2024-01-02: Site is back on track, self-hosted on a rpi because you get the Internet you fund.
← back

c689aaba-8e78-11d0-8c47-00c04fc295ee
CRYPT_SUBJTYPE_CABINET_IMAGE

c689aaba-8e78-11d0-8c47-00c04fc295ee 1997-02-24 19:04:17⋮75002·124fa CRYPT_SUBJTYPE_CABINET_IMAGE

Version	1
Variant	specified in RFC 4122
urn	urn:uuid:c689aaba-8e78-11d0-8c47-00c04fc295ee
Hexdump	c689aaba8e7811d08c4700c04fc295ee
Bytes	╞ë¬║Äx␑╨îG␀└O┬òε
Clock ID	3143
Clock ID (hex)	0xc47
Timestamp, RFC	1997-02-24 19:04:17
Timestamp, MS	2015-05-14 19:04:17
Timestamp, UNIX	2384-05-13 19:04:17
Raw hex timestamp	0x1d08e78c689aaba
Raw timestamp	130761038571875002
Sub-millisecond timestamp	75002
MAC Address	00c04fc295ee
is_local bit	False
is_multicast bit	False
MAC Manufacturer	Dell
UUIDv1	timestamp + clock_id + version (1) + node ID (MAC)
MAC Date	1998-04-22, deepmac.org, 00c04f/24

Links :

UUID registration form :

MS:SIP Cabinet

https://specterops.io/assets/resources/SpecterOps_Subverting_Trust_in_Windows.pdf

0

MS:Crypto:EncodingType:CryptSIPDllCreateIndirectData_CryptSIPDllCreateIndirectData

path: Microsoft.PowerShell.Core\Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData\{C689AABA-8E78-11D0-8C47-00C04FC295EE}
FuncName: CryptSIPCreateIndirectData
Dll: WINTRUST.DLL

0 c.ps1v001 Microsoft Windows 7 Entreprise v6.1.7601.65536 2018-04-18

MS:Crypto:EncodingType:CryptSIPDllGetSignedDataMsg_CryptSIPDllGetSignedDataMsg

path: Microsoft.PowerShell.Core\Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{C689AABA-8E78-11D0-8C47-00C04FC295EE}
FuncName: CryptSIPGetSignedDataMsg
Dll: WINTRUST.DLL

0 c.ps1v001 Microsoft Windows 7 Entreprise v6.1.7601.65536 2018-04-18

MS:Crypto:EncodingType:CryptSIPDllPutSignedDataMsg_CryptSIPDllPutSignedDataMsg

path: Microsoft.PowerShell.Core\Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{C689AABA-8E78-11D0-8C47-00C04FC295EE}
FuncName: CryptSIPPutSignedDataMsg
Dll: WINTRUST.DLL

0 c.ps1v001 Microsoft Windows 7 Entreprise v6.1.7601.65536 2018-04-18

MS:Crypto:EncodingType:CryptSIPDllRemoveSignedDataMsg_CryptSIPDllRemoveSignedDataMsg

path: Microsoft.PowerShell.Core\Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{C689AABA-8E78-11D0-8C47-00C04FC295EE}
FuncName: CryptSIPRemoveSignedDataMsg
Dll: WINTRUST.DLL

0 c.ps1v001 Microsoft Windows 7 Entreprise v6.1.7601.65536 2018-04-18

MS:CryptSIPDllCreateIndirectData_CryptSIPCreateIndirectData

path: Microsoft.PowerShell.Core\Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData\{C689AABA-8E78-11D0-8C47-00C04FC295EE}
FuncName: CryptSIPCreateIndirectData
Dll: WINTRUST.DLL

0 c.ps1v001 Microsoft Windows 7 Entreprise v6.1.7601.65536 2018-04-18

MS:CryptSIPDllGetSignedDataMsg_CryptSIPGetSignedDataMsg

path: Microsoft.PowerShell.Core\Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{C689AABA-8E78-11D0-8C47-00C04FC295EE}
FuncName: CryptSIPGetSignedDataMsg
Dll: WINTRUST.DLL

0 c.ps1v001 Microsoft Windows 7 Entreprise v6.1.7601.65536 2018-04-18

MS:CryptSIPDllPutSignedDataMsg_CryptSIPPutSignedDataMsg

path: Microsoft.PowerShell.Core\Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{C689AABA-8E78-11D0-8C47-00C04FC295EE}
FuncName: CryptSIPPutSignedDataMsg
Dll: WINTRUST.DLL

0 c.ps1v001 Microsoft Windows 7 Entreprise v6.1.7601.65536 2018-04-18

MS:CryptSIPDllRemoveSignedDataMsg_CryptSIPRemoveSignedDataMsg

path: Microsoft.PowerShell.Core\Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{C689AABA-8E78-11D0-8C47-00C04FC295EE}
FuncName: CryptSIPRemoveSignedDataMsg
Dll: WINTRUST.DLL

0 c.ps1v001 Microsoft Windows 7 Entreprise v6.1.7601.65536 2018-04-18

MS:CryptSIPDllVerifyIndirectData_CryptSIPVerifyIndirectData

path: Microsoft.PowerShell.Core\Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{C689AABA-8E78-11D0-8C47-00C04FC295EE}
FuncName: CryptSIPVerifyIndirectData
Dll: WINTRUST.DLL

0 c.ps1v001 Microsoft Windows 7 Entreprise v6.1.7601.65536 2018-04-18

CRYPT_SUBJTYPE_CABINET_IMAGE

1

HKLM\Software\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg

Windows 98 Registry
object: reg-subkey
name: None
key: HKLM\Software\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg

from Mikołaj Zalewski's http://mikolajapp2.appspot.com - reg-win98.xml

0 autopush - reg-win98

HKLM\Software\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg

Windows 98 Registry
object: reg-subkey
name: None
key: HKLM\Software\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg

from Mikołaj Zalewski's http://mikolajapp2.appspot.com - reg-win98.xml

0 autopush - reg-win98

HKLM\Software\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg

Windows 98 Registry
object: reg-subkey
name: None
key: HKLM\Software\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg

from Mikołaj Zalewski's http://mikolajapp2.appspot.com - reg-win98.xml

0 autopush - reg-win98

HKLM\Software\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData

Windows 98 Registry
object: reg-subkey
name: None
key: HKLM\Software\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData

from Mikołaj Zalewski's http://mikolajapp2.appspot.com - reg-win98.xml

0 autopush - reg-win98

HKLM\Software\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData

Windows 98 Registry
object: reg-subkey
name: None
key: HKLM\Software\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData

from Mikołaj Zalewski's http://mikolajapp2.appspot.com - reg-win98.xml

0 autopush - reg-win98

HKLM\Software\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData

Wine 1.1.0 Registry
object: reg-subkey
name: None
key: HKLM\Software\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData

from Mikołaj Zalewski's http://mikolajapp2.appspot.com - reg-wine11.xml

0 autopush - reg-wine11

HKLM\Software\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg

Wine 1.1.0 Registry
object: reg-subkey
name: None
key: HKLM\Software\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg

from Mikołaj Zalewski's http://mikolajapp2.appspot.com - reg-wine11.xml

0 autopush - reg-wine11

HKLM\Software\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg

Wine 1.1.0 Registry
object: reg-subkey
name: None
key: HKLM\Software\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg

from Mikołaj Zalewski's http://mikolajapp2.appspot.com - reg-wine11.xml

0 autopush - reg-wine11

HKLM\Software\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg

Wine 1.1.0 Registry
object: reg-subkey
name: None
key: HKLM\Software\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg

from Mikołaj Zalewski's http://mikolajapp2.appspot.com - reg-wine11.xml

0 autopush - reg-wine11

HKLM\Software\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData

Wine 1.1.0 Registry
object: reg-subkey
name: None
key: HKLM\Software\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData

from Mikołaj Zalewski's http://mikolajapp2.appspot.com - reg-wine11.xml

0 autopush - reg-wine11

HKLM\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData

Windows Vista Registry
object: reg-subkey
name: None
key: HKLM\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData

from Mikołaj Zalewski's http://mikolajapp2.appspot.com - reg-vista.xml

0 autopush - reg-vista

HKLM\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg

Windows Vista Registry
object: reg-subkey
name: None
key: HKLM\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg

from Mikołaj Zalewski's http://mikolajapp2.appspot.com - reg-vista.xml

0 autopush - reg-vista

HKLM\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg

Windows Vista Registry
object: reg-subkey
name: None
key: HKLM\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg

from Mikołaj Zalewski's http://mikolajapp2.appspot.com - reg-vista.xml

0 autopush - reg-vista

HKLM\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg

Windows Vista Registry
object: reg-subkey
name: None
key: HKLM\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg

from Mikołaj Zalewski's http://mikolajapp2.appspot.com - reg-vista.xml

0 autopush - reg-vista

HKLM\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData

Windows Vista Registry
object: reg-subkey
name: None
key: HKLM\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData

from Mikołaj Zalewski's http://mikolajapp2.appspot.com - reg-vista.xml

0 autopush - reg-vista

57806