Microsoft-Windows-MUI
28 events across 4 channels
Event ID 2000 — MUI notify operation failed with status code %1.
Message
Fields
| Name | Description |
|---|---|
Status | — |
Event ID 2001 — MUI Callback failed for file %1 because it can not be loaded.
Message
Fields
| Name | Description |
|---|---|
FileName | — |
Event ID 2002 — MUI Callback failed for file %1 registered as type %2 because the function %3 does not exist in the dll.
Message
Fields
| Name | Description |
|---|---|
FileName | — |
Type | — |
FunctionName | — |
Event ID 2003 — MUI Callback failed for file %1 because it is not signed by Microsoft.
Message
Fields
| Name | Description |
|---|---|
FileName | — |
Event ID 2004 — MUI Callback file %1 cannot be found.
Message
Fields
| Name | Description |
|---|---|
FileName | — |
Event ID 2006 — Wow redirection could not be disabled.
Message
Event ID 2007 — Resource cache cannot be opened in writable mode.
Message
Event ID 2008 — Live resource cache could not be disabled.
Message
Event ID 2009 — Unable to retrieve language settings from MUI API.
Message
Event ID 2010 — Unable to parse the cacheable file list or write to the resource cache manifest.
Message
Event ID 2011 — Changes made to resource cache manifest cannot be written to disk.
Message
Event ID 2012 — New resource cache could not be built due to internal error.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
Event ID 2013 — Newly built resource cache could not be installed on the system.
Message
Event ID 2014 — Resource cache manifest could not be created.
Message
Event ID 3000 — MUI notification for UI Language change has been invoked with flags set to %1 and the new languages set to %2 and the previous languages set to %3.
Message
Fields
| Name | Description |
|---|---|
Flags | — |
NewLanguage | — |
PrevLanguage | — |
ExtendedFlag | — |
Example Event
system:
provider: Microsoft-Windows-MUI
guid: A8A1F2F6-A13A-45E9-B1FE-3419569E5EF2
event_source_name: ''
event_id: 3000
version: 0
level: 4
task: 30
opcode: 30
keywords: 9223372036854775808
time_created: '2023-11-06T06:25:37.341209+00:00'
event_record_id: 21
correlation: {}
execution:
process_id: 1424
thread_id: 1552
channel: Microsoft-Windows-MUI/Operational
computer: WinDev2310Eval
security:
user_id: S-1-5-18
event_data:
Flags: 1
NewLanguage: en-US
PrevLanguage: en-US
ExtendedFlag: 0
message: ''
References
- Example event sourced from https://github.com/NextronSystems/evtx-baseline
Event ID 3002 — MUI notification callback API %2 in %1 returned with code %3.
Message
Fields
| Name | Description |
|---|---|
FileName | — |
FunctionName | — |
ReturnValue | — |
Example Event
system:
provider: Microsoft-Windows-MUI
guid: A8A1F2F6-A13A-45E9-B1FE-3419569E5EF2
event_source_name: ''
event_id: 3002
version: 0
level: 4
task: 30
opcode: 31
keywords: 9223372036854775808
time_created: '2023-11-06T06:25:38.231122+00:00'
event_record_id: 28
correlation: {}
execution:
process_id: 1424
thread_id: 1552
channel: Microsoft-Windows-MUI/Operational
computer: WinDev2310Eval
security:
user_id: S-1-5-18
event_data:
FileName: TimeDateMUICallback.dll
FunctionName: ''
ReturnValue: 1299074816
message: ''
References
- Example event sourced from https://github.com/NextronSystems/evtx-baseline
Event ID 3003 — MUI resource cache builder has been called with the following parameters.
Message
Fields
| Name | Description |
|---|---|
Parameter | MUI resource cache builder has been called with the following parameters. |
Example Event
system:
provider: Microsoft-Windows-MUI
guid: A8A1F2F6-A13A-45E9-B1FE-3419569E5EF2
event_source_name: ''
event_id: 3003
version: 0
level: 4
task: 31
opcode: 30
keywords: 9223372036854775808
time_created: '2023-11-06T06:25:38.190967+00:00'
event_record_id: 27
correlation: {}
execution:
process_id: 1568
thread_id: 1572
channel: Microsoft-Windows-MUI/Operational
computer: WinDev2310Eval
security:
user_id: S-1-5-18
event_data:
Parameter: '-s '
message: ''
References
- Example event sourced from https://github.com/NextronSystems/evtx-baseline
Event ID 3004 — MUI resource cache manifest entry for file %1 has been updated.
Message
Fields
| Name | Description |
|---|---|
and_Priority | — |
FileName | — |
Affinity | — |
Sequence | — |
Priority | — |
Event ID 3005 — Start.
Message
Fields
| Name | Description |
|---|---|
Start | — |
Name | — |
Event ID 3006 — End.
Message
Fields
| Name | Description |
|---|---|
End | — |
Name | — |
Event ID 3007 — New resource cache built and installed on system.
Message
Fields
| Name | Description |
|---|---|
NewCacheIndex | — |
LiveCacheIndex | — |
Config | — |
Event ID 3008 — Start.
Message
Fields
| Name | Description |
|---|---|
Start | — |
Name | — |
Event ID 3009 — End.
Message
Fields
| Name | Description |
|---|---|
End | — |
Name | — |
Event ID 3010 — Start.
Message
Fields
| Name | Description |
|---|---|
Start | — |
Name | — |
Event ID 3011 — End.
Message
Fields
| Name | Description |
|---|---|
End | — |
Name | — |
Event ID 3012 — Resource file %1 will not be cached since it is not used frequently in the system.
Message
Fields
| Name | Description |
|---|---|
FileName | — |