Microsoft-Windows-TSF-msctf

Event	Title	Channel	Sample	Rule
1	InitMSCTFForProcess	Diagnostic	Y	N
2	InitMSCTFForProcess	Diagnostic	Y	N
3	UninitMSCTFForProcess	Diagnostic	Y	N
4	UninitMSCTFForProcess	Diagnostic	Y	N
5	ActivateCiceroForThread	Diagnostic	Y	N
6	ActivateCiceroForThread	Diagnostic	N	N
7	ActivateCiceroForThread	Diagnostic	Y	N
8	DeactivateCiceroForThread	Diagnostic	Y	N
9	DeactivateCiceroForThread	Diagnostic	Y	N
10	FLSCallback	Diagnostic	Y	N
11	FLSCallback	Diagnostic	Y	N
12	ConnectServer	Diagnostic	Y	N
13	ConnectServer	Diagnostic	Y	N
14	ConnectServer	Diagnostic	Y	N
15	task_0	Diagnostic	Y	N
16	CreateMessageWindow	Diagnostic	Y	N
17	CreateMessageWindow17	Diagnostic	N	N
18	task_018	Diagnostic	Y	N
19	ActivateTIPStart	Diagnostic	N	N
20	ActivateTIPStop	Diagnostic	N	N
21	DeactivateTIPStart	Diagnostic	N	N
22	DeactivateTIPStop	Diagnostic	N	N
23	CheckLastWindowDestroyedStart	Diagnostic	N	N
24	CheckLastWindowDestroyedStop	Diagnostic	N	N
25	CreateAssemblyListStart	Diagnostic	N	N
26	CreateAssemblyListStop	Diagnostic	N	N
27	LoadAssemblyListStart	Diagnostic	N	N
28	LoadAssemblyListStop	Diagnostic	N	N
29	ActivateAssemblyStart	Diagnostic	N	N
30	ActivateAssemblyStop	Diagnostic	N	N
31	HandleThreadInputFocusEventStart	Diagnostic	Y	N
32	HandleThreadInputFocusEventStop	Diagnostic	Y	N
33	HandleGlobalInputFocusEventStart	Diagnostic	N	N
34	HandleGlobalInputFocusEventStop	Diagnostic	N	N
35	SendNotification	Diagnostic	Y	N
36	SendSyncRequest	Diagnostic	Y	N
37	SendSyncRequest	Diagnostic	Y	N
38	SendAsyncRequestStart	Diagnostic	Y	N
39	SendAsyncRequestStop	Diagnostic	Y	N
40	ReceiveALPCMessagesStart	Diagnostic	Y	N
41	ReceiveALPCMessagesStop	Diagnostic	Y	N
42	ProcessALPCMessageStart	Diagnostic	Y	N
43	ProcessALPCMessageStop	Diagnostic	N	N
44	ProcessALPCMessageStop44	Diagnostic	Y	N
45	ProcessALPCMessageReply	Diagnostic	N	N
46	CreateLangBarItemMgrStart	Diagnostic	N	N
47	CreateLangBarItemMgrStop	Diagnostic	N	N
48	GetIconFromFileStart	Diagnostic	N	N
49	GetIconFromFileStop	Diagnostic	N	N
50	CreateBitmapStart	Diagnostic	N	N
51	CreateBitmapStop	Diagnostic	N	N
52	ITfThreadFocusSink_OnSetThreadFocusStart	Diagnostic	N	N
53	ITfThreadFocusSink_OnSetThreadFocusStop	Diagnostic	N	N
54	ITfThreadFocusSink_OnKillThreadFocusStart	Diagnostic	N	N
55	ITfThreadFocusSink_OnKillThreadFocusStop	Diagnostic	N	N
56	ITfThreadMgrEventSink_OnSetFocusStart	Diagnostic	Y	N
57	ITfThreadMgrEventSink_OnSetFocusStop	Diagnostic	Y	N
58	CiceroServerStart	Diagnostic	N	N
59	CiceroServerStop	Diagnostic	N	N
60	CiceroServer	Diagnostic	N	N
61	CiceroServer61	Diagnostic	N	N
62	CiceroServer62	Diagnostic	N	N
63	CiceroServer63	Diagnostic	N	N
64	task_064	Diagnostic	N	N
65	IMELocalServer	Diagnostic	N	N
66	IMELocalServer66	Diagnostic	N	N
67	IMELocalServer67	Diagnostic	N	N
68	IMELocalServer68	Diagnostic	N	N
69	IMELocalServer69	Diagnostic	N	N
70	IMELocalServer70	Diagnostic	N	N
71	IMELocalServerStart	Diagnostic	N	N
72	IMELocalServerStop	Diagnostic	N	N
73	InputProfileActivation	Diagnostic	N	N
74	InputProfileActivation74	Diagnostic	N	N
75	InputProfileActivation75	Diagnostic	N	N
76	InputProfileDeactivation	Diagnostic	N	N
77	InputProfileDeactivation77	Diagnostic	N	N
78	InputProfileDeactivation78	Diagnostic	N	N
79	DocumentFocusChange	Diagnostic	N	N
80	DocumentFocusChange80	Diagnostic	N	N
81	DocumentFocusChange81	Diagnostic	N	N
82	DocumentFocusChange82	Diagnostic	N	N
83	DocumentContentChange	Diagnostic	N	N
84	DocumentContentChange84	Diagnostic	N	N
85	DocumentContentChange85	Diagnostic	N	N
86	DocumentContentChange86	Diagnostic	N	N
87	KeyboardEventHandling	Diagnostic	N	N
88	KeyboardEventHandling88	Diagnostic	N	N
89	KeyboardEventHandling89	Diagnostic	N	N
90	KeyboardEventHandling90	Diagnostic	N	N
91	KeyboardEventHandling91	Diagnostic	N	N
92	KeyboardEventHandling92	Diagnostic	N	N
93	KeyboardEventHandling93	Diagnostic	N	N
94	KeyboardEventHandling94	Diagnostic	N	N
95	KeyboardEventHandling95	Diagnostic	N	N

