Microsoft-Windows-DotNETRuntimeRundown

23 events across 1 channel

Event	Title	Channel	Sample
0	ClrInstanceID=ClrInstanceID.	Operational	N
141	MethodID=MethodID.	Operational	N
142	MethodID=MethodID.	Operational	N
143	MethodID=MethodID.	Operational	Y
144	MethodID=MethodID.	Operational	Y
145	ClrInstanceID=ClrInstanceID.	Operational	Y
146	ClrInstanceID=ClrInstanceID.	Operational	Y
147	ClrInstanceID=ClrInstanceID.	Operational	Y
148	ClrInstanceID=ClrInstanceID.	Operational	Y
149	MethodID=MethodID.	Operational	Y
150	MethodID=MethodID.	Operational	Y
151	ModuleID=ModuleID.	Operational	Y
152	ModuleID=ModuleID.	Operational	Y
153	ModuleID=ModuleID.	Operational	Y
154	ModuleID=ModuleID.	Operational	Y
155	AssemblyID=AssemblyID.	Operational	Y
156	AssemblyID=AssemblyID.	Operational	Y
157	AppDomainID=AppDomainID.	Operational	Y
158	AppDomainID=AppDomainID.	Operational	Y
159	ManagedThreadID=ManagedThreadID.	Operational	Y
160	ClrInstanceID=ClrInstanceID;%ModuleID=ModuleID.	Operational	Y
161	ClrInstanceID=ClrInstanceID;%ModuleID=ModuleID.	Operational	Y
187	ClrInstanceID=ClrInstanceID.	Operational	Y

Event ID 0: ClrInstanceID=ClrInstanceID.

Provider: Microsoft-Windows-DotNETRuntimeRundown
Channel: Operational
Task: ClrStack
Opcode: Walk

Description

ClrInstanceID=ClrInstanceID.

Message #

ClrInstanceID=%1;
Reserved1=%2;
Reserved2=%3;
FrameCount=%4;
Stack=%5

Fields #

Name	Description
`ClrInstanceID` UInt16
`Reserved1` UInt8
`Reserved2` UInt8
`FrameCount` UInt32
`Stack` Pointer

Event ID 141: MethodID=MethodID.

Provider: Microsoft-Windows-DotNETRuntimeRundown
Channel: Operational
Task: Method
Opcode: DCStart

Description

MethodID=MethodID.

Message #

MethodID=%1;
ModuleID=%2;
MethodStartAddress=%3;
MethodSize=%4;
MethodToken=%5;
MethodFlags=%6

Fields #

Name	Description
`MethodID` UInt64
`ModuleID` UInt64
`MethodStartAddress` UInt64
`MethodSize` UInt32
`MethodToken` UInt32
`MethodFlags` UInt32
`ClrInstanceID` UInt16
`ReJITID` UInt64

Event ID 142: MethodID=MethodID.

Provider: Microsoft-Windows-DotNETRuntimeRundown
Channel: Operational
Task: Method
Opcode: DCStop

Description

MethodID=MethodID.

Message #

MethodID=%1;
ModuleID=%2;
MethodStartAddress=%3;
MethodSize=%4;
MethodToken=%5;
MethodFlags=%6

Fields #

Name	Description
`MethodID` UInt64
`ModuleID` UInt64
`MethodStartAddress` UInt64
`MethodSize` UInt32
`MethodToken` UInt32
`MethodFlags` UInt32
`ClrInstanceID` UInt16
`ReJITID` UInt64

Event ID 143: MethodID=MethodID.

Provider: Microsoft-Windows-DotNETRuntimeRundown
Channel: Operational
Also via: realtime ETW trace
Level: Informational
Task: Method
Opcode: DCStartVerbose

Description

MethodID=MethodID.

Message #

MethodID=%1;
ModuleID=%2;
MethodStartAddress=%3;
MethodSize=%4;
MethodToken=%5;
MethodFlags=%6;
MethodNamespace=%7;
MethodName=%8;
MethodSignature=%9

Fields #

Name	Description
`MethodID` UInt64
`ModuleID` UInt64
`MethodStartAddress` UInt64
`MethodSize` UInt32
`MethodToken` UInt32
`MethodFlags` UInt32
`MethodNamespace` UnicodeString
`MethodName` UnicodeString
`MethodSignature` UnicodeString
`ClrInstanceID` UInt16
`ReJITID` UInt64

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DotNETRuntimeRundown",
    "guid": "{A669021C-C450-4609-A035-5AF59AF4DF18}",
    "event_source_name": "",
    "event_id": 143,
    "version": 1,
    "level": 4,
    "task": 1,
    "opcode": 39,
    "keywords": "0x0000000000000030",
    "time_created": "2026-06-02T04:52:45.971+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 14288,
      "thread_id": 11700
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "ClrInstanceID": 9,
    "MethodFlags": 9,
    "MethodID": 140709712278560,
    "MethodName": "lambda_method",
    "MethodNamespace": "dynamicClass",
    "MethodSignature": "pMT: 00007FF9C4140630  (pMT: 00007FF9DD58DE20)",
    "MethodSize": 92,
    "MethodStartAddress": 140709712494720,
    "MethodToken": 0,
    "ModuleID": 140709712276448
  },
  "message": "CLRMethodRundown"
}

Event ID 144: MethodID=MethodID.

Provider: Microsoft-Windows-DotNETRuntimeRundown
Channel: Operational
Also via: realtime ETW trace
Level: Informational
Task: Method
Opcode: DCStopVerbose

Description

MethodID=MethodID.

Message #

MethodID=%1;
ModuleID=%2;
MethodStartAddress=%3;
MethodSize=%4;
MethodToken=%5;
MethodFlags=%6;
MethodNamespace=%7;
MethodName=%8;
MethodSignature=%9

Fields #

Name	Description
`MethodID` UInt64
`ModuleID` UInt64
`MethodStartAddress` UInt64
`MethodSize` UInt32
`MethodToken` UInt32
`MethodFlags` UInt32
`MethodNamespace` UnicodeString
`MethodName` UnicodeString
`MethodSignature` UnicodeString
`ClrInstanceID` UInt16
`ReJITID` UInt64

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DotNETRuntimeRundown",
    "guid": "{A669021C-C450-4609-A035-5AF59AF4DF18}",
    "event_source_name": "",
    "event_id": 144,
    "version": 1,
    "level": 4,
    "task": 1,
    "opcode": 40,
    "keywords": "0x0000000000000030",
    "time_created": "2026-06-02T04:52:45.972+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 18424,
      "thread_id": 14004
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "ClrInstanceID": 9,
    "MethodFlags": 8,
    "MethodID": 140709710566296,
    "MethodName": "Bind",
    "MethodNamespace": "Microsoft.IdentityServer.Service.WmiProvider2.SecurityTokenService",
    "MethodSignature": "class Microsoft.IdentityServer.Service.WmiProvider2.SecurityTokenService  ()",
    "MethodSize": 69,
    "MethodStartAddress": 140709711644816,
    "MethodToken": 100663599,
    "ModuleID": 140709710556144
  },
  "message": "CLRMethodRundown"
}

Event ID 145: ClrInstanceID=ClrInstanceID.

Provider: Microsoft-Windows-DotNETRuntimeRundown
Channel: Operational
Also via: realtime ETW trace
Level: Informational
Task: Method
Opcode: DCStartComplete

Description

ClrInstanceID=ClrInstanceID.

Message #

ClrInstanceID=%1

Fields #

Name	Description
`ClrInstanceID` UInt16

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DotNETRuntimeRundown",
    "guid": "{A669021C-C450-4609-A035-5AF59AF4DF18}",
    "event_source_name": "",
    "event_id": 145,
    "version": 1,
    "level": 4,
    "task": 1,
    "opcode": 14,
    "keywords": "0x0000000000020038",
    "time_created": "2026-06-02T04:52:45.972+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 18424,
      "thread_id": 14004
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "ClrInstanceID": 9
  },
  "message": "CLRMethodRundown"
}

Event ID 146: ClrInstanceID=ClrInstanceID.

Provider: Microsoft-Windows-DotNETRuntimeRundown
Channel: Operational
Also via: realtime ETW trace
Level: Informational
Task: Method
Opcode: DCStopComplete

Description

ClrInstanceID=ClrInstanceID.

Message #

ClrInstanceID=%1

Fields #

Name	Description
`ClrInstanceID` UInt16

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DotNETRuntimeRundown",
    "guid": "{A669021C-C450-4609-A035-5AF59AF4DF18}",
    "event_source_name": "",
    "event_id": 146,
    "version": 1,
    "level": 4,
    "task": 1,
    "opcode": 15,
    "keywords": "0x0000000000020038",
    "time_created": "2026-06-02T04:52:45.973+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 18424,
      "thread_id": 14004
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "ClrInstanceID": 9
  },
  "message": "CLRMethodRundown"
}

Event ID 147: ClrInstanceID=ClrInstanceID.

Provider: Microsoft-Windows-DotNETRuntimeRundown
Channel: Operational
Also via: realtime ETW trace
Level: Informational
Task: Method
Opcode: DCStartInit

Description

ClrInstanceID=ClrInstanceID.

Message #

ClrInstanceID=%1

Fields #

Name	Description
`ClrInstanceID` UInt16

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DotNETRuntimeRundown",
    "guid": "{A669021C-C450-4609-A035-5AF59AF4DF18}",
    "event_source_name": "",
    "event_id": 147,
    "version": 1,
    "level": 4,
    "task": 1,
    "opcode": 16,
    "keywords": "0x0000000000020038",
    "time_created": "2026-06-02T04:52:45.971+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 17484,
      "thread_id": 20296
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "ClrInstanceID": 9
  },
  "message": "CLRMethodRundown"
}

Event ID 148: ClrInstanceID=ClrInstanceID.

Provider: Microsoft-Windows-DotNETRuntimeRundown
Channel: Operational
Also via: realtime ETW trace
Level: Informational
Task: Method
Opcode: DCStopInit

Description

ClrInstanceID=ClrInstanceID.

Message #

ClrInstanceID=%1

Fields #

Name	Description
`ClrInstanceID` UInt16

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DotNETRuntimeRundown",
    "guid": "{A669021C-C450-4609-A035-5AF59AF4DF18}",
    "event_source_name": "",
    "event_id": 148,
    "version": 1,
    "level": 4,
    "task": 1,
    "opcode": 17,
    "keywords": "0x0000000000020038",
    "time_created": "2026-06-02T04:52:45.972+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 18424,
      "thread_id": 14004
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "ClrInstanceID": 9
  },
  "message": "CLRMethodRundown"
}

Event ID 149: MethodID=MethodID.

Provider: Microsoft-Windows-DotNETRuntimeRundown
Channel: Operational
Also via: realtime ETW trace
Level: Verbose
Task: Method
Opcode: MethodDCStartILToNativeMap

Description

MethodID=MethodID.

Message #

MethodID=%1;
ReJITID=%2;
MethodExtent=%3;
CountOfMapEntries=%4;
ClrInstanceID=%5

Fields #

Name	Description
`MethodID` UInt64
`ReJITID` UInt64
`MethodExtent` UInt8
`CountOfMapEntries` UInt16
`ILOffsets` UInt32
`NativeOffsets` UInt32
`ClrInstanceID` UInt16

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DotNETRuntimeRundown",
    "guid": "{A669021C-C450-4609-A035-5AF59AF4DF18}",
    "event_source_name": "",
    "event_id": 149,
    "version": 0,
    "level": 5,
    "task": 1,
    "opcode": 41,
    "keywords": "0x0000000000020000",
    "time_created": "2026-06-02T04:52:45.971+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 9780,
      "thread_id": 13396
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "ClrInstanceID": 65534,
    "CountOfMapEntries": 12,
    "ILOffsets": 4294967294,
    "MethodExtent": 0,
    "MethodID": 140709714070544,
    "NativeOffsets": 4294967294,
    "ReJITID": 0
  },
  "message": "CLRMethodRundown"
}

Event ID 150: MethodID=MethodID.

Provider: Microsoft-Windows-DotNETRuntimeRundown
Channel: Operational
Also via: realtime ETW trace
Level: Verbose
Task: Method
Opcode: MethodDCEndILToNativeMap

Description

MethodID=MethodID.

Message #

MethodID=%1;
ReJITID=%2;
MethodExtent=%3;
CountOfMapEntries=%4;
ClrInstanceID=%5

Fields #

Name	Description
`MethodID` UInt64
`ReJITID` UInt64
`MethodExtent` UInt8
`CountOfMapEntries` UInt16
`ILOffsets` UInt32
`NativeOffsets` UInt32
`ClrInstanceID` UInt16

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DotNETRuntimeRundown",
    "guid": "{A669021C-C450-4609-A035-5AF59AF4DF18}",
    "event_source_name": "",
    "event_id": 150,
    "version": 0,
    "level": 5,
    "task": 1,
    "opcode": 42,
    "keywords": "0x0000000000020000",
    "time_created": "2026-06-02T04:52:45.972+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 18424,
      "thread_id": 14004
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "ClrInstanceID": 0,
    "CountOfMapEntries": 6,
    "ILOffsets": 4294967294,
    "MethodExtent": 0,
    "MethodID": 140709710566296,
    "NativeOffsets": 4294967294,
    "ReJITID": 0
  },
  "message": "CLRMethodRundown"
}

Event ID 151: ModuleID=ModuleID.

Provider: Microsoft-Windows-DotNETRuntimeRundown
Channel: Operational
Also via: realtime ETW trace
Level: Informational
Task: Loader
Opcode: DomainModuleDCStart

Description

ModuleID=ModuleID.

Message #

ModuleID=%1;
AssemblyID=%2;
AppDomainID=%3;
ModuleFlags=%4;ModuleILPath=%5;ModuleNativePath=%6

Fields #

Name	Description
`ModuleID` UInt64
`AssemblyID` UInt64
`AppDomainID` UInt64
`ModuleFlags` UInt32
`Reserved1` UInt32
`ModuleILPath` UnicodeString
`ModuleNativePath` UnicodeString
`ClrInstanceID` UInt16

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DotNETRuntimeRundown",
    "guid": "{A669021C-C450-4609-A035-5AF59AF4DF18}",
    "event_source_name": "",
    "event_id": 151,
    "version": 1,
    "level": 4,
    "task": 2,
    "opcode": 46,
    "keywords": "0x0000000000000008",
    "time_created": "2026-06-02T04:52:45.971+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 17484,
      "thread_id": 20296
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "AppDomainID": 2117511435920,
    "AssemblyID": 2117928960608,
    "ClrInstanceID": 9,
    "ModuleFlags": 12,
    "ModuleID": 140709712276448,
    "ModuleILPath": "Anonymously Hosted DynamicMethods Assembly",
    "ModuleNativePath": "",
    "Reserved1": 0
  },
  "message": "CLRLoaderRundown"
}

Event ID 152: ModuleID=ModuleID.

Provider: Microsoft-Windows-DotNETRuntimeRundown
Channel: Operational
Also via: realtime ETW trace
Level: Informational
Task: Loader
Opcode: DomainModuleDCStop

Description

ModuleID=ModuleID.

Message #

ModuleID=%1;
AssemblyID=%2;
AppDomainID=%3;
ModuleFlags=%4;ModuleILPath=%5;ModuleNativePath=%6

Fields #

Name	Description
`ModuleID` UInt64
`AssemblyID` UInt64
`AppDomainID` UInt64
`ModuleFlags` UInt32
`Reserved1` UInt32
`ModuleILPath` UnicodeString
`ModuleNativePath` UnicodeString
`ClrInstanceID` UInt16

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DotNETRuntimeRundown",
    "guid": "{A669021C-C450-4609-A035-5AF59AF4DF18}",
    "event_source_name": "",
    "event_id": 152,
    "version": 1,
    "level": 4,
    "task": 2,
    "opcode": 47,
    "keywords": "0x0000000000000008",
    "time_created": "2026-06-02T04:52:45.972+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 18424,
      "thread_id": 14004
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "AppDomainID": 1782304869376,
    "AssemblyID": 1782305227376,
    "ClrInstanceID": 9,
    "ModuleFlags": 10,
    "ModuleID": 140710973870080,
    "ModuleILPath": "C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Instrumentation\\v4.0_4.0.0.0__b77a5c561934e089\\System.Management.Instrumentation.dll",
    "ModuleNativePath": "C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\a38e5caee7861d3edf6aca46d0c496e6\\System.Management.Instrumentation.ni.dll",
    "Reserved1": 0
  },
  "message": "CLRLoaderRundown"
}

Event ID 153: ModuleID=ModuleID.

Provider: Microsoft-Windows-DotNETRuntimeRundown
Channel: Operational
Also via: realtime ETW trace
Level: Informational
Task: Loader
Opcode: ModuleDCStart

Description

ModuleID=ModuleID.

Message #

ModuleID=%1;
AssemblyID=%2;
ModuleFlags=%3;ModuleILPath=%4;ModuleNativePath=%5

Fields #

Name	Description
`ModuleID` UInt64
`AssemblyID` UInt64
`ModuleFlags` UInt32
`Reserved1` UInt32
`ModuleILPath` UnicodeString
`ModuleNativePath` UnicodeString
`ClrInstanceID` UInt16
`ManagedPdbSignature` GUID
`ManagedPdbAge` UInt32
`ManagedPdbBuildPath` UnicodeString
`NativePdbSignature` GUID
`NativePdbAge` UInt32
`NativePdbBuildPath` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DotNETRuntimeRundown",
    "guid": "{A669021C-C450-4609-A035-5AF59AF4DF18}",
    "event_source_name": "",
    "event_id": 153,
    "version": 2,
    "level": 4,
    "task": 2,
    "opcode": 35,
    "keywords": "0x0000000020000008",
    "time_created": "2026-06-02T04:52:45.971+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 17484,
      "thread_id": 20296
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "AssemblyID": 2117928960608,
    "ClrInstanceID": 9,
    "ManagedPdbAge": 0,
    "ManagedPdbBuildPath": "",
    "ManagedPdbSignature": "{00000000-0000-0000-0000-000000000000}",
    "ModuleFlags": 12,
    "ModuleID": 140709712276448,
    "ModuleILPath": "Anonymously Hosted DynamicMethods Assembly",
    "ModuleNativePath": "",
    "NativePdbAge": 0,
    "NativePdbBuildPath": "",
    "NativePdbSignature": "{00000000-0000-0000-0000-000000000000}",
    "Reserved1": 0
  },
  "message": "CLRLoaderRundown"
}

Event ID 154: ModuleID=ModuleID.

Provider: Microsoft-Windows-DotNETRuntimeRundown
Channel: Operational
Also via: realtime ETW trace
Level: Informational
Task: Loader
Opcode: ModuleDCStop

Description

ModuleID=ModuleID.

Message #

ModuleID=%1;
AssemblyID=%2;
ModuleFlags=%3;ModuleILPath=%4;ModuleNativePath=%5

Fields #

Name	Description
`ModuleID` UInt64
`AssemblyID` UInt64
`ModuleFlags` UInt32
`Reserved1` UInt32
`ModuleILPath` UnicodeString
`ModuleNativePath` UnicodeString
`ClrInstanceID` UInt16
`ManagedPdbSignature` GUID
`ManagedPdbAge` UInt32
`ManagedPdbBuildPath` UnicodeString
`NativePdbSignature` GUID
`NativePdbAge` UInt32
`NativePdbBuildPath` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DotNETRuntimeRundown",
    "guid": "{A669021C-C450-4609-A035-5AF59AF4DF18}",
    "event_source_name": "",
    "event_id": 154,
    "version": 2,
    "level": 4,
    "task": 2,
    "opcode": 36,
    "keywords": "0x0000000020000008",
    "time_created": "2026-06-02T04:52:45.972+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 18424,
      "thread_id": 14004
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "AssemblyID": 1782305227376,
    "ClrInstanceID": 9,
    "ManagedPdbAge": 1,
    "ManagedPdbBuildPath": "System.Management.Instrumentation.pdb",
    "ManagedPdbSignature": "{F1C5C0E3-DBCA-49E9-ADF0-DAA0C1A44874}",
    "ModuleFlags": 10,
    "ModuleID": 140710973870080,
    "ModuleILPath": "C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Instrumentation\\v4.0_4.0.0.0__b77a5c561934e089\\System.Management.Instrumentation.dll",
    "ModuleNativePath": "C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaf08ebffb#\\a38e5caee7861d3edf6aca46d0c496e6\\System.Management.Instrumentation.ni.dll",
    "NativePdbAge": 1,
    "NativePdbBuildPath": "System.Management.Instrumentation.ni.pdb",
    "NativePdbSignature": "{A38E5CAE-E786-1D3E-DF6A-CA46D0C496E6}",
    "Reserved1": 0
  },
  "message": "CLRLoaderRundown"
}

Event ID 155: AssemblyID=AssemblyID.

Provider: Microsoft-Windows-DotNETRuntimeRundown
Channel: Operational
Also via: realtime ETW trace
Level: Informational
Task: Loader
Opcode: AssemblyDCStart

Description

AssemblyID=AssemblyID.

Message #

AssemblyID=%1;
AppDomainID=%2;
AssemblyFlags=%3;FullyQualifiedAssemblyName=%4

Fields #

Name	Description
`AssemblyID` UInt64
`AppDomainID` UInt64
`BindingID` UInt64
`AssemblyFlags` UInt32
`FullyQualifiedAssemblyName` UnicodeString
`ClrInstanceID` UInt16

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DotNETRuntimeRundown",
    "guid": "{A669021C-C450-4609-A035-5AF59AF4DF18}",
    "event_source_name": "",
    "event_id": 155,
    "version": 1,
    "level": 4,
    "task": 2,
    "opcode": 39,
    "keywords": "0x0000000000000008",
    "time_created": "2026-06-02T04:52:45.971+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 17484,
      "thread_id": 20296
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "AppDomainID": 2117511435920,
    "AssemblyFlags": 2,
    "AssemblyID": 2117928960608,
    "BindingID": 0,
    "ClrInstanceID": 9,
    "FullyQualifiedAssemblyName": "Anonymously Hosted DynamicMethods Assembly, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null"
  },
  "message": "CLRLoaderRundown"
}

Event ID 156: AssemblyID=AssemblyID.

Provider: Microsoft-Windows-DotNETRuntimeRundown
Channel: Operational
Also via: realtime ETW trace
Level: Informational
Task: Loader
Opcode: AssemblyDCStop

Description

AssemblyID=AssemblyID.

Message #

AssemblyID=%1;
AppDomainID=%2;
AssemblyFlags=%3;FullyQualifiedAssemblyName=%4

Fields #

Name	Description
`AssemblyID` UInt64
`AppDomainID` UInt64
`BindingID` UInt64
`AssemblyFlags` UInt32
`FullyQualifiedAssemblyName` UnicodeString
`ClrInstanceID` UInt16

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DotNETRuntimeRundown",
    "guid": "{A669021C-C450-4609-A035-5AF59AF4DF18}",
    "event_source_name": "",
    "event_id": 156,
    "version": 1,
    "level": 4,
    "task": 2,
    "opcode": 40,
    "keywords": "0x0000000000000008",
    "time_created": "2026-06-02T04:52:45.972+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 18424,
      "thread_id": 14004
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "AppDomainID": 1782304869376,
    "AssemblyFlags": 4,
    "AssemblyID": 1782305227376,
    "BindingID": 0,
    "ClrInstanceID": 9,
    "FullyQualifiedAssemblyName": "System.Management.Instrumentation, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"
  },
  "message": "CLRLoaderRundown"
}

Event ID 157: AppDomainID=AppDomainID.

Provider: Microsoft-Windows-DotNETRuntimeRundown
Channel: Operational
Also via: realtime ETW trace
Level: Informational
Task: Loader
Opcode: AppDomainDCStart

Description

AppDomainID=AppDomainID.

Message #

AppDomainID=%1;
AppDomainFlags=%2;
AppDomainName=%3

Fields #

Name	Description
`AppDomainID` UInt64
`AppDomainFlags` UInt32
`AppDomainName` UnicodeString
`AppDomainIndex` UInt32
`ClrInstanceID` UInt16

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DotNETRuntimeRundown",
    "guid": "{A669021C-C450-4609-A035-5AF59AF4DF18}",
    "event_source_name": "",
    "event_id": 157,
    "version": 1,
    "level": 4,
    "task": 2,
    "opcode": 43,
    "keywords": "0x0000000000000008",
    "time_created": "2026-06-02T04:52:45.971+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 17484,
      "thread_id": 20296
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "AppDomainFlags": 536870915,
    "AppDomainID": 2117511435920,
    "AppDomainIndex": 1,
    "AppDomainName": "DefaultDomain",
    "ClrInstanceID": 9
  },
  "message": "CLRLoaderRundown"
}

Event ID 158: AppDomainID=AppDomainID.

Provider: Microsoft-Windows-DotNETRuntimeRundown
Channel: Operational
Also via: realtime ETW trace
Level: Informational
Task: Loader
Opcode: AppDomainDCStop

Description

AppDomainID=AppDomainID.

Message #

AppDomainID=%1;
AppDomainFlags=%2;
AppDomainName=%3

Fields #

Name	Description
`AppDomainID` UInt64
`AppDomainFlags` UInt32
`AppDomainName` UnicodeString
`AppDomainIndex` UInt32
`ClrInstanceID` UInt16

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DotNETRuntimeRundown",
    "guid": "{A669021C-C450-4609-A035-5AF59AF4DF18}",
    "event_source_name": "",
    "event_id": 158,
    "version": 1,
    "level": 4,
    "task": 2,
    "opcode": 44,
    "keywords": "0x0000000000000008",
    "time_created": "2026-06-02T04:52:45.973+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 18424,
      "thread_id": 14004
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "AppDomainFlags": 268435459,
    "AppDomainID": 1782304869376,
    "AppDomainIndex": 1,
    "AppDomainName": "DefaultDomain",
    "ClrInstanceID": 9
  },
  "message": "CLRLoaderRundown"
}

Event ID 159: ManagedThreadID=ManagedThreadID.

Provider: Microsoft-Windows-DotNETRuntimeRundown
Channel: Operational
Also via: realtime ETW trace
Level: Informational
Task: Loader
Opcode: ThreadDCStop

Description

ManagedThreadID=ManagedThreadID.

Message #

ManagedThreadID=%1;
AppDomainID=%2;
Flags=%3;
ManagedThreadIndex=%4;
OSThreadID=%5;
ClrInstanceID=%6

Fields #

Name	Description
`ManagedThreadID` UInt64
`AppDomainID` UInt64
`Flags` UInt32
`ManagedThreadIndex` UInt32
`OSThreadID` UInt32
`ClrInstanceID` UInt16

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DotNETRuntimeRundown",
    "guid": "{A669021C-C450-4609-A035-5AF59AF4DF18}",
    "event_source_name": "",
    "event_id": 159,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 48,
    "keywords": "0x0000000000010800",
    "time_created": "2026-06-02T04:52:45.972+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 18424,
      "thread_id": 14004
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "AppDomainID": 1782304869376,
    "ClrInstanceID": 9,
    "Flags": 2,
    "ManagedThreadID": 1782305100160,
    "ManagedThreadIndex": 2,
    "OSThreadID": 12972
  },
  "message": "CLRLoaderRundown"
}

Event ID 160: ClrInstanceID=ClrInstanceID;%ModuleID=ModuleID.

Provider: Microsoft-Windows-DotNETRuntimeRundown
Channel: Operational
Also via: realtime ETW trace
Level: Informational
Task: ClrPerfTrack
Opcode: ModuleRangeDCStart

Description

ClrInstanceID=ClrInstanceID;%ModuleID=ModuleID.

Message #

ClrInstanceID=%1;%ModuleID=%2;
RangeBegin=%3;
RangeSize=%4;
RangeType=%5

Fields #

Name	Description
`ClrInstanceID` UInt16
`ModuleID` UInt64
`RangeBegin` UInt32
`RangeSize` UInt32
`RangeType` UInt8

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DotNETRuntimeRundown",
    "guid": "{A669021C-C450-4609-A035-5AF59AF4DF18}",
    "event_source_name": "",
    "event_id": 160,
    "version": 0,
    "level": 4,
    "task": 20,
    "opcode": 10,
    "keywords": "0x0000000020000000",
    "time_created": "2026-06-02T04:52:45.971+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 1764,
      "thread_id": 15068
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "ClrInstanceID": 7,
    "ModuleID": 140711137054720,
    "RangeBegin": 368160,
    "RangeSize": 659280,
    "RangeType": 4
  },
  "message": "CLRPerfTrackRundown"
}

Event ID 161: ClrInstanceID=ClrInstanceID;%ModuleID=ModuleID.

