As captured amply well by its name, the LDR_DLL_LOAD_REASON enumeration (formally _LDR_DLL_LOAD_REASON) tells something of why or how a DLL got loaded. It is thought to exist only as the LoadReason member of the LDR_DATA_TABLE_ENTRY.


The defined values and Microsoft’s names for them are known from public symbol files for the kernel, starting with Windows 8.

Value Name Versions
0 LoadReasonStaticDependency 6.2 and higher
1 LoadReasonStaticForwarderDependency 6.2 and higher
2 LoadReasonDynamicForwarderDependency 6.2 and higher
3 LoadReasonDelayloadDependency 6.2 and higher
4 LoadReasonDynamicLoad 6.2 and higher
5 LoadReasonAsImageLoad 6.2 and higher
6 LoadReasonAsDataLoad 6.2 and higher
7 LoadReasonEnclavePrimary 1709 and higher
8 LoadReasonEnclaveDependency 1709 and higher
-1 LoadReasonUnknown 6.2 and higher