MUI Resource Trace
1 events across 1 channel
| Event | Title | Channel | Sample |
|---|---|---|---|
| 0 | MUIResource | ETW Trace | Y |
Event ID 0: MUIResource
#Fields #
| Name | Description |
|---|---|
MuiLoadString mof:String |
Example Event #
{
"system": {
"provider": "MUI Resource Trace",
"guid": "{D3DE60B2-A663-45D5-9826-A0A5949D2CB0}",
"event_source_name": "",
"event_id": 0,
"version": 0,
"level": 0,
"task": 0,
"opcode": 0,
"keywords": "",
"time_created": "2026-06-02T04:02:05.625+00:00",
"event_record_id": 0,
"correlation": {},
"execution": {
"process_id": 3132,
"thread_id": 7676
},
"channel": "ETW Trace",
"computer": "JD-DC01-2022",
"security": {
"user_id": ""
}
},
"event_data": {
"MuiLoadString": "LdrResSearchResource Enter"
},
"message": "MUIResource"
}
Provenance
Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.
ETW provider GUID {D3DE60B2-A663-45D5-9826-A0A5949D2CB0}
Observed on:
- WS2025-26100.0, schema read from the WMI MOF class, captured 2026-02-26
Taken from Windows installation media (build 26100.1), not a patched system, so the exact update level is unknown.
- WS2022-20348.4893, sample captured from a live trace, captured 2026-06-02
- WS2022-20348.4893, schema read from the WMI MOF class, captured 2026-06-02
MOF class: MuiTrace
- Win11-26200.6584, schema read from the WMI MOF class, captured 2026-06-02
MOF class: MuiTrace