detection.wiki

Microsoft-Windows-DirectShow-Core

EventTitleChannelSampleRule
1The file FileName could not be processed by the application ApplicationName …ApplicationNN
2Initialize: Found PreferredCount Preferred Filter clsids, DontUseCount Do Not …DirectShowPluginControlNN
3Attempt to use Filter clsid clsid marked as do not use.DirectShowPluginControlNN
4Mark Filter clsid clsid do not use = Disabled.DirectShowPluginControlNN
5Choosing preferred Filter clsid clsid for subtype Subtype.DirectShowPluginControlNN
6Registering preferred Filter clsid clsid for subtype Subtype.DirectShowPluginControlNN
7Attempt to use Do Not Use VCM codec fourcc FourCC DLL name dllName.DirectShowPluginControlNN
8Query for preferred subtype Subtype found clsid clsid.DirectShowPluginControlNN
9Query for preferred subtype Subtype found no clsid.DirectShowPluginControlNN
10Query Do Not Use for clsid clsid: do not use = Disabled.DirectShowPluginControlNN
100RenderFile Enter CFilterGraph(context) url(url).DirectShowFilterGraphNN
101RenderFile Leave CFilterGraph(context) hr(hr).DirectShowFilterGraphNN
102Connect Enter CFilterGraph(context) OutputPin(pinOutput,pinOutputName) …DirectShowFilterGraphNN
103Connect Leave CFilterGraph(context) hr(hr) Major Type(type) Subtype(subtype).DirectShowFilterGraphNN
104Render Pin Enter CFilterGraph(context) Pin(pinOutput,pinOutputName).DirectShowFilterGraphNN
105Render Pin Leave CFilterGraph(context) hr(hr).DirectShowFilterGraphNN
106AddFilter CFilterGraph(context) Filter(filter,filterName) Name(name) hr(hr).DirectShowFilterGraphNN
107AddSourceFilter Enter CFilterGraph(context) url(url).DirectShowFilterGraphNN
108AddSourceFilter Leave CFilterGraph(context) Filter(filter,filterName) hr(hr).DirectShowFilterGraphNN
109NotifyEvent CFilterGraph(context) EventCode(eventCode) Param1(param1) …DirectShowFilterGraphNN
110Pause Enter CFilterGraph(context).DirectShowFilterGraphNN
111Pause Leave CFilterGraph(context) Failing Filter …DirectShowFilterGraphNN
112Stop Enter CFilterGraph(context).DirectShowFilterGraphNN
113Stop Leave CFilterGraph(context) Failing Filter …DirectShowFilterGraphNN
114Run Enter CFilterGraph(context) tStart(tStart).DirectShowFilterGraphNN
115Run Leave CFilterGraph(context) Failing Filter (failingFilter,failingFilterName) …DirectShowFilterGraphNN
116ConnectDirect Enter CFilterGraph(context) OutputPin(pinOutput,pinOutputName) …DirectShowFilterGraphNN
117ConnectDirect Leave CFilterGraph(context) hr(hr).DirectShowFilterGraphNN
118Disconnect CFilterGraph(context) Pin(pin,pinName) hr(hr).DirectShowFilterGraphNN
119GetState Enter CFilterGraph(context) Timeout(timeout).DirectShowFilterGraphNN
120GetState Leave CFilterGraph(context) State(state) Failing …DirectShowFilterGraphNN
121RemoveFIlter CFilterGraph(context) Filter(filter,filterName) hr(hr).DirectShowFilterGraphNN

Event ID 1: The file FileName could not be processed by the application ApplicationName because it requires Indeo?

#
Channel
Application
Opcode
Info

Description

The file FileName could not be processed by the application ApplicationName because it requires Indeo? Decoders of type ContentType.

Message #

The file %2 could not be processed by the application %1 because it requires Indeo? Decoders of type %3

Fields #

NameDescription
ApplicationName UnicodeString
FileName UnicodeString
ContentType UnicodeString

Event ID 2: Initialize: Found PreferredCount Preferred Filter clsids, DontUseCount Do Not Use Filter clsids.

#
Channel
DirectShowPluginControl
Task
PluginManager
Opcode
Start

Message #

Initialize:  Found %1 Preferred Filter clsids, %2 Do Not Use Filter clsids.

Fields #

NameDescription
PreferredCount UInt32
DontUseCount UInt32

Event ID 3: Attempt to use Filter clsid clsid marked as do not use.

#
Channel
DirectShowPluginControl
Task
PluginManager

Message #

Attempt to use Filter clsid %1 marked as do not use.

Fields #

NameDescription
clsid GUID

Event ID 4: Mark Filter clsid clsid do not use = Disabled.

#
Channel
DirectShowPluginControl
Task
PluginManager

Message #

Mark Filter clsid %1 do not use = %2.

Fields #

NameDescription
clsid GUID
Disabled Boolean

Event ID 5: Choosing preferred Filter clsid clsid for subtype Subtype.

#
Channel
DirectShowPluginControl
Task
PluginManager

Message #

Choosing preferred Filter clsid %1 for subtype %2.

Fields #

NameDescription
clsid GUID
Subtype GUID

Event ID 6: Registering preferred Filter clsid clsid for subtype Subtype.

#
Channel
DirectShowPluginControl
Task
PluginManager

Message #

Registering preferred Filter clsid %1 for subtype %2.

Fields #

NameDescription
clsid GUID
Subtype GUID

Event ID 7: Attempt to use Do Not Use VCM codec fourcc FourCC DLL name dllName.

#
Channel
DirectShowPluginControl
Task
PluginManager

Message #

Attempt to use Do Not Use VCM codec fourcc %1 DLL name %2.

Fields #

NameDescription
FourCC UnicodeString
dllName UnicodeString

Event ID 8: Query for preferred subtype Subtype found clsid clsid.

#
Channel
DirectShowPluginControl
Task
PluginManager

Message #

Query for preferred subtype %2 found clsid %1.

Fields #

NameDescription
clsid GUID
Subtype GUID

Event ID 9: Query for preferred subtype Subtype found no clsid.

#
Channel
DirectShowPluginControl
Task
PluginManager

Message #

Query for preferred subtype %1 found no clsid.

Fields #

NameDescription
Subtype GUID

Event ID 10: Query Do Not Use for clsid clsid: do not use = Disabled.

#
Channel
DirectShowPluginControl
Task
PluginManager

Message #

Query Do Not Use for clsid %1: do not use = %2

Fields #

NameDescription
clsid GUID
Disabled Boolean

Event ID 100: RenderFile Enter CFilterGraph(context) url(url).

#
Channel
DirectShowFilterGraph
Task
DirectShowFilterGraphRenderFile
Opcode
Start

Message #

RenderFile Enter CFilterGraph(%1) url(%2)

Fields #

NameDescription
context Pointer
url UnicodeString

Event ID 101: RenderFile Leave CFilterGraph(context) hr(hr).

#
Channel
DirectShowFilterGraph
Task
DirectShowFilterGraphRenderFile
Opcode
Stop

Message #

RenderFile Leave CFilterGraph(%1) hr(%2)

Fields #

NameDescription
context Pointer
hr HexInt32

Event ID 102: Connect Enter CFilterGraph(context) OutputPin(pinOutput,pinOutputName) InputPin(pinInput,pinInputName).

#
Channel
DirectShowFilterGraph
Task
DirectShowFilterGraphConnect
Opcode
Start

Message #

Connect Enter CFilterGraph(%1) OutputPin(%2,%3) InputPin(%4,%5)

Fields #

NameDescription
context Pointer
pinOutput Pointer
pinOutputName UnicodeString
pinInput Pointer
pinInputName UnicodeString

Event ID 103: Connect Leave CFilterGraph(context) hr(hr) Major Type(type) Subtype(subtype).

#
Channel
DirectShowFilterGraph
Task
DirectShowFilterGraphConnect
Opcode
Stop

Message #

Connect Leave CFilterGraph(%1) hr(%2) Major Type(%3) Subtype(%4)

Fields #

NameDescription
context Pointer
hr HexInt32
type GUID
subtype GUID

Event ID 104: Render Pin Enter CFilterGraph(context) Pin(pinOutput,pinOutputName).

#
Channel
DirectShowFilterGraph
Task
DirectShowFilterGraphRenderPin
Opcode
Start

Message #

Render Pin Enter CFilterGraph(%1) Pin(%2,%3)

Fields #

NameDescription
context Pointer
pinOutput Pointer
pinOutputName UnicodeString

Event ID 105: Render Pin Leave CFilterGraph(context) hr(hr).

#
Channel
DirectShowFilterGraph
Task
DirectShowFilterGraphRenderPin
Opcode
Stop

Message #

Render Pin Leave CFilterGraph(%1) hr(%2)

Fields #

NameDescription
context Pointer
hr HexInt32

Event ID 106: AddFilter CFilterGraph(context) Filter(filter,filterName) Name(name) hr(hr).

#
Channel
DirectShowFilterGraph
Task
DirectShowFilterGraphAddFilter

Message #

AddFilter CFilterGraph(%1) Filter(%2,%3) Name(%4) hr(%5)

Fields #

NameDescription
context Pointer
filter Pointer
filterName UnicodeString
name UnicodeString
hr HexInt32

Event ID 107: AddSourceFilter Enter CFilterGraph(context) url(url).

#
Channel
DirectShowFilterGraph
Task
DirectShowFilterGraphAddSourceFilter
Opcode
Start

Message #

AddSourceFilter Enter CFilterGraph(%1) url(%2)

Fields #

NameDescription
context Pointer
url UnicodeString

Event ID 108: AddSourceFilter Leave CFilterGraph(context) Filter(filter,filterName) hr(hr).

#
Channel
DirectShowFilterGraph
Task
DirectShowFilterGraphAddSourceFilter
Opcode
Stop

Message #

AddSourceFilter Leave CFilterGraph(%1) Filter(%2,%3) hr(%4)

Fields #

NameDescription
context Pointer
filter Pointer
filterName UnicodeString
hr HexInt32

Event ID 109: NotifyEvent CFilterGraph(context) EventCode(eventCode) Param1(param1) Param2(param2).

#
Channel
DirectShowFilterGraph
Task
DirectShowFilterGraphNotifyEvent

Message #

NotifyEvent CFilterGraph(%1) EventCode(%2) Param1(%3) Param2(%4)

Fields #

NameDescription
context Pointer
eventCode Int32
param1 Pointer
param2 Pointer

Event ID 110: Pause Enter CFilterGraph(context).

#
Channel
DirectShowFilterGraph
Task
DirectShowFilterGraphPause
Opcode
Start

Message #

Pause Enter CFilterGraph(%1)

Fields #

NameDescription
context Pointer

Event ID 111: Pause Leave CFilterGraph(context) Failing Filter (failingFilter,failingFilterName) hr(hr).

#
Channel
DirectShowFilterGraph
Task
DirectShowFilterGraphPause
Opcode
Stop

Message #

Pause Leave CFilterGraph(%1) Failing Filter (%2,%3) hr(%4)

Fields #

NameDescription
context Pointer
failingFilter Pointer
failingFilterName UnicodeString
hr HexInt32

Event ID 112: Stop Enter CFilterGraph(context).

#
Channel
DirectShowFilterGraph
Task
DirectShowFilterGraphStop
Opcode
Start

Message #

Stop Enter CFilterGraph(%1)

Fields #

NameDescription
context Pointer

Event ID 113: Stop Leave CFilterGraph(context) Failing Filter (failingFilter,failingFilterName) hr(hr).

#
Channel
DirectShowFilterGraph
Task
DirectShowFilterGraphStop
Opcode
Stop

Message #

Stop Leave CFilterGraph(%1) Failing Filter (%2,%3) hr(%4)

Fields #

NameDescription
context Pointer
failingFilter Pointer
failingFilterName UnicodeString
hr HexInt32

Event ID 114: Run Enter CFilterGraph(context) tStart(tStart).

#
Channel
DirectShowFilterGraph
Task
DirectShowFilterGraphRun
Opcode
Start

Message #

Run Enter CFilterGraph(%1) tStart(%2)

Fields #

NameDescription
context Pointer
tStart Int64

Event ID 115: Run Leave CFilterGraph(context) Failing Filter (failingFilter,failingFilterName) hr(hr).

#
Channel
DirectShowFilterGraph
Task
DirectShowFilterGraphRun
Opcode
Stop

Message #

Run Leave CFilterGraph(%1) Failing Filter (%2,%3) hr(%4)

Fields #

NameDescription
context Pointer
failingFilter Pointer
failingFilterName UnicodeString
hr HexInt32

Event ID 116: ConnectDirect Enter CFilterGraph(context) OutputPin(pinOutput,pinOutputName) InputPin(pinInput,pinInputName).

#
Channel
DirectShowFilterGraph
Task
DirectShowFilterGraphConnectDirect
Opcode
Start

Message #

ConnectDirect Enter CFilterGraph(%1) OutputPin(%2,%3) InputPin(%4,%5)

Fields #

NameDescription
context Pointer
pinOutput Pointer
pinOutputName UnicodeString
pinInput Pointer
pinInputName UnicodeString

Event ID 117: ConnectDirect Leave CFilterGraph(context) hr(hr).

#
Channel
DirectShowFilterGraph
Task
DirectShowFilterGraphConnectDirect
Opcode
Stop

Message #

ConnectDirect Leave CFilterGraph(%1) hr(%2)

Fields #

NameDescription
context Pointer
hr HexInt32

Event ID 118: Disconnect CFilterGraph(context) Pin(pin,pinName) hr(hr).

#
Channel
DirectShowFilterGraph
Task
DirectShowFilterGraphDisconnect

Message #

Disconnect CFilterGraph(%1) Pin(%2,%3) hr(%4)

Fields #

NameDescription
context Pointer
pin Pointer
pinName UnicodeString
hr HexInt32

Event ID 119: GetState Enter CFilterGraph(context) Timeout(timeout).

#
Channel
DirectShowFilterGraph
Task
DirectShowFilterGraphGetState
Opcode
Start

Message #

GetState Enter CFilterGraph(%1) Timeout(%2)

Fields #

NameDescription
context Pointer
timeout UInt32

Event ID 120: GetState Leave CFilterGraph(context) State(state) Failing Filter(failingFilter,failingFilterName) hr(hr).

#
Channel
DirectShowFilterGraph
Task
DirectShowFilterGraphGetState
Opcode
Stop

Message #

GetState Leave CFilterGraph(%1) State(%2) Failing Filter(%3,%4) hr(%5)

Fields #

NameDescription
context Pointer
state UInt32
failingFilter Pointer
failingFilterName UnicodeString
hr HexInt32

Event ID 121: RemoveFIlter CFilterGraph(context) Filter(filter,filterName) hr(hr).

#
Channel
DirectShowFilterGraph
Task
DirectShowFilterGraphRemoveFilter

Message #

RemoveFIlter CFilterGraph(%1) Filter(%2,%3) hr(%4)

Fields #

NameDescription
context Pointer
filter Pointer
filterName UnicodeString
hr HexInt32

Provenance

ETW provider GUID 968f313b-097f-4e09-9cdd-bc62692d138b

Defined in quartz.dll, which carries the event manifest.

  • WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB
  • Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB