detection.wiki

Microsoft-Windows-MSPaint

EventTitleChannelSampleRule
1Intializing current instance of the applicationDebugNN
2Exiting current Instance of the applicationDebugNN
3MSPaint Launch StartDiagnosticNN
4MSPaint Launch EndDiagnosticNN
5MSPaint Exit StartDiagnosticNN
6MSPaint Exit EndDiagnosticNN
7Select Tool(ID: ToolID) Start.DiagnosticNN
8Select Tool EndDiagnosticNN
9Commit Tool(ID: ToolID)b Start.DiagnosticNN
10Commit Tool EndDiagnosticNN
11Undo StartDiagnosticNN
12Undo EndDiagnosticNN
13Change Tool(ID: ToolID) Thickness(ToolThickness).DiagnosticNN
14Change Stroke Color(RGB: Color).DiagnosticNN
15Change Fill Color(RGB: Color).DiagnosticNN
16Change DrawMode(ShapeDrawMode).DiagnosticNN
17Change Brush CrossSection(ToolCrosssection).DiagnosticNN
18Change Caligraphic Brush CrossSection(ToolCrosssection).DiagnosticNN
19Change Glitter Color(Color).DiagnosticNN
20Error enabling/disabling RTSDebugNN
21Failed to load msftedit.DebugNN
22Start measure paint lagDiagnosticNN
23Stop measure paint lagDiagnosticNN
24Recieved RTS PacketDiagnosticNN
25Start save drawingDiagnosticNN
26Stop save drawingDiagnosticNN
27Start open imageDiagnosticNN
28Stop open imageDiagnosticNN
29Start flip operationDiagnosticNN
30Stop flip operationDiagnosticNN
31Start rotate operationDiagnosticNN
32Stop rotate operationDiagnosticNN
33Start crop operationDiagnosticNN
34Stop crop operationDiagnosticNN
35Start invert color operationDiagnosticNN
36Stop invert color operationDiagnosticNN
37Start resize skew operationDiagnosticNN
38Stop resize skew operationDiagnosticNN

Event ID 1: Intializing current instance of the application

#
Channel
Debug

Event ID 2: Exiting current Instance of the application

#
Channel
Debug

Event ID 3: MSPaint Launch Start

#
Channel
Diagnostic
Task
MSPaint_Launch
Opcode
Start

Event ID 4: MSPaint Launch End

#
Channel
Diagnostic
Task
MSPaint_Launch
Opcode
Stop

Event ID 5: MSPaint Exit Start

#
Channel
Diagnostic
Task
MSPaint_Exit
Opcode
Start

Event ID 6: MSPaint Exit End

#
Channel
Diagnostic
Task
MSPaint_Exit
Opcode
Stop

Event ID 7: Select Tool(ID: ToolID) Start.

#
Channel
Diagnostic
Task
Select_Tool
Opcode
Start

Message #

Select Tool(ID: %1) Start

Fields #

NameDescription
ToolID Int32

Event ID 8: Select Tool End

#
Channel
Diagnostic
Task
Select_Tool
Opcode
Stop

Event ID 9: Commit Tool(ID: ToolID)b Start.

#
Channel
Diagnostic
Task
Commit_Tool
Opcode
Start

Message #

Commit Tool(ID: %1)b Start

Fields #

NameDescription
ToolID Int32

Event ID 10: Commit Tool End

#
Channel
Diagnostic
Task
Commit_Tool
Opcode
Stop

Event ID 11: Undo Start

#
Channel
Diagnostic
Task
Undo
Opcode
Start

Event ID 12: Undo End

#
Channel
Diagnostic
Task
Undo
Opcode
Stop

Event ID 13: Change Tool(ID: ToolID) Thickness(ToolThickness).

#
Channel
Diagnostic

Message #

Change Tool(ID: %1) Thickness(%2)

Fields #

NameDescription
ToolID Int32
ToolThickness Int32

Event ID 14: Change Stroke Color(RGB: Color).

#
Channel
Diagnostic

Message #

Change Stroke Color(RGB: %1)

Fields #

NameDescription
Color UInt64

Event ID 15: Change Fill Color(RGB: Color).

#
Channel
Diagnostic

Message #

Change Fill Color(RGB: %1)

Fields #

NameDescription
Color UInt64

Event ID 16: Change DrawMode(ShapeDrawMode).

#
Channel
Diagnostic

Message #

Change DrawMode(%1)

Fields #

NameDescription
ShapeDrawMode Int32

Event ID 17: Change Brush CrossSection(ToolCrosssection).

#
Channel
Diagnostic

Message #

Change Brush CrossSection(%1)

Fields #

NameDescription
ToolCrosssection Int32

Event ID 18: Change Caligraphic Brush CrossSection(ToolCrosssection).

#
Channel
Diagnostic

Message #

Change Caligraphic Brush CrossSection(%1)

Fields #

NameDescription
ToolCrosssection Int32

Event ID 19: Change Glitter Color(Color).

#
Channel
Diagnostic

Message #

Change Glitter Color(%1)

Fields #

NameDescription
Color UInt64

Event ID 20: Error enabling/disabling RTS

#
Channel
Debug

Fields #

NameDescription
HResult UInt32

Event ID 21: Failed to load msftedit.

#
Channel
Debug

Description

Failed to load msftedit.dll.

Message #

Failed to load msftedit.dll

Event ID 22: Start measure paint lag

#
Channel
Diagnostic
Task
MeasurePaintLag
Opcode
Start

Event ID 23: Stop measure paint lag

#
Channel
Diagnostic
Task
MeasurePaintLag
Opcode
Stop

Event ID 24: Recieved RTS Packet

#
Channel
Diagnostic
Task
MeasurePaintLag

Event ID 25: Start save drawing

#
Channel
Diagnostic
Task
SaveDrawing
Opcode
Start

Event ID 26: Stop save drawing

#
Channel
Diagnostic
Task
SaveDrawing
Opcode
Stop

Fields #

NameDescription
Saveoperationresult Int32

Event ID 27: Start open image

#
Channel
Diagnostic
Task
OpenImage
Opcode
Start

Event ID 28: Stop open image

#
Channel
Diagnostic
Task
OpenImage
Opcode
Stop

Event ID 29: Start flip operation

#
Channel
Diagnostic
Task
FlipOperation
Opcode
Start

Event ID 30: Stop flip operation

#
Channel
Diagnostic
Task
FlipOperation
Opcode
Stop

Event ID 31: Start rotate operation

#
Channel
Diagnostic
Task
RotateOperation
Opcode
Start

Event ID 32: Stop rotate operation

#
Channel
Diagnostic
Task
RotateOperation
Opcode
Stop

Event ID 33: Start crop operation

#
Channel
Diagnostic
Task
CropOperation
Opcode
Start

Event ID 34: Stop crop operation

#
Channel
Diagnostic
Task
CropOperation
Opcode
Stop

Event ID 35: Start invert color operation

#
Channel
Diagnostic
Task
InvertColorOperation
Opcode
Start

Event ID 36: Stop invert color operation

#
Channel
Diagnostic
Task
InvertColorOperation
Opcode
Stop

Event ID 37: Start resize skew operation

#
Channel
Diagnostic
Task
ResizeSkewOperation
Opcode
Start

Event ID 38: Stop resize skew operation

#
Channel
Diagnostic
Task
ResizeSkewOperation
Opcode
Stop

Fields #

NameDescription
ResizeskewOperationresult Int32
Widthofthecanvas Int32
Heightofthecanvas Int32
Horizontalresizepercentage Int32
Verticalresizepercentage Int32
Horizontalskewangle Int32
Verticalskewangle Int32

Provenance

ETW provider GUID 1d75856d-36a7-4ecb-a3f5-b13152222d29

Defined in mspaint.exe, which carries the event manifest.

  • WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB