Microsoft-Windows-CorruptedFileRecovery-Server

17 events across 2 channels

Event	Title	Channel	Sample
1	The file FileName may be corrupted, which may have caused the application …	Operational	N
2	The system file FileName is corrupted, which may have caused the application …	Operational	N
3	The system file FileName may be corrupted, which may have caused the application …	Operational	N
4	The system file FileName is corrupted, which may have caused the application …	Operational	N
5	The system file FileName was reported as being corrupted but Windows determined …	Operational	N
6	The system file FileName was corrupted, which may have caused the application …	System	N
7	The system file FileName was corrupted, which may have caused the application …	Operational	N
8	The system file FileName was corrupted, which may have caused the application …	System	N
9	The system file FileName may be corrupted, which may have caused the application …	Operational	N
10	The system file FileName may be corrupted, but Windows could not determine if …	System	N
11	The system file FileName is corrupted, which may have caused the application …	System	N
12	Windows detected that program file FilePath is corrupted, causing application …	System	N
13	The program file FileName was reported as being possibly corrupted, causing …	Operational	N
14	The file FileName may be corrupted, which may have caused the application …	System	N
15	Windows detected that program file FilePath is corrupted, causing application …	Operational	N
16	Windows detected that program file FilePath is corrupted, causing application …	Operational	N
17	The program file FileName was reported as being possibly corrupted, causing …	Operational	N

Event ID 1: The file FileName may be corrupted, which may have caused the application AppName to stop working.

Provider: Microsoft-Windows-CorruptedFileRecovery-Server
Channel: Operational

Description

The file FileName may be corrupted, which may have caused the application AppName to stop working. Windows did not attempt to repair FileName because it is not a protected system file.

Message #

The file %1 may be corrupted, which may have caused the application %2 to stop working. Windows did not attempt to repair %1 because it is not a protected system file.

Fields #

Name	Description
`FileName` UnicodeString
`AppName` UnicodeString

Event ID 2: The system file FileName is corrupted, which may have caused the application AppName to stop working.

Provider: Microsoft-Windows-CorruptedFileRecovery-Server
Channel: Operational

Description

The system file FileName is corrupted, which may have caused the application AppName to stop working. Windows will not attempt to repair FileName because too many corrupted files have been detected recently. Frequent corruptions may indicate a problem with the disk on this computer.

Message #

The system file %1 is corrupted, which may have caused the application %2 to stop working. Windows will not attempt to repair %1 because too many corrupted files have been detected recently.  Frequent corruptions may indicate a problem with the disk on this computer.

Fields #

Name	Description
`FileName` UnicodeString
`AppName` UnicodeString

Event ID 3: The system file FileName may be corrupted, which may have caused the application AppName to stop working.

Provider: Microsoft-Windows-CorruptedFileRecovery-Server
Channel: Operational

Description

The system file FileName may be corrupted, which may have caused the application AppName to stop working. Windows did not attempt to repair this file because the same file has been repaired too many times over a recent period of time.

Message #

The system file %1 may be corrupted, which may have caused the application %2 to stop working. Windows did not attempt to repair this file because the same file has been repaired too many times over a recent period of time.

Fields #

Name	Description
`FileName` UnicodeString
`AppName` UnicodeString

Event ID 4: The system file FileName is corrupted, which may have caused the application AppName to stop working.

Provider: Microsoft-Windows-CorruptedFileRecovery-Server
Channel: Operational

Description

The system file FileName is corrupted, which may have caused the application AppName to stop working. Windows did not attempt to repair this file because a repair attempt is already underway for the same file.

Message #

The system file %1 is corrupted, which may have caused the application %2 to stop working. Windows did not attempt to repair this file because a repair attempt is already underway for the same file.

Fields #

Name	Description
`FileName` UnicodeString
`AppName` UnicodeString

Event ID 5: The system file FileName was reported as being corrupted but Windows determined that the file is not actually damaged.

Provider: Microsoft-Windows-CorruptedFileRecovery-Server
Channel: Operational

Description

The system file FileName was reported as being corrupted but Windows determined that the file is not actually damaged. It may have been repaired already.

Message #

The system file %1 was reported as being corrupted but Windows determined that the file is not actually damaged. It may have been repaired already.

Fields #

Name	Description
`FileName` UnicodeString
`AppName` UnicodeString

Event ID 6: The system file FileName was corrupted, which may have caused the application AppName to stop working.

Provider: Microsoft-Windows-CorruptedFileRecovery-Server
Channel: System

Description

The system file FileName was corrupted, which may have caused the application AppName to stop working. Windows was unable to repair this file (error code ErrorCode). Run the command "sfc /scannow" at an administrative command prompt to check for errors and to repair the file if necessary.

Message #

The system file %1 was corrupted, which may have caused the application %2 to stop working. Windows was unable to repair this file (error code %3).  Run the command "sfc /scannow" at an administrative command prompt to check for errors and to repair the file if necessary.

Fields #

Name	Description
`FileName` UnicodeString
`AppName` UnicodeString
`ErrorCode` UInt32

Event ID 7: The system file FileName was corrupted, which may have caused the application AppName to stop working.

Provider: Microsoft-Windows-CorruptedFileRecovery-Server
Channel: Operational

Description

The system file FileName was corrupted, which may have caused the application AppName to stop working. Windows successfully repaired the damaged file.

Message #

The system file %1 was corrupted, which may have caused the application %2 to stop working. Windows successfully repaired the damaged file.

Fields #

Name	Description
`FileName` UnicodeString
`AppName` UnicodeString

Event ID 8: The system file FileName was corrupted, which may have caused the application AppName to stop working.

Provider: Microsoft-Windows-CorruptedFileRecovery-Server
Channel: System

Description

The system file FileName was corrupted, which may have caused the application AppName to stop working. Windows attempted to repair the file. A reboot is required to finish this repair.

Message #

The system file %1 was corrupted, which may have caused the application %2 to stop working. Windows attempted to repair the file. A reboot is required to finish this repair.

Fields #

Name	Description
`FileName` UnicodeString
`AppName` UnicodeString

Event ID 9: The system file FileName may be corrupted, which may have caused the application AppName to stop working.

Provider: Microsoft-Windows-CorruptedFileRecovery-Server
Channel: Operational

Description

The system file FileName may be corrupted, which may have caused the application AppName to stop working. Windows attempted to repair the file, but the operation was cancelled before it could be completed. Run the command "sfc /scannow" at an administrative command prompt to check for errors and to repair the file if necessary.

Message #

The system file %1 may be corrupted, which may have caused the application %2 to stop working. Windows attempted to repair the file, but the operation was cancelled before it could be completed.  Run the command "sfc /scannow" at an administrative command prompt to check for errors and to repair the file if necessary.

Fields #

Name	Description
`FileName` UnicodeString
`AppName` UnicodeString

Event ID 10: The system file FileName may be corrupted, but Windows could not determine if the file was actually damaged (error code ErrorCode).

Provider: Microsoft-Windows-CorruptedFileRecovery-Server
Channel: System

Description

The system file FileName may be corrupted, but Windows could not determine if the file was actually damaged (error code ErrorCode). No repair action was taken. Run the command "sfc /scannow" at an administrative command prompt to check for errors and to repair the file if necessary.

Message #

The system file %1 may be corrupted, but Windows could not determine if the file was actually damaged (error code %3). No repair action was taken. Run the command "sfc /scannow" at an administrative command prompt to check for errors and to repair the file if necessary.

Fields #

Name	Description
`FileName` UnicodeString
`AppName` UnicodeString
`ErrorCode` UInt32

Event ID 11: The system file FileName is corrupted, which may have caused the application AppName to stop working.

Provider: Microsoft-Windows-CorruptedFileRecovery-Server
Channel: System

Description

The system file FileName is corrupted, which may have caused the application AppName to stop working. Windows could not attempt to repair FileName because a previous repair operation was pended. Reboot the computer and run the command "sfc /scannow" at an administrative command prompt to check for errors and to repair the file if necessary.

Message #

The system file %1 is corrupted, which may have caused the application %2 to stop working. Windows could not attempt to repair %1 because a previous repair operation was pended.  Reboot the computer and run the command "sfc /scannow" at an administrative command prompt to check for errors and to repair the file if necessary.

Fields #

Name	Description
`FileName` UnicodeString
`AppName` UnicodeString

Event ID 12: Windows detected that program file FilePath is corrupted, causing application AppName to stop working.

Provider: Microsoft-Windows-CorruptedFileRecovery-Server
Channel: System

Description

Windows detected that program file FilePath is corrupted, causing application AppName to stop working. To restore the file, reinstall ProductName version ProductVersion.

Message #

Windows detected that program file %1 is corrupted, causing application %2 to stop working. To restore the file, reinstall %3 version %4.

Fields #

Name	Description
`FilePath` UnicodeString
`AppName` UnicodeString
`ProductName` UnicodeString
`ProductVersion` UnicodeString

Event ID 13: The program file FileName was reported as being possibly corrupted, causing application AppName to stop working.

Provider: Microsoft-Windows-CorruptedFileRecovery-Server
Channel: Operational

Description

The program file FileName was reported as being possibly corrupted, causing application AppName to stop working. Windows performed additional diagnostics and determined that the file is not actually damaged.

Message #

The program file %1 was reported as being possibly corrupted, causing application %2 to stop working. Windows performed additional diagnostics and determined that the file is not actually damaged.

Fields #

Name	Description
`FileName` UnicodeString
`AppName` UnicodeString

Event ID 14: The file FileName may be corrupted, which may have caused the application AppName to stop working.

Provider: Microsoft-Windows-CorruptedFileRecovery-Server
Channel: System

Description

The file FileName may be corrupted, which may have caused the application AppName to stop working. Windows did not attempt to repair FileName because it could not find its corresponding installer package.

Message #

The file %1 may be corrupted, which may have caused the application %2 to stop working. Windows did not attempt to repair %1 because it could not find its corresponding installer package.

Fields #

Name	Description
`FileName` UnicodeString
`AppName` UnicodeString

Event ID 15: Windows detected that program file FilePath is corrupted, causing application AppName to stop working.

Provider: Microsoft-Windows-CorruptedFileRecovery-Server
Channel: Operational

Description

Windows detected that program file FilePath is corrupted, causing application AppName to stop working. Reinstalling ProductName version ProductVersion may repair the file. However, Windows is not launching a ProductName reinstallation because too many product reinstalls have run recently.

Message #

Windows detected that program file %1 is corrupted, causing application %2 to stop working. Reinstalling %3 version %4 may repair the file. However, Windows is not launching a %3 reinstallation because too many product reinstalls have run recently.

Fields #

Name	Description
`FilePath` UnicodeString
`AppName` UnicodeString
`ProductName` UnicodeString
`ProductVersion` UnicodeString

Event ID 16: Windows detected that program file FilePath is corrupted, causing application AppName to stop working.

Provider: Microsoft-Windows-CorruptedFileRecovery-Server
Channel: Operational

Description

Message #

Windows detected that program file %1 is corrupted, causing application %2 to stop working. Reinstalling %3 version %4 may repair the file. However, Windows is not launching a %3 reinstallation because that product has already been reinstalled too many times recently.

Fields #

Name	Description
`FilePath` UnicodeString
`AppName` UnicodeString
`ProductName` UnicodeString
`ProductVersion` UnicodeString

Event ID 17: The program file FileName was reported as being possibly corrupted, causing application AppName to stop working.

Provider: Microsoft-Windows-CorruptedFileRecovery-Server
Channel: Operational

Description

Message #

The program file %1 was reported as being possibly corrupted, causing application %2 to stop working. Windows performed additional diagnostics and determined that the file is not an executable image. To avoid potential user data loss, Windows will not attempt to repair the file.

Fields #

Name	Description
`FileName` UnicodeString
`AppName` UnicodeString

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID d6f68875-cdf5-43a5-a3e3-53ffd683311c

Defined in cofiredm.dll, which carries the event manifest.

Observed on:

WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02
Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)

Microsoft-Windows-CorruptedFileRecovery-Server

Event ID 1: The file FileName may be corrupted, which may have caused the application AppName to stop working.

Description

Message #

Fields #

Event ID 2: The system file FileName is corrupted, which may have caused the application AppName to stop working.

Description

Message #

Fields #

Event ID 3: The system file FileName may be corrupted, which may have caused the application AppName to stop working.

Description

Message #

Fields #

Event ID 4: The system file FileName is corrupted, which may have caused the application AppName to stop working.

Description

Message #

Fields #

Event ID 5: The system file FileName was reported as being corrupted but Windows determined that the file is not actually damaged.

Description

Message #

Fields #

Event ID 6: The system file FileName was corrupted, which may have caused the application AppName to stop working.

Description

Message #

Fields #

Related Events #

Event ID 7: The system file FileName was corrupted, which may have caused the application AppName to stop working.

Description

Message #

Fields #

Event ID 8: The system file FileName was corrupted, which may have caused the application AppName to stop working.

Description

Message #

Fields #

Event ID 9: The system file FileName may be corrupted, which may have caused the application AppName to stop working.

Description

Message #

Fields #

Event ID 10: The system file FileName may be corrupted, but Windows could not determine if the file was actually damaged (error code ErrorCode).

Description

Message #

Fields #

Related Events #

Event ID 11: The system file FileName is corrupted, which may have caused the application AppName to stop working.

Description

Message #

Fields #

Event ID 12: Windows detected that program file FilePath is corrupted, causing application AppName to stop working.

Description

Message #

Fields #

Event ID 13: The program file FileName was reported as being possibly corrupted, causing application AppName to stop working.

Description

Message #

Fields #

Event ID 14: The file FileName may be corrupted, which may have caused the application AppName to stop working.

Description

Message #

Fields #

Event ID 15: Windows detected that program file FilePath is corrupted, causing application AppName to stop working.

Description

Message #

Fields #

Event ID 16: Windows detected that program file FilePath is corrupted, causing application AppName to stop working.

Description

Message #

Fields #

Event ID 17: The program file FileName was reported as being possibly corrupted, causing application AppName to stop working.

Description

Message #

Fields #

Provenance

Downloads