Microsoft-Windows-WinINet

Event	Title	Channel	Sample	Rule
101	Session handle HINTERNET created: UserAgent=UserAgent, AccessType=AccessType, …	Analytic	Y	N
102	Handle ConnectionHandle created by InternetOpenURL: …	Analytic	Y	N
103	Handle ConnectionHandle created by InternetConnect: SessionHandle=ParentHandle, …	Analytic	Y	N
104	Request handle ConnectionHandle created by HttpOpenRequest: …	Analytic	Y	N
105	Handle HINTERNET closed successfully.	Analytic	Y	N
106	Failed to create handle: ParentHandle=HINTERNET, Error=Error.	Analytic	N	N
107	Handle HINTERNET failed to close: Error=Error.	Analytic	N	N
108	Request handle ConnectionHandle Server Details: Server=ServerName …	Analytic	Y	N
200	HTTP request was received from API: RequestHandle=HINTERNET.	Analytic	Y	N
201	HTTP request was sent successfully: RequestHandle=RequestHandle, …	Analytic	Y	N
202	HTTP request send failed: Handle=Handle, Error=Error.	Analytic	N	N
203	HTTP response (ResponseCode) received: RequestHandle=RequestHandle, …	Analytic	Y	N
204	HTTP response failed: Handle=Handle, Error=Error.	Analytic	N	N
205	HTTP connection (Handle=ConnectionHandle, SocketHandle=SocketHandle) closed due …	Analytic	N	N
206	Keep-alive connection is re-used: ConnectionHandle=ConnectionHandle, …	Analytic	N	N
207	Connection is returned to keep-alive pool: RequestHandle=ConnectionHandle, …	Analytic	Y	N
208	Keep-alive connection is closed: ConnectionHandle=ConnectionHandle, …	Analytic	N	N
209	HTTP response entity body received: RequestHandle=RequestHandle.	Analytic	Y	N
210	HTTP Request Headers RequestHandle=RequestHandle Headers.	Analytic	Y	N
211	HTTP Response Headers RequestHandle=RequestHandle Headers.	Analytic	Y	N
212	HTTP Request Headers OptionalData RequestHandle=RequestHandle Headers.	Analytic	Y	N
213	WinInet::Http response entity body receive failed: Request Handle=RequestHandle, …	Analytic	N	N
301	TCP connection to server ServerName established: …	Analytic	Y	N
302	TCP connection to ServerName for connection handle ConnectionHandle failed: …	Analytic	N	N
303	TCP connection closed successfully: SocketHandle=SocketHandle.	Analytic	N	N
304	DNS query for HostName hostname is sent: Handle=RequestHandle.	Analytic	Y	N
305	DNS query for HostName hostname is complete: Handle=RequestHandle, …	Analytic	Y	N
306	DNS query for HostName hostname failed: Handle=RequestHandle Error=Error.	Analytic	N	N
307	Re-used DNS cache, query for HostName hostname is complete: …	Analytic	Y	N
308	A network change was detected: Handle=Handle.	Analytic	N	N
400	Wininet_WebSocketUpgrade	WebSocket	N	N
401	Wininet_WebSocketUpgrade401	WebSocket	N	N
402	Wininet_WebSocketSessionStart	WebSocket	N	N
403	Wininet_WebSocketSessionStop	WebSocket	N	N
404	Wininet_WebSocketSession	WebSocket	N	N
405	Wininet_WebSocketSession405	WebSocket	N	N
406	Wininet_WebSocketSession406	WebSocket	N	N
407	Wininet_WebSocketSession407	WebSocket	N	N
408	Wininet_WebSocketSession408	WebSocket	N	N
409	Wininet_WebSocketSession409	WebSocket	N	N
410	Wininet_WebSocketSession410	WebSocket	N	N
411	Wininet_WebSocketSession411	WebSocket	N	N
412	Wininet_WebSocketSession412	WebSocket	N	N
413	Wininet_WebSocketSession413	WebSocket	N	N
414	Wininet_WebSocketSession414	WebSocket	N	N
415	Wininet_WebSocketSession415	WebSocket	N	N
416	Wininet_WebSocketSession416	WebSocket	N	N
417	Wininet_WebSocketSession417	WebSocket	N	N
501	Received response including a cookie header: URL=URL.	Analytic	N	N
502	Client has stored a cookie in the cookie jar: Domain=Domain, Path=Path, …	Analytic	N	N
503	Client has deleted a cookie in the cookie jar: Domain=Domain, Path=Path, …	Analytic	N	N
504	Client has rejected a cookie sent by the server: Domain=Domain, Path=Path, …	Analytic	N	N
505	Server cookie was rejected by the client's P3P policy: Domain=Domain, Path=Path, …	Analytic	N	N
506	A cookie header was created for the request: URL=URL.	Analytic	N	N
507	Cookie added to the request header: Domain=Domain, Path=Path, Name=Name, …	Analytic	N	N
601	Auth response received: RequestHandle=RequestHandle, Scheme=Scheme, …	Analytic	N	N
602	Client sets username: RequestHandle=RequestHandle, IsProxy=IsProxy.	Analytic	N	N
603	Client sets password: RequestHandle=RequestHandle, IsProxy=IsProxy.	Analytic	N	N
604	Using cached credentials: RequestHandle=RequestHandle, IsProxy=IsProxy.	Analytic	N	N
605	Using default credentials: RequestHandle=RequestHandle, IsProxy=IsProxy.	Analytic	N	N
606	Client adds authorization headers to an HTTP request: …	Analytic	N	N
701	Client begins SSL negotiation: RequestHandle=RequestHandle.	Analytic	Y	N
702	SSL negotiation between client and server has completed successfully: …	Analytic	Y	N
703	SSL negotiation failed: RequestHandle=RequestHandle, Error=Error.	Analytic	N	N
704	Error validating server certificate (SCHANNEL error): …	Analytic	N	N
705	Server certificate validated: RequestHandle=RequestHandle, CertHash=CertHash, …	Analytic	Y	N
706	Server requires a client certificate for client authorization: …	Analytic	N	N
707	There is no client certificate available: RequestHandle=RequestHandle.	Analytic	N	N
708	The selected client certificate will be used for the SSL transaction: …	Analytic	N	N
711	Client begins SSL renegotiation: RequestHandle=RequestHandle.	Analytic	Y	N
712	SSL renegotiation between client and server has completed successfully: …	Analytic	Y	N
713	SSL renegotiation failed: RequestHandle=RequestHandle, Error=Error.	Analytic	N	N
801	Client begins attempts to locate the WPAD configuration file: …	Analytic	N	N
802	Begin search for configuration file using DHCP: Interface=Interface.	Analytic	N	N
803	WPAD configuration file found using DHCP: Interface=Interface, …	Analytic	N	N
804	Search for WPAD configuration file using DHCP failed: Interface=Interface, …	Analytic	N	N
805	Begin search for configuration file using DNS: DetectFlags=DetectFlags.	Analytic	N	N
806	WPAD configuration file found using DNS: ConfigurationURL=ConfigurationURL, …	Analytic	N	N
807	Search for WPAD configuration file using DNS failed: DetectFlags=DetectFlags, …	Analytic	N	N
808	Search for WPAD configruation file failed: Error=Error.	Analytic	N	N
809	Begin downloading the configuration file from the configuration URL: …	Analytic	N	N
810	Client successfully downloaded the configuration file from the configuration …	Analytic	N	N
811	Downloading the configuration file from the configuration URL failed: …	Analytic	N	N
812	The downloaded configuration file could not be used: …	Analytic	N	N
813	Searching for Proxy Information for the URL: URL=URL.	Analytic	N	N
814	Client has successfully retrieved proxy data for accessing a specified resource: …	Analytic	N	N
815	Error locating proxy information for the URL: URL=URL, Error=Error.	Analytic	N	N
816	Blocking autoproxy determination started	Analytic	N	N
817	Blocking autoproxy determination stopped	Analytic	N	N
818	WinInet Activity Transfer Event	Analytic	N	N
819	AutoProxy SWPAD Decision (WPADNetworkDecision) NumConnections (NetworkCount).	Analytic	N	N
820	Autoproxy host IP lookup started	Analytic	N	N
821	Autoproxy host IP lookup stopped	Analytic	N	N
822	Autoproxy SWPAD lookup started	Analytic	N	N
823	Autoproxy SWPAD lookup stopped	Analytic	N	N
824	Autoproxy Detection with SWPAD ON started	Analytic	N	N
825	Autoproxy Detection with SWPAD ON stopped	Analytic	N	N
826	Autoproxy Detection with SWPAD UNKNOWN started	Analytic	N	N
827	Autoproxy Detection with SWPAD UNKNOWN stopped	Analytic	N	N
828	Autoproxy Script Download Started	Analytic	N	N
829	Autoproxy Script Download Stopped	Analytic	N	N
834	Autoproxy full scenario started	Analytic	N	N
835	Autoproxy full scenario stopped	Analytic	N	N
901	Application offline check started	Analytic	N	N
902	Application offline check complete	Analytic	N	N
1000	WININET_TEST_EVENT	Analytic	N	N
1007	Wininet_SendRequestStart	Analytic	Y	N
1008	Wininet_SendRequestStop	Analytic	Y	N
1009	Wininet_OfflineCacheLookup	Analytic	N	N
1011	Wininet_OfflineCacheHit	Analytic	N	N
1013	Wininet_OfflineCacheMiss	Analytic	N	N
1015	Wininet_PreNet_CacheLookup	Analytic	Y	N
1017	Wininet_PreNet_CacheHit	Analytic	N	N
1019	Wininet_PreNet_CacheMiss	Analytic	Y	N
1021	Wininet_PostNet_CacheLookup	Analytic	Y	N
1023	Wininet_PostNet_CacheHit	Analytic	N	N
1025	Wininet_PostNet_CacheMiss	Analytic	Y	N
1027	Wininet_AutodialIfNotLocalHostStart	Analytic	N	N
1028	Wininet_AutodialIfNotLocalHostStop	Analytic	N	N
1029	Wininet_ResolveHostStart	Analytic	Y	N
1030	Wininet_ResolveHostStop	Analytic	Y	N
1031	Wininet_SendRequest_Main	Analytic	Y	N
1033	Wininet_SendRequest_Extra	Analytic	N	N
1035	Wininet_SendRequest_CRLF	Analytic	N	N
1037	Wininet_ReadData	Analytic	Y	N
1039	Wininet_ReadDataPostReceiveBuf	Analytic	Y	N
1041	Wininet_SendRequest_PostReceiveBuf	Analytic	Y	N
1043	Wininet_DrainResponsePostReceiveBuf	Analytic	N	N
1045	Wininet_ConnectStart	Analytic	Y	N
1046	Wininet_ConnectStop_V1	Analytic	Y	N
1047	Wininet_LookupConnectionStart	Analytic	Y	N
1048	Wininet_LookupConnectionStop	Analytic	Y	N
1049	Wininet_Redirect	Analytic	N	N
1051	Wininet_GetaddrinfoStart	Analytic	Y	N
1052	Wininet_GetaddrinfoStop	Analytic	Y	N
1053	Wininet_DHCP_I252WPADStart	Analytic	N	N
1054	Wininet_DHCP_I252WPADStop	Analytic	N	N
1055	Wininet_SelectStart	Analytic	N	N
1056	Wininet_SelectStop	Analytic	N	N
1057	Requested URL=URL Verb=Verb RequestHeaders=RequestHeaders …	UsageLog	Y	N
1058	Scavenged URL=URL.	UsageLog	N	N
1059	Wininet_SocketConnectStart	Analytic	Y	N
1060	Wininet_SocketConnectStop	Analytic	Y	N
1061	Wininet_AppCacheLookupStart	Analytic	N	N
1062	Wininet_AppCacheLookupStop	Analytic	N	N
1063	Wininet_RequestPrioritySet	Analytic	N	N
1064	WININET_STREAM_DATA_INDICATED	Analytic	N	N
1065	Wininet_SecurityContextStart	Analytic	Y	N
1066	Wininet_SecurityContextStop	Analytic	Y	N
1067	Wininet_SocketReceiveDelayStart	Analytic	Y	N
1068	Wininet_SocketReceiveDelayStop	Analytic	Y	N
1069	Wininet_FileIOStart	Analytic	Y	N
1070	Wininet_FileIOStop	Analytic	Y	N
1071	Wininet_FileIOStart1071	Analytic	Y	N
1072	Wininet_FileIOStop1072	Analytic	Y	N
1073	Wininet_AppCacheHandleStart	Analytic	N	N
1074	Wininet_AppCacheHandleStop	Analytic	N	N
1075	Wininet_AppCacheHandleStart1075	Analytic	N	N
1076	Wininet_AppCacheHandleStop1076	Analytic	N	N
1077	Wininet_AppCacheHandleStart1077	Analytic	N	N
1078	Wininet_AppCacheHandleStop1078	Analytic	N	N
1079	Wininet_AppCacheHandleStart1079	Analytic	N	N
1080	Wininet_AppCacheHandleStop1080	Analytic	N	N
1081	Wininet_AppCacheHandleStart1081	Analytic	N	N
1082	Wininet_AppCacheHandleStop1082	Analytic	N	N
1083	Wininet_AppCacheHandleStart1083	Analytic	N	N
1084	Wininet_AppCacheHandleStop1084	Analytic	N	N
1085	Wininet_AppCacheHandleStart1085	Analytic	N	N
1086	Wininet_AppCacheHandleStop1086	Analytic	N	N
1087	Wininet_AppCacheHandleStart1087	Analytic	N	N
1088	Wininet_AppCacheHandleStop1088	Analytic	N	N
1089	Wininet_AppCacheServerContainerStart	Analytic	N	N
1090	Wininet_AppCacheServerContainerStop	Analytic	N	N
1091	Wininet_AppCacheServerContainerStart1091	Analytic	N	N
1092	Wininet_AppCacheServerContainerStop1092	Analytic	N	N
1093	Wininet_AppCacheServerContainerStart1093	Analytic	N	N
1094	Wininet_AppCacheServerContainerStop1094	Analytic	N	N
1095	Wininet_AppCacheServerContainerStart1095	Analytic	N	N
1096	Wininet_AppCacheServerContainerStop1096	Analytic	N	N
1097	Wininet_AppCacheServerContainerStart1097	Analytic	N	N
1098	Wininet_AppCacheServerContainerStop1098	Analytic	N	N
1099	Wininet_AppCacheServerContainerStart1099	Analytic	N	N
1100	Wininet_AppCacheServerContainerStop1100	Analytic	N	N
1101	Wininet_AppCacheServerContainerStart1101	Analytic	N	N
1102	Wininet_AppCacheServerContainerStop1102	Analytic	N	N
1103	Wininet_AppCacheServerContainerStart1103	Analytic	N	N
1104	Wininet_AppCacheServerContainerStop1104	Analytic	N	N
1105	Wininet_AppCacheServerContainerStart1105	Analytic	N	N
1106	Wininet_AppCacheServerContainerStop1106	Analytic	N	N
1107	Wininet_AppCacheServerContainerStart1107	Analytic	N	N
1108	Wininet_AppCacheServerContainerStop1108	Analytic	N	N
1109	Wininet_AppCacheServerContainerStart1109	Analytic	N	N
1110	Wininet_AppCacheServerContainerStop1110	Analytic	N	N
1111	Wininet_BlobServerContainerStart	Analytic	Y	N
1112	Wininet_BlobServerContainerStop	Analytic	Y	N
1113	Wininet_BlobServerContainerStart1113	Analytic	N	N
1114	Wininet_BlobServerContainerStop1114	Analytic	N	N
1115	Wininet_BlobServerContainerStart1115	Analytic	N	N
1116	Wininet_BlobServerContainerStop1116	Analytic	N	N
1117	Wininet_BlobServerContainerStart1117	Analytic	Y	N
1118	Wininet_BlobServerContainerStop1118	Analytic	Y	N
1119	Wininet_BlobServerContainerStart1119	Analytic	N	N
1120	Wininet_BlobServerContainerStop1120	Analytic	N	N
1121	Wininet_BlobServerContainerStart1121	Analytic	N	N
1122	Wininet_BlobServerContainerStop1122	Analytic	N	N
1123	Wininet_BlobServerContainerStart1123	Analytic	N	N
1124	Wininet_BlobServerContainerStop1124	Analytic	N	N
1125	Wininet_CacheClientBloomFilterStart	Analytic	N	N
1126	Wininet_CacheClientBloomFilterStop	Analytic	N	N
1127	Wininet_CacheClientBloomFilterStart1127	Analytic	N	N
1128	Wininet_CacheClientBloomFilterStop1128	Analytic	N	N
1129	Wininet_CookieServerContainerStart	Analytic	N	N
1130	Wininet_CookieServerContainerStop	Analytic	N	N
1131	Wininet_CookieServerContainerStart1131	Analytic	N	N
1132	Wininet_CookieServerContainerStop1132	Analytic	N	N
1133	Wininet_CookieServerContainerStart1133	Analytic	N	N
1134	Wininet_CookieServerContainerStop1134	Analytic	N	N
1135	Wininet_CookieServerContainerStart1135	Analytic	N	N
1136	Wininet_CookieServerContainerStop1136	Analytic	N	N
1137	Wininet_CookieServerContainerStart1137	Analytic	N	N
1138	Wininet_CookieServerContainerStop1138	Analytic	N	N
1139	Wininet_CookieServerContainerStart1139	Analytic	N	N
1140	Wininet_CookieServerContainerStop1140	Analytic	N	N
1141	Wininet_CacheClientCountersStart	Analytic	N	N
1142	Wininet_CacheClientCountersStop	Analytic	N	N
1143	Wininet_DependencyServerContainerStart	Analytic	N	N
1144	Wininet_DependencyServerContainerStop	Analytic	N	N
1145	Wininet_DependencyServerContainerStart1145	Analytic	N	N
1146	Wininet_DependencyServerContainerStop1146	Analytic	N	N
1147	Wininet_DependencyServerContainerStart1147	Analytic	N	N
1148	Wininet_DependencyServerContainerStop1148	Analytic	N	N
1149	Wininet_DependencyServerContainerStart1149	Analytic	N	N
1150	Wininet_DependencyServerContainerStop1150	Analytic	N	N
1151	Wininet_DependencyServerContainerStart1151	Analytic	N	N
1152	Wininet_DependencyServerContainerStop1152	Analytic	N	N
1153	Wininet_HstsServerContainerStart	Analytic	N	N
1154	Wininet_HstsServerContainerStop	Analytic	N	N
1155	Wininet_HstsServerContainerStart1155	Analytic	N	N
1156	Wininet_HstsServerContainerStop1156	Analytic	N	N
1157	Wininet_HstsServerContainerStart1157	Analytic	N	N
1158	Wininet_HstsServerContainerStop1158	Analytic	N	N
1159	Wininet_HstsServerContainerStart1159	Analytic	N	N
1160	Wininet_HstsServerContainerStop1160	Analytic	N	N
1161	Wininet_HstsServerContainerStart1161	Analytic	N	N
1162	Wininet_HstsServerContainerStop1162	Analytic	N	N
1163	Wininet_CacheServerConnectionStart	Analytic	N	N
1164	Wininet_CacheServerConnectionStop	Analytic	N	N
1165	Wininet_CacheServerConnectionStart1165	Analytic	Y	N
1166	Wininet_CacheServerConnectionStop1166	Analytic	Y	N
1167	Wininet_CacheServerEntryEnumStart	Analytic	N	N
1168	Wininet_CacheServerEntryEnumStop	Analytic	N	N
1169	Wininet_CacheServerEntryEnumStart1169	Analytic	N	N
1170	Wininet_CacheServerEntryEnumStop1170	Analytic	N	N
1171	Wininet_CacheServerEntryEnumStart1171	Analytic	N	N
1172	Wininet_CacheServerEntryEnumStop1172	Analytic	N	N
1173	Wininet_CacheServerContainerStart	Analytic	N	N
1174	Wininet_CacheServerContainerStop	Analytic	N	N
1175	Wininet_CacheServerContainerStart1175	Analytic	N	N
1176	Wininet_CacheServerContainerStop1176	Analytic	N	N
1177	Wininet_CacheServerContainerStart1177	Analytic	N	N
1178	Wininet_CacheServerContainerStop1178	Analytic	N	N
1179	Wininet_CacheServerContainerStart1179	Analytic	N	N
1180	Wininet_CacheServerContainerStop1180	Analytic	N	N
1181	Wininet_CacheServerContainerStart1181	Analytic	N	N
1182	Wininet_CacheServerContainerStop1182	Analytic	N	N
1183	Wininet_CacheServerContainerStart1183	Analytic	N	N
1184	Wininet_CacheServerContainerStop1184	Analytic	N	N
1185	Wininet_CacheServerContainerStart1185	Analytic	N	N
1186	Wininet_CacheServerContainerStop1186	Analytic	N	N
1187	Wininet_CacheServerContainerStart1187	Analytic	N	N
1188	Wininet_CacheServerContainerStop1188	Analytic	N	N
1189	Wininet_CacheServerContainerStart1189	Analytic	Y	N
1190	Wininet_CacheServerContainerStop1190	Analytic	Y	N
1191	Wininet_CacheServerContainerStart1191	Analytic	N	N
1192	Wininet_CacheServerContainerStop1192	Analytic	N	N
1193	Wininet_CacheServerContainerStart1193	Analytic	N	N
1194	Wininet_CacheServerContainerStop1194	Analytic	N	N
1195	Wininet_CacheServerContainerStart1195	Analytic	N	N
1196	Wininet_CacheServerContainerStop1196	Analytic	N	N
1197	Wininet_CacheServerContainerStart1197	Analytic	N	N
1198	Wininet_CacheServerContainerStop1198	Analytic	N	N
1199	Wininet_CacheServerContainerStart1199	Analytic	N	N
1200	Wininet_CacheServerContainerStop1200	Analytic	N	N
1201	Wininet_CacheServerContainerStart1201	Analytic	N	N
1202	Wininet_CacheServerContainerStop1202	Analytic	N	N
1203	Wininet_CacheServerContainerStart1203	Analytic	N	N
1204	Wininet_CacheServerContainerStop1204	Analytic	N	N
1205	Wininet_CacheServerContainerStart1205	Analytic	N	N
1206	Wininet_CacheServerContainerStop1206	Analytic	N	N
1207	Wininet_CacheServerContainerStart1207	Analytic	N	N
1208	Wininet_CacheServerContainerStop1208	Analytic	N	N
1209	Wininet_CacheServerContainerStart1209	Analytic	N	N
1210	Wininet_CacheServerContainerStop1210	Analytic	N	N
1211	Wininet_CacheServerContainerStart1211	Analytic	N	N
1212	Wininet_CacheServerContainerStop1212	Analytic	N	N
1213	Wininet_CacheServerContainerStart1213	Analytic	N	N
1214	Wininet_CacheServerContainerStop1214	Analytic	N	N
1215	Wininet_CacheServerContainerStart1215	Analytic	N	N
1216	Wininet_CacheServerContainerStop1216	Analytic	N	N
1217	Wininet_CacheServerContainerStart1217	Analytic	N	N
1218	Wininet_CacheServerContainerStop1218	Analytic	N	N
1219	Wininet_CacheServerContainerStart1219	Analytic	N	N
1220	Wininet_CacheServerContainerStop1220	Analytic	N	N
1221	Wininet_UrlCacheContainerStart	Analytic	N	N
1222	Wininet_UrlCacheContainerStop	Analytic	N	N
1223	Wininet_UrlCacheContainerStart1223	Analytic	N	N
1224	Wininet_UrlCacheContainerStop1224	Analytic	N	N
1225	Wininet_UrlCacheContainerStart1225	Analytic	N	N
1226	Wininet_UrlCacheContainerStop1226	Analytic	N	N
1227	Wininet_UrlCacheContainerStart1227	Analytic	N	N
1228	Wininet_UrlCacheContainerStop1228	Analytic	N	N
1229	Wininet_UrlCacheContainerStart1229	Analytic	N	N
1230	Wininet_UrlCacheContainerStop1230	Analytic	N	N
1231	Wininet_UrlCacheContainerStart1231	Analytic	N	N
1232	Wininet_UrlCacheContainerStop1232	Analytic	N	N
1233	Wininet_UrlCacheContainerStart1233	Analytic	N	N
1234	Wininet_UrlCacheContainerStop1234	Analytic	N	N
1235	Wininet_UrlCacheContainerStart1235	Analytic	N	N
1236	Wininet_UrlCacheContainerStop1236	Analytic	N	N
1237	Wininet_UrlCacheContainerStart1237	Analytic	N	N
1238	Wininet_UrlCacheContainerStop1238	Analytic	N	N
1239	Wininet_SyncInternetOpen	Analytic	Y	N
1240	Wininet_SyncSendRequestStart	Analytic	Y	N
1241	Wininet_SyncSendRequestStop	Analytic	Y	N
1242	Wininet_SyncQueryDataAvailableStart	Analytic	N	N
1243	Wininet_SyncQueryDataAvailableStop	Analytic	N	N
1244	Wininet_SyncReadFileStart	Analytic	Y	N
1245	Wininet_SyncReadFileStop	Analytic	Y	N
1246	Wininet_SyncWriteFileStart	Analytic	N	N
1247	Wininet_SyncWriteFileStop	Analytic	N	N

Event ID 101: Session handle HINTERNET created: UserAgent=UserAgent, AccessType=AccessType, ProxyList=ProxyList, ProxyBypassList=ProxyBypassList, Flags=Flags.

Channel: Analytic
Level: Informational
Task: WININET_ROOT_HANDLE_CREATED

Message #

Session handle %1 created: UserAgent=%3, AccessType=%5, ProxyList=%7, ProxyBypassList=%9, Flags=%10

Fields #

Name	Description
`HINTERNET` Pointer
`_UserAgentLength` UInt16
`UserAgent` AnsiString
`_AccessTypeLength` UInt16
`AccessType` AnsiString
`_ProxyListLength` UInt16
`ProxyList` AnsiString
`_ProxyBypassListLength` UInt16
`ProxyBypassList` AnsiString
`Flags` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-WinINet",
    "guid": "{43d1a55c-76d6-4f7e-995c-64c711e5cafe}",
    "event_source_name": "",
    "event_id": 101,
    "version": 0,
    "level": 4,
    "task": 500,
    "opcode": 0,
    "keywords": "0x8000000000000001",
    "time_created": "2026-07-19T03:37:35.698018200+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "00CC0004-0002-0000-7428-3411403A6DA0"
    },
    "execution": {
      "process_id": 10356,
      "thread_id": 4404
    },
    "channel": "Microsoft-Windows-WinINet/Analytic",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "HINTERNET": "0xCC0004",
    "_UserAgentLength": "20",
    "UserAgent": "CatalogClient/1.0",
    "_AccessTypeLength": "6",
    "AccessType": "DIRECT",
    "_ProxyListLength": "0",
    "ProxyList": "",
    "_ProxyBypassListLength": "0",
    "ProxyBypassList": "",
    "Flags": "0x0"
  },
  "message": "Session handle 0xCC0004 created: UserAgent=CatalogClient/1.0, AccessType=DIRECT, ProxyList=, ProxyBypassList=, Flags=0x0"
}

Event ID 102: Handle ConnectionHandle created by InternetOpenURL: SessionHandle=ParentHandle,URL=URL, Headers=Headers, Flags=Flags.

Channel: Analytic
Level: Informational
Task: WININET_OPEN_URL_HANDLE_CREATED

Message #

Handle %1 created by InternetOpenURL: SessionHandle=%2,URL=%4, Headers=%6, Flags=%7

Fields #

Name	Description
`ConnectionHandle` Pointer
`ParentHandle` Pointer
`_URLLength` UInt16
`URL` AnsiString
`_HeadersLength` UInt16
`Headers` AnsiString
`Flags` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-WinINet",
    "guid": "{43d1a55c-76d6-4f7e-995c-64c711e5cafe}",
    "event_source_name": "",
    "event_id": 102,
    "version": 0,
    "level": 4,
    "task": 501,
    "opcode": 0,
    "keywords": "0x8000000000000001",
    "time_created": "2026-07-19T03:37:35.769377400+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "F8378F7E-0003-0000-A7A6-BF0374280000"
    },
    "execution": {
      "process_id": 10356,
      "thread_id": 4404
    },
    "channel": "Microsoft-Windows-WinINet/Analytic",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "ConnectionHandle": "0xCC000C",
    "ParentHandle": "0xCC0004",
    "_URLLength": "35",
    "URL": "http://127.0.0.1:18081/catalog-test",
    "_HeadersLength": "0",
    "Headers": "",
    "Flags": "0x0"
  },
  "message": "Handle 0xCC000C created by InternetOpenURL: SessionHandle=0xCC0004,URL=http://127.0.0.1:18081/catalog-test, Headers=, Flags=0x0"
}

Event ID 103: Handle ConnectionHandle created by InternetConnect: SessionHandle=ParentHandle, Server=ServerName:ServerPort, Service, Flags=Flags.

Channel: Analytic
Level: Informational
Task: WININET_CONNECT_HANDLE_CREATED

Message #

Handle %1 created by InternetConnect: SessionHandle=%2, Server=%4:%5, %7, Flags=%8

Fields #

Name	Description
`ConnectionHandle` Pointer
`ParentHandle` Pointer
`_ServerNameLength` UInt16
`ServerName` AnsiString
`ServerPort` UInt32
`_ServiceLength` UInt16
`Service` AnsiString
`Flags` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-WinINet",
    "guid": "{43d1a55c-76d6-4f7e-995c-64c711e5cafe}",
    "event_source_name": "",
    "event_id": 103,
    "version": 0,
    "level": 4,
    "task": 502,
    "opcode": 0,
    "keywords": "0x8000000000000001",
    "time_created": "2026-07-19T03:37:35.721057100+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "00CC0008-0005-0000-7428-3411A0F8ADA0"
    },
    "execution": {
      "process_id": 10356,
      "thread_id": 4404
    },
    "channel": "Microsoft-Windows-WinINet/Analytic",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "ConnectionHandle": "0xCC0008",
    "ParentHandle": "0xCC0004",
    "_ServerNameLength": "9",
    "ServerName": "127.0.0.1",
    "ServerPort": "18081",
    "_ServiceLength": "4",
    "Service": "HTTP",
    "Flags": "0x0"
  },
  "message": "Handle 0xCC0008 created by InternetConnect: SessionHandle=0xCC0004, Server=127.0.0.1:18081, HTTP, Flags=0x0"
}

Event ID 104: Request handle ConnectionHandle created by HttpOpenRequest: ConnectionHandle=ParentHandle, Verb, Target=ObjectName, Ver=Version, Referrer=Referrer, Media types=AcceptTypes, Flags=Flags.

Channel: Analytic
Level: Informational
Task: WININET_HTTP_REQUEST_HANDLE_CREATED

Message #

Request handle %1 created by HttpOpenRequest: ConnectionHandle=%2, %4, Target=%6, Ver=%8, Referrer=%10, Media types=%12, Flags=%13

Fields #

Name	Description
`ConnectionHandle` Pointer
`ParentHandle` Pointer
`_VerbLength` UInt16
`Verb` AnsiString
`_ObjectNameLength` UInt16
`ObjectName` AnsiString
`_VersionLength` UInt16
`Version` AnsiString
`_ReferrerLength` UInt32
`Referrer` AnsiString
`_AcceptTypesLength` UInt16
`AcceptTypes` AnsiString
`Flags` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-WinINet",
    "guid": "{43d1a55c-76d6-4f7e-995c-64c711e5cafe}",
    "event_source_name": "",
    "event_id": 104,
    "version": 0,
    "level": 4,
    "task": 503,
    "opcode": 0,
    "keywords": "0x8000000000000201",
    "time_created": "2026-07-19T03:37:35.721188500+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "00CC000C-0007-0000-7428-34116005E5A0"
    },
    "execution": {
      "process_id": 10356,
      "thread_id": 4404
    },
    "channel": "Microsoft-Windows-WinINet/Analytic",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "ConnectionHandle": "0xCC000C",
    "ParentHandle": "0xCC0008",
    "_VerbLength": "3",
    "Verb": "GET",
    "_ObjectNameLength": "13",
    "ObjectName": "/catalog-test",
    "_VersionLength": "8",
    "Version": "HTTP/1.1",
    "_ReferrerLength": "0",
    "Referrer": "",
    "_AcceptTypesLength": "0",
    "AcceptTypes": "",
    "Flags": "0x0"
  },
  "message": "Request handle 0xCC000C created by HttpOpenRequest: ConnectionHandle=0xCC0008, GET, Target=/catalog-test, Ver=HTTP/1.1, Referrer=, Media types=, Flags=0x0"
}

Event ID 105: Handle HINTERNET closed successfully.

Channel: Analytic
Level: Informational
Task: WININET_HANDLE_CLOSED

Message #

Handle %1 closed successfully

Fields #

Name	Description
`HINTERNET` Pointer

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-WinINet",
    "guid": "{43d1a55c-76d6-4f7e-995c-64c711e5cafe}",
    "event_source_name": "",
    "event_id": 105,
    "version": 0,
    "level": 4,
    "task": 504,
    "opcode": 0,
    "keywords": "0x8000000000000201",
    "time_created": "2026-07-19T03:37:35.803464600+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "00CC000C-0007-0000-7428-34116005E5A0"
    },
    "execution": {
      "process_id": 10356,
      "thread_id": 4404
    },
    "channel": "Microsoft-Windows-WinINet/Analytic",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "HINTERNET": "0xCC000C"
  },
  "message": "Handle 0xCC000C closed successfully"
}

Event ID 106: Failed to create handle: ParentHandle=HINTERNET, Error=Error.

Channel: Analytic
Task: WININET_HANDLE_CREATE_FAILED

Message #

Failed to create handle: ParentHandle=%1, Error=%2

Fields #

Name	Description
`HINTERNET` Pointer
`Error` UInt32

Event ID 107: Handle HINTERNET failed to close: Error=Error.

Channel: Analytic
Task: WININET_HANDLE_CLOSE_FAILED

Message #

Handle %1 failed to close: Error=%2

Fields #

Name	Description
`HINTERNET` Pointer
`Error` UInt32

Event ID 108: Request handle ConnectionHandle Server Details: Server=ServerName Port=ServerPort Service=Service.

Channel: Analytic
Level: Informational
Task: WININET_HTTP_REQUEST_HANDLE_CREATED

Message #

Request handle %1 Server Details: Server=%3 Port=%4 Service=%6

Fields #

Name	Description
`ConnectionHandle` Pointer
`_ServerNameLength` UInt16
`ServerName` AnsiString
`ServerPort` UInt32
`_ServiceLength` UInt16
`Service` AnsiString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-WinINet",
    "guid": "{43d1a55c-76d6-4f7e-995c-64c711e5cafe}",
    "event_source_name": "",
    "event_id": 108,
    "version": 0,
    "level": 4,
    "task": 503,
    "opcode": 0,
    "keywords": "0x8000000000000201",
    "time_created": "2026-07-19T03:37:35.721205600+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "00CC000C-0007-0000-7428-34116005E5A0"
    },
    "execution": {
      "process_id": 10356,
      "thread_id": 4404
    },
    "channel": "Microsoft-Windows-WinINet/Analytic",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "ConnectionHandle": "0xCC000C",
    "_ServerNameLength": "9",
    "ServerName": "127.0.0.1",
    "ServerPort": "18081",
    "_ServiceLength": "4",
    "Service": "http"
  },
  "message": "Request handle 0xCC000C Server Details: Server=127.0.0.1 Port=18081 Service=http"
}

Event ID 200: HTTP request was received from API: RequestHandle=HINTERNET.

Channel: Analytic
Level: Informational
Task: WININET_HTTP_REQUEST
Opcode: Start

Message #

HTTP request was received from API: RequestHandle=%1

Fields #

Name	Description
`HINTERNET` Pointer
`Context` Pointer

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-WinINet",
    "guid": "{43d1a55c-76d6-4f7e-995c-64c711e5cafe}",
    "event_source_name": "",
    "event_id": 200,
    "version": 1,
    "level": 4,
    "task": 507,
    "opcode": 1,
    "keywords": "0x8000000000000202",
    "time_created": "2026-07-19T03:37:35.721241500+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "00CC000C-0007-0000-7428-34116005E5A0"
    },
    "execution": {
      "process_id": 10356,
      "thread_id": 4404
    },
    "channel": "Microsoft-Windows-WinINet/Analytic",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "HINTERNET": "0xCC000C",
    "Context": "0x0"
  },
  "message": "HTTP request was received from API: RequestHandle=0xCC000C, RequestContext=0x0"
}

Event ID 201: HTTP request was sent successfully: RequestHandle=RequestHandle, SocketHandle=SocketHandle, Verb, CookieSent= Cookie.

Channel: Analytic
Level: Informational
Task: WININET_HTTP_REQUEST
Opcode: Stop

Message #

HTTP request was sent successfully: RequestHandle=%1, SocketHandle=%2, %4, CookieSent= %5

Fields #

Name	Description
`RequestHandle` Pointer
`SocketHandle` Pointer
`_VerbLength` UInt16
`Verb` AnsiString
`Cookie` Boolean

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-WinINet",
    "guid": "{43d1a55c-76d6-4f7e-995c-64c711e5cafe}",
    "event_source_name": "",
    "event_id": 201,
    "version": 0,
    "level": 4,
    "task": 507,
    "opcode": 2,
    "keywords": "0x8000000000000202",
    "time_created": "2026-07-19T03:37:35.736617700+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "00CC000C-0007-0000-7428-34116005E5A0"
    },
    "execution": {
      "process_id": 10356,
      "thread_id": 10196
    },
    "channel": "Microsoft-Windows-WinINet/Analytic",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "RequestHandle": "0xCC000C",
    "SocketHandle": "0xE10",
    "_VerbLength": "3",
    "Verb": "GET",
    "Cookie": "false"
  },
  "message": "HTTP request was sent successfully: RequestHandle=0xCC000C, SocketHandle=0xE10, GET, CookieSent= false"
}

Event ID 202: HTTP request send failed: Handle=Handle, Error=Error.

Channel: Analytic
Task: WININET_HTTP_REQUEST
Opcode: Fail

Message #

HTTP request send failed: Handle=%1, Error=%2

Fields #

Name	Description
`Handle` Pointer
`Error` UInt32

Event ID 203: HTTP response (ResponseCode) received: RequestHandle=RequestHandle, SocketHandle=SocketHandle, Verb, ContentLength=ContentLength.

Channel: Analytic
Level: Informational
Task: WININET_HTTP_RESPONSE
Opcode: Stop

Message #

HTTP response (%1) received: RequestHandle=%2, SocketHandle=%3, %5, ContentLength=%7

Fields #

Name	Description
`ResponseCode` Int32
`RequestHandle` Pointer
`SocketHandle` Pointer
`_VerbLength` UInt16
`Verb` AnsiString
`_ContentLengthStrLength` UInt16
`ContentLength` AnsiString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-WinINet",
    "guid": "{43d1a55c-76d6-4f7e-995c-64c711e5cafe}",
    "event_source_name": "",
    "event_id": 203,
    "version": 0,
    "level": 4,
    "task": 508,
    "opcode": 2,
    "keywords": "0x8000000000000202",
    "time_created": "2026-07-19T03:37:35.766436300+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "00CC000C-0007-0000-7428-34116005E5A0"
    },
    "execution": {
      "process_id": 10356,
      "thread_id": 10196
    },
    "channel": "Microsoft-Windows-WinINet/Analytic",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "ResponseCode": "200",
    "RequestHandle": "0xCC000C",
    "SocketHandle": "0xE10",
    "_VerbLength": "3",
    "Verb": "GET",
    "_ContentLengthStrLength": "1",
    "ContentLength": "9"
  },
  "message": "HTTP response (200) received: RequestHandle=0xCC000C, SocketHandle=0xE10, GET, ContentLength=9"
}

Event ID 204: HTTP response failed: Handle=Handle, Error=Error.

Channel: Analytic
Task: WININET_HTTP_RESPONSE
Opcode: Fail

Message #

HTTP response failed: Handle=%1, Error=%2

Fields #

Name	Description
`Handle` Pointer
`Error` UInt32

Event ID 205: HTTP connection (Handle=ConnectionHandle, SocketHandle=SocketHandle) closed due to the following reason: Reason.

Channel: Analytic
Task: WININET_HTTP_CONNECTION_CLOSED

Message #

HTTP connection (Handle=%1, SocketHandle=%2) closed due to the following reason: %4

Fields #

Name	Description
`ConnectionHandle` Pointer
`SocketHandle` Pointer
`_ReasonLength` UInt16
`Reason` AnsiString

Event ID 206: Keep-alive connection is re-used: ConnectionHandle=ConnectionHandle, SocketHandle=SocketHandle.

Channel: Analytic
Task: WININET_KEEP_ALIVE_CONNECTION_REUSED

Message #

Keep-alive connection is re-used: ConnectionHandle=%1, SocketHandle=%2

Fields #

Name	Description
`ConnectionHandle` Pointer
`SocketHandle` Pointer

Event ID 207: Connection is returned to keep-alive pool: RequestHandle=ConnectionHandle, SocketHandle=SocketHandle.

Channel: Analytic
Level: Informational
Task: WININET_KEEP_ALIVE_CONNECTION_POOLED

Message #

Connection is returned to keep-alive pool: RequestHandle=%1, SocketHandle=%2

Fields #

Name	Description
`ConnectionHandle` Pointer
`SocketHandle` Pointer

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-WinINet",
    "guid": "{43d1a55c-76d6-4f7e-995c-64c711e5cafe}",
    "event_source_name": "",
    "event_id": 207,
    "version": 0,
    "level": 4,
    "task": 511,
    "opcode": 0,
    "keywords": "0x8000000000000002",
    "time_created": "2026-07-19T03:37:35.766611600+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "00CC000C-0007-0000-7428-34116005E5A0"
    },
    "execution": {
      "process_id": 10356,
      "thread_id": 10196
    },
    "channel": "Microsoft-Windows-WinINet/Analytic",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "ConnectionHandle": "0xCC000C",
    "SocketHandle": "0xE10"
  },
  "message": "Connection is returned to keep-alive pool: RequestHandle=0xCC000C, SocketHandle=0xE10"
}

Event ID 208: Keep-alive connection is closed: ConnectionHandle=ConnectionHandle, SocketHandle=SocketHandle.

Channel: Analytic
Task: WININET_KEEP_ALIVE_CONNECTION_CLOSED

Message #

Keep-alive connection is closed: ConnectionHandle=%1, SocketHandle=%2

Fields #

Name	Description
`ConnectionHandle` Pointer
`SocketHandle` Pointer

Event ID 209: HTTP response entity body received: RequestHandle=RequestHandle.

Channel: Analytic
Level: Informational
Task: WININET_HTTP_RESPONSE_BODY_RECEIVED

Message #

HTTP response entity body received: RequestHandle=%1

Fields #

Name	Description
`RequestHandle` Pointer

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-WinINet",
    "guid": "{43d1a55c-76d6-4f7e-995c-64c711e5cafe}",
    "event_source_name": "",
    "event_id": 209,
    "version": 0,
    "level": 4,
    "task": 513,
    "opcode": 0,
    "keywords": "0x8000000000000202",
    "time_created": "2026-07-19T03:37:35.798757200+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "00CC000C-0007-0000-7428-34116005E5A0"
    },
    "execution": {
      "process_id": 10356,
      "thread_id": 4404
    },
    "channel": "Microsoft-Windows-WinINet/Analytic",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "RequestHandle": "0xCC000C"
  },
  "message": "HTTP response entity body received: RequestHandle=0xCC000C"
}

Event ID 210: HTTP Request Headers RequestHandle=RequestHandle Headers.

Channel: Analytic
Level: Verbose
Task: WININET_REQUEST_HEADER

Message #

HTTP Request Headers RequestHandle=%1 %3

Fields #

Name	Description
`RequestHandle` Pointer
`Length` UInt16
`Headers` AnsiString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-WinINet",
    "guid": "{43d1a55c-76d6-4f7e-995c-64c711e5cafe}",
    "event_source_name": "",
    "event_id": 210,
    "version": 0,
    "level": 5,
    "task": 546,
    "opcode": 0,
    "keywords": "0x8000020000000202",
    "time_created": "2026-07-19T03:37:35.736180900+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "00CC000C-0007-0000-7428-34116005E5A0"
    },
    "execution": {
      "process_id": 10356,
      "thread_id": 10196
    },
    "channel": "Microsoft-Windows-WinINet/Analytic",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "RequestHandle": "0xCC000C",
    "Length": "215",
    "Headers": "GET /catalog-test HTTP/1.1\nUser-Agent: CatalogClient/1.0\nHost: 127.0.0.1:18081\nX-P2P-PeerDist: Version=1.1\nX-P2P-PeerDistEx: MinContentInformation=1.0, MaxContentInformation=2.0\nAccept-Encoding: peerdist"
  },
  "message": "HTTP Request Headers RequestHandle=0xCC000C GET /catalog-test HTTP/1.1\nUser-Agent: CatalogClient/1.0\nHost: 127.0.0.1:18081\nX-P2P-PeerDist: Version=1.1\nX-P2P-PeerDistEx: MinContentInformation=1.0, MaxContentInformation=2.0\nAccept-Encoding: peerdist"
}

Event ID 211: HTTP Response Headers RequestHandle=RequestHandle Headers.

Channel: Analytic
Level: Verbose
Task: WININET_RESPONSE_HEADER

Message #

HTTP Response Headers RequestHandle=%1 %3

Fields #

Name	Description
`RequestHandle` Pointer
`Length` UInt16
`Headers` AnsiString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-WinINet",
    "guid": "{43d1a55c-76d6-4f7e-995c-64c711e5cafe}",
    "event_source_name": "",
    "event_id": 211,
    "version": 0,
    "level": 5,
    "task": 547,
    "opcode": 0,
    "keywords": "0x8000020000000202",
    "time_created": "2026-07-19T03:37:35.766452000+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "00CC000C-0007-0000-7428-34116005E5A0"
    },
    "execution": {
      "process_id": 10356,
      "thread_id": 10196
    },
    "channel": "Microsoft-Windows-WinINet/Analytic",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "RequestHandle": "0xCC000C",
    "Length": "106",
    "Headers": "HTTP/1.1 200 OK\nContent-Length: 9\nServer: Microsoft-HTTPAPI/2.0\nDate: Sun, 19 Jul 2026 03:37:36 GMT"
  },
  "message": "HTTP Response Headers RequestHandle=0xCC000C HTTP/1.1 200 OK\nContent-Length: 9\nServer: Microsoft-HTTPAPI/2.0\nDate: Sun, 19 Jul 2026 03:37:36 GMT"
}

Event ID 212: HTTP Request Headers OptionalData RequestHandle=RequestHandle Headers.

Channel: Analytic
Level: Verbose
Task: WININET_REQUEST_HEADER_OPTIONAL

Message #

HTTP Request Headers OptionalData RequestHandle=%1 %3

Fields #

Name	Description
`RequestHandle` Pointer
`Length` UInt16
`Headers` AnsiString

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-WinINet/Analytic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 212,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 7468,
      "thread_id": 11764
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft-Windows-WinINet",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 05:37:29.010Z",
    "version": 0
  },
  "event_data": {
    "Headers": "mRj0\u0018i4fؠ;`J*M\u0015*c\r\u0004vhI.8\\D\u001a9t}^ W{w}aw})i\u0003\u001bH\u001d~6<u1BG8z{g\u0016\u001d\fhR?Ҙ\nN8IO827\u0011-+{;\u000ez:RI'n}))ECv.mX\u0003Ƕʇ}\u0011o\u0005\u0011\u0019\u001a0Ĝ\u0003:\bF\u0000\u0011x  '촀(:\u001b[#>Q݅:\b\"H\b#\u0018b\u0018\u0012F\\@%8\u0016Q!\u0001L*\u001f;t\u0012a.'\u0002T\f{\"X\\To\u0013\u00061\n C>$\u0017/ʧ\u001a\t-rځ\u001aTY\u001bOv>EFn4\fxB3wY5;m@my\u0018A+\u0004wvqOޜӦ\u0001\bPM@+D\u0014PG\u0017*\u0006\r\u0019,;\r[3-\n\u0011AZ˿TZmD\u001a\u0017JpŌDVp`\u0002TkYQ&ՑU=V7UYX;RWHڪG(\u001eΪ3\\\u001ef8z\u0011\u000e\u000b6eX\u0010Er$\n\u0003\u001e\u000b0Mhc\u0015'qprX`\u001cZ\u0013",
    "Length": 572,
    "RequestHandle": "0xCC000C"
  },
  "message": ""
}

Event ID 213: WinInet::Http response entity body receive failed: Request Handle=RequestHandle, Error=Error.

Channel: Analytic
Task: WININET_HTTP_RESPONSE_BODY_READ_ERROR

Message #

WinInet::Http response entity body receive failed: Request Handle=%1, Error=%2

Fields #

Name	Description
`RequestHandle` Pointer
`Error` UInt32

Event ID 301: TCP connection to server ServerName established: ConnectionHandle=ConnectionHandle, SocketHandle=SocketHandle, LocalPort=LocalPort.

Channel: Analytic
Level: Informational
Task: WININET_TCP_CONNECTION
Opcode: Start

Message #

TCP connection to server %2 established: ConnectionHandle=%3, SocketHandle=%4, LocalPort=%5

Fields #

Name	Description
`_ServerNameLength` UInt16
`ServerName` AnsiString
`ConnectionHandle` Pointer
`SocketHandle` Pointer
`LocalPort` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-WinINet",
    "guid": "{43d1a55c-76d6-4f7e-995c-64c711e5cafe}",
    "event_source_name": "",
    "event_id": 301,
    "version": 0,
    "level": 4,
    "task": 514,
    "opcode": 1,
    "keywords": "0x8000000000000204",
    "time_created": "2026-07-19T03:37:35.734120200+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "00CC000C-0007-0000-7428-34116005E5A0"
    },
    "execution": {
      "process_id": 10356,
      "thread_id": 10196
    },
    "channel": "Microsoft-Windows-WinINet/Analytic",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "_ServerNameLength": "9",
    "ServerName": "127.0.0.1",
    "ConnectionHandle": "0xCC000C",
    "SocketHandle": "0xE10",
    "LocalPort": "57005"
  },
  "message": "TCP connection to server 127.0.0.1 established: ConnectionHandle=0xCC000C, SocketHandle=0xE10, LocalPort=57005"
}

Event ID 302: TCP connection to ServerName for connection handle ConnectionHandle failed: Error=Error.

Channel: Analytic
Task: WININET_TCP_CONNECTION
Opcode: Fail

Message #

TCP connection to %2 for connection handle %3 failed: Error=%4

Fields #

Name	Description
`_ServerNameLength` UInt16
`ServerName` AnsiString
`ConnectionHandle` Pointer
`Error` UInt32

Event ID 303: TCP connection closed successfully: SocketHandle=SocketHandle.

Channel: Analytic
Task: WININET_TCP_CONNECTION
Opcode: Stop

Message #

TCP connection closed successfully: SocketHandle=%1

Fields #

Name	Description
`SocketHandle` Pointer

Event ID 304: DNS query for HostName hostname is sent: Handle=RequestHandle.

Channel: Analytic
Level: Informational
Task: WININET_DNS_QUERY
Opcode: Start

Message #

DNS query for %2 hostname is sent: Handle=%3

Fields #

Name	Description
`_HostNameLength` UInt16
`HostName` AnsiString
`RequestHandle` Pointer

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-WinINet",
    "guid": "{43d1a55c-76d6-4f7e-995c-64c711e5cafe}",
    "event_source_name": "",
    "event_id": 304,
    "version": 0,
    "level": 4,
    "task": 515,
    "opcode": 1,
    "keywords": "0x8000000000000004",
    "time_created": "2026-07-19T03:37:35.729330600+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "00CC000C-0007-0000-7428-34116005E5A0"
    },
    "execution": {
      "process_id": 10356,
      "thread_id": 180
    },
    "channel": "Microsoft-Windows-WinINet/Analytic",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "_HostNameLength": "9",
    "HostName": "127.0.0.1",
    "RequestHandle": "0xCC000C"
  },
  "message": "DNS query for 127.0.0.1 hostname is sent: Handle=0xCC000C"
}

Event ID 305: DNS query for HostName hostname is complete: Handle=RequestHandle, Addresses=AddressList.

Channel: Analytic
Level: Informational
Task: WININET_DNS_QUERY
Opcode: Stop

Message #

DNS query for %2 hostname is complete: Handle=%3, Addresses=%5

Fields #

Name	Description
`_HostNameLength` UInt16
`HostName` AnsiString
`RequestHandle` Pointer
`_AddressListLength` UInt16
`AddressList` AnsiString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-WinINet",
    "guid": "{43d1a55c-76d6-4f7e-995c-64c711e5cafe}",
    "event_source_name": "",
    "event_id": 305,
    "version": 0,
    "level": 4,
    "task": 515,
    "opcode": 2,
    "keywords": "0x8000000000000004",
    "time_created": "2026-07-19T03:37:35.730373600+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "00CC000C-0007-0000-7428-34116005E5A0"
    },
    "execution": {
      "process_id": 10356,
      "thread_id": 180
    },
    "channel": "Microsoft-Windows-WinINet/Analytic",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "_HostNameLength": "9",
    "HostName": "127.0.0.1",
    "RequestHandle": "0xCC000C",
    "_AddressListLength": "10",
    "AddressList": "127.0.0.1;"
  },
  "message": "DNS query for 127.0.0.1 hostname is complete: Handle=0xCC000C, Addresses=127.0.0.1;"
}

Event ID 306: DNS query for HostName hostname failed: Handle=RequestHandle Error=Error.

Channel: Analytic
Task: WININET_DNS_QUERY
Opcode: Fail

Message #

DNS query for %2 hostname failed: Handle=%3 Error=%4

Fields #

Name	Description
`_HostNameLength` UInt16
`HostName` AnsiString
`RequestHandle` Pointer
`Error` UInt32

Event ID 307: Re-used DNS cache, query for HostName hostname is complete: Handle=RequestHandle, Addresses=AddressList.

Channel: Analytic
Level: Informational
Task: WININET_DNS_QUERY
Opcode: Stop

Message #

Re-used DNS cache, query for %2 hostname is complete: Handle=%3, Addresses=%5

Fields #

Name	Description
`_HostNameLength` UInt16
`HostName` AnsiString
`RequestHandle` Pointer
`_AddressListLength` UInt16
`AddressList` AnsiString

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-WinINet/Analytic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 307,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 7468,
      "thread_id": 11764
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 2,
    "provider": "Microsoft-Windows-WinINet",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 05:37:28.810Z",
    "version": 0
  },
  "event_data": {
    "AddressList": "4.150.223.102;",
    "HostName": "mobile.events.data.microsoft.com",
    "RequestHandle": "0xCC000C",
    "_AddressListLength": 14,
    "_HostNameLength": 32
  },
  "message": ""
}

Event ID 308: A network change was detected: Handle=Handle.

Channel: Analytic
Task: WININET_NETWORK_CHANGE_DETECTED

Message #

A network change was detected: Handle=%1

Fields #

Name	Description
`Handle` Pointer

Event ID 400: Wininet_WebSocketUpgrade

Channel: WebSocket
Task: Wininet_WebSocketUpgrade

Fields #

Name	Description
`CorrelationID` GUID
`InternetFlags` UInt32
`Length` UInt16
`Headers` AnsiString

Event ID 401: Wininet_WebSocketUpgrade401

Channel: WebSocket
Task: Wininet_WebSocketUpgrade

Fields #

Name	Description
`CorrelationID` GUID
`ResponseCode` Int32
`Length` UInt16
`Headers` AnsiString

Event ID 402: Wininet_WebSocketSessionStart

Channel: WebSocket
Task: Wininet_WebSocketSession
Opcode: Start

Fields #

Name	Description
`CorrelationID` GUID

Event ID 403: Wininet_WebSocketSessionStop

Channel: WebSocket
Task: Wininet_WebSocketSession
Opcode: Stop

Fields #

Name	Description
`CorrelationID` GUID
`Status` UInt16	NTSTATUS reference

Event ID 404: Wininet_WebSocketSession

Channel: WebSocket
Task: Wininet_WebSocketSession

Fields #

Name	Description
`CorrelationID` GUID
`Length` Int64
`TruncatedLength` UInt16
`TruncatedData` UnicodeString

Event ID 405: Wininet_WebSocketSession405

Channel: WebSocket
Task: Wininet_WebSocketSession

Fields #

Name	Description
`CorrelationID` GUID
`Length` Int64
`TruncatedLength` UInt16
`TruncatedData` UnicodeString

Event ID 406: Wininet_WebSocketSession406

Channel: WebSocket
Task: Wininet_WebSocketSession

Fields #

Name	Description
`CorrelationID` GUID
`Length` Int64

Event ID 407: Wininet_WebSocketSession407

Channel: WebSocket
Task: Wininet_WebSocketSession

Fields #

Name	Description
`CorrelationID` GUID
`Status` UInt16	NTSTATUS reference
`Length` UInt32
`Reason` AnsiString

Event ID 408: Wininet_WebSocketSession408

Channel: WebSocket
Task: Wininet_WebSocketSession

Fields #

Name	Description
`CorrelationID` GUID
`Length` Int64

Event ID 409: Wininet_WebSocketSession409

Channel: WebSocket
Task: Wininet_WebSocketSession

Fields #

Name	Description
`CorrelationID` GUID
`Status` UInt16	NTSTATUS reference
`Length` UInt32
`Reason` AnsiString

Event ID 410: Wininet_WebSocketSession410

Channel: WebSocket
Task: Wininet_WebSocketSession

Fields #

Name	Description
`CorrelationID` GUID
`Length` Int64

Event ID 411: Wininet_WebSocketSession411

Channel: WebSocket
Task: Wininet_WebSocketSession

Fields #

Name	Description
`CorrelationID` GUID
`Length` Int64

Event ID 412: Wininet_WebSocketSession412

Channel: WebSocket
Task: Wininet_WebSocketSession

Fields #

Name	Description
`CorrelationID` GUID

Event ID 413: Wininet_WebSocketSession413

Channel: WebSocket
Task: Wininet_WebSocketSession

Fields #

Name	Description
`CorrelationID` GUID

Event ID 414: Wininet_WebSocketSession414

Channel: WebSocket
Task: Wininet_WebSocketSession

Fields #

Name	Description
`CorrelationID` GUID
`SequenceNumber` UInt32
`PayloadByteLength` UInt32
`Payload` Binary

Event ID 415: Wininet_WebSocketSession415

Channel: WebSocket
Task: Wininet_WebSocketSession

Fields #

Name	Description
`CorrelationID` GUID
`SequenceNumber` UInt32
`PayloadByteLength` UInt32
`Payload` Binary

Event ID 416: Wininet_WebSocketSession416

Channel: WebSocket
Task: Wininet_WebSocketSession

Fields #

Name	Description
`CorrelationID` GUID
`SequenceNumber` UInt32
`PayloadByteLength` UInt32
`Payload` Binary

Event ID 417: Wininet_WebSocketSession417

Channel: WebSocket
Task: Wininet_WebSocketSession

Fields #

Name	Description
`CorrelationID` GUID
`SequenceNumber` UInt32
`PayloadByteLength` UInt32
`Payload` Binary

Event ID 501: Received response including a cookie header: URL=URL.

Channel: Analytic
Task: WININET_COOKIE_HEADER_RECEIVED

Message #

Received response including a cookie header: URL=%2

Fields #

Name	Description
`URLLength` UInt32
`URL` AnsiString

Event ID 502: Client has stored a cookie in the cookie jar: Domain=Domain, Path=Path, Name=Name, Value=Value.

Channel: Analytic
Task: WININET_COOKIE_STORED

Message #

Client has stored a cookie in the cookie jar: Domain=%2, Path=%4, Name=%6, Value=%8

Fields #

Name	Description
`_DomainLength` UInt16
`Domain` AnsiString
`_PathLength` UInt16
`Path` AnsiString
`_NameLength` UInt16
`Name` AnsiString
`_ValueLength` UInt16
`Value` AnsiString

Event ID 503: Client has deleted a cookie in the cookie jar: Domain=Domain, Path=Path, Name=Name, Value=Value.

Channel: Analytic
Task: WININET_COOKIE_DELETED

Message #

Client has deleted a cookie in the cookie jar: Domain=%2, Path=%4, Name=%6, Value=%8

Fields #

Name	Description
`_DomainLength` UInt16
`Domain` AnsiString
`_PathLength` UInt16
`Path` AnsiString
`_NameLength` UInt16
`Name` AnsiString
`_ValueLength` UInt16
`Value` AnsiString

Event ID 504: Client has rejected a cookie sent by the server: Domain=Domain, Path=Path, Name=Name, Value=Value.

Channel: Analytic
Task: WININET_COOKIE_BLOCKED

Message #

Client has rejected a cookie sent by the server: Domain=%2, Path=%4, Name=%6, Value=%8

Fields #

Name	Description
`_DomainLength` UInt16
`Domain` AnsiString
`_PathLength` UInt16
`Path` AnsiString
`_NameLength` UInt16
`Name` AnsiString
`_ValueLength` UInt16
`Value` AnsiString

Event ID 505: Server cookie was rejected by the client's P3P policy: Domain=Domain, Path=Path, Name=Name, Value=Value.

Channel: Analytic
Task: WININET_COOKIE_P3P_REJECTED

Message #

Server cookie was rejected by the client's P3P policy: Domain=%2, Path=%4, Name=%6, Value=%8

Fields #

Name	Description
`_DomainLength` UInt16
`Domain` AnsiString
`_PathLength` UInt16
`Path` AnsiString
`_NameLength` UInt16
`Name` AnsiString
`_ValueLength` UInt16
`Value` AnsiString

Event ID 506: A cookie header was created for the request: URL=URL.

Channel: Analytic
Task: WININET_COOKIE_REQUEST_HEADER_CREATED

Message #

A cookie header was created for the request: URL=%2

Fields #

Name	Description
`URLLength` UInt32
`URL` AnsiString

Event ID 507: Cookie added to the request header: Domain=Domain, Path=Path, Name=Name, Value=Value.

Channel: Analytic
Task: WININET_COOKIE_ADDED_TO_HEADER

Message #

Cookie added to the request header: Domain=%2, Path=%4, Name=%6, Value=%8

Fields #

Name	Description
`_DomainLength` UInt16
`Domain` AnsiString
`_PathLength` UInt16
`Path` AnsiString
`_NameLength` UInt16
`Name` AnsiString
`_ValueLength` UInt16
`Value` AnsiString

Event ID 601: Auth response received: RequestHandle=RequestHandle, Scheme=Scheme, IsProxy=IsProxy.

Channel: Analytic
Task: WININET_AUTH_RESPONSE_RECEIVED

Message #

Auth response received: RequestHandle=%1, Scheme=%3, IsProxy=%4

Fields #

Name	Description
`RequestHandle` Pointer
`_SchemeLength` UInt16
`Scheme` AnsiString
`IsProxy` Boolean

Event ID 602: Client sets username: RequestHandle=RequestHandle, IsProxy=IsProxy.

Channel: Analytic
Task: WININET_AUTH_CLIENT_SETS_USERNAME

Message #

Client sets username: RequestHandle=%1, IsProxy=%2

Fields #

Name	Description
`RequestHandle` Pointer
`IsProxy` Boolean

Event ID 603: Client sets password: RequestHandle=RequestHandle, IsProxy=IsProxy.

Channel: Analytic
Task: WININET_AUTH_CLIENT_SETS_PASSWORD

Message #

Client sets password: RequestHandle=%1, IsProxy=%2

Fields #

Name	Description
`RequestHandle` Pointer
`IsProxy` Boolean

Event ID 604: Using cached credentials: RequestHandle=RequestHandle, IsProxy=IsProxy.

Channel: Analytic
Task: WININET_AUTH_USING_CACHED_CREDS

Message #

Using cached credentials: RequestHandle=%1, IsProxy=%2

Fields #

Name	Description
`RequestHandle` Pointer
`IsProxy` Boolean

Event ID 605: Using default credentials: RequestHandle=RequestHandle, IsProxy=IsProxy.

Channel: Analytic
Task: WININET_AUTH_USING_DEFAULT_CREDS

Message #

Using default credentials: RequestHandle=%1, IsProxy=%2

Fields #

Name	Description
`RequestHandle` Pointer
`IsProxy` Boolean

Event ID 606: Client adds authorization headers to an HTTP request: RequestHandle=RequestHandle, Scheme=Scheme, IsProxy=IsProxy.

Channel: Analytic
Task: WININET_AUTH_CLIENT_ADD_HEADERS

Message #

Client adds authorization headers to an HTTP request: RequestHandle=%1, Scheme=%3, IsProxy=%4

Fields #

Name	Description
`RequestHandle` Pointer
`_SchemeLength` UInt16
`Scheme` AnsiString
`IsProxy` Boolean

Event ID 701: Client begins SSL negotiation: RequestHandle=RequestHandle.

Channel: Analytic
Level: Informational
Task: WININET_HTTPS_NEGOTIATION
Opcode: Start

Message #

Client begins SSL negotiation: RequestHandle=%1

Fields #

Name	Description
`RequestHandle` Pointer

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-WinINet/Analytic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 701,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 2220,
      "thread_id": 4552
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 1,
    "provider": "Microsoft-Windows-WinINet",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 05:25:29.485Z",
    "version": 0
  },
  "event_data": {
    "RequestHandle": "0xCC0018"
  },
  "message": ""
}

Event ID 702: SSL negotiation between client and server has completed successfully: RequestHandle=RequestHandle.

Channel: Analytic
Level: Informational
Task: WININET_HTTPS_NEGOTIATION
Opcode: Stop

Message #

SSL negotiation between client and server has completed successfully: RequestHandle=%1

Fields #

Name	Description
`RequestHandle` Pointer

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-WinINet/Analytic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 702,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 2220,
      "thread_id": 12528
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 2,
    "provider": "Microsoft-Windows-WinINet",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 05:25:29.717Z",
    "version": 0
  },
  "event_data": {
    "RequestHandle": "0xCC0010"
  },
  "message": ""
}

Event ID 703: SSL negotiation failed: RequestHandle=RequestHandle, Error=Error.

Channel: Analytic
Task: WININET_HTTPS_NEGOTIATION
Opcode: Fail

Message #

SSL negotiation failed: RequestHandle=%1, Error=%2

Fields #

Name	Description
`RequestHandle` Pointer
`Error` UInt32

Event ID 704: Error validating server certificate (SCHANNEL error): RequestHandle=RequestHandle, Error=Error.

Channel: Analytic
Task: WININET_HTTPS_SERVER_CERT_ERROR

Message #

Error validating server certificate (SCHANNEL error): RequestHandle=%1, Error=%2

Fields #

Name	Description
`RequestHandle` Pointer
`Error` UInt32

Event ID 705: Server certificate validated: RequestHandle=RequestHandle, CertHash=CertHash, WarningFlags=WarningFlags.

Channel: Analytic
Level: Informational
Task: WININET_HTTPS_SERVER_CERT_VALIDATED

Message #

Server certificate validated: RequestHandle=%1, CertHash=%3, WarningFlags=%4

Fields #

Name	Description
`RequestHandle` Pointer
`_CertHashLength` UInt16
`CertHash` AnsiString
`WarningFlags` UInt32

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-WinINet/Analytic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 705,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 2220,
      "thread_id": 5984
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft-Windows-WinINet",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 05:25:29.262Z",
    "version": 0
  },
  "event_data": {
    "CertHash": "ED390D784C9C436EB91B7A638EBE06B7CEAC5AF0",
    "RequestHandle": "0xCC0010",
    "WarningFlags": 69888,
    "_CertHashLength": 40
  },
  "message": ""
}

Event ID 706: Server requires a client certificate for client authorization: RequestHandle=RequestHandle.

Channel: Analytic
Task: WININET_HTTPS_CLIENT_CERT_REQUIRED

Message #

Server requires a client certificate for client authorization: RequestHandle=%1

Fields #

Name	Description
`RequestHandle` Pointer

Event ID 707: There is no client certificate available: RequestHandle=RequestHandle.

Channel: Analytic
Task: WININET_HTTPS_CLIENT_CERT_UNAVAILABLE

Message #

There is no client certificate available: RequestHandle=%1

Fields #

Name	Description
`RequestHandle` Pointer
`Error` UInt32

Event ID 708: The selected client certificate will be used for the SSL transaction: RequestHandle=RequestHandle, CertHash=CertHash.

Channel: Analytic
Task: WININET_HTTPS_CLIENT_CERT_SELECTED

Message #

The selected client certificate will be used for the SSL transaction: RequestHandle=%1, CertHash=%3

Fields #

Name	Description
`RequestHandle` Pointer
`_CertHashLength` UInt16
`CertHash` AnsiString

Event ID 711: Client begins SSL renegotiation: RequestHandle=RequestHandle.

Channel: Analytic
Level: Informational
Task: WININET_HTTPS_RENEGOTIATION
Opcode: Start

Message #

Client begins SSL renegotiation: RequestHandle=%1

Fields #

Name	Description
`RequestHandle` Pointer

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-WinINet/Analytic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 711,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 2220,
      "thread_id": 4420
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 1,
    "provider": "Microsoft-Windows-WinINet",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 05:25:29.789Z",
    "version": 0
  },
  "event_data": {
    "RequestHandle": "0xCC0018"
  },
  "message": ""
}

Event ID 712: SSL renegotiation between client and server has completed successfully: RequestHandle=RequestHandle.

Channel: Analytic
Level: Informational
Task: WININET_HTTPS_RENEGOTIATION
Opcode: Stop

Message #

SSL renegotiation between client and server has completed successfully: RequestHandle=%1

Fields #

Name	Description
`RequestHandle` Pointer

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-WinINet/Analytic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 712,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 2220,
      "thread_id": 4420
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 2,
    "provider": "Microsoft-Windows-WinINet",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 05:25:29.791Z",
    "version": 0
  },
  "event_data": {
    "RequestHandle": "0xCC0018"
  },
  "message": ""
}

Event ID 713: SSL renegotiation failed: RequestHandle=RequestHandle, Error=Error.

Channel: Analytic
Task: WININET_HTTPS_RENEGOTIATION
Opcode: Fail

Message #

SSL renegotiation failed: RequestHandle=%1, Error=%2

Fields #

Name	Description
`RequestHandle` Pointer
`Error` UInt32

Event ID 801: Client begins attempts to locate the WPAD configuration file: ConnectionName=ConnectionName, DetectFlags=DetectFlags.

Channel: Analytic
Task: WININET_AUTOPROXY_SEARCH
Opcode: Start

Message #

Client begins attempts to locate the WPAD configuration file: ConnectionName=%2, DetectFlags=%3

Fields #

Name	Description
`_ConnectionNameLength` UInt16
`ConnectionName` UnicodeString
`DetectFlags` UInt32

Event ID 802: Begin search for configuration file using DHCP: Interface=Interface.

Channel: Analytic
Task: WININET_AUTOPROXY_DHCP
Opcode: Start

Message #

Begin search for configuration file using DHCP: Interface=%2

Fields #

Name	Description
`_InterfaceLength` UInt16
`Interface` UnicodeString

Event ID 803: WPAD configuration file found using DHCP: Interface=Interface, ConfigurationURL=ConfigurationURL.

Channel: Analytic
Task: WININET_AUTOPROXY_DHCP
Opcode: Stop

Message #

WPAD configuration file found using DHCP: Interface=%2, ConfigurationURL=%4

Fields #

Name	Description
`_InterfaceLength` UInt16
`Interface` UnicodeString
`_ConfigurationURLLength` UInt16
`ConfigurationURL` UnicodeString

Event ID 804: Search for WPAD configuration file using DHCP failed: Interface=Interface, ConfigurationURL=ConfigurationURL, Error=Error.

Channel: Analytic
Task: WININET_AUTOPROXY_DHCP
Opcode: Fail

Message #

Search for WPAD configuration file using DHCP failed: Interface=%2, ConfigurationURL=%4, Error=%5

Fields #

Name	Description
`_InterfaceLength` UInt16
`Interface` UnicodeString
`_ConfigurationURLLength` UInt16
`ConfigurationURL` UnicodeString
`Error` UInt32

Event ID 805: Begin search for configuration file using DNS: DetectFlags=DetectFlags.

Channel: Analytic
Task: WININET_AUTOPROXY_DNS
Opcode: Start

Message #

Begin search for configuration file using DNS: DetectFlags=%1

Fields #

Name	Description
`DetectFlags` UInt32

Event ID 806: WPAD configuration file found using DNS: ConfigurationURL=ConfigurationURL, DetectFlags=DetectFlags.

Channel: Analytic
Task: WININET_AUTOPROXY_DNS
Opcode: Stop

Message #

WPAD configuration file found using DNS: ConfigurationURL=%2, DetectFlags=%3

Fields #

Name	Description
`_ConfigurationURLLength` UInt16
`ConfigurationURL` UnicodeString
`DetectFlags` UInt32

Event ID 807: Search for WPAD configuration file using DNS failed: DetectFlags=DetectFlags, Error=Error.

Channel: Analytic
Task: WININET_AUTOPROXY_DNS
Opcode: Fail

Message #

Search for WPAD configuration file using DNS failed: DetectFlags=%1, Error=%2

Fields #

Name	Description
`DetectFlags` UInt32
`Error` UInt32

Event ID 808: Search for WPAD configruation file failed: Error=Error.

Channel: Analytic
Task: WININET_AUTOPROXY_SEARCH
Opcode: Fail

Message #

Search for WPAD configruation file failed: Error=%1

Fields #

Name	Description
`Error` UInt32

Event ID 809: Begin downloading the configuration file from the configuration URL: ConfigurationURL=ConfigurationURL.

Channel: Analytic
Task: WININET_AUTOPROXY_DOWNLOAD
Opcode: Start

Message #

Begin downloading the configuration file from the configuration URL: ConfigurationURL=%2

Fields #

Name	Description
`_ConfigurationURLLength` UInt16
`ConfigurationURL` UnicodeString

Event ID 810: Client successfully downloaded the configuration file from the configuration URL: ConfigurationURL=ConfigurationURL.

Channel: Analytic
Task: WININET_AUTOPROXY_DOWNLOAD
Opcode: Stop

Message #

Client successfully downloaded the configuration file from the configuration URL: ConfigurationURL=%2

Fields #

Name	Description
`_ConfigurationURLLength` UInt16
`ConfigurationURL` UnicodeString

Event ID 811: Downloading the configuration file from the configuration URL failed: ConfigurationURL=ConfigurationURL, Error=Error.

Channel: Analytic
Task: WININET_AUTOPROXY_DOWNLOAD
Opcode: Fail

Message #

Downloading the configuration file from the configuration URL failed: ConfigurationURL=%2, Error=%3

Fields #

Name	Description
`_ConfigurationURLLength` UInt16
`ConfigurationURL` UnicodeString
`Error` UInt32

Event ID 812: The downloaded configuration file could not be used: ConfigurationURL=ConfigurationURL, MIMEType=MIMEType, Error=Error.

Channel: Analytic
Task: WININET_AUTOPROXY_DOWNLOAD
Opcode: Fail

Message #

The downloaded configuration file could not be used: ConfigurationURL=%2, MIMEType=%4, Error=%5

Fields #

Name	Description
`_ConfigurationURLLength` UInt16
`ConfigurationURL` UnicodeString
`_MIMETypeLength` UInt16
`MIMEType` UnicodeString
`Error` UInt32

Event ID 813: Searching for Proxy Information for the URL: URL=URL.

Channel: Analytic
Task: WININET_AUTOPROXY_FIND_INFO_FOR_URL
Opcode: Start

Message #

Searching for Proxy Information for the URL: URL=%2

Fields #

Name	Description
`_URLLength` UInt16
`URL` UnicodeString

Event ID 814: Client has successfully retrieved proxy data for accessing a specified resource: URL=URL, ProxyString=ProxyString.

Channel: Analytic
Task: WININET_AUTOPROXY_FIND_INFO_FOR_URL
Opcode: Stop

Message #

Client has successfully retrieved proxy data for accessing a specified resource: URL=%2, ProxyString=%4

Fields #

Name	Description
`_URLLength` UInt16
`URL` UnicodeString
`_ProxyStringLength` UInt16
`ProxyString` UnicodeString

Event ID 815: Error locating proxy information for the URL: URL=URL, Error=Error.

Channel: Analytic
Task: WININET_AUTOPROXY_FIND_INFO_FOR_URL
Opcode: Fail

Message #

Error locating proxy information for the URL: URL=%2, Error=%3

Fields #

Name	Description
`_URLLength` UInt16
`URL` UnicodeString
`Error` UInt32

Event ID 816: Blocking autoproxy determination started

Channel: Analytic
Task: WININET_BLOCKING_AUTOPROXY_DETERMINATION
Opcode: Start

Event ID 817: Blocking autoproxy determination stopped

Channel: Analytic
Task: WININET_BLOCKING_AUTOPROXY_DETERMINATION
Opcode: Stop

Event ID 818: WinInet Activity Transfer Event

Channel: Analytic
Task: WININET_TRANSFER

Event ID 819: AutoProxy SWPAD Decision (WPADNetworkDecision) NumConnections (NetworkCount).

Channel: Analytic
Task: WININET_AUTOPROXY_SWPAD

Message #

AutoProxy SWPAD Decision (%1) NumConnections (%2)

Fields #

Name	Description
`WPADNetworkDecision` UInt32
`NetworkCount` UInt32

Event ID 820: Autoproxy host IP lookup started

Channel: Analytic
Task: WININET_AUTOPROXY_PERFTRACK_HOST_IP_LOOKUP
Opcode: Start

Event ID 821: Autoproxy host IP lookup stopped

Channel: Analytic
Task: WININET_AUTOPROXY_PERFTRACK_HOST_IP_LOOKUP
Opcode: Stop

Event ID 822: Autoproxy SWPAD lookup started

Channel: Analytic
Task: WININET_AUTOPROXY_PERFTRACK_SWPAD_LOOKUP
Opcode: Start

Event ID 823: Autoproxy SWPAD lookup stopped

Channel: Analytic
Task: WININET_AUTOPROXY_PERFTRACK_SWPAD_LOOKUP
Opcode: Stop

Event ID 824: Autoproxy Detection with SWPAD ON started

Channel: Analytic
Task: WININET_AUTOPROXY_PERFTRACK_KNOWN_DETECTION
Opcode: Start

Event ID 825: Autoproxy Detection with SWPAD ON stopped

Channel: Analytic
Task: WININET_AUTOPROXY_PERFTRACK_KNOWN_DETECTION
Opcode: Stop

Event ID 826: Autoproxy Detection with SWPAD UNKNOWN started

Channel: Analytic
Task: WININET_AUTOPROXY_PERFTRACK_UNKNOWN_DETECTION
Opcode: Start

Event ID 827: Autoproxy Detection with SWPAD UNKNOWN stopped

Channel: Analytic
Task: WININET_AUTOPROXY_PERFTRACK_UNKNOWN_DETECTION
Opcode: Stop

Event ID 828: Autoproxy Script Download Started

Channel: Analytic
Task: WININET_AUTOPROXY_PERFTRACK_SCRIPT_DOWNLOAD
Opcode: Start

Event ID 829: Autoproxy Script Download Stopped

Channel: Analytic
Task: WININET_AUTOPROXY_PERFTRACK_SCRIPT_DOWNLOAD
Opcode: Stop

Event ID 834: Autoproxy full scenario started

Channel: Analytic
Task: WININET_AUTOPROXY_PERFTRACK_ALL
Opcode: Start

Fields #

Name	Description
`UniqueId` UInt32

Event ID 835: Autoproxy full scenario stopped

Channel: Analytic
Task: WININET_AUTOPROXY_PERFTRACK_ALL
Opcode: Stop

Fields #

Name	Description
`UniqueId` UInt32

Event ID 901: Application offline check started

Channel: Analytic
Task: WININET_APPLICATION_OFFLINE_CHECK
Opcode: Start

Fields #

Name	Description
`AppPackageSid` UnicodeString

Event ID 902: Application offline check complete

Channel: Analytic
Task: WININET_APPLICATION_OFFLINE_CHECK
Opcode: Stop

Fields #

Name	Description
`Result` UInt32
`Offline` Boolean

Event ID 1000: WININET_TEST_EVENT

Channel: Analytic
Task: WININET_TEST_EVENT

Fields #

Name	Description
`_TestStr0Length` UInt8
`TestStr0` AnsiString
`_TestStr1Length` UInt16
`TestStr1` AnsiString
`_TestStr2Length` UInt32
`TestStr2` AnsiString
`_TestStr0WLength` UInt8
`TestStr0W` UnicodeString
`_TestStr1WLength` UInt16
`TestStr1W` UnicodeString
`_TestStr2WLength` UInt32
`TestStr2W` UnicodeString
`TestStrLength` UInt16
`TestStr` AnsiString
`TestStrWLength` UInt16
`TestStrW` UnicodeString

Event ID 1007: Wininet_SendRequestStart

Channel: Analytic
Level: Informational
Task: Wininet_SendRequest
Opcode: Start

Fields #

Name	Description
`Request` Pointer
`AddressName` AnsiString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-WinINet",
    "guid": "{43d1a55c-76d6-4f7e-995c-64c711e5cafe}",
    "event_source_name": "",
    "event_id": 1007,
    "version": 0,
    "level": 4,
    "task": 550,
    "opcode": 1,
    "keywords": "0x8000000000000080",
    "time_created": "2026-07-19T03:37:35.721259700+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "00CC000C-0007-0000-7428-34116005E5A0"
    },
    "execution": {
      "process_id": 10356,
      "thread_id": 4404
    },
    "channel": "Microsoft-Windows-WinINet/Analytic",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Request": "0x1D3A0E50560",
    "AddressName": "http://127.0.0.1:18081/catalog-test"
  },
  "message": ""
}

Event ID 1008: Wininet_SendRequestStop

Channel: Analytic
Level: Informational
Task: Wininet_SendRequest
Opcode: Stop

Fields #

Name	Description
`Request` Pointer
`StatusLineLength` UInt32
`StatusLine` AnsiString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-WinINet",
    "guid": "{43d1a55c-76d6-4f7e-995c-64c711e5cafe}",
    "event_source_name": "",
    "event_id": 1008,
    "version": 0,
    "level": 4,
    "task": 550,
    "opcode": 2,
    "keywords": "0x8000000000000080",
    "time_created": "2026-07-19T03:37:35.769180100+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "00CC000C-0007-0000-7428-34116005E5A0"
    },
    "execution": {
      "process_id": 10356,
      "thread_id": 10196
    },
    "channel": "Microsoft-Windows-WinINet/Analytic",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Request": "0x1D3A0E50560",
    "StatusLineLength": "15",
    "StatusLine": "HTTP/1.1 200 OK"
  },
  "message": ""
}

Event ID 1009: Wininet_OfflineCacheLookup

Channel: Analytic
Task: Wininet_OfflineCacheLookup

Fields #

Name	Description
`Request` Pointer

Event ID 1011: Wininet_OfflineCacheHit

Channel: Analytic
Task: Wininet_OfflineCacheHit

Fields #

Name	Description
`Request` Pointer

Event ID 1013: Wininet_OfflineCacheMiss

Channel: Analytic
Task: Wininet_OfflineCacheMiss

Fields #

Name	Description
`Request` Pointer

Event ID 1015: Wininet_PreNet_CacheLookup

Channel: Analytic
Level: Informational
Task: Wininet_PreNet_CacheLookup

Fields #

Name	Description
`Request` Pointer

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-WinINet",
    "guid": "{43d1a55c-76d6-4f7e-995c-64c711e5cafe}",
    "event_source_name": "",
    "event_id": 1015,
    "version": 0,
    "level": 4,
    "task": 554,
    "opcode": 0,
    "keywords": "0x8000000000000280",
    "time_created": "2026-07-19T03:37:35.721287200+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "00CC000C-0007-0000-7428-34116005E5A0"
    },
    "execution": {
      "process_id": 10356,
      "thread_id": 4404
    },
    "channel": "Microsoft-Windows-WinINet/Analytic",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Request": "0x1D3A0E50560"
  },
  "message": ""
}

Event ID 1017: Wininet_PreNet_CacheHit

Channel: Analytic
Task: Wininet_PreNet_CacheHit

Fields #

Name	Description
`Request` Pointer

Event ID 1019: Wininet_PreNet_CacheMiss

Channel: Analytic
Level: Informational
Task: Wininet_PreNet_CacheMiss

Fields #

Name	Description
`Request` Pointer

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-WinINet",
    "guid": "{43d1a55c-76d6-4f7e-995c-64c711e5cafe}",
    "event_source_name": "",
    "event_id": 1019,
    "version": 0,
    "level": 4,
    "task": 556,
    "opcode": 0,
    "keywords": "0x8000000000000280",
    "time_created": "2026-07-19T03:37:35.721401200+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "00CC000C-0007-0000-7428-34116005E5A0"
    },
    "execution": {
      "process_id": 10356,
      "thread_id": 4404
    },
    "channel": "Microsoft-Windows-WinINet/Analytic",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Request": "0x1D3A0E50560"
  },
  "message": ""
}

Event ID 1021: Wininet_PostNet_CacheLookup

Channel: Analytic
Level: Informational
Task: Wininet_PostNet_CacheLookup

Fields #

Name	Description
`Request` Pointer

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-WinINet",
    "guid": "{43d1a55c-76d6-4f7e-995c-64c711e5cafe}",
    "event_source_name": "",
    "event_id": 1021,
    "version": 0,
    "level": 4,
    "task": 557,
    "opcode": 0,
    "keywords": "0x8000000000000080",
    "time_created": "2026-07-19T03:37:35.766629600+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "00CC000C-0007-0000-7428-34116005E5A0"
    },
    "execution": {
      "process_id": 10356,
      "thread_id": 10196
    },
    "channel": "Microsoft-Windows-WinINet/Analytic",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Request": "0x1D3A0E50560"
  },
  "message": ""
}

Event ID 1023: Wininet_PostNet_CacheHit

Channel: Analytic
Task: Wininet_PostNet_CacheHit

Fields #

Name	Description
`Request` Pointer

Event ID 1025: Wininet_PostNet_CacheMiss

Channel: Analytic
Level: Informational
Task: Wininet_PostNet_CacheMiss

Fields #

Name	Description
`Request` Pointer

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-WinINet",
    "guid": "{43d1a55c-76d6-4f7e-995c-64c711e5cafe}",
    "event_source_name": "",
    "event_id": 1025,
    "version": 0,
    "level": 4,
    "task": 559,
    "opcode": 0,
    "keywords": "0x8000000000000080",
    "time_created": "2026-07-19T03:37:35.766646800+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "00CC000C-0007-0000-7428-34116005E5A0"
    },
    "execution": {
      "process_id": 10356,
      "thread_id": 10196
    },
    "channel": "Microsoft-Windows-WinINet/Analytic",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Request": "0x1D3A0E50560"
  },
  "message": ""
}

Event ID 1027: Wininet_AutodialIfNotLocalHostStart

Channel: Analytic
Task: Wininet_AutodialIfNotLocalHost
Opcode: Start

Fields #

Name	Description
`Request` Pointer
`HostName` AnsiString

Event ID 1028: Wininet_AutodialIfNotLocalHostStop

Channel: Analytic
Task: Wininet_AutodialIfNotLocalHost
Opcode: Stop

Fields #

Name	Description
`Request` Pointer

Event ID 1029: Wininet_ResolveHostStart

Channel: Analytic
Level: Informational
Task: Wininet_ResolveHost
Opcode: Start

Fields #

Name	Description
`Request` Pointer
`HostName` AnsiString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-WinINet",
    "guid": "{43d1a55c-76d6-4f7e-995c-64c711e5cafe}",
    "event_source_name": "",
    "event_id": 1029,
    "version": 0,
    "level": 4,
    "task": 561,
    "opcode": 1,
    "keywords": "0x8000000000000280",
    "time_created": "2026-07-19T03:37:35.729311100+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "00CC000C-0007-0000-7428-34116005E5A0"
    },
    "execution": {
      "process_id": 10356,
      "thread_id": 180
    },
    "channel": "Microsoft-Windows-WinINet/Analytic",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Request": "0x1D3A0E50560",
    "HostName": "127.0.0.1"
  },
  "message": ""
}

Event ID 1030: Wininet_ResolveHostStop

Channel: Analytic
Level: Informational
Task: Wininet_ResolveHost
Opcode: Stop

Fields #

Name	Description
`Request` Pointer
`HostName` AnsiString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-WinINet",
    "guid": "{43d1a55c-76d6-4f7e-995c-64c711e5cafe}",
    "event_source_name": "",
    "event_id": 1030,
    "version": 0,
    "level": 4,
    "task": 561,
    "opcode": 2,
    "keywords": "0x8000000000000280",
    "time_created": "2026-07-19T03:37:35.730396000+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "00CC000C-0007-0000-7428-34116005E5A0"
    },
    "execution": {
      "process_id": 10356,
      "thread_id": 180
    },
    "channel": "Microsoft-Windows-WinINet/Analytic",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Request": "0x1D3A0E50560",
    "HostName": "127.0.0.1"
  },
  "message": ""
}

Event ID 1031: Wininet_SendRequest_Main

Channel: Analytic
Level: Informational
Task: Wininet_SendRequest_Main

Fields #

Name	Description
`Request` Pointer
`Size` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-WinINet",
    "guid": "{43d1a55c-76d6-4f7e-995c-64c711e5cafe}",
    "event_source_name": "",
    "event_id": 1031,
    "version": 0,
    "level": 4,
    "task": 562,
    "opcode": 0,
    "keywords": "0x8000000000000280",
    "time_created": "2026-07-19T03:37:35.736212500+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "00CC000C-0007-0000-7428-34116005E5A0"
    },
    "execution": {
      "process_id": 10356,
      "thread_id": 10196
    },
    "channel": "Microsoft-Windows-WinINet/Analytic",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Request": "0x1D3A0E50560",
    "Size": "215"
  },
  "message": ""
}

Event ID 1033: Wininet_SendRequest_Extra

Channel: Analytic
Task: Wininet_SendRequest_Extra

Fields #

Name	Description
`Request` Pointer
`Size` UInt32

Event ID 1035: Wininet_SendRequest_CRLF

Channel: Analytic
Task: Wininet_SendRequest_CRLF

Fields #

Name	Description
`Request` Pointer
`Size` UInt32

Event ID 1037: Wininet_ReadData

Channel: Analytic
Level: Informational
Task: Wininet_ReadData

Fields #

Name	Description
`Request` Pointer
`Size` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-WinINet",
    "guid": "{43d1a55c-76d6-4f7e-995c-64c711e5cafe}",
    "event_source_name": "",
    "event_id": 1037,
    "version": 0,
    "level": 4,
    "task": 565,
    "opcode": 0,
    "keywords": "0x8000000000000280",
    "time_created": "2026-07-19T03:37:35.766407000+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "00CC000C-0007-0000-7428-34116005E5A0"
    },
    "execution": {
      "process_id": 10356,
      "thread_id": 10196
    },
    "channel": "Microsoft-Windows-WinINet/Analytic",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Request": "0x1D3A0E50560",
    "Size": "115"
  },
  "message": ""
}

Event ID 1039: Wininet_ReadDataPostReceiveBuf

Channel: Analytic
Level: Informational
Task: Wininet_ReadDataPostReceiveBuf

Fields #

Name	Description
`Request` Pointer
`Size` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-WinINet",
    "guid": "{43d1a55c-76d6-4f7e-995c-64c711e5cafe}",
    "event_source_name": "",
    "event_id": 1039,
    "version": 0,
    "level": 4,
    "task": 566,
    "opcode": 0,
    "keywords": "0x8000000000000080",
    "time_created": "2026-07-19T03:37:35.736674300+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "00CC000C-0007-0000-7428-34116005E5A0"
    },
    "execution": {
      "process_id": 10356,
      "thread_id": 10196
    },
    "channel": "Microsoft-Windows-WinINet/Analytic",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Request": "0x1D3A0E50560",
    "Size": "1024"
  },
  "message": ""
}

Event ID 1041: Wininet_SendRequest_PostReceiveBuf

Channel: Analytic
Level: Informational
Task: Wininet_SendRequest_PostReceiveBuf

Fields #

Name	Description
`Request` Pointer
`Size` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-WinINet",
    "guid": "{43d1a55c-76d6-4f7e-995c-64c711e5cafe}",
    "event_source_name": "",
    "event_id": 1041,
    "version": 0,
    "level": 4,
    "task": 567,
    "opcode": 0,
    "keywords": "0x8000000000000280",
    "time_created": "2026-07-19T03:37:35.736639800+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "00CC000C-0007-0000-7428-34116005E5A0"
    },
    "execution": {
      "process_id": 10356,
      "thread_id": 10196
    },
    "channel": "Microsoft-Windows-WinINet/Analytic",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Request": "0x1D3A0E50560",
    "Size": "1024"
  },
  "message": ""
}

Event ID 1043: Wininet_DrainResponsePostReceiveBuf

Channel: Analytic
Task: Wininet_DrainResponsePostReceiveBuf

Fields #

Name	Description
`Request` Pointer
`Size` UInt32

Event ID 1045: Wininet_ConnectStart

Channel: Analytic
Level: Informational
Task: Wininet_Connect
Opcode: Start

Fields #

Name	Description
`Request` Pointer

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-WinINet",
    "guid": "{43d1a55c-76d6-4f7e-995c-64c711e5cafe}",
    "event_source_name": "",
    "event_id": 1045,
    "version": 0,
    "level": 4,
    "task": 569,
    "opcode": 1,
    "keywords": "0x8000000000000280",
    "time_created": "2026-07-19T03:37:35.729211300+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "00CC000C-0007-0000-7428-34116005E5A0"
    },
    "execution": {
      "process_id": 10356,
      "thread_id": 180
    },
    "channel": "Microsoft-Windows-WinINet/Analytic",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Request": "0x1D3A0E50560"
  },
  "message": ""
}

Event ID 1046: Wininet_ConnectStop_V1

Channel: Analytic
Level: Informational
Task: Wininet_Connect
Opcode: Stop

Fields #

Name	Description
`Request` Pointer
`Socket` UInt32
`Protocol` UInt32	Known values `0` HOPOPT `1` ICMP `2` IGMP `6` TCP `17` UDP `41` IPv6 `43` IPv6-Route `44` IPv6-Frag `47` GRE `50` ESP `51` AH `58` ICMPv6 `89` OSPF `103` PIM `132` SCTP
`LocalAddressLength` UInt32
`LocalAddress` Binary
`RemoteAddressLength` UInt32
`RemoteAddress` Binary

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-WinINet",
    "guid": "{43d1a55c-76d6-4f7e-995c-64c711e5cafe}",
    "event_source_name": "",
    "event_id": 1046,
    "version": 1,
    "level": 4,
    "task": 569,
    "opcode": 2,
    "keywords": "0x8000000000000280",
    "time_created": "2026-07-19T03:37:35.734157600+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "00CC000C-0007-0000-7428-34116005E5A0"
    },
    "execution": {
      "process_id": 10356,
      "thread_id": 10196
    },
    "channel": "Microsoft-Windows-WinINet/Analytic",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Request": "0x1D3A0E50560",
    "Socket": "57005",
    "Protocol": "0x0",
    "LocalAddressLength": "16",
    "LocalAddress": "127.0.0.1:57005",
    "RemoteAddressLength": "16",
    "RemoteAddress": "127.0.0.1:18081"
  },
  "message": ""
}

Event ID 1047: Wininet_LookupConnectionStart

Channel: Analytic
Level: Informational
Task: Wininet_LookupConnection
Opcode: Start

Fields #

Name	Description
`Request` Pointer

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-WinINet",
    "guid": "{43d1a55c-76d6-4f7e-995c-64c711e5cafe}",
    "event_source_name": "",
    "event_id": 1047,
    "version": 0,
    "level": 4,
    "task": 570,
    "opcode": 1,
    "keywords": "0x8000000000000080",
    "time_created": "2026-07-19T03:37:35.729264900+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "00CC000C-0007-0000-7428-34116005E5A0"
    },
    "execution": {
      "process_id": 10356,
      "thread_id": 180
    },
    "channel": "Microsoft-Windows-WinINet/Analytic",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Request": "0x1D3A0E50560"
  },
  "message": ""
}

Event ID 1048: Wininet_LookupConnectionStop

Channel: Analytic
Level: Informational
Task: Wininet_LookupConnection
Opcode: Stop

Fields #

Name	Description
`Request` Pointer
`Socket` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-WinINet",
    "guid": "{43d1a55c-76d6-4f7e-995c-64c711e5cafe}",
    "event_source_name": "",
    "event_id": 1048,
    "version": 0,
    "level": 4,
    "task": 570,
    "opcode": 2,
    "keywords": "0x8000000000000080",
    "time_created": "2026-07-19T03:37:35.729289100+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "00CC000C-0007-0000-7428-34116005E5A0"
    },
    "execution": {
      "process_id": 10356,
      "thread_id": 180
    },
    "channel": "Microsoft-Windows-WinINet/Analytic",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Request": "0x1D3A0E50560",
    "Socket": "4294967295"
  },
  "message": ""
}

Event ID 1049: Wininet_Redirect

Channel: Analytic
Task: Wininet_Redirect

Fields #

Name	Description
`Request` Pointer
`AddressName` AnsiString

Event ID 1051: Wininet_GetaddrinfoStart

Channel: Analytic
Level: Informational
Task: Wininet_Getaddrinfo
Opcode: Start

Fields #

Name	Description
`Flags` UInt32
`AddressName` AnsiString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-WinINet",
    "guid": "{43d1a55c-76d6-4f7e-995c-64c711e5cafe}",
    "event_source_name": "",
    "event_id": 1051,
    "version": 0,
    "level": 4,
    "task": 572,
    "opcode": 1,
    "keywords": "0x8000000000000080",
    "time_created": "2026-07-19T03:37:35.729375300+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "00CC000C-0007-0000-7428-34116005E5A0"
    },
    "execution": {
      "process_id": 10356,
      "thread_id": 180
    },
    "channel": "Microsoft-Windows-WinINet/Analytic",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Flags": "0x2",
    "AddressName": "127.0.0.1"
  },
  "message": ""
}

Event ID 1052: Wininet_GetaddrinfoStop

Channel: Analytic
Level: Informational
Task: Wininet_Getaddrinfo
Opcode: Stop

Fields #

Name	Description
`error` UInt32
`Flags` UInt32
`AddressName` AnsiString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-WinINet",
    "guid": "{43d1a55c-76d6-4f7e-995c-64c711e5cafe}",
    "event_source_name": "",
    "event_id": 1052,
    "version": 0,
    "level": 4,
    "task": 572,
    "opcode": 2,
    "keywords": "0x8000000000000080",
    "time_created": "2026-07-19T03:37:35.730317700+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "00CC000C-0007-0000-7428-34116005E5A0"
    },
    "execution": {
      "process_id": 10356,
      "thread_id": 180
    },
    "channel": "Microsoft-Windows-WinINet/Analytic",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "error": "0",
    "Flags": "0x2",
    "AddressName": "127.0.0.1"
  },
  "message": ""
}

Event ID 1053: Wininet_DHCP_I252WPADStart

Channel: Analytic
Task: Wininet_DHCP_I252WPAD
Opcode: Start

Fields #

Name	Description
`Order` UInt32
`AddressName` AnsiString

Event ID 1054: Wininet_DHCP_I252WPADStop

Channel: Analytic
Task: Wininet_DHCP_I252WPAD
Opcode: Stop

Fields #

Name	Description
`error` UInt32
`AddressName` AnsiString

Event ID 1055: Wininet_SelectStart

Channel: Analytic
Task: Wininet_Select
Opcode: Start

Fields #

Name	Description
`Request` Pointer
`Flags` UInt32

Event ID 1056: Wininet_SelectStop

Channel: Analytic
Task: Wininet_Select
Opcode: Stop

Fields #

Name	Description
`Request` Pointer
`Flags` UInt32

Event ID 1057: Requested URL=URL Verb=Verb RequestHeaders=RequestHeaders ResponseHeaders=ResponseHeaders Status=Status Cache=UsageLogRequestCache.

Channel: UsageLog
Level: Informational
Task: Wininet_UsageLogRequest

Message #

Requested URL=%1 Verb=%2 RequestHeaders=%3 ResponseHeaders=%4 Status=%5 Cache=%6

Fields #

Name	Description
`URL` AnsiString
`Verb` AnsiString
`RequestHeaders` AnsiString
`ResponseHeaders` AnsiString
`Status` UInt32	NTSTATUS reference
`UsageLogRequestCache` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-WinINet",
    "guid": "{43d1a55c-76d6-4f7e-995c-64c711e5cafe}",
    "event_source_name": "",
    "event_id": 1057,
    "version": 0,
    "level": 4,
    "task": 575,
    "opcode": 0,
    "keywords": "0x4000020000000000",
    "time_created": "2026-07-19T03:37:35.803502500+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "00CC000C-0007-0000-7428-34116005E5A0"
    },
    "execution": {
      "process_id": 10356,
      "thread_id": 4404
    },
    "channel": "Microsoft-Windows-WinINet/UsageLog",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "URL": "http://127.0.0.1:18081/catalog-test",
    "Verb": "GET",
    "RequestHeaders": "GET /catalog-test HTTP/1.1\nUser-Agent: CatalogClient/1.0\nHost: 127.0.0.1:18081\nX-P2P-PeerDist: Version=1.1\nX-P2P-PeerDistEx: MinContentInformation=1.0, MaxContentInformation=2.0\nAccept-Encoding: peerdist",
    "ResponseHeaders": "HTTP/1.1 200 OK\nContent-Length: 9\nServer: Microsoft-HTTPAPI/2.0\nDate: Sun, 19 Jul 2026 03:37:36 GMT",
    "Status": "200",
    "UsageLogRequestCache": "0x0"
  },
  "message": "Requested URL=http://127.0.0.1:18081/catalog-test Verb=GET RequestHeaders=GET /catalog-test HTTP/1.1\nUser-Agent: CatalogClient/1.0\nHost: 127.0.0.1:18081\nX-P2P-PeerDist: Version=1.1\nX-P2P-PeerDistEx: MinContentInformation=1.0, MaxContentInformation=2.0\nAccept-Encoding: peerdist\n\n ResponseHeaders=HTTP/1.1 200 OK\nContent-Length: 9\nServer: Microsoft-HTTPAPI/2.0\nDate: Sun, 19 Jul 2026 03:37:36 GMT\n\n Status=200 Cache=Missed"
}

Event ID 1058: Scavenged URL=URL.

Channel: UsageLog
Task: Wininet_UsageLogScavenge

Message #

Scavenged URL=%1

Fields #

Name	Description
`URL` AnsiString

Event ID 1059: Wininet_SocketConnectStart

Channel: Analytic
Level: Informational
Task: Wininet_SocketConnect
Opcode: Start

Fields #

Name	Description
`Request` Pointer
`Socket` UInt32
`SourcePort` UInt32
`RemoteAddressIndex` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-WinINet",
    "guid": "{43d1a55c-76d6-4f7e-995c-64c711e5cafe}",
    "event_source_name": "",
    "event_id": 1059,
    "version": 0,
    "level": 4,
    "task": 577,
    "opcode": 1,
    "keywords": "0x8000000000000280",
    "time_created": "2026-07-19T03:37:35.733288000+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "00CC000C-0007-0000-7428-34116005E5A0"
    },
    "execution": {
      "process_id": 10356,
      "thread_id": 180
    },
    "channel": "Microsoft-Windows-WinINet/Analytic",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Request": "0x1D3A0E50560",
    "Socket": "3600",
    "SourcePort": "57005",
    "RemoteAddressIndex": "0"
  },
  "message": ""
}

Event ID 1060: Wininet_SocketConnectStop

Channel: Analytic
Level: Informational
Task: Wininet_SocketConnect
Opcode: Stop

Fields #

Name	Description
`Request` Pointer
`Socket` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-WinINet",
    "guid": "{43d1a55c-76d6-4f7e-995c-64c711e5cafe}",
    "event_source_name": "",
    "event_id": 1060,
    "version": 0,
    "level": 4,
    "task": 577,
    "opcode": 2,
    "keywords": "0x8000000000000280",
    "time_created": "2026-07-19T03:37:35.734103500+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "00CC000C-0007-0000-7428-34116005E5A0"
    },
    "execution": {
      "process_id": 10356,
      "thread_id": 10196
    },
    "channel": "Microsoft-Windows-WinINet/Analytic",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Request": "0x1D3A0E50560",
    "Socket": "3600"
  },
  "message": ""
}

Event ID 1061: Wininet_AppCacheLookupStart

Channel: Analytic
Task: Wininet_AppCacheLookup
Opcode: Start

Fields #

Name	Description
`URL` UnicodeString

Event ID 1062: Wininet_AppCacheLookupStop

Channel: Analytic
Task: Wininet_AppCacheLookup
Opcode: Stop

Fields #

Name	Description
`ManifestURL` UnicodeString

Event ID 1063: Wininet_RequestPrioritySet

Channel: Analytic
Task: Wininet_RequestPrioritySet

Fields #

Name	Description
`Request` Pointer
`OldPriority` Int32
`NewPriority` Int32

Event ID 1064: WININET_STREAM_DATA_INDICATED

Channel: Analytic
Task: WININET_STREAM_DATA_INDICATED

Fields #

Name	Description
`RequestHandle` Pointer
`StreamId` UInt32
`Size` UInt32
`Headers` Boolean

Event ID 1065: Wininet_SecurityContextStart

Channel: Analytic
Level: Informational
Task: Wininet_SecurityContext
Opcode: Start

Fields #

Name	Description
`Context` Pointer
`HostName` AnsiString
`NegotiationCount` UInt32
`Socket` UInt32

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-WinINet/Analytic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 1065,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 2220,
      "thread_id": 4552
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 1,
    "provider": "Microsoft-Windows-WinINet",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 05:25:29.509Z",
    "version": 0
  },
  "event_data": {
    "Context": "0x2342A8E9B40",
    "HostName": "odc.officeapps.live.com",
    "NegotiationCount": 1,
    "Socket": 5580
  },
  "message": ""
}

Event ID 1066: Wininet_SecurityContextStop

Channel: Analytic
Level: Informational
Task: Wininet_SecurityContext
Opcode: Stop

Fields #

Name	Description
`Context` Pointer
`HostName` AnsiString
`NegotiationCount` UInt32
`Socket` UInt32
`Status` UInt32	NTSTATUS reference

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-WinINet/Analytic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 1066,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 2220,
      "thread_id": 12528
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 2,
    "provider": "Microsoft-Windows-WinINet",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 05:25:29.510Z",
    "version": 0
  },
  "event_data": {
    "Context": "0x2342A8E8040",
    "HostName": "odc.officeapps.live.com",
    "NegotiationCount": 1,
    "Socket": 5992,
    "Status": 590610
  },
  "message": ""
}

Event ID 1067: Wininet_SocketReceiveDelayStart

Channel: Analytic
Level: Informational
Task: Wininet_SocketReceiveDelay
Opcode: Start

Fields #

Name	Description
`Request` Pointer
`Socket` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-WinINet",
    "guid": "{43d1a55c-76d6-4f7e-995c-64c711e5cafe}",
    "event_source_name": "",
    "event_id": 1067,
    "version": 0,
    "level": 4,
    "task": 592,
    "opcode": 1,
    "keywords": "0x8000000000000080",
    "time_created": "2026-07-19T03:37:35.766388900+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "00CC000C-0007-0000-7428-34116005E5A0"
    },
    "execution": {
      "process_id": 10356,
      "thread_id": 10196
    },
    "channel": "Microsoft-Windows-WinINet/Analytic",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Request": "0x1D3A06D3F40",
    "Socket": "3600"
  },
  "message": ""
}

Event ID 1068: Wininet_SocketReceiveDelayStop

Channel: Analytic
Level: Informational
Task: Wininet_SocketReceiveDelay
Opcode: Stop

Fields #

Name	Description
`Request` Pointer
`Socket` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-WinINet",
    "guid": "{43d1a55c-76d6-4f7e-995c-64c711e5cafe}",
    "event_source_name": "",
    "event_id": 1068,
    "version": 0,
    "level": 4,
    "task": 592,
    "opcode": 2,
    "keywords": "0x8000000000000080",
    "time_created": "2026-07-19T03:37:35.736704400+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "00CC000C-0007-0000-7428-34116005E5A0"
    },
    "execution": {
      "process_id": 10356,
      "thread_id": 10196
    },
    "channel": "Microsoft-Windows-WinINet/Analytic",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Request": "0x1D3A06D3F40",
    "Socket": "3600"
  },
  "message": ""
}

Event ID 1069: Wininet_FileIOStart

Channel: Analytic
Level: Informational
Task: Wininet_FileIO
Opcode: Start

Fields #

Name	Description
`Handle` Pointer
`Operation` UInt32	Known values `%%2456` Open key file. `%%2457` Delete key file. `%%2458` Read persisted key from file. `%%2459` Write persisted key to file. `%%2464` Export of persistent cryptographic key. `%%2465` Import of persistent cryptographic key. `%%2480` Open Key. `%%2481` Create Key. `%%2482` Delete Key. `%%2483` Encrypt. `%%2484` Decrypt. `%%2485` Sign hash. `%%2486` Secret agreement. `%%2487` Domain settings. `%%2488` Local settings. `%%2489` Add provider. `%%2490` Remove provider. `%%2491` Add context. `%%2492` Remove context. `%%2493` Add function. `%%2494` Remove function. `%%2495` Add function provider. `%%2496` Remove function provider. `%%2497` Add function property. `%%2498` Remove function property. `%%2499` Machine key. `%%2500` User key. `%%2501` Key Derivation. `%%2502` Claim Creation. `%%2503` Claim Verification.
`ClientType` UInt32
`ThreadInfoUIType` UInt32
`IsSync` Boolean

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-WinINet",
    "guid": "{43d1a55c-76d6-4f7e-995c-64c711e5cafe}",
    "event_source_name": "",
    "event_id": 1069,
    "version": 0,
    "level": 4,
    "task": 593,
    "opcode": 1,
    "keywords": "0x8000000000000080",
    "time_created": "2026-07-19T03:37:35.721319600+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "00CC000C-0007-0000-7428-34116005E5A0"
    },
    "execution": {
      "process_id": 10356,
      "thread_id": 4404
    },
    "channel": "Microsoft-Windows-WinINet/Analytic",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Handle": "0xCC000C",
    "Operation": "0",
    "ClientType": "5",
    "ThreadInfoUIType": "0",
    "IsSync": "true"
  },
  "message": ""
}

Event ID 1070: Wininet_FileIOStop

Channel: Analytic
Level: Informational
Task: Wininet_FileIO
Opcode: Stop

Fields #

Name	Description
`Handle` Pointer
`Operation` UInt32	Known values `%%2456` Open key file. `%%2457` Delete key file. `%%2458` Read persisted key from file. `%%2459` Write persisted key to file. `%%2464` Export of persistent cryptographic key. `%%2465` Import of persistent cryptographic key. `%%2480` Open Key. `%%2481` Create Key. `%%2482` Delete Key. `%%2483` Encrypt. `%%2484` Decrypt. `%%2485` Sign hash. `%%2486` Secret agreement. `%%2487` Domain settings. `%%2488` Local settings. `%%2489` Add provider. `%%2490` Remove provider. `%%2491` Add context. `%%2492` Remove context. `%%2493` Add function. `%%2494` Remove function. `%%2495` Add function provider. `%%2496` Remove function provider. `%%2497` Add function property. `%%2498` Remove function property. `%%2499` Machine key. `%%2500` User key. `%%2501` Key Derivation. `%%2502` Claim Creation. `%%2503` Claim Verification.
`ClientType` UInt32
`ThreadInfoUIType` UInt32
`IsSync` Boolean

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-WinINet",
    "guid": "{43d1a55c-76d6-4f7e-995c-64c711e5cafe}",
    "event_source_name": "",
    "event_id": 1070,
    "version": 0,
    "level": 4,
    "task": 593,
    "opcode": 2,
    "keywords": "0x8000000000000080",
    "time_created": "2026-07-19T03:37:35.721369700+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "00CC000C-0007-0000-7428-34116005E5A0"
    },
    "execution": {
      "process_id": 10356,
      "thread_id": 4404
    },
    "channel": "Microsoft-Windows-WinINet/Analytic",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Handle": "0xCC000C",
    "Operation": "0",
    "ClientType": "5",
    "ThreadInfoUIType": "0",
    "IsSync": "true"
  },
  "message": ""
}

Event ID 1071: Wininet_FileIOStart1071

Channel: Analytic
Level: Informational
Task: Wininet_FileIO
Opcode: Start

Fields #

Name	Description
`Handle` Pointer
`Operation` UInt32	Known values `%%2456` Open key file. `%%2457` Delete key file. `%%2458` Read persisted key from file. `%%2459` Write persisted key to file. `%%2464` Export of persistent cryptographic key. `%%2465` Import of persistent cryptographic key. `%%2480` Open Key. `%%2481` Create Key. `%%2482` Delete Key. `%%2483` Encrypt. `%%2484` Decrypt. `%%2485` Sign hash. `%%2486` Secret agreement. `%%2487` Domain settings. `%%2488` Local settings. `%%2489` Add provider. `%%2490` Remove provider. `%%2491` Add context. `%%2492` Remove context. `%%2493` Add function. `%%2494` Remove function. `%%2495` Add function provider. `%%2496` Remove function provider. `%%2497` Add function property. `%%2498` Remove function property. `%%2499` Machine key. `%%2500` User key. `%%2501` Key Derivation. `%%2502` Claim Creation. `%%2503` Claim Verification.
`ClientType` UInt32
`ThreadInfoUIType` UInt32
`IsSync` Boolean
`DataLength` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-WinINet",
    "guid": "{43d1a55c-76d6-4f7e-995c-64c711e5cafe}",
    "event_source_name": "",
    "event_id": 1071,
    "version": 0,
    "level": 4,
    "task": 593,
    "opcode": 1,
    "keywords": "0x8000000000000080",
    "time_created": "2026-07-19T03:37:35.798787800+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "00CC000C-0007-0000-7428-34116005E5A0"
    },
    "execution": {
      "process_id": 10356,
      "thread_id": 4404
    },
    "channel": "Microsoft-Windows-WinINet/Analytic",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Handle": "0xCC000C",
    "Operation": "2",
    "ClientType": "5",
    "ThreadInfoUIType": "0",
    "IsSync": "true",
    "DataLength": "9"
  },
  "message": ""
}

Event ID 1072: Wininet_FileIOStop1072

Channel: Analytic
Level: Informational
Task: Wininet_FileIO
Opcode: Stop

Fields #

Name	Description
`Handle` Pointer
`Operation` UInt32	Known values `%%2456` Open key file. `%%2457` Delete key file. `%%2458` Read persisted key from file. `%%2459` Write persisted key to file. `%%2464` Export of persistent cryptographic key. `%%2465` Import of persistent cryptographic key. `%%2480` Open Key. `%%2481` Create Key. `%%2482` Delete Key. `%%2483` Encrypt. `%%2484` Decrypt. `%%2485` Sign hash. `%%2486` Secret agreement. `%%2487` Domain settings. `%%2488` Local settings. `%%2489` Add provider. `%%2490` Remove provider. `%%2491` Add context. `%%2492` Remove context. `%%2493` Add function. `%%2494` Remove function. `%%2495` Add function provider. `%%2496` Remove function provider. `%%2497` Add function property. `%%2498` Remove function property. `%%2499` Machine key. `%%2500` User key. `%%2501` Key Derivation. `%%2502` Claim Creation. `%%2503` Claim Verification.
`ClientType` UInt32
`ThreadInfoUIType` UInt32
`IsSync` Boolean

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-WinINet",
    "guid": "{43d1a55c-76d6-4f7e-995c-64c711e5cafe}",
    "event_source_name": "",
    "event_id": 1072,
    "version": 0,
    "level": 4,
    "task": 593,
    "opcode": 2,
    "keywords": "0x8000000000000080",
    "time_created": "2026-07-19T03:37:35.799366500+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "00CC000C-0007-0000-7428-34116005E5A0"
    },
    "execution": {
      "process_id": 10356,
      "thread_id": 4404
    },
    "channel": "Microsoft-Windows-WinINet/Analytic",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Handle": "0xCC000C",
    "Operation": "2",
    "ClientType": "5",
    "ThreadInfoUIType": "0",
    "IsSync": "true"
  },
  "message": ""
}

Event ID 1073: Wininet_AppCacheHandleStart

Channel: Analytic
Task: Wininet_AppCacheHandle
Opcode: Start

Fields #

Name	Description
`Object` Pointer
`Url` UnicodeString
`LocalFileName` UnicodeString

Event ID 1074: Wininet_AppCacheHandleStop

Channel: Analytic
Task: Wininet_AppCacheHandle
Opcode: Stop

Fields #

Name	Description
`Object` Pointer
`HResult` UInt32

Event ID 1075: Wininet_AppCacheHandleStart1075

Channel: Analytic
Task: Wininet_AppCacheHandle
Opcode: Start

Fields #

Name	Description
`Object` Pointer
`Handle` Pointer
`Url` UnicodeString

Event ID 1076: Wininet_AppCacheHandleStop1076

Channel: Analytic
Task: Wininet_AppCacheHandle
Opcode: Stop

Fields #

Name	Description
`Object` Pointer
`HResult` UInt32

Event ID 1077: Wininet_AppCacheHandleStart1077

Channel: Analytic
Task: Wininet_AppCacheHandle
Opcode: Start

Fields #

Name	Description
`Object` Pointer
`Handle` Pointer
`Url` UnicodeString

Event ID 1078: Wininet_AppCacheHandleStop1078

Channel: Analytic
Task: Wininet_AppCacheHandle
Opcode: Stop

Fields #

Name	Description
`Object` Pointer
`HResult` UInt32

Event ID 1079: Wininet_AppCacheHandleStart1079

Channel: Analytic
Task: Wininet_AppCacheHandle
Opcode: Start

Fields #

Name	Description
`Object` Pointer
`DataSize` UInt32

Event ID 1080: Wininet_AppCacheHandleStop1080

Channel: Analytic
Task: Wininet_AppCacheHandle
Opcode: Stop

Fields #

Name	Description
`Object` Pointer
`HResult` UInt32

Event ID 1081: Wininet_AppCacheHandleStart1081

Channel: Analytic
Task: Wininet_AppCacheHandle
Opcode: Start

Fields #

Name	Description
`Object` Pointer

Event ID 1082: Wininet_AppCacheHandleStop1082

Channel: Analytic
Task: Wininet_AppCacheHandle
Opcode: Stop

Fields #

Name	Description
`Object` Pointer
`HResult` UInt32

Event ID 1083: Wininet_AppCacheHandleStart1083

Channel: Analytic
Task: Wininet_AppCacheHandle
Opcode: Start

Fields #

Name	Description
`Object` Pointer
`Url` UnicodeString

Event ID 1084: Wininet_AppCacheHandleStop1084

Channel: Analytic
Task: Wininet_AppCacheHandle
Opcode: Stop

Fields #

Name	Description
`Object` Pointer
`HResult` UInt32

Event ID 1085: Wininet_AppCacheHandleStart1085

Channel: Analytic
Task: Wininet_AppCacheHandle
Opcode: Start

Fields #

Name	Description
`Object` Pointer

Event ID 1086: Wininet_AppCacheHandleStop1086

Channel: Analytic
Task: Wininet_AppCacheHandle
Opcode: Stop

Fields #

Name	Description
`Object` Pointer
`HResult` UInt32

Event ID 1087: Wininet_AppCacheHandleStart1087

Channel: Analytic
Task: Wininet_AppCacheHandle
Opcode: Start

Fields #

Name	Description
`Object` Pointer

Event ID 1088: Wininet_AppCacheHandleStop1088

Channel: Analytic
Task: Wininet_AppCacheHandle
Opcode: Stop

Fields #

Name	Description
`Object` Pointer
`HResult` UInt32

Event ID 1089: Wininet_AppCacheServerContainerStart

Channel: Analytic
Task: Wininet_AppCacheServerContainer
Opcode: Start

Fields #

Name	Description
`Object` Pointer
`Handle` Pointer
`Directory` UnicodeString
`IsIEAppContainer` Boolean

Event ID 1090: Wininet_AppCacheServerContainerStop

Channel: Analytic
Task: Wininet_AppCacheServerContainer
Opcode: Stop

Fields #

Name	Description
`Object` Pointer
`HResult` UInt32

Event ID 1091: Wininet_AppCacheServerContainerStart1091

Channel: Analytic
Task: Wininet_AppCacheServerContainer
Opcode: Start

Fields #

Name	Description
`Object` Pointer

Event ID 1092: Wininet_AppCacheServerContainerStop1092

Channel: Analytic
Task: Wininet_AppCacheServerContainer
Opcode: Stop

Fields #

Name	Description
`Object` Pointer
`HResult` UInt32

Event ID 1093: Wininet_AppCacheServerContainerStart1093

Channel: Analytic
Task: Wininet_AppCacheServerContainer
Opcode: Start

Fields #

Name	Description
`Object` Pointer

Event ID 1094: Wininet_AppCacheServerContainerStop1094

Channel: Analytic
Task: Wininet_AppCacheServerContainer
Opcode: Stop

Fields #

Name	Description
`Object` Pointer
`HResult` UInt32

Event ID 1095: Wininet_AppCacheServerContainerStart1095

Channel: Analytic
Task: Wininet_AppCacheServerContainer
Opcode: Start

Fields #

Name	Description
`Object` Pointer
`Url` UnicodeString

Event ID 1096: Wininet_AppCacheServerContainerStop1096

Channel: Analytic
Task: Wininet_AppCacheServerContainer
Opcode: Stop

Fields #

Name	Description
`Object` Pointer
`HResult` UInt32

Event ID 1097: Wininet_AppCacheServerContainerStart1097

Channel: Analytic
Task: Wininet_AppCacheServerContainer
Opcode: Start

Fields #

Name	Description
`Object` Pointer
`Url` UnicodeString

Event ID 1098: Wininet_AppCacheServerContainerStop1098

Channel: Analytic
Task: Wininet_AppCacheServerContainer
Opcode: Stop

Fields #

Name	Description
`Object` Pointer
`HResult` UInt32

Event ID 1099: Wininet_AppCacheServerContainerStart1099

Channel: Analytic
Task: Wininet_AppCacheServerContainer
Opcode: Start

Fields #

Name	Description
`Object` Pointer
`Url` UnicodeString
`Flags` UInt32

Event ID 1100: Wininet_AppCacheServerContainerStop1100

Channel: Analytic
Task: Wininet_AppCacheServerContainer
Opcode: Stop

Fields #

Name	Description
`Object` Pointer
`HResult` UInt32

Event ID 1101: Wininet_AppCacheServerContainerStart1101

Channel: Analytic
Task: Wininet_AppCacheServerContainer
Opcode: Start

Fields #

Name	Description
`Object` Pointer
`MasterUrl` UnicodeString
`ManifestURL` UnicodeString
`DataSize` UInt32
`EntryType` UInt32
`HeaderSize` UInt32

Event ID 1102: Wininet_AppCacheServerContainerStop1102

Channel: Analytic
Task: Wininet_AppCacheServerContainer
Opcode: Stop

Fields #

Name	Description
`Object` Pointer
`HResult` UInt32

Event ID 1103: Wininet_AppCacheServerContainerStart1103

Channel: Analytic
Task: Wininet_AppCacheServerContainer
Opcode: Start

Fields #

Name	Description
`Object` Pointer

Event ID 1104: Wininet_AppCacheServerContainerStop1104

Channel: Analytic
Task: Wininet_AppCacheServerContainer
Opcode: Stop

Fields #

Name	Description
`Object` Pointer
`HResult` UInt32

Event ID 1105: Wininet_AppCacheServerContainerStart1105

Channel: Analytic
Task: Wininet_AppCacheServerContainer
Opcode: Start

Fields #

Name	Description
`Object` Pointer

Event ID 1106: Wininet_AppCacheServerContainerStop1106

Channel: Analytic
Task: Wininet_AppCacheServerContainer
Opcode: Stop

Fields #

Name	Description
`Object` Pointer
`HResult` UInt32

Event ID 1107: Wininet_AppCacheServerContainerStart1107

Channel: Analytic
Task: Wininet_AppCacheServerContainer
Opcode: Start

Fields #

Name	Description
`Object` Pointer

Event ID 1108: Wininet_AppCacheServerContainerStop1108

Channel: Analytic
Task: Wininet_AppCacheServerContainer
Opcode: Stop

Fields #

Name	Description
`Object` Pointer
`HResult` UInt32

Event ID 1109: Wininet_AppCacheServerContainerStart1109

Channel: Analytic
Task: Wininet_AppCacheServerContainer
Opcode: Start

Fields #

Name	Description
`Object` Pointer

Event ID 1110: Wininet_AppCacheServerContainerStop1110

Channel: Analytic
Task: Wininet_AppCacheServerContainer
Opcode: Stop

Fields #

Name	Description
`Object` Pointer
`HResult` UInt32

Event ID 1111: Wininet_BlobServerContainerStart

Channel: Analytic
Level: Informational
Task: Wininet_BlobServerContainer
Opcode: Start

Fields #

Name	Description
`Object` Pointer
`Handle` Pointer
`Directory` UnicodeString

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-WinINet/Analytic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 1111,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 2220,
      "thread_id": 5984
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 1,
    "provider": "Microsoft-Windows-WinINet",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 05:25:29.214Z",
    "version": 0
  },
  "event_data": {
    "Directory": "C:\\Users\\domainadmin\\AppData\\Local\\Microsoft\\Windows\\INetCache\\IE",
    "Handle": "0x2342A8D90C0",
    "Object": "0x2342C1ABFF0"
  },
  "message": ""
}

Event ID 1112: Wininet_BlobServerContainerStop

Channel: Analytic
Level: Informational
Task: Wininet_BlobServerContainer
Opcode: Stop

Fields #

Name	Description
`Object` Pointer
`HResult` UInt32

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-WinINet/Analytic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 1112,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 2220,
      "thread_id": 5984
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 2,
    "provider": "Microsoft-Windows-WinINet",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 05:25:29.215Z",
    "version": 0
  },
  "event_data": {
    "HResult": 0,
    "Object": "0x2342C1ABFF0"
  },
  "message": ""
}

Event ID 1113: Wininet_BlobServerContainerStart1113

Channel: Analytic
Task: Wininet_BlobServerContainer
Opcode: Start

Fields #

Name	Description
`Object` Pointer

Event ID 1114: Wininet_BlobServerContainerStop1114

Channel: Analytic
Task: Wininet_BlobServerContainer
Opcode: Stop

Fields #

Name	Description
`Object` Pointer
`HResult` UInt32

Event ID 1115: Wininet_BlobServerContainerStart1115

Channel: Analytic
Task: Wininet_BlobServerContainer
Opcode: Start

Fields #

Name	Description
`Object` Pointer

Event ID 1116: Wininet_BlobServerContainerStop1116

Channel: Analytic
Task: Wininet_BlobServerContainer
Opcode: Stop

Fields #

Name	Description
`Object` Pointer
`HResult` UInt32

Event ID 1117: Wininet_BlobServerContainerStart1117

Channel: Analytic
Level: Informational
Task: Wininet_BlobServerContainer
Opcode: Start

Fields #

Name	Description
`Object` Pointer
`Url` UnicodeString

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-WinINet/Analytic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 1117,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 2220,
      "thread_id": 5984
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 1,
    "provider": "Microsoft-Windows-WinINet",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 05:25:29.215Z",
    "version": 0
  },
  "event_data": {
    "Object": "0x2342C1ABFF0",
    "Url": "odc.officeapps.live.com:443"
  },
  "message": ""
}

Event ID 1118: Wininet_BlobServerContainerStop1118

Channel: Analytic
Level: Informational
Task: Wininet_BlobServerContainer
Opcode: Stop

Fields #

Name	Description
`Object` Pointer
`HResult` UInt32

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-WinINet/Analytic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 1118,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 2220,
      "thread_id": 5984
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 2,
    "provider": "Microsoft-Windows-WinINet",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 05:25:29.217Z",
    "version": 0
  },
  "event_data": {
    "HResult": 0,
    "Object": "0x2342C1ABFF0"
  },
  "message": ""
}

Event ID 1119: Wininet_BlobServerContainerStart1119

Channel: Analytic
Task: Wininet_BlobServerContainer
Opcode: Start

Fields #

Name	Description
`Object` Pointer
`Url` UnicodeString

Event ID 1120: Wininet_BlobServerContainerStop1120

Channel: Analytic
Task: Wininet_BlobServerContainer
Opcode: Stop

Fields #

Name	Description
`Object` Pointer
`HResult` UInt32

Event ID 1121: Wininet_BlobServerContainerStart1121

Channel: Analytic
Task: Wininet_BlobServerContainer
Opcode: Start

Fields #

Name	Description
`Object` Pointer
`Url` UnicodeString

Event ID 1122: Wininet_BlobServerContainerStop1122

Channel: Analytic
Task: Wininet_BlobServerContainer
Opcode: Stop

Fields #

Name	Description
`Object` Pointer
`HResult` UInt32

Event ID 1123: Wininet_BlobServerContainerStart1123

Channel: Analytic
Task: Wininet_BlobServerContainer
Opcode: Start

Fields #

Name	Description
`Object` Pointer

Event ID 1124: Wininet_BlobServerContainerStop1124

Channel: Analytic
Task: Wininet_BlobServerContainer
Opcode: Stop

Fields #

Name	Description
`Object` Pointer
`HResult` UInt32

Event ID 1125: Wininet_CacheClientBloomFilterStart

Channel: Analytic
Task: Wininet_CacheClientBloomFilter
Opcode: Start

Fields #

Name	Description
`Handle` Pointer

Event ID 1126: Wininet_CacheClientBloomFilterStop

Channel: Analytic
Task: Wininet_CacheClientBloomFilter
Opcode: Stop

Fields #

Name	Description
`HResult` UInt32

Event ID 1127: Wininet_CacheClientBloomFilterStart1127

Channel: Analytic
Task: Wininet_CacheClientBloomFilter
Opcode: Start

Event ID 1128: Wininet_CacheClientBloomFilterStop1128

Channel: Analytic
Task: Wininet_CacheClientBloomFilter
Opcode: Stop

Event ID 1129: Wininet_CookieServerContainerStart

Channel: Analytic
Task: Wininet_CookieServerContainer
Opcode: Start

Fields #

Name	Description
`Object` Pointer
`Handle` Pointer
`Directory` UnicodeString

Event ID 1130: Wininet_CookieServerContainerStop

Channel: Analytic
Task: Wininet_CookieServerContainer
Opcode: Stop

Fields #

Name	Description
`Object` Pointer
`HResult` UInt32

Event ID 1131: Wininet_CookieServerContainerStart1131

Channel: Analytic
Task: Wininet_CookieServerContainer
Opcode: Start

Fields #

Name	Description
`Object` Pointer

Event ID 1132: Wininet_CookieServerContainerStop1132

Channel: Analytic
Task: Wininet_CookieServerContainer
Opcode: Stop

Fields #

Name	Description
`Object` Pointer
`HResult` UInt32

Event ID 1133: Wininet_CookieServerContainerStart1133

Channel: Analytic
Task: Wininet_CookieServerContainer
Opcode: Start

Fields #

Name	Description
`Object` Pointer
`MinimizedRDomain` UnicodeString

Event ID 1134: Wininet_CookieServerContainerStop1134

Channel: Analytic
Task: Wininet_CookieServerContainer
Opcode: Stop

Fields #

Name	Description
`Object` Pointer
`HResult` UInt32

Event ID 1135: Wininet_CookieServerContainerStart1135

Channel: Analytic
Task: Wininet_CookieServerContainer
Opcode: Start

Fields #

Name	Description
`Object` Pointer

Event ID 1136: Wininet_CookieServerContainerStop1136

Channel: Analytic
Task: Wininet_CookieServerContainer
Opcode: Stop

Fields #

Name	Description
`Object` Pointer
`HResult` UInt32

Event ID 1137: Wininet_CookieServerContainerStart1137

Channel: Analytic
Task: Wininet_CookieServerContainer
Opcode: Start

Fields #

Name	Description
`Object` Pointer
`Hash` Int64
`OperationCount` UInt32

Event ID 1138: Wininet_CookieServerContainerStop1138

Channel: Analytic
Task: Wininet_CookieServerContainer
Opcode: Stop

Fields #

Name	Description
`Object` Pointer
`HResult` UInt32

Event ID 1139: Wininet_CookieServerContainerStart1139

Channel: Analytic
Task: Wininet_CookieServerContainer
Opcode: Start

Fields #

Name	Description
`Object` Pointer

Event ID 1140: Wininet_CookieServerContainerStop1140

Channel: Analytic
Task: Wininet_CookieServerContainer
Opcode: Stop

Fields #

Name	Description
`Object` Pointer
`HResult` UInt32

Event ID 1141: Wininet_CacheClientCountersStart

Channel: Analytic
Task: Wininet_CacheClientCounters
Opcode: Start

Fields #

Name	Description
`Object` Pointer
`Handle` Pointer

Event ID 1142: Wininet_CacheClientCountersStop

Channel: Analytic
Task: Wininet_CacheClientCounters
Opcode: Stop

Fields #

Name	Description
`Object` Pointer
`HResult` UInt32

Event ID 1143: Wininet_DependencyServerContainerStart

Channel: Analytic
Task: Wininet_DependencyServerContainer
Opcode: Start

Fields #

Name	Description
`Object` Pointer
`Url` UnicodeString
`BlobSize` UInt32

Event ID 1144: Wininet_DependencyServerContainerStop

Channel: Analytic
Task: Wininet_DependencyServerContainer
Opcode: Stop

Fields #

Name	Description
`Object` Pointer
`HResult` UInt32

Event ID 1145: Wininet_DependencyServerContainerStart1145

Channel: Analytic
Task: Wininet_DependencyServerContainer
Opcode: Start

Fields #

Name	Description
`Object` Pointer
`Url` UnicodeString

Event ID 1146: Wininet_DependencyServerContainerStop1146

Channel: Analytic
Task: Wininet_DependencyServerContainer
Opcode: Stop

Fields #

Name	Description
`Object` Pointer
`HResult` UInt32

Event ID 1147: Wininet_DependencyServerContainerStart1147

Channel: Analytic
Task: Wininet_DependencyServerContainer
Opcode: Start

Fields #

Name	Description
`Object` Pointer

Event ID 1148: Wininet_DependencyServerContainerStop1148

Channel: Analytic
Task: Wininet_DependencyServerContainer
Opcode: Stop

Fields #

Name	Description
`Object` Pointer
`HResult` UInt32

Event ID 1149: Wininet_DependencyServerContainerStart1149

Channel: Analytic
Task: Wininet_DependencyServerContainer
Opcode: Start

Fields #

Name	Description
`Object` Pointer
`Handle` Pointer
`IsCreateContainer` Boolean
`Directory` UnicodeString

Event ID 1150: Wininet_DependencyServerContainerStop1150

Channel: Analytic
Task: Wininet_DependencyServerContainer
Opcode: Stop

Fields #

Name	Description
`Object` Pointer
`HResult` UInt32

Event ID 1151: Wininet_DependencyServerContainerStart1151

Channel: Analytic
Task: Wininet_DependencyServerContainer
Opcode: Start

Fields #

Name	Description
`Object` Pointer

Event ID 1152: Wininet_DependencyServerContainerStop1152

Channel: Analytic
Task: Wininet_DependencyServerContainer
Opcode: Stop

Fields #

Name	Description
`Object` Pointer
`HResult` UInt32

Event ID 1153: Wininet_HstsServerContainerStart

Channel: Analytic
Task: Wininet_HstsServerContainer
Opcode: Start

Fields #

Name	Description
`Object` Pointer
`Handle` Pointer
`Directory` UnicodeString

Event ID 1154: Wininet_HstsServerContainerStop

Channel: Analytic
Task: Wininet_HstsServerContainer
Opcode: Stop

Fields #

Name	Description
`Object` Pointer
`HResult` UInt32

Event ID 1155: Wininet_HstsServerContainerStart1155

Channel: Analytic
Task: Wininet_HstsServerContainer
Opcode: Start

Fields #

Name	Description
`Object` Pointer

Event ID 1156: Wininet_HstsServerContainerStop1156

Channel: Analytic
Task: Wininet_HstsServerContainer
Opcode: Stop

Fields #

Name	Description
`Object` Pointer
`HResult` UInt32

Event ID 1157: Wininet_HstsServerContainerStart1157

Channel: Analytic
Task: Wininet_HstsServerContainer
Opcode: Start

Fields #

Name	Description
`Object` Pointer
`MinimizedRDomain` UnicodeString
`Hash` Int64

Event ID 1158: Wininet_HstsServerContainerStop1158

Channel: Analytic
Task: Wininet_HstsServerContainer
Opcode: Stop

Fields #

Name	Description
`Object` Pointer
`HResult` UInt32

Event ID 1159: Wininet_HstsServerContainerStart1159

Channel: Analytic
Task: Wininet_HstsServerContainer
Opcode: Start

Fields #

Name	Description
`Object` Pointer
`Hash` Int64
`HstsEntryCount` UInt32

Event ID 1160: Wininet_HstsServerContainerStop1160

Channel: Analytic
Task: Wininet_HstsServerContainer
Opcode: Stop

Fields #

Name	Description
`Object` Pointer
`HResult` UInt32

Event ID 1161: Wininet_HstsServerContainerStart1161

Channel: Analytic
Task: Wininet_HstsServerContainer
Opcode: Start

Fields #

Name	Description
`Object` Pointer

Event ID 1162: Wininet_HstsServerContainerStop1162

Channel: Analytic
Task: Wininet_HstsServerContainer
Opcode: Stop

Fields #

Name	Description
`Object` Pointer
`HResult` UInt32

Event ID 1163: Wininet_CacheServerConnectionStart

Channel: Analytic
Task: Wininet_CacheServerConnection
Opcode: Start

Fields #

Name	Description
`Object` Pointer

Event ID 1164: Wininet_CacheServerConnectionStop

Channel: Analytic
Task: Wininet_CacheServerConnection
Opcode: Stop

Fields #

Name	Description
`Object` Pointer
`HResult` UInt32

Event ID 1165: Wininet_CacheServerConnectionStart1165

Channel: Analytic
Level: Informational
Task: Wininet_CacheServerConnection
Opcode: Start

Fields #

Name	Description
`Object` Pointer
`Handle` Pointer

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-WinINet/Analytic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 1165,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 2220,
      "thread_id": 5984
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 1,
    "provider": "Microsoft-Windows-WinINet",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 05:25:29.213Z",
    "version": 0
  },
  "event_data": {
    "Handle": "0x2342A8D90C0",
    "Object": "0x2342C134AD0"
  },
  "message": ""
}

Event ID 1166: Wininet_CacheServerConnectionStop1166

Channel: Analytic
Level: Informational
Task: Wininet_CacheServerConnection
Opcode: Stop

Fields #

Name	Description
`Object` Pointer
`HResult` UInt32

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-WinINet/Analytic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 1166,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 2220,
      "thread_id": 5984
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 2,
    "provider": "Microsoft-Windows-WinINet",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 05:25:29.214Z",
    "version": 0
  },
  "event_data": {
    "HResult": 0,
    "Object": "0x2342C134AD0"
  },
  "message": ""
}

Event ID 1167: Wininet_CacheServerEntryEnumStart

Channel: Analytic
Task: Wininet_CacheServerEntryEnum
Opcode: Start

Fields #

Name	Description
`Object` Pointer

Event ID 1168: Wininet_CacheServerEntryEnumStop

Channel: Analytic
Task: Wininet_CacheServerEntryEnum
Opcode: Stop

Fields #

Name	Description
`Object` Pointer
`HResult` UInt32

Event ID 1169: Wininet_CacheServerEntryEnumStart1169

Channel: Analytic
Task: Wininet_CacheServerEntryEnum
Opcode: Start

Fields #

Name	Description
`Object` Pointer
`Handle` Pointer
`Filter` UInt32
`GroupId` Int64

Event ID 1170: Wininet_CacheServerEntryEnumStop1170

Channel: Analytic
Task: Wininet_CacheServerEntryEnum
Opcode: Stop

Fields #

Name	Description
`Object` Pointer
`HResult` UInt32

Event ID 1171: Wininet_CacheServerEntryEnumStart1171

Channel: Analytic
Task: Wininet_CacheServerEntryEnum
Opcode: Start

Fields #

Name	Description
`Object` Pointer

Event ID 1172: Wininet_CacheServerEntryEnumStop1172

Channel: Analytic
Task: Wininet_CacheServerEntryEnum
Opcode: Stop

Fields #

Name	Description
`Object` Pointer
`HResult` UInt32

Event ID 1173: Wininet_CacheServerContainerStart

Channel: Analytic
Task: Wininet_CacheServerContainer
Opcode: Start

Fields #

Name	Description
`Object` Pointer
`EntryMaxAge` UInt32

Event ID 1174: Wininet_CacheServerContainerStop

Channel: Analytic
Task: Wininet_CacheServerContainer
Opcode: Stop

Fields #

Name	Description
`Object` Pointer
`HResult` UInt32

Event ID 1175: Wininet_CacheServerContainerStart1175

Channel: Analytic
Task: Wininet_CacheServerContainer
Opcode: Start

Fields #

Name	Description
`Object` Pointer
`Type` UInt32
`Flags` UInt32
`Url` UnicodeString
`Redirect` UnicodeString
`Filename` UnicodeString
`Extension` UnicodeString

Event ID 1176: Wininet_CacheServerContainerStop1176

Channel: Analytic
Task: Wininet_CacheServerContainer
Opcode: Stop

Fields #

Name	Description
`Object` Pointer
`HResult` UInt32

Event ID 1177: Wininet_CacheServerContainerStart1177

Channel: Analytic
Task: Wininet_CacheServerContainer
Opcode: Start

Fields #

Name	Description
`Object` Pointer
`Url` UnicodeString
`ValidateCreationTime` Boolean

Event ID 1178: Wininet_CacheServerContainerStop1178

Channel: Analytic
Task: Wininet_CacheServerContainer
Opcode: Stop

Fields #

Name	Description
`Object` Pointer
`HResult` UInt32

Event ID 1179: Wininet_CacheServerContainerStart1179

Channel: Analytic
Task: Wininet_CacheServerContainer
Opcode: Start

Fields #

Name	Description
`Object` Pointer
`Url` UnicodeString
`Flags` UInt32

Event ID 1180: Wininet_CacheServerContainerStop1180

Channel: Analytic
Task: Wininet_CacheServerContainer
Opcode: Stop

Fields #

Name	Description
`Object` Pointer
`HResult` UInt32

Event ID 1181: Wininet_CacheServerContainerStart1181

Channel: Analytic
Task: Wininet_CacheServerContainer
Opcode: Start

Fields #

Name	Description
`Object` Pointer

Event ID 1182: Wininet_CacheServerContainerStop1182

Channel: Analytic
Task: Wininet_CacheServerContainer
Opcode: Stop

Fields #

Name	Description
`Object` Pointer
`HResult` UInt32

Event ID 1183: Wininet_CacheServerContainerStart1183

Channel: Analytic
Task: Wininet_CacheServerContainer
Opcode: Start

Fields #

Name	Description
`Object` Pointer
`Url` UnicodeString

Event ID 1184: Wininet_CacheServerContainerStop1184

Channel: Analytic
Task: Wininet_CacheServerContainer
Opcode: Stop

Fields #

Name	Description
`Object` Pointer
`HResult` UInt32

Event ID 1185: Wininet_CacheServerContainerStart1185

Channel: Analytic
Task: Wininet_CacheServerContainer
Opcode: Start

Fields #

Name	Description
`Object` Pointer
`Url` UnicodeString
`Type` UInt32

Event ID 1186: Wininet_CacheServerContainerStop1186

Channel: Analytic
Task: Wininet_CacheServerContainer
Opcode: Stop

Fields #

Name	Description
`Object` Pointer
`HResult` UInt32

Event ID 1187: Wininet_CacheServerContainerStart1187

Channel: Analytic
Task: Wininet_CacheServerContainer
Opcode: Start

Fields #

Name	Description
`Object` Pointer
`Url` UnicodeString

Event ID 1188: Wininet_CacheServerContainerStop1188

Channel: Analytic
Task: Wininet_CacheServerContainer
Opcode: Stop

Fields #

Name	Description
`Object` Pointer
`HResult` UInt32

Event ID 1189: Wininet_CacheServerContainerStart1189

Channel: Analytic
Level: Informational
Task: Wininet_CacheServerContainer
Opcode: Start

Fields #

Name	Description
`Object` Pointer
`Url` UnicodeString
`Fields` UInt32

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-WinINet/Analytic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 1189,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 7468,
      "thread_id": 2396
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 1,
    "provider": "Microsoft-Windows-WinINet",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 05:37:28.805Z",
    "version": 0
  },
  "event_data": {
    "Fields": 16,
    "Object": "0x1912D8E3FA0",
    "Url": "https://mobile.events.data.microsoft.com/OneCollector/1.0/"
  },
  "message": ""
}

Event ID 1190: Wininet_CacheServerContainerStop1190

Channel: Analytic
Level: Informational
Task: Wininet_CacheServerContainer
Opcode: Stop

Fields #

Name	Description
`Object` Pointer
`HResult` UInt32

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-WinINet/Analytic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 1190,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 7468,
      "thread_id": 2396
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 2,
    "provider": "Microsoft-Windows-WinINet",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 05:37:28.805Z",
    "version": 0
  },
  "event_data": {
    "HResult": 2147942402,
    "Object": "0x1912D8E3FA0"
  },
  "message": ""
}

Event ID 1191: Wininet_CacheServerContainerStart1191

Channel: Analytic
Task: Wininet_CacheServerContainer
Opcode: Start

Fields #

Name	Description
`Object` Pointer

Event ID 1192: Wininet_CacheServerContainerStop1192

Channel: Analytic
Task: Wininet_CacheServerContainer
Opcode: Stop

Fields #

Name	Description
`Object` Pointer
`HResult` UInt32

Event ID 1193: Wininet_CacheServerContainerStart1193

Channel: Analytic
Task: Wininet_CacheServerContainer
Opcode: Start

Fields #

Name	Description
`Object` Pointer

Event ID 1194: Wininet_CacheServerContainerStop1194

Channel: Analytic
Task: Wininet_CacheServerContainer
Opcode: Stop

Fields #

Name	Description
`Object` Pointer
`HResult` UInt32

Event ID 1195: Wininet_CacheServerContainerStart1195

Channel: Analytic
Task: Wininet_CacheServerContainer
Opcode: Start

Fields #

Name	Description
`Object` Pointer
`Limit` Int64

Event ID 1196: Wininet_CacheServerContainerStop1196

Channel: Analytic
Task: Wininet_CacheServerContainer
Opcode: Stop

Fields #

Name	Description
`Object` Pointer
`HResult` UInt32

Event ID 1197: Wininet_CacheServerContainerStart1197

Channel: Analytic
Task: Wininet_CacheServerContainer
Opcode: Start

Fields #

Name	Description
`Object` Pointer
`Factor` UInt32
`Filter` UInt32

Event ID 1198: Wininet_CacheServerContainerStop1198

Channel: Analytic
Task: Wininet_CacheServerContainer
Opcode: Stop

Fields #

Name	Description
`Object` Pointer
`HResult` UInt32

Event ID 1199: Wininet_CacheServerContainerStart1199

Channel: Analytic
Task: Wininet_CacheServerContainer
Opcode: Start

Fields #

Name	Description
`Object` Pointer

Event ID 1200: Wininet_CacheServerContainerStop1200

Channel: Analytic
Task: Wininet_CacheServerContainer
Opcode: Stop

Fields #

Name	Description
`Object` Pointer
`HResult` UInt32

Event ID 1201: Wininet_CacheServerContainerStart1201

Channel: Analytic
Task: Wininet_CacheServerContainer
Opcode: Start

Fields #

Name	Description
`Object` Pointer

Event ID 1202: Wininet_CacheServerContainerStop1202

Channel: Analytic
Task: Wininet_CacheServerContainer
Opcode: Stop

Fields #

Name	Description
`Object` Pointer
`HResult` UInt32

Event ID 1203: Wininet_CacheServerContainerStart1203

Channel: Analytic
Task: Wininet_CacheServerContainer
Opcode: Start

Fields #

Name	Description
`Object` Pointer
`Filename` UnicodeString

Event ID 1204: Wininet_CacheServerContainerStop1204

Channel: Analytic
Task: Wininet_CacheServerContainer
Opcode: Stop

Fields #

Name	Description
`Object` Pointer
`HResult` UInt32

Event ID 1205: Wininet_CacheServerContainerStart1205

Channel: Analytic
Task: Wininet_CacheServerContainer
Opcode: Start

Fields #

Name	Description
`Object` Pointer
`Flags` UInt32

Event ID 1206: Wininet_CacheServerContainerStop1206

Channel: Analytic
Task: Wininet_CacheServerContainer
Opcode: Stop

Fields #

Name	Description
`Object` Pointer
`HResult` UInt32

Event ID 1207: Wininet_CacheServerContainerStart1207

Channel: Analytic
Task: Wininet_CacheServerContainer
Opcode: Start

Fields #

Name	Description
`Object` Pointer
`GroupId` Int64
`Flags` UInt32

Event ID 1208: Wininet_CacheServerContainerStop1208

Channel: Analytic
Task: Wininet_CacheServerContainer
Opcode: Stop

Fields #

Name	Description
`Object` Pointer
`HResult` UInt32

Event ID 1209: Wininet_CacheServerContainerStart1209

Channel: Analytic
Task: Wininet_CacheServerContainer
Opcode: Start

Fields #

Name	Description
`Object` Pointer

Event ID 1210: Wininet_CacheServerContainerStop1210

Channel: Analytic
Task: Wininet_CacheServerContainer
Opcode: Stop

Fields #

Name	Description
`Object` Pointer
`HResult` UInt32

Event ID 1211: Wininet_CacheServerContainerStart1211

Channel: Analytic
Task: Wininet_CacheServerContainer
Opcode: Start

Fields #

Name	Description
`Object` Pointer
`GroupId` Int64

Event ID 1212: Wininet_CacheServerContainerStop1212

Channel: Analytic
Task: Wininet_CacheServerContainer
Opcode: Stop

Fields #

Name	Description
`Object` Pointer
`HResult` UInt32

Event ID 1213: Wininet_CacheServerContainerStart1213

Channel: Analytic
Task: Wininet_CacheServerContainer
Opcode: Start

Fields #

Name	Description
`Object` Pointer
`GroupId` Int64
`Flags` UInt32

Event ID 1214: Wininet_CacheServerContainerStop1214

Channel: Analytic
Task: Wininet_CacheServerContainer
Opcode: Stop

Fields #

Name	Description
`Object` Pointer
`HResult` UInt32

Event ID 1215: Wininet_CacheServerContainerStart1215

Channel: Analytic
Task: Wininet_CacheServerContainer
Opcode: Start

Fields #

Name	Description
`Object` Pointer
`Url` UnicodeString
`GroupId` Int64
`Flags` UInt32

Event ID 1216: Wininet_CacheServerContainerStop1216

Channel: Analytic
Task: Wininet_CacheServerContainer
Opcode: Stop

Fields #

Name	Description
`Object` Pointer
`HResult` UInt32

Event ID 1217: Wininet_CacheServerContainerStart1217

Channel: Analytic
Task: Wininet_CacheServerContainer
Opcode: Start

Fields #

Name	Description
`Object` Pointer
`Handle` Pointer
`Name` UnicodeString
`Directory` UnicodeString
`Flags` UInt32
`Limit` Int64
`EntryMaxAge` UInt32

Event ID 1218: Wininet_CacheServerContainerStop1218

Channel: Analytic
Task: Wininet_CacheServerContainer
Opcode: Stop

Fields #

Name	Description
`Object` Pointer
`HResult` UInt32

Event ID 1219: Wininet_CacheServerContainerStart1219

Channel: Analytic
Task: Wininet_CacheServerContainer
Opcode: Start

Fields #

Name	Description
`Object` Pointer

Event ID 1220: Wininet_CacheServerContainerStop1220

Channel: Analytic
Task: Wininet_CacheServerContainer
Opcode: Stop

Fields #

Name	Description
`Object` Pointer
`HResult` UInt32

Event ID 1221: Wininet_UrlCacheContainerStart

Channel: Analytic
Task: Wininet_UrlCacheContainer
Opcode: Start

Fields #

Name	Description
`TargetSize` Int64
`Filter` UInt32

Event ID 1222: Wininet_UrlCacheContainerStop

Channel: Analytic
Task: Wininet_UrlCacheContainer
Opcode: Stop

Fields #

Name	Description
`TargetSize` Int64
`Filter` UInt32

Event ID 1223: Wininet_UrlCacheContainerStart1223

Channel: Analytic
Task: Wininet_UrlCacheContainer
Opcode: Start

Event ID 1224: Wininet_UrlCacheContainerStop1224

Channel: Analytic
Task: Wininet_UrlCacheContainer
Opcode: Stop

Event ID 1225: Wininet_UrlCacheContainerStart1225

Channel: Analytic
Task: Wininet_UrlCacheContainer
Opcode: Start

Event ID 1226: Wininet_UrlCacheContainerStop1226

Channel: Analytic
Task: Wininet_UrlCacheContainer
Opcode: Stop

Event ID 1227: Wininet_UrlCacheContainerStart1227

Channel: Analytic
Task: Wininet_UrlCacheContainer
Opcode: Start

Fields #

Name	Description
`Name` UnicodeString
`Prefix` UnicodeString
`Directory` UnicodeString
`RootPath` UnicodeString
`Limit` Int64
`Options` UInt32

Event ID 1228: Wininet_UrlCacheContainerStop1228

Channel: Analytic
Task: Wininet_UrlCacheContainer
Opcode: Stop

Fields #

Name	Description
`Name` UnicodeString
`Prefix` UnicodeString
`Directory` UnicodeString
`RootPath` UnicodeString
`Limit` Int64
`Options` UInt32

Event ID 1229: Wininet_UrlCacheContainerStart1229

Channel: Analytic
Task: Wininet_UrlCacheContainer
Opcode: Start

Fields #

Name	Description
`Name` UnicodeString
`RootPath` UnicodeString

Event ID 1230: Wininet_UrlCacheContainerStop1230

Channel: Analytic
Task: Wininet_UrlCacheContainer
Opcode: Stop

Fields #

Name	Description
`Name` UnicodeString
`RootPath` UnicodeString

Event ID 1231: Wininet_UrlCacheContainerStart1231

Channel: Analytic
Task: Wininet_UrlCacheContainer
Opcode: Start

Fields #

Name	Description
`RootPath` UnicodeString

Event ID 1232: Wininet_UrlCacheContainerStop1232

Channel: Analytic
Task: Wininet_UrlCacheContainer
Opcode: Stop

Fields #

Name	Description
`RootPath` UnicodeString

Event ID 1233: Wininet_UrlCacheContainerStart1233

Channel: Analytic
Task: Wininet_UrlCacheContainer
Opcode: Start

Fields #

Name	Description
`LimitType` UInt32
`Limit` Int64

Event ID 1234: Wininet_UrlCacheContainerStop1234

Channel: Analytic
Task: Wininet_UrlCacheContainer
Opcode: Stop

Fields #

Name	Description
`LimitType` UInt32
`Limit` Int64

Event ID 1235: Wininet_UrlCacheContainerStart1235

Channel: Analytic
Task: Wininet_UrlCacheContainer
Opcode: Start

Fields #

Name	Description
`LimitType` UInt32

Event ID 1236: Wininet_UrlCacheContainerStop1236

Channel: Analytic
Task: Wininet_UrlCacheContainer
Opcode: Stop

Fields #

Name	Description
`LimitType` UInt32

Event ID 1237: Wininet_UrlCacheContainerStart1237

Channel: Analytic
Task: Wininet_UrlCacheContainer
Opcode: Start

Event ID 1238: Wininet_UrlCacheContainerStop1238

Channel: Analytic
Task: Wininet_UrlCacheContainer
Opcode: Stop

Event ID 1239: Wininet_SyncInternetOpen

Channel: Analytic
Level: Informational
Task: Wininet_SyncInternetOpen

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-WinINet",
    "guid": "{43d1a55c-76d6-4f7e-995c-64c711e5cafe}",
    "event_source_name": "",
    "event_id": 1239,
    "version": 0,
    "level": 4,
    "task": 609,
    "opcode": 0,
    "keywords": "0x8000000000000080",
    "time_created": "2026-07-19T03:37:35.695088700+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "F8378F7E-0001-0000-88A6-BF0374280000"
    },
    "execution": {
      "process_id": 10356,
      "thread_id": 4404
    },
    "channel": "Microsoft-Windows-WinINet/Analytic",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": ""
}

Event ID 1240: Wininet_SyncSendRequestStart

Channel: Analytic
Level: Informational
Task: Wininet_SyncSendRequest
Opcode: Start

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-WinINet",
    "guid": "{43d1a55c-76d6-4f7e-995c-64c711e5cafe}",
    "event_source_name": "",
    "event_id": 1240,
    "version": 0,
    "level": 4,
    "task": 610,
    "opcode": 1,
    "keywords": "0x8000000000000080",
    "time_created": "2026-07-19T03:37:35.721417700+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "00CC000C-0007-0000-7428-34116005E5A0"
    },
    "execution": {
      "process_id": 10356,
      "thread_id": 4404
    },
    "channel": "Microsoft-Windows-WinINet/Analytic",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": ""
}

Event ID 1241: Wininet_SyncSendRequestStop

Channel: Analytic
Level: Informational
Task: Wininet_SyncSendRequest
Opcode: Stop

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-WinINet",
    "guid": "{43d1a55c-76d6-4f7e-995c-64c711e5cafe}",
    "event_source_name": "",
    "event_id": 1241,
    "version": 0,
    "level": 4,
    "task": 610,
    "opcode": 2,
    "keywords": "0x8000000000000080",
    "time_created": "2026-07-19T03:37:35.769348700+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "00CC000C-0007-0000-7428-34116005E5A0"
    },
    "execution": {
      "process_id": 10356,
      "thread_id": 4404
    },
    "channel": "Microsoft-Windows-WinINet/Analytic",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": ""
}

Event ID 1242: Wininet_SyncQueryDataAvailableStart

Channel: Analytic
Task: Wininet_SyncQueryDataAvailable
Opcode: Start

Event ID 1243: Wininet_SyncQueryDataAvailableStop

Channel: Analytic
Task: Wininet_SyncQueryDataAvailable
Opcode: Stop

Event ID 1244: Wininet_SyncReadFileStart

Channel: Analytic
Level: Informational
Task: Wininet_SyncReadFile
Opcode: Start

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-WinINet",
    "guid": "{43d1a55c-76d6-4f7e-995c-64c711e5cafe}",
    "event_source_name": "",
    "event_id": 1244,
    "version": 0,
    "level": 4,
    "task": 612,
    "opcode": 1,
    "keywords": "0x8000000000000080",
    "time_created": "2026-07-19T03:37:35.798734900+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "00CC000C-0007-0000-7428-34116005E5A0"
    },
    "execution": {
      "process_id": 10356,
      "thread_id": 4404
    },
    "channel": "Microsoft-Windows-WinINet/Analytic",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": ""
}

Event ID 1245: Wininet_SyncReadFileStop

Channel: Analytic
Level: Informational
Task: Wininet_SyncReadFile
Opcode: Stop

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-WinINet",
    "guid": "{43d1a55c-76d6-4f7e-995c-64c711e5cafe}",
    "event_source_name": "",
    "event_id": 1245,
    "version": 0,
    "level": 4,
    "task": 612,
    "opcode": 2,
    "keywords": "0x8000000000000080",
    "time_created": "2026-07-19T03:37:35.799384900+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "00CC000C-0007-0000-7428-34116005E5A0"
    },
    "execution": {
      "process_id": 10356,
      "thread_id": 4404
    },
    "channel": "Microsoft-Windows-WinINet/Analytic",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": ""
}

Event ID 1246: Wininet_SyncWriteFileStart

Channel: Analytic
Task: Wininet_SyncWriteFile
Opcode: Start

Event ID 1247: Wininet_SyncWriteFileStop

Channel: Analytic
Task: Wininet_SyncWriteFile
Opcode: Stop

Provenance

ETW provider GUID 43d1a55c-76d6-4f7e-995c-64c711e5cafe

Defined in wininet.dll, which carries the event manifest.

WS2022-20348.4893, schema read from the registered manifest, binary version 11.00.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB
Win11-26200.6584, schema read from the registered manifest, binary version 11.00.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB
JD-WIN11-22H2-1-native-20260719, sample captured from a live trace, binary version 11.00.22621.1, captured 2026-07-19
Native ETL capture of WinINet API activity against a controlled loopback HTTP listener; identifiers were sanitized in catalog examples.