Event ID 1: InitMSCTFForProcess

Channel: Diagnostic
Level: Informational
Task: InitMSCTFForProcess
Opcode: Start

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-TSF-msctf",
    "guid": "{4FBA1227-F606-4E5F-B9E8-FAB9AB5740F3}",
    "event_source_name": "",
    "event_id": 1,
    "version": 0,
    "level": 4,
    "task": 1,
    "opcode": 1,
    "keywords": "0x0000000000020000",
    "time_created": "2026-06-02T05:32:12.637+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 9660,
      "thread_id": 16940
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": "InitMSCTFForProcess"
}

Event ID 2: InitMSCTFForProcess

Channel: Diagnostic
Level: Informational
Task: InitMSCTFForProcess
Opcode: Stop

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-TSF-msctf",
    "guid": "{4FBA1227-F606-4E5F-B9E8-FAB9AB5740F3}",
    "event_source_name": "",
    "event_id": 2,
    "version": 0,
    "level": 4,
    "task": 1,
    "opcode": 2,
    "keywords": "0x0000000000020000",
    "time_created": "2026-06-02T05:32:12.637+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 9660,
      "thread_id": 16940
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": "InitMSCTFForProcess"
}

Event ID 3: UninitMSCTFForProcess

Channel: Diagnostic
Level: Informational
Task: UninitMSCTFForProcess
Opcode: Start

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-TSF-msctf",
    "guid": "{4FBA1227-F606-4E5F-B9E8-FAB9AB5740F3}",
    "event_source_name": "",
    "event_id": 3,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 1,
    "keywords": "0x0000000000020000",
    "time_created": "2026-06-02T06:05:39.831+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 14036,
      "thread_id": 8384
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": "UninitMSCTFForProcess"
}

Event ID 4: UninitMSCTFForProcess

Channel: Diagnostic
Level: Informational
Task: UninitMSCTFForProcess
Opcode: Stop

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-TSF-msctf",
    "guid": "{4FBA1227-F606-4E5F-B9E8-FAB9AB5740F3}",
    "event_source_name": "",
    "event_id": 4,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 2,
    "keywords": "0x0000000000020000",
    "time_created": "2026-06-02T06:05:39.831+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 14036,
      "thread_id": 8384
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": "UninitMSCTFForProcess"
}

Event ID 5: ActivateCiceroForThread

Channel: Diagnostic
Also via: realtime ETW trace
Level: Informational
Task: ActivateCiceroForThread
Opcode: Start

Fields #

Name	Description
`thread_flags` UInt32
`activation_flags` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-TSF-msctf",
    "guid": "{4FBA1227-F606-4E5F-B9E8-FAB9AB5740F3}",
    "event_source_name": "",
    "event_id": 5,
    "version": 0,
    "level": 4,
    "task": 3,
    "opcode": 1,
    "keywords": "0x0000000000020000",
    "time_created": "2026-06-02T06:05:39.495+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 8468,
      "thread_id": 17036
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "activation_flags": 2147483681,
    "thread_flags": 0
  },
  "message": "ActivateCiceroForThread"
}

Event ID 6: ActivateCiceroForThread

Channel: Diagnostic
Task: ActivateCiceroForThread

Event ID 7: ActivateCiceroForThread

Channel: Diagnostic
Also via: realtime ETW trace
Level: Informational
Task: ActivateCiceroForThread
Opcode: Stop

Fields #

Name	Description
`thread_flags` UInt32
`activation_flags` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-TSF-msctf",
    "guid": "{4FBA1227-F606-4E5F-B9E8-FAB9AB5740F3}",
    "event_source_name": "",
    "event_id": 7,
    "version": 0,
    "level": 4,
    "task": 3,
    "opcode": 2,
    "keywords": "0x0000000000020000",
    "time_created": "2026-06-02T06:05:39.502+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 8468,
      "thread_id": 17036
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "activation_flags": 0,
    "thread_flags": 33
  },
  "message": "ActivateCiceroForThread"
}

Event ID 8: DeactivateCiceroForThread

Channel: Diagnostic
Level: Informational
Task: DeactivateCiceroForThread
Opcode: Start

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-TSF-msctf",
    "guid": "{4FBA1227-F606-4E5F-B9E8-FAB9AB5740F3}",
    "event_source_name": "",
    "event_id": 8,
    "version": 0,
    "level": 4,
    "task": 4,
    "opcode": 1,
    "keywords": "0x0000000000020000",
    "time_created": "2026-06-02T06:05:40.074+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 8468,
      "thread_id": 17036
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": "DeactivateCiceroForThread"
}

Event ID 9: DeactivateCiceroForThread

Channel: Diagnostic
Level: Informational
Task: DeactivateCiceroForThread
Opcode: Stop

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-TSF-msctf",
    "guid": "{4FBA1227-F606-4E5F-B9E8-FAB9AB5740F3}",
    "event_source_name": "",
    "event_id": 9,
    "version": 0,
    "level": 4,
    "task": 4,
    "opcode": 2,
    "keywords": "0x0000000000020000",
    "time_created": "2026-06-02T06:05:40.074+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 8468,
      "thread_id": 17036
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": "DeactivateCiceroForThread"
}

Event ID 10: FLSCallback

Channel: Diagnostic
Level: Informational
Task: FLSCallback
Opcode: Start

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-TSF-msctf",
    "guid": "{4FBA1227-F606-4E5F-B9E8-FAB9AB5740F3}",
    "event_source_name": "",
    "event_id": 10,
    "version": 0,
    "level": 4,
    "task": 6,
    "opcode": 1,
    "keywords": "0x0000000000020000",
    "time_created": "2026-06-02T06:05:40.072+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 8468,
      "thread_id": 17036
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": "FLSCallback"
}

Event ID 11: FLSCallback

Channel: Diagnostic
Level: Informational
Task: FLSCallback
Opcode: Stop

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-TSF-msctf",
    "guid": "{4FBA1227-F606-4E5F-B9E8-FAB9AB5740F3}",
    "event_source_name": "",
    "event_id": 11,
    "version": 0,
    "level": 4,
    "task": 6,
    "opcode": 2,
    "keywords": "0x0000000000020000",
    "time_created": "2026-06-02T06:05:40.075+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 8468,
      "thread_id": 17036
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": "FLSCallback"
}

Event ID 12: ConnectServer

Channel: Diagnostic
Level: Informational
Task: ConnectServer
Opcode: Start

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-TSF-msctf",
    "guid": "{4FBA1227-F606-4E5F-B9E8-FAB9AB5740F3}",
    "event_source_name": "",
    "event_id": 12,
    "version": 0,
    "level": 4,
    "task": 7,
    "opcode": 1,
    "keywords": "0x0000000000220000",
    "time_created": "2026-06-02T06:05:39.496+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 8468,
      "thread_id": 17036
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": "ConnectServer"
}

Event ID 13: ConnectServer

Channel: Diagnostic
Level: Warning
Task: ConnectServer

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-TSF-msctf/Diagnostic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 13,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 1616,
      "thread_id": 11744
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft-Windows-TSF-msctf",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 01:59:07.108Z",
    "version": 0
  },
  "event_data": {},
  "message": ""
}

Event ID 14: ConnectServer

Channel: Diagnostic
Level: Informational
Task: ConnectServer
Opcode: Stop

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-TSF-msctf",
    "guid": "{4FBA1227-F606-4E5F-B9E8-FAB9AB5740F3}",
    "event_source_name": "",
    "event_id": 14,
    "version": 0,
    "level": 4,
    "task": 7,
    "opcode": 2,
    "keywords": "0x0000000000220000",
    "time_created": "2026-06-02T06:05:39.497+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 8468,
      "thread_id": 17036
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": "ConnectServer"
}

Event ID 15: task_0

Channel: Diagnostic
Level: Informational
Opcode: Info

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-TSF-msctf",
    "guid": "{4FBA1227-F606-4E5F-B9E8-FAB9AB5740F3}",
    "event_source_name": "",
    "event_id": 15,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": "0x0000000000210000",
    "time_created": "2026-06-02T06:05:39.500+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 8468,
      "thread_id": 17036
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": ""
}

Event ID 16: CreateMessageWindow

Channel: Diagnostic
Level: Informational
Task: CreateMessageWindow
Opcode: win:Info

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-TSF-msctf",
    "guid": "{4FBA1227-F606-4E5F-B9E8-FAB9AB5740F3}",
    "event_source_name": "",
    "event_id": 16,
    "version": 0,
    "level": 4,
    "task": 17,
    "opcode": 0,
    "keywords": "0x0000000000010000",
    "time_created": "2026-06-02T06:05:39.496+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 8468,
      "thread_id": 17036
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": "CreateMessageWindow"
}

Event ID 17: CreateMessageWindow17

Channel: Diagnostic
Task: CreateMessageWindow

Event ID 18: task_018

Channel: Diagnostic
Level: Informational
Opcode: Info

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-TSF-msctf",
    "guid": "{4FBA1227-F606-4E5F-B9E8-FAB9AB5740F3}",
    "event_source_name": "",
    "event_id": 18,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": "0x0000000000010000",
    "time_created": "2026-06-02T06:05:39.499+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 8468,
      "thread_id": 17036
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": ""
}

