detection.wiki

Microsoft-Windows-Calculator

EventTitleChannelSampleRule
1HistoryToggle has startedDiagnosticNN
2History toggle has been closedDiagnosticNN
3Calculator Command has startedDiagnosticNN
4Calculator Command has been completedDiagnosticNN
5Launching of app has startedDiagnosticNN
6Launching of app has been closedDiagnosticNN
7Closing of app has startedDiagnosticNN
8App has been closedDiagnosticNN
9Reading templates: StartDiagnosticNN
10Reading templates: StopDiagnosticNN
11Loading templates: StartDiagnosticNN
12Loading templates: StopDiagnosticNN
13Initing template manager: StartDiagnosticNN
14Initing template manager: StopDiagnosticNN
15Template formula lookup: StartDiagnosticNN
16Template formula lookup: StopDiagnosticNN
17Template parsing errorDebugNN
18Template validation errorDebugNN
19GetCategories: StartDiagnosticNN
20GetCategories: StopDiagnosticNN
21Unit Conversion errorDebugNN
22Statistics Calculation has startedDiagnosticNN
23Statistics Calculation has been completedDiagnosticNN
24Recalculation has startedDiagnosticNN
25Recalculation has been completedDiagnosticNN
26Mode change event has startedDiagnosticNN
27Mode change has been completedDiagnosticNN

Event ID 1: HistoryToggle has started

#
Channel
Diagnostic
Task
HistoryToggle
Opcode
Start

Fields #

NameDescription
Eventnumber UInt32

Event ID 2: History toggle has been closed

#
Channel
Diagnostic
Task
HistoryToggle
Opcode
Stop

Fields #

NameDescription
Eventnumber UInt32

Event ID 3: Calculator Command has started

#
Channel
Diagnostic
Task
CalcCommand
Opcode
Start

Fields #

NameDescription
EventNumber UInt32

Event ID 4: Calculator Command has been completed

#
Channel
Diagnostic
Task
CalcCommand
Opcode
Stop

Fields #

NameDescription
EventNumber UInt32

Event ID 5: Launching of app has started

#
Channel
Diagnostic
Task
LaunchingApp
Opcode
Start

Fields #

NameDescription
EventNumber UInt32

Event ID 6: Launching of app has been closed

#
Channel
Diagnostic
Task
LaunchingApp
Opcode
Stop

Fields #

NameDescription
EventNumber UInt32

Event ID 7: Closing of app has started

#
Channel
Diagnostic
Task
ClosingApp
Opcode
Start

Fields #

NameDescription
EventNumber UInt32

Event ID 8: App has been closed

#
Channel
Diagnostic
Task
ClosingApp
Opcode
Stop

Fields #

NameDescription
EventNumber UInt32

Event ID 9: Reading templates: Start

#
Channel
Diagnostic
Task
TemplateRead
Opcode
Start

Fields #

NameDescription
Eventnumber UInt32

Event ID 10: Reading templates: Stop

#
Channel
Diagnostic
Task
TemplateRead
Opcode
Stop

Fields #

NameDescription
Eventnumber UInt32

Event ID 11: Loading templates: Start

#
Channel
Diagnostic
Task
TemplateLoad
Opcode
Start

Fields #

NameDescription
Eventnumber UInt32

Event ID 12: Loading templates: Stop

#
Channel
Diagnostic
Task
TemplateLoad
Opcode
Stop

Fields #

NameDescription
Eventnumber UInt32

Event ID 13: Initing template manager: Start

#
Channel
Diagnostic
Task
TemplateInit
Opcode
Start

Fields #

NameDescription
Eventnumber UInt32

Event ID 14: Initing template manager: Stop

#
Channel
Diagnostic
Task
TemplateInit
Opcode
Stop

Fields #

NameDescription
Eventnumber UInt32

Event ID 15: Template formula lookup: Start

#
Channel
Diagnostic
Task
TemplateLookUp
Opcode
Start

Fields #

NameDescription
Eventnumber UInt32

Event ID 16: Template formula lookup: Stop

#
Channel
Diagnostic
Task
TemplateLookUp
Opcode
Stop

Fields #

NameDescription
Eventnumber UInt32

Event ID 17: Template parsing error

#
Channel
Debug

Fields #

NameDescription
Description UnicodeString

Event ID 18: Template validation error

#
Channel
Debug

Fields #

NameDescription
Description UnicodeString

Event ID 19: GetCategories: Start

#
Channel
Diagnostic
Task
GetCategories
Opcode
Start

Fields #

NameDescription
Eventnumber UInt32

Event ID 20: GetCategories: Stop

#
Channel
Diagnostic
Task
GetCategories
Opcode
Stop

Fields #

NameDescription
Eventnumber UInt32

Event ID 21: Unit Conversion error

#
Channel
Debug

Fields #

NameDescription
Description UnicodeString

Event ID 22: Statistics Calculation has started

#
Channel
Diagnostic
Task
StatisticsCalculation
Opcode
Start

Fields #

NameDescription
EventNumber UInt32

Event ID 23: Statistics Calculation has been completed

#
Channel
Diagnostic
Task
StatisticsCalculation
Opcode
Stop

Fields #

NameDescription
EventNumber UInt32

Event ID 24: Recalculation has started

#
Channel
Diagnostic
Task
Recalculation
Opcode
Start

Fields #

NameDescription
EventNumber UInt32

Event ID 25: Recalculation has been completed

#
Channel
Diagnostic
Task
Recalculation
Opcode
Stop

Fields #

NameDescription
EventNumber UInt32

Event ID 26: Mode change event has started

#
Channel
Diagnostic
Task
ModeChange
Opcode
Start

Fields #

NameDescription
Eventnumber UInt32

Event ID 27: Mode change has been completed

#
Channel
Diagnostic
Task
ModeChange
Opcode
Stop

Fields #

NameDescription
Eventnumber UInt32

Provenance

ETW provider GUID 75f48521-4131-4ac3-9887-65473224fcb2

Defined in win32calc.exe, which carries the event manifest.

  • WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB