_raw:
    svchost(1740)[C:\windows\system32\svchost.exe] -- POwn: SYSTEM
    Possible DLL Hijacking folder: C:\windows\system32 (Administrators [Allow: WriteData/CreateFiles])
    Command Line: C:\windows\system32\svchost.exe -k netsvcs -p -s SENS
   =================================================================================================
    StartMenuExperienceHost(6908)[C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe] -- POwn: rdavis
    Possible DLL Hijacking folder: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy (Administrators [Allow: WriteData/CreateFiles])
    Command Line: "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
   =================================================================================================
    svchost(1732)[C:\windows\system32\svchost.exe] -- POwn: SYSTEM
    Possible DLL Hijacking folder: C:\windows\system32 (Administrators [Allow: WriteData/CreateFiles])
    Command Line: C:\windows\system32\svchost.exe -k netsvcs -p -s Schedule
   =================================================================================================
    svchost(2592)[C:\windows\system32\svchost.exe] -- POwn: SYSTEM
    Possible DLL Hijacking folder: C:\windows\system32 (Administrators [Allow: WriteData/CreateFiles])
    Command Line: C:\windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
   =================================================================================================
    svchost(2156)[C:\windows\system32\svchost.exe] -- POwn: LOCAL SERVICE
    Possible DLL Hijacking folder: C:\windows\system32 (Administrators [Allow: WriteData/CreateFiles])
    Command Line: C:\windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
   =================================================================================================
ÉÍÍÍÍÍÍÍÍÍÍ¹ Vulnerable Leaked Handlers
È  https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#leaked-handlers
È Getting Leaked Handlers, it might take some time...
[----------]   5% |6% /#---------]  11% -5% \7% |#--------]  20% /3% -7% \#-------]  31% |3% /6% -8% \#------]  40% |3% /6% -9% \#-----]  51% |2% /3% -5% \8% |#----]  60% /2% -3% \5% |6% /9% -#---]  72% \4% |7% /#--]  80% -2% \5% |6% /8% -#-]  90% \|1% /-2% \5% |7% /9% -                       Handle: 508(file)
    Handle Owner: Pid is 1404(taskhostw) with owner: rdavis
    Reason: WriteData/CreateFiles
    File Path: \Users\rdavis\AppData\Local\Microsoft\Windows\WebCache\V01.log
    File Owner: BUILTIN\Administrators
   =================================================================================================
    Handle: 708(file)
    Handle Owner: Pid is 1404(taskhostw) with owner: rdavis
    Reason: WriteData/CreateFiles
    File Path: \Users\rdavis\AppData\Local\Microsoft\Windows\WebCache\V01tmp.log
    File Owner: BUILTIN\Administrators
   =================================================================================================
    Handle: 772(file)
    Handle Owner: Pid is 1404(taskhostw) with owner: rdavis
    Reason: WriteData/CreateFiles
    File Path: \Users\rdavis\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.jfm
    File Owner: BUILTIN\Administrators
   =================================================================================================
    Handle: 784(file)
    Handle Owner: Pid is 1404(taskhostw) with owner: rdavis
    Reason: WriteData/CreateFiles
    File Path: \Users\rdavis\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat
    File Owner: BUILTIN\Administrators
   =================================================================================================
    Handle: 884(file)
    Handle Owner: Pid is 8104(dllhost) with owner: rdavis
    Reason: WriteData/CreateFiles
    File Path: \Users\rdavis\AppData\Local\Microsoft\Internet Explorer\CacheStorage\edbtmp.log
    File Owner: BUILTIN\Administrators
   =================================================================================================
    Handle: 896(file)
    Handle Owner: Pid is 8104(dllhost) with owner: rdavis
    Reason: WriteData/CreateFiles
    File Path: \Users\rdavis\AppData\Local\Microsoft\Internet Explorer\CacheStorage\edb.log
    File Owner: BUILTIN\Administrators
   =================================================================================================
    Handle: 904(file)
    Handle Owner: Pid is 8104(dllhost) with owner: rdavis
    Reason: WriteData/CreateFiles
    File Path: \Users\rdavis\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\CacheStorage\CacheStorage.jfm
    File Owner: BUILTIN\Administrators
   =================================================================================================
    Handle: 908(file)
    Handle Owner: Pid is 8104(dllhost) with owner: rdavis
    Reason: WriteData/CreateFiles
    File Path: \Users\rdavis\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\CacheStorage\CacheStorage.edb
    File Owner: BUILTIN\Administrators
   =================================================================================================
    Handle: 92(file)
    Handle Owner: Pid is 7240(cmd) with owner: rdavis
    Reason: WriteData/CreateFiles
    File Path: \Users\rdavis\Desktop\output.txt
    File Owner: BUILTIN\Administrators
   =================================================================================================
    Handle: 872(file)
    Handle Owner: Pid is 6580(chrome) with owner: rdavis
    Reason: WriteData/CreateFiles
    File Path: \Users\rdavis\AppData\Local\Google\Chrome\User Data\lockfile
    File Owner: BUILTIN\Administrators
   =================================================================================================
    Handle: 1760(file)
    Handle Owner: Pid is 6580(chrome) with owner: rdavis
    Reason: WriteData/CreateFiles
    File Path: \Users\rdavis\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_2
    File Owner: BUILTIN\Administrators
   =================================================================================================
    Handle: 1984(file)
    Handle Owner: Pid is 6580(chrome) with owner: rdavis
    Reason: WriteData/CreateFiles
    File Path: \Users\rdavis\AppData\Local\Google\Chrome\User Data\ShaderCache\index
    File Owner: BUILTIN\Administrators
   =================================================================================================
    Handle: 1996(file)
    Handle Owner: Pid is 6580(chrome) with owner: rdavis
    Reason: WriteData/CreateFiles
    File Path: \Users\rdavis\AppData\Local\Google\Chrome\User Data\ShaderCache\data_3
    File Owner: BUILTIN\Administrators
   =================================================================================================
    Handle: 2004(file)
    Handle Owner: Pid is 6580(chrome) with owner: rdavis
    Reason: WriteData/CreateFiles
    File Path: \Users\rdavis\AppData\Local\Google\Chrome\User Data\ShaderCache\index
    File Owner: BUILTIN\Administrators
   =================================================================================================
    Handle: 2012(file)
    Handle Owner: Pid is 6580(chrome) with owner: rdavis
    Reason: WriteData/CreateFiles
    File Path: \Users\rdavis\AppData\Local\Google\Chrome\User Data\ShaderCache\data_0
    File Owner: BUILTIN\Administrators
   =================================================================================================
    Handle: 2016(file)
    Handle Owner: Pid is 6580(chrome) with owner: rdavis
    Reason: WriteData/CreateFiles
    File Path: \Users\rdavis\AppData\Local\Google\Chrome\User Data\ShaderCache\data_0
    File Owner: BUILTIN\Administrators
   =================================================================================================
    Handle: 2024(file)
    Handle Owner: Pid is 6580(chrome) with owner: rdavis
    Reason: WriteData/CreateFiles
    File Path: \Users\rdavis\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
    File Owner: BUILTIN\Administrators
   =================================================================================================
    Handle: 2028(file)
    Handle Owner: Pid is 6580(chrome) with owner: rdavis
    Reason: WriteData/CreateFiles
    File Path: \Users\rdavis\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
    File Owner: BUILTIN\Administrators
   =================================================================================================
    Handle: 2036(file)
    Handle Owner: Pid is 6580(chrome) with owner: rdavis
    Reason: WriteData/CreateFiles
    File Path: \Users\rdavis\AppData\Local\Google\Chrome\User Data\ShaderCache\data_2
    File Owner: BUILTIN\Administrators
   =================================================================================================
    Handle: 2040(file)
    Handle Owner: Pid is 6580(chrome) with owner: rdavis
    Reason: WriteData/CreateFiles
    File Path: \Users\rdavis\AppData\Local\Google\Chrome\User Data\ShaderCache\data_2
    File Owner: BUILTIN\Administrators
   =================================================================================================
    Handle: 2052(file)
    Handle Owner: Pid is 6580(chrome) with owner: rdavis
    Reason: WriteData/CreateFiles
    File Path: \Users\rdavis\AppData\Local\Google\Chrome\User Data\ShaderCache\data_3
    File Owner: BUILTIN\Administrators
   =================================================================================================
    Handle: 2488(file)
    Handle Owner: Pid is 6580(chrome) with owner: rdavis
    Reason: WriteData/CreateFiles
    File Path: \Users\rdavis\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG
    File Owner: BUILTIN\Administrators
   =================================================================================================
    Handle: 2608(file)
    Handle Owner: Pid is 6580(chrome) with owner: rdavis
    Reason: WriteData/CreateFiles
    File Path: \Users\rdavis\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG
    File Owner: BUILTIN\Administrators
   =================================================================================================
    Handle: 2724(file)
    Handle Owner: Pid is 6580(chrome) with owner: rdavis
    Reason: WriteData/CreateFiles
    File Path: \Users\rdavis\AppData\Local\Google\Chrome\User Data\Default\Extension Rules\LOG
    File Owner: BUILTIN\Administrators
   =================================================================================================
    Handle: 2744(file)
    Handle Owner: Pid is 6580(chrome) with owner: rdavis
    Reason: AppendData/CreateDirectories
    File Path: \Users\rdavis\AppData\Local\Google\Chrome\User Data\Default\Extension Rules\MANIFEST-000001
    File Owner: BUILTIN\Administrators
   =================================================================================================
    Handle: 2824(file)
    Handle Owner: Pid is 6580(chrome) with owner: rdavis
    Reason: AppendData/CreateDirectories
    File Path: \Users\rdavis\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\MANIFEST-000001
    File Owner: BUILTIN\Administrators
   =================================================================================================
    Handle: 2848(file)
    Handle Owner: Pid is 6580(chrome) with owner: rdavis
    Reason: AppendData/CreateDirectories
    File Path: \Users\rdavis\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\MANIFEST-000001
    File Owner: BUILTIN\Administrators
   =================================================================================================
    Handle: 2876(file)
    Handle Owner: Pid is 6580(chrome) with owner: rdavis
    Reason: WriteData/CreateFiles
    File Path: \Users\rdavis\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000003.log
    File Owner: BUILTIN\Administrators
   =================================================================================================
    Handle: 2884(file)
    Handle Owner: Pid is 6580(chrome) with owner: rdavis
    Reason: WriteData/CreateFiles
    File Path: \Users\rdavis\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000003.log
    File Owner: BUILTIN\Administrators
   =================================================================================================
    Handle: 2892(file)
    Handle Owner: Pid is 6580(chrome) with owner: rdavis
    Reason: WriteData/CreateFiles
    File Path: \Users\rdavis\AppData\Local\Google\Chrome\User Data\Default\Extension Rules\000003.log
    File Owner: BUILTIN\Administrators
   =================================================================================================
    Handle: 2896(file)
    Handle Owner: Pid is 6580(chrome) with owner: rdavis
    Reason: WriteData/CreateFiles
    File Path: \Users\rdavis\AppData\Local\Google\Chrome\User Data\Default\Extension Scripts\LOG
    File Owner: BUILTIN\Administrators
   =================================================================================================
    Handle: 2904(file)
    Handle Owner: Pid is 6580(chrome) with owner: rdavis
    Reason: AppendData/CreateDirectories
    File Path: \Users\rdavis\AppData\Local\Google\Chrome\User Data\Default\Extension Scripts\MANIFEST-000001
    File Owner: BUILTIN\Administrators
   =================================================================================================
    Handle: 2908(file)
    Handle Owner: Pid is 6580(chrome) with owner: rdavis
    Reason: WriteData/CreateFiles
    File Path: \Users\rdavis\AppData\Local\Google\Chrome\User Data\Default\Extension Scripts\000003.log
    File Owner: BUILTIN\Administrators
   =================================================================================================
    Handle: 3176(file)
    Handle Owner: Pid is 6580(chrome) with owner: rdavis
    Reason: WriteData/CreateFiles
    File Path: \Users\rdavis\AppData\Local\Google\Chrome\User Data\Default\GPUCache\index
    File Owner: BUILTIN\Administrators
   =================================================================================================
    Handle: 3180(file)
    Handle Owner: Pid is 6580(chrome) with owner: rdavis
    Reason: WriteData/CreateFiles
    File Path: \Users\rdavis\AppData\Local\Google\Chrome\User Data\Default\DawnGraphiteCache\index
    File Owner: BUILTIN\Administrators
   =================================================================================================
    Handle: 3188(file)
    Handle Owner: Pid is 6580(chrome) with owner: rdavis
    Reason: WriteData/CreateFiles
    File Path: \Users\rdavis\AppData\Local\Google\Chrome\User Data\Default\DawnGraphiteCache\data_0
    File Owner: BUILTIN\Administrators
   =================================================================================================
    Handle: 3204(file)
    Handle Owner: Pid is 6580(chrome) with owner: rdavis
    Reason: WriteData/CreateFiles
    File Path: \Users\rdavis\AppData\Local\Google\Chrome\User Data\Default\GPUCache\index
    File Owner: BUILTIN\Administrators
   =================================================================================================
    Handle: 3220(file)
    Handle Owner: Pid is 6580(chrome) with owner: rdavis
    Reason: WriteData/CreateFiles
    File Path: \Users\rdavis\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_0
    File Owner: BUILTIN\Administrators
   =================================================================================================
    Handle: 3224(file)
    Handle Owner: Pid is 6580(chrome) with owner: rdavis
    Reason: WriteData/CreateFiles
    File Path: \Users\rdavis\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_0
    File Owner: BUILTIN\Administrators
   =================================================================================================


_raw:
    svchost(1496)[C:\windows\system32\svchost.exe] -- POwn: LOCAL SERVICE
    Possible DLL Hijacking folder: C:\windows\system32 (Administrators [Allow: WriteData/CreateFiles])
    Command Line: C:\windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
   =================================================================================================
    svchost(7956)[C:\windows\system32\svchost.exe] -- POwn: rdavis
    Possible DLL Hijacking folder: C:\windows\system32 (Administrators [Allow: WriteData/CreateFiles])
    Command Line: C:\windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
   =================================================================================================
    svchost(1840)[C:\windows\system32\svchost.exe] -- POwn: LOCAL SERVICE
    Possible DLL Hijacking folder: C:\windows\system32 (Administrators [Allow: WriteData/CreateFiles])
    Command Line: C:\windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p
   =================================================================================================
    svchost(4072)[C:\windows\system32\svchost.exe] -- POwn: SYSTEM
    Possible DLL Hijacking folder: C:\windows\system32 (Administrators [Allow: WriteData/CreateFiles])
    Command Line: C:\windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s PcaSvc
   =================================================================================================
    chrome(5364)[C:\Program Files\Google\Chrome\Application\chrome.exe] -- POwn: rdavis
    Permissions: Administrators [Allow: AllAccess]
    Possible DLL Hijacking folder: C:\Program Files\Google\Chrome\Application (Administrators [Allow: AllAccess])
    Command Line: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\rdavis\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\rdavis\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\rdavis\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=141.0.7390.108 --initial-client-data=0xf4,0xf8,0xfc,0xd0,0x100,0x7ffbb9610868,0x7ffbb9610874,0x7ffbb9610880
   =================================================================================================
    conhost(5792)[C:\windows\system32\conhost.exe] -- POwn: rdavis
    Possible DLL Hijacking folder: C:\windows\system32 (Administrators [Allow: WriteData/CreateFiles])
    Command Line: \??\C:\windows\system32\conhost.exe 0x4
   =================================================================================================
    WmiPrvSE(4656)[C:\windows\system32\wbem\wmiprvse.exe] -- POwn: LOCAL SERVICE
    Possible DLL Hijacking folder: C:\windows\system32\wbem (Administrators [Allow: WriteData/CreateFiles])
    Command Line: C:\windows\system32\wbem\wmiprvse.exe
   =================================================================================================
    winlogon(612)[C:\windows\system32\winlogon.exe] -- POwn: SYSTEM
    Possible DLL Hijacking folder: C:\windows\system32 (Administrators [Allow: WriteData/CreateFiles])
    Command Line: winlogon.exe
   =================================================================================================
    svchost(1904)[C:\windows\System32\svchost.exe] -- POwn: SYSTEM
    Possible DLL Hijacking folder: C:\windows\System32 (Administrators [Allow: WriteData/CreateFiles])
    Command Line: C:\windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
   =================================================================================================
    svchost(1472)[C:\windows\system32\svchost.exe] -- POwn: LOCAL SERVICE
    Possible DLL Hijacking folder: C:\windows\system32 (Administrators [Allow: WriteData/CreateFiles])
    Command Line: C:\windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
   =================================================================================================
    Sysmon64(5776)[C:\windows\Sysmon64.exe] -- POwn: rdavis
    Permissions: Administrators [Allow: AllAccess]
    Possible DLL Hijacking folder: C:\windows (Administrators [Allow: WriteData/CreateFiles])
    Command Line: "C:\windows\Sysmon64.exe" -z syscliprpcB81B26942DE3E4AE
   =================================================================================================
    splunk-powershell(1532)[C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe] -- POwn: SplunkForwarder
    Permissions: Administrators [Allow: AllAccess]
    Possible DLL Hijacking folder: C:\Program Files\SplunkUniversalForwarder\bin (Administrators [Allow: AllAccess])
    Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"
   =================================================================================================
    svchost(1460)[C:\windows\System32\svchost.exe] -- POwn: NETWORK SERVICE
    Possible DLL Hijacking folder: C:\windows\System32 (Administrators [Allow: WriteData/CreateFiles])
    Command Line: C:\windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
   =================================================================================================
    svchost(1888)[C:\windows\system32\svchost.exe] -- POwn: SYSTEM
    Possible DLL Hijacking folder: C:\windows\system32 (Administrators [Allow: WriteData/CreateFiles])
    Command Line: C:\windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s UALSVC
   =================================================================================================
    conhost(4472)[C:\windows\system32\conhost.exe] -- POwn: SplunkForwarder
    Possible DLL Hijacking folder: C:\windows\system32 (Administrators [Allow: WriteData/CreateFiles])
    Command Line: \??\C:\windows\system32\conhost.exe 0x4
   =================================================================================================
    splunk-winevtlog(5328)[C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exe] -- POwn: SplunkForwarder
    Permissions: Administrators [Allow: AllAccess]
    Possible DLL Hijacking folder: C:\Program Files\SplunkUniversalForwarder\bin (Administrators [Allow: AllAccess])
    Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exe"
   =================================================================================================
    cmd(7240)[C:\windows\system32\cmd.exe] -- POwn: rdavis
    Possible DLL Hijacking folder: C:\windows\system32 (Administrators [Allow: WriteData/CreateFiles])
    Command Line: "C:\windows\system32\cmd.exe"
   =================================================================================================
    chrome(5756)[C:\Program Files\Google\Chrome\Application\chrome.exe] -- POwn: rdavis
    Permissions: Administrators [Allow: AllAccess]
    Possible DLL Hijacking folder: C:\Program Files\Google\Chrome\Application (Administrators [Allow: AllAccess])
    Command Line: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=51 --time-ticks-at-unix-epoch=-1760530238575564 --launch-time-ticks=291278479783 --metrics-shmem-handle=6784,i,787950154799200145,18382907364075713471,2097152 --field-trial-handle=1956,i,9774236850684306164,17292126406124687351,262144 --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:1
   =================================================================================================
    svchost(1444)[C:\windows\system32\svchost.exe] -- POwn: LOCAL SERVICE
    Possible DLL Hijacking folder: C:\windows\system32 (Administrators [Allow: WriteData/CreateFiles])
    Command Line: C:\windows\system32\svchost.exe -k LocalServiceNoNetwork -p
   =================================================================================================
    RuntimeBroker(2304)[C:\Windows\System32\RuntimeBroker.exe] -- POwn: rdavis
    Possible DLL Hijacking folder: C:\Windows\System32 (Administrators [Allow: WriteData/CreateFiles])
    Command Line: C:\Windows\System32\RuntimeBroker.exe -Embedding
   =================================================================================================
    ctfmon(5320)[C:\windows\system32\ctfmon.exe] -- POwn: rdavis
    Possible DLL Hijacking folder: C:\windows\system32 (Administrators [Allow: WriteData/CreateFiles])
    Command Line: "ctfmon.exe"
   =================================================================================================
    sihost(1224)[C:\windows\system32\sihost.exe] -- POwn: rdavis
    Possible DLL Hijacking folder: C:\windows\system32 (Administrators [Allow: WriteData/CreateFiles])
    Command Line: sihost.exe
   =================================================================================================
    ApplicationFrameHost(576)[C:\windows\system32\ApplicationFrameHost.exe] -- POwn: rdavis
    Possible DLL Hijacking folder: C:\windows\system32 (Administrators [Allow: WriteData/CreateFiles])
    Command Line: C:\windows\system32\ApplicationFrameHost.exe -Embedding
   =================================================================================================
    msdtc(4452)[C:\windows\System32\msdtc.exe] -- POwn: NETWORK SERVICE
    Possible DLL Hijacking folder: C:\windows\System32 (Administrators [Allow: WriteData/CreateFiles])
    Command Line: C:\windows\System32\msdtc.exe
   =================================================================================================
    chrome(7888)[C:\Program Files\Google\Chrome\Application\chrome.exe] -- POwn: rdavis
    Permissions: Administrators [Allow: AllAccess]
    Possible DLL Hijacking folder: C:\Program Files\Google\Chrome\Application (Administrators [Allow: AllAccess])
    Command Line: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --metrics-shmem-handle=2320,i,680865220550128209,17599297432946056463,524288 --field-trial-handle=1956,i,9774236850684306164,17292126406124687351,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:8
   =================================================================================================
    svchost(1852)[C:\windows\System32\svchost.exe] -- POwn: SYSTEM
    Possible DLL Hijacking folder: C:\windows\System32 (Administrators [Allow: WriteData/CreateFiles])
    Command Line: C:\windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s UmRdpService
   =================================================================================================
    taskhostw(6592)[C:\windows\system32\taskhostw.exe] -- POwn: rdavis
    Possible DLL Hijacking folder: C:\windows\system32 (Administrators [Allow: WriteData/CreateFiles])
    Command Line: taskhostw.exe
   =================================================================================================
    svchost(988)[C:\windows\system32\svchost.exe] -- POwn: SYSTEM
    Possible DLL Hijacking folder: C:\windows\system32 (Administrators [Allow: WriteData/CreateFiles])
    Command Line: C:\windows\system32\svchost.exe -k DcomLaunch -p -s LSM
   =================================================================================================
    rdpclip(3572)[C:\windows\System32\rdpclip.exe] -- POwn: rdavis
    Possible DLL Hijacking folder: C:\windows\System32 (Administrators [Allow: WriteData/CreateFiles])
    Command Line: rdpclip
   =================================================================================================
    powershell(4432)[C:\windows\System32\WindowsPowerShell\v1.0\powershell.exe] -- POwn: SplunkForwarder
    Permissions: Administrators [Allow: WriteData/CreateFiles]
    Possible DLL Hijacking folder: C:\windows\System32\WindowsPowerShell\v1.0 (Administrators [Allow: WriteData/CreateFiles])
    Command Line: powershell.exe  -command  $input |"C:\Program` Files\SplunkUniversalForwarder\bin\splunk-powershell.ps1"  "C:\Program` Files\SplunkUniversalForwarder"  a4f4a910fe2be9b1
   =================================================================================================
    svchost(5720)[C:\windows\System32\svchost.exe] -- POwn: SYSTEM
    Possible DLL Hijacking folder: C:\windows\System32 (Administrators [Allow: WriteData/CreateFiles])
    Command Line: C:\windows\System32\svchost.exe -k netsvcs -p -s NetSetupSvc
   =================================================================================================
    chrome(6580)[C:\Program Files\Google\Chrome\Application\chrome.exe] -- POwn: rdavis
    Permissions: Administrators [Allow: AllAccess]
    Possible DLL Hijacking folder: C:\Program Files\Google\Chrome\Application (Administrators [Allow: AllAccess])
    Command Line: "C:\Program Files\Google\Chrome\Application\chrome.exe"
   =================================================================================================
    taskhostw(1404)[C:\windows\system32\taskhostw.exe] -- POwn: rdavis
    Possible DLL Hijacking folder: C:\windows\system32 (Administrators [Allow: WriteData/CreateFiles])
    Command Line: taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
   =================================================================================================
    WUDFHost(2264)[C:\Windows\System32\WUDFHost.exe] -- POwn: LOCAL SERVICE
    Possible DLL Hijacking folder: C:\Windows\System32 (Administrators [Allow: WriteData/CreateFiles])
    Command Line: "C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-b0265e47-671b-434a-a95e-a7d54a0bafe5 -SystemEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-adb1a5a1-7f37-4391-9b4f-78379fe1caae -IoCancelEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-c3f17155-dc06-4bf6-9d4e-11478e5fa85b -NonStateChangingEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-82409315-67d4-4906-aed0-224b10833f12 -LifetimeId:43db4630-d3a5-4741-b527-a55c85242fc5 -DeviceGroupId: -HostArg:0
   =================================================================================================
    svchost(3984)[C:\windows\System32\svchost.exe] -- POwn: SYSTEM
    Possible DLL Hijacking folder: C:\windows\System32 (Administrators [Allow: WriteData/CreateFiles])
    Command Line: C:\windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
   =================================================================================================
    svchost(1396)[C:\windows\System32\svchost.exe] -- POwn: SYSTEM
    Possible DLL Hijacking folder: C:\windows\System32 (Administrators [Allow: WriteData/CreateFiles])
    Command Line: C:\windows\System32\svchost.exe -k netsvcs -p -s BITS
   =================================================================================================
    explorer(5704)[C:\windows\Explorer.EXE] -- POwn: rdavis
    Possible DLL Hijacking folder: C:\windows (Administrators [Allow: WriteData/CreateFiles])
    Command Line: C:\windows\Explorer.EXE
   =================================================================================================
    svchost(1824)[C:\windows\System32\svchost.exe] -- POwn: LOCAL SERVICE
    Possible DLL Hijacking folder: C:\windows\System32 (Administrators [Allow: WriteData/CreateFiles])
    Command Line: C:\windows\System32\svchost.exe -k LocalService -p -s netprofm
   =================================================================================================
    dwm(3968)[C:\windows\system32\dwm.exe] -- POwn: DWM-2
    Possible DLL Hijacking folder: C:\windows\system32 (Administrators [Allow: WriteData/CreateFiles])
    Command Line: "dwm.exe"
   =================================================================================================
    svchost(2252)[C:\windows\system32\svchost.exe] -- POwn: LOCAL SERVICE
    Possible DLL Hijacking folder: C:\windows\system32 (Administrators [Allow: WriteData/CreateFiles])
    Command Line: C:\windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
   =================================================================================================
    WmiPrvSE(3544)[C:\windows\system32\wbem\wmiprvse.exe] -- POwn: NETWORK SERVICE
    Possible DLL Hijacking folder: C:\windows\system32\wbem (Administrators [Allow: WriteData/CreateFiles])
    Command Line: C:\windows\system32\wbem\wmiprvse.exe
   =================================================================================================
    svchost(2676)[C:\windows\system32\svchost.exe] -- POwn: rdavis
    Possible DLL Hijacking folder: C:\windows\system32 (Administrators [Allow: WriteData/CreateFiles])
    Command Line: C:\windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
   =================================================================================================
    svchost(2244)[C:\windows\system32\svchost.exe] -- POwn: SYSTEM
    Possible DLL Hijacking folder: C:\windows\system32 (Administrators [Allow: WriteData/CreateFiles])
    Command Line: C:\windows\system32\svchost.exe -k netsvcs -p -s WpnService
   =================================================================================================
    TiWorker(2668)[C:\windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.20348.557_none_f1edaeb8515fa10d\TiWorker.exe] -- POwn: SYSTEM
    Command Line: C:\windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.20348.557_none_f1edaeb8515fa10d\TiWorker.exe -Embedding
   =================================================================================================
    svchost(2436)[C:\windows\system32\svchost.exe] -- POwn: NETWORK SERVICE
    Possible DLL Hijacking folder: C:\windows\system32 (Administrators [Allow: WriteData/CreateFiles])
    Command Line: C:\windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
   =================================================================================================
    chrome(2664)[C:\Program Files\Google\Chrome\Application\chrome.exe] -- POwn: rdavis
    Permissions: Administrators [Allow: AllAccess]
    Possible DLL Hijacking folder: C:\Program Files\Google\Chrome\Application (Administrators [Allow: AllAccess])
    Command Line: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=77 --time-ticks-at-unix-epoch=-1760530238575564 --launch-time-ticks=291613437032 --metrics-shmem-handle=7100,i,4051550299498704683,348406821148706489,2097152 --field-trial-handle=1956,i,9774236850684306164,17292126406124687351,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:1
   =================================================================================================
    LogonUI(504)[C:\windows\system32\LogonUI.exe] -- POwn: SYSTEM
    Possible DLL Hijacking folder: C:\windows\system32 (Administrators [Allow: WriteData/CreateFiles])
    Command Line: "LogonUI.exe" /flags:0x2 /state0:0xa3bfd055 /state1:0x41c64e6d
   =================================================================================================
    AggregatorHost(3516)[C:\windows\System32\AggregatorHost.exe] -- POwn: SYSTEM
    Possible DLL Hijacking folder: C:\windows\System32 (Administrators [Allow: WriteData/CreateFiles])
    Command Line: AggregatorHost.exe
   =================================================================================================
    conhost(6992)[C:\windows\system32\conhost.exe] -- POwn: rdavis
    Possible DLL Hijacking folder: C:\windows\system32 (Administrators [Allow: WriteData/CreateFiles])
    Command Line: \??\C:\windows\system32\conhost.exe 0x4
   =================================================================================================
    svchost(2648)[C:\windows\System32\svchost.exe] -- POwn: SYSTEM
    Possible DLL Hijacking folder: C:\windows\System32 (Administrators [Allow: WriteData/CreateFiles])
    Command Line: C:\windows\System32\svchost.exe -k utcsvc -p
   =================================================================================================
    chrome(6524)[C:\Program Files\Google\Chrome\Application\chrome.exe] -- POwn: rdavis
    Permissions: Administrators [Allow: AllAccess]
    Possible DLL Hijacking folder: C:\Program Files\Google\Chrome\Application (Administrators [Allow: AllAccess])
    Command Line: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1768,i,5442593114007445259,14688440507019107594,262144 --field-trial-handle=1956,i,9774236850684306164,17292126406124687351,262144 --variations-seed-version --mojo-platform-channel-handle=1960 /prefetch:2
   =================================================================================================
    svchost(764)[C:\windows\System32\svchost.exe] -- POwn: NETWORK SERVICE
    Possible DLL Hijacking folder: C:\windows\System32 (Administrators [Allow: WriteData/CreateFiles])
    Command Line: C:\windows\System32\svchost.exe -k termsvcs -s TermService
   =================================================================================================
    chrome(3920)[C:\Program Files\Google\Chrome\Application\chrome.exe] -- POwn: rdavis
    Permissions: Administrators [Allow: AllAccess]
    Possible DLL Hijacking folder: C:\Program Files\Google\Chrome\Application (Administrators [Allow: AllAccess])
    Command Line: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --metrics-shmem-handle=4132,i,1227096187502769129,9938724165747164639,524288 --field-trial-handle=1956,i,9774236850684306164,17292126406124687351,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:8
   =================================================================================================
    svchost(5212)[C:\windows\System32\svchost.exe] -- POwn: SYSTEM
    Possible DLL Hijacking folder: C:\windows\System32 (Administrators [Allow: WriteData/CreateFiles])
    Command Line: C:\windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TabletInputService
   =================================================================================================
    svchost(1160)[C:\windows\system32\svchost.exe] -- POwn: LOCAL SERVICE
    Possible DLL Hijacking folder: C:\windows\system32 (Administrators [Allow: WriteData/CreateFiles])
    Command Line: C:\windows\system32\svchost.exe -k LocalService -p -s nsi
   =================================================================================================
    svchost(2620)[C:\windows\system32\svchost.exe] -- POwn: NETWORK SERVICE
    Possible DLL Hijacking folder: C:\windows\system32 (Administrators [Allow: WriteData/CreateFiles])
    Command Line: C:\windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
   =================================================================================================
    wlms(3048)[C:\windows\system32\wlms\wlms.exe] -- POwn: SYSTEM
    Command Line: C:\windows\system32\wlms\wlms.exe
   =================================================================================================
    svchost(1752)[C:\windows\system32\svchost.exe] -- POwn: SYSTEM
    Possible DLL Hijacking folder: C:\windows\system32 (Administrators [Allow: WriteData/CreateFiles])
    Command Line: C:\windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
   =================================================================================================
    SecurityHealthHost(5700)[C:\Windows\System32\SecurityHealthHost.exe] -- POwn: rdavis
    Possible DLL Hijacking folder: C:\Windows\System32 (Administrators [Allow: WriteData/CreateFiles])
    Command Line: C:\Windows\System32\SecurityHealthHost.exe {E041C90B-68BA-42C9-991E-477B73A75C90} -Embedding
   =================================================================================================
    dwm(452)[C:\windows\system32\dwm.exe] -- POwn: DWM-1
    Possible DLL Hijacking folder: C:\windows\system32 (Administrators [Allow: WriteData/CreateFiles])
    Command Line: "dwm.exe"
   =================================================================================================
    SecHealthUI(4328)[C:\Windows\SystemApps\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\SecHealthUI.exe] -- POwn: rdavis
    Possible DLL Hijacking folder: C:\Windows\SystemApps\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy (Administrators [Allow: WriteData/CreateFiles])
    Command Line: "C:\Windows\SystemApps\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\SecHealthUI.exe" -ServerName:SecHealthUI.AppXep4x2tbtjws1v9qqs0rmb3hxykvkpqtn.mca
   =================================================================================================
    svchost(2172)[C:\windows\System32\svchost.exe] -- POwn: NETWORK SERVICE
    Possible DLL Hijacking folder: C:\windows\System32 (Administrators [Allow: WriteData/CreateFiles])
    Command Line: C:\windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
   =================================================================================================


_raw:
    Logon Time:                   10/15/2025 12:10:40 PM
    Logon Type:                   Interactive
    Start Time:
    Domain:                       Font Driver Host
    Authentication Package:       Negotiate
    Start Time:
    User Name:                    UMFD-0
    User Principal Name:          DECKHAND-01$@allports.local
    User SID:                     S-1-5-96-0-0
   =================================================================================================
ÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ¹ Processes Information ÌÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ
ÉÍÍÍÍÍÍÍÍÍÍ¹ Interesting Processes -non Microsoft-
È Check if any interesting processes for memory dump or if you could overwrite some binary running https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#running-processes
    fontdrvhost(860)[C:\windows\system32\fontdrvhost.exe] -- POwn: UMFD-0
    Possible DLL Hijacking folder: C:\windows\system32 (Administrators [Allow: WriteData/CreateFiles])
    Command Line: "fontdrvhost.exe"
   =================================================================================================
    WmiPrvSE(6892)[C:\windows\system32\wbem\wmiprvse.exe] -- POwn: NETWORK SERVICE
    Possible DLL Hijacking folder: C:\windows\system32\wbem (Administrators [Allow: WriteData/CreateFiles])
    Command Line: C:\windows\system32\wbem\wmiprvse.exe
   =================================================================================================
    fontdrvhost(852)[C:\windows\system32\fontdrvhost.exe] -- POwn: UMFD-1
    Possible DLL Hijacking folder: C:\windows\system32 (Administrators [Allow: WriteData/CreateFiles])
    Command Line: "fontdrvhost.exe"
   =================================================================================================
    svchost(940)[C:\windows\system32\svchost.exe] -- POwn: NETWORK SERVICE
    Possible DLL Hijacking folder: C:\windows\system32 (Administrators [Allow: WriteData/CreateFiles])
    Command Line: C:\windows\system32\svchost.exe -k RPCSS -p
   =================================================================================================
    svchost(4728)[C:\windows\System32\svchost.exe] -- POwn: SYSTEM
    Possible DLL Hijacking folder: C:\windows\System32 (Administrators [Allow: WriteData/CreateFiles])
    Command Line: C:\windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s WdiSystemHost
   =================================================================================================
    svchost(1076)[C:\windows\System32\svchost.exe] -- POwn: SYSTEM
    Possible DLL Hijacking folder: C:\windows\System32 (Administrators [Allow: WriteData/CreateFiles])
    Command Line: C:\windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
   =================================================================================================
    unsecapp(1708)[C:\windows\system32\wbem\unsecapp.exe] -- POwn: SYSTEM
    Possible DLL Hijacking folder: C:\windows\system32\wbem (Administrators [Allow: WriteData/CreateFiles])
    Command Line: C:\windows\system32\wbem\unsecapp.exe -Embedding
   =================================================================================================
    svchost(4292)[C:\windows\System32\svchost.exe] -- POwn: SYSTEM
    Possible DLL Hijacking folder: C:\windows\System32 (Administrators [Allow: WriteData/CreateFiles])
    Command Line: C:\windows\System32\svchost.exe -k WerSvcGroup
   =================================================================================================
    svchost(2996)[C:\windows\System32\svchost.exe] -- POwn: NETWORK SERVICE
    Possible DLL Hijacking folder: C:\windows\System32 (Administrators [Allow: WriteData/CreateFiles])
    Command Line: C:\windows\System32\svchost.exe -k NetworkService -p -s WinRM
   =================================================================================================
    svchost(2132)[C:\windows\system32\svchost.exe] -- POwn: rdavis
    Possible DLL Hijacking folder: C:\windows\system32 (Administrators [Allow: WriteData/CreateFiles])
    Command Line: C:\windows\system32\svchost.exe -k UnistackSvcGroup -s WpnUserService
   =================================================================================================
    svchost(1268)[C:\windows\system32\svchost.exe] -- POwn: NETWORK SERVICE
    Possible DLL Hijacking folder: C:\windows\system32 (Administrators [Allow: WriteData/CreateFiles])
    Command Line: C:\windows\system32\svchost.exe -k NetworkService -p -s Dnscache
   =================================================================================================
    laforge(2740)[C:\ProgramData\Laforge\laforge.exe] -- POwn: SYSTEM
    Permissions: Administrators [Allow: AllAccess]
    Possible DLL Hijacking folder: C:\ProgramData\Laforge (Administrators [Allow: AllAccess], Users [Allow: WriteData/CreateFiles])
    Command Line: C:\ProgramData\Laforge\laforge.exe
   =================================================================================================
    svchost(5144)[C:\windows\system32\svchost.exe] -- POwn: SYSTEM
    Possible DLL Hijacking folder: C:\windows\system32 (Administrators [Allow: WriteData/CreateFiles])
    Command Line: C:\windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
   =================================================================================================
    splunk-regmon(3444)[C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe] -- POwn: SplunkForwarder
    Permissions: Administrators [Allow: AllAccess]
    Possible DLL Hijacking folder: C:\Program Files\SplunkUniversalForwarder\bin (Administrators [Allow: AllAccess])
    Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"
   =================================================================================================
    RuntimeBroker(6864)[C:\Windows\System32\RuntimeBroker.exe] -- POwn: rdavis
    Possible DLL Hijacking folder: C:\Windows\System32 (Administrators [Allow: WriteData/CreateFiles])
    Command Line: C:\Windows\System32\RuntimeBroker.exe -Embedding
   =================================================================================================
    svchost(1260)[C:\windows\system32\svchost.exe] -- POwn: LOCAL SERVICE
    Possible DLL Hijacking folder: C:\windows\system32 (Administrators [Allow: WriteData/CreateFiles])
    Command Line: C:\windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
   =================================================================================================
    svchost(824)[C:\windows\system32\svchost.exe] -- POwn: SYSTEM
    Possible DLL Hijacking folder: C:\windows\system32 (Administrators [Allow: WriteData/CreateFiles])
    Command Line: C:\windows\system32\svchost.exe -k DcomLaunch -p
   =================================================================================================
    svchost(2976)[C:\windows\system32\svchost.exe] -- POwn: SYSTEM
    Possible DLL Hijacking folder: C:\windows\system32 (Administrators [Allow: WriteData/CreateFiles])
    Command Line: C:\windows\system32\svchost.exe -k netsvcs -p -s UserManager
   =================================================================================================
    svchost(1180)[C:\windows\System32\svchost.exe] -- POwn: LOCAL SERVICE
    Possible DLL Hijacking folder: C:\windows\System32 (Administrators [Allow: WriteData/CreateFiles])
    Command Line: C:\windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
   =================================================================================================
    smartscreen(812)[C:\Windows\System32\smartscreen.exe] -- POwn: rdavis
    Possible DLL Hijacking folder: C:\Windows\System32 (Administrators [Allow: WriteData/CreateFiles])
    Command Line: C:\Windows\System32\smartscreen.exe -Embedding
   =================================================================================================
    svchost(4688)[C:\windows\System32\svchost.exe] -- POwn: LOCAL SERVICE
    Possible DLL Hijacking folder: C:\windows\System32 (Administrators [Allow: WriteData/CreateFiles])
    Command Line: C:\windows\System32\svchost.exe -k LocalServiceNoNetwork -p -s DPS
   =================================================================================================
    splunk-admon(4268)[C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe] -- POwn: SplunkForwarder
    Permissions: Administrators [Allow: AllAccess]
    Possible DLL Hijacking folder: C:\Program Files\SplunkUniversalForwarder\bin (Administrators [Allow: AllAccess])
    Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"
   =================================================================================================
    svchost(5544)[C:\windows\system32\svchost.exe] -- POwn: SYSTEM
    Possible DLL Hijacking folder: C:\windows\system32 (Administrators [Allow: WriteData/CreateFiles])
    Command Line: C:\windows\system32\svchost.exe -k appmodel -p -s camsvc
   =================================================================================================
    spoolsv(2524)[C:\windows\System32\spoolsv.exe] -- POwn: SYSTEM
    Possible DLL Hijacking folder: C:\windows\System32 (Administrators [Allow: WriteData/CreateFiles])
    Command Line: C:\windows\System32\spoolsv.exe
   =================================================================================================
    winlogon(3384)[C:\windows\system32\winlogon.exe] -- POwn: SYSTEM
    Possible DLL Hijacking folder: C:\windows\system32 (Administrators [Allow: WriteData/CreateFiles])
    Command Line: winlogon.exe
   =================================================================================================
    svchost(2952)[C:\windows\System32\svchost.exe] -- POwn: SYSTEM
    Possible DLL Hijacking folder: C:\windows\System32 (Administrators [Allow: WriteData/CreateFiles])
    Command Line: C:\windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
   =================================================================================================
    TrustedInstaller(8120)[C:\windows\servicing\TrustedInstaller.exe] -- POwn: SYSTEM
    Command Line: C:\windows\servicing\TrustedInstaller.exe
   =================================================================================================
    svchost(2748)[C:\windows\system32\svchost.exe] -- POwn: SYSTEM
    Possible DLL Hijacking folder: C:\windows\system32 (Administrators [Allow: WriteData/CreateFiles])
    Command Line: C:\windows\system32\svchost.exe -k appmodel -p -s StateRepository
   =================================================================================================
    svchost(5952)[C:\windows\System32\svchost.exe] -- POwn: SYSTEM
    Possible DLL Hijacking folder: C:\windows\System32 (Administrators [Allow: WriteData/CreateFiles])
    Command Line: C:\windows\System32\svchost.exe -k AppReadiness -p -s AppReadiness
   =================================================================================================
    winPEASx64 (2)(7244)[C:\Users\rdavis\Desktop\winPEASx64 (2).exe] -- POwn: rdavis -- isDotNet
    Permissions: Administrators [Allow: AllAccess], rdavis [Allow: AllAccess]
    Possible DLL Hijacking folder: C:\Users\rdavis\Desktop (Administrators [Allow: AllAccess], rdavis [Allow: AllAccess])
    Command Line: "winPEASx64 (2).exe"
   =================================================================================================
    dllhost(8104)[C:\windows\system32\DllHost.exe] -- POwn: rdavis
    Possible DLL Hijacking folder: C:\windows\system32 (Administrators [Allow: WriteData/CreateFiles])
    Command Line: C:\windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}
   =================================================================================================
    chrome(6424)[C:\Program Files\Google\Chrome\Application\chrome.exe] -- POwn: rdavis
    Permissions: Administrators [Allow: AllAccess]
    Possible DLL Hijacking folder: C:\Program Files\Google\Chrome\Application (Administrators [Allow: AllAccess])
    Command Line: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --metrics-shmem-handle=2264,i,14151962762449890988,6976198204293096715,524288 --field-trial-handle=1956,i,9774236850684306164,17292126406124687351,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:3
   =================================================================================================
    svchost(1632)[C:\windows\System32\svchost.exe] -- POwn: SYSTEM
    Possible DLL Hijacking folder: C:\windows\System32 (Administrators [Allow: WriteData/CreateFiles])
    Command Line: C:\windows\System32\svchost.exe -k netsvcs -p -s Themes
   =================================================================================================
    RuntimeBroker(4212)[C:\Windows\System32\RuntimeBroker.exe] -- POwn: rdavis
    Possible DLL Hijacking folder: C:\Windows\System32 (Administrators [Allow: WriteData/CreateFiles])
    Command Line: C:\Windows\System32\RuntimeBroker.exe -Embedding
   =================================================================================================
    svchost(1624)[C:\windows\system32\svchost.exe] -- POwn: LOCAL SERVICE
    Possible DLL Hijacking folder: C:\windows\system32 (Administrators [Allow: WriteData/CreateFiles])
    Command Line: C:\windows\system32\svchost.exe -k LocalService -p -s EventSystem
   =================================================================================================
    svchost(1188)[C:\windows\system32\svchost.exe] -- POwn: LOCAL SERVICE
    Possible DLL Hijacking folder: C:\windows\system32 (Administrators [Allow: WriteData/CreateFiles])
    Command Line: C:\windows\system32\svchost.exe -k LocalService -s W32Time
   =================================================================================================
    cptclogging(7444)[C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\cptclogging.exe] -- POwn: rdavis
    Permissions: Administrators [Allow: AllAccess]
    Possible DLL Hijacking folder: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup (Administrators [Allow: AllAccess])
    Command Line: "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\cptclogging.exe"
   =================================================================================================
    splunkd(2904)[C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe] -- POwn: SplunkForwarder
    Permissions: Administrators [Allow: AllAccess]
    Possible DLL Hijacking folder: C:\Program Files\SplunkUniversalForwarder\bin (Administrators [Allow: AllAccess])
    Command Line: "C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service
   =================================================================================================
    svchost(1608)[C:\windows\system32\svchost.exe] -- POwn: SYSTEM
    Possible DLL Hijacking folder: C:\windows\system32 (Administrators [Allow: WriteData/CreateFiles])
    Command Line: C:\windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
   =================================================================================================
    svchost(1168)[C:\windows\System32\svchost.exe] -- POwn: LOCAL SERVICE
    Possible DLL Hijacking folder: C:\windows\System32 (Administrators [Allow: WriteData/CreateFiles])
    Command Line: C:\windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
   =================================================================================================
    svchost(2884)[C:\windows\System32\svchost.exe] -- POwn: SYSTEM
    Possible DLL Hijacking folder: C:\windows\System32 (Administrators [Allow: WriteData/CreateFiles])
    Command Line: C:\windows\System32\svchost.exe -k smbsvcs -s LanmanServer
   =================================================================================================
    svchost(4604)[C:\windows\system32\svchost.exe] -- POwn: LOCAL SERVICE
    Possible DLL Hijacking folder: C:\windows\system32 (Administrators [Allow: WriteData/CreateFiles])
    Command Line: C:\windows\system32\svchost.exe -k LocalService -p -s CDPSvc
   =================================================================================================
    svchost(2448)[C:\windows\System32\svchost.exe] -- POwn: SYSTEM
    Possible DLL Hijacking folder: C:\windows\System32 (Administrators [Allow: WriteData/CreateFiles])
    Command Line: C:\windows\System32\svchost.exe -k NetSvcs -p -s iphlpsvc
   =================================================================================================
    svchost(2016)[C:\windows\system32\svchost.exe] -- POwn: LOCAL SERVICE
    Possible DLL Hijacking folder: C:\windows\system32 (Administrators [Allow: WriteData/CreateFiles])
    Command Line: C:\windows\system32\svchost.exe -k LocalService -p -s FontCache
   =================================================================================================
    SearchApp(7060)[C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe] -- POwn: rdavis
    Possible DLL Hijacking folder: C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy (Administrators [Allow: WriteData/CreateFiles])
    Command Line: "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
   =================================================================================================
    svchost(4160)[C:\windows\System32\svchost.exe] -- POwn: SYSTEM
    Possible DLL Hijacking folder: C:\windows\System32 (Administrators [Allow: WriteData/CreateFiles])
    Command Line: C:\windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s DsSvc
   =================================================================================================
    chrome(8036)[C:\Program Files\Google\Chrome\Application\chrome.exe] -- POwn: rdavis
    Permissions: Administrators [Allow: AllAccess]
    Possible DLL Hijacking folder: C:\Program Files\Google\Chrome\Application (Administrators [Allow: AllAccess])
    Command Line: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=76 --time-ticks-at-unix-epoch=-1760530238575564 --launch-time-ticks=291612171297 --metrics-shmem-handle=5960,i,3576833732187587835,6491708982654156609,2097152 --field-trial-handle=1956,i,9774236850684306164,17292126406124687351,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:1
   =================================================================================================
    RuntimeBroker(7600)[C:\Windows\System32\RuntimeBroker.exe] -- POwn: rdavis
    Possible DLL Hijacking folder: C:\Windows\System32 (Administrators [Allow: WriteData/CreateFiles])
    Command Line: C:\Windows\System32\RuntimeBroker.exe -Embedding
   =================================================================================================
    svchost(2424)[C:\windows\system32\svchost.exe] -- POwn: SYSTEM
    Possible DLL Hijacking folder: C:\windows\system32 (Administrators [Allow: WriteData/CreateFiles])
    Command Line: C:\windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
   =================================================================================================
    lsass(696)[C:\windows\system32\lsass.exe] -- POwn: SYSTEM
    Possible DLL Hijacking folder: C:\windows\system32 (Administrators [Allow: WriteData/CreateFiles])
    Command Line: C:\windows\system32\lsass.exe
   =================================================================================================
    svchost(2848)[C:\windows\system32\svchost.exe] -- POwn: SYSTEM
    Possible DLL Hijacking folder: C:\windows\system32 (Administrators [Allow: WriteData/CreateFiles])
    Command Line: C:\windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s SysMain
   =================================================================================================
    dllhost(2412)[C:\windows\system32\DllHost.exe] -- POwn: SYSTEM
    Possible DLL Hijacking folder: C:\windows\system32 (Administrators [Allow: WriteData/CreateFiles])
    Command Line: C:\windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
   =================================================================================================
    svchost(1544)[C:\windows\system32\svchost.exe] -- POwn: SYSTEM
    Possible DLL Hijacking folder: C:\windows\system32 (Administrators [Allow: WriteData/CreateFiles])
    Command Line: C:\windows\system32\svchost.exe -k netsvcs -p -s gpsvc
   =================================================================================================
    fontdrvhost(4980)[C:\windows\system32\fontdrvhost.exe] -- POwn: UMFD-2
    Possible DLL Hijacking folder: C:\windows\system32 (Administrators [Allow: WriteData/CreateFiles])
    Command Line: "fontdrvhost.exe"
   =================================================================================================
    TextInputHost(5840)[C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe] -- POwn: rdavis
    Possible DLL Hijacking folder: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy (Administrators [Allow: WriteData/CreateFiles])
    Command Line: "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe" -ServerName:InputApp.AppXjd5de1g66v206tj52m9d0dtpppx4cgpn.mca
   =================================================================================================
    svchost(2384)[C:\windows\System32\svchost.exe] -- POwn: SYSTEM
    Possible DLL Hijacking folder: C:\windows\System32 (Administrators [Allow: WriteData/CreateFiles])
    Command Line: C:\windows\System32\svchost.exe -k netsvcs -p -s SessionEnv
   =================================================================================================
    svchost(7976)[C:\windows\system32\svchost.exe] -- POwn: LOCAL SERVICE
    Possible DLL Hijacking folder: C:\windows\system32 (Administrators [Allow: WriteData/CreateFiles])
    Command Line: C:\windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
   =================================================================================================
    qemu-ga(2800)[C:\Program Files\Qemu-ga\qemu-ga.exe] -- POwn: SYSTEM
    Permissions: Administrators [Allow: AllAccess]
    Possible DLL Hijacking folder: C:\Program Files\Qemu-ga (Administrators [Allow: AllAccess])
    Command Line: "C:\Program Files\Qemu-ga\qemu-ga.exe" -d --retry-path
   =================================================================================================
    svchost(2072)[C:\windows\system32\svchost.exe] -- POwn: SYSTEM
    Possible DLL Hijacking folder: C:\windows\system32 (Administrators [Allow: WriteData/CreateFiles])
    Command Line: C:\windows\system32\svchost.exe -k netsvcs -s CertPropSvc
   =================================================================================================


_raw:
    Logon Time:                   10/15/2025 12:10:40 PM
    Logon Type:                   Interactive
    Start Time:
    Domain:                       Window Manager
    Authentication Package:       Negotiate
    Start Time:
    User Name:                    DWM-1
    User Principal Name:
    User SID:                     S-1-5-90-0-1
   =================================================================================================
    Method:                       LSA
    Logon Server:
    Logon Server Dns Domain:      allports.local
    Logon Id:                     23529


_raw:
    Logon Time:                   10/15/2025 12:10:40 PM
    Logon Type:                   Service
    Start Time:
    Domain:                       NT AUTHORITY
    Authentication Package:       Negotiate
    Start Time:
    User Name:                    LOCAL SERVICE
    User Principal Name:
    User SID:                     S-1-5-19
   =================================================================================================
    Method:                       LSA
    Logon Server:
    Logon Server Dns Domain:
    Logon Id:                     43797


_raw:
    Logon Time:                   10/15/2025 12:10:40 PM
    Logon Type:                   Service
    Start Time:
    Domain:                       APT
    Authentication Package:       Negotiate
    Start Time:
    User Name:                    DECKHAND-01$
    User Principal Name:          DECKHAND-01$@allports.local
    User SID:                     S-1-5-20
   =================================================================================================
    Method:                       LSA
    Logon Server:
    Logon Server Dns Domain:
    Logon Id:                     100995253


_raw:
    Logon Time:                   10/15/2025 12:10:40 PM
    Logon Type:                   0
    Start Time:
    Domain:                       APT
    Authentication Package:       Negotiate
    Start Time:
    User Name:                    DECKHAND-01$
    User Principal Name:          DECKHAND-01$@allports.local
    User SID:                     S-1-5-18
   =================================================================================================
    Method:                       LSA
    Logon Server:
    Logon Server Dns Domain:      allports.local
    Logon Id:                     100987822


_raw:
    Logon Time:                   10/15/2025 12:10:40 PM
    Logon Type:                   Interactive
    Start Time:
    Domain:                       Font Driver Host
    Authentication Package:       Negotiate
    Start Time:
    User Name:                    UMFD-1
    User Principal Name:          DECKHAND-01$@allports.local
    User SID:                     S-1-5-96-0-1
   =================================================================================================
    Method:                       LSA
    Logon Server:
    Logon Server Dns Domain:      allports.local
    Logon Id:                     999


_raw:
   Last Logon              :   10/15/2025 8:10:41 AM
   Logons Count            :   6


_raw:
ÉÍÍÍÍÍÍÍÍÍÍ¹ Enumerating Sysmon process creation logs (1)
      EventID:                  1
      User Name:                NT AUTHORITY\LOCAL SERVICE


_raw:
    Last Shutdown Date/time        :    10/15/2025 8:10:35 AM
ÉÍÍÍÍÍÍÍÍÍÍ¹ User Environment Variables
È Check for some passwords or keys in the env variables
    COMPUTERNAME: DECKHAND-01
    USERPROFILE: C:\Users\rdavis
    HOMEPATH: \Users\rdavis
    LOCALAPPDATA: C:\Users\rdavis\AppData\Local
    PSModulePath: C:\Program Files\WindowsPowerShell\Modules;C:\windows\system32\WindowsPowerShell\v1.0\Modules
    PROCESSOR_ARCHITECTURE: AMD64
    Path: C:\windows\system32;C:\windows;C:\windows\System32\Wbem;C:\windows\System32\WindowsPowerShell\v1.0\;C:\windows\System32\OpenSSH\;C:\ProgramData\chocolatey\bin;C:\Users\rdavis\AppData\Local\Microsoft\WindowsApps;
    CommonProgramFiles(x86): C:\Program Files (x86)\Common Files
    ProgramFiles(x86): C:\Program Files (x86)
    PROCESSOR_LEVEL: 23
    LOGONSERVER: \\APT-DC-01
    PATHEXT: .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC
    HOMEDRIVE: C:
    SystemRoot: C:\windows
    ChocolateyInstall: C:\ProgramData\chocolatey
    SESSIONNAME: RDP-Tcp#0
    ALLUSERSPROFILE: C:\ProgramData
    DriverData: C:\Windows\System32\Drivers\DriverData
    APPDATA: C:\Users\rdavis\AppData\Roaming
    PROCESSOR_REVISION: 3100
    USERNAME: rdavis
    CommonProgramW6432: C:\Program Files\Common Files
    CommonProgramFiles: C:\Program Files\Common Files
    CLIENTNAME: CPTC11-regional
    OS: Windows_NT
    USERDOMAIN_ROAMINGPROFILE: APT
    PROCESSOR_IDENTIFIER: AMD64 Family 23 Model 49 Stepping 0, AuthenticAMD
    ComSpec: C:\windows\system32\cmd.exe
    PROMPT: $P$G
    SystemDrive: C:
    TEMP: C:\Users\rdavis\AppData\Local\Temp\2
    ProgramFiles: C:\Program Files
    NUMBER_OF_PROCESSORS: 4
    TMP: C:\Users\rdavis\AppData\Local\Temp\2
    ProgramData: C:\ProgramData
    ProgramW6432: C:\Program Files
    windir: C:\windows
    USERDOMAIN: APT
    PUBLIC: C:\Users\Public
    USERDNSDOMAIN: ALLPORTS.LOCAL
ÉÍÍÍÍÍÍÍÍÍÍ¹ System Environment Variables
È Check for some passwords or keys in the env variables
    ComSpec: C:\windows\system32\cmd.exe
    DriverData: C:\Windows\System32\Drivers\DriverData
    OS: Windows_NT
    Path: C:\windows\system32;C:\windows;C:\windows\System32\Wbem;C:\windows\System32\WindowsPowerShell\v1.0\;C:\windows\System32\OpenSSH\;C:\ProgramData\chocolatey\bin
    PATHEXT: .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC
    PROCESSOR_ARCHITECTURE: AMD64
    PSModulePath: C:\Program Files\WindowsPowerShell\Modules;C:\windows\system32\WindowsPowerShell\v1.0\Modules
    TEMP: C:\windows\TEMP
    TMP: C:\windows\TEMP
    USERNAME: SYSTEM
    windir: C:\windows
    NUMBER_OF_PROCESSORS: 4
    PROCESSOR_LEVEL: 23
    PROCESSOR_IDENTIFIER: AMD64 Family 23 Model 49 Stepping 0, AuthenticAMD
    PROCESSOR_REVISION: 3100
    ChocolateyInstall: C:\ProgramData\chocolatey
ÉÍÍÍÍÍÍÍÍÍÍ¹ Audit Settings
È Check what is being logged
  [X] Exception: Unable to cast object of type 'System.Int32' to type 'System.String'.
    Not Found
ÉÍÍÍÍÍÍÍÍÍÍ¹ Audit Policy Settings - Classic & Advanced
ÉÍÍÍÍÍÍÍÍÍÍ¹ WEF Settings
È Windows Event Forwarding, is interesting to know were are sent the logs
    Not Found
ÉÍÍÍÍÍÍÍÍÍÍ¹ LAPS Settings
È If installed, local administrator password is changed frequently and is restricted by ACL
    LAPS Enabled: LAPS not installed
ÉÍÍÍÍÍÍÍÍÍÍ¹ Wdigest
È If enabled, plain-text crds could be stored in LSASS https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#wdigest
    Wdigest is not enabled
ÉÍÍÍÍÍÍÍÍÍÍ¹ LSA Protection
È If enabled, a driver is needed to read LSASS memory (If Secure Boot or UEFI, RunAsPPL cannot be disabled by deleting the registry key) https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#lsa-protection
    LSA Protection is not enabled
ÉÍÍÍÍÍÍÍÍÍÍ¹ Credentials Guard
È If enabled, a driver is needed to read LSASS memory https://book.hacktricks.wiki/windows-hardening/stealing-credentials/credentials-protections#credentials-guard
    CredentialGuard is not enabled
    Virtualization Based Security Status:      Not enabled
    Configured:                                False
    Running:                                   False
ÉÍÍÍÍÍÍÍÍÍÍ¹ Cached Creds
È If > 0, credentials will be cached in the registry and accessible by SYSTEM user https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#cached-credentials
    cachedlogonscount is 10
ÉÍÍÍÍÍÍÍÍÍÍ¹ Enumerating saved credentials in Registry (CurrentPass)
ÉÍÍÍÍÍÍÍÍÍÍ¹ AV Information
  [X] Exception: Invalid namespace
    No AV was detected!!
    whitelistpaths:     C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
ÉÍÍÍÍÍÍÍÍÍÍ¹ Windows Defender configuration
  Local Settings
  Path Exclusions:
    C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
  PolicyManagerPathExclusions:
    C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
  Group Policy Settings
ÉÍÍÍÍÍÍÍÍÍÍ¹ UAC Status
È If you are in the Administrators group check how to bypass the UAC https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#from-administrator-medium-to-high-integrity-level--uac-bypasss
    ConsentPromptBehaviorAdmin: 0 - No prompting
    EnableLUA: 0
    LocalAccountTokenFilterPolicy: 1
    FilterAdministratorToken: 0
      [*] EnableLUA != 1, UAC policies disabled.
      [+] Any local account can be used for lateral movement.
ÉÍÍÍÍÍÍÍÍÍÍ¹ PowerShell Settings
  [X] Exception: The given key was not present in the dictionary.
    PowerShell v2 Version: 2.0
    PowerShell v5 Version: 5.1.20348.1
    PowerShell Core Version:
    Transcription Settings:
    Module Logging Settings:
    Scriptblock Logging Settings:
    PS history file:
    PS history size:
ÉÍÍÍÍÍÍÍÍÍÍ¹ Enumerating PowerShell Session Settings using the registry
    Name                                   Microsoft.PowerShell
      BUILTIN\Administrators               AccessAllowed
      NT AUTHORITY\INTERACTIVE             AccessAllowed
      BUILTIN\Remote Management Users      AccessAllowed
   =================================================================================================
    Name                                   Microsoft.PowerShell.Workflow
      BUILTIN\Administrators               AccessAllowed
      BUILTIN\Remote Management Users      AccessAllowed
   =================================================================================================
    Name                                   Microsoft.PowerShell32
      BUILTIN\Administrators               AccessAllowed
      NT AUTHORITY\INTERACTIVE             AccessAllowed
      BUILTIN\Remote Management Users      AccessAllowed
   =================================================================================================
ÉÍÍÍÍÍÍÍÍÍÍ¹ PS default transcripts history
È Read the PS history inside these files (if any)
ÉÍÍÍÍÍÍÍÍÍÍ¹ HKCU Internet Settings
    CertificateRevocation: 1
    DisableCachingOfSSLPages: 1
    IE5_UA_Backup_Flag: 5.0
    PrivacyAdvanced: 1
    SecureProtocols: 10240
    User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
    ZonesSecurityUpgrade: System.Byte[]
    WarnonZoneCrossing: 1
    EnableNegotiate: 1
    ProxyEnable: 0
    MigrateProxy: 1
ÉÍÍÍÍÍÍÍÍÍÍ¹ HKLM Internet Settings
    ActiveXCache: C:\Windows\Downloaded Program Files
    CodeBaseSearchPath: CODEBASE
    EnablePunycode: 1
    MinorVersion: 0
    WarnOnIntranet: 1
ÉÍÍÍÍÍÍÍÍÍÍ¹ Drives Information
È Remember that you should search more info inside the other drives
    C:\ (Type: Fixed)(Volume label: OS)(Filesystem: NTFS)(Available space: 94 GB)(Permissions: Administrators [Allow: AllAccess], Users [Allow: AppendData/CreateDirectories])
ÉÍÍÍÍÍÍÍÍÍÍ¹ Checking WSUS
È  https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#wsus
    Not Found
ÉÍÍÍÍÍÍÍÍÍÍ¹ Checking KrbRelayUp
È  https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#krbrelayup
  The system is inside a domain (APT) so it could be vulnerable.
È You can try https://github.com/Dec0ne/KrbRelayUp to escalate privileges
ÉÍÍÍÍÍÍÍÍÍÍ¹ Checking If Inside Container
È If the binary cexecsvc.exe or associated service exists, you are inside Docker
You are NOT inside a container
ÉÍÍÍÍÍÍÍÍÍÍ¹ Checking AlwaysInstallElevated
È  https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#alwaysinstallelevated
    AlwaysInstallElevated isn't available
ÉÍÍÍÍÍÍÍÍÍÍ¹ Enumerate LSA settings - auth packages included

    auditbasedirectories                 :       0
    auditbaseobjects                     :       1
    Bounds                               :       00-30-00-00-00-20-00-00
    crashonauditfail                     :       0
    fullprivilegeauditing                :       01
    LimitBlankPasswordUse                :       0
    NoLmHash                             :       1
    Security Packages                    :       ""
    Notification Packages                :       rassfm,scecli
    Authentication Packages              :       msv1_0
    LsaPid                               :       696
    LsaCfgFlagsDefault                   :       0
    SecureBoot                           :       1
    ProductType                          :       7
    disabledomaincreds                   :       0
    everyoneincludesanonymous            :       0
    forceguest                           :       0
    restrictanonymous                    :       0
    restrictanonymoussam                 :       0
    lmcompatibilitylevel                 :       0
ÉÍÍÍÍÍÍÍÍÍÍ¹ Enumerating NTLM Settings
  LanmanCompatibilityLevel    : 0 (Send LM & NTLM responses)

  NTLM Signing Settings
      ClientRequireSigning    : False
      ClientNegotiateSigning  : True
      ServerRequireSigning    : False
      ServerNegotiateSigning  : False
      LdapSigning             : Negotiate signing (Negotiate signing)

  Session Security
      NTLMMinClientSec        : 536870912 (Require 128-bit encryption)
        [!] NTLM clients support NTLMv1!
      NTLMMinServerSec        : 536870912 (Require 128-bit encryption)

        [!] NTLM services on this machine support NTLMv1!

  NTLM Auditing and Restrictions
      InboundRestrictions     :  (Not defined)
      OutboundRestrictions    :  (Not defined)
      InboundAuditing         :  (Not defined)
      OutboundExceptions      :
ÉÍÍÍÍÍÍÍÍÍÍ¹ Display Local Group Policy settings - local users/machine
   Type             :     user
   Display Name     :     Local Group Policy
   Name             :     Local Group Policy
   Extensions       :     [{35378EAC-683F-11D2-A89A-00C04FBBCFA2}{D02B1F73-3407-48AE-BA88-E8213C6761F1}]
   File Sys Path    :     C:\windows\System32\GroupPolicy\User
   Link             :     Local
   GPO Link         :     Local Machine
   Options          :     All Sections Enabled
   =================================================================================================
ÉÍÍÍÍÍÍÍÍÍÍ¹ Potential GPO abuse vectors (applied domain GPOs writable by current user)
    No obvious GPO abuse via writable SYSVOL paths or GPCO membership detected.
ÉÍÍÍÍÍÍÍÍÍÍ¹ Checking AppLocker effective policy
   AppLockerPolicy version: 1
   listing rules:
ÉÍÍÍÍÍÍÍÍÍÍ¹ Enumerating Printers (WMI)
      Name:                    Microsoft XPS Document Writer
      Status:                  Unknown
      Sddl:                    O:SYD:(A;;LCSWSDRCWDWO;;;LA)(A;OIIO;RPWPSDRCWDWO;;;LA)(A;OIIO;GA;;;CO)(A;OIIO;GA;;;AC)(A;;SWRC;;;WD)(A;CIIO;GX;;;WD)(A;;SWRC;;;AC)(A;CIIO;GX;;;AC)(A;;LCSWDTSDRCWDWO;;;BA)(A;OICIIO;GA;;;BA)(A;OIIO;GA;;;S-1-15-3-1024-4044835139-2658482041-3127973164-329287231-3865880861-1938685643-461067658-1087000422)(A;;SWRC;;;S-1-15-3-1024-4044835139-2658482041-3127973164-329287231-3865880861-1938685643-461067658-1087000422)(A;CIIO;GX;;;S-1-15-3-1024-4044835139-2658482041-3127973164-329287231-3865880861-1938685643-461067658-1087000422)
      Is default:              False
      Is network printer:      False
   =================================================================================================
      Name:                    Microsoft Print to PDF
      Status:                  Unknown
      Sddl:                    O:SYD:(A;;LCSWSDRCWDWO;;;LA)(A;OIIO;RPWPSDRCWDWO;;;LA)(A;OIIO;GA;;;CO)(A;OIIO;GA;;;AC)(A;;SWRC;;;WD)(A;CIIO;GX;;;WD)(A;;SWRC;;;AC)(A;CIIO;GX;;;AC)(A;;LCSWDTSDRCWDWO;;;BA)(A;OICIIO;GA;;;BA)(A;OIIO;GA;;;S-1-15-3-1024-4044835139-2658482041-3127973164-329287231-3865880861-1938685643-461067658-1087000422)(A;;SWRC;;;S-1-15-3-1024-4044835139-2658482041-3127973164-329287231-3865880861-1938685643-461067658-1087000422)(A;CIIO;GX;;;S-1-15-3-1024-4044835139-2658482041-3127973164-329287231-3865880861-1938685643-461067658-1087000422)
      Is default:              True
      Is network printer:      False
   =================================================================================================
ÉÍÍÍÍÍÍÍÍÍÍ¹ Enumerating Named Pipes
  Name                                                                                CurrentUserPerms                                                       Sddl
  eventlog                                                                                Everyone [Allow: WriteData/CreateFiles]                                O:LSG:LSD:P(A;;0x12019b;;;WD)(A;;CC;;;OW)(A;;0x12008f;;;S-1-5-80-880578595-1860270145-482643319-2788375705-1540778122)
  PIPE_EVENTROOT\CIMV2SCM EVENT PROVIDER                                                                                O:BAG:SYD:(A;;FA;;;SY)(A;;0x12019b;;;LS)(A;;0x12019b;;;NS)
  Winsock2\CatalogChangeListener-2b8-0                                                                 Administrators [Allow: WriteData/CreateFiles]                          O:BAG:SYD:(D;;FW;;;NU)(A;;0x120196;;;SY)(A;;0x120196;;;BA)
  Winsock2\CatalogChangeListener-49c-0                                                                 Administrators [Allow: WriteData/CreateFiles]                          O:BAG:LSD:(D;;FW;;;NU)(A;;0x120196;;;SY)(A;;0x120196;;;BA)
ÉÍÍÍÍÍÍÍÍÍÍ¹ Enumerating AMSI registered providers
    Provider:       {2781761E-28E0-4109-99FE-B9D127C57AFE}
    Path:           "C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MpOav.dll"
   =================================================================================================
ÉÍÍÍÍÍÍÍÍÍÍ¹ Enumerating Sysmon configuration
      Installed:                True
      Hashing Algorithm:        Not Defined
      Options:                  7
      Rules:                    [encoded data, 9968 characters]
   =================================================================================================


_raw:
   Password Last Set       :   1/1/1970 12:00:00 AM
   =================================================================================================
   Computer Name           :   DECKHAND-01
   User Name               :   Guest
   User Id                 :   501
   Is Enabled              :   True
   User Type               :   Guest
   Comment                 :   Built-in account for guest access to the computer/domain
   Last Logon              :   1/1/1970 12:00:00 AM
   Logons Count            :   0
   Password Last Set       :   1/1/1970 12:00:00 AM
   =================================================================================================
   Computer Name           :   DECKHAND-01
   User Name               :   WDAGUtilityAccount
   User Id                 :   504
   Is Enabled              :   False
   User Type               :   Guest
   Comment                 :   A user account managed and used by the system for Windows Defender Application Guard scenarios.
   Last Logon              :   1/1/1970 12:00:00 AM
   Logons Count            :   0
   Password Last Set       :   6/21/2022 3:46:17 PM
   =================================================================================================
ÉÍÍÍÍÍÍÍÍÍÍ¹ RDP Sessions
    SessID    pSessionName   pUserName      pDomainName              State     SourceIP
    2         RDP-Tcp#0      rdavis         APT                      Active    10.0.254.203
ÉÍÍÍÍÍÍÍÍÍÍ¹ Ever logged users
    NT SERVICE\SplunkForwarder
    DECKHAND-01\Admin
    DECKHAND-01\cloudbase-init
    APT\rdavis
ÉÍÍÍÍÍÍÍÍÍÍ¹ Home folders found
    C:\Users\Admin : Administrators [Allow: AllAccess]
    C:\Users\All Users : Administrators [Allow: AllAccess]
    C:\Users\cloudbase-init : Administrators [Allow: AllAccess]
    C:\Users\Default : Administrators [Allow: AllAccess]
    C:\Users\Default User : Administrators [Allow: AllAccess]
    C:\Users\Public : Interactive [Allow: WriteData/CreateFiles], Administrators [Allow: AllAccess]
    C:\Users\rdavis : Administrators [Allow: AllAccess], rdavis [Allow: AllAccess]
ÉÍÍÍÍÍÍÍÍÍÍ¹ Looking for AutoLogon credentials
    Not Found
ÉÍÍÍÍÍÍÍÍÍÍ¹ Password Policies
È Check for a possible brute-force
    Domain: Builtin
    SID: S-1-5-32
    MaxPasswordAge: 42.22:47:31.7437440
    MinPasswordAge: 00:00:00
    MinPasswordLength: 0
    PasswordHistoryLength: 0
    PasswordProperties: 0
   =================================================================================================
    Domain: DECKHAND-01
    SID: S-1-5-21-3186930452-1215421086-4224751751
    MaxPasswordAge: 60.00:00:00
    MinPasswordAge: 00:00:00
    MinPasswordLength: 5
    PasswordHistoryLength: 0
    PasswordProperties: DOMAIN_PASSWORD_COMPLEX, DOMAIN_PASSWORD_STORE_CLEARTEXT
   =================================================================================================
ÉÍÍÍÍÍÍÍÍÍÍ¹ Print Logon Sessions
    Method:                       LSA
    Logon Server:                 APT-DC-01
    Logon Server Dns Domain:      ALLPORTS.LOCAL
    Logon Id:                     101048861


_raw:
   Last Logon              :   1/1/1970 12:00:00 AM
   Logons Count            :   0


_raw:
   Password Last Set       :   10/15/2025 7:59:32 AM
   =================================================================================================
   Computer Name           :   DECKHAND-01
   User Name               :   DefaultAccount
   User Id                 :   503
   Is Enabled              :   False
   User Type               :   Guest
   Comment                 :   A user account managed by the system.


_raw:
   Password Last Set       :   10/15/2025 7:57:47 AM
   =================================================================================================
   Computer Name           :   DECKHAND-01
   User Name               :   Administrator
   User Id                 :   500
   Is Enabled              :   True
   User Type               :   Administrator
   Comment                 :   Built-in account for administering the computer/domain


_raw:
   Last Logon              :   10/15/2025 7:57:01 AM
   Logons Count            :   1


_raw:
  10/15/2025 3:55:21 AM   :  Startup
ÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ¹ Users Information ÌÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ
ÉÍÍÍÍÍÍÍÍÍÍ¹ Users
È Check if you have some admin equivalent privileges https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#users--groups
  Current user: rdavis
  Current groups: Domain Users, Everyone, Users, Administrators, Remote Interactive Logon, Interactive, Authenticated Users, This Organization, Local, Authentication authority asserted identity
   =================================================================================================
    DECKHAND-01\Admin
        |->Groups: Administrators
        |->Password: CanChange-NotExpi-Req
    DECKHAND-01\Administrator: Built-in account for administering the computer/domain
        |->Groups: Administrators
        |->Password: CanChange-Expi-Req
    DECKHAND-01\cloudbase-init
        |->Groups: Administrators
        |->Password: NotChange-NotExpi-Req
    DECKHAND-01\DefaultAccount(Disabled): A user account managed by the system.
        |->Groups: System Managed Accounts Group
        |->Password: CanChange-NotExpi-NotReq
    DECKHAND-01\Guest: Built-in account for guest access to the computer/domain
        |->Groups: Guests
        |->Password: NotChange-NotExpi-NotReq
    DECKHAND-01\WDAGUtilityAccount(Disabled): A user account managed and used by the system for Windows Defender Application Guard scenarios.
        |->Password: CanChange-Expi-Req
ÉÍÍÍÍÍÍÍÍÍÍ¹ Current User Idle Time
   Current User   :     APT\rdavis
   Idle Time      :     00h:00m:00s:062ms
ÉÍÍÍÍÍÍÍÍÍÍ¹ Display Tenant information (DsRegCmd.exe /status)
   Tenant is NOT Azure AD Joined.
ÉÍÍÍÍÍÍÍÍÍÍ¹ Current Token privileges
È Check if you can escalate privilege using some enabled token https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#token-manipulation
    SeIncreaseQuotaPrivilege: DISABLED
    SeSecurityPrivilege: DISABLED
    SeTakeOwnershipPrivilege: DISABLED
    SeLoadDriverPrivilege: DISABLED
    SeSystemProfilePrivilege: DISABLED
    SeSystemtimePrivilege: DISABLED
    SeProfileSingleProcessPrivilege: DISABLED
    SeIncreaseBasePriorityPrivilege: DISABLED
    SeCreatePagefilePrivilege: DISABLED
    SeBackupPrivilege: DISABLED
    SeRestorePrivilege: DISABLED
    SeShutdownPrivilege: DISABLED
    SeDebugPrivilege: DISABLED
    SeSystemEnvironmentPrivilege: DISABLED
    SeChangeNotifyPrivilege: SE_PRIVILEGE_ENABLED_BY_DEFAULT, SE_PRIVILEGE_ENABLED
    SeRemoteShutdownPrivilege: DISABLED
    SeUndockPrivilege: DISABLED
    SeManageVolumePrivilege: DISABLED
    SeImpersonatePrivilege: SE_PRIVILEGE_ENABLED_BY_DEFAULT, SE_PRIVILEGE_ENABLED
    SeCreateGlobalPrivilege: SE_PRIVILEGE_ENABLED_BY_DEFAULT, SE_PRIVILEGE_ENABLED
    SeIncreaseWorkingSetPrivilege: DISABLED
    SeTimeZonePrivilege: DISABLED
    SeCreateSymbolicLinkPrivilege: DISABLED
    SeDelegateSessionUserImpersonatePrivilege: DISABLED
ÉÍÍÍÍÍÍÍÍÍÍ¹ Clipboard text
ÉÍÍÍÍÍÍÍÍÍÍ¹ Logged users
    NT SERVICE\SplunkForwarder
    APT\rdavis
ÉÍÍÍÍÍÍÍÍÍÍ¹ Display information about local users
   Computer Name           :   DECKHAND-01
   User Name               :   Admin
   User Id                 :   1001
   Is Enabled              :   True
   User Type               :   Administrator
   Comment                 :