detection.wiki

Microsoft-WindowsPhone-CoreMessaging

EventTitleChannelSampleRule
1000CoreUI ETW - Initialized (pid=hex).UnknownYN
1001CoreUI ETW - Uninitialized (pid=hex).UnknownNN
1050CoreUI System - Out of Memory!UnknownNN
2900CoreUI Service server-thread startedUnknownNN
2901CoreUI Service server-thread exitingUnknownNN
2902CoreUI InitializeService calledUnknownNN
2903CoreUI UninitializeService calledUnknownNN
2904CoreUI ServiceObjectCreated called (serviceType={coreUIServiceType}).UnknownNN
2905CoreUI ServiceObjectDestroyed calledUnknownNN
2906CoreUI UpdateServiceStatus calledUnknownNN
2907CoreUI ServiceObjectServiceMain calledUnknownNN
2908CoreUI CoreUI ServiceMain called with unknown service name pwsz.UnknownNN
3100Session - CoreUICreate - StartUnknownYN
3101Session - CoreUICreate - StopUnknownYN
3102Session_CoreUICreate_InitializeCnContextStartUnknownYN
3103Session_CoreUICreate_InitializeCnContextStopUnknownYN
3106Session_CoreUICreate_ExportSessionStartUnknownYN
3107Session_CoreUICreate_ExportSessionStopUnknownYN
3110Session_ConstructThreadContextStartUnknownYN
3111Session_ConstructThreadContextStopUnknownYN
3210Dispatcher_DispatchLoopUnknownYN
3211Dispatcher_DispatchLoopUnknownYN
3214Dispatcher - DispatchItem - Start (internalPriority=InternalPriority).UnknownYN
3215Dispatcher - DispatchItem - Stop (internalPriority=InternalPriority).UnknownYN
3216Dispatcher - WakeLevel - UpdateWakeLevel (bits=unParam old=InternalPriority …UnknownYN
3220Dispatcher - DoWait - Start (timeout=hex).UnknownYN
3221Dispatcher - DoWait - Stop (status=unParam handle=unParam2).UnknownYN
3222Dispatcher - CallDispatchCallback - Start (awake=fBool reference=unParam).UnknownNN
3223Dispatcher - CallDispatchCallback - Stop (timeout=unParam).UnknownNN
3224UserAdapter - ScheduleDispatch (threadid=unParam userPriority=UserPriority).UnknownYN
3225UserAdapter - HostModeRun - Start (runMode=RunMode stopping=fBool).UnknownNN
3226UserAdapter - HostModeRun - StopUnknownNN
3227UserAdapter - OnUserDispatch - Start (priority=UserPriority).UnknownYN
3228UserAdapter - OnUserDispatch - Stop.UnknownYN
3229UserAdapter - IntegratedLoopWait - StartUnknownYN
3230UserAdapter - IntegratedLoopWait - StopUnknownYN
3231UserAdapter - PostMessage - Failed due to post message queue fullUnknownNN
3232UserAdapter - PostMessage - User failed to schedule an asynchronous …UnknownNN
3300RegistrarClient - Initialize - StartUnknownYN
3301RegistrarClient - Initialize - StopUnknownYN
3310RegistrarClient_ConnectToRegistrarServerStartUnknownYN
3311RegistrarClient_ConnectToRegistrarServerStopUnknownYN
3400RemoteRegistrarClient_ConnectStartUnknownYN
3401RemoteRegistrarClient_ConnectStopUnknownYN
3402RemoteRegistrarClient_RegisterThreadStartUnknownYN
3403RemoteRegistrarClient_RegisterThreadStopUnknownYN
3404RemoteRegistrarClient_RegisterPortStartUnknownYN
3405RemoteRegistrarClient_RegisterPortStopUnknownYN
3406RemoteRegistrarClient_UnregisterPortStartUnknownNN
3407RemoteRegistrarClient_UnregisterPortStopUnknownNN
3408RemoteRegistrarClient_PrepareConnectionStartUnknownYN
3409RemoteRegistrarClient_PrepareConnectionStopUnknownYN
3410RemoteRegistrarClient_CloseConnectionStartUnknownYN
3411RemoteRegistrarClient_CloseConnectionStopUnknownYN
3412RemoteRegistrarClient_CompleteCrossProcConnectionStartUnknownYN
3413RemoteRegistrarClient_CompleteCrossProcConnectionStopUnknownYN
3414RemoteRegistrarClient_CrossProcClientDisconnectedStartUnknownYN
3415RemoteRegistrarClient_CrossProcClientDisconnectedStopUnknownYN
3416RemoteRegistrarClient_FreeServerGroupIDForClientStartUnknownNN
3417RemoteRegistrarClient_FreeServerGroupIDForClientStopUnknownNN
3418RemoteRegistrarClient_RegisterObjectStartUnknownNN
3419RemoteRegistrarClient_RegisterObjectStopUnknownNN
3420RemoteRegistrarClient_UnregisterObjectStartUnknownNN
3421RemoteRegistrarClient_UnregisterObjectStopUnknownNN
3424RemoteRegistrarClient_FindObjectStartUnknownYN
3425RemoteRegistrarClient_FindObjectStopUnknownYN
3426RemoteRegistrarClient_CompleteLocalConnectionStartUnknownNN
3427RemoteRegistrarClient_CompleteLocalConnectionStopUnknownNN
3428RemoteRegistrarClient_LocalClientDisconnectedStartUnknownNN
3429RemoteRegistrarClient_LocalClientDisconnectedStopUnknownNN
3430RemoteRegistrarClient_GetOrCreateReverseConnectionPortIDStartUnknownYN
3431RemoteRegistrarClient_GetOrCreateReverseConnectionPortIDStopUnknownYN
3432RemoteRegistrarClient_UnregisterReverseConnectionPortStartUnknownYN
3433RemoteRegistrarClient_UnregisterReverseConnectionPortStopUnknownYN
3436RemoteRegistrarClient_RegisterConversationStartUnknownNN
3437RemoteRegistrarClient_RegisterConversationStopUnknownNN
3438RemoteRegistrarClient_ReleaseConversationServerStartUnknownNN
3439RemoteRegistrarClient_ReleaseConversationServerStopUnknownNN
3440RemoteRegistrarClient_RegisterConversationClientStartUnknownYN
3441RemoteRegistrarClient_RegisterConversationClientStopUnknownYN
3442RemoteRegistrarClient_ConnectPendingConversationClientStartUnknownYN
3443RemoteRegistrarClient_ConnectPendingConversationClientStopUnknownYN
3444RemoteRegistrarClient_RegisterPendingConversationClientForServerStartUnknownYN
3445RemoteRegistrarClient_RegisterPendingConversationClientForServerStopUnknownYN
3446RemoteRegistrarClient_ReleaseConversationClientConnectionStartUnknownYN
3447RemoteRegistrarClient_ReleaseConversationClientConnectionStopUnknownYN
3450RemoteRegistrarClient_FindPendingConversationClientStartUnknownNN
3451RemoteRegistrarClient_FindPendingConversationClientStopUnknownNN
3452RemoteRegistrarClient_FindCrossProcConnectionStartUnknownYN
3453RemoteRegistrarClient_FindCrossProcConnectionStopUnknownYN
3454RemoteRegistrarClient_ReleaseConversationClientStartUnknownNN
3455RemoteRegistrarClient_ReleaseConversationClientStopUnknownNN
3456RemoteRegistrarClient_ClientConversationAttachedStartUnknownYN
3457RemoteRegistrarClient_ClientConversationAttachedStopUnknownYN
4000Messaging_ConstructMessageSessionStartUnknownYN
4001Messaging_ConstructMessageSessionStopUnknownYN
4010Messaging - CreateConnection - Start (destProcessId=unParam; …UnknownYN
4011Messaging - CreateConnection - Stop (destProcessId=unParam; …UnknownYN
4020Messaging - AllocatedMessage (externalPriority=ExternalPriority; size=unParam; …UnknownNN
4021Messaging - Message stream dirty (processId=hex threadId=hex2).UnknownYN
4022Messaging - FlushPendingStreams - Start (externalPriority=ExternalPriority).UnknownYN
4023Messaging - FlushPendingStreams - StopUnknownYN
4030Messaging_LocalReceiveStartUnknownYN
4031Messaging - LocalReceive - Statistics (messages=unParam; size=unParam2).UnknownYN
4041Messaging - InterconnectSend - Statistics (buffers=unParam; size=unParam2).UnknownYN
4042Messaging - InterconnectFlush - Start (externalPriority=ExternalPriority; …UnknownYN
4043Messaging - InterconnectFlush - Stop (externalPriority=ExternalPriority; …UnknownYN
4044Messaging_InterconnectReceiveStartUnknownYN
4045Messaging - InterconnectReceive - Statistics (senderTid=unParam; …UnknownYN
4051Messaging - AlpcSend - Statistics (buffers=unParam; size=unParam2).UnknownYN
4052Messaging - AlpcFlush - Start (externalPriority=ExternalPriority; …UnknownYN
4053Messaging - AlpcFlush - Stop (externalPriority=ExternalPriority; …UnknownYN
4054Messaging_AlpcReceiveStartUnknownYN
4055Messaging - AlpcReceive - Statistics (senderPid=unParam; senderTid=unParam2; …UnknownYN
5050Formatting - Message Method ({pwsz}).UnknownNN
5052Proxy - Message Event ({pwsz}).UnknownNN
5054Proxy - Property Update ({pwsz}).UnknownNN
7000CoreMessagingRegistrar ObjectRegistered 'pwsz' (type RegisteredObjectType scope …UnknownNN
7001CoreMessagingRegistrar ObjectRevoked 'pwsz' (type RegisteredObjectType scope …UnknownNN
7002CoreUI server disconnected pid hex tid hex2 id guid.UnknownYN
7003Conversation pwsz has run out of PeerID handles to allocate.UnknownNN
7004Client connection to conversation 'pwsz' failed, max clients already connected.UnknownNN
7005IdentityTable uniqueness bits protected us: index hex requestedUniq hex2 …UnknownNN
7006IdentityTable uniqueness bits reached max for slot index {hex}.UnknownNN
7007IdentityTable slot {hex} passed over (diff: {hex2}).UnknownNN
7008IdentityTable grown to max index {hex} (after {hex2} times through the loop).UnknownNN
8000NtAssociateWaitCompletionPacket succeeded: packet ptr1 target ptr2 keyContext …UnknownYN
8001NtAssociateWaitCompletionPacket failed, packet ptr1 port ptr2 handle ptr3 status …UnknownNN
8002NtCancelWaitCompletionPacket results: packet ptr status hex signaled fBool1 …UnknownYN
8003Created RegisteredWait: packet ptr1 target ptr2 cloned fBool.UnknownYN
8004UserAdapter HandleCompletion: packet ptr1 target ptr2.UnknownYN
8005Calling completion handler: ApcContext ptr1 KeyContext ptr2.UnknownYN
8006Removed end of batch completion.UnknownYN
8007Removed completion: ApcContext ptr1 KeyContext ptr2.UnknownYN
20000CoreUI SelfHostError - ThrownException (type=pwsz; hr=hex; message=pwsz2).UnknownYN
20001CoreMessagingRegistrar Object 'pwsz' not found (type=RegisteredObjectType; …UnknownYN
20002CoreUI Connection failed to pid hex tid hex2 id guid.UnknownNN
20003CoreUI forcibly disconnecting client pid hex tid hex2.UnknownNN
20004CoreUI NtAlpcConnectPort 'pwsz' failed with hr=hresult.UnknownNN
20005CoreMessagingRegistrar Conversation '{pwsz}' not found.UnknownNN
20006CoreUI Conversation ignoring client pid hex errorCode hex2 errorMessage pwsz.UnknownNN

Event ID 1000: CoreUI ETW - Initialized (pid=hex).

#
Channel
Unknown
Level
Verbose
Task
ETW_Init

Message #

CoreUI ETW - Initialized (pid=%1)

Fields #

NameDescription
hex UInt32

Example Event #

{
  "system": {
    "channel": "Unknown",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 1000,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 7112,
      "thread_id": 8684
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft-WindowsPhone-CoreMessaging",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 01:47:30.021Z",
    "version": 0
  },
  "event_data": {
    "hex": 7112
  },
  "message": ""
}

Event ID 1001: CoreUI ETW - Uninitialized (pid=hex).

#
Channel
Unknown
Task
ETW_Uninit

Message #

CoreUI ETW - Uninitialized (pid=%1)

Fields #

NameDescription
hex UInt32

Event ID 1050: CoreUI System - Out of Memory!

#
Channel
Unknown
Task
System_OutOfMemory

Event ID 2900: CoreUI Service server-thread started

#
Channel
Unknown
Task
CoreUIService_ServerThread_Started

Event ID 2901: CoreUI Service server-thread exiting

#
Channel
Unknown
Task
CoreUIService_ServerThread_Exiting

Event ID 2902: CoreUI InitializeService called

#
Channel
Unknown
Task
CoreUIService_InitializeService

Event ID 2903: CoreUI UninitializeService called

#
Channel
Unknown
Task
CoreUIService_UninitializeService

Event ID 2904: CoreUI ServiceObjectCreated called (serviceType={coreUIServiceType}).

#
Channel
Unknown

Fields #

NameDescription
coreUIServiceType

Event ID 2905: CoreUI ServiceObjectDestroyed called

#
Channel
Unknown
Task
CoreUIService_ServiceObjectDestroyed

Event ID 2906: CoreUI UpdateServiceStatus called

#
Channel
Unknown
Task
CoreUIService_UpdateServiceStatus

Event ID 2907: CoreUI ServiceObjectServiceMain called

#
Channel
Unknown
Task
CoreUIService_ServiceObjectServiceMain

Event ID 2908: CoreUI CoreUI ServiceMain called with unknown service name pwsz.

#
Channel
Unknown
Task
CoreUIService_CoreUIServiceMain_UnknownService

Message #

CoreUI CoreUI ServiceMain called with unknown service name %1

Fields #

NameDescription
pwsz UnicodeString

Event ID 3100: Session - CoreUICreate - Start

#
Channel
Unknown
Level
Verbose
Task
Session_CoreUICreate
Opcode
Start

Example Event #

{
  "system": {
    "channel": "Unknown",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 3100,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 7112,
      "thread_id": 8684
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 1,
    "provider": "Microsoft-WindowsPhone-CoreMessaging",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 01:47:30.021Z",
    "version": 0
  },
  "event_data": {},
  "message": ""
}

Event ID 3101: Session - CoreUICreate - Stop

#
Channel
Unknown
Level
Verbose
Task
Session_CoreUICreate
Opcode
Stop

Example Event #

{
  "system": {
    "channel": "Unknown",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 3101,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 7112,
      "thread_id": 8684
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 2,
    "provider": "Microsoft-WindowsPhone-CoreMessaging",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 01:47:30.023Z",
    "version": 0
  },
  "event_data": {},
  "message": ""
}

Event ID 3102: Session_CoreUICreate_InitializeCnContextStart

#
Channel
Unknown
Level
Verbose
Task
Session_CoreUICreate_InitializeCnContext
Opcode
Start

Example Event #

{
  "system": {
    "channel": "Unknown",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 3102,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 7112,
      "thread_id": 8684
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 1,
    "provider": "Microsoft-WindowsPhone-CoreMessaging",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 01:47:30.021Z",
    "version": 0
  },
  "event_data": {},
  "message": ""
}

Event ID 3103: Session_CoreUICreate_InitializeCnContextStop

#
Channel
Unknown
Level
Verbose
Task
Session_CoreUICreate_InitializeCnContext
Opcode
Stop

Example Event #

{
  "system": {
    "channel": "Unknown",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 3103,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 7112,
      "thread_id": 8684
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 2,
    "provider": "Microsoft-WindowsPhone-CoreMessaging",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 01:47:30.021Z",
    "version": 0
  },
  "event_data": {},
  "message": ""
}

Event ID 3106: Session_CoreUICreate_ExportSessionStart

#
Channel
Unknown
Level
Verbose
Task
Session_CoreUICreate_ExportSession
Opcode
Start

Example Event #

{
  "system": {
    "channel": "Unknown",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 3106,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 7112,
      "thread_id": 8684
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 1,
    "provider": "Microsoft-WindowsPhone-CoreMessaging",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 01:47:30.022Z",
    "version": 0
  },
  "event_data": {},
  "message": ""
}

Event ID 3107: Session_CoreUICreate_ExportSessionStop

#
Channel
Unknown
Level
Verbose
Task
Session_CoreUICreate_ExportSession
Opcode
Stop

Example Event #

{
  "system": {
    "channel": "Unknown",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 3107,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 7112,
      "thread_id": 8684
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 2,
    "provider": "Microsoft-WindowsPhone-CoreMessaging",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 01:47:30.022Z",
    "version": 0
  },
  "event_data": {},
  "message": ""
}

Event ID 3110: Session_ConstructThreadContextStart

#
Channel
Unknown
Level
Verbose
Task
Session_ConstructThreadContext
Opcode
Start

Example Event #

{
  "system": {
    "channel": "Unknown",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 3110,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 7112,
      "thread_id": 8684
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 1,
    "provider": "Microsoft-WindowsPhone-CoreMessaging",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 01:47:30.021Z",
    "version": 0
  },
  "event_data": {},
  "message": ""
}

Event ID 3111: Session_ConstructThreadContextStop

#
Channel
Unknown
Level
Verbose
Task
Session_ConstructThreadContext
Opcode
Stop

Example Event #

{
  "system": {
    "channel": "Unknown",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 3111,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 7112,
      "thread_id": 8684
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 2,
    "provider": "Microsoft-WindowsPhone-CoreMessaging",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 01:47:30.022Z",
    "version": 0
  },
  "event_data": {},
  "message": ""
}

Event ID 3210: Dispatcher_DispatchLoop

#
Channel
Unknown
Level
Verbose
Task
Dispatcher_DispatchLoop
Opcode
Start

Example Event #

{
  "system": {
    "provider": "Microsoft-WindowsPhone-CoreMessaging",
    "guid": "{922CDCF3-6123-42DA-A877-1A24F23E39C5}",
    "event_source_name": "",
    "event_id": 3210,
    "version": 0,
    "level": 5,
    "task": 50,
    "opcode": 1,
    "keywords": "0x0000000500000000",
    "time_created": "2026-06-02T05:32:34.719+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 1648,
      "thread_id": 1712
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": "Dispatcher_DispatchLoop"
}

Event ID 3211: Dispatcher_DispatchLoop

#
Channel
Unknown
Level
Verbose
Task
Dispatcher_DispatchLoop
Opcode
Stop

Example Event #

{
  "system": {
    "provider": "Microsoft-WindowsPhone-CoreMessaging",
    "guid": "{922CDCF3-6123-42DA-A877-1A24F23E39C5}",
    "event_source_name": "",
    "event_id": 3211,
    "version": 0,
    "level": 5,
    "task": 50,
    "opcode": 2,
    "keywords": "0x0000000500000000",
    "time_created": "2026-06-02T05:32:34.719+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 1648,
      "thread_id": 1712
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": "Dispatcher_DispatchLoop"
}

Event ID 3214: Dispatcher - DispatchItem - Start (internalPriority=InternalPriority).

#
Channel
Unknown
Also via
realtime ETW trace
Level
Verbose
Task
Dispatcher_DispatchItem
Opcode
Start

Message #

Dispatcher - DispatchItem - Start (internalPriority=%1)

Fields #

NameDescription
InternalPriority UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-WindowsPhone-CoreMessaging",
    "guid": "{922CDCF3-6123-42DA-A877-1A24F23E39C5}",
    "event_source_name": "",
    "event_id": 3214,
    "version": 0,
    "level": 5,
    "task": 51,
    "opcode": 1,
    "keywords": "0x0000000500000000",
    "time_created": "2026-06-02T05:32:34.719+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 1648,
      "thread_id": 1712
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "InternalPriority": 2
  },
  "message": "Dispatcher_DispatchItem"
}

Event ID 3215: Dispatcher - DispatchItem - Stop (internalPriority=InternalPriority).

#
Channel
Unknown
Also via
realtime ETW trace
Level
Verbose
Task
Dispatcher_DispatchItem
Opcode
Stop

Message #

Dispatcher - DispatchItem - Stop (internalPriority=%1)

Fields #

NameDescription
InternalPriority UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-WindowsPhone-CoreMessaging",
    "guid": "{922CDCF3-6123-42DA-A877-1A24F23E39C5}",
    "event_source_name": "",
    "event_id": 3215,
    "version": 0,
    "level": 5,
    "task": 51,
    "opcode": 2,
    "keywords": "0x0000000500000000",
    "time_created": "2026-06-02T05:32:34.719+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 1648,
      "thread_id": 1712
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "InternalPriority": 0
  },
  "message": "Dispatcher_DispatchItem"
}

Event ID 3216: Dispatcher - WakeLevel - UpdateWakeLevel (bits=unParam old=InternalPriority new=InternalPriority2).

#
Channel
Unknown
Also via
realtime ETW trace
Level
Verbose
Task
Dispatcher_WakeLevel_UpdateWakeLevel
Opcode
win:Info

Message #

Dispatcher - WakeLevel - UpdateWakeLevel (bits=%1 old=%2 new=%3)

Fields #

NameDescription
unParam UInt32
InternalPriority UInt32
InternalPriority2 UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-WindowsPhone-CoreMessaging",
    "guid": "{922CDCF3-6123-42DA-A877-1A24F23E39C5}",
    "event_source_name": "",
    "event_id": 3216,
    "version": 0,
    "level": 5,
    "task": 52,
    "opcode": 0,
    "keywords": "0x0000000500000000",
    "time_created": "2026-06-02T05:32:34.719+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 1648,
      "thread_id": 1712
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "InternalPriority": 0,
    "InternalPriority2": 2,
    "unParam": 4
  },
  "message": "Dispatcher_WakeLevel_UpdateWakeLevel"
}

Event ID 3220: Dispatcher - DoWait - Start (timeout=hex).

#
Channel
Unknown
Also via
realtime ETW trace
Level
Verbose
Task
Dispatcher_DoWait
Opcode
Start

Message #

Dispatcher - DoWait - Start (timeout=%1)

Fields #

NameDescription
hex UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-WindowsPhone-CoreMessaging",
    "guid": "{922CDCF3-6123-42DA-A877-1A24F23E39C5}",
    "event_source_name": "",
    "event_id": 3220,
    "version": 0,
    "level": 5,
    "task": 53,
    "opcode": 1,
    "keywords": "0x0000000500000000",
    "time_created": "2026-06-02T05:32:34.719+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 1648,
      "thread_id": 1712
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "hex": 0
  },
  "message": "Dispatcher_DoWait"
}

Event ID 3221: Dispatcher - DoWait - Stop (status=unParam handle=unParam2).

#
Channel
Unknown
Also via
realtime ETW trace
Level
Verbose
Task
Dispatcher_DoWait
Opcode
Stop

Message #

Dispatcher - DoWait - Stop (status=%1 handle=%2)

Fields #

NameDescription
unParam UInt32
unParam2 UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-WindowsPhone-CoreMessaging",
    "guid": "{922CDCF3-6123-42DA-A877-1A24F23E39C5}",
    "event_source_name": "",
    "event_id": 3221,
    "version": 0,
    "level": 5,
    "task": 53,
    "opcode": 2,
    "keywords": "0x0000000500000000",
    "time_created": "2026-06-02T05:32:34.704+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 1648,
      "thread_id": 1712
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "unParam": 43963,
    "unParam2": 0
  },
  "message": "Dispatcher_DoWait"
}

Event ID 3222: Dispatcher - CallDispatchCallback - Start (awake=fBool reference=unParam).

#
Channel
Unknown
Task
Dispatcher_CallDispatchCallback
Opcode
Start

Message #

Dispatcher - CallDispatchCallback - Start (awake=%1 reference=%2)

Fields #

NameDescription
fBool Boolean
unParam UInt64

Event ID 3223: Dispatcher - CallDispatchCallback - Stop (timeout=unParam).

#
Channel
Unknown
Task
Dispatcher_CallDispatchCallback
Opcode
Stop

Message #

Dispatcher - CallDispatchCallback - Stop            (timeout=%1)

Fields #

NameDescription
unParam UInt64

Event ID 3224: UserAdapter - ScheduleDispatch (threadid=unParam userPriority=UserPriority).

#
Channel
Unknown
Level
Verbose
Task
Adapter_ScheduleDispatch

Message #

UserAdapter - ScheduleDispatch (threadid=%1 userPriority=%2)

Fields #

NameDescription
unParam UInt32
UserPriority UInt32

Example Event #

{
  "system": {
    "channel": "Unknown",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 3224,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 10476,
      "thread_id": 10580
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft-WindowsPhone-CoreMessaging",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 01:47:29.990Z",
    "version": 0
  },
  "event_data": {
    "UserPriority": 3,
    "unParam": 10580
  },
  "message": ""
}

Event ID 3225: UserAdapter - HostModeRun - Start (runMode=RunMode stopping=fBool).

#
Channel
Unknown
Task
Adapter_HostModeRun
Opcode
Start

Message #

UserAdapter - HostModeRun - Start (runMode=%1 stopping=%2)

Fields #

NameDescription
RunMode UInt32
fBool Boolean

Event ID 3226: UserAdapter - HostModeRun - Stop

#
Channel
Unknown
Task
Adapter_HostModeRun
Opcode
Stop

Event ID 3227: UserAdapter - OnUserDispatch - Start (priority=UserPriority).

#
Channel
Unknown
Level
Verbose
Task
Adapter_OnUserDispatch
Opcode
Start

Message #

UserAdapter - OnUserDispatch - Start (priority=%1)

Fields #

NameDescription
UserPriority UInt32

Example Event #

{
  "system": {
    "channel": "Unknown",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 3227,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 10004,
      "thread_id": 7236
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 1,
    "provider": "Microsoft-WindowsPhone-CoreMessaging",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 01:47:29.993Z",
    "version": 0
  },
  "event_data": {
    "UserPriority": 4
  },
  "message": ""
}

Event ID 3228: UserAdapter - OnUserDispatch - Stop.

#
Channel
Unknown
Level
Verbose
Task
Adapter_OnUserDispatch
Opcode
Stop

Description

UserAdapter - OnUserDispatch - Stop (discarded? fBool).

Message #

UserAdapter - OnUserDispatch - Stop (discarded? %1)

Fields #

NameDescription
fBool Boolean

Example Event #

{
  "system": {
    "channel": "Unknown",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 3228,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 10004,
      "thread_id": 7236
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 2,
    "provider": "Microsoft-WindowsPhone-CoreMessaging",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 01:47:29.993Z",
    "version": 0
  },
  "event_data": {
    "fBool": false
  },
  "message": ""
}

Event ID 3229: UserAdapter - IntegratedLoopWait - Start

#
Channel
Unknown
Level
Verbose
Task
Adapter_IntegratedLoopWait
Opcode
Start

Example Event #

{
  "system": {
    "channel": "Unknown",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 3229,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 7644,
      "thread_id": 9032
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 1,
    "provider": "Microsoft-WindowsPhone-CoreMessaging",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 01:47:30.004Z",
    "version": 0
  },
  "event_data": {},
  "message": ""
}

Event ID 3230: UserAdapter - IntegratedLoopWait - Stop

#
Channel
Unknown
Level
Verbose
Task
Adapter_IntegratedLoopWait
Opcode
Stop

Example Event #

{
  "system": {
    "channel": "Unknown",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 3230,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 10476,
      "thread_id": 10580
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 2,
    "provider": "Microsoft-WindowsPhone-CoreMessaging",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 01:47:29.989Z",
    "version": 0
  },
  "event_data": {},
  "message": ""
}

Event ID 3231: UserAdapter - PostMessage - Failed due to post message queue full

#
Channel
Unknown
Task
Adapter_PostMessageError_QueueFull

Event ID 3232: UserAdapter - PostMessage - User failed to schedule an asynchronous DISPATCHNOTIFY_COMPLETION

#
Channel
Unknown
Task
Adapter_KernelPostMessageError

Event ID 3300: RegistrarClient - Initialize - Start

#
Channel
Unknown
Level
Verbose
Task
RegistrarClient_Initialize
Opcode
Start

Example Event #

{
  "system": {
    "channel": "Unknown",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 3300,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 7112,
      "thread_id": 8684
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 1,
    "provider": "Microsoft-WindowsPhone-CoreMessaging",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 01:47:30.021Z",
    "version": 0
  },
  "event_data": {},
  "message": ""
}

Event ID 3301: RegistrarClient - Initialize - Stop

#
Channel
Unknown
Level
Verbose
Task
RegistrarClient_Initialize
Opcode
Stop

Example Event #

{
  "system": {
    "channel": "Unknown",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 3301,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 7112,
      "thread_id": 8684
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 2,
    "provider": "Microsoft-WindowsPhone-CoreMessaging",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 01:47:30.022Z",
    "version": 0
  },
  "event_data": {},
  "message": ""
}

Event ID 3310: RegistrarClient_ConnectToRegistrarServerStart

#
Channel
Unknown
Level
Verbose
Task
RegistrarClient_ConnectToRegistrarServer
Opcode
Start

Example Event #

{
  "system": {
    "channel": "Unknown",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 3310,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 7112,
      "thread_id": 8684
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 1,
    "provider": "Microsoft-WindowsPhone-CoreMessaging",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 01:47:30.021Z",
    "version": 0
  },
  "event_data": {},
  "message": ""
}

Event ID 3311: RegistrarClient_ConnectToRegistrarServerStop

#
Channel
Unknown
Level
Verbose
Task
RegistrarClient_ConnectToRegistrarServer
Opcode
Stop

Example Event #

{
  "system": {
    "channel": "Unknown",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 3311,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 7112,
      "thread_id": 8684
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 2,
    "provider": "Microsoft-WindowsPhone-CoreMessaging",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 01:47:30.022Z",
    "version": 0
  },
  "event_data": {},
  "message": ""
}

Event ID 3400: RemoteRegistrarClient_ConnectStart

#
Channel
Unknown
Level
Verbose
Task
RemoteRegistrarClient_Connect
Opcode
Start

Example Event #

{
  "system": {
    "channel": "Unknown",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 3400,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 7112,
      "thread_id": 8684
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 1,
    "provider": "Microsoft-WindowsPhone-CoreMessaging",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 01:47:30.021Z",
    "version": 0
  },
  "event_data": {},
  "message": ""
}

Event ID 3401: RemoteRegistrarClient_ConnectStop

#
Channel
Unknown
Level
Verbose
Task
RemoteRegistrarClient_Connect
Opcode
Stop

Example Event #

{
  "system": {
    "channel": "Unknown",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 3401,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 7112,
      "thread_id": 8684
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 2,
    "provider": "Microsoft-WindowsPhone-CoreMessaging",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 01:47:30.022Z",
    "version": 0
  },
  "event_data": {},
  "message": ""
}

Event ID 3402: RemoteRegistrarClient_RegisterThreadStart

#
Channel
Unknown
Level
Verbose
Task
RemoteRegistrarClient_RegisterThread
Opcode
Start

Example Event #

{
  "system": {
    "channel": "Unknown",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 3402,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 7112,
      "thread_id": 8684
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 1,
    "provider": "Microsoft-WindowsPhone-CoreMessaging",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 01:47:30.021Z",
    "version": 0
  },
  "event_data": {},
  "message": ""
}

Event ID 3403: RemoteRegistrarClient_RegisterThreadStop

#
Channel
Unknown
Level
Verbose
Task
RemoteRegistrarClient_RegisterThread
Opcode
Stop

Example Event #

{
  "system": {
    "channel": "Unknown",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 3403,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 7112,
      "thread_id": 8684
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 2,
    "provider": "Microsoft-WindowsPhone-CoreMessaging",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 01:47:30.022Z",
    "version": 0
  },
  "event_data": {},
  "message": ""
}

Event ID 3404: RemoteRegistrarClient_RegisterPortStart

#
Channel
Unknown
Level
Verbose
Task
RemoteRegistrarClient_RegisterPort
Opcode
Start

Example Event #

{
  "system": {
    "channel": "Unknown",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 3404,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 7112,
      "thread_id": 8684
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 1,
    "provider": "Microsoft-WindowsPhone-CoreMessaging",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 01:47:30.026Z",
    "version": 0
  },
  "event_data": {},
  "message": ""
}

Event ID 3405: RemoteRegistrarClient_RegisterPortStop

#
Channel
Unknown
Level
Verbose
Task
RemoteRegistrarClient_RegisterPort
Opcode
Stop

Example Event #

{
  "system": {
    "channel": "Unknown",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 3405,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 7112,
      "thread_id": 8684
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 2,
    "provider": "Microsoft-WindowsPhone-CoreMessaging",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 01:47:30.026Z",
    "version": 0
  },
  "event_data": {},
  "message": ""
}

Event ID 3406: RemoteRegistrarClient_UnregisterPortStart

#
Channel
Unknown
Task
RemoteRegistrarClient_UnregisterPort
Opcode
Start

Event ID 3407: RemoteRegistrarClient_UnregisterPortStop

#
Channel
Unknown
Task
RemoteRegistrarClient_UnregisterPort
Opcode
Stop

Event ID 3408: RemoteRegistrarClient_PrepareConnectionStart

#
Channel
Unknown
Level
Verbose
Task
RemoteRegistrarClient_PrepareConnection
Opcode
Start

Example Event #

{
  "system": {
    "channel": "Unknown",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 3408,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 7112,
      "thread_id": 8684
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 1,
    "provider": "Microsoft-WindowsPhone-CoreMessaging",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 01:47:30.027Z",
    "version": 0
  },
  "event_data": {},
  "message": ""
}

Event ID 3409: RemoteRegistrarClient_PrepareConnectionStop

#
Channel
Unknown
Level
Verbose
Task
RemoteRegistrarClient_PrepareConnection
Opcode
Stop

Example Event #

{
  "system": {
    "channel": "Unknown",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 3409,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 7112,
      "thread_id": 8684
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 2,
    "provider": "Microsoft-WindowsPhone-CoreMessaging",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 01:47:30.027Z",
    "version": 0
  },
  "event_data": {},
  "message": ""
}

Event ID 3410: RemoteRegistrarClient_CloseConnectionStart

#
Channel
Unknown
Level
Verbose
Task
RemoteRegistrarClient_CloseConnection
Opcode
Start

Example Event #

{
  "system": {
    "channel": "Unknown",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 3410,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 10476,
      "thread_id": 10580
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 1,
    "provider": "Microsoft-WindowsPhone-CoreMessaging",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 01:47:30.596Z",
    "version": 0
  },
  "event_data": {},
  "message": ""
}

Event ID 3411: RemoteRegistrarClient_CloseConnectionStop

#
Channel
Unknown
Level
Verbose
Task
RemoteRegistrarClient_CloseConnection
Opcode
Stop

Example Event #

{
  "system": {
    "channel": "Unknown",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 3411,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 10476,
      "thread_id": 10580
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 2,
    "provider": "Microsoft-WindowsPhone-CoreMessaging",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 01:47:30.596Z",
    "version": 0
  },
  "event_data": {},
  "message": ""
}

Event ID 3412: RemoteRegistrarClient_CompleteCrossProcConnectionStart

#
Channel
Unknown
Level
Verbose
Task
RemoteRegistrarClient_CompleteCrossProcConnection
Opcode
Start

Example Event #

{
  "system": {
    "channel": "Unknown",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 3412,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 10476,
      "thread_id": 10580
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 1,
    "provider": "Microsoft-WindowsPhone-CoreMessaging",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 01:47:30.028Z",
    "version": 0
  },
  "event_data": {},
  "message": ""
}

Event ID 3413: RemoteRegistrarClient_CompleteCrossProcConnectionStop

#
Channel
Unknown
Level
Verbose
Task
RemoteRegistrarClient_CompleteCrossProcConnection
Opcode
Stop

Example Event #

{
  "system": {
    "channel": "Unknown",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 3413,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 10476,
      "thread_id": 10580
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 2,
    "provider": "Microsoft-WindowsPhone-CoreMessaging",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 01:47:30.028Z",
    "version": 0
  },
  "event_data": {},
  "message": ""
}

Event ID 3414: RemoteRegistrarClient_CrossProcClientDisconnectedStart

#
Channel
Unknown
Level
Verbose
Task
RemoteRegistrarClient_CrossProcClientDisconnected
Opcode
Start

Example Event #

{
  "system": {
    "channel": "Unknown",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 3414,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 10476,
      "thread_id": 10580
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 1,
    "provider": "Microsoft-WindowsPhone-CoreMessaging",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 01:47:30.595Z",
    "version": 0
  },
  "event_data": {},
  "message": ""
}

Event ID 3415: RemoteRegistrarClient_CrossProcClientDisconnectedStop

#
Channel
Unknown
Level
Verbose
Task
RemoteRegistrarClient_CrossProcClientDisconnected
Opcode
Stop

Example Event #

{
  "system": {
    "channel": "Unknown",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 3415,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 10476,
      "thread_id": 10580
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 2,
    "provider": "Microsoft-WindowsPhone-CoreMessaging",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 01:47:30.595Z",
    "version": 0
  },
  "event_data": {},
  "message": ""
}

Event ID 3416: RemoteRegistrarClient_FreeServerGroupIDForClientStart

#
Channel
Unknown
Task
RemoteRegistrarClient_FreeServerGroupIDForClient
Opcode
Start

Event ID 3417: RemoteRegistrarClient_FreeServerGroupIDForClientStop

#
Channel
Unknown
Task
RemoteRegistrarClient_FreeServerGroupIDForClient
Opcode
Stop

Event ID 3418: RemoteRegistrarClient_RegisterObjectStart

#
Channel
Unknown
Task
RemoteRegistrarClient_RegisterObject
Opcode
Start

Fields #

NameDescription
pwsz UnicodeString

Event ID 3419: RemoteRegistrarClient_RegisterObjectStop

#
Channel
Unknown
Task
RemoteRegistrarClient_RegisterObject
Opcode
Stop

Event ID 3420: RemoteRegistrarClient_UnregisterObjectStart

#
Channel
Unknown
Task
RemoteRegistrarClient_UnregisterObject
Opcode
Start

Fields #

NameDescription
pwsz UnicodeString

Event ID 3421: RemoteRegistrarClient_UnregisterObjectStop

#
Channel
Unknown
Task
RemoteRegistrarClient_UnregisterObject
Opcode
Stop

Event ID 3424: RemoteRegistrarClient_FindObjectStart

#
Channel
Unknown
Level
Verbose
Task
RemoteRegistrarClient_FindObject
Opcode
Start

Fields #

NameDescription
pwsz UnicodeString

Example Event #

{
  "system": {
    "channel": "Unknown",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 3424,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 7112,
      "thread_id": 8684
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 1,
    "provider": "Microsoft-WindowsPhone-CoreMessaging",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 01:47:30.027Z",
    "version": 0
  },
  "event_data": {
    "pwsz": "TextInputServerDefault1"
  },
  "message": ""
}

Event ID 3425: RemoteRegistrarClient_FindObjectStop

#
Channel
Unknown
Level
Verbose
Task
RemoteRegistrarClient_FindObject
Opcode
Stop

Example Event #

{
  "system": {
    "channel": "Unknown",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 3425,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 7112,
      "thread_id": 8684
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 2,
    "provider": "Microsoft-WindowsPhone-CoreMessaging",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 01:47:30.027Z",
    "version": 0
  },
  "event_data": {},
  "message": ""
}

Event ID 3426: RemoteRegistrarClient_CompleteLocalConnectionStart

#
Channel
Unknown
Task
RemoteRegistrarClient_CompleteLocalConnection
Opcode
Start

Event ID 3427: RemoteRegistrarClient_CompleteLocalConnectionStop

#
Channel
Unknown
Task
RemoteRegistrarClient_CompleteLocalConnection
Opcode
Stop

Event ID 3428: RemoteRegistrarClient_LocalClientDisconnectedStart

#
Channel
Unknown
Task
RemoteRegistrarClient_LocalClientDisconnected
Opcode
Start

Event ID 3429: RemoteRegistrarClient_LocalClientDisconnectedStop

#
Channel
Unknown
Task
RemoteRegistrarClient_LocalClientDisconnected
Opcode
Stop

Event ID 3430: RemoteRegistrarClient_GetOrCreateReverseConnectionPortIDStart

#
Channel
Unknown
Level
Verbose
Task
RemoteRegistrarClient_GetOrCreateReverseConnectionPortID
Opcode
Start

Example Event #

{
  "system": {
    "channel": "Unknown",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 3430,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 7112,
      "thread_id": 8684
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 1,
    "provider": "Microsoft-WindowsPhone-CoreMessaging",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 01:47:30.030Z",
    "version": 0
  },
  "event_data": {},
  "message": ""
}

Event ID 3431: RemoteRegistrarClient_GetOrCreateReverseConnectionPortIDStop

#
Channel
Unknown
Level
Verbose
Task
RemoteRegistrarClient_GetOrCreateReverseConnectionPortID
Opcode
Stop

Example Event #

{
  "system": {
    "channel": "Unknown",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 3431,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 7112,
      "thread_id": 8684
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 2,
    "provider": "Microsoft-WindowsPhone-CoreMessaging",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 01:47:30.030Z",
    "version": 0
  },
  "event_data": {},
  "message": ""
}

Event ID 3432: RemoteRegistrarClient_UnregisterReverseConnectionPortStart

#
Channel
Unknown
Level
Verbose
Task
RemoteRegistrarClient_UnregisterReverseConnectionPort
Opcode
Start

Example Event #

{
  "system": {
    "channel": "Unknown",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 3432,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 10476,
      "thread_id": 10580
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 1,
    "provider": "Microsoft-WindowsPhone-CoreMessaging",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 01:47:30.596Z",
    "version": 0
  },
  "event_data": {},
  "message": ""
}

Event ID 3433: RemoteRegistrarClient_UnregisterReverseConnectionPortStop

#
Channel
Unknown
Level
Verbose
Task
RemoteRegistrarClient_UnregisterReverseConnectionPort
Opcode
Stop

Example Event #

{
  "system": {
    "channel": "Unknown",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 3433,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 10476,
      "thread_id": 10580
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 2,
    "provider": "Microsoft-WindowsPhone-CoreMessaging",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 01:47:30.596Z",
    "version": 0
  },
  "event_data": {},
  "message": ""
}

Event ID 3436: RemoteRegistrarClient_RegisterConversationStart

#
Channel
Unknown
Task
RemoteRegistrarClient_RegisterConversation
Opcode
Start

Fields #

NameDescription
pwsz UnicodeString

Event ID 3437: RemoteRegistrarClient_RegisterConversationStop

#
Channel
Unknown
Task
RemoteRegistrarClient_RegisterConversation
Opcode
Stop

Event ID 3438: RemoteRegistrarClient_ReleaseConversationServerStart

#
Channel
Unknown
Task
RemoteRegistrarClient_ReleaseConversationServer
Opcode
Start

Fields #

NameDescription
pwsz UnicodeString
unParam UInt32

Event ID 3439: RemoteRegistrarClient_ReleaseConversationServerStop

#
Channel
Unknown
Task
RemoteRegistrarClient_ReleaseConversationServer
Opcode
Stop

Event ID 3440: RemoteRegistrarClient_RegisterConversationClientStart

#
Channel
Unknown
Level
Verbose
Task
RemoteRegistrarClient_RegisterConversationClient
Opcode
Start

Fields #

NameDescription
pwsz UnicodeString

Example Event #

{
  "system": {
    "channel": "Unknown",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 3440,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 7112,
      "thread_id": 8684
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 1,
    "provider": "Microsoft-WindowsPhone-CoreMessaging",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 01:47:30.032Z",
    "version": 0
  },
  "event_data": {
    "pwsz": "TextInputServerBamoDefault1_BAMO"
  },
  "message": ""
}

Event ID 3441: RemoteRegistrarClient_RegisterConversationClientStop

#
Channel
Unknown
Level
Verbose
Task
RemoteRegistrarClient_RegisterConversationClient
Opcode
Stop

Example Event #

{
  "system": {
    "channel": "Unknown",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 3441,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 7112,
      "thread_id": 8684
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 2,
    "provider": "Microsoft-WindowsPhone-CoreMessaging",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 01:47:30.032Z",
    "version": 0
  },
  "event_data": {},
  "message": ""
}

Event ID 3442: RemoteRegistrarClient_ConnectPendingConversationClientStart

#
Channel
Unknown
Level
Verbose
Task
RemoteRegistrarClient_ConnectPendingConversationClient
Opcode
Start

Fields #

NameDescription
pwsz UnicodeString
unParam UInt32
unParam2 UInt64

Example Event #

{
  "system": {
    "channel": "Unknown",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 3442,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 10476,
      "thread_id": 10580
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 1,
    "provider": "Microsoft-WindowsPhone-CoreMessaging",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 01:47:30.135Z",
    "version": 0
  },
  "event_data": {
    "pwsz": "TextInputServerBamoDefault1_BAMO",
    "unParam": 1,
    "unParam2": 2146
  },
  "message": ""
}

Event ID 3443: RemoteRegistrarClient_ConnectPendingConversationClientStop

#
Channel
Unknown
Level
Verbose
Task
RemoteRegistrarClient_ConnectPendingConversationClient
Opcode
Stop

Example Event #

{
  "system": {
    "channel": "Unknown",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 3443,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 10476,
      "thread_id": 10580
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 2,
    "provider": "Microsoft-WindowsPhone-CoreMessaging",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 01:47:30.135Z",
    "version": 0
  },
  "event_data": {},
  "message": ""
}

Event ID 3444: RemoteRegistrarClient_RegisterPendingConversationClientForServerStart

#
Channel
Unknown
Level
Verbose
Task
RemoteRegistrarClient_RegisterPendingConversationClientForServer
Opcode
Start

Fields #

NameDescription
pwsz UnicodeString
unParam UInt32
unParam2 UInt32

Example Event #

{
  "system": {
    "channel": "Unknown",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 3444,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 7112,
      "thread_id": 8684
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 1,
    "provider": "Microsoft-WindowsPhone-CoreMessaging",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 01:47:30.032Z",
    "version": 0
  },
  "event_data": {
    "pwsz": "TextInputServerBamoDefault1_BAMO",
    "unParam": 1,
    "unParam2": 26
  },
  "message": ""
}

Event ID 3445: RemoteRegistrarClient_RegisterPendingConversationClientForServerStop

#
Channel
Unknown
Level
Verbose
Task
RemoteRegistrarClient_RegisterPendingConversationClientForServer
Opcode
Stop

Example Event #

{
  "system": {
    "channel": "Unknown",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 3445,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 7112,
      "thread_id": 8684
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 2,
    "provider": "Microsoft-WindowsPhone-CoreMessaging",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 01:47:30.032Z",
    "version": 0
  },
  "event_data": {},
  "message": ""
}

Event ID 3446: RemoteRegistrarClient_ReleaseConversationClientConnectionStart

#
Channel
Unknown
Level
Verbose
Task
RemoteRegistrarClient_ReleaseConversationClientConnection
Opcode
Start

Fields #

NameDescription
pwsz UnicodeString
unParam UInt32
unParam2 UInt32
unParam3 UInt32

Example Event #

{
  "system": {
    "channel": "Unknown",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 3446,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 10476,
      "thread_id": 10580
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 1,
    "provider": "Microsoft-WindowsPhone-CoreMessaging",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 01:47:30.595Z",
    "version": 0
  },
  "event_data": {
    "pwsz": "TextInputServerBamoDefault1_BAMO",
    "unParam": 1,
    "unParam2": 26,
    "unParam3": 7112
  },
  "message": ""
}

Event ID 3447: RemoteRegistrarClient_ReleaseConversationClientConnectionStop

#
Channel
Unknown
Level
Verbose
Task
RemoteRegistrarClient_ReleaseConversationClientConnection
Opcode
Stop

Example Event #

{
  "system": {
    "channel": "Unknown",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 3447,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 10476,
      "thread_id": 10580
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 2,
    "provider": "Microsoft-WindowsPhone-CoreMessaging",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 01:47:30.595Z",
    "version": 0
  },
  "event_data": {},
  "message": ""
}

Event ID 3450: RemoteRegistrarClient_FindPendingConversationClientStart

#
Channel
Unknown
Task
RemoteRegistrarClient_FindPendingConversationClient
Opcode
Start

Fields #

NameDescription
pwsz UnicodeString
unParam UInt32
unParam2 UInt64

Event ID 3451: RemoteRegistrarClient_FindPendingConversationClientStop

#
Channel
Unknown
Task
RemoteRegistrarClient_FindPendingConversationClient
Opcode
Stop

Event ID 3452: RemoteRegistrarClient_FindCrossProcConnectionStart

#
Channel
Unknown
Level
Verbose
Task
RemoteRegistrarClient_FindCrossProcConnection
Opcode
Start

Example Event #

{
  "system": {
    "channel": "Unknown",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 3452,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 10476,
      "thread_id": 10580
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 1,
    "provider": "Microsoft-WindowsPhone-CoreMessaging",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 01:47:30.028Z",
    "version": 0
  },
  "event_data": {},
  "message": ""
}

Event ID 3453: RemoteRegistrarClient_FindCrossProcConnectionStop

#
Channel
Unknown
Level
Verbose
Task
RemoteRegistrarClient_FindCrossProcConnection
Opcode
Stop

Example Event #

{
  "system": {
    "channel": "Unknown",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 3453,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 10476,
      "thread_id": 10580
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 2,
    "provider": "Microsoft-WindowsPhone-CoreMessaging",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 01:47:30.028Z",
    "version": 0
  },
  "event_data": {},
  "message": ""
}

Event ID 3454: RemoteRegistrarClient_ReleaseConversationClientStart

#
Channel
Unknown
Task
RemoteRegistrarClient_ReleaseConversationClient
Opcode
Start

Fields #

NameDescription
pwsz UnicodeString
unParam UInt32

Event ID 3455: RemoteRegistrarClient_ReleaseConversationClientStop

#
Channel
Unknown
Task
RemoteRegistrarClient_ReleaseConversationClient
Opcode
Stop

Event ID 3456: RemoteRegistrarClient_ClientConversationAttachedStart

#
Channel
Unknown
Level
Verbose
Task
RemoteRegistrarClient_ClientConversationAttached
Opcode
Start

Fields #

NameDescription
pwsz UnicodeString
unParam UInt32
unParam2 UInt32

Example Event #

{
  "system": {
    "channel": "Unknown",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 3456,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 7112,
      "thread_id": 8684
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 1,
    "provider": "Microsoft-WindowsPhone-CoreMessaging",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 01:47:30.584Z",
    "version": 0
  },
  "event_data": {
    "pwsz": "TextInputServerBamoDefault1_BAMO",
    "unParam": 26,
    "unParam2": 1
  },
  "message": ""
}

Event ID 3457: RemoteRegistrarClient_ClientConversationAttachedStop

#
Channel
Unknown
Level
Verbose
Task
RemoteRegistrarClient_ClientConversationAttached
Opcode
Stop

Example Event #

{
  "system": {
    "channel": "Unknown",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 3457,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 7112,
      "thread_id": 8684
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 2,
    "provider": "Microsoft-WindowsPhone-CoreMessaging",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 01:47:30.584Z",
    "version": 0
  },
  "event_data": {},
  "message": ""
}

Event ID 4000: Messaging_ConstructMessageSessionStart

#
Channel
Unknown
Level
Verbose
Task
Messaging_ConstructMessageSession
Opcode
Start

Example Event #

{
  "system": {
    "channel": "Unknown",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 4000,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 7112,
      "thread_id": 8684
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 1,
    "provider": "Microsoft-WindowsPhone-CoreMessaging",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 01:47:30.022Z",
    "version": 0
  },
  "event_data": {},
  "message": ""
}

Event ID 4001: Messaging_ConstructMessageSessionStop

#
Channel
Unknown
Level
Verbose
Task
Messaging_ConstructMessageSession
Opcode
Stop

Example Event #

{
  "system": {
    "channel": "Unknown",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 4001,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 7112,
      "thread_id": 8684
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 2,
    "provider": "Microsoft-WindowsPhone-CoreMessaging",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 01:47:30.022Z",
    "version": 0
  },
  "event_data": {},
  "message": ""
}

Event ID 4010: Messaging - CreateConnection - Start (destProcessId=unParam; destThreadId=unParam2).

#
Channel
Unknown
Level
Verbose
Task
Messaging_CreateConnection
Opcode
Start

Message #

Messaging - CreateConnection - Start (destProcessId=%1; destThreadId=%2)

Fields #

NameDescription
unParam UInt32
unParam2 UInt32

Example Event #

{
  "system": {
    "channel": "Unknown",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 4010,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 7112,
      "thread_id": 8684
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 1,
    "provider": "Microsoft-WindowsPhone-CoreMessaging",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 01:47:30.027Z",
    "version": 0
  },
  "event_data": {
    "unParam": 10476,
    "unParam2": 10580
  },
  "message": ""
}

Event ID 4011: Messaging - CreateConnection - Stop (destProcessId=unParam; destThreadId=unParam2).

#
Channel
Unknown
Level
Verbose
Task
Messaging_CreateConnection
Opcode
Stop

Message #

Messaging - CreateConnection - Stop (destProcessId=%1; destThreadId=%2)

Fields #

NameDescription
unParam UInt32
unParam2 UInt32

Example Event #

{
  "system": {
    "channel": "Unknown",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 4011,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 7112,
      "thread_id": 8684
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 2,
    "provider": "Microsoft-WindowsPhone-CoreMessaging",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 01:47:30.030Z",
    "version": 0
  },
  "event_data": {
    "unParam": 10476,
    "unParam2": 10580
  },
  "message": ""
}

Event ID 4020: Messaging - AllocatedMessage (externalPriority=ExternalPriority; size=unParam; destProcessId=hex; destThreadId=hex2).

#
Channel
Unknown
Task
Messaging_AllocatedMessage

Message #

Messaging - AllocatedMessage (externalPriority=%1; size=%2; destProcessId=%3; destThreadId=%4)

Fields #

NameDescription
ExternalPriority UInt32
unParam UInt32
hex UInt32
hex2 UInt32

Event ID 4021: Messaging - Message stream dirty (processId=hex threadId=hex2).

#
Channel
Unknown
Level
Verbose
Task
Messaging_StreamDirty

Message #

Messaging - Message stream dirty (processId=%1 threadId=%2)

Fields #

NameDescription
hex UInt32
hex2 UInt32

Example Event #

{
  "system": {
    "channel": "Unknown",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 4021,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 1584,
      "thread_id": 1660
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft-WindowsPhone-CoreMessaging",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 01:47:29.989Z",
    "version": 0
  },
  "event_data": {
    "hex": 8992,
    "hex2": 9672
  },
  "message": ""
}

Event ID 4022: Messaging - FlushPendingStreams - Start (externalPriority=ExternalPriority).

#
Channel
Unknown
Level
Verbose
Task
Messaging_FlushPendingStreams
Opcode
Start

Message #

Messaging - FlushPendingStreams - Start (externalPriority=%1)

Fields #

NameDescription
ExternalPriority UInt32

Example Event #

{
  "system": {
    "channel": "Unknown",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 4022,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 1584,
      "thread_id": 1660
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 1,
    "provider": "Microsoft-WindowsPhone-CoreMessaging",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 01:47:29.990Z",
    "version": 0
  },
  "event_data": {
    "ExternalPriority": 3
  },
  "message": ""
}

Event ID 4023: Messaging - FlushPendingStreams - Stop

#
Channel
Unknown
Level
Verbose
Task
Messaging_FlushPendingStreams
Opcode
Stop

Example Event #

{
  "system": {
    "channel": "Unknown",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 4023,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 9584,
      "thread_id": 11060
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 2,
    "provider": "Microsoft-WindowsPhone-CoreMessaging",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 01:47:29.991Z",
    "version": 0
  },
  "event_data": {},
  "message": ""
}

Event ID 4030: Messaging_LocalReceiveStart

#
Channel
Unknown
Level
Verbose
Task
Messaging_LocalReceive
Opcode
Start

Example Event #

{
  "system": {
    "channel": "Unknown",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 4030,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 8992,
      "thread_id": 9680
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 1,
    "provider": "Microsoft-WindowsPhone-CoreMessaging",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 01:47:30.405Z",
    "version": 0
  },
  "event_data": {},
  "message": ""
}

Event ID 4031: Messaging - LocalReceive - Statistics (messages=unParam; size=unParam2).

#
Channel
Unknown
Level
Verbose
Task
Messaging_LocalReceive
Opcode
Stop

Message #

Messaging - LocalReceive - Statistics (messages=%1; size=%2)

Fields #

NameDescription
unParam UInt32
unParam2 UInt32

Example Event #

{
  "system": {
    "channel": "Unknown",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 4031,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 8992,
      "thread_id": 9680
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 2,
    "provider": "Microsoft-WindowsPhone-CoreMessaging",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 01:47:30.405Z",
    "version": 0
  },
  "event_data": {
    "unParam": 5,
    "unParam2": 228
  },
  "message": ""
}

Event ID 4041: Messaging - InterconnectSend - Statistics (buffers=unParam; size=unParam2).

#
Channel
Unknown
Level
Verbose
Task
Messaging_InterconnectSend

Message #

Messaging - InterconnectSend - Statistics (buffers=%1; size=%2)

Fields #

NameDescription
unParam UInt32
unParam2 UInt32

Example Event #

{
  "system": {
    "channel": "Unknown",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 4041,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 10476,
      "thread_id": 10580
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft-WindowsPhone-CoreMessaging",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 01:47:30.138Z",
    "version": 0
  },
  "event_data": {
    "unParam": 4,
    "unParam2": 1984
  },
  "message": ""
}

Event ID 4042: Messaging - InterconnectFlush - Start (externalPriority=ExternalPriority; destProcessId=unParam; destThreadId=unParam2).

#
Channel
Unknown
Level
Verbose
Task
Messaging_InterconnectFlush
Opcode
Start

Message #

Messaging - InterconnectFlush - Start (externalPriority=%1; destProcessId=%2; destThreadId=%3)

Fields #

NameDescription
ExternalPriority UInt32
unParam UInt32
unParam2 UInt32

Example Event #

{
  "system": {
    "channel": "Unknown",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 4042,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 10476,
      "thread_id": 10580
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 1,
    "provider": "Microsoft-WindowsPhone-CoreMessaging",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 01:47:30.138Z",
    "version": 0
  },
  "event_data": {
    "ExternalPriority": 3,
    "unParam": 10476,
    "unParam2": 10584
  },
  "message": ""
}

Event ID 4043: Messaging - InterconnectFlush - Stop (externalPriority=ExternalPriority; destProcessId=unParam; destThreadId=unParam2).

#
Channel
Unknown
Level
Verbose
Task
Messaging_InterconnectFlush
Opcode
Stop

Message #

Messaging - InterconnectFlush - Stop (externalPriority=%1; destProcessId=%2; destThreadId=%3)

Fields #

NameDescription
ExternalPriority UInt32
unParam UInt32
unParam2 UInt32

Example Event #

{
  "system": {
    "channel": "Unknown",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 4043,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 10476,
      "thread_id": 10580
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 2,
    "provider": "Microsoft-WindowsPhone-CoreMessaging",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 01:47:30.138Z",
    "version": 0
  },
  "event_data": {
    "ExternalPriority": 3,
    "unParam": 10476,
    "unParam2": 10584
  },
  "message": ""
}

Event ID 4044: Messaging_InterconnectReceiveStart

#
Channel
Unknown
Level
Verbose
Task
Messaging_InterconnectReceive
Opcode
Start

Example Event #

{
  "system": {
    "channel": "Unknown",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 4044,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 10476,
      "thread_id": 10584
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 1,
    "provider": "Microsoft-WindowsPhone-CoreMessaging",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 01:47:30.138Z",
    "version": 0
  },
  "event_data": {},
  "message": ""
}

Event ID 4045: Messaging - InterconnectReceive - Statistics (senderTid=unParam; messages=unParam2; size=unParam3).

#
Channel
Unknown
Level
Verbose
Task
Messaging_InterconnectReceive
Opcode
Stop

Message #

Messaging - InterconnectReceive - Statistics (senderTid=%1; messages=%2; size=%3)

Fields #

NameDescription
unParam UInt32
unParam2 UInt32
unParam3 UInt32

Example Event #

{
  "system": {
    "channel": "Unknown",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 4045,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 10476,
      "thread_id": 10584
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 2,
    "provider": "Microsoft-WindowsPhone-CoreMessaging",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 01:47:30.138Z",
    "version": 0
  },
  "event_data": {
    "unParam": 10580,
    "unParam2": 1,
    "unParam3": 240
  },
  "message": ""
}

Event ID 4051: Messaging - AlpcSend - Statistics (buffers=unParam; size=unParam2).

#
Channel
Unknown
Level
Verbose
Task
Messaging_AlpcSend

Message #

Messaging - AlpcSend - Statistics (buffers=%1; size=%2)

Fields #

NameDescription
unParam UInt32
unParam2 UInt32

Example Event #

{
  "system": {
    "channel": "Unknown",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 4051,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 1584,
      "thread_id": 1660
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft-WindowsPhone-CoreMessaging",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 01:47:29.990Z",
    "version": 0
  },
  "event_data": {
    "unParam": 1,
    "unParam2": 176
  },
  "message": ""
}

Event ID 4052: Messaging - AlpcFlush - Start (externalPriority=ExternalPriority; destProcessId=unParam; destThreadId=unParam2).

#
Channel
Unknown
Level
Verbose
Task
Messaging_AlpcFlush
Opcode
Start

Message #

Messaging - AlpcFlush - Start (externalPriority=%1; destProcessId=%2; destThreadId=%3)

Fields #

NameDescription
ExternalPriority UInt32
unParam UInt32
unParam2 UInt32

Example Event #

{
  "system": {
    "channel": "Unknown",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 4052,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 1584,
      "thread_id": 1660
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 1,
    "provider": "Microsoft-WindowsPhone-CoreMessaging",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 01:47:29.990Z",
    "version": 0
  },
  "event_data": {
    "ExternalPriority": 3,
    "unParam": 8992,
    "unParam2": 9672
  },
  "message": ""
}

Event ID 4053: Messaging - AlpcFlush - Stop (externalPriority=ExternalPriority; destProcessId=unParam; destThreadId=unParam2).

#
Channel
Unknown
Level
Verbose
Task
Messaging_AlpcFlush
Opcode
Stop

Message #

Messaging - AlpcFlush - Stop (externalPriority=%1; destProcessId=%2; destThreadId=%3)

Fields #

NameDescription
ExternalPriority UInt32
unParam UInt32
unParam2 UInt32

Example Event #

{
  "system": {
    "channel": "Unknown",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 4053,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 1584,
      "thread_id": 1660
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 2,
    "provider": "Microsoft-WindowsPhone-CoreMessaging",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 01:47:29.990Z",
    "version": 0
  },
  "event_data": {
    "ExternalPriority": 3,
    "unParam": 8992,
    "unParam2": 9672
  },
  "message": ""
}

Event ID 4054: Messaging_AlpcReceiveStart

#
Channel
Unknown
Level
Verbose
Task
Messaging_AlpcReceive
Opcode
Start

Example Event #

{
  "system": {
    "channel": "Unknown",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 4054,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 1584,
      "thread_id": 1660
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 1,
    "provider": "Microsoft-WindowsPhone-CoreMessaging",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 01:47:29.989Z",
    "version": 0
  },
  "event_data": {},
  "message": ""
}

Event ID 4055: Messaging - AlpcReceive - Statistics (senderPid=unParam; senderTid=unParam2; messages=unParam3; size=unParam4).

#
Channel
Unknown
Level
Verbose
Task
Messaging_AlpcReceive
Opcode
Stop

Message #

Messaging - AlpcReceive - Statistics (senderPid=%1; senderTid=%2; messages=%3; size=%4)

Fields #

NameDescription
unParam UInt32
unParam2 UInt32
unParam3 UInt32
unParam4 UInt32

Example Event #

{
  "system": {
    "channel": "Unknown",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 4055,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 1584,
      "thread_id": 1660
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 2,
    "provider": "Microsoft-WindowsPhone-CoreMessaging",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 01:47:29.990Z",
    "version": 0
  },
  "event_data": {
    "unParam": 0,
    "unParam2": 0,
    "unParam3": 1,
    "unParam4": 56
  },
  "message": ""
}

Event ID 5050: Formatting - Message Method ({pwsz}).

#
Channel
Unknown

Fields #

NameDescription
pwsz

Event ID 5052: Proxy - Message Event ({pwsz}).

#
Channel
Unknown

Fields #

NameDescription
pwsz

Event ID 5054: Proxy - Property Update ({pwsz}).

#
Channel
Unknown

Fields #

NameDescription
pwsz

Event ID 7000: CoreMessagingRegistrar ObjectRegistered 'pwsz' (type RegisteredObjectType scope RegistrarScope session hex pid hex2 tid hex3).

#
Channel
Unknown
Task
SelfHostInfo_ObjectRegistered

Message #

CoreMessagingRegistrar ObjectRegistered '%1' (type %2 scope %3 session %4 pid %5 tid %6)

Fields #

NameDescription
pwsz UnicodeString
RegisteredObjectType UInt32
RegistrarScope UInt32
hex UInt32
hex2 UInt32
hex3 UInt32

Event ID 7001: CoreMessagingRegistrar ObjectRevoked 'pwsz' (type RegisteredObjectType scope RegistrarScope session hex pid hex2 tid hex3 Orphaned=fBool).

#
Channel
Unknown
Task
SelfHostInfo_ObjectRevoked

Message #

CoreMessagingRegistrar ObjectRevoked '%1' (type %2 scope %3 session %4 pid %5 tid %6 Orphaned=%7)

Fields #

NameDescription
pwsz UnicodeString
RegisteredObjectType UInt32
RegistrarScope UInt32
hex UInt32
hex2 UInt32
hex3 UInt32
fBool Boolean

Event ID 7002: CoreUI server disconnected pid hex tid hex2 id guid.

#
Channel
Unknown
Level
Informational
Task
SelfHostInfo_ConnectionSevered

Message #

CoreUI server disconnected pid %1 tid %2 id %3

Fields #

NameDescription
hex UInt32
hex2 UInt32
guid GUID

Example Event #

{
  "system": {
    "channel": "Unknown",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 7002,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 10476,
      "thread_id": 10580
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft-WindowsPhone-CoreMessaging",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 01:47:30.595Z",
    "version": 0
  },
  "event_data": {
    "guid": "{EC91E72B-4789-48CD-A343-2E573D300CC8}",
    "hex": 7112,
    "hex2": 8684
  },
  "message": ""
}

Event ID 7003: Conversation pwsz has run out of PeerID handles to allocate.

#
Channel
Unknown
Task
SelfHostInfo_OutOfConversationPeerHandles

Message #

Conversation %1 has run out of PeerID handles to allocate

Fields #

NameDescription
pwsz UnicodeString

Event ID 7004: Client connection to conversation 'pwsz' failed, max clients already connected.

#
Channel
Unknown
Task
SelfHostInfo_MaxConversationClientsConnected

Message #

Client connection to conversation '%1' failed, max clients already connected

Fields #

NameDescription
pwsz UnicodeString

Event ID 7005: IdentityTable uniqueness bits protected us: index hex requestedUniq hex2 currentUniq hex3.

#
Channel
Unknown
Task
SelfHostInfo_UniquenessProtectedUs

Message #

IdentityTable uniqueness bits protected us: index %1  requestedUniq %2  currentUniq %3

Fields #

NameDescription
hex UInt32
hex2 UInt32
hex3 UInt32

Event ID 7006: IdentityTable uniqueness bits reached max for slot index {hex}.

#
Channel
Unknown

Fields #

NameDescription
hex

Event ID 7007: IdentityTable slot {hex} passed over (diff: {hex2}).

#
Channel
Unknown

Fields #

NameDescription
hex
hex2

Event ID 7008: IdentityTable grown to max index {hex} (after {hex2} times through the loop).

#
Channel
Unknown

Fields #

NameDescription
hex
hex2

Event ID 8000: NtAssociateWaitCompletionPacket succeeded: packet ptr1 target ptr2 keyContext ptr3 apcContext ptr4.

#
Channel
Unknown
Level
Informational
Task
IoCompletionPort

Message #

NtAssociateWaitCompletionPacket succeeded: packet %1 target %2 keyContext %3 apcContext %4

Fields #

NameDescription
ptr1 Pointer
ptr2 Pointer
ptr3 Pointer
ptr4 Pointer

Example Event #

{
  "system": {
    "channel": "Unknown",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 8000,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 9584,
      "thread_id": 11060
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft-WindowsPhone-CoreMessaging",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 01:47:29.991Z",
    "version": 0
  },
  "event_data": {
    "ptr1": "0x68C",
    "ptr2": "0x688",
    "ptr3": "0x40001402"
  },
  "message": ""
}

Event ID 8001: NtAssociateWaitCompletionPacket failed, packet ptr1 port ptr2 handle ptr3 status hex.

#
Channel
Unknown
Task
IoCompletionPort

Message #

NtAssociateWaitCompletionPacket failed, packet %1 port %2 handle %3 status %4

Fields #

NameDescription
ptr1 Pointer
ptr2 Pointer
ptr3 Pointer
hex UInt32

Event ID 8002: NtCancelWaitCompletionPacket results: packet ptr status hex signaled fBool1 canceled fBool2.

#
Channel
Unknown
Level
Informational
Task
IoCompletionPort

Message #

NtCancelWaitCompletionPacket results: packet %1 status %2 signaled %3 canceled %4

Fields #

NameDescription
ptr Pointer
hex UInt32
fBool1 Boolean
fBool2 Boolean

Example Event #

{
  "system": {
    "channel": "Unknown",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 8002,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 8992,
      "thread_id": 9680
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft-WindowsPhone-CoreMessaging",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 01:47:30.407Z",
    "version": 0
  },
  "event_data": {
    "fBool1": false,
    "fBool2": true,
    "hex": 0,
    "ptr": "0x25B8"
  },
  "message": ""
}

Event ID 8003: Created RegisteredWait: packet ptr1 target ptr2 cloned fBool.

#
Channel
Unknown
Level
Informational
Task
IoCompletionPort

Message #

Created RegisteredWait: packet %1 target %2 cloned %3

Fields #

NameDescription
ptr1 Pointer
ptr2 Pointer
fBool Boolean

Example Event #

{
  "system": {
    "channel": "Unknown",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 8003,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 7112,
      "thread_id": 8684
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft-WindowsPhone-CoreMessaging",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 01:47:30.023Z",
    "version": 0
  },
  "event_data": {
    "fBool": false,
    "ptr1": "0x560",
    "ptr2": "0x540"
  },
  "message": ""
}

Event ID 8004: UserAdapter HandleCompletion: packet ptr1 target ptr2.

#
Channel
Unknown
Level
Informational
Task
IoCompletionPort

Message #

UserAdapter HandleCompletion: packet %1 target %2

Fields #

NameDescription
ptr1 Pointer
ptr2 Pointer

Example Event #

{
  "system": {
    "channel": "Unknown",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 8004,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 10004,
      "thread_id": 7236
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft-WindowsPhone-CoreMessaging",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 01:47:29.993Z",
    "version": 0
  },
  "event_data": {
    "ptr1": "0xFA8",
    "ptr2": "0xF3C"
  },
  "message": ""
}

Event ID 8005: Calling completion handler: ApcContext ptr1 KeyContext ptr2.

#
Channel
Unknown
Level
Informational
Task
IoCompletionPort

Message #

Calling completion handler: ApcContext %1 KeyContext %2

Fields #

NameDescription
ptr1 Pointer
ptr2 Pointer

Example Event #

{
  "system": {
    "channel": "Unknown",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 8005,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 1584,
      "thread_id": 1660
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft-WindowsPhone-CoreMessaging",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 01:47:29.780Z",
    "version": 0
  },
  "event_data": {
    "ptr1": "0x2",
    "ptr2": "0x0"
  },
  "message": ""
}

Event ID 8006: Removed end of batch completion.

#
Channel
Unknown
Level
Informational
Task
IoCompletionPort

Example Event #

{
  "system": {
    "channel": "Unknown",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 8006,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 1584,
      "thread_id": 1660
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft-WindowsPhone-CoreMessaging",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 01:48:30.789Z",
    "version": 0
  },
  "event_data": {},
  "message": ""
}

Event ID 8007: Removed completion: ApcContext ptr1 KeyContext ptr2.

#
Channel
Unknown
Level
Informational
Task
IoCompletionPort

Message #

Removed completion: ApcContext %1 KeyContext %2

Fields #

NameDescription
ptr1 Pointer
ptr2 Pointer

Example Event #

{
  "system": {
    "channel": "Unknown",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 8007,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 1584,
      "thread_id": 1660
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft-WindowsPhone-CoreMessaging",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 01:47:29.780Z",
    "version": 0
  },
  "event_data": {
    "ptr1": "0x2",
    "ptr2": "0x0"
  },
  "message": ""
}

Event ID 20000: CoreUI SelfHostError - ThrownException (type=pwsz; hr=hex; message=pwsz2).

#
Channel
Unknown
Level
Error
Task
SelfHostError_ThrownException

Message #

CoreUI SelfHostError - ThrownException (type=%1; hr=%2; message=%3)

Fields #

NameDescription
pwsz UnicodeString
hex UInt32
pwsz2 UnicodeString

Example Event #

{
  "system": {
    "channel": "Unknown",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 20000,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 10476,
      "thread_id": 10580
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft-WindowsPhone-CoreMessaging",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 01:47:30.135Z",
    "version": 0
  },
  "event_data": {
    "hex": 2276591625,
    "pwsz": "MessagingValidationException",
    "pwsz2": "NULL"
  },
  "message": ""
}

Event ID 20001: CoreMessagingRegistrar Object 'pwsz' not found (type=RegisteredObjectType; scope=RegistrarScope).

#
Channel
Unknown
Level
Error
Task
SelfHostError_ObjectNotFound

Message #

CoreMessagingRegistrar Object '%1' not found (type=%2; scope=%3)

Fields #

NameDescription
pwsz UnicodeString
RegisteredObjectType UInt32
RegistrarScope UInt32

Example Event #

{
  "system": {
    "channel": "Unknown",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 20001,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 1816,
      "thread_id": 2032
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft-WindowsPhone-CoreMessaging",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 01:47:30.135Z",
    "version": 0
  },
  "event_data": {
    "RegisteredObjectType": 0,
    "RegistrarScope": 1,
    "pwsz": "TextInputHost"
  },
  "message": ""
}

Event ID 20002: CoreUI Connection failed to pid hex tid hex2 id guid.

#
Channel
Unknown
Task
SelfHostError_ConnectionFailed

Message #

CoreUI Connection failed to pid %1 tid %2 id %3

Fields #

NameDescription
hex UInt32
hex2 UInt32
guid GUID

Event ID 20003: CoreUI forcibly disconnecting client pid hex tid hex2.

#
Channel
Unknown
Task
SelfHostError_DisconnectClient

Message #

CoreUI forcibly disconnecting client pid %1 tid %2

Fields #

NameDescription
hex UInt32
hex2 UInt32

Event ID 20004: CoreUI NtAlpcConnectPort 'pwsz' failed with hr=hresult.

#
Channel
Unknown
Task
SelfHostError_AlpcConnectionFailed

Message #

CoreUI NtAlpcConnectPort '%1' failed with hr=%2

Fields #

NameDescription
pwsz UnicodeString
hresult Int32

Event ID 20005: CoreMessagingRegistrar Conversation '{pwsz}' not found.

#
Channel
Unknown

Fields #

NameDescription
pwsz

Event ID 20006: CoreUI Conversation ignoring client pid hex errorCode hex2 errorMessage pwsz.

#
Channel
Unknown
Task
SelfHostError_ConversationPeerSoftBlocked

Message #

CoreUI Conversation ignoring client pid %1 errorCode %2 errorMessage %3

Fields #

NameDescription
hex UInt32
hex2 UInt32
pwsz UnicodeString

Provenance

ETW provider GUID {922CDCF3-6123-42DA-A877-1A24F23E39C5}

Defined in CoreMessaging.dll, which carries the event manifest.

  • WS2022-20348.4893, sample captured from a live trace, binary version 10.0.20348.3692, captured 2026-06-02 — Manifest XML pack, 1.9 MB
  • WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.3692, captured 2026-06-02 — Manifest XML pack, 1.9 MB
  • Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.4202, captured 2026-06-02 — Manifest XML pack, 2.0 MB