detection.wiki

Microsoft-Windows-USB-UCX

EventTitleChannelSampleRule
1Start RundownMicrosoft-Windows-USB-UCX-AnalyticNN
2Complete RundownMicrosoft-Windows-USB-UCX-AnalyticNN
3UCX Controller InformationMicrosoft-Windows-USB-UCX-AnalyticNN
4UCX RootHub InformationMicrosoft-Windows-USB-UCX-AnalyticNN
5UCX Device InformationMicrosoft-Windows-USB-UCX-AnalyticNN
6UCX Endpoint InformationMicrosoft-Windows-USB-UCX-AnalyticNN
7UCX Static Stream InformationMicrosoft-Windows-USB-UCX-AnalyticNN
8UCX Controller CreateMicrosoft-Windows-USB-UCX-AnalyticNN
9UCX Controller DeleteMicrosoft-Windows-USB-UCX-AnalyticNN
10UCX RootHub CreateMicrosoft-Windows-USB-UCX-AnalyticNN
11UCX RootHub DeleteMicrosoft-Windows-USB-UCX-AnalyticNN
12UCX RootHub Prepare HardwareMicrosoft-Windows-USB-UCX-AnalyticNN
13UCX RootHub Release HardwareMicrosoft-Windows-USB-UCX-AnalyticNN
14UCX Device CreateMicrosoft-Windows-USB-UCX-AnalyticNN
15UCX Device DeleteMicrosoft-Windows-USB-UCX-AnalyticNN
16UCX Endpoint CreateMicrosoft-Windows-USB-UCX-AnalyticNN
17UCX Endpoint DeleteMicrosoft-Windows-USB-UCX-AnalyticNN
18UCX Static Stream CreateMicrosoft-Windows-USB-UCX-AnalyticNN
19UCX Static Stream DeleteMicrosoft-Windows-USB-UCX-AnalyticNN
20Dispatch URB_FUNCTION_CONTROL_TRANSFERMicrosoft-Windows-USB-UCX-AnalyticNN
21Complete URB_FUNCTION_CONTROL_TRANSFERMicrosoft-Windows-USB-UCX-AnalyticNN
22Complete URB_FUNCTION_CONTROL_TRANSFER with dataMicrosoft-Windows-USB-UCX-AnalyticNN
23Dispatch URB_FUNCTION_CONTROL_TRANSFER_EXMicrosoft-Windows-USB-UCX-AnalyticNN
24Complete URB_FUNCTION_CONTROL_TRANSFER_EXMicrosoft-Windows-USB-UCX-AnalyticNN
25Complete URB_FUNCTION_CONTROL_TRANSFER_EX with dataMicrosoft-Windows-USB-UCX-AnalyticNN
26Dispatch URB_FUNCTION_BULK_OR_INTERRUPT_TRANSFERMicrosoft-Windows-USB-UCX-AnalyticNN
27Complete URB_FUNCTION_BULK_OR_INTERRUPT_TRANSFERMicrosoft-Windows-USB-UCX-AnalyticNN
28Complete URB_FUNCTION_BULK_OR_INTERRUPT_TRANSFER with partial dataMicrosoft-Windows-USB-UCX-AnalyticNN
29Complete URB_FUNCTION_BULK_OR_INTERRUPT_TRANSFER with full dataMicrosoft-Windows-USB-UCX-AnalyticNN
30Dispatch URB_FUNCTION_ISOCH_TRANSFERMicrosoft-Windows-USB-UCX-AnalyticNN
31Complete URB_FUNCTION_ISOCH_TRANSFERMicrosoft-Windows-USB-UCX-AnalyticNN
32Complete URB_FUNCTION_ISOCH_TRANSFER with partial dataMicrosoft-Windows-USB-UCX-AnalyticNN
33Complete URB_FUNCTION_ISOCH_TRANSFER with full dataMicrosoft-Windows-USB-UCX-AnalyticNN
34Dispatch URB_FUNCTION_GET_DESCRIPTOR_FROM_DEVICEMicrosoft-Windows-USB-UCX-AnalyticNN
35Dispatch URB_FUNCTION_GET_DESCRIPTOR_FROM_INTERFACEMicrosoft-Windows-USB-UCX-AnalyticNN
36Dispatch URB_FUNCTION_GET_DESCRIPTOR_FROM_ENDPOINTMicrosoft-Windows-USB-UCX-AnalyticNN
37Dispatch URB_FUNCTION_SET_DESCRIPTOR_TO_DEVICEMicrosoft-Windows-USB-UCX-AnalyticNN
38Dispatch URB_FUNCTION_SET_DESCRIPTOR_TO_INTERFACEMicrosoft-Windows-USB-UCX-AnalyticNN
39Dispatch URB_FUNCTION_SET_DESCRIPTOR_TO_ENDPOINTMicrosoft-Windows-USB-UCX-AnalyticNN
40Dispatch URB_FUNCTION_SET_FEATURE_TO_DEVICEMicrosoft-Windows-USB-UCX-AnalyticNN
41Dispatch URB_FUNCTION_SET_FEATURE_TO_INTERFACEMicrosoft-Windows-USB-UCX-AnalyticNN
42Dispatch URB_FUNCTION_SET_FEATURE_TO_ENDPOINTMicrosoft-Windows-USB-UCX-AnalyticNN
43Dispatch URB_FUNCTION_SET_FEATURE_TO_OTHERMicrosoft-Windows-USB-UCX-AnalyticNN
44Dispatch URB_FUNCTION_CLEAR_FEATURE_TO_DEVICEMicrosoft-Windows-USB-UCX-AnalyticNN
45Dispatch URB_FUNCTION_CLEAR_FEATURE_TO_INTERFACEMicrosoft-Windows-USB-UCX-AnalyticNN
46Dispatch URB_FUNCTION_CLEAR_FEATURE_TO_ENDPOINTMicrosoft-Windows-USB-UCX-AnalyticNN
47Dispatch URB_FUNCTION_CLEAR_FEATURE_TO_OTHERMicrosoft-Windows-USB-UCX-AnalyticNN
48Dispatch URB_FUNCTION_GET_STATUS_FROM_DEVICEMicrosoft-Windows-USB-UCX-AnalyticNN
49Dispatch URB_FUNCTION_GET_STATUS_FROM_INTERFACEMicrosoft-Windows-USB-UCX-AnalyticNN
50Dispatch URB_FUNCTION_GET_STATUS_FROM_ENDPOINTMicrosoft-Windows-USB-UCX-AnalyticNN
51Dispatch URB_FUNCTION_GET_STATUS_FROM_OTHERMicrosoft-Windows-USB-UCX-AnalyticNN
52Dispatch URB_FUNCTION_CLASS_DEVICEMicrosoft-Windows-USB-UCX-AnalyticNN
53Dispatch URB_FUNCTION_CLASS_INTERFACEMicrosoft-Windows-USB-UCX-AnalyticNN
54Dispatch URB_FUNCTION_CLASS_ENDPOINTMicrosoft-Windows-USB-UCX-AnalyticNN
55Dispatch URB_FUNCTION_CLASS_OTHERMicrosoft-Windows-USB-UCX-AnalyticNN
56Dispatch URB_FUNCTION_VENDOR_DEVICEMicrosoft-Windows-USB-UCX-AnalyticNN
57Dispatch URB_FUNCTION_VENDOR_INTERFACEMicrosoft-Windows-USB-UCX-AnalyticNN
58Dispatch URB_FUNCTION_VENDOR_ENDPOINTMicrosoft-Windows-USB-UCX-AnalyticNN
59Dispatch URB_FUNCTION_VENDOR_OTHERMicrosoft-Windows-USB-UCX-AnalyticNN
60Dispatch URB_FUNCTION_GET_CONFIGURATIONMicrosoft-Windows-USB-UCX-AnalyticNN
61Dispatch URB_FUNCTION_GET_INTERFACEMicrosoft-Windows-USB-UCX-AnalyticNN
62Dispatch URB_FUNCTION_GET_MS_FEATURE_DESCRIPTORMicrosoft-Windows-USB-UCX-AnalyticNN
63Endpoint State Machine TransitionMicrosoft-Windows-USB-UCX-AnalyticNN
64Endpoint State Machine EventMicrosoft-Windows-USB-UCX-AnalyticNN
65Rundown Endpoint State Machine TransitionMicrosoft-Windows-USB-UCX-AnalyticNN
66Rundown Endpoint State Machine EventMicrosoft-Windows-USB-UCX-AnalyticNN
67Controller State Machine TransitionMicrosoft-Windows-USB-UCX-AnalyticNN
68Controller State Machine EventMicrosoft-Windows-USB-UCX-AnalyticNN
69Rundown Controller State Machine TransitionMicrosoft-Windows-USB-UCX-AnalyticNN
70Rundown Controller State Machine EventMicrosoft-Windows-USB-UCX-AnalyticNN
71UCX RootHub Initiating WakeMicrosoft-Windows-USB-UCX-AnalyticNN
72Dispatch URB_FUNCTION_SECURE_BULK_OR_INTERRUPT_TRANSFERMicrosoft-Windows-USB-UCX-AnalyticNN
73Complete URB_FUNCTION_SECURE_BULK_OR_INTERRUPT_TRANSFERMicrosoft-Windows-USB-UCX-AnalyticNN
74Dispatch URB_FUNCTION_SECURE_ISOCH_TRANSFERMicrosoft-Windows-USB-UCX-AnalyticNN
75Complete URB_FUNCTION_SECURE_ISOCH_TRANSFERMicrosoft-Windows-USB-UCX-AnalyticNN

Event ID 1: Start Rundown

#
Channel
Microsoft-Windows-USB-UCX-Analytic
Task
UCXDriverRundown
Opcode
Start

Event ID 2: Complete Rundown

#
Channel
Microsoft-Windows-USB-UCX-Analytic
Task
UCXDriverRundown
Opcode
Stop

Event ID 3: UCX Controller Information

#
Channel
Microsoft-Windows-USB-UCX-Analytic
Task
UCXControlerRundown
Opcode
Information

Fields #

NameDescription
fid_UcxController Pointer
fid_ParentBusType UInt32
fid_PciBus UInt32
fid_PciDevice UInt32
fid_PciFunction UInt32
fid_PciVendorId UInt32
fid_PciDeviceId UInt32
fid_PciRevisionId UInt32
fid_AcpiVendorId AnsiString
fid_AcpiDeviceId AnsiString
fid_AcpiRevisionId AnsiString
fid_DeviceInterfacePath UnicodeString

Event ID 4: UCX RootHub Information

#
Channel
Microsoft-Windows-USB-UCX-Analytic
Task
UCXRootHubRundown
Opcode
Information

Fields #

NameDescription
fid_UcxController Pointer
fid_UsbDevice Pointer
fid_DeviceInterfacePath UnicodeString

Event ID 5: UCX Device Information

#
Channel
Microsoft-Windows-USB-UCX-Analytic
Task
UCXDeviceRundown
Opcode
Information

Fields #

NameDescription
fid_UcxController Pointer
fid_HubDevice Pointer
fid_UsbDevice Pointer
DeviceSpeed UInt32
PortPathDepth UInt32
PortPath UInt32

Event ID 6: UCX Endpoint Information

#
Channel
Microsoft-Windows-USB-UCX-Analytic
Task
UCXEndpointRundown
Opcode
Information

Fields #

NameDescription
fid_UsbDevice Pointer
fid_Endpoint Pointer
fid_PipeHandle Pointer
fid_UCX_Endpoint_Descriptor UInt8