Provider: Microsoft-Windows-DotNETRuntimeRundown
Channel: Operational
Also via: realtime ETW trace
Level: Informational
Task: ClrPerfTrack
Opcode: ModuleRangeDCEnd

Description

ClrInstanceID=ClrInstanceID;%ModuleID=ModuleID.

Message #

ClrInstanceID=%1;%ModuleID=%2;
RangeBegin=%3;
RangeSize=%4;
RangeType=%5

Fields #

Name	Description
`ClrInstanceID` UInt16
`ModuleID` UInt64
`RangeBegin` UInt32
`RangeSize` UInt32
`RangeType` UInt8

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DotNETRuntimeRundown",
    "guid": "{A669021C-C450-4609-A035-5AF59AF4DF18}",
    "event_source_name": "",
    "event_id": 161,
    "version": 0,
    "level": 4,
    "task": 20,
    "opcode": 11,
    "keywords": "0x0000000020000000",
    "time_created": "2026-06-02T04:52:45.972+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 18424,
      "thread_id": 14004
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "ClrInstanceID": 9,
    "ModuleID": 140711155798016,
    "RangeBegin": 607200,
    "RangeSize": 244776,
    "RangeType": 4
  },
  "message": "CLRPerfTrackRundown"
}

Event ID 187: ClrInstanceID=ClrInstanceID.

Provider: Microsoft-Windows-DotNETRuntimeRundown
Channel: Operational
Also via: realtime ETW trace
Level: Informational
Task: Runtime
Opcode: Start

Description

ClrInstanceID=ClrInstanceID.

Message #

ClrInstanceID=%1;
SKU=%2;
BclMajorVersion=%3;
BclMinorVersion=%4;
BclBuildNumber=%5;
BclQfeNumber=%6;
VMMajorVersion=%7;
VMMinorVersion=%8;
VMBuildNumber=%9;
VMQfeNumber=%10;
StartupFlags=%11;
StartupMode=%12;
CommandLine=%13;
ComObjectGUID=%14;
RuntimeDllPath=%15

Fields #

Name	Description
`ClrInstanceID` UInt16
`Sku` UInt16
`BclMajorVersion` UInt16
`BclMinorVersion` UInt16
`BclBuildNumber` UInt16
`BclQfeNumber` UInt16
`VMMajorVersion` UInt16
`VMMinorVersion` UInt16
`VMBuildNumber` UInt16
`VMQfeNumber` UInt16
`StartupFlags` UInt32
`StartupMode` UInt8
`CommandLine` UnicodeString
`ComObjectGuid` GUID
`RuntimeDllPath` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DotNETRuntimeRundown",
    "guid": "{A669021C-C450-4609-A035-5AF59AF4DF18}",
    "event_source_name": "",
    "event_id": 187,
    "version": 0,
    "level": 4,
    "task": 19,
    "opcode": 1,
    "keywords": "0x0000000000000000",
    "time_created": "2026-06-02T04:52:45.971+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 17484,
      "thread_id": 20296
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "BclBuildNumber": 0,
    "BclMajorVersion": 4,
    "BclMinorVersion": 0,
    "BclQfeNumber": 0,
    "ClrInstanceID": 9,
    "ComObjectGuid": "{00000000-0000-0000-0000-000000000000}",
    "CommandLine": "",
    "RuntimeDllPath": "C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll",
    "Sku": 1,
    "StartupFlags": 4,
    "StartupMode": 2,
    "VMBuildNumber": 30319,
    "VMMajorVersion": 4,
    "VMMinorVersion": 0,
    "VMQfeNumber": 0
  },
  "message": "CLRRuntimeInformationRundown"
}

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID {A669021C-C450-4609-A035-5AF59AF4DF18}

Defined in clretwrc.dll, which carries the event manifest.

Observed on:

WS2022-20348.4893, sample captured from a live trace, binary version 4.8.4161.0 built by: NET48REL1, captured 2026-06-02
WS2022-20348.4893, schema read from the registered manifest, binary version 4.8.4161.0, captured 2026-06-02
Win11-26200.6584, schema read from the registered manifest, binary version 4.8.9221.0, captured 2026-06-02

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)