detection.wiki

Microsoft-Windows-Shell-OpenWith

EventTitleChannelSampleRule
103ShowImmersiveOpenWithStartDiagnosticNN
104ShowImmersiveOpenWithStopDiagnosticNN

Event ID 103: ShowImmersiveOpenWithStart

#
Channel
Diagnostic
Task
ShowImmersiveOpenWith
Opcode
Start

Fields #

NameDescription
Target UnicodeString
TargetIsURL Boolean

Event ID 104: ShowImmersiveOpenWithStop

#
Channel
Diagnostic
Task
ShowImmersiveOpenWith
Opcode
Stop

Fields #

NameDescription
HRESULT UInt32

Provenance

ETW provider GUID 11bd2a68-77ff-4991-9658-f451f2eb6ce1

Defined in OpenWith.exe, which carries the event manifest.

  • WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB
  • Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB