detection.wiki

Microsoft-Windows-User-Loader

12 events across 2 channels

Event IDTitleChannel
1Deprecated module FileName.Analytic
2Process ProcessFileNamePath encountered a fatal user callback exception.Analytic
3Error status code FailureReason returned when ProcessImagePath attempted to load …Analytic
4The process launches a 16 bit process.Analytic
5Windows component on demand ProcessId.Analytic
6The Loader encountered a fatal error while loading a thread from process image …Analytic
7A fatal error occured during initalization of FileName.Analytic
8Error status code FailureReason returned when ExportModule attempted to load …Analytic
9The Loader encountered a fatal error running process image name FileName.Analytic
10Error status code FailureReason returned when ProcessImagePath attempted to load …Application
11Loading dependency CurDirDllPath from the current directory was not allowed when …Application
12Loading dependency CurDirDllPath from the current directory was not allowed when …Application

Event ID 1 — Deprecated module FileName.

Provider
Microsoft-Windows-User-Loader
Channel
Analytic
Opcode
Info

Description

Deprecated module FileName.

Message #

Deprecated module %1.

Fields #

NameDescription
FileName UnicodeString—

Event ID 2 — Process ProcessFileNamePath encountered a fatal user callback exception.

Provider
Microsoft-Windows-User-Loader
Channel
Analytic
Opcode
Info

Description

Process ProcessFileNamePath encountered a fatal user callback exception.

Message #

Process %2 encountered a fatal user callback exception.

Fields #

NameDescription
ProcessFileNamePathLength UInt16—
ProcessFileNamePath UnicodeString—

Event ID 3 — Error status code FailureReason returned when ProcessImagePath attempted to load dependency ImportDllName.

Provider
Microsoft-Windows-User-Loader
Channel
Analytic
Opcode
Info

Description

Error status code FailureReason returned when ProcessImagePath attempted to load dependency ImportDllName.

Message #

Error status code %1 returned when %3 attempted to load dependency %2.

Fields #

NameDescription
FailureReason UInt32—
Known values
%%2304
An Error occured during Logon.
%%2305
The specified user account has expired.
%%2306
The NetLogon component is not active.
%%2307
Account locked out.
%%2308
The user has not been granted the requested logon type at this machine.
%%2309
The specified account's password has expired.
%%2310
Account currently disabled.
%%2311
Account logon time restriction violation.
%%2312
User not allowed to logon at this computer.
%%2313
Unknown user name or bad password.
%%2314
Domain sid inconsistent.
%%2315
Smartcard logon is required and was not used.
ImportDllName UnicodeString—
ProcessImagePath UnicodeString—

Event ID 4 — The process launches a 16 bit process.

Provider
Microsoft-Windows-User-Loader
Channel
Analytic
Opcode
Info

Description

The process launches a 16 bit process.

Message #

The process launches a 16 bit process.

Fields #

NameDescription
FileName UnicodeString—

Event ID 5 — Windows component on demand ProcessId.

Provider
Microsoft-Windows-User-Loader
Channel
Analytic
Opcode
Info

Description

Windows component on demand ProcessId.

Message #

Windows component on demand %1.

Fields #

NameDescription
ProcessId UInt32—
SuspendProcessRequest UInt32—
DLLName UnicodeString—

Event ID 6 — The Loader encountered a fatal error while loading a thread from process image name FileName.

Provider
Microsoft-Windows-User-Loader
Channel
Analytic
Opcode
Info

Description

The Loader encountered a fatal error while loading a thread from process image name FileName.

Message #

The Loader encountered a fatal error while loading a thread from process image name %1.

Fields #

NameDescription
FileName UnicodeString—

Event ID 7 — A fatal error occured during initalization of FileName.

Provider
Microsoft-Windows-User-Loader
Channel
Analytic
Opcode
Info

Description

A fatal error occured during initalization of FileName.

Message #

A fatal error occured during initalization of %1.

Fields #

NameDescription
FileName UnicodeString—

Event ID 8 — Error status code FailureReason returned when ExportModule attempted to load dependency ImportDllName.

Provider
Microsoft-Windows-User-Loader
Channel
Analytic
Opcode
Info

Description

Error status code FailureReason returned when ExportModule attempted to load dependency ImportDllName.

Message #

Error status code %1 returned when %3 attempted to load dependency %2.

Fields #

NameDescription
FailureReason UInt32—
Known values
%%2304
An Error occured during Logon.
%%2305
The specified user account has expired.
%%2306
The NetLogon component is not active.
%%2307
Account locked out.
%%2308
The user has not been granted the requested logon type at this machine.
%%2309
The specified account's password has expired.
%%2310
Account currently disabled.
%%2311
Account logon time restriction violation.
%%2312
User not allowed to logon at this computer.
%%2313
Unknown user name or bad password.
%%2314
Domain sid inconsistent.
%%2315
Smartcard logon is required and was not used.
ImportDllName UnicodeString—
ExportModule UnicodeString—

Event ID 9 — The Loader encountered a fatal error running process image name FileName.

Provider
Microsoft-Windows-User-Loader
Channel
Analytic
Opcode
Info

Description

The Loader encountered a fatal error running process image name FileName.

Message #

The Loader encountered a fatal error running process image name %1.

Fields #

NameDescription
FileName UnicodeString—

Event ID 10 — Error status code FailureReason returned when ProcessImagePath attempted to load dependency ImportDllName.

Provider
Microsoft-Windows-User-Loader
Channel
Application
Opcode
Info

Description

Error status code FailureReason returned when ProcessImagePath attempted to load dependency ImportDllName.

Message #

Error status code %1 returned when %3 attempted to load dependency %2.

Fields #

NameDescription
FailureReason UInt32—
Known values
%%2304
An Error occured during Logon.
%%2305
The specified user account has expired.
%%2306
The NetLogon component is not active.
%%2307
Account locked out.
%%2308
The user has not been granted the requested logon type at this machine.
%%2309
The specified account's password has expired.
%%2310
Account currently disabled.
%%2311
Account logon time restriction violation.
%%2312
User not allowed to logon at this computer.
%%2313
Unknown user name or bad password.
%%2314
Domain sid inconsistent.
%%2315
Smartcard logon is required and was not used.
ImportDllName UnicodeString—
ProcessImagePath UnicodeString—

Event ID 11 — Loading dependency CurDirDllPath from the current directory was not allowed when attempted by ProcessImagePath.

Provider
Microsoft-Windows-User-Loader
Channel
Application
Opcode
Info

Description

Loading dependency CurDirDllPath from the current directory was not allowed when attempted by ProcessImagePath. Another DLL was found: FoundDllPath. For more information, see http://go.microsoft.com/fwlink/?LinkId=718136.

Message #

Loading dependency %2 from the current directory was not allowed when attempted by %1. Another DLL was found: %3. For more information, see http://go.microsoft.com/fwlink/?LinkId=718136.

Fields #

NameDescription
ProcessImagePath UnicodeString—
CurDirDllPath UnicodeString—
FoundDllPath UnicodeString—

Event ID 12 — Loading dependency CurDirDllPath from the current directory was not allowed when attempted by ProcessImagePath.

Provider
Microsoft-Windows-User-Loader
Channel
Application
Opcode
Info

Message #

Loading dependency %2 from the current directory was not allowed when attempted by %1. No other DLL was found and the dependency resolution failed. For more information, see http://go.microsoft.com/fwlink/?LinkId=718136.

Fields #

NameDescription
ProcessImagePath UnicodeString—
CurDirDllPath UnicodeString—