Event ID 7: UCX Static Stream Information

#
Channel
Microsoft-Windows-USB-UCX-Analytic
Task
UCXStaticStreamRundown
Opcode
Information

Fields #

NameDescription
fid_UsbDevice Pointer
fid_EndpointPipeHandle Pointer
fid_StreamID UInt32
fid_StreamPipeHandle Pointer

Event ID 8: UCX Controller Create

#
Channel
Microsoft-Windows-USB-UCX-Analytic
Task
UCXControllerCreate
Opcode
Information

Fields #

NameDescription
fid_UcxController Pointer
fid_ParentBusType UInt32
fid_PciBus UInt32
fid_PciDevice UInt32
fid_PciFunction UInt32
fid_PciVendorId UInt32
fid_PciDeviceId UInt32
fid_PciRevisionId UInt32
fid_AcpiVendorId AnsiString
fid_AcpiDeviceId AnsiString
fid_AcpiRevisionId AnsiString
fid_DeviceInterfacePath UnicodeString

Event ID 9: UCX Controller Delete

#
Channel
Microsoft-Windows-USB-UCX-Analytic
Task
UCXControllerDelete
Opcode
Information

Fields #

NameDescription
fid_UcxController Pointer
fid_ParentBusType UInt32
fid_PciBus UInt32
fid_PciDevice UInt32
fid_PciFunction UInt32
fid_PciVendorId UInt32
fid_PciDeviceId UInt32
fid_PciRevisionId UInt32
fid_AcpiVendorId AnsiString
fid_AcpiDeviceId AnsiString
fid_AcpiRevisionId AnsiString
fid_DeviceInterfacePath UnicodeString

Event ID 10: UCX RootHub Create

#
Channel
Microsoft-Windows-USB-UCX-Analytic
Task
UCXRootHubCreate
Opcode
Information

Fields #

NameDescription
fid_UcxController Pointer
fid_UsbDevice Pointer
fid_DeviceInterfacePath UnicodeString

Event ID 11: UCX RootHub Delete

#
Channel
Microsoft-Windows-USB-UCX-Analytic
Task
UCXRootHubDelete
Opcode
Information

Fields #

NameDescription
fid_UcxController Pointer
fid_UsbDevice Pointer
fid_DeviceInterfacePath UnicodeString

Event ID 12: UCX RootHub Prepare Hardware

#
Channel
Microsoft-Windows-USB-UCX-Analytic
Task
UCXRootHubPrepareHardware
Opcode
Information

Fields #

NameDescription
fid_UcxController Pointer
fid_UsbDevice Pointer
fid_DeviceInterfacePath UnicodeString

Event ID 13: UCX RootHub Release Hardware

#
Channel
Microsoft-Windows-USB-UCX-Analytic
Task
UCXRootHubReleaseHardware
Opcode
Information

Fields #

NameDescription
fid_UcxController Pointer
fid_UsbDevice Pointer
fid_DeviceInterfacePath UnicodeString

Event ID 14: UCX Device Create

#
Channel
Microsoft-Windows-USB-UCX-Analytic
Task
UCXDeviceCreate
Opcode
Information

Fields #

NameDescription
fid_UcxController Pointer
fid_HubDevice Pointer
fid_UsbDevice Pointer
DeviceSpeed UInt32
PortPathDepth UInt32
PortPath UInt32

Event ID 15: UCX Device Delete

#
Channel
Microsoft-Windows-USB-UCX-Analytic
Task
UCXDeviceDelete
Opcode
Information

Fields #

NameDescription
fid_UcxController Pointer
fid_HubDevice Pointer
fid_UsbDevice Pointer
DeviceSpeed UInt32
PortPathDepth UInt32
PortPath UInt32

Event ID 16: UCX Endpoint Create

#
Channel
Microsoft-Windows-USB-UCX-Analytic
Task
UCXEndpointCreate
Opcode
Information

Fields #

NameDescription
fid_UsbDevice Pointer
fid_Endpoint Pointer
fid_PipeHandle Pointer
fid_UCX_Endpoint_Descriptor UInt8

Event ID 17: UCX Endpoint Delete

#
Channel
Microsoft-Windows-USB-UCX-Analytic
Task
UCXEndpointDelete
Opcode
Information

Fields #

NameDescription
fid_UsbDevice Pointer
fid_Endpoint Pointer
fid_PipeHandle Pointer
fid_UCX_Endpoint_Descriptor UInt8

Event ID 18: UCX Static Stream Create

#
Channel
Microsoft-Windows-USB-UCX-Analytic
Task
UCXStaticStreamCreate
Opcode
Information

Fields #

NameDescription
fid_UsbDevice Pointer
fid_EndpointPipeHandle Pointer
fid_StreamID UInt32
fid_StreamPipeHandle Pointer

Event ID 19: UCX Static Stream Delete

#
Channel
Microsoft-Windows-USB-UCX-Analytic
Task
UCXStaticStreamDelete
Opcode
Information

Fields #

NameDescription
fid_UsbDevice Pointer
fid_EndpointPipeHandle Pointer
fid_StreamID UInt32
fid_StreamPipeHandle Pointer

Event ID 20: Dispatch URB_FUNCTION_CONTROL_TRANSFER

#
Channel
Microsoft-Windows-USB-UCX-Analytic
Task
URB_FUNCTION_CONTROL_TRANSFER
Opcode
Start

Fields #

NameDescription
fid_UcxController Pointer
fid_UsbDevice Pointer
fid_PipeHandle Pointer
fid_IRP_Ptr Pointer
fid_URB_Ptr Pointer
fid_UCX_URB_CONTROL_TRANSFER UInt16

Event ID 21: Complete URB_FUNCTION_CONTROL_TRANSFER

#
Channel
Microsoft-Windows-USB-UCX-Analytic
Task
URB_FUNCTION_CONTROL_TRANSFER
Opcode
Stop

Fields #

NameDescription
fid_UcxController Pointer
fid_UsbDevice Pointer
fid_PipeHandle Pointer
fid_IRP_Ptr Pointer
fid_URB_Ptr Pointer
fid_UCX_URB_CONTROL_TRANSFER Int32
fid_IRP_NtStatus UInt32

Event ID 22: Complete URB_FUNCTION_CONTROL_TRANSFER with data

#
Channel
Microsoft-Windows-USB-UCX-Analytic
Task
URB_FUNCTION_CONTROL_TRANSFER
Opcode
Stop

Fields #

NameDescription
fid_UcxController Pointer
fid_UsbDevice Pointer
fid_PipeHandle Pointer
fid_IRP_Ptr Pointer
fid_URB_Ptr Pointer
fid_UCX_URB_CONTROL_TRANSFER Int64
fid_IRP_NtStatus UInt32
fid_URB_TransferDataLength UInt16
fid_URB_TransferData UInt8

Event ID 23: Dispatch URB_FUNCTION_CONTROL_TRANSFER_EX

#
Channel
Microsoft-Windows-USB-UCX-Analytic
Task
URB_FUNCTION_CONTROL_TRANSFER_EX
Opcode
Start

Fields #

NameDescription
fid_UcxController Pointer
fid_UsbDevice Pointer
fid_PipeHandle Pointer
fid_IRP_Ptr Pointer
fid_URB_Ptr Pointer
fid_UCX_URB_CONTROL_TRANSFER_EX UInt16

Event ID 24: Complete URB_FUNCTION_CONTROL_TRANSFER_EX

#
Channel
Microsoft-Windows-USB-UCX-Analytic
Task
URB_FUNCTION_CONTROL_TRANSFER_EX
Opcode
Stop

Fields #

NameDescription
fid_UcxController Pointer
fid_UsbDevice Pointer
fid_PipeHandle Pointer
fid_IRP_Ptr Pointer
fid_URB_Ptr Pointer
fid_UCX_URB_CONTROL_TRANSFER_EX Int32
fid_IRP_NtStatus UInt32

Event ID 25: Complete URB_FUNCTION_CONTROL_TRANSFER_EX with data

#
Channel
Microsoft-Windows-USB-UCX-Analytic
Task
URB_FUNCTION_CONTROL_TRANSFER_EX
Opcode
Stop

Fields #

NameDescription
fid_UcxController Pointer
fid_UsbDevice Pointer
fid_PipeHandle Pointer
fid_IRP_Ptr Pointer
fid_URB_Ptr Pointer
fid_UCX_URB_CONTROL_TRANSFER_EX Int64
fid_IRP_NtStatus UInt32
fid_URB_TransferDataLength UInt16
fid_URB_TransferData UInt8

Event ID 26: Dispatch URB_FUNCTION_BULK_OR_INTERRUPT_TRANSFER

#
Channel
Microsoft-Windows-USB-UCX-Analytic
Task
URB_FUNCTION_BULK_OR_INTERRUPT_TRANSFER
Opcode
Start

Fields #

NameDescription
fid_UcxController Pointer
fid_UsbDevice Pointer
fid_PipeHandle Pointer
fid_IRP_Ptr Pointer
fid_URB_Ptr Pointer
fid_UCX_URB_BULK_OR_INTERRUPT_TRANSFER UInt16

Event ID 27: Complete URB_FUNCTION_BULK_OR_INTERRUPT_TRANSFER

#
Channel
Microsoft-Windows-USB-UCX-Analytic
Task
URB_FUNCTION_BULK_OR_INTERRUPT_TRANSFER
Opcode
Stop

Fields #

NameDescription
fid_UcxController Pointer
fid_UsbDevice Pointer
fid_PipeHandle Pointer
fid_IRP_Ptr Pointer
fid_URB_Ptr Pointer
fid_UCX_URB_BULK_OR_INTERRUPT_TRANSFER Int32
fid_IRP_NtStatus UInt32

Event ID 28: Complete URB_FUNCTION_BULK_OR_INTERRUPT_TRANSFER with partial data

#
Channel
Microsoft-Windows-USB-UCX-Analytic
Task
URB_FUNCTION_BULK_OR_INTERRUPT_TRANSFER
Opcode
Stop

Fields #

NameDescription
fid_UcxController Pointer
fid_UsbDevice Pointer
fid_PipeHandle Pointer
fid_IRP_Ptr Pointer
fid_URB_Ptr Pointer
fid_UCX_URB_BULK_OR_INTERRUPT_TRANSFER Int64
fid_IRP_NtStatus UInt32
fid_URB_TransferDataLength UInt16
fid_URB_TransferData UInt8

Event ID 29: Complete URB_FUNCTION_BULK_OR_INTERRUPT_TRANSFER with full data

#
Channel
Microsoft-Windows-USB-UCX-Analytic
Task
URB_FUNCTION_BULK_OR_INTERRUPT_TRANSFER
Opcode
Stop

Fields #

NameDescription
fid_UcxController Pointer
fid_UsbDevice Pointer
fid_PipeHandle Pointer
fid_IRP_Ptr Pointer
fid_URB_Ptr Pointer
fid_UCX_URB_BULK_OR_INTERRUPT_TRANSFER Int64
fid_IRP_NtStatus UInt32
fid_URB_TransferDataLength UInt16
fid_URB_TransferData UInt8

Event ID 30: Dispatch URB_FUNCTION_ISOCH_TRANSFER

#
Channel
Microsoft-Windows-USB-UCX-Analytic
Task
URB_FUNCTION_ISOCH_TRANSFER
Opcode
Start

Fields #

NameDescription
fid_UcxController Pointer
fid_UsbDevice Pointer
fid_PipeHandle Pointer
fid_IRP_Ptr Pointer
fid_URB_Ptr Pointer
fid_UCX_URB_NumberOfPackets UInt16
fid_UCX_URB_ISOCH_TRANSFER UInt32
fid_UCX_URB_ISO_PACKETS CountedMbcsString

Event ID 31: Complete URB_FUNCTION_ISOCH_TRANSFER

#
Channel
Microsoft-Windows-USB-UCX-Analytic
Task
URB_FUNCTION_ISOCH_TRANSFER
Opcode
Stop

Fields #

NameDescription
fid_UcxController Pointer
fid_UsbDevice Pointer
fid_PipeHandle Pointer
fid_IRP_Ptr Pointer
fid_URB_Ptr Pointer
fid_UCX_URB_NumberOfPackets UInt16
fid_UCX_URB_ISOCH_TRANSFER Int64
fid_UCX_URB_ISO_PACKETS Struct
fid_IRP_NtStatus UInt32

Event ID 32: Complete URB_FUNCTION_ISOCH_TRANSFER with partial data

#
Channel
Microsoft-Windows-USB-UCX-Analytic
Task
URB_FUNCTION_ISOCH_TRANSFER
Opcode
Stop

Fields #

NameDescription
fid_UcxController Pointer
fid_UsbDevice Pointer
fid_PipeHandle Pointer
fid_IRP_Ptr Pointer
fid_URB_Ptr Pointer
fid_UCX_URB_NumberOfPackets UInt16
fid_UCX_URB_ISOCH_TRANSFER Float
fid_UCX_URB_ISO_PACKETS 26
fid_IRP_NtStatus UInt32
fid_URB_TransferDataLength UInt16
fid_URB_TransferData UInt8

Event ID 33: Complete URB_FUNCTION_ISOCH_TRANSFER with full data

#
Channel
Microsoft-Windows-USB-UCX-Analytic
Task
URB_FUNCTION_ISOCH_TRANSFER
Opcode
Stop

Fields #

NameDescription
fid_UcxController Pointer
fid_UsbDevice Pointer
fid_PipeHandle Pointer
fid_IRP_Ptr Pointer
fid_URB_Ptr Pointer
fid_UCX_URB_NumberOfPackets UInt16
fid_UCX_URB_ISOCH_TRANSFER Float
fid_UCX_URB_ISO_PACKETS 26
fid_IRP_NtStatus UInt32
fid_URB_TransferDataLength UInt16
fid_URB_TransferData UInt8

Event ID 34: Dispatch URB_FUNCTION_GET_DESCRIPTOR_FROM_DEVICE

#
Channel
Microsoft-Windows-USB-UCX-Analytic
Task
URB_FUNCTION_GET_DESCRIPTOR_FROM_DEVICE
Opcode
Start

Fields #

NameDescription
fid_UcxController Pointer
fid_UsbDevice Pointer
fid_PipeHandle Pointer
fid_IRP_Ptr Pointer
fid_URB_Ptr Pointer
fid_UCX_URB_CONTROL_TRANSFER UInt16

Event ID 35: Dispatch URB_FUNCTION_GET_DESCRIPTOR_FROM_INTERFACE

#
Channel
Microsoft-Windows-USB-UCX-Analytic
Task
URB_FUNCTION_GET_DESCRIPTOR_FROM_INTERFACE
Opcode
Start

Fields #

NameDescription
fid_UcxController Pointer
fid_UsbDevice Pointer
fid_PipeHandle Pointer
fid_IRP_Ptr Pointer
fid_URB_Ptr Pointer
fid_UCX_URB_CONTROL_TRANSFER UInt16

Event ID 36: Dispatch URB_FUNCTION_GET_DESCRIPTOR_FROM_ENDPOINT

#
Channel
Microsoft-Windows-USB-UCX-Analytic
Task
URB_FUNCTION_GET_DESCRIPTOR_FROM_ENDPOINT
Opcode
Start

Fields #

NameDescription
fid_UcxController Pointer
fid_UsbDevice Pointer
fid_PipeHandle Pointer
fid_IRP_Ptr Pointer
fid_URB_Ptr Pointer
fid_UCX_URB_CONTROL_TRANSFER UInt16

Event ID 37: Dispatch URB_FUNCTION_SET_DESCRIPTOR_TO_DEVICE

#
Channel
Microsoft-Windows-USB-UCX-Analytic
Task
URB_FUNCTION_SET_DESCRIPTOR_TO_DEVICE
Opcode
Start

Fields #

NameDescription
fid_UcxController Pointer
fid_UsbDevice Pointer
fid_PipeHandle Pointer
fid_IRP_Ptr Pointer
fid_URB_Ptr Pointer
fid_UCX_URB_CONTROL_TRANSFER UInt16

Event ID 38: Dispatch URB_FUNCTION_SET_DESCRIPTOR_TO_INTERFACE

#
Channel
Microsoft-Windows-USB-UCX-Analytic
Task
URB_FUNCTION_SET_DESCRIPTOR_TO_INTERFACE
Opcode
Start

Fields #

NameDescription
fid_UcxController Pointer
fid_UsbDevice Pointer
fid_PipeHandle Pointer
fid_IRP_Ptr Pointer
fid_URB_Ptr Pointer
fid_UCX_URB_CONTROL_TRANSFER UInt16

Event ID 39: Dispatch URB_FUNCTION_SET_DESCRIPTOR_TO_ENDPOINT

#
Channel
Microsoft-Windows-USB-UCX-Analytic
Task
URB_FUNCTION_SET_DESCRIPTOR_TO_ENDPOINT
Opcode
Start

Fields #

NameDescription
fid_UcxController Pointer
fid_UsbDevice Pointer
fid_PipeHandle Pointer
fid_IRP_Ptr Pointer
fid_URB_Ptr Pointer
fid_UCX_URB_CONTROL_TRANSFER UInt16

Event ID 40: Dispatch URB_FUNCTION_SET_FEATURE_TO_DEVICE

#
Channel
Microsoft-Windows-USB-UCX-Analytic
Task
URB_FUNCTION_SET_FEATURE_TO_DEVICE
Opcode
Start

Fields #

NameDescription
fid_UcxController Pointer
fid_UsbDevice Pointer
fid_PipeHandle Pointer
fid_IRP_Ptr Pointer
fid_URB_Ptr Pointer
fid_UCX_URB_CONTROL_TRANSFER UInt16

Event ID 41: Dispatch URB_FUNCTION_SET_FEATURE_TO_INTERFACE

#
Channel
Microsoft-Windows-USB-UCX-Analytic
Task
URB_FUNCTION_SET_FEATURE_TO_INTERFACE
Opcode
Start

Fields #

NameDescription
fid_UcxController Pointer
fid_UsbDevice Pointer
fid_PipeHandle Pointer
fid_IRP_Ptr Pointer
fid_URB_Ptr Pointer
fid_UCX_URB_CONTROL_TRANSFER UInt16

Event ID 42: Dispatch URB_FUNCTION_SET_FEATURE_TO_ENDPOINT

#
Channel
Microsoft-Windows-USB-UCX-Analytic
Task
URB_FUNCTION_SET_FEATURE_TO_ENDPOINT
Opcode
Start

Fields #

NameDescription
fid_UcxController Pointer
fid_UsbDevice Pointer
fid_PipeHandle Pointer
fid_IRP_Ptr Pointer
fid_URB_Ptr Pointer
fid_UCX_URB_CONTROL_TRANSFER UInt16

Event ID 43: Dispatch URB_FUNCTION_SET_FEATURE_TO_OTHER

#
Channel
Microsoft-Windows-USB-UCX-Analytic
Task
URB_FUNCTION_SET_FEATURE_TO_OTHER
Opcode
Start

Fields #

NameDescription
fid_UcxController Pointer
fid_UsbDevice Pointer
fid_PipeHandle Pointer
fid_IRP_Ptr Pointer
fid_URB_Ptr Pointer
fid_UCX_URB_CONTROL_TRANSFER UInt16

Event ID 44: Dispatch URB_FUNCTION_CLEAR_FEATURE_TO_DEVICE

#
Channel
Microsoft-Windows-USB-UCX-Analytic
Task
URB_FUNCTION_CLEAR_FEATURE_TO_DEVICE
Opcode
Start

Fields #

NameDescription
fid_UcxController Pointer
fid_UsbDevice Pointer
fid_PipeHandle Pointer
fid_IRP_Ptr Pointer
fid_URB_Ptr Pointer
fid_UCX_URB_CONTROL_TRANSFER UInt16

Event ID 45: Dispatch URB_FUNCTION_CLEAR_FEATURE_TO_INTERFACE

#
Channel
Microsoft-Windows-USB-UCX-Analytic
Task
URB_FUNCTION_CLEAR_FEATURE_TO_INTERFACE
Opcode
Start

Fields #

NameDescription
fid_UcxController Pointer
fid_UsbDevice Pointer
fid_PipeHandle Pointer
fid_IRP_Ptr Pointer
fid_URB_Ptr Pointer
fid_UCX_URB_CONTROL_TRANSFER UInt16

Event ID 46: Dispatch URB_FUNCTION_CLEAR_FEATURE_TO_ENDPOINT

#
Channel
Microsoft-Windows-USB-UCX-Analytic
Task
URB_FUNCTION_CLEAR_FEATURE_TO_ENDPOINT
Opcode
Start

Fields #

NameDescription
fid_UcxController Pointer
fid_UsbDevice Pointer
fid_PipeHandle Pointer
fid_IRP_Ptr Pointer
fid_URB_Ptr Pointer
fid_UCX_URB_CONTROL_TRANSFER UInt16

Event ID 47: Dispatch URB_FUNCTION_CLEAR_FEATURE_TO_OTHER

#
Channel
Microsoft-Windows-USB-UCX-Analytic
Task
URB_FUNCTION_CLEAR_FEATURE_TO_OTHER
Opcode
Start

Fields #

NameDescription
fid_UcxController Pointer
fid_UsbDevice Pointer
fid_PipeHandle Pointer
fid_IRP_Ptr Pointer
fid_URB_Ptr Pointer
fid_UCX_URB_CONTROL_TRANSFER UInt16

Event ID 48: Dispatch URB_FUNCTION_GET_STATUS_FROM_DEVICE

#
Channel
Microsoft-Windows-USB-UCX-Analytic
Task
URB_FUNCTION_GET_STATUS_FROM_DEVICE
Opcode
Start

Fields #

NameDescription
fid_UcxController Pointer
fid_UsbDevice Pointer
fid_PipeHandle Pointer
fid_IRP_Ptr Pointer
fid_URB_Ptr Pointer
fid_UCX_URB_CONTROL_TRANSFER UInt16

Event ID 49: Dispatch URB_FUNCTION_GET_STATUS_FROM_INTERFACE

#
Channel
Microsoft-Windows-USB-UCX-Analytic
Task
URB_FUNCTION_GET_STATUS_FROM_INTERFACE
Opcode
Start

Fields #

NameDescription
fid_UcxController Pointer
fid_UsbDevice Pointer
fid_PipeHandle Pointer
fid_IRP_Ptr Pointer
fid_URB_Ptr Pointer
fid_UCX_URB_CONTROL_TRANSFER UInt16

Event ID 50: Dispatch URB_FUNCTION_GET_STATUS_FROM_ENDPOINT

#
Channel
Microsoft-Windows-USB-UCX-Analytic
Task
URB_FUNCTION_GET_STATUS_FROM_ENDPOINT
Opcode
Start

Fields #

NameDescription
fid_UcxController Pointer
fid_UsbDevice Pointer
fid_PipeHandle Pointer
fid_IRP_Ptr Pointer
fid_URB_Ptr Pointer
fid_UCX_URB_CONTROL_TRANSFER UInt16

Event ID 51: Dispatch URB_FUNCTION_GET_STATUS_FROM_OTHER

#
Channel
Microsoft-Windows-USB-UCX-Analytic
Task
URB_FUNCTION_GET_STATUS_FROM_OTHER
Opcode
Start

Fields #

NameDescription
fid_UcxController Pointer
fid_UsbDevice Pointer
fid_PipeHandle Pointer
fid_IRP_Ptr Pointer
fid_URB_Ptr Pointer
fid_UCX_URB_CONTROL_TRANSFER UInt16

Event ID 52: Dispatch URB_FUNCTION_CLASS_DEVICE

#
Channel
Microsoft-Windows-USB-UCX-Analytic
Task
URB_FUNCTION_CLASS_DEVICE
Opcode
Start

Fields #

NameDescription
fid_UcxController Pointer
fid_UsbDevice Pointer
fid_PipeHandle Pointer
fid_IRP_Ptr Pointer
fid_URB_Ptr Pointer
fid_UCX_URB_CONTROL_TRANSFER UInt16

Event ID 53: Dispatch URB_FUNCTION_CLASS_INTERFACE

#
Channel
Microsoft-Windows-USB-UCX-Analytic
Task
URB_FUNCTION_CLASS_INTERFACE
Opcode
Start

Fields #

NameDescription
fid_UcxController Pointer
fid_UsbDevice Pointer
fid_PipeHandle Pointer
fid_IRP_Ptr Pointer
fid_URB_Ptr Pointer
fid_UCX_URB_CONTROL_TRANSFER UInt16

Event ID 54: Dispatch URB_FUNCTION_CLASS_ENDPOINT

#
Channel
Microsoft-Windows-USB-UCX-Analytic
Task
URB_FUNCTION_CLASS_ENDPOINT
Opcode
Start

Fields #

NameDescription
fid_UcxController Pointer
fid_UsbDevice Pointer
fid_PipeHandle Pointer
fid_IRP_Ptr Pointer
fid_URB_Ptr Pointer
fid_UCX_URB_CONTROL_TRANSFER UInt16

Event ID 55: Dispatch URB_FUNCTION_CLASS_OTHER

#
Channel
Microsoft-Windows-USB-UCX-Analytic
Task
URB_FUNCTION_CLASS_OTHER
Opcode
Start

Fields #

NameDescription
fid_UcxController Pointer
fid_UsbDevice Pointer
fid_PipeHandle Pointer
fid_IRP_Ptr Pointer
fid_URB_Ptr Pointer
fid_UCX_URB_CONTROL_TRANSFER UInt16

Event ID 56: Dispatch URB_FUNCTION_VENDOR_DEVICE

#
Channel
Microsoft-Windows-USB-UCX-Analytic
Task
URB_FUNCTION_VENDOR_DEVICE
Opcode
Start

Fields #

NameDescription
fid_UcxController Pointer
fid_UsbDevice Pointer
fid_PipeHandle Pointer
fid_IRP_Ptr Pointer
fid_URB_Ptr Pointer
fid_UCX_URB_CONTROL_TRANSFER UInt16

Event ID 57: Dispatch URB_FUNCTION_VENDOR_INTERFACE

#
Channel
Microsoft-Windows-USB-UCX-Analytic
Task
URB_FUNCTION_VENDOR_INTERFACE
Opcode
Start

Fields #

NameDescription
fid_UcxController Pointer
fid_UsbDevice Pointer
fid_PipeHandle Pointer
fid_IRP_Ptr Pointer
fid_URB_Ptr Pointer
fid_UCX_URB_CONTROL_TRANSFER UInt16

Event ID 58: Dispatch URB_FUNCTION_VENDOR_ENDPOINT

#
Channel
Microsoft-Windows-USB-UCX-Analytic
Task
URB_FUNCTION_VENDOR_ENDPOINT
Opcode
Start

Fields #

NameDescription
fid_UcxController Pointer
fid_UsbDevice Pointer
fid_PipeHandle Pointer
fid_IRP_Ptr Pointer
fid_URB_Ptr Pointer
fid_UCX_URB_CONTROL_TRANSFER UInt16

Event ID 59: Dispatch URB_FUNCTION_VENDOR_OTHER

#
Channel
Microsoft-Windows-USB-UCX-Analytic
Task
URB_FUNCTION_VENDOR_OTHER
Opcode
Start

Fields #

NameDescription
fid_UcxController Pointer
fid_UsbDevice Pointer
fid_PipeHandle Pointer
fid_IRP_Ptr Pointer
fid_URB_Ptr Pointer
fid_UCX_URB_CONTROL_TRANSFER UInt16

Event ID 60: Dispatch URB_FUNCTION_GET_CONFIGURATION

#
Channel
Microsoft-Windows-USB-UCX-Analytic
Task
URB_FUNCTION_GET_CONFIGURATION
Opcode
Start

Fields #

NameDescription
fid_UcxController Pointer
fid_UsbDevice Pointer
fid_PipeHandle Pointer
fid_IRP_Ptr Pointer
fid_URB_Ptr Pointer
fid_UCX_URB_CONTROL_TRANSFER UInt16

Event ID 61: Dispatch URB_FUNCTION_GET_INTERFACE

#
Channel
Microsoft-Windows-USB-UCX-Analytic
Task
URB_FUNCTION_GET_INTERFACE
Opcode
Start

Fields #

NameDescription
fid_UcxController Pointer
fid_UsbDevice Pointer
fid_PipeHandle Pointer
fid_IRP_Ptr Pointer
fid_URB_Ptr Pointer
fid_UCX_URB_CONTROL_TRANSFER UInt16

Event ID 62: Dispatch URB_FUNCTION_GET_MS_FEATURE_DESCRIPTOR

#
Channel
Microsoft-Windows-USB-UCX-Analytic
Task
URB_FUNCTION_GET_MS_FEATURE_DESCRIPTOR
Opcode
Start

Fields #

NameDescription
fid_UcxController Pointer
fid_UsbDevice Pointer
fid_PipeHandle Pointer
fid_IRP_Ptr Pointer
fid_URB_Ptr Pointer
fid_UCX_URB_CONTROL_TRANSFER UInt16

Event ID 63: Endpoint State Machine Transition

#
Channel
Microsoft-Windows-USB-UCX-Analytic
Task
ENDPOINT_STATE_MACHINE_TRANSITION
Opcode
Information

Fields #

NameDescription
fid_Endpoint Pointer
fid_URB_PipeHandle Pointer
fid_State UInt32
fid_Event UInt32

Event ID 64: Endpoint State Machine Event

#
Channel
Microsoft-Windows-USB-UCX-Analytic
Task
ENDPOINT_STATE_MACHINE_EVENT
Opcode
Information

Fields #

NameDescription
fid_Endpoint Pointer
fid_URB_PipeHandle Pointer
fid_Event UInt32

Event ID 65: Rundown Endpoint State Machine Transition

#
Channel
Microsoft-Windows-USB-UCX-Analytic
Task
UCXEndpointRundown
Opcode
Information

Fields #

NameDescription
fid_Endpoint Pointer
fid_URB_PipeHandle Pointer
fid_State UInt32
fid_Event UInt32

Event ID 66: Rundown Endpoint State Machine Event

#
Channel
Microsoft-Windows-USB-UCX-Analytic
Task
UCXEndpointRundown
Opcode
Information

Fields #

NameDescription
fid_Endpoint Pointer
fid_URB_PipeHandle Pointer
fid_Event UInt32

Event ID 67: Controller State Machine Transition

#
Channel
Microsoft-Windows-USB-UCX-Analytic
Task
CONTROLLER_STATE_MACHINE_TRANSITION
Opcode
Information

Fields #

NameDescription
fid_UcxController Pointer
fid_SmEngineContext Pointer
fid_State UInt32
fid_Event UInt32

Event ID 68: Controller State Machine Event

#
Channel
Microsoft-Windows-USB-UCX-Analytic
Task
CONTROLLER_STATE_MACHINE_EVENT
Opcode
Information

Fields #

NameDescription
fid_UcxController Pointer
fid_SmEngineContext Pointer
fid_Event UInt32

Event ID 69: Rundown Controller State Machine Transition

#
Channel
Microsoft-Windows-USB-UCX-Analytic
Task
UCXControlerRundown
Opcode
Information

Fields #

NameDescription
fid_UcxController Pointer
fid_SmEngineContext Pointer
fid_State UInt32
fid_Event UInt32

Event ID 70: Rundown Controller State Machine Event

#
Channel
Microsoft-Windows-USB-UCX-Analytic
Task
UCXControlerRundown
Opcode
Information

Fields #

NameDescription
fid_UcxController Pointer
fid_SmEngineContext Pointer
fid_Event UInt32

Event ID 71: UCX RootHub Initiating Wake

#
Channel
Microsoft-Windows-USB-UCX-Analytic
Task
UCXRootHubInitiatingWake
Opcode
Information

Fields #

NameDescription
fid_UcxController Pointer
fid_UsbDevice Pointer
fid_DeviceInterfacePath UnicodeString

Event ID 72: Dispatch URB_FUNCTION_SECURE_BULK_OR_INTERRUPT_TRANSFER

#
Channel
Microsoft-Windows-USB-UCX-Analytic
Task
URB_FUNCTION_SECURE_BULK_OR_INTERRUPT_TRANSFER
Opcode
Start

Fields #

NameDescription
fid_UcxController Pointer
fid_UsbDevice Pointer
fid_PipeHandle Pointer
fid_IRP_Ptr Pointer
fid_URB_Ptr Pointer
fid_UCX_URB_SECURE_BULK_OR_INTERRUPT_TRANSFER UInt16

Event ID 73: Complete URB_FUNCTION_SECURE_BULK_OR_INTERRUPT_TRANSFER

#
Channel
Microsoft-Windows-USB-UCX-Analytic
Task
URB_FUNCTION_SECURE_BULK_OR_INTERRUPT_TRANSFER
Opcode
Stop

Fields #

NameDescription
fid_UcxController Pointer
fid_UsbDevice Pointer
fid_PipeHandle Pointer
fid_IRP_Ptr Pointer
fid_URB_Ptr Pointer
fid_UCX_URB_SECURE_BULK_OR_INTERRUPT_TRANSFER Int32
fid_IRP_NtStatus UInt32

Event ID 74: Dispatch URB_FUNCTION_SECURE_ISOCH_TRANSFER

#
Channel
Microsoft-Windows-USB-UCX-Analytic
Task
URB_FUNCTION_SECURE_ISOCH_TRANSFER
Opcode
Start

Fields #

NameDescription
fid_UcxController Pointer
fid_UsbDevice Pointer
fid_PipeHandle Pointer
fid_IRP_Ptr Pointer
fid_URB_Ptr Pointer
fid_UCX_URB_NumberOfPackets UInt16
fid_UCX_URB_SECURE_ISOCH_TRANSFER UInt32
fid_UCX_URB_ISO_PACKETS CountedUtf16String

Event ID 75: Complete URB_FUNCTION_SECURE_ISOCH_TRANSFER

#
Channel
Microsoft-Windows-USB-UCX-Analytic
Task
URB_FUNCTION_SECURE_ISOCH_TRANSFER
Opcode
Stop

Fields #

NameDescription
fid_UcxController Pointer
fid_UsbDevice Pointer
fid_PipeHandle Pointer
fid_IRP_Ptr Pointer
fid_URB_Ptr Pointer
fid_UCX_URB_NumberOfPackets UInt16
fid_UCX_URB_SECURE_ISOCH_TRANSFER Int64
fid_UCX_URB_ISO_PACKETS CountedMbcsString
fid_IRP_NtStatus UInt32

Provenance

ETW provider GUID 36da592d-e43a-4e28-af6f-4bc57c5a11e8

Defined in ucx01000.sys, the binary that emits these events.

  • WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.4297, captured 2026-06-02 — Manifest XML pack, 1.9 MB
  • Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.5074, captured 2026-06-02 — Manifest XML pack, 2.0 MB