_raw:
    Key: StubPath
    Folder: C:\windows\system32
    FolderPerms: Administrators [Allow: WriteData/CreateFiles]
    File: C:\windows\system32\unregmp2.exe /FirstLogon
   =================================================================================================
    RegPath: HKLM\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{89B4C1CD-B018-4511-B0A1-5476DBF70820}
    RegPerms: Administrators [Allow: FullControl]
    Key: StubPath
    Folder: C:\Windows