mrxsmb

Provenance

Defined in mrxsmb.sys, the binary that emits these events.

• Win11-26200.6584, schema recovered from debug symbols, binary version 10.0.26100.5074, PDB signature CBC5312D7EF6D1D46AF5DE4E36F400341, captured 2026-06-02 — mrxsmb WPP/TMF statements (in the Win11-26200.6584 TMF pack) — TMF corpus provenance and drift model (Win11-26200.6584)

  mrxsmb.sys was recovered from Microsoft's public symbol server. These are low-level developer trace messages whose internal identifiers Windows renumbers on every build, so a capture decodes correctly only against the exact binary it came from. Match the PDB signature above to the mrxsmb.sys on your own host before decoding a captured trace.