detection.wiki

Microsoft-Windows-Hyper-V-DynMem

EventTitleChannelSampleRule
1500[Virtual machine VmId]OperationalNN
1500[Virtual machine VmId] TraceData.Microsoft-Windows-Hyper-V-Worker-AnalyticNN
1510[Virtual machine VmId]OperationalNN
1510[Virtual machine VmId] TraceData.Microsoft-Windows-Hyper-V-Worker-AnalyticNN
1520[Virtual machine VmId]OperationalNN
1520[Virtual machine VmId] TraceData.Microsoft-Windows-Hyper-V-Worker-AnalyticNN
1530[Virtual machine VmId]OperationalNN
1530[Virtual machine VmId] TraceData.Microsoft-Windows-Hyper-V-Worker-AnalyticNN
12540'VmName' device Device experienced a protocol error indicative of a deep system …Operational, Microsoft-Windows-Hyper-V-Worker-AdminNN
12541Device Device experienced a protocol error indicative of a deep system problemOperational, Microsoft-Windows-Hyper-V-Worker-AdminNN
12542VM 'VmName' (Virtual machine ID VmId) is misconfigured with more physical RAM …Operational, Microsoft-Windows-Hyper-V-Worker-AdminNN
12543VM 'VmName' (Virtual machine ID VmId) is misconfiguredOperational, Microsoft-Windows-Hyper-V-Worker-AdminNN
12544'VmName' device Device found bad data on restoringOperational, Microsoft-Windows-Hyper-V-Worker-AdminNN
12545Device Device found bad data on restoringOperational, Microsoft-Windows-Hyper-V-Worker-AdminNN
12546VM 'VmName' (Virtual machine ID VmId) is misconfigured to allow guest …Operational, Microsoft-Windows-Hyper-V-Worker-AdminNN
12547VM 'VmName' (Virtual machine ID VmId) is misconfigured to allow guest …Operational, Microsoft-Windows-Hyper-V-Worker-AdminNN
25001Started reserving memoryOperational, Microsoft-Windows-Hyper-V-Worker-AnalyticNN
25002Operation reserve memory completed, Parameter0 pages were reserved, time Time sOperational, Microsoft-Windows-Hyper-V-Worker-AnalyticNN
25003Started committing memoryOperational, Microsoft-Windows-Hyper-V-Worker-AnalyticNN
25004Operation committing memory completed, Parameter0 pages were committed, time …Operational, Microsoft-Windows-Hyper-V-Worker-AnalyticNN
25005Started de-committing memoryOperational, Microsoft-Windows-Hyper-V-Worker-AnalyticNN
25006Operation de-committing memory completed, Parameter0 pages were de-committed, …Operational, Microsoft-Windows-Hyper-V-Worker-AnalyticNN
25007Started hot adding memory (GUEST)Operational, Microsoft-Windows-Hyper-V-Worker-AnalyticNN
25008Operation hot adding memory completed (GUEST), Parameter0 pages were hot added, …Operational, Microsoft-Windows-Hyper-V-Worker-AnalyticNN
25009Started un-ballooning memory (GUEST)Operational, Microsoft-Windows-Hyper-V-Worker-AnalyticNN
25010Operation un-ballooning memory completed (GUEST), Parameter0 pages were …Operational, Microsoft-Windows-Hyper-V-Worker-AnalyticNN
25011Started ballooning memory (GUEST)Operational, Microsoft-Windows-Hyper-V-Worker-AnalyticNN
25012Operation ballooning memory completed (GUEST), Parameter0 pages were ballooned, …Operational, Microsoft-Windows-Hyper-V-Worker-AnalyticNN
25013Started hot add undo memoryOperational, Microsoft-Windows-Hyper-V-Worker-AnalyticNN
25014Operation hot add undo memory completed, Parameter0 pages were processed, time …Operational, Microsoft-Windows-Hyper-V-Worker-AnalyticNN
25015Started releasing memoryOperational, Microsoft-Windows-Hyper-V-Worker-AnalyticNN
25016Operation release memory completed, Parameter0 pages were released, time Time sOperational, Microsoft-Windows-Hyper-V-Worker-AnalyticNN
25017Started backing pagesOperational, Microsoft-Windows-Hyper-V-Worker-AnalyticNN
25018Operation backing pages completed, Parameter0 pages were backed, time Time sOperational, Microsoft-Windows-Hyper-V-Worker-AnalyticNN
25019Started greedy ballooning memory (GUEST)Operational, Microsoft-Windows-Hyper-V-Worker-AnalyticNN
25020Operation greedy ballooning memory completed (GUEST), Parameter0 pages were …Operational, Microsoft-Windows-Hyper-V-Worker-AnalyticNN

Event ID 1500: [Virtual machine VmId]

#
Channel
Operational

Description

[Virtual machine ].

Fields #

NameDescription
TraceData UnicodeString
VmName UnicodeString
VmId UnicodeString
StackFrameCount UInt32
StackFrame Pointer
ModuleCount UInt32
Module Int32

Event ID 1500: [Virtual machine VmId] TraceData.

#
Channel
Microsoft-Windows-Hyper-V-Worker-Analytic

Message #

[Virtual machine %3] %1

Fields #

NameDescription
TraceData UnicodeString
VmName UnicodeString
VmId UnicodeString
StackFrameCount UInt32
StackFrame Pointer
ModuleCount UInt32
Module Int32

Event ID 1510: [Virtual machine VmId]

#
Channel
Operational

Description

[Virtual machine ].

Fields #

NameDescription
TraceData UnicodeString
VmName UnicodeString
VmId UnicodeString
StackFrameCount UInt32
StackFrame Pointer
ModuleCount UInt32
Module Int32

Event ID 1510: [Virtual machine VmId] TraceData.

#
Channel
Microsoft-Windows-Hyper-V-Worker-Analytic

Message #

[Virtual machine %3] %1

Fields #

NameDescription
TraceData UnicodeString
VmName UnicodeString
VmId UnicodeString
StackFrameCount UInt32
StackFrame Pointer
ModuleCount UInt32
Module Int32

Event ID 1520: [Virtual machine VmId]

#
Channel
Operational

Description

[Virtual machine ].

Fields #

NameDescription
TraceData UnicodeString
VmName UnicodeString
VmId UnicodeString
StackFrameCount UInt32
StackFrame Pointer
ModuleCount UInt32
Module Int32

Event ID 1520: [Virtual machine VmId] TraceData.

#
Channel
Microsoft-Windows-Hyper-V-Worker-Analytic

Message #

[Virtual machine %3] %1

Fields #

NameDescription
TraceData UnicodeString
VmName UnicodeString
VmId UnicodeString
StackFrameCount UInt32
StackFrame Pointer
ModuleCount UInt32
Module Int32

Event ID 1530: [Virtual machine VmId]

#
Channel
Operational

Description

[Virtual machine ].

Fields #

NameDescription
TraceData UnicodeString
VmName UnicodeString
VmId UnicodeString
StackFrameCount UInt32
StackFrame Pointer
ModuleCount UInt32
Module Int32

Event ID 1530: [Virtual machine VmId] TraceData.

#
Channel
Microsoft-Windows-Hyper-V-Worker-Analytic

Message #

[Virtual machine %3] %1

Fields #

NameDescription
TraceData UnicodeString
VmName UnicodeString
VmId UnicodeString
StackFrameCount UInt32
StackFrame Pointer
ModuleCount UInt32
Module Int32

Event ID 12540: 'VmName' device Device experienced a protocol error indicative of a deep system problem

#
Channel
Operational, Microsoft-Windows-Hyper-V-Worker-Admin

Description

'VmName' device Device experienced a protocol error indicative of a deep system problem. (Virtual machine ID VmId).

Fields #

NameDescription
VmName UnicodeString
VmId UnicodeString
Device UnicodeString

Event ID 12541: Device Device experienced a protocol error indicative of a deep system problem

#
Channel
Operational, Microsoft-Windows-Hyper-V-Worker-Admin

Description

Device experienced a protocol error indicative of a deep system problem.

Fields #

NameDescription
VmName UnicodeString
VmId UnicodeString
Device UnicodeString

Event ID 12542: VM 'VmName' (Virtual machine ID VmId) is misconfigured with more physical RAM pages than it can access

#
Channel
Operational, Microsoft-Windows-Hyper-V-Worker-Admin

Description

VM 'VmName' (Virtual machine ID VmId) is misconfigured with more physical RAM pages than it can access. Numer of inaccessible pages: InaccessiblePages.

Fields #

NameDescription
VmName UnicodeString
VmId UnicodeString
InaccessiblePages UInt64

Event ID 12543: VM 'VmName' (Virtual machine ID VmId) is misconfigured

#
Channel
Operational, Microsoft-Windows-Hyper-V-Worker-Admin

Fields #

NameDescription
VmName UnicodeString
VmId UnicodeString
InaccessiblePages UInt64

Event ID 12544: 'VmName' device Device found bad data on restoring

#
Channel
Operational, Microsoft-Windows-Hyper-V-Worker-Admin

Description

'VmName' device Device found bad data on restoring. (Virtual machine ID VmId).

Fields #

NameDescription
VmName UnicodeString
VmId UnicodeString
Device UnicodeString

Event ID 12545: Device Device found bad data on restoring

#
Channel
Operational, Microsoft-Windows-Hyper-V-Worker-Admin

Description

Device found bad data on restoring.

Fields #

NameDescription
VmName UnicodeString
VmId UnicodeString
Device UnicodeString

Event ID 12546: VM 'VmName' (Virtual machine ID VmId) is misconfigured to allow guest hibernation along with dynamic memory

#
Channel
Operational, Microsoft-Windows-Hyper-V-Worker-Admin

Fields #

NameDescription
VmName UnicodeString
VmId UnicodeString

Event ID 12547: VM 'VmName' (Virtual machine ID VmId) is misconfigured to allow guest hibernation along with dynamic memory

#
Channel
Operational, Microsoft-Windows-Hyper-V-Worker-Admin

Fields #

NameDescription
VmName UnicodeString
VmId UnicodeString

Event ID 25001: Started reserving memory

#
Channel
Operational, Microsoft-Windows-Hyper-V-Worker-Analytic
Task
Dynamicmemory_reservememory
Opcode
Start

Description

Started reserving memory. Reserving pages. (Virtual machine ID ).

Fields #

NameDescription
VmId UnicodeString
Parameter0 UInt64

Event ID 25002: Operation reserve memory completed, Parameter0 pages were reserved, time Time s

#
Channel
Operational, Microsoft-Windows-Hyper-V-Worker-Analytic
Task
Dynamicmemory_reservememory
Opcode
Stop

Description

Operation reserve memory completed, pages were reserved, time s. (Virtual machine ID ).

Fields #

NameDescription
VmId UnicodeString
Time UnicodeString
Parameter0 UInt64

Event ID 25003: Started committing memory

#
Channel
Operational, Microsoft-Windows-Hyper-V-Worker-Analytic
Task
Dynamicmemory_commitmemory
Opcode
Start

Description

Started committing memory. Committing pages. (Virtual machine ID ).

Fields #

NameDescription
VmId UnicodeString
Parameter0 UInt64

Event ID 25004: Operation committing memory completed, Parameter0 pages were committed, time Time s

#
Channel
Operational, Microsoft-Windows-Hyper-V-Worker-Analytic
Task
Dynamicmemory_commitmemory
Opcode
Stop

Description

Operation committing memory completed, pages were committed, time s. (Virtual machine ID ).

Fields #

NameDescription
VmId UnicodeString
Time UnicodeString
Parameter0 UInt64

Event ID 25005: Started de-committing memory

#
Channel
Operational, Microsoft-Windows-Hyper-V-Worker-Analytic
Task
Dynamicmemory_de_commitmemory
Opcode
Start

Description

Started de-committing memory. De-committing pages. (Virtual machine ID ).

Fields #

NameDescription
VmId UnicodeString
Parameter0 UInt64

Event ID 25006: Operation de-committing memory completed, Parameter0 pages were de-committed, time Time s

#
Channel
Operational, Microsoft-Windows-Hyper-V-Worker-Analytic
Task
Dynamicmemory_de_commitmemory
Opcode
Stop

Description

Operation de-committing memory completed, pages were de-committed, time s. (Virtual machine ID ).

Fields #

NameDescription
VmId UnicodeString
Time UnicodeString
Parameter0 UInt64

Event ID 25007: Started hot adding memory (GUEST)

#
Channel
Operational, Microsoft-Windows-Hyper-V-Worker-Analytic
Task
Dynamicmemory_hotadd
Opcode
Start

Description

Started hot adding memory (GUEST). Hot adding pages. (Virtual machine ID ).

Fields #

NameDescription
VmId UnicodeString
Parameter0 UInt64

Event ID 25008: Operation hot adding memory completed (GUEST), Parameter0 pages were hot added, time Time s

#
Channel
Operational, Microsoft-Windows-Hyper-V-Worker-Analytic
Task
Dynamicmemory_hotadd
Opcode
Stop

Description

Operation hot adding memory completed (GUEST), pages were hot added, time s. (Virtual machine ID ).

Fields #

NameDescription
VmId UnicodeString
Time UnicodeString
Parameter0 UInt64

Event ID 25009: Started un-ballooning memory (GUEST)

#
Channel
Operational, Microsoft-Windows-Hyper-V-Worker-Analytic
Task
Dynamicmemory_un_balloon
Opcode
Start

Description

Started un-ballooning memory (GUEST). Un-ballooning pages. (Virtual machine ID ).

Fields #

NameDescription
VmId UnicodeString
Parameter0 UInt64

Event ID 25010: Operation un-ballooning memory completed (GUEST), Parameter0 pages were un-ballooned, time Time s

#
Channel
Operational, Microsoft-Windows-Hyper-V-Worker-Analytic
Task
Dynamicmemory_un_balloon
Opcode
Stop

Description

Operation un-ballooning memory completed (GUEST), pages were un-ballooned, time s. (Virtual machine ID ).

Fields #

NameDescription
VmId UnicodeString
Time UnicodeString
Parameter0 UInt64

Event ID 25011: Started ballooning memory (GUEST)

#
Channel
Operational, Microsoft-Windows-Hyper-V-Worker-Analytic
Task
Dynamicmemory_balloon
Opcode
Start

Description

Started ballooning memory (GUEST). Ballooning pages. (Virtual machine ID ).

Fields #

NameDescription
VmId UnicodeString
Parameter0 UInt64

Event ID 25012: Operation ballooning memory completed (GUEST), Parameter0 pages were ballooned, time Time s

#
Channel
Operational, Microsoft-Windows-Hyper-V-Worker-Analytic
Task
Dynamicmemory_balloon
Opcode
Stop

Description

Operation ballooning memory completed (GUEST), pages were ballooned, time s. (Virtual machine ID ).

Fields #

NameDescription
VmId UnicodeString
Time UnicodeString
Parameter0 UInt64

Event ID 25013: Started hot add undo memory

#
Channel
Operational, Microsoft-Windows-Hyper-V-Worker-Analytic
Task
Dynamicmemory_hotaddundo
Opcode
Start

Description

Started hot add undo memory. Undoing pages. (Virtual machine ID ).

Fields #

NameDescription
VmId UnicodeString
Parameter0 UInt64

Event ID 25014: Operation hot add undo memory completed, Parameter0 pages were processed, time Time s

#
Channel
Operational, Microsoft-Windows-Hyper-V-Worker-Analytic
Task
Dynamicmemory_hotaddundo
Opcode
Stop

Description

Operation hot add undo memory completed, pages were processed, time s. (Virtual machine ID ).

Fields #

NameDescription
VmId UnicodeString
Time UnicodeString
Parameter0 UInt64

Event ID 25015: Started releasing memory

#
Channel
Operational, Microsoft-Windows-Hyper-V-Worker-Analytic
Task
Dynamicmemory_release
Opcode
Start

Description

Started releasing memory. Releasing pages. (Virtual machine ID ).

Fields #

NameDescription
VmId UnicodeString
Parameter0 UInt64

Event ID 25016: Operation release memory completed, Parameter0 pages were released, time Time s

#
Channel
Operational, Microsoft-Windows-Hyper-V-Worker-Analytic
Task
Dynamicmemory_release
Opcode
Stop

Description

Operation release memory completed, pages were released, time s. (Virtual machine ID ).

Fields #

NameDescription
VmId UnicodeString
Time UnicodeString
Parameter0 UInt64

Event ID 25017: Started backing pages

#
Channel
Operational, Microsoft-Windows-Hyper-V-Worker-Analytic
Task
Dynamicmemory_backpages
Opcode
Start

Description

Started backing pages. Backing pages. (Virtual machine ID ).

Fields #

NameDescription
VmId UnicodeString
Parameter0 UInt64

Event ID 25018: Operation backing pages completed, Parameter0 pages were backed, time Time s

#
Channel
Operational, Microsoft-Windows-Hyper-V-Worker-Analytic
Task
Dynamicmemory_backpages
Opcode
Stop

Description

Operation backing pages completed, pages were backed, time s. (Virtual machine ID ).

Fields #

NameDescription
VmId UnicodeString
Time UnicodeString
Parameter0 UInt64

Event ID 25019: Started greedy ballooning memory (GUEST)

#
Channel
Operational, Microsoft-Windows-Hyper-V-Worker-Analytic
Task
Dynamicmemory_greedyballoooning
Opcode
Start

Description

Started greedy ballooning memory (GUEST). Ballooning pages. (Virtual machine ID ).

Fields #

NameDescription
VmId UnicodeString
Parameter0 UInt64

Event ID 25020: Operation greedy ballooning memory completed (GUEST), Parameter0 pages were ballooned, time Time s

#
Channel
Operational, Microsoft-Windows-Hyper-V-Worker-Analytic
Task
Dynamicmemory_greedyballoooning
Opcode
Stop

Description

Operation greedy ballooning memory completed (GUEST), pages were ballooned, time s. (Virtual machine ID ).

Fields #

NameDescription
VmId UnicodeString
Time UnicodeString
Parameter0 UInt64

Provenance

ETW provider GUID b1d080a6-f3a5-42f6-b6f1-b9fd86c088da

Defined in vmdynmem.dll, which carries the event manifest.

  • Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB