2024-01-02: Site is back on track, self-hosted on a rpi because you get the Internet you fund.
← back

9ba61d3f-e73a-11d0-8cd2-00c04fc295ee
CRYPT_SUBJTYPE_CTL_IMAGE

9ba61d3f-e73a-11d0-8cd2-00c04fc295ee 1997-06-17 17:53:29⋮18751· 493f CRYPT_SUBJTYPE_CTL_IMAGE

Version	1
Variant	specified in RFC 4122
urn	urn:uuid:9ba61d3f-e73a-11d0-8cd2-00c04fc295ee
Hexdump	9ba61d3fe73a11d08cd200c04fc295ee
Bytes	¢ª␝?τ:␑╨î╥␀└O┬òε
Clock ID	3282
Clock ID (hex)	0xcd2
Timestamp, RFC	1997-06-17 17:53:29
Timestamp, MS	2015-09-04 17:53:29
Timestamp, UNIX	2384-09-03 17:53:29
Raw hex timestamp	0x1d0e73a9ba61d3f
Raw timestamp	130858628099218751
Sub-millisecond timestamp	18751
MAC Address	00c04fc295ee
is_local bit	False
is_multicast bit	False
MAC Manufacturer	Dell
UUIDv1	timestamp + clock_id + version (1) + node ID (MAC)
MAC Date	1998-04-22, deepmac.org, 00c04f/24

Links :

UUID registration form :

MS:SIP CTL

https://specterops.io/assets/resources/SpecterOps_Subverting_Trust_in_Windows.pdf

0

MS:Crypto:EncodingType:CryptSIPDllCreateIndirectData_CryptSIPDllCreateIndirectData

path: Microsoft.PowerShell.Core\Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData\{9BA61D3F-E73A-11D0-8CD2-00C04FC295EE}
FuncName: CryptSIPCreateIndirectData
Dll: WINTRUST.DLL

0 c.ps1v001 Microsoft Windows 7 Entreprise v6.1.7601.65536 2018-04-18

MS:Crypto:EncodingType:CryptSIPDllGetSignedDataMsg_CryptSIPDllGetSignedDataMsg

path: Microsoft.PowerShell.Core\Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{9BA61D3F-E73A-11D0-8CD2-00C04FC295EE}
FuncName: CryptSIPGetSignedDataMsg
Dll: WINTRUST.DLL

0 c.ps1v001 Microsoft Windows 7 Entreprise v6.1.7601.65536 2018-04-18

MS:Crypto:EncodingType:CryptSIPDllPutSignedDataMsg_CryptSIPDllPutSignedDataMsg

path: Microsoft.PowerShell.Core\Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{9BA61D3F-E73A-11D0-8CD2-00C04FC295EE}
FuncName: CryptSIPPutSignedDataMsg
Dll: WINTRUST.DLL

0 c.ps1v001 Microsoft Windows 7 Entreprise v6.1.7601.65536 2018-04-18

MS:Crypto:EncodingType:CryptSIPDllRemoveSignedDataMsg_CryptSIPDllRemoveSignedDataMsg

path: Microsoft.PowerShell.Core\Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{9BA61D3F-E73A-11D0-8CD2-00C04FC295EE}
FuncName: CryptSIPRemoveSignedDataMsg
Dll: WINTRUST.DLL

0 c.ps1v001 Microsoft Windows 7 Entreprise v6.1.7601.65536 2018-04-18

MS:CryptSIPDllCreateIndirectData_CryptSIPCreateIndirectData

path: Microsoft.PowerShell.Core\Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData\{9BA61D3F-E73A-11D0-8CD2-00C04FC295EE}
FuncName: CryptSIPCreateIndirectData
Dll: WINTRUST.DLL

0 c.ps1v001 Microsoft Windows 7 Entreprise v6.1.7601.65536 2018-04-18

MS:CryptSIPDllGetSignedDataMsg_CryptSIPGetSignedDataMsg

path: Microsoft.PowerShell.Core\Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{9BA61D3F-E73A-11D0-8CD2-00C04FC295EE}
FuncName: CryptSIPGetSignedDataMsg
Dll: WINTRUST.DLL

0 c.ps1v001 Microsoft Windows 7 Entreprise v6.1.7601.65536 2018-04-18

MS:CryptSIPDllPutSignedDataMsg_CryptSIPPutSignedDataMsg

path: Microsoft.PowerShell.Core\Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{9BA61D3F-E73A-11D0-8CD2-00C04FC295EE}
FuncName: CryptSIPPutSignedDataMsg
Dll: WINTRUST.DLL

0 c.ps1v001 Microsoft Windows 7 Entreprise v6.1.7601.65536 2018-04-18

MS:CryptSIPDllRemoveSignedDataMsg_CryptSIPRemoveSignedDataMsg

path: Microsoft.PowerShell.Core\Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{9BA61D3F-E73A-11D0-8CD2-00C04FC295EE}
FuncName: CryptSIPRemoveSignedDataMsg
Dll: WINTRUST.DLL

0 c.ps1v001 Microsoft Windows 7 Entreprise v6.1.7601.65536 2018-04-18

MS:CryptSIPDllVerifyIndirectData_CryptSIPVerifyIndirectData

path: Microsoft.PowerShell.Core\Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{9BA61D3F-E73A-11D0-8CD2-00C04FC295EE}
FuncName: CryptSIPVerifyIndirectData
Dll: WINTRUST.DLL

0 c.ps1v001 Microsoft Windows 7 Entreprise v6.1.7601.65536 2018-04-18

CRYPT_SUBJTYPE_CTL_IMAGE

ms trust

1

HKLM\Software\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg

Windows 98 Registry
object: reg-subkey
name: None
key: HKLM\Software\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg

from Mikołaj Zalewski's http://mikolajapp2.appspot.com - reg-win98.xml

0 autopush - reg-win98

HKLM\Software\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg

Windows 98 Registry
object: reg-subkey
name: None
key: HKLM\Software\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg

from Mikołaj Zalewski's http://mikolajapp2.appspot.com - reg-win98.xml

0 autopush - reg-win98

HKLM\Software\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg

Windows 98 Registry
object: reg-subkey
name: None
key: HKLM\Software\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg

from Mikołaj Zalewski's http://mikolajapp2.appspot.com - reg-win98.xml

0 autopush - reg-win98

HKLM\Software\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData

Windows 98 Registry
object: reg-subkey
name: None
key: HKLM\Software\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData

from Mikołaj Zalewski's http://mikolajapp2.appspot.com - reg-win98.xml

0 autopush - reg-win98

HKLM\Software\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData

Windows 98 Registry
object: reg-subkey
name: None
key: HKLM\Software\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData

from Mikołaj Zalewski's http://mikolajapp2.appspot.com - reg-win98.xml

0 autopush - reg-win98

HKLM\Software\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData

Wine 1.1.0 Registry
object: reg-subkey
name: None
key: HKLM\Software\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData

from Mikołaj Zalewski's http://mikolajapp2.appspot.com - reg-wine11.xml

0 autopush - reg-wine11

HKLM\Software\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg

Wine 1.1.0 Registry
object: reg-subkey
name: None
key: HKLM\Software\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg

from Mikołaj Zalewski's http://mikolajapp2.appspot.com - reg-wine11.xml

0 autopush - reg-wine11

HKLM\Software\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg

Wine 1.1.0 Registry
object: reg-subkey
name: None
key: HKLM\Software\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg

from Mikołaj Zalewski's http://mikolajapp2.appspot.com - reg-wine11.xml

0 autopush - reg-wine11

HKLM\Software\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg

Wine 1.1.0 Registry
object: reg-subkey
name: None
key: HKLM\Software\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg

from Mikołaj Zalewski's http://mikolajapp2.appspot.com - reg-wine11.xml

0 autopush - reg-wine11

HKLM\Software\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData

Wine 1.1.0 Registry
object: reg-subkey
name: None
key: HKLM\Software\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData

from Mikołaj Zalewski's http://mikolajapp2.appspot.com - reg-wine11.xml

0 autopush - reg-wine11

HKLM\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData

Windows Vista Registry
object: reg-subkey
name: None
key: HKLM\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData

from Mikołaj Zalewski's http://mikolajapp2.appspot.com - reg-vista.xml

0 autopush - reg-vista

HKLM\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg

Windows Vista Registry
object: reg-subkey
name: None
key: HKLM\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg

from Mikołaj Zalewski's http://mikolajapp2.appspot.com - reg-vista.xml

0 autopush - reg-vista

HKLM\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg

Windows Vista Registry
object: reg-subkey
name: None
key: HKLM\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg

from Mikołaj Zalewski's http://mikolajapp2.appspot.com - reg-vista.xml

0 autopush - reg-vista

HKLM\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg

Windows Vista Registry
object: reg-subkey
name: None
key: HKLM\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg

from Mikołaj Zalewski's http://mikolajapp2.appspot.com - reg-vista.xml

0 autopush - reg-vista

HKLM\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData

Windows Vista Registry
object: reg-subkey
name: None
key: HKLM\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData

from Mikołaj Zalewski's http://mikolajapp2.appspot.com - reg-vista.xml

0 autopush - reg-vista

57805