Microsoft-Windows-Kernel-Prefetch

Event	Title	Channel	Sample	Rule
1	PrefetchSectionsStart_V1	Diagnostic	Y	N
2	PrefetchSectionsStop_V1	Diagnostic	Y	N
3	PrefetchMetadataStart_V1	Diagnostic	Y	N
4	PrefetchMetadataStop_V1	Diagnostic	Y	N
5	OpenVolumesStart	Diagnostic	Y	N
6	OpenVolumesStop	Diagnostic	Y	N
7	EndTrace	Diagnostic	Y	N
8	ScenarioDecision	Diagnostic	Y	N
9	GetReadListsStart_V1	Diagnostic	Y	N
10	GetReadListsStop_V1	Diagnostic	Y	N
11	AsyncWorkerStart	Diagnostic	Y	N
12	AsyncWorkerStop	Diagnostic	Y	N
13	AsyncWorker	Diagnostic	Y	N

Event ID 1: PrefetchSectionsStart_V1

Channel: Diagnostic
Level: Informational
Task: PrefetchSections
Opcode: Start

Fields #

Name	Description
`ScenarioNameLength` UInt16
`ScenarioName` UnicodeString
`ScenarioHashId` UInt32
`ScenarioType` UInt32
`PrefetchPhaseMask` UInt32
`PrefetchType` UInt32
`IsTricklePhase` UInt8

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-Kernel-Prefetch/Diagnostic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 1,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 4,
      "thread_id": 2556
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 1,
    "provider": "Microsoft-Windows-Kernel-Prefetch",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 09:07:54.853Z",
    "version": 0
  },
  "event_data": {
    "IsTricklePhase": 0,
    "PrefetchPhaseMask": 1,
    "PrefetchType": 0,
    "ScenarioHashId": 3441713054,
    "ScenarioName": "CMD.EXE",
    "ScenarioNameLength": 7,
    "ScenarioType": 0
  },
  "message": ""
}

Event ID 2: PrefetchSectionsStop_V1

Channel: Diagnostic
Level: Informational
Task: PrefetchSections
Opcode: Stop

Fields #

Name	Description
`ScenarioNameLength` UInt16
`ScenarioName` UnicodeString
`ScenarioHashId` UInt32
`ScenarioType` UInt32
`PrefetchPhaseMask` UInt32
`PrefetchType` UInt32
`IsTricklePhase` UInt8
`NumPagesPrefetched` UInt64
`NumReadLists` UInt32

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-Kernel-Prefetch/Diagnostic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 2,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 4,
      "thread_id": 2556
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 2,
    "provider": "Microsoft-Windows-Kernel-Prefetch",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 09:07:54.855Z",
    "version": 0
  },
  "event_data": {
    "IsTricklePhase": 0,
    "NumPagesPrefetched": 48,
    "NumReadLists": 6,
    "PrefetchPhaseMask": 1,
    "PrefetchType": 0,
    "ScenarioHashId": 3441713054,
    "ScenarioName": "CMD.EXE",
    "ScenarioNameLength": 7,
    "ScenarioType": 0
  },
  "message": ""
}

Event ID 3: PrefetchMetadataStart_V1

Channel: Diagnostic
Level: Informational
Task: PrefetchMetadata
Opcode: Start

Fields #

Name	Description
`ScenarioNameLength` UInt16
`ScenarioName` UnicodeString
`ScenarioHashId` UInt32
`ScenarioType` UInt32
`PrefetchPhaseMask` UInt32

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-Kernel-Prefetch/Diagnostic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 3,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 4,
      "thread_id": 2556
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 1,
    "provider": "Microsoft-Windows-Kernel-Prefetch",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 09:07:54.852Z",
    "version": 0
  },
  "event_data": {
    "PrefetchPhaseMask": 1,
    "ScenarioHashId": 3441713054,
    "ScenarioName": "CMD.EXE",
    "ScenarioNameLength": 7,
    "ScenarioType": 0
  },
  "message": ""
}

Event ID 4: PrefetchMetadataStop_V1

Channel: Diagnostic
Level: Informational
Task: PrefetchMetadata
Opcode: Stop

Fields #

Name	Description
`ScenarioNameLength` UInt16
`ScenarioName` UnicodeString
`ScenarioHashId` UInt32
`ScenarioType` UInt32
`PrefetchPhaseMask` UInt32

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-Kernel-Prefetch/Diagnostic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 4,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 4,
      "thread_id": 2556
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 2,
    "provider": "Microsoft-Windows-Kernel-Prefetch",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 09:07:54.853Z",
    "version": 0
  },
  "event_data": {
    "PrefetchPhaseMask": 1,
    "ScenarioHashId": 3441713054,
    "ScenarioName": "CMD.EXE",
    "ScenarioNameLength": 7,
    "ScenarioType": 0
  },
  "message": ""
}

Event ID 5: OpenVolumesStart

Channel: Diagnostic
Level: Informational
Task: OpenVolumes
Opcode: Start

Fields #

Name	Description
`ScenarioNameLength` UInt16
`ScenarioName` UnicodeString
`ScenarioHashId` UInt32
`ScenarioType` UInt32

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-Kernel-Prefetch/Diagnostic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 5,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 4,
      "thread_id": 2556
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 1,
    "provider": "Microsoft-Windows-Kernel-Prefetch",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 09:07:54.850Z",
    "version": 0
  },
  "event_data": {
    "ScenarioHashId": 3441713054,
    "ScenarioName": "CMD.EXE",
    "ScenarioNameLength": 7,
    "ScenarioType": 0
  },
  "message": ""
}

Event ID 6: OpenVolumesStop

Channel: Diagnostic
Level: Informational
Task: OpenVolumes
Opcode: Stop

Fields #

Name	Description
`ScenarioNameLength` UInt16
`ScenarioName` UnicodeString
`ScenarioHashId` UInt32
`ScenarioType` UInt32

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-Kernel-Prefetch/Diagnostic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 6,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 4,
      "thread_id": 2556
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 2,
    "provider": "Microsoft-Windows-Kernel-Prefetch",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 09:07:54.852Z",
    "version": 0
  },
  "event_data": {
    "ScenarioHashId": 3441713054,
    "ScenarioName": "CMD.EXE",
    "ScenarioNameLength": 7,
    "ScenarioType": 0
  },
  "message": ""
}

Event ID 7: EndTrace

Channel: Diagnostic
Level: Informational
Task: EndTrace

Fields #

Name	Description
`ScenarioNameLength` UInt16
`ScenarioName` UnicodeString
`ScenarioHashId` UInt32
`ScenarioType` UInt32
`EndReason` UInt32

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-Kernel-Prefetch/Diagnostic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 7,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 4,
      "thread_id": 7264
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft-Windows-Kernel-Prefetch",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 09:07:55.032Z",
    "version": 0
  },
  "event_data": {
    "EndReason": 2,
    "ScenarioHashId": 1931461292,
    "ScenarioName": "MODE.COM",
    "ScenarioNameLength": 8,
    "ScenarioType": 0
  },
  "message": ""
}

Event ID 8: ScenarioDecision

Channel: Diagnostic
Also via: realtime ETW trace
Level: Informational
Task: ScenarioDecision
Opcode: win:Info

Fields #

Name	Description
`ScenarioNameLength` UInt16
`ScenarioName` UnicodeString
`ScenarioHashId` UInt32
`ScenarioType` UInt32
`ActionFlags` UInt16
`TraceReason` UInt8
`PrefetchReason` UInt8
`NumLaunches` UInt32
`TimeSinceLastLaunchInS` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Kernel-Prefetch",
    "guid": "{5322D61A-9EFA-4BC3-A3F9-14BE95C144F8}",
    "event_source_name": "",
    "event_id": 8,
    "version": 1,
    "level": 4,
    "task": 8,
    "opcode": 0,
    "keywords": "0x0000000000000020",
    "time_created": "2026-06-02T05:27:48.680+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 13244,
      "thread_id": 22076
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "ActionFlags": 0,
    "NumLaunches": 3221225897,
    "PrefetchReason": 15,
    "ScenarioHashId": 0,
    "ScenarioName": "",
    "ScenarioNameLength": 0,
    "ScenarioType": 0,
    "TimeSinceLastLaunchInS": 4294967295,
    "TraceReason": 15
  },
  "message": "ScenarioDecision"
}

Event ID 9: GetReadListsStart_V1

Channel: Diagnostic
Level: Informational
Task: GetReadLists
Opcode: Start

Fields #

Name	Description
`ScenarioNameLength` UInt16
`ScenarioName` UnicodeString
`ScenarioHashId` UInt32
`ScenarioType` UInt32
`WorkItemsCount` UInt32

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-Kernel-Prefetch/Diagnostic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 9,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 4,
      "thread_id": 2556
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 1,
    "provider": "Microsoft-Windows-Kernel-Prefetch",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 09:07:54.853Z",
    "version": 0
  },
  "event_data": {
    "ScenarioHashId": 3441713054,
    "ScenarioName": "CMD.EXE",
    "ScenarioNameLength": 7,
    "ScenarioType": 0,
    "WorkItemsCount": 15
  },
  "message": ""
}

Event ID 10: GetReadListsStop_V1

Channel: Diagnostic
Level: Informational
Task: GetReadLists
Opcode: Stop

Fields #

Name	Description
`ScenarioNameLength` UInt16
`ScenarioName` UnicodeString
`ScenarioHashId` UInt32
`ScenarioType` UInt32

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-Kernel-Prefetch/Diagnostic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 10,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 4,
      "thread_id": 2556
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 2,
    "provider": "Microsoft-Windows-Kernel-Prefetch",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 09:07:54.854Z",
    "version": 0
  },
  "event_data": {
    "ScenarioHashId": 3441713054,
    "ScenarioName": "CMD.EXE",
    "ScenarioNameLength": 7,
    "ScenarioType": 0
  },
  "message": ""
}

Event ID 11: AsyncWorkerStart

Channel: Diagnostic
Level: Informational
Task: AsyncWorker
Opcode: Start

Fields #

Name	Description
`ScenarioNameLength` UInt16
`ScenarioName` UnicodeString
`ScenarioHashId` UInt32
`ScenarioType` UInt32
`NumPhases` UInt32

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-Kernel-Prefetch/Diagnostic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 11,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 4,
      "thread_id": 2556
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 1,
    "provider": "Microsoft-Windows-Kernel-Prefetch",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 09:07:54.850Z",
    "version": 0
  },
  "event_data": {
    "NumPhases": 1,
    "ScenarioHashId": 3441713054,
    "ScenarioName": "CMD.EXE",
    "ScenarioNameLength": 7,
    "ScenarioType": 0
  },
  "message": ""
}

Event ID 12: AsyncWorkerStop

Channel: Diagnostic
Level: Informational
Task: AsyncWorker
Opcode: Stop

Fields #

Name	Description
`ScenarioNameLength` UInt16
`ScenarioName` UnicodeString
`ScenarioHashId` UInt32
`ScenarioType` UInt32

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-Kernel-Prefetch/Diagnostic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 12,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 4,
      "thread_id": 2556
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 2,
    "provider": "Microsoft-Windows-Kernel-Prefetch",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 09:07:54.857Z",
    "version": 0
  },
  "event_data": {
    "ScenarioHashId": 3441713054,
    "ScenarioName": "CMD.EXE",
    "ScenarioNameLength": 7,
    "ScenarioType": 0
  },
  "message": ""
}

Event ID 13: AsyncWorker

Channel: Diagnostic
Level: Informational
Task: AsyncWorker

Fields #

Name	Description
`ScenarioNameLength` UInt16
`ScenarioName` UnicodeString
`ScenarioHashId` UInt32
`ScenarioType` UInt32

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-Kernel-Prefetch/Diagnostic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 13,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 4,
      "thread_id": 2556
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft-Windows-Kernel-Prefetch",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 09:07:54.856Z",
    "version": 0
  },
  "event_data": {
    "ScenarioHashId": 3441713054,
    "ScenarioName": "CMD.EXE",
    "ScenarioNameLength": 7,
    "ScenarioType": 0
  },
  "message": ""
}

Provenance

ETW provider GUID {5322D61A-9EFA-4BC3-A3F9-14BE95C144F8}

Defined in Microsoft-Windows-System-Events.dll, which carries the event manifest.

WS2022-20348.4893, sample captured from a live trace, binary version 10.0.20348.3932, captured 2026-06-02 — Manifest XML pack, 1.9 MB
WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.3932, captured 2026-06-02 — Manifest XML pack, 1.9 MB
Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.5074, captured 2026-06-02 — Manifest XML pack, 2.0 MB