detection.wiki

Microsoft-Windows-Wallet

EventTitleChannelSampleRule
100Launch StartOperationalNN
101Launch StopOperationalNN
102UI: Start: Create ItemOperationalNN
103UI: Stop : Create ItemOperationalNN
104UI: Start: Get Item ItemId.OperationalNN
105UI: Stop : Get Item ItemId.OperationalNN
106UI: Start: Delete ItemOperationalNN
107UI: Stop : Delete ItemOperationalNN
108UI: Start: Save ItemOperationalNN
109UI: Stop : Save ItemOperationalNN
201UI: Start: Get List ListType.OperationalNN
202UI: Stop : Get List ListType.OperationalNN
203UI: Start: Get Search List ListType.OperationalNN
204UI: Stop : Get Search List ListType.OperationalNN
303Core: Start: OpenDatabaseOperationalNN
304Core: Stop : OpenDatabaseOperationalNN
305Core: Start: GetList ListType.OperationalNN
306Core: Stop : GetList ListType.OperationalNN
307Core: Start: GetListWithParams ListType.OperationalNN
308Core: Stop : GetListWithParams ListType.OperationalNN
309Core: Start: GetProperty Item ItemId Property WalletItemPropertyType.OperationalNN
310Core: Stop : GetProperty Item ItemId Property WalletItemPropertyType.OperationalNN
311Core: Start: SetProperty Item ItemId Property WalletItemPropertyType.OperationalNN
312Core: Stop : SetProperty Item ItemId Property WalletItemPropertyType.OperationalNN
313Core: Start: ProcessPackageOperationalNN
314Core: Stop : ProcessPackageOperationalNN
315Core: Start: ProcessGeofencingOperationalNN
316Core: Stop : ProcessGeofencingOperationalNN

Event ID 100: Launch Start

#
Channel
Operational
Task
Launch
Opcode
Start

Event ID 101: Launch Stop

#
Channel
Operational
Task
Launch
Opcode
Stop

Event ID 102: UI: Start: Create Item

#
Channel
Operational
Task
Item_Create
Opcode
Start

Event ID 103: UI: Stop : Create Item

#
Channel
Operational
Task
Item_Create
Opcode
Stop

Event ID 104: UI: Start: Get Item ItemId.

#
Channel
Operational
Task
Item_Get
Opcode
Start

Message #

UI: Start: Get Item %1

Fields #

NameDescription
ItemId UnicodeString

Event ID 105: UI: Stop : Get Item ItemId.

#
Channel
Operational
Task
Item_Get
Opcode
Stop

Message #

UI: Stop : Get Item %1

Fields #

NameDescription
ItemId UnicodeString

Event ID 106: UI: Start: Delete Item

#
Channel
Operational
Task
Item_Delete
Opcode
Start

Event ID 107: UI: Stop : Delete Item

#
Channel
Operational
Task
Item_Delete
Opcode
Stop

Event ID 108: UI: Start: Save Item

#
Channel
Operational
Task
Item_Save
Opcode
Start

Event ID 109: UI: Stop : Save Item

#
Channel
Operational
Task
Item_Save
Opcode
Stop

Event ID 201: UI: Start: Get List ListType.

#
Channel
Operational
Task
List_Get
Opcode
Start

Message #

UI: Start: Get List %1

Fields #

NameDescription
ListType UInt32

Event ID 202: UI: Stop : Get List ListType.

#
Channel
Operational
Task
List_Get
Opcode
Stop

Message #

UI: Stop : Get List %1

Fields #

NameDescription
ListType UInt32

Event ID 203: UI: Start: Get Search List ListType.

#
Channel
Operational
Task
List_Get_Search
Opcode
Start

Message #

UI: Start: Get Search List %1

Fields #

NameDescription
ListType UInt32

Event ID 204: UI: Stop : Get Search List ListType.

#
Channel
Operational
Task
List_Get_Search
Opcode
Stop

Message #

UI: Stop : Get Search List %1

Fields #

NameDescription
ListType UInt32

Event ID 303: Core: Start: OpenDatabase

#
Channel
Operational
Task
Core_OpenDatabase
Opcode
Start

Event ID 304: Core: Stop : OpenDatabase

#
Channel
Operational
Task
Core_OpenDatabase
Opcode
Stop

Event ID 305: Core: Start: GetList ListType.

#
Channel
Operational
Task
Core_GetList
Opcode
Start

Message #

Core: Start: GetList %1

Fields #

NameDescription
ListType UInt32

Event ID 306: Core: Stop : GetList ListType.

#
Channel
Operational
Task
Core_GetList
Opcode
Stop

Message #

Core: Stop : GetList %1

Fields #

NameDescription
ListType UInt32

Event ID 307: Core: Start: GetListWithParams ListType.

#
Channel
Operational
Task
Core_GetListWithParams
Opcode
Start

Message #

Core: Start: GetListWithParams %1

Fields #

NameDescription
ListType UInt32

Event ID 308: Core: Stop : GetListWithParams ListType.

#
Channel
Operational
Task
Core_GetListWithParams
Opcode
Stop

Message #

Core: Stop : GetListWithParams %1

Fields #

NameDescription
ListType UInt32

Event ID 309: Core: Start: GetProperty Item ItemId Property WalletItemPropertyType.

#
Channel
Operational
Task
Core_GetProperty
Opcode
Start

Message #

Core: Start: GetProperty Item %1 Property %2

Fields #

NameDescription
ItemId HexInt64
WalletItemPropertyType UInt32

Event ID 310: Core: Stop : GetProperty Item ItemId Property WalletItemPropertyType.

#
Channel
Operational
Task
Core_GetProperty
Opcode
Stop

Message #

Core: Stop : GetProperty Item %1 Property %2

Fields #

NameDescription
ItemId HexInt64
WalletItemPropertyType UInt32

Event ID 311: Core: Start: SetProperty Item ItemId Property WalletItemPropertyType.

#
Channel
Operational
Task
Core_SetProperty
Opcode
Start

Message #

Core: Start: SetProperty Item %1 Property %2

Fields #

NameDescription
ItemId HexInt64
WalletItemPropertyType UInt32

Event ID 312: Core: Stop : SetProperty Item ItemId Property WalletItemPropertyType.

#
Channel
Operational
Task
Core_SetProperty
Opcode
Stop

Message #

Core: Stop : SetProperty Item %1 Property %2

Fields #

NameDescription
ItemId HexInt64
WalletItemPropertyType UInt32

Event ID 313: Core: Start: ProcessPackage

#
Channel
Operational
Task
Core_ProcessPackage
Opcode
Start

Event ID 314: Core: Stop : ProcessPackage

#
Channel
Operational
Task
Core_ProcessPackage
Opcode
Stop

Event ID 315: Core: Start: ProcessGeofencing

#
Channel
Operational
Task
Core_ProcessGeofencing
Opcode
Start

Event ID 316: Core: Stop : ProcessGeofencing

#
Channel
Operational
Task
Core_ProcessGeofencing
Opcode
Stop

Provenance

ETW provider GUID 6ed11b00-c1b5-48cb-aecc-ff72ebefbae8

Defined in WalletService.dll, which carries the event manifest.

  • WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB
  • Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB