detection.wiki

Microsoft-Windows-IME-TCTIP

EventTitleChannelSampleRule
23EAIME_UI_InvokeCommandStartAnalyticNN
24EAIME_UI_InvokeCommandEndAnalyticNN
30EAIME_IME_CHT_HWKBD_CandUIProcess_InfoAnalyticNN

Event ID 23: EAIME_UI_InvokeCommandStart

#
Channel
Analytic
Task
TaskID:IMEInvokeCommand
Opcode
Start

Event ID 24: EAIME_UI_InvokeCommandEnd

#
Channel
Analytic
Task
TaskID:IMEInvokeCommand
Opcode
Stop

Event ID 30: EAIME_IME_CHT_HWKBD_CandUIProcess_Info

#
Channel
Analytic
Task
TaskID:IME_CHT_HWKBD_CandUIProcess

Fields #

NameDescription
Duration UInt32
IMEType UInt32

Provenance

ETW provider GUID d5268c02-6f51-436f-983b-74f2efbfaf3a

Defined in imTcTip.dll, which carries the event manifest.

  • WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.3451, captured 2026-06-02 — Manifest XML pack, 1.9 MB
  • Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.5074, captured 2026-06-02 — Manifest XML pack, 2.0 MB