detection.wiki

Microsoft-Windows-SpellChecker

EventTitleChannelSampleRule
1Add word startAnalyticNN
2Add word completeAnalyticNN
3Check startAnalyticNN
4Check completeAnalyticNN
5Create SpellChecker startAnalyticNN
6Create SpellChecker completeAnalyticNN
7Suggest startAnalyticNN
8Suggest completeAnalyticNN
9EnumSpellingError Next StartAnalyticNN
10EnumSpellingError Next StopAnalyticNN
11SupportedLanguages completeAnalyticNN
12SupportedLanguages startAnalyticNN
13Csapi Suggest startAnalyticNN
14Csapi Suggest CompleteAnalyticNN
15Csapi Check StartAnalyticNN
16Csapi Check completeAnalyticNN
17Csapi Add word startAnalyticNN
18Csapi Add Word completeAnalyticNN
19Csapi Initialize SpellChecker startAnalyticNN
20Csapi Initialize SpellChecker completeAnalyticNN
21Csapi open lexicon startAnalyticNN
22Csapi OpenLexicon completeAnalyticNN
23Csapi Get options startAnalyticNN
24Csapi Get options completeAnalyticNN
25Csapi Set options startAnalyticNN
26Csapi Set options completeAnalyticNN
27Csapi terminate spell checker startAnalyticNN
28Csapi terminate spell checker completeAnalyticNN
29Csapi close lexicon startAnalyticNN
30Csapi close lexicon completeAnalyticNN
31EnumOptionDescription next OptionDescription startAnalyticNN
32EnumOptionDescription next OptionDescription stopAnalyticNN
33Failed to add hardcoded change pair "First -> Second" to engine: hr.ApplicationNN
34Comprehensive check startAnalyticNN
35Comprehensive check completeAnalyticNN

Event ID 1: Add word start

#
Channel
Analytic
Task
ModifyWordlist
Opcode
Start

Fields #

NameDescription
WordlistType UInt32

Event ID 2: Add word complete

#
Channel
Analytic
Task
ModifyWordlist
Opcode
Stop

Fields #

NameDescription
WordlistType UInt32

Event ID 3: Check start

#
Channel
Analytic
Task
Checkspelling
Opcode
Start

Event ID 4: Check complete

#
Channel
Analytic
Task
Checkspelling
Opcode
Stop

Event ID 5: Create SpellChecker start

#
Channel
Analytic
Task
Setup
Opcode
Start

Event ID 6: Create SpellChecker complete

#
Channel
Analytic
Task
Setup
Opcode
Stop

Event ID 7: Suggest start

#
Channel
Analytic
Task
GetSuggestions
Opcode
Start

Event ID 8: Suggest complete

#
Channel
Analytic
Task
GetSuggestions
Opcode
Stop

Event ID 9: EnumSpellingError Next Start

#
Channel
Analytic
Task
Checkspelling
Opcode
Start

Event ID 10: EnumSpellingError Next Stop

#
Channel
Analytic
Task
Checkspelling
Opcode
Stop

Event ID 11: SupportedLanguages complete

#
Channel
Analytic
Opcode
Start

Event ID 12: SupportedLanguages start

#
Channel
Analytic
Opcode
Stop

Event ID 13: Csapi Suggest start

#
Channel
Analytic
Task
GetSuggestions
Opcode
Start

Event ID 14: Csapi Suggest Complete

#
Channel
Analytic
Task
GetSuggestions
Opcode
Stop

Event ID 15: Csapi Check Start

#
Channel
Analytic
Task
Checkspelling
Opcode
Start

Event ID 16: Csapi Check complete

#
Channel
Analytic
Task
Checkspelling
Opcode
Stop

Event ID 17: Csapi Add word start

#
Channel
Analytic
Task
ModifyWordlist
Opcode
Start

Event ID 18: Csapi Add Word complete

#
Channel
Analytic
Task
ModifyWordlist
Opcode
Stop

Event ID 19: Csapi Initialize SpellChecker start

#
Channel
Analytic
Task
Setup
Opcode
Start

Event ID 20: Csapi Initialize SpellChecker complete

#
Channel
Analytic
Task
Setup
Opcode
Stop

Event ID 21: Csapi open lexicon start

#
Channel
Analytic
Task
Setup
Opcode
Start

Event ID 22: Csapi OpenLexicon complete

#
Channel
Analytic
Task
Setup
Opcode
Stop

Event ID 23: Csapi Get options start

#
Channel
Analytic
Task
SettingandGettingOptions
Opcode
Start

Event ID 24: Csapi Get options complete

#
Channel
Analytic
Task
SettingandGettingOptions
Opcode
Stop

Event ID 25: Csapi Set options start

#
Channel
Analytic
Task
SettingandGettingOptions
Opcode
Start

Event ID 26: Csapi Set options complete

#
Channel
Analytic
Task
SettingandGettingOptions
Opcode
Stop

Event ID 27: Csapi terminate spell checker start

#
Channel
Analytic
Task
Teardown
Opcode
Start

Event ID 28: Csapi terminate spell checker complete

#
Channel
Analytic
Task
Teardown
Opcode
Stop

Event ID 29: Csapi close lexicon start

#
Channel
Analytic
Task
Teardown
Opcode
Start

Event ID 30: Csapi close lexicon complete

#
Channel
Analytic
Task
Teardown
Opcode
Stop

Event ID 31: EnumOptionDescription next OptionDescription start

#
Channel
Analytic
Task
SettingandGettingOptions
Opcode
Start

Event ID 32: EnumOptionDescription next OptionDescription stop

#
Channel
Analytic
Task
SettingandGettingOptions
Opcode
Stop

Event ID 33: Failed to add hardcoded change pair "First -> Second" to engine: hr.

#
Channel
Application
Task
Setup

Description

Failed to add hardcoded change pair "First -> Second" to engine: hr. The spell checker will still be available.

Message #

Failed to add hardcoded change pair "%1 -> %2" to engine: %3. The spell checker will still be available.

Fields #

NameDescription
First UnicodeString
Second UnicodeString
hr Int32

Event ID 34: Comprehensive check start

#
Channel
Analytic
Task
Checkspelling
Opcode
Start

Event ID 35: Comprehensive check complete

#
Channel
Analytic
Task
Checkspelling
Opcode
Stop

Provenance

ETW provider GUID b2fcd41f-9a40-4150-8c92-b224b7d8c8aa

Defined in MsSpellCheckingFacility.dll, which carries the event manifest.

  • WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB
  • Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB