Microsoft-Windows-wmbclass

45 events across 2 channels

Event	Title	Channel	Sample
1	Driver loaded	Trace	N
2	[Instance] Miniport initialize called.	Trace	N
3	[Instance] Miniport Halt called.	Trace	N
4	[Instance] Miniport Initialize exited with status=Status.	Trace	N
5	[Instance] Miniport Halt exited with status=Status.	Trace	N
6	[Instance] Miniport PAUSE called.	Trace	N
7	[Instance] Miniport PAUSE exited with status=Status.	Trace	N
8	[Instance] Miniport RESTART called.	Trace	N
9	[Instance] Miniport RESTART exited with status=Status.	Trace	N
10	[Instance] Miniport RESET called.	Trace	N
11	[Instance] Miniport RESET exited with status=Status.	Trace	N
12	[Instance] Miniport RESET completed async with status=Status.	Trace	N
13	[Instance] Miniport PAUSE completed async with status=Status.	Trace	N
14	[Instance] Miniport RESTART completed async with status=Status.	Trace	N
15	[.	Trace	N
16	[Instance] Miniport REQUEST exited with status=Status, Request=Request.	Trace	N
17	[.	Trace	N
18	[.	Trace	N
19	[Instance] Indicating status StatusCode=Status, Handle=RequestId, …	Trace	N
20	[Instance] Sent NBL queued NBL.	Trace	N
21	[.	Trace	N
100	[Instance] Usb Device descriptor Class=Class, SubClass=SubClass, …	Trace	N
101	[Instance] USB_CONFIG_DESC_BAD.	Trace	N
102	[Instance] Missing functional Desc, ECM=ECMFuncDescpresent, …	Trace	N
103	[Instance] Require Communications and Data insterfaces were not found.	Trace	N
104	[Instance] INTERFACE_DESC Num=bInterfaceNumber, Class=bInterfaceClass, …	Trace	N
105	[Instance] Interrupt pipe read completed with BytesRead bytes.	Trace	N
106	[Instance] received CDC_NOTIFICATION bmRequestType=bmRequestType, …	Trace	N
107	[.	Trace	N
108	[Instance] Send encapsulted command MessageType=MessageType, …	Trace	N
109	[Instance] Get encapsulated response MessageType=MessageType, …	Trace	N
110	[Instance] Control transfer failed Status=Status, ToHostToHost, Request=Request, …	Trace	N
111	[Instance] Inteerupt Pipe read failed Status=Status.	Trace	N
112	[Instance] Bulk Out transfer failed Status=Status.	Trace	N
113	[Instance] Bulk In transfer failed Status=Status.	Trace	N
114	[Instance] Host detected MBIM error ErrorCode for command CommandName.	Trace	N
115	[Instance] Device detected MBIM error ErrorCode for command CommandName.	Trace	N
116	[Instance] Device returned an invalid NTB of size ErrorCode.	Trace	N
117	Sending command with the following parameters.	Analytic	N
118	Sending command completed with status NdisStatus.	Analytic	N
119	ResponseType response received with the following parameters.	Analytic	N
120	Dumping adapter state -.	Analytic	N
121	Dumping adapter port state -.	Analytic	N
122	[Instance] Device [DeviceId] Wait/Wake IRP is completed.	Trace	N
123	Device [DeviceId] initial radio state is HwRadioState HwRadioState, SwRadioState …	Trace	N

Event ID 1: Driver loaded

Provider: Microsoft-Windows-wmbclass
Channel: Trace
Opcode: Info

Description

Driver loaded.

Message #

Driver loaded

Fields #

Name	Description
`DeviceObject` UnicodeString

Event ID 2: [Instance] Miniport initialize called.

Provider: Microsoft-Windows-wmbclass
Channel: Trace
Opcode: Info

Description

[Instance] Miniport initialize called.

Message #

[%1] Miniport initialize called

Fields #

Name	Description
`Instance` UInt32

Event ID 3: [Instance] Miniport Halt called.

Provider: Microsoft-Windows-wmbclass
Channel: Trace
Opcode: Info

Description

[Instance] Miniport Halt called.

Message #

[%1] Miniport Halt called

Fields #

Name	Description
`Instance` UInt32

Event ID 4: [Instance] Miniport Initialize exited with status=Status.

Provider: Microsoft-Windows-wmbclass
Channel: Trace
Opcode: Info

Description

[Instance] Miniport Initialize exited with status=Status.

Message #

[%1] Miniport Initialize exited with status=%2

Fields #

Name	Description
`Instance` UInt32
`Status` UInt32	NTSTATUS reference

Event ID 5: [Instance] Miniport Halt exited with status=Status.

Provider: Microsoft-Windows-wmbclass
Channel: Trace
Opcode: Info

Description

[Instance] Miniport Halt exited with status=Status.

Message #

[%1] Miniport Halt exited with status=%2

Fields #

Name	Description
`Instance` UInt32
`Status` UInt32	NTSTATUS reference

Event ID 6: [Instance] Miniport PAUSE called.

Provider: Microsoft-Windows-wmbclass
Channel: Trace
Opcode: Info

Description

[Instance] Miniport PAUSE called.

Message #

[%1] Miniport PAUSE called

Fields #

Name	Description
`Instance` UInt32

Event ID 7: [Instance] Miniport PAUSE exited with status=Status.

Provider: Microsoft-Windows-wmbclass
Channel: Trace
Opcode: Info

Description

[Instance] Miniport PAUSE exited with status=Status.

Message #

[%1] Miniport PAUSE exited with status=%2

Fields #

Name	Description
`Instance` UInt32
`Status` UInt32	NTSTATUS reference

Event ID 8: [Instance] Miniport RESTART called.

Provider: Microsoft-Windows-wmbclass
Channel: Trace
Opcode: Info

Description

[Instance] Miniport RESTART called.

Message #

[%1] Miniport RESTART called

Fields #

Name	Description
`Instance` UInt32

Event ID 9: [Instance] Miniport RESTART exited with status=Status.

Provider: Microsoft-Windows-wmbclass
Channel: Trace
Opcode: Info

Description

[Instance] Miniport RESTART exited with status=Status.

Message #

[%1] Miniport RESTART exited with status=%2

Fields #

Name	Description
`Instance` UInt32
`Status` UInt32	NTSTATUS reference

Event ID 10: [Instance] Miniport RESET called.

Provider: Microsoft-Windows-wmbclass
Channel: Trace
Opcode: Info

Description

[Instance] Miniport RESET called.

Message #

[%1] Miniport RESET called

Fields #

Name	Description
`Instance` UInt32

Event ID 11: [Instance] Miniport RESET exited with status=Status.

Provider: Microsoft-Windows-wmbclass
Channel: Trace
Opcode: Info

Description

[Instance] Miniport RESET exited with status=Status.

Message #

[%1] Miniport RESET exited with status=%2

Fields #

Name	Description
`Instance` UInt32
`Status` UInt32	NTSTATUS reference

Event ID 12: [Instance] Miniport RESET completed async with status=Status.

Provider: Microsoft-Windows-wmbclass
Channel: Trace
Opcode: Info

Description

[Instance] Miniport RESET completed async with status=Status.

Message #

[%1] Miniport RESET completed async with status=%2

Fields #

Name	Description
`Instance` UInt32
`Status` UInt32	NTSTATUS reference

Event ID 13: [Instance] Miniport PAUSE completed async with status=Status.

Provider: Microsoft-Windows-wmbclass
Channel: Trace
Opcode: Info

Description

[Instance] Miniport PAUSE completed async with status=Status.

Message #

[%1] Miniport PAUSE completed async with status=%2

Fields #

Name	Description
`Instance` UInt32
`Status` UInt32	NTSTATUS reference

Event ID 14: [Instance] Miniport RESTART completed async with status=Status.

Provider: Microsoft-Windows-wmbclass
Channel: Trace
Opcode: Info

Description

[Instance] Miniport RESTART completed async with status=Status.

Message #

[%1] Miniport RESTART completed async with status=%2

Fields #

Name	Description
`Instance` UInt32
`Status` UInt32	NTSTATUS reference

Event ID 15: [.

Provider: Microsoft-Windows-wmbclass
Channel: Trace
Opcode: Info

Description

[Instance] Miniport Request called Request=Request, OID=OID, OID name=OIDname RequestId=RequestId, RequestHandle=RequestHandle, Type=Type, InformationLength=InformationLength.

Message #

[%1] Miniport Request called Request=%2, OID=%3, OID name=%4 RequestId=%5, RequestHandle=%6, Type=%7, InformationLength=%8

Fields #

Name	Description
`Instance` UInt32
`Request` Pointer
`OID` UInt32
`OIDname` AnsiString
`RequestId` Pointer
`RequestHandle` Pointer
`Type` UInt32
`InformationLength` UInt32

Event ID 16: [Instance] Miniport REQUEST exited with status=Status, Request=Request.

Provider: Microsoft-Windows-wmbclass
Channel: Trace
Opcode: Info

Description

[Instance] Miniport REQUEST exited with status=Status, Request=Request.

Message #

[%1] Miniport REQUEST exited with status=%3, Request=%2

Fields #

Name	Description
`Instance` UInt32
`Request` Pointer
`Status` UInt32	NTSTATUS reference

Event ID 17: [.

Provider: Microsoft-Windows-wmbclass
Channel: Trace
Opcode: Info

Description

[Instance] Miniport REQUEST exited with status=Status, Request=Request, OID=OID, OID name=OIDname RequestId=RequestId, RequestHandle=RequestHandle, Type=Type, BytesUsed=BytesUsed, BYtesNeeded=BytesNeeded.

Message #

[%1] Miniport REQUEST exited with status=%10, Request=%2, OID=%3, OID name=%4 RequestId=%5, RequestHandle=%6, Type=%7, BytesUsed=%8, BYtesNeeded=%9

Fields #

Name	Description
`Instance` UInt32
`Request` Pointer
`OID` UInt32
`OIDname` AnsiString
`RequestId` Pointer
`RequestHandle` Pointer
`Type` UInt32
`BytesUsed` UInt32
`BytesNeeded` UInt32
`Status` UInt32	NTSTATUS reference

Event ID 18: [.

Provider: Microsoft-Windows-wmbclass
Channel: Trace
Opcode: Info

Description

[Instance] Miniport REQUEST completed async with status=Status, Request=Request, OID=OID, OID name=OIDname RequestId=RequestId, RequestHandle=RequestHandle, Type=Type, BytesUsed=BytesUsed, BYtesNeeded=BytesNeeded.

Message #

[%1] Miniport REQUEST completed async with status=%10, Request=%2, OID=%3, OID name=%4 RequestId=%5, RequestHandle=%6, Type=%7, BytesUsed=%8, BYtesNeeded=%9

Fields #

Name	Description
`Instance` UInt32
`Request` Pointer
`OID` UInt32
`OIDname` AnsiString
`RequestId` Pointer
`RequestHandle` Pointer
`Type` UInt32
`BytesUsed` UInt32
`BytesNeeded` UInt32
`Status` UInt32	NTSTATUS reference

Event ID 19: [Instance] Indicating status StatusCode=Status, Handle=RequestId, RequestId=RequestHandle, BufferSize=BufferSize.

Provider: Microsoft-Windows-wmbclass
Channel: Trace
Opcode: Info

Description

[Instance] Indicating status StatusCode=Status, Handle=RequestId, RequestId=RequestHandle, BufferSize=BufferSize.

Message #

[%1] Indicating status StatusCode=%2, Handle=%3, RequestId=%4, BufferSize=%5

Fields #

Name	Description
`Instance` UInt32
`Status` UInt32	NTSTATUS reference
`RequestId` Pointer
`RequestHandle` Pointer
`BufferSize` UInt32

Event ID 20: [Instance] Sent NBL queued NBL.

Provider: Microsoft-Windows-wmbclass
Channel: Trace
Opcode: Info

Description

[Instance] Sent NBL queued NBL.

Message #

[%1] Sent NBL queued %2

Fields #

Name	Description
`Instance` UInt32
`NBL` Pointer

Event ID 21: [.

Provider: Microsoft-Windows-wmbclass
Channel: Trace
Opcode: Info

Description

[Instance] Send NBL completed NBL=NBL, Status=Status.

Message #

[%1] Send NBL completed NBL=%2, Status=%3

Fields #

Name	Description
`Instance` UInt32
`NBL` Pointer
`Status` UInt32	NTSTATUS reference

Event ID 100: [Instance] Usb Device descriptor Class=Class, SubClass=SubClass, Protocol=Protocol, Configs=Configs.

Provider: Microsoft-Windows-wmbclass
Channel: Trace
Opcode: Info

Description

[Instance] Usb Device descriptor Class=Class, SubClass=SubClass, Protocol=Protocol, Configs=Configs.

Message #

[%1] Usb Device descriptor Class=%2, SubClass=%3, Protocol=%4, Configs=%5

Fields #

Name	Description
`Instance` UInt32
`Class` UInt8
`SubClass` UInt8
`Protocol` UInt8	Known values `0` HOPOPT `1` ICMP `2` IGMP `6` TCP `17` UDP `41` IPv6 `43` IPv6-Route `44` IPv6-Frag `47` GRE `50` ESP `51` AH `58` ICMPv6 `89` OSPF `103` PIM `132` SCTP
`Configs` UInt8

Event ID 101: [Instance] USB_CONFIG_DESC_BAD.

Provider: Microsoft-Windows-wmbclass
Channel: Trace
Opcode: Info

Description

[Instance] USB_CONFIG_DESC_BAD.

Message #

[%1] USB_CONFIG_DESC_BAD

Fields #

Name	Description
`Instance` UInt32

Event ID 102: [Instance] Missing functional Desc, ECM=ECMFuncDescpresent, NCM=NCMFuncDescpresent, MBIM=MBIMFuncDescpresent.

Provider: Microsoft-Windows-wmbclass
Channel: Trace
Opcode: Info

Description

[Instance] Missing functional Desc, ECM=ECMFuncDescpresent, NCM=NCMFuncDescpresent, MBIM=MBIMFuncDescpresent.

Message #

[%1] Missing functional Desc, ECM=%2, NCM=%3, MBIM=%4

Fields #

Name	Description
`Instance` UInt32
`ECMFuncDescpresent` UInt8
`NCMFuncDescpresent` UInt8
`MBIMFuncDescpresent` UInt8

Event ID 103: [Instance] Require Communications and Data insterfaces were not found.

Provider: Microsoft-Windows-wmbclass
Channel: Trace
Opcode: Info

Description

[Instance] Require Communications and Data insterfaces were not found.

Message #

[%1] Require Communications and Data insterfaces were not found

Fields #

Name	Description
`Instance` UInt32

Event ID 104: [Instance] INTERFACE_DESC Num=bInterfaceNumber, Class=bInterfaceClass, SubClass=bInterfaceSubClass, Protocol=bInterfaceProtocol, AltSetting=bAlternateSetting, EndPoints=bNumEndPoints.

Provider: Microsoft-Windows-wmbclass
Channel: Trace
Opcode: Info

Description

[Instance] INTERFACE_DESC Num=bInterfaceNumber, Class=bInterfaceClass, SubClass=bInterfaceSubClass, Protocol=bInterfaceProtocol, AltSetting=bAlternateSetting, EndPoints=bNumEndPoints.

Message #

[%1] INTERFACE_DESC  Num=%2, Class=%3, SubClass=%4, Protocol=%5, AltSetting=%6, EndPoints=%7

Fields #

Name	Description
`Instance` UInt32
`bInterfaceNumber` UInt8
`bInterfaceClass` UInt8
`bInterfaceSubClass` UInt8
`bInterfaceProtocol` UInt8
`bAlternateSetting` UInt8
`bNumEndPoints` UInt8

Event ID 105: [Instance] Interrupt pipe read completed with BytesRead bytes.

Provider: Microsoft-Windows-wmbclass
Channel: Trace
Opcode: Info

Description

[Instance] Interrupt pipe read completed with BytesRead bytes.

Message #

[%1] Interrupt pipe read completed with %2 bytes

Fields #

Name	Description
`Instance` UInt32
`BytesRead` UInt32

Event ID 106: [Instance] received CDC_NOTIFICATION bmRequestType=bmRequestType, bNotificationCode=bNotificationCode wValue=wValue, wIndex=wIndex, wLength=wLength.

Provider: Microsoft-Windows-wmbclass
Channel: Trace
Opcode: Info

Description

[Instance] received CDC_NOTIFICATION bmRequestType=bmRequestType, bNotificationCode=bNotificationCode wValue=wValue, wIndex=wIndex, wLength=wLength.

Message #

[%1] received CDC_NOTIFICATION bmRequestType=%2, bNotificationCode=%3 wValue=%4, wIndex=%5, wLength=%6

Fields #

Name	Description
`Instance` UInt32
`bmRequestType` UInt8
`bNotificationCode` UInt8
`wValue` UInt16
`wIndex` UInt16
`wLength` UInt16

Event ID 107: [.

Provider: Microsoft-Windows-wmbclass
Channel: Trace
Opcode: Info

Description

[Instance] Error from Intterupt pipe Status=Status, USBD Status=UsdbStatus.

Message #

[%1] Error from Intterupt pipe Status=%2, USBD Status=%3

Fields #

Name	Description
`Instance` UInt32
`Status` UInt32	NTSTATUS reference
`UsdbStatus` UInt32

Event ID 108: [Instance] Send encapsulted command MessageType=MessageType, MessageLength=MessageLength, TransactionId=MessageTransactionId, TotalFrags=TotalFragments, CurrentFrag=CurrentFragment, ServiceId=Servi...

Provider: Microsoft-Windows-wmbclass
Channel: Trace
Opcode: Info

Description

[Instance] Send encapsulted command MessageType=MessageType, MessageLength=MessageLength, TransactionId=MessageTransactionId, TotalFrags=TotalFragments, CurrentFrag=CurrentFragment, ServiceId=ServiceId, CID=CID, CommandType=CommandType, InfoLength=InfoLength.

Message #

[%1] Send encapsulted command MessageType=%2, MessageLength=%3, TransactionId=%4, TotalFrags=%5, CurrentFrag=%6, ServiceId=%7, CID=%8, CommandType=%9, InfoLength=%10

Fields #

Name	Description
`Instance` UInt32
`MessageType` UInt32
`MessageLength` UInt32
`MessageTransactionId` UInt32
`TotalFragments` UInt32
`CurrentFragment` UInt32
`ServiceId` GUID
`CID` UInt32
`CommandType` UInt32
`InfoLength` UInt32

Event ID 109: [Instance] Get encapsulated response MessageType=MessageType, MessageLength=MessageLength, TransactionId=MessageTransactionId, TotalFrags=TotalFragments, CurrentFrag=CurrentFragment, ServiceId=Serv...

Provider: Microsoft-Windows-wmbclass
Channel: Trace
Opcode: Info

Description

[Instance] Get encapsulated response MessageType=MessageType, MessageLength=MessageLength, TransactionId=MessageTransactionId, TotalFrags=TotalFragments, CurrentFrag=CurrentFragment, ServiceId=ServiceId, CID=CID, Status=Status, InfoLength=InfoLength.

Message #

[%1] Get encapsulated response MessageType=%2, MessageLength=%3, TransactionId=%4, TotalFrags=%5, CurrentFrag=%6, ServiceId=%7, CID=%8, Status=%9, InfoLength=%10

Fields #

Name	Description
`Instance` UInt32
`MessageType` UInt32
`MessageLength` UInt32
`MessageTransactionId` UInt32
`TotalFragments` UInt32
`CurrentFragment` UInt32
`ServiceId` GUID
`CID` UInt32
`Status` UInt32	NTSTATUS reference
`InfoLength` UInt32

Event ID 110: [Instance] Control transfer failed Status=Status, ToHostToHost, Request=Request, Size=Length.

Provider: Microsoft-Windows-wmbclass
Channel: Trace
Opcode: Info

Description

[Instance] Control transfer failed Status=Status, ToHostToHost, Request=Request, Size=Length.

Message #

[%1] Control transfer failed Status=%2, ToHost%3, Request=%4, Size=%5

Fields #

Name	Description
`Instance` UInt32
`Status` UInt32	NTSTATUS reference
`ToHost` Boolean
`Request` UInt8
`Length` UInt32

Event ID 111: [Instance] Inteerupt Pipe read failed Status=Status.

Provider: Microsoft-Windows-wmbclass
Channel: Trace
Opcode: Info

Description

[Instance] Inteerupt Pipe read failed Status=Status.

Message #

[%1] Inteerupt Pipe read failed Status=%2

Fields #

Name	Description
`Instance` UInt32
`Status` UInt32	NTSTATUS reference

Event ID 112: [Instance] Bulk Out transfer failed Status=Status.

Provider: Microsoft-Windows-wmbclass
Channel: Trace
Opcode: Info

Description

[Instance] Bulk Out transfer failed Status=Status.

Message #

[%1] Bulk Out transfer failed Status=%2,

Fields #

Name	Description
`Instance` UInt32
`Status` UInt32	NTSTATUS reference

Event ID 113: [Instance] Bulk In transfer failed Status=Status.

Provider: Microsoft-Windows-wmbclass
Channel: Trace
Opcode: Info

Description

[Instance] Bulk In transfer failed Status=Status.

Message #

[%1] Bulk In transfer failed Status=%2,

Fields #

Name	Description
`Instance` UInt32
`Status` UInt32	NTSTATUS reference

Event ID 114: [Instance] Host detected MBIM error ErrorCode for command CommandName.

Provider: Microsoft-Windows-wmbclass
Channel: Trace
Opcode: Info

Description

[Instance] Host detected MBIM error ErrorCode for command CommandName.

Message #

[%1] Host detected MBIM error %2 for command %6.

Fields #

Name	Description
`Instance` UInt32
`ErrorCode` UInt32
`TransactionId` UInt32
`ServiceId` GUID
`CommandId` UInt32
`CommandName` AnsiString

Event ID 115: [Instance] Device detected MBIM error ErrorCode for command CommandName.

Provider: Microsoft-Windows-wmbclass
Channel: Trace
Opcode: Info

Description

[Instance] Device detected MBIM error ErrorCode for command CommandName.

Message #

[%1] Device detected MBIM error %2 for command %6.

Fields #

Name	Description
`Instance` UInt32
`ErrorCode` UInt32
`TransactionId` UInt32
`ServiceId` GUID
`CommandId` UInt32
`CommandName` AnsiString

Event ID 116: [Instance] Device returned an invalid NTB of size ErrorCode.

Provider: Microsoft-Windows-wmbclass
Channel: Trace
Opcode: Info

Description

[Instance] Device returned an invalid NTB of size ErrorCode.

Message #

[%1] Device returned an invalid NTB of size %2.

Fields #

Name	Description
`Instance` UInt32
`ErrorCode` UInt32

Event ID 117: Sending command with the following parameters.

Provider: Microsoft-Windows-wmbclass
Channel: Analytic
Opcode: Info

Description

Sending command with the following parameters.

Message #

Sending command with the following parameters:
Caller Request Id: %1
Driver Request Id: %2
Service Id: %3
Command Name: %4
Command Id: %5
Payload Length: %6
Payload: %7

Fields #

Name	Description
`CallerRequestId` UInt32
`DriverRequestId` UInt32
`ServiceId` GUID
`CommandName` AnsiString
`CommandId` UInt32
`InBufferSize` UInt32
`Payload` Binary

Event ID 118: Sending command completed with status NdisStatus.

Provider: Microsoft-Windows-wmbclass
Channel: Analytic
Opcode: Info

Description

Sending command completed with status NdisStatus. Command was sent with the following parameters.

Message #

Sending command completed with status %8. Command was sent with the following parameters:
Caller Request Id: %1
Driver Request Id: %2
Service Id: %3
Command Name: %4
Command Id: %5
Payload Length: %6
Payload: %7

Fields #

Name	Description
`CallerRequestId` UInt32
`DriverRequestId` UInt32
`ServiceId` GUID
`CommandName` AnsiString
`CommandId` UInt32
`InBufferSize` UInt32
`Payload` Binary
`NdisStatus` UInt32

Event ID 119: ResponseType response received with the following parameters.

Provider: Microsoft-Windows-wmbclass
Channel: Analytic
Opcode: Info

Description

ResponseType response received with the following parameters.

Message #

%1 response received with the following parameters:
Caller Request Id: %2
Driver Request Id: %3
Service Id: %4
Command Name: %5
Command Id: %6
Device Status: %7
Ndis Status: %8
Payload Length: %9
Payload: %10

Fields #

Name	Description
`ResponseType` AnsiString
`CallerRequestId` UInt32
`DriverRequestId` UInt32
`ServiceId` GUID
`CommandName` AnsiString
`CommandId` UInt32
`DeviceStatus` UInt32
`NdisStatus` UInt32
`BufferSize` UInt32
`Payload` Binary

Event ID 120: Dumping adapter state -.

Provider: Microsoft-Windows-wmbclass
Channel: Analytic
Opcode: Info

Description

Dumping adapter state -.

Message #

Dumping adapter state - 
Friendly Name: %1
Interface Index: %2
Mac Address: %3
Interface Guid: %4
Radio Off: %5
Maximum Link Speed: %6
Current Link Speed: %7
Uplink Speed: %8
Downlink Speed: %9
Available Data Class: %10
Available Data Class Valid: %11
Supported Cellular Class: %12
Current Cellular Class: %13
Transmitted NBLs: %14
Discarded Transmit NBLs: %15
Received NBLs: %16
Discarded Received NBLs: %17
Maximum Sessions: %18
Active Port Count: %19
Reference Count: %20
Pending request count: %21

Fields #

Name	Description
`FriendlyName` AnsiString
`IfIndex` UInt32
`MacAddress` Binary
`NetCfgId` GUID
`RadioOff` Boolean
`MaxLinkSpeed` UInt64
`CurrentLinkSpeed` UInt64
`UplinkSpeed` UInt64
`DownlinkSpeed` UInt64
`AvailableDataClass` UInt32
`AvailableDataClassValid` Boolean
`AdapterSupportedCellularClass` UInt32
`AdapterCurrentCellularClass` UInt32
`GenXmitFramesOk` UInt64
`GenXmitFramesDiscard` UInt64
`GenReceiveFramesOk` UInt64
`GenReceiveFramesDiscard` UInt64
`MaxActivatedContexts` UInt32
`ActivePortCount` UInt32
`RefCount` UInt32
`PendingRequestCount` UInt32

Event ID 121: Dumping adapter port state -.

Provider: Microsoft-Windows-wmbclass
Channel: Analytic
Opcode: Info

Description

Dumping adapter port state -.

Message #

Dumping adapter port state - 
Port Number: %1
Connected: %2
Connection Id: %3
Session Id: %4
Reference Count: %5

Fields #

Name	Description
`PortNumber` UInt32
`Connected` Boolean
`ConnectionId` UInt32
`SessionId` Int32
`RefCount` UInt32

Event ID 122: [Instance] Device [DeviceId] Wait/Wake IRP is completed.

Provider: Microsoft-Windows-wmbclass
Channel: Trace
Opcode: Info

Description

[Instance] Device [DeviceId] Wait/Wake IRP is completed.

Message #

[%1] Device [%2] Wait/Wake IRP is completed.

Fields #

Name	Description
`Instance` UInt32
`DeviceId` GUID

Event ID 123: Device [DeviceId] initial radio state is HwRadioState HwRadioState, SwRadioState SwRadioState.

Provider: Microsoft-Windows-wmbclass
Channel: Trace
Opcode: Info

Description

Device [DeviceId] initial radio state is HwRadioState HwRadioState, SwRadioState SwRadioState.

Message #

Device [%1] initial radio state is HwRadioState %2, SwRadioState %3

Fields #

Name	Description
`DeviceId` GUID
`HwRadioState` Boolean
`SwRadioState` Boolean

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID 12d25187-6c0d-4783-ad3a-84caa135acfd

Defined in mbbcx.sys, the binary that emits these events.

Observed on:

Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.6584, captured 2026-06-02

Downloads

Microsoft-Windows-wmbclass registered manifest XML (in the Win11-26200.6584 manifest pack, 2.0 MB) manifest-xml

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)