Microsoft-Windows-IME-CandidateUI

Event	Title	Channel	Sample	Rule
1	EAIME_CANDUI_OnKeyDownStart	Analytic	N	N
2	EAIME_CANDUI_OnKeyDownEnd	Analytic	N	N
120	EAIME_CANDUI_MovePageStart	Analytic	N	N
121	EAIME_CANDUI_MovePageEnd	Analytic	N	N

Event ID 1: EAIME_CANDUI_OnKeyDownStart

Channel: Analytic
Task: TaskID:Processingincomingkey
Opcode: Start

Event ID 2: EAIME_CANDUI_OnKeyDownEnd

Channel: Analytic
Task: TaskID:Processingincomingkey
Opcode: Stop

Event ID 120: EAIME_CANDUI_MovePageStart

Channel: Analytic
Task: TaskID:Processingincomingkey
Opcode: Start

Event ID 121: EAIME_CANDUI_MovePageEnd

Channel: Analytic
Task: TaskID:Processingincomingkey
Opcode: Stop

Provenance

ETW provider GUID 7c4117b1-ed82-4f47-b2ca-29e4e25719c7

Defined in mscand20.dll, which carries the event manifest.

WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.3451, captured 2026-06-02 — Manifest XML pack, 1.9 MB
Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.5074, captured 2026-06-02 — Manifest XML pack, 2.0 MB