HKLM\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Signature

573e31f8-ddba-11d0-8ccb-00c04fc295ee
HKLM\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Signature

573e31f8-ddba-11d0-8ccb-00c04fc295ee 1997-06-05 15:42:39⋮93752·16e38 HKLM\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Signature

Version	1
Variant	specified in RFC 4122
urn	urn:uuid:573e31f8-ddba-11d0-8ccb-00c04fc295ee
Hexdump	573e31f8ddba11d08ccb00c04fc295ee
Bytes	W>1°▌║␑╨î╦␀└O┬òε
Clock ID	3275
Clock ID (hex)	0xccb
Timestamp, RFC	1997-06-05 15:42:39
Timestamp, MS	2015-08-23 15:42:39
Timestamp, UNIX	2384-08-22 15:42:39
Raw hex timestamp	0x1d0ddba573e31f8
Raw timestamp	130848181591093752
Sub-millisecond timestamp	93752
MAC Address	00c04fc295ee
is_local bit	False
is_multicast bit	False
MAC Manufacturer	Dell
UUIDv1	timestamp + clock_id + version (1) + node ID (MAC)
MAC Date	1998-04-22, deepmac.org, 00c04f/24

UUID registration form :

MSTrustProvider

path: Microsoft.PowerShell.Core\Registry::HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\Providers\Trust\Signature\{573E31F8-DDBA-11D0-8CCB-00C04FC295EE}
Function: SoftpubLoadSignature
DLL: WINTRUST.DLL

0 c.ps1v001 Microsoft Windows 7 Entreprise v6.1.7601.65536 2018-04-18

WINTRUST_ACTION_TRUSTPROVIDER_TEST

MSTrust provider
from https://specterops.io/assets/resources/SpecterOps_Subverting_Trust_in_Windows.pdf

0 autopush - mstrust

HKLM\Software\Microsoft\Cryptography\Providers\Trust\Initialization

Windows 98 Registry
object: reg-subkey
name: None
key: HKLM\Software\Microsoft\Cryptography\Providers\Trust\Initialization

from Mikołaj Zalewski's http://mikolajapp2.appspot.com - reg-win98.xml

0 autopush - reg-win98

HKLM\Software\Microsoft\Cryptography\Providers\Trust\Message

Windows 98 Registry
object: reg-subkey
name: None
key: HKLM\Software\Microsoft\Cryptography\Providers\Trust\Message

from Mikołaj Zalewski's http://mikolajapp2.appspot.com - reg-win98.xml

0 autopush - reg-win98

HKLM\Software\Microsoft\Cryptography\Providers\Trust\Signature

Windows 98 Registry
object: reg-subkey
name: None
key: HKLM\Software\Microsoft\Cryptography\Providers\Trust\Signature

from Mikołaj Zalewski's http://mikolajapp2.appspot.com - reg-win98.xml

0 autopush - reg-win98

HKLM\Software\Microsoft\Cryptography\Providers\Trust\Certificate

Windows 98 Registry
object: reg-subkey
name: None
key: HKLM\Software\Microsoft\Cryptography\Providers\Trust\Certificate

from Mikołaj Zalewski's http://mikolajapp2.appspot.com - reg-win98.xml

0 autopush - reg-win98

HKLM\Software\Microsoft\Cryptography\Providers\Trust\CertCheck

Windows 98 Registry
object: reg-subkey
name: None
key: HKLM\Software\Microsoft\Cryptography\Providers\Trust\CertCheck

from Mikołaj Zalewski's http://mikolajapp2.appspot.com - reg-win98.xml

0 autopush - reg-win98

HKLM\Software\Microsoft\Cryptography\Providers\Trust\FinalPolicy

Windows 98 Registry
object: reg-subkey
name: None
key: HKLM\Software\Microsoft\Cryptography\Providers\Trust\FinalPolicy

from Mikołaj Zalewski's http://mikolajapp2.appspot.com - reg-win98.xml

0 autopush - reg-win98

HKLM\Software\Microsoft\Cryptography\Providers\Trust\Cleanup

Windows 98 Registry
object: reg-subkey
name: None
key: HKLM\Software\Microsoft\Cryptography\Providers\Trust\Cleanup

from Mikołaj Zalewski's http://mikolajapp2.appspot.com - reg-win98.xml

0 autopush - reg-win98

HKLM\Software\Microsoft\Cryptography\Providers\Trust\DiagnosticPolicy

Windows 98 Registry
object: reg-subkey
name: None
key: HKLM\Software\Microsoft\Cryptography\Providers\Trust\DiagnosticPolicy

from Mikołaj Zalewski's http://mikolajapp2.appspot.com - reg-win98.xml

0 autopush - reg-win98

HKLM\Software\Microsoft\Cryptography\Providers\Trust\CertCheck

Wine 1.1.0 Registry
object: reg-subkey
name: None
key: HKLM\Software\Microsoft\Cryptography\Providers\Trust\CertCheck

from Mikołaj Zalewski's http://mikolajapp2.appspot.com - reg-wine11.xml

0 autopush - reg-wine11

HKLM\Software\Microsoft\Cryptography\Providers\Trust\Certificate

Wine 1.1.0 Registry
object: reg-subkey
name: None
key: HKLM\Software\Microsoft\Cryptography\Providers\Trust\Certificate

from Mikołaj Zalewski's http://mikolajapp2.appspot.com - reg-wine11.xml

0 autopush - reg-wine11

HKLM\Software\Microsoft\Cryptography\Providers\Trust\Cleanup

Wine 1.1.0 Registry
object: reg-subkey
name: None
key: HKLM\Software\Microsoft\Cryptography\Providers\Trust\Cleanup

from Mikołaj Zalewski's http://mikolajapp2.appspot.com - reg-wine11.xml

0 autopush - reg-wine11

HKLM\Software\Microsoft\Cryptography\Providers\Trust\DiagnosticPolicy

Wine 1.1.0 Registry
object: reg-subkey
name: None
key: HKLM\Software\Microsoft\Cryptography\Providers\Trust\DiagnosticPolicy

from Mikołaj Zalewski's http://mikolajapp2.appspot.com - reg-wine11.xml

0 autopush - reg-wine11

HKLM\Software\Microsoft\Cryptography\Providers\Trust\FinalPolicy

Wine 1.1.0 Registry
object: reg-subkey
name: None
key: HKLM\Software\Microsoft\Cryptography\Providers\Trust\FinalPolicy

from Mikołaj Zalewski's http://mikolajapp2.appspot.com - reg-wine11.xml

0 autopush - reg-wine11

HKLM\Software\Microsoft\Cryptography\Providers\Trust\Initialization

Wine 1.1.0 Registry
object: reg-subkey
name: None
key: HKLM\Software\Microsoft\Cryptography\Providers\Trust\Initialization

from Mikołaj Zalewski's http://mikolajapp2.appspot.com - reg-wine11.xml

0 autopush - reg-wine11

HKLM\Software\Microsoft\Cryptography\Providers\Trust\Message

Wine 1.1.0 Registry
object: reg-subkey
name: None
key: HKLM\Software\Microsoft\Cryptography\Providers\Trust\Message

from Mikołaj Zalewski's http://mikolajapp2.appspot.com - reg-wine11.xml

0 autopush - reg-wine11

HKLM\Software\Microsoft\Cryptography\Providers\Trust\Signature

Wine 1.1.0 Registry
object: reg-subkey
name: None
key: HKLM\Software\Microsoft\Cryptography\Providers\Trust\Signature

from Mikołaj Zalewski's http://mikolajapp2.appspot.com - reg-wine11.xml

0 autopush - reg-wine11

HKLM\SOFTWARE\Microsoft\Cryptography\Providers\Trust\CertCheck

Windows Vista Registry
object: reg-subkey
name: None
key: HKLM\SOFTWARE\Microsoft\Cryptography\Providers\Trust\CertCheck

from Mikołaj Zalewski's http://mikolajapp2.appspot.com - reg-vista.xml

0 autopush - reg-vista

HKLM\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Certificate

Windows Vista Registry
object: reg-subkey
name: None
key: HKLM\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Certificate

from Mikołaj Zalewski's http://mikolajapp2.appspot.com - reg-vista.xml

0 autopush - reg-vista

HKLM\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Cleanup

Windows Vista Registry
object: reg-subkey
name: None
key: HKLM\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Cleanup

from Mikołaj Zalewski's http://mikolajapp2.appspot.com - reg-vista.xml

0 autopush - reg-vista

HKLM\SOFTWARE\Microsoft\Cryptography\Providers\Trust\DiagnosticPolicy

Windows Vista Registry
object: reg-subkey
name: None
key: HKLM\SOFTWARE\Microsoft\Cryptography\Providers\Trust\DiagnosticPolicy

from Mikołaj Zalewski's http://mikolajapp2.appspot.com - reg-vista.xml

0 autopush - reg-vista

HKLM\SOFTWARE\Microsoft\Cryptography\Providers\Trust\FinalPolicy

Windows Vista Registry
object: reg-subkey
name: None
key: HKLM\SOFTWARE\Microsoft\Cryptography\Providers\Trust\FinalPolicy

from Mikołaj Zalewski's http://mikolajapp2.appspot.com - reg-vista.xml

0 autopush - reg-vista

HKLM\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Initialization

Windows Vista Registry
object: reg-subkey
name: None
key: HKLM\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Initialization

from Mikołaj Zalewski's http://mikolajapp2.appspot.com - reg-vista.xml

0 autopush - reg-vista

HKLM\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Message

Windows Vista Registry
object: reg-subkey
name: None
key: HKLM\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Message

from Mikołaj Zalewski's http://mikolajapp2.appspot.com - reg-vista.xml

0 autopush - reg-vista

HKLM\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Signature

Windows Vista Registry
object: reg-subkey
name: None
key: HKLM\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Signature

from Mikołaj Zalewski's http://mikolajapp2.appspot.com - reg-vista.xml

0 autopush - reg-vista

(in wine/dlls/wintrust/register.c:548) * WINTRUST_ACTION_TRUSTPROVIDER_TEST ({573E31F8-DDBA-11D0-8CCB-00C04FC295EE})

from the wine source code

-1 autopush - wine

wine/dlls/wintrust/register.c:547

*   WINTRUST_ACTION_TRUSTPROVIDER_TEST ({573E31F8-DDBA-11D0-8CCB-00C04FC295EE})
in wine/dlls/wintrust/register.c:547

-2 wine

reactos/dll/win32/wintrust/register.c:547

*   WINTRUST_ACTION_TRUSTPROVIDER_TEST ({573E31F8-DDBA-11D0-8CCB-00C04FC295EE})
in reactos/dll/win32/wintrust/register.c:547

-2 reactos

Include/10.0.16299.0/um/SoftPub.h:71

//          {573E31F8-DDBA-11d0-8CCB-00C04FC295EE}
in Include/10.0.16299.0/um/SoftPub.h:71

-2

573e31f8-ddba-11d0-8ccb-00c04fc295eeHKLM\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Signature

573e31f8-ddba-11d0-8ccb-00c04fc295ee
HKLM\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Signature