Event ID 19: ActivateTIPStart

Channel: Diagnostic
Task: ActivateTIP
Opcode: Start

Fields #

Name	Description
`guid` GUID

Event ID 20: ActivateTIPStop

Channel: Diagnostic
Task: ActivateTIP
Opcode: Stop

Fields #

Name	Description
`guid` GUID

Event ID 21: DeactivateTIPStart

Channel: Diagnostic
Task: DeactivateTIP
Opcode: Start

Fields #

Name	Description
`guid` GUID

Event ID 22: DeactivateTIPStop

Channel: Diagnostic
Task: DeactivateTIP
Opcode: Stop

Fields #

Name	Description
`guid` GUID

Event ID 23: CheckLastWindowDestroyedStart

Channel: Diagnostic
Task: CheckLastWindowDestroyed
Opcode: Start

Event ID 24: CheckLastWindowDestroyedStop

Channel: Diagnostic
Task: CheckLastWindowDestroyed
Opcode: Stop

Event ID 25: CreateAssemblyListStart

Channel: Diagnostic
Task: CreateAssemblyList
Opcode: Start

Event ID 26: CreateAssemblyListStop

Channel: Diagnostic
Task: CreateAssemblyList
Opcode: Stop

Event ID 27: LoadAssemblyListStart

Channel: Diagnostic
Task: LoadAssemblyList
Opcode: Start

Event ID 28: LoadAssemblyListStop

Channel: Diagnostic
Task: LoadAssemblyList
Opcode: Stop

Event ID 29: ActivateAssemblyStart

Channel: Diagnostic
Task: ActivateAssembly
Opcode: Start

Fields #

Name	Description
`LANGID` UInt32

Event ID 30: ActivateAssemblyStop

Channel: Diagnostic
Task: ActivateAssembly
Opcode: Stop

Fields #

Name	Description
`LANGID` UInt32

Event ID 31: HandleThreadInputFocusEventStart

Channel: Diagnostic
Level: Informational
Task: HandleThreadInputFocusEvent
Opcode: Start

Fields #

Name	Description
`event` UInt32
`hwnd` Pointer
`flags` UInt32
`event_order` UInt32

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-TSF-msctf/Diagnostic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 31,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 8716,
      "thread_id": 8708
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 1,
    "provider": "Microsoft-Windows-TSF-msctf",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 01:59:01.581Z",
    "version": 0
  },
  "event_data": {
    "event": 2147483651,
    "event_order": 11822,
    "flags": 1,
    "hwnd": "0x0"
  },
  "message": ""
}

Event ID 32: HandleThreadInputFocusEventStop

Channel: Diagnostic
Level: Informational
Task: HandleThreadInputFocusEvent
Opcode: Stop

Fields #

Name	Description
`hwnd` Pointer

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-TSF-msctf/Diagnostic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 32,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 8716,
      "thread_id": 8708
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 2,
    "provider": "Microsoft-Windows-TSF-msctf",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 01:59:01.581Z",
    "version": 0
  },
  "event_data": {
    "hwnd": "0x0"
  },
  "message": ""
}

Event ID 33: HandleGlobalInputFocusEventStart

Channel: Diagnostic
Task: HandleGlobalInputFocusEvent
Opcode: Start

Fields #

Name	Description
`event` UInt32
`hwnd` Pointer
`flags` UInt32
`event_order` UInt32

Event ID 34: HandleGlobalInputFocusEventStop

Channel: Diagnostic
Task: HandleGlobalInputFocusEvent
Opcode: Stop

Event ID 35: SendNotification

Channel: Diagnostic
Also via: realtime ETW trace
Level: Informational
Task: SendNotification
Opcode: Send

Fields #

Name	Description
`message` UInt32
`target_tid` UInt32
`params` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-TSF-msctf",
    "guid": "{4FBA1227-F606-4E5F-B9E8-FAB9AB5740F3}",
    "event_source_name": "",
    "event_id": 35,
    "version": 0,
    "level": 4,
    "task": 19,
    "opcode": 9,
    "keywords": "0x0000000000200000",
    "time_created": "2026-06-02T06:05:39.502+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 8468,
      "thread_id": 17036
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "message": 16777242,
    "params": 8,
    "target_tid": 0
  },
  "message": "SendNotification"
}

Event ID 36: SendSyncRequest

Channel: Diagnostic
Also via: realtime ETW trace
Level: Informational
Task: SendSyncRequest
Opcode: Suspend

Fields #

Name	Description
`message` UInt32
`target_tid` UInt32
`params` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-TSF-msctf",
    "guid": "{4FBA1227-F606-4E5F-B9E8-FAB9AB5740F3}",
    "event_source_name": "",
    "event_id": 36,
    "version": 0,
    "level": 4,
    "task": 20,
    "opcode": 8,
    "keywords": "0x0000000000200000",
    "time_created": "2026-06-02T06:05:39.498+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 8468,
      "thread_id": 17036
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "message": 21,
    "params": 0,
    "target_tid": 0
  },
  "message": "SendSyncRequest"
}

Event ID 37: SendSyncRequest

Channel: Diagnostic
Level: Informational
Task: SendSyncRequest
Opcode: Resume

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-TSF-msctf",
    "guid": "{4FBA1227-F606-4E5F-B9E8-FAB9AB5740F3}",
    "event_source_name": "",
    "event_id": 37,
    "version": 0,
    "level": 4,
    "task": 20,
    "opcode": 7,
    "keywords": "0x0000000000200000",
    "time_created": "2026-06-02T06:05:39.499+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 8468,
      "thread_id": 17036
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": "SendSyncRequest"
}

Event ID 38: SendAsyncRequestStart

Channel: Diagnostic
Level: Informational
Task: SendAsyncRequest
Opcode: Start

Fields #

Name	Description
`message` UInt32
`target_tid` UInt32
`params` UInt32

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-TSF-msctf/Diagnostic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 38,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 10476,
      "thread_id": 10580
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 1,
    "provider": "Microsoft-Windows-TSF-msctf",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 01:59:01.630Z",
    "version": 0
  },
  "event_data": {
    "message": 2684354601,
    "params": 2,
    "target_tid": 6520
  },
  "message": ""
}

Event ID 39: SendAsyncRequestStop

Channel: Diagnostic
Level: Informational
Task: SendAsyncRequest
Opcode: Stop

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-TSF-msctf/Diagnostic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 39,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 10476,
      "thread_id": 10580
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 2,
    "provider": "Microsoft-Windows-TSF-msctf",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 01:59:01.630Z",
    "version": 0
  },
  "event_data": {},
  "message": ""
}

Event ID 40: ReceiveALPCMessagesStart

Channel: Diagnostic
Level: Informational
Task: ReceiveALPCMessages
Opcode: Start

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-TSF-msctf/Diagnostic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 40,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 10476,
      "thread_id": 10580
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 1,
    "provider": "Microsoft-Windows-TSF-msctf",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 01:59:01.630Z",
    "version": 0
  },
  "event_data": {},
  "message": ""
}

Event ID 41: ReceiveALPCMessagesStop

Channel: Diagnostic
Level: Informational
Task: ReceiveALPCMessages
Opcode: Stop

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-TSF-msctf/Diagnostic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 41,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 10476,
      "thread_id": 10580
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 2,
    "provider": "Microsoft-Windows-TSF-msctf",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 01:59:01.630Z",
    "version": 0
  },
  "event_data": {},
  "message": ""
}

Event ID 42: ProcessALPCMessageStart

Channel: Diagnostic
Level: Informational
Task: ProcessALPCMessage
Opcode: Start

Fields #

Name	Description
`message` UInt32
`target_tid` UInt32
`params` UInt32

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-TSF-msctf/Diagnostic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 42,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 10476,
      "thread_id": 10580
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 1,
    "provider": "Microsoft-Windows-TSF-msctf",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 01:59:01.630Z",
    "version": 0
  },
  "event_data": {
    "message": 536870953,
    "params": 2,
    "target_tid": 10580
  },
  "message": ""
}

Event ID 43: ProcessALPCMessageStop

Channel: Diagnostic
Task: ProcessALPCMessage
Opcode: Stop

Fields #

Name	Description
`param` UInt32

Event ID 44: ProcessALPCMessageStop44

Channel: Diagnostic
Level: Informational
Task: ProcessALPCMessage
Opcode: Stop

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-TSF-msctf/Diagnostic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 44,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 10476,
      "thread_id": 10580
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 2,
    "provider": "Microsoft-Windows-TSF-msctf",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 01:59:01.630Z",
    "version": 0
  },
  "event_data": {},
  "message": ""
}

Event ID 45: ProcessALPCMessageReply

Channel: Diagnostic
Task: ProcessALPCMessage
Opcode: Reply

Fields #

Name	Description
`message` UInt32
`target_tid` UInt32
`params` UInt32
`hr` UInt32

Event ID 46: CreateLangBarItemMgrStart

Channel: Diagnostic
Task: CreateLangBarItemMgr
Opcode: Start

Event ID 47: CreateLangBarItemMgrStop

Channel: Diagnostic
Task: CreateLangBarItemMgr
Opcode: Stop

Event ID 48: GetIconFromFileStart

Channel: Diagnostic
Task: GetIconFromFile
Opcode: Start

Event ID 49: GetIconFromFileStop

Channel: Diagnostic
Task: GetIconFromFile
Opcode: Stop

Event ID 50: CreateBitmapStart

Channel: Diagnostic
Task: CreateBitmap
Opcode: Start

Event ID 51: CreateBitmapStop

Channel: Diagnostic
Task: CreateBitmap
Opcode: Stop

Event ID 52: ITfThreadFocusSink_OnSetThreadFocusStart

Channel: Diagnostic
Task: ITfThreadFocusSink_OnSetThreadFocus
Opcode: Start

Fields #

Name	Description
`param` UInt32

Event ID 53: ITfThreadFocusSink_OnSetThreadFocusStop

Channel: Diagnostic
Task: ITfThreadFocusSink_OnSetThreadFocus
Opcode: Stop

Fields #

Name	Description
`param` UInt32

Event ID 54: ITfThreadFocusSink_OnKillThreadFocusStart

Channel: Diagnostic
Task: ITfThreadFocusSink_OnKillThreadFocus
Opcode: Start

Fields #

Name	Description
`param` UInt32

Event ID 55: ITfThreadFocusSink_OnKillThreadFocusStop

Channel: Diagnostic
Task: ITfThreadFocusSink_OnKillThreadFocus
Opcode: Stop

Fields #

Name	Description
`param` UInt32

Event ID 56: ITfThreadMgrEventSink_OnSetFocusStart

Channel: Diagnostic
Level: Informational
Task: ITfThreadMgrEventSink_OnSetFocus
Opcode: Start

Fields #

Name	Description
`pdimNewFocus` Pointer
`pdimPrevFocus` Pointer

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-TSF-msctf/Diagnostic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 56,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 336,
      "thread_id": 6520
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 1,
    "provider": "Microsoft-Windows-TSF-msctf",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 01:59:01.625Z",
    "version": 0
  },
  "event_data": {
    "pdimNewFocus": "0x1A5A3F0",
    "pdimPrevFocus": "0x0"
  },
  "message": ""
}

Event ID 57: ITfThreadMgrEventSink_OnSetFocusStop

Channel: Diagnostic
Level: Informational
Task: ITfThreadMgrEventSink_OnSetFocus
Opcode: Stop

Fields #

Name	Description
`pdimNewFocus` Pointer
`pdimPrevFocus` Pointer

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-TSF-msctf/Diagnostic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 57,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 336,
      "thread_id": 6520
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 2,
    "provider": "Microsoft-Windows-TSF-msctf",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 01:59:01.625Z",
    "version": 0
  },
  "event_data": {
    "pdimNewFocus": "0x1A5A3F0",
    "pdimPrevFocus": "0x0"
  },
  "message": ""
}

Event ID 58: CiceroServerStart

Channel: Diagnostic
Task: CiceroServer
Opcode: Start

Fields #

Name	Description
`param` UInt32

Event ID 59: CiceroServerStop

Channel: Diagnostic
Task: CiceroServer
Opcode: Stop

Fields #

Name	Description
`param` UInt32

Event ID 60: CiceroServer

Channel: Diagnostic
Task: CiceroServer

Event ID 61: CiceroServer61

Channel: Diagnostic
Task: CiceroServer

Event ID 62: CiceroServer62

Channel: Diagnostic
Task: CiceroServer

Event ID 63: CiceroServer63

Channel: Diagnostic
Task: CiceroServer

Event ID 64: task_064

Channel: Diagnostic
Opcode: Info

Fields #

Name	Description
`param` UInt32

Event ID 65: IMELocalServer

Channel: Diagnostic
Task: IMELocalServer

Fields #

Name	Description
`guid` GUID

Event ID 66: IMELocalServer66

Channel: Diagnostic
Task: IMELocalServer

Fields #

Name	Description
`guid` GUID

Event ID 67: IMELocalServer67

Channel: Diagnostic
Task: IMELocalServer

Fields #

Name	Description
`guid` GUID

Event ID 68: IMELocalServer68

Channel: Diagnostic
Task: IMELocalServer

Fields #

Name	Description
`guid` GUID

Event ID 69: IMELocalServer69

Channel: Diagnostic
Task: IMELocalServer

Fields #

Name	Description
`guid` GUID

Event ID 70: IMELocalServer70

Channel: Diagnostic
Task: IMELocalServer

Fields #

Name	Description
`guid` GUID

Event ID 71: IMELocalServerStart

Channel: Diagnostic
Task: IMELocalServer
Opcode: Start

Event ID 72: IMELocalServerStop

Channel: Diagnostic
Task: IMELocalServer
Opcode: Stop

Event ID 73: InputProfileActivation

Channel: Diagnostic
Task: InputProfileActivation

Event ID 74: InputProfileActivation74

Channel: Diagnostic
Task: InputProfileActivation

Fields #

Name	Description
`param` UInt32

Event ID 75: InputProfileActivation75

Channel: Diagnostic
Task: InputProfileActivation

Fields #

Name	Description
`guid` GUID
`langid` UInt16

Event ID 76: InputProfileDeactivation

Channel: Diagnostic
Task: InputProfileDeactivation

Event ID 77: InputProfileDeactivation77

Channel: Diagnostic
Task: InputProfileDeactivation

Fields #

Name	Description
`param` UInt32

Event ID 78: InputProfileDeactivation78

Channel: Diagnostic
Task: InputProfileDeactivation

Event ID 79: DocumentFocusChange

Channel: Diagnostic
Task: DocumentFocusChange

Fields #

Name	Description
`DocId` UInt32
`DocThread` UInt32
`GainFocus` Boolean

Event ID 80: DocumentFocusChange80

Channel: Diagnostic
Task: DocumentFocusChange

Fields #

Name	Description
`thread` UInt32
`document` UInt32

Event ID 81: DocumentFocusChange81

Channel: Diagnostic
Task: DocumentFocusChange

Fields #

Name	Description
`thread` UInt32
`document` UInt32

Event ID 82: DocumentFocusChange82

Channel: Diagnostic
Task: DocumentFocusChange

Fields #

Name	Description
`boolean` Boolean

Event ID 83: DocumentContentChange

Channel: Diagnostic
Task: DocumentContentChange

Event ID 84: DocumentContentChange84

Channel: Diagnostic
Task: DocumentContentChange

Fields #

Name	Description
`param` UInt32

Event ID 85: DocumentContentChange85

Channel: Diagnostic
Task: DocumentContentChange

Fields #

Name	Description
`param` UInt32

Event ID 86: DocumentContentChange86

Channel: Diagnostic
Task: DocumentContentChange

Event ID 87: KeyboardEventHandling

Channel: Diagnostic
Task: KeyboardEventHandling

Event ID 88: KeyboardEventHandling88

Channel: Diagnostic
Task: KeyboardEventHandling

Event ID 89: KeyboardEventHandling89

Channel: Diagnostic
Task: KeyboardEventHandling

Fields #

Name	Description
`boolean` Boolean

Event ID 90: KeyboardEventHandling90

Channel: Diagnostic
Task: KeyboardEventHandling

Event ID 91: KeyboardEventHandling91

Channel: Diagnostic
Task: KeyboardEventHandling

Event ID 92: KeyboardEventHandling92

Channel: Diagnostic
Task: KeyboardEventHandling

Event ID 93: KeyboardEventHandling93

Channel: Diagnostic
Task: KeyboardEventHandling

Event ID 94: KeyboardEventHandling94

Channel: Diagnostic
Task: KeyboardEventHandling

Event ID 95: KeyboardEventHandling95

Channel: Diagnostic
Task: KeyboardEventHandling

Provenance

ETW provider GUID {4FBA1227-F606-4E5F-B9E8-FAB9AB5740F3}

Defined in msctf.dll, which carries the event manifest.

WS2022-20348.4893, sample captured from a live trace, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB
Win11-26200.6584, sample captured from a live trace, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB
WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB
Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB