topic Re: Operation type for event 5058 in Getting Data In

Operation type for event 5058 {Solution}

Hons — Fri, 14 Oct 2022 14:57:07 GMT

Hello everyone,

Have you ever wondered why microsoft does not documented Operation types with Unicode + meaning?

You don´t need to anymore.

I have made the needed research (anyone can do) and here are the results:

%%2458 = Read

%%2459 = Write

%%2457 = Delete

mrthom — Fri, 14 Oct 2022 14:36:38 GMT

have found it 😄 it is non-sense string stored in system32/msobjs.dll and some snapshot can be seen there

%%2456 : Open key file.
%%2457 : Delete key file.
%%2458 : Read persisted key from file.
%%2459 : Write persisted key to file.

Hons — Fri, 14 Oct 2022 15:29:47 GMT

Thanks @mrthom.

Your version is absolutely precise 😉