Microsoft-Windows-PhotoAcq
| Event | Title | Channel | Sample | Rule |
|---|---|---|---|---|
| 1 | EnumerateItemsStart | Analytic | N | N |
| 2 | EnumerateItemsStop | Analytic | N | N |
| 3 | TransferItemStart | Analytic | N | N |
| 4 | TransferItemStop | Analytic | N | N |
| 5 | PrecacheItemStart | Analytic | N | N |
| 6 | PrecacheItemStop | Analytic | N | N |
| 7 | EndToEndStart | Analytic | N | N |
| 8 | EndToEndStop | Analytic | N | N |
Event ID 1: EnumerateItemsStart
#Event ID 2: EnumerateItemsStop
#Event ID 3: TransferItemStart
#Event ID 4: TransferItemStop
#Event ID 5: PrecacheItemStart
#Event ID 6: PrecacheItemStop
#Event ID 7: EndToEndStart
#Event ID 8: EndToEndStop
#Provenance
ETW provider GUID 76cfa528-b26e-b773-62d0-9588270442a6
Defined in Program, which carries the event manifest.
- WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB
- Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB