detection.wiki

Microsoft-Windows-User-Loader

EventTitleChannelSampleRule
1Deprecated module FileName.AnalyticNN
2Process ProcessFileNamePath encountered a fatal user callback exception.AnalyticNN
3Error status code FailureReason returned when ProcessImagePath attempted to load …AnalyticNN
4The process launches a 16 bit process.AnalyticNN
5Windows component on demand ProcessId.AnalyticNN
6The Loader encountered a fatal error while loading a thread from process image …AnalyticNN
7A fatal error occured during initalization of FileName.AnalyticNN
8Error status code FailureReason returned when ExportModule attempted to load …AnalyticNN
9The Loader encountered a fatal error running process image name FileName.AnalyticNN
10Error status code FailureReason returned when ProcessImagePath attempted to load …ApplicationNN
11Loading dependency CurDirDllPath from the current directory was not allowed when …ApplicationNN
12Loading dependency CurDirDllPath from the current directory was not allowed when …ApplicationNN

Event ID 1: Deprecated module FileName.

#
Channel
Analytic
Opcode
Info

Message #

Deprecated module %1.

Fields #

NameDescription
FileName UnicodeString

Event ID 2: Process ProcessFileNamePath encountered a fatal user callback exception.

#
Channel
Analytic
Opcode
Info

Message #

Process %2 encountered a fatal user callback exception.

Fields #

NameDescription
ProcessFileNamePathLength UInt16
ProcessFileNamePath UnicodeString

Event ID 3: Error status code FailureReason returned when ProcessImagePath attempted to load dependency ImportDllName.

#
Channel
Analytic
Opcode
Info

Message #

Error status code %1 returned when %3 attempted to load dependency %2.

Fields #

NameDescription
FailureReason UInt32
Known values
%%2304
An Error occured during Logon.
%%2305
The specified user account has expired.
%%2306
The NetLogon component is not active.
%%2307
Account locked out.
%%2308
The user has not been granted the requested logon type at this machine.
%%2309
The specified account's password has expired.
%%2310
Account currently disabled.
%%2311
Account logon time restriction violation.
%%2312
User not allowed to logon at this computer.
%%2313
Unknown user name or bad password.
%%2314
Domain sid inconsistent.
%%2315
Smartcard logon is required and was not used.
ImportDllName UnicodeString
ProcessImagePath UnicodeString

Event ID 4: The process launches a 16 bit process.

#
Channel
Analytic
Opcode
Info

Fields #

NameDescription
FileName UnicodeString

Event ID 5: Windows component on demand ProcessId.

#
Channel
Analytic
Opcode
Info

Message #

Windows component on demand %1.

Fields #

NameDescription
ProcessId UInt32
SuspendProcessRequest UInt32
DLLName UnicodeString

Event ID 6: The Loader encountered a fatal error while loading a thread from process image name FileName.

#
Channel
Analytic
Opcode
Info

Message #

The Loader encountered a fatal error while loading a thread from process image name %1.

Fields #

NameDescription
FileName UnicodeString

Event ID 7: A fatal error occured during initalization of FileName.

#
Channel
Analytic
Opcode
Info

Message #

A fatal error occured during initalization of %1.

Fields #

NameDescription
FileName UnicodeString

Event ID 8: Error status code FailureReason returned when ExportModule attempted to load dependency ImportDllName.

#
Channel
Analytic
Opcode
Info

Message #

Error status code %1 returned when %3 attempted to load dependency %2.

Fields #

NameDescription
FailureReason UInt32
Known values
%%2304
An Error occured during Logon.
%%2305
The specified user account has expired.
%%2306
The NetLogon component is not active.
%%2307
Account locked out.
%%2308
The user has not been granted the requested logon type at this machine.
%%2309
The specified account's password has expired.
%%2310
Account currently disabled.
%%2311
Account logon time restriction violation.
%%2312
User not allowed to logon at this computer.
%%2313
Unknown user name or bad password.
%%2314
Domain sid inconsistent.
%%2315
Smartcard logon is required and was not used.
ImportDllName UnicodeString
ExportModule UnicodeString

Event ID 9: The Loader encountered a fatal error running process image name FileName.

#
Channel
Analytic
Opcode
Info

Message #

The Loader encountered a fatal error running process image name %1.

Fields #

NameDescription
FileName UnicodeString

Event ID 10: Error status code FailureReason returned when ProcessImagePath attempted to load dependency ImportDllName.

#
Channel
Application
Opcode
Info

Message #

Error status code %1 returned when %3 attempted to load dependency %2.

Fields #

NameDescription
FailureReason UInt32
Known values
%%2304
An Error occured during Logon.
%%2305
The specified user account has expired.
%%2306
The NetLogon component is not active.
%%2307
Account locked out.
%%2308
The user has not been granted the requested logon type at this machine.
%%2309
The specified account's password has expired.
%%2310
Account currently disabled.
%%2311
Account logon time restriction violation.
%%2312
User not allowed to logon at this computer.
%%2313
Unknown user name or bad password.
%%2314
Domain sid inconsistent.
%%2315
Smartcard logon is required and was not used.
ImportDllName UnicodeString
ProcessImagePath UnicodeString

Event ID 11: Loading dependency CurDirDllPath from the current directory was not allowed when attempted by ProcessImagePath.

#
Channel
Application
Opcode
Info

Description

Loading dependency CurDirDllPath from the current directory was not allowed when attempted by ProcessImagePath. Another DLL was found: FoundDllPath. For more information, see http://go.microsoft.com/fwlink/?LinkId=718136.

Message #

Loading dependency %2 from the current directory was not allowed when attempted by %1. Another DLL was found: %3. For more information, see http://go.microsoft.com/fwlink/?LinkId=718136.

Fields #

NameDescription
ProcessImagePath UnicodeString
CurDirDllPath UnicodeString
FoundDllPath UnicodeString

Event ID 12: Loading dependency CurDirDllPath from the current directory was not allowed when attempted by ProcessImagePath.

#
Channel
Application
Opcode
Info

Description

Loading dependency CurDirDllPath from the current directory was not allowed when attempted by ProcessImagePath. No other DLL was found and the dependency resolution failed. For more information, see http://go.microsoft.com/fwlink/?LinkId=718136.

Message #

Loading dependency %2 from the current directory was not allowed when attempted by %1. No other DLL was found and the dependency resolution failed. For more information, see http://go.microsoft.com/fwlink/?LinkId=718136.

Fields #

NameDescription
ProcessImagePath UnicodeString
CurDirDllPath UnicodeString

Provenance

ETW provider GUID b059b83f-d946-4b13-87ca-4292839dc2f2

Defined in Microsoft-Windows-System-Events.dll, which carries the event manifest.

  • WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.3932, captured 2026-06-02 — Manifest XML pack, 1.9 MB
  • Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.5074, captured 2026-06-02 — Manifest XML pack, 2.0 MB