2024-01-02: Site is back on track, self-hosted on a rpi because you get the Internet you fund.
← back

de351a43-8e59-11d0-8c47-00c04fc295ee
CRYPT_SUBJTYPE_CATALOG_IMAGE

de351a43-8e59-11d0-8c47-00c04fc295ee 1997-02-24 15:23:02⋮ 3· 3 CRYPT_SUBJTYPE_CATALOG_IMAGE

Version	1
Variant	specified in RFC 4122
urn	urn:uuid:de351a43-8e59-11d0-8c47-00c04fc295ee
Hexdump	de351a438e5911d08c4700c04fc295ee
Bytes	▐5␚CÄY␑╨îG␀└O┬òε
Clock ID	3143
Clock ID (hex)	0xc47
Timestamp, RFC	1997-02-24 15:23:02
Timestamp, MS	2015-05-14 15:23:02
Timestamp, UNIX	2384-05-13 15:23:02
Raw hex timestamp	0x1d08e59de351a43
Raw timestamp	130760905825000003
Sub-millisecond timestamp	3
MAC Address	00c04fc295ee
is_local bit	False
is_multicast bit	False
MAC Manufacturer	Dell
UUIDv1	timestamp + clock_id + version (1) + node ID (MAC)
MAC Date	1998-04-22, deepmac.org, 00c04f/24

Links :

UUID registration form :

MS:SIP Catalog

https://specterops.io/assets/resources/SpecterOps_Subverting_Trust_in_Windows.pdf

0

MS:Crypto:EncodingType:CryptSIPDllCreateIndirectData_CryptSIPDllCreateIndirectData

path: Microsoft.PowerShell.Core\Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData\{DE351A43-8E59-11D0-8C47-00C04FC295EE}
FuncName: CryptSIPCreateIndirectData
Dll: WINTRUST.DLL

0 c.ps1v001 Microsoft Windows 7 Entreprise v6.1.7601.65536 2018-04-18

MS:Crypto:EncodingType:CryptSIPDllGetSignedDataMsg_CryptSIPDllGetSignedDataMsg

path: Microsoft.PowerShell.Core\Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{DE351A43-8E59-11D0-8C47-00C04FC295EE}
FuncName: CryptSIPGetSignedDataMsg
Dll: WINTRUST.DLL

0 c.ps1v001 Microsoft Windows 7 Entreprise v6.1.7601.65536 2018-04-18

MS:Crypto:EncodingType:CryptSIPDllPutSignedDataMsg_CryptSIPDllPutSignedDataMsg

path: Microsoft.PowerShell.Core\Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{DE351A43-8E59-11D0-8C47-00C04FC295EE}
FuncName: CryptSIPPutSignedDataMsg
Dll: WINTRUST.DLL

0 c.ps1v001 Microsoft Windows 7 Entreprise v6.1.7601.65536 2018-04-18

MS:Crypto:EncodingType:CryptSIPDllRemoveSignedDataMsg_CryptSIPDllRemoveSignedDataMsg

path: Microsoft.PowerShell.Core\Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{DE351A43-8E59-11D0-8C47-00C04FC295EE}
FuncName: CryptSIPRemoveSignedDataMsg
Dll: WINTRUST.DLL

0 c.ps1v001 Microsoft Windows 7 Entreprise v6.1.7601.65536 2018-04-18

MS:CryptSIPDllCreateIndirectData_CryptSIPCreateIndirectData

path: Microsoft.PowerShell.Core\Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData\{DE351A43-8E59-11D0-8C47-00C04FC295EE}
FuncName: CryptSIPCreateIndirectData
Dll: WINTRUST.DLL

0 c.ps1v001 Microsoft Windows 7 Entreprise v6.1.7601.65536 2018-04-18

MS:CryptSIPDllGetSignedDataMsg_CryptSIPGetSignedDataMsg

path: Microsoft.PowerShell.Core\Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{DE351A43-8E59-11D0-8C47-00C04FC295EE}
FuncName: CryptSIPGetSignedDataMsg
Dll: WINTRUST.DLL

0 c.ps1v001 Microsoft Windows 7 Entreprise v6.1.7601.65536 2018-04-18

MS:CryptSIPDllPutSignedDataMsg_CryptSIPPutSignedDataMsg

path: Microsoft.PowerShell.Core\Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{DE351A43-8E59-11D0-8C47-00C04FC295EE}
FuncName: CryptSIPPutSignedDataMsg
Dll: WINTRUST.DLL

0 c.ps1v001 Microsoft Windows 7 Entreprise v6.1.7601.65536 2018-04-18

MS:CryptSIPDllRemoveSignedDataMsg_CryptSIPRemoveSignedDataMsg

path: Microsoft.PowerShell.Core\Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{DE351A43-8E59-11D0-8C47-00C04FC295EE}
FuncName: CryptSIPRemoveSignedDataMsg
Dll: WINTRUST.DLL

0 c.ps1v001 Microsoft Windows 7 Entreprise v6.1.7601.65536 2018-04-18

MS:CryptSIPDllVerifyIndirectData_CryptSIPVerifyIndirectData

path: Microsoft.PowerShell.Core\Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{DE351A43-8E59-11D0-8C47-00C04FC295EE}
FuncName: CryptSIPVerifyIndirectData
Dll: WINTRUST.DLL

0 c.ps1v001 Microsoft Windows 7 Entreprise v6.1.7601.65536 2018-04-18

CRYPT_SUBJTYPE_CATALOG_IMAGE

1

HKLM\Software\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg

Windows 98 Registry
object: reg-subkey
name: None
key: HKLM\Software\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg

from Mikołaj Zalewski's http://mikolajapp2.appspot.com - reg-win98.xml

0 autopush - reg-win98

HKLM\Software\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg

Windows 98 Registry
object: reg-subkey
name: None
key: HKLM\Software\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg

from Mikołaj Zalewski's http://mikolajapp2.appspot.com - reg-win98.xml

0 autopush - reg-win98

HKLM\Software\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg

Windows 98 Registry
object: reg-subkey
name: None
key: HKLM\Software\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg

from Mikołaj Zalewski's http://mikolajapp2.appspot.com - reg-win98.xml

0 autopush - reg-win98

HKLM\Software\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData

Windows 98 Registry
object: reg-subkey
name: None
key: HKLM\Software\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData

from Mikołaj Zalewski's http://mikolajapp2.appspot.com - reg-win98.xml

0 autopush - reg-win98

HKLM\Software\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData

Windows 98 Registry
object: reg-subkey
name: None
key: HKLM\Software\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData

from Mikołaj Zalewski's http://mikolajapp2.appspot.com - reg-win98.xml

0 autopush - reg-win98

HKLM\Software\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData

Wine 1.1.0 Registry
object: reg-subkey
name: None
key: HKLM\Software\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData

from Mikołaj Zalewski's http://mikolajapp2.appspot.com - reg-wine11.xml

0 autopush - reg-wine11

HKLM\Software\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg

Wine 1.1.0 Registry
object: reg-subkey
name: None
key: HKLM\Software\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg

from Mikołaj Zalewski's http://mikolajapp2.appspot.com - reg-wine11.xml

0 autopush - reg-wine11

HKLM\Software\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg

Wine 1.1.0 Registry
object: reg-subkey
name: None
key: HKLM\Software\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg

from Mikołaj Zalewski's http://mikolajapp2.appspot.com - reg-wine11.xml

0 autopush - reg-wine11

HKLM\Software\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg

Wine 1.1.0 Registry
object: reg-subkey
name: None
key: HKLM\Software\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg

from Mikołaj Zalewski's http://mikolajapp2.appspot.com - reg-wine11.xml

0 autopush - reg-wine11

HKLM\Software\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData

Wine 1.1.0 Registry
object: reg-subkey
name: None
key: HKLM\Software\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData

from Mikołaj Zalewski's http://mikolajapp2.appspot.com - reg-wine11.xml

0 autopush - reg-wine11

HKLM\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData

Windows Vista Registry
object: reg-subkey
name: None
key: HKLM\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData

from Mikołaj Zalewski's http://mikolajapp2.appspot.com - reg-vista.xml

0 autopush - reg-vista

HKLM\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg

Windows Vista Registry
object: reg-subkey
name: None
key: HKLM\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg

from Mikołaj Zalewski's http://mikolajapp2.appspot.com - reg-vista.xml

0 autopush - reg-vista

HKLM\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg

Windows Vista Registry
object: reg-subkey
name: None
key: HKLM\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg

from Mikołaj Zalewski's http://mikolajapp2.appspot.com - reg-vista.xml

0 autopush - reg-vista

HKLM\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg

Windows Vista Registry
object: reg-subkey
name: None
key: HKLM\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg

from Mikołaj Zalewski's http://mikolajapp2.appspot.com - reg-vista.xml

0 autopush - reg-vista

HKLM\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData

Windows Vista Registry
object: reg-subkey
name: None
key: HKLM\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData

from Mikołaj Zalewski's http://mikolajapp2.appspot.com - reg-vista.xml

0 autopush - reg-vista

57804