detection.wiki

Microsoft-Windows-Wordpad

EventTitleChannelSampleRule
1Intializing current instance of the applicationDebugNN
2Exiting current Instance of the applicationDebugNN
3Failed to InitializeDebugNN
4OLE initialization failedDebugNN
5Failed to load msftedit.DebugNN
6Wordpad is initialized as OLE ServerDebugNN
7Creation of Window:StringParam failed.DebugNN
8Intent Load Failed: StringParam.DebugNN
9New Document Failed: StringParam.DebugNN
10Create Font Indirect FailedDebugNN
11Insert Picture Failed with HRESULT:HResultParam.DebugNN
12Insert Picture Failed with HRESULT:HResultParam and Msg:StringParam.DebugNN
13GDIPlus Error:StringParam.DebugNN
14Wordpad Launch Start.DiagnosticNN
15Wordpad Launch End.DiagnosticNN
16Insert Picture Start.DiagnosticNN
17Insert Picture End.DiagnosticNN
18Resize Picture Start.DiagnosticNN
19Resize Picture End.DiagnosticNN
20StringParam failed since the system is low on memory.AdminNN
21Msg:StringParam .DebugNN
22Msg:StringParam .DebugNN
23Live Preview Show (Type: Live Preview Type) Start.DiagnosticNN
24Live Preview Show End.DiagnosticNN
25Live Preview Cancel (Type: Live Preview Type) Start.DiagnosticNN
26Live Preview Cancel End.DiagnosticNN
27Live Preview Execute (Type: Live Preview Type) Start.DiagnosticNN
28Live Preview Execute End.DiagnosticNN
29File Open Start.DiagnosticNN
30File Open End.DiagnosticNN
31File Save Start.DiagnosticNN
32File Save End.DiagnosticNN
33Zoom Start.DiagnosticNN
34Zoom End.DiagnosticNN
35ParseError:StringParam.DebugNN
36ParseError: HResult: StringParam, Error: HResultParam.DebugNN
37ParseError:HResultParam.DebugNN
38UnSupported Element:StringParam.DebugNN
39Start reading TOM.DiagnosticNN
40End reading TOM.DiagnosticNN
41Start saving Ole or Picture.DiagnosticNN
42End saving Ole or Picture.DiagnosticNN
43Begin reading Ole or Picture.DiagnosticNN
44End reading Ole or Picture.DiagnosticNN
45Indexed Search StringDebugNN
46Wordpad Search Filter Encountered an errorAdminNN

Event ID 1: Intializing current instance of the application

#
Channel
Debug
Opcode
Info

Event ID 2: Exiting current Instance of the application

#
Channel
Debug
Opcode
Info

Event ID 3: Failed to Initialize

#
Channel
Debug
Opcode
Info

Fields #

NameDescription
StringParam UnicodeString

Event ID 4: OLE initialization failed

#
Channel
Debug
Opcode
Info

Event ID 5: Failed to load msftedit.

#
Channel
Debug
Opcode
Info

Description

Failed to load msftedit.dll.

Message #

Failed to load msftedit.dll

Event ID 6: Wordpad is initialized as OLE Server

#
Channel
Debug
Opcode
Info

Event ID 7: Creation of Window:StringParam failed.

#
Channel
Debug
Opcode
Info

Message #

Creation of Window:%1 failed

Fields #

NameDescription
StringParam UnicodeString

Event ID 8: Intent Load Failed: StringParam.

#
Channel
Debug
Opcode
Info

Message #

Intent Load Failed: %1

Fields #

NameDescription
StringParam UnicodeString

Event ID 9: New Document Failed: StringParam.

#
Channel
Debug
Opcode
Info

Message #

New Document Failed: %1

Fields #

NameDescription
StringParam UnicodeString

Event ID 10: Create Font Indirect Failed

#
Channel
Debug
Opcode
Info

Event ID 11: Insert Picture Failed with HRESULT:HResultParam.

#
Channel
Debug
Opcode
Info

Message #

Insert Picture Failed with HRESULT:%1.

Fields #

NameDescription
HResultParam UInt32

Event ID 12: Insert Picture Failed with HRESULT:HResultParam and Msg:StringParam.

#
Channel
Debug
Opcode
Info

Message #

Insert Picture Failed with HRESULT:%1 and Msg:%2.

Fields #

NameDescription
HResultParam UInt32
StringParam UnicodeString

Event ID 13: GDIPlus Error:StringParam.

#
Channel
Debug
Opcode
Info

Message #

GDIPlus Error:%1.

Fields #

NameDescription
StringParam UnicodeString

Event ID 14: Wordpad Launch Start.

#
Channel
Diagnostic
Task
Wordpad_Launch
Opcode
Start

Event ID 15: Wordpad Launch End.

#
Channel
Diagnostic
Task
Wordpad_Launch
Opcode
Stop

Event ID 16: Insert Picture Start.

#
Channel
Diagnostic
Task
Wordpad_InsertPicture
Opcode
Start

Event ID 17: Insert Picture End.

#
Channel
Diagnostic
Task
Wordpad_InsertPicture
Opcode
Stop

Event ID 18: Resize Picture Start.

#
Channel
Diagnostic
Task
Wordpad_ResizePicture
Opcode
Start

Event ID 19: Resize Picture End.

#
Channel
Diagnostic
Task
Wordpad_ResizePicture
Opcode
Stop

Event ID 20: StringParam failed since the system is low on memory.

#
Channel
Admin
Opcode
Info

Message #

%1 failed since the system is low on memory.

Fields #

NameDescription
StringParam UnicodeString

Event ID 21: Msg:StringParam .

#
Channel
Debug
Opcode
Info

Description

Msg:StringParam .HRESULT:HResultParam.

Message #

Msg:%1 .HRESULT:%2

Fields #

NameDescription
StringParam UnicodeString
HResultParam UInt32

Event ID 22: Msg:StringParam .

#
Channel
Debug
Opcode
Info

Description

Msg:StringParam .HRESULT:DWordParam.

Message #

Msg:%1 .HRESULT:%2

Fields #

NameDescription
StringParam UnicodeString
DWordParam UInt64

Event ID 23: Live Preview Show (Type: Live Preview Type) Start.

#
Channel
Diagnostic
Task
Wordpad_LivePreviewShow
Opcode
Start

Message #

Live Preview Show (Type: %1) Start.

Fields #

NameDescription
Live Preview Type Int32

Event ID 24: Live Preview Show End.

#
Channel
Diagnostic
Task
Wordpad_LivePreviewShow
Opcode
Stop

Event ID 25: Live Preview Cancel (Type: Live Preview Type) Start.

#
Channel
Diagnostic
Task
Wordpad_LivePreviewCancel
Opcode
Start

Message #

Live Preview Cancel (Type: %1) Start.

Fields #

NameDescription
Live Preview Type Int32

Event ID 26: Live Preview Cancel End.

#
Channel
Diagnostic
Task
Wordpad_LivePreviewCancel
Opcode
Stop

Event ID 27: Live Preview Execute (Type: Live Preview Type) Start.

#
Channel
Diagnostic
Task
Wordpad_LivePreviewExecute
Opcode
Start

Message #

Live Preview Execute (Type: %1) Start.

Fields #

NameDescription
Live Preview Type Int32

Event ID 28: Live Preview Execute End.

#
Channel
Diagnostic
Task
Wordpad_LivePreviewExecute
Opcode
Stop

Event ID 29: File Open Start.

#
Channel
Diagnostic
Task
Wordpad_FileOpen
Opcode
Start

Event ID 30: File Open End.

#
Channel
Diagnostic
Task
Wordpad_FileOpen
Opcode
Stop

Event ID 31: File Save Start.

#
Channel
Diagnostic
Task
Wordpad_FileSave
Opcode
Start

Event ID 32: File Save End.

#
Channel
Diagnostic
Task
Wordpad_FileSave
Opcode
Stop

Event ID 33: Zoom Start.

#
Channel
Diagnostic
Task
Wordpad_Zoom
Opcode
Start

Event ID 34: Zoom End.

#
Channel
Diagnostic
Task
Wordpad_Zoom
Opcode
Stop

Event ID 35: ParseError:StringParam.

#
Channel
Debug
Opcode
Info

Message #

ParseError:%1.

Fields #

NameDescription
StringParam UnicodeString

Event ID 36: ParseError: HResult: StringParam, Error: HResultParam.

#
Channel
Debug
Opcode
Info

Message #

ParseError: HResult: %1, Error: %2.

Fields #

NameDescription
StringParam UnicodeString
HResultParam UInt32

Event ID 37: ParseError:HResultParam.

#
Channel
Debug
Opcode
Info

Message #

ParseError:%1.

Fields #

NameDescription
HResultParam UInt32

Event ID 38: UnSupported Element:StringParam.

#
Channel
Debug
Opcode
Info

Message #

UnSupported Element:%1.

Fields #

NameDescription
StringParam UnicodeString

Event ID 39: Start reading TOM.

#
Channel
Diagnostic
Task
Wordpad_Docx_Odt_Save
Opcode
Start

Event ID 40: End reading TOM.

#
Channel
Diagnostic
Task
Wordpad_Docx_Odt_Save
Opcode
Stop

Event ID 41: Start saving Ole or Picture.

#
Channel
Diagnostic
Task
Wordpad_Docx_Odt_Save
Opcode
Start

Event ID 42: End saving Ole or Picture.

#
Channel
Diagnostic
Task
Wordpad_Docx_Odt_Save
Opcode
Stop

Event ID 43: Begin reading Ole or Picture.

#
Channel
Diagnostic
Task
Wordpad_Docx_Odt_Read
Opcode
Start

Event ID 44: End reading Ole or Picture.

#
Channel
Diagnostic
Task
Wordpad_Docx_Odt_Read
Opcode
Stop

Event ID 45: Indexed Search String

#
Channel
Debug
Opcode
Info

Fields #

NameDescription
StringParam UnicodeString

Event ID 46: Wordpad Search Filter Encountered an error

#
Channel
Admin
Opcode
Info

Fields #

NameDescription
HResultParam UInt32

Provenance

ETW provider GUID 54ffd262-99fe-4576-96e7-1adb500370dc

Defined in Program, which carries the event manifest.

  • WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB