CLSID:Loads ELSEXT.DLL (Known Related to CVE-2015-6128)

2024-01-02: Site is back on track, self-hosted on a rpi because you get the Internet you fund. 2025-02-06: Oh well, some power grid issues caused the rpi to reboot, I really should configure uwsgi to restart automatically --'

975797fc-4e2a-11d0-b702-00c04fd8dbf7
CLSID:Loads ELSEXT.DLL (Known Related to CVE-2015-6128)

975797fc-4e2a-11d0-b702-00c04fd8dbf7 1996-12-04 23:03:22⋮37500· 927c CLSID:Loads ELSEXT.DLL (Known Related to CVE-2015-6128)

CLSID

Version	1
Variant	specified in RFC 4122
urn	urn:uuid:975797fc-4e2a-11d0-b702-00c04fd8dbf7
Hexdump	975797fc4e2a11d0b70200c04fd8dbf7
Bytes	ùWùⁿN*␑╨╖␂␀└O╪█≈
Clock ID	14082
Clock ID (hex)	0x3702
Timestamp, RFC	1996-12-04 23:03:22
Timestamp, MS	2015-02-21 23:03:22
Timestamp, UNIX	2384-02-21 23:03:22
Raw hex timestamp	0x1d04e2a975797fc
Raw timestamp	130690334028437500
Sub-millisecond timestamp	37500
MAC Address	00c04fd8dbf7
is_local bit	False
is_multicast bit	False
MAC Manufacturer	Dell
UUIDv1	timestamp + clock_id + version (1) + node ID (MAC)
MAC Date	1998-04-22, deepmac.org, 00c04f/24

UUID registration form :

unnamed w10.clsid

w10.clsid

0 w10 clsid push

noname_els.dll

CLSID,
InprocServer32.: C:\WINDOWS\system32\els.dll
InprocServer32.ThreadingModel: Apartment

0 c.ps1v001 Microsoft Windows 10 Pro v10.0.16299.0 2018-01-27

noname_els.dll

CLSID,
InprocServer32.: C:\Windows\system32\els.dll
InprocServer32.ThreadingModel: Apartment

0 c.ps1v001 Microsoft Windows 7 Ultimate N v6.1.7601.65536 2018-01-27

RFCTIM
from https://misc.daniel-marschall.de/projects/guid_analysis/guid.txt

0 autopush - dmde

Windows Vista Registry
object: reg-clsid
name: 
key: None
inproc-server : {
  "file": "els.dll",
  "product-version": "6.0.6000.16386",
  "product": "Microsoft\u00ae Windows\u00ae Operating System"
}

from Mikołaj Zalewski's http://mikolajapp2.appspot.com - reg-vista.xml

0 autopush - reg-vista

HKLM\SOFTWARE\Microsoft\MMC\SnapIns

Windows Vista Registry
object: reg-subkey
name: None
key: HKLM\SOFTWARE\Microsoft\MMC\SnapIns

from Mikołaj Zalewski's http://mikolajapp2.appspot.com - reg-vista.xml

0 autopush - reg-vista

CLSID:Loads ELSEXT.DLL (Known Related to CVE-2015-6128)

CLSID from https://github.com/decalage2/oletools/blob/master/oletools/common/clsid.py

1 autopush - oletools 0.53 clsid

975797fc-4e2a-11d0-b702-00c04fd8dbf7CLSID:Loads ELSEXT.DLL (Known Related to CVE-2015-6128)

975797fc-4e2a-11d0-b702-00c04fd8dbf7
CLSID:Loads ELSEXT.DLL (Known Related to CVE-2015-6128)