time_created": "2026-03-15T04:33:21.215510000+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{bb8e93ce-8090-42ed-989b-719baa7c5499}"
    },
    "execution": {
      "process_id": "4020",
      "thread_id": "2900"
    },
    "channel": "Microsoft-Windows-COM/CreateInstance",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": ""
}

Event ID 36: COM_GetClassFactory_InprocServerImplStop

Provider: Microsoft-Windows-COM-Perf
Channel: CreateInstance
Level: Informational
Task: COM_GetClassFactory_InprocServerImpl
Opcode: Stop

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-COM-Perf",
    "guid": "{b8d6861b-d20f-4eec-bbae-87e0dd80602b}",
    "event_source_name": "",
    "event_id": "36",
    "version": "0",
    "level": "4",
    "task": "18",
    "opcode": "2",
    "keywords": 4611686018427387904,
    "time_created": "2026-03-15T04:33:21.215512100+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{bb8e93ce-8090-42ed-989b-719baa7c5499}"
    },
    "execution": {
      "process_id": "4020",
      "thread_id": "2900"
    },
    "channel": "Microsoft-Windows-COM/CreateInstance",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": ""
}

Event ID 37: COM_CreateInstance_InprocServerImplStart

Provider: Microsoft-Windows-COM-Perf
Channel: CreateInstance
Task: COM_CreateInstance_InprocServerImpl
Opcode: Start

Event ID 38: COM_CreateInstance_InprocServerImplStop

Provider: Microsoft-Windows-COM-Perf
Channel: CreateInstance
Task: COM_CreateInstance_InprocServerImpl
Opcode: Stop

Event ID 39: COM_ClientSyncCallStart_V1

Provider: Microsoft-Windows-COM-Perf
Channel: Call
Also via: realtime ETW trace
Level: Informational
Task: COM_ClientSyncCall
Opcode: Start

Fields #

Name	Description
`CallTraceId` UInt32
`TargetProcessId` UInt32	Process ID of the target process.
`TargetThreadId` UInt32	Thread ID in the target process.
`CausalityId` GUID
`TargetMethod` UInt32
`TargetInterface` GUID
`ProxyInterfacePointer` Pointer
`ProxyManagerIUnknown` Pointer
`IPID` GUID
`OID` UInt64
`CallerLogicalThreadId` GUID
`CallerReturnAddress` Pointer
`WinrtAsyncPatternMethodIndicator` UInt32
`FakeSync` Boolean

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-COM-Perf",
    "guid": "{b8d6861b-d20f-4eec-bbae-87e0dd80602b}",
    "event_source_name": "",
    "event_id": "39",
    "version": "1",
    "level": "4",
    "task": "20",
    "opcode": "1",
    "keywords": 1152921504606846976,
    "time_created": "2026-03-15T04:33:23.259139100+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{ba28d8a0-fac6-4470-a0d3-5a9342b1e9c9}"
    },
    "execution": {
      "process_id": "4020",
      "thread_id": "6644"
    },
    "channel": "Microsoft-Windows-COM/Call",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "CallTraceId": " 1657669",
    "TargetProcessId": "    7284",
    "TargetThreadId": "       0",
    "CausalityId": "{f30f8aa7-9eee-465c-a796-709143fbd8d6}",
    "TargetMethod": "      19",
    "TargetInterface": "{9556dc99-828c-11cf-a37e-00aa003240c7}",
    "ProxyInterfacePointer": "0x2B273AF84C0",
    "ProxyManagerIUnknown": "0x2B2743B66B0",
    "IPID": "{0000d409-1c74-0000-7528-2c3638aa99db}",
    "OID": "3999546768768185921",
    "CallerLogicalThreadId": "{f30f8aa7-9eee-465c-a796-709143fbd8d6}",
    "CallerReturnAddress": "0x7FFD6A484F90",
    "WinrtAsyncPatternMethodIndicator": "       0",
    "FakeSync": "false"
  },
  "message": ""
}

Event ID 40: COM_ClientSyncCallStop

Provider: Microsoft-Windows-COM-Perf
Channel: Call
Also via: realtime ETW trace
Level: Informational
Task: COM_ClientSyncCall
Opcode: Stop

Fields #

Name	Description
`CallTraceId` UInt32
`HRESULT` Int32
`SourceOfHRESULT` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-COM-Perf",
    "guid": "{b8d6861b-d20f-4eec-bbae-87e0dd80602b}",
    "event_source_name": "",
    "event_id": "40",
    "version": "0",
    "level": "4",
    "task": "20",
    "opcode": "2",
    "keywords": 1152921504606846976,
    "time_created": "2026-03-15T04:33:25.322550200+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{5eaf07a3-cc7f-444e-b51e-3196a39e1e34}"
    },
    "execution": {
      "process_id": "4020",
      "thread_id": "6644"
    },
    "channel": "Microsoft-Windows-COM/Call",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "CallTraceId": " 1657692",
    "HRESULT": "0",
    "SourceOfHRESULT": "       1"
  },
  "message": ""
}

Event ID 41: COM_ClientAsyncCallStart_V1

Provider: Microsoft-Windows-COM-Perf
Channel: Call
Task: COM_ClientAsyncCall
Opcode: Start

Fields #

Name	Description
`CallTraceId` UInt32
`TargetProcessId` UInt32	Process ID of the target process.
`TargetThreadId` UInt32	Thread ID in the target process.
`CausalityId` GUID
`TargetMethod` UInt32
`TargetInterface` GUID
`TargetInterfaceAsyncUuid` GUID
`ProxyInterfacePointer` Pointer
`ProxyManagerIUnknown` Pointer
`IPID` GUID
`OID` UInt64
`CallerLogicalThreadId` GUID
`CallerReturnAddress` Pointer

Event ID 42: COM_ClientAsyncCallStop

Provider: Microsoft-Windows-COM-Perf
Channel: Call
Task: COM_ClientAsyncCall
Opcode: Stop

Fields #

Name	Description
`CallTraceId` UInt32
`HRESULT` Int32
`SourceOfHRESULT` UInt32

Event ID 43: COM_ServerSyncCallStart_V2

Provider: Microsoft-Windows-COM-Perf
Channel: Call
Also via: realtime ETW trace
Level: Informational
Task: COM_ServerSyncCall
Opcode: Start

Fields #

Name	Description
`CallTraceId` UInt32
`SourceProcessId` UInt32
`SourceThreadId` UInt32
`CausalityId` GUID
`TargetMethod` UInt32
`TargetInterface` GUID
`InterfacePointer` Pointer
`MethodAddress` Pointer
`ServerIUnknown` Pointer
`IPID` GUID
`OID` UInt64
`WinrtAsyncPatternMethodIndicator` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-COM-Perf",
    "guid": "{b8d6861b-d20f-4eec-bbae-87e0dd80602b}",
    "event_source_name": "",
    "event_id": "43",
    "version": "2",
    "level": "4",
    "task": "22",
    "opcode": "1",
    "keywords": 1152921504606846976,
    "time_created": "2026-03-15T04:33:21.215574700+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{7f29c7b7-c6e5-45f3-b006-ac5f75a40973}"
    },
    "execution": {
      "process_id": "7284",
      "thread_id": "6724"
    },
    "channel": "Microsoft-Windows-COM/Call",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "CallTraceId": "  689814",
    "SourceProcessId": "    4020",
    "SourceThreadId": "       0",
    "CausalityId": "{b5574a87-7c88-4fe1-b85b-682749eedd6f}",
    "TargetMethod": "      19",
    "TargetInterface": "{9556dc99-828c-11cf-a37e-00aa003240c7}",
    "InterfacePointer": "0x2535F4762E0",
    "MethodAddress": "0x7FF738171310",
    "ServerIUnknown": "0x2535F4762E0",
    "IPID": "{0000d409-1c74-0000-7528-2c3638aa99db}",
    "OID": "3999546768768185921",
    "WinrtAsyncPatternMethodIndicator": "       0"
  },
  "message": ""
}

Event ID 44: COM_ServerSyncCallStop

Provider: Microsoft-Windows-COM-Perf
Channel: Call
Also via: realtime ETW trace
Level: Informational
Task: COM_ServerSyncCall
Opcode: Stop

Fields #

Name	Description
`CallTraceId` UInt32
`HRESULT` Int32
`ServerException` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-COM-Perf",
    "guid": "{b8d6861b-d20f-4eec-bbae-87e0dd80602b}",
    "event_source_name": "",
    "event_id": "44",
    "version": "0",
    "level": "4",
    "task": "22",
    "opcode": "2",
    "keywords": 1152921504606846976,
    "time_created": "2026-03-15T04:33:25.322506600+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{5eaf07a3-cc7f-444e-b51e-3196a39e1e34}"
    },
    "execution": {
      "process_id": "7284",
      "thread_id": "6724"
    },
    "channel": "Microsoft-Windows-COM/Call",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "CallTraceId": "  689857",
    "HRESULT": "0",
    "ServerException": "       0"
  },
  "message": ""
}

Event ID 45: COM_ServerAsyncCallStart_V1

Provider: Microsoft-Windows-COM-Perf
Channel: Call
Task: COM_ServerAsyncCall
Opcode: Start

Fields #

Name	Description
`CallTraceId` UInt32
`SourceProcessId` UInt32
`SourceThreadId` UInt32
`CausalityId` GUID
`TargetMethod` UInt32
`TargetInterface` GUID
`TargetInterfaceAsyncUuid` GUID
`InterfacePointer` Pointer
`MethodAddress` Pointer
`ServerIUnknown` Pointer
`IPID` GUID
`OID` UInt64

Event ID 46: COM_ServerAsyncCallStop

Provider: Microsoft-Windows-COM-Perf
Channel: Call
Task: COM_ServerAsyncCall
Opcode: Stop

Fields #

Name	Description
`CallTraceId` UInt32
`HRESULT` Int32
`ServerException` UInt32

Event ID 47: COM_FreeUnusedLibrary

Provider: Microsoft-Windows-COM-Perf
Channel: FreeUnusedLibrary
Also via: realtime ETW trace
Level: Informational
Task: COM_FreeUnusedLibrary

Fields #

Name	Description
`ApartmentId64` UInt64
`AptId` UInt32
`AptKind` UInt8
`UnloadDelay` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-COM-Perf",
    "guid": "{b8d6861b-d20f-4eec-bbae-87e0dd80602b}",
    "event_source_name": "",
    "event_id": "47",
    "version": "0",
    "level": "4",
    "task": "24",
    "opcode": "0",
    "keywords": 576460752303423488,
    "time_created": "2026-03-15T23:27:28.521979700+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "12840",
      "thread_id": "3840"
    },
    "channel": "Microsoft-Windows-COM/FreeUnusedLibrary",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "ApartmentId64": "5",
    "AptId": "       0",
    "AptKind": "2",
    "UnloadDelay": "4294967295"
  },
  "message": ""
}

Event ID 48: COM_ApartmentUninitialize

Provider: Microsoft-Windows-COM-Perf
Channel: ApartmentUninitialize
Also via: realtime ETW trace
Level: Informational
Task: COM_ApartmentUninitialize

Fields #

Name	Description
`ApartmentId64` UInt64
`AptId` UInt32
`AptKind` UInt8

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-COM-Perf",
    "guid": "{b8d6861b-d20f-4eec-bbae-87e0dd80602b}",
    "event_source_name": "",
    "event_id": "48",
    "version": "0",
    "level": "4",
    "task": "25",
    "opcode": "0",
    "keywords": 288230376151711744,
    "time_created": "2026-03-15T23:27:27.605190800+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "10408",
      "thread_id": "3732"
    },
    "channel": "Microsoft-Windows-COM/ApartmentUninitialize",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "ApartmentId64": "18446744069414584321",
    "AptId": "4294967295",
    "AptKind": "1"
  },
  "message": ""
}

Event ID 49: COM_ApartmentInitialize

Provider: Microsoft-Windows-COM-Perf
Channel: ApartmentInitialize
Also via: realtime ETW trace
Level: Informational
Task: COM_ApartmentInitialize

Fields #

Name	Description
`ApartmentId64` UInt64
`AptId` UInt32
`AptKind` UInt8

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-COM-Perf",
    "guid": "{b8d6861b-d20f-4eec-bbae-87e0dd80602b}",
    "event_source_name": "",
    "event_id": "49",
    "version": "0",
    "level": "4",
    "task": "26",
    "opcode": "0",
    "keywords": 144115188075855872,
    "time_created": "2026-03-15T04:33:37.123009100+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "5820",
      "thread_id": "11756"
    },
    "channel": "Microsoft-Windows-COM/ApartmentInitialize",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "ApartmentId64": "0",
    "AptId": "   11756",
    "AptKind": "4"
  },
  "message": ""
}

Event ID 50: Windows_Runtime_DesktopBrokeredActivateInstanceStart

Provider: Microsoft-Windows-COM-Perf
Channel: CreateInstance
Task: Windows_Runtime_DesktopBrokeredActivateInstance
Opcode: Start

Event ID 51: Windows_Runtime_DesktopBrokeredActivateInstanceStop

Provider: Microsoft-Windows-COM-Perf
Channel: CreateInstance
Task: Windows_Runtime_DesktopBrokeredActivateInstance
Opcode: Stop

Event ID 52: Windows_Runtime_DesktopBrokeredGetActivationFactoryStart

Provider: Microsoft-Windows-COM-Perf
Channel: CreateInstance
Task: Windows_Runtime_DesktopBrokeredGetActivationFactory
Opcode: Start

Event ID 53: Windows_Runtime_DesktopBrokeredGetActivationFactoryStop

Provider: Microsoft-Windows-COM-Perf
Channel: CreateInstance
Task: Windows_Runtime_DesktopBrokeredGetActivationFactory
Opcode: Stop

Event ID 54: ExtensionCatalog_RoGetExtensionRegistrationForLaunchContractsStart

Provider: Microsoft-Windows-COM-Perf
Channel: ExtensionCatalog
Task: ExtensionCatalog_RoGetExtensionRegistrationForLaunchContracts
Opcode: Start

Fields #

Name	Description
`ContractId` UnicodeString
`PackageId` UnicodeString

Event ID 55: ExtensionCatalog_RoGetExtensionRegistrationForLaunchContractsStop

Provider: Microsoft-Windows-COM-Perf
Channel: ExtensionCatalog
Task: ExtensionCatalog_RoGetExtensionRegistrationForLaunchContracts
Opcode: Stop

Fields #

Name	Description
`HRESULT` Int32
`ContractId` UnicodeString
`PackageId` UnicodeString
`ActivatableClassId` UnicodeString
`InboxAppsRegistrationScope` Boolean

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID {B8D6861B-D20F-4EEC-BBAE-87E0DD80602B}

Defined in combase.dll, which carries the event manifest.

Observed on:

WS2022-20348.4893, sample captured from a live trace, binary version 10.0.20348.2849, captured 2026-06-02
WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.2849, captured 2026-06-02
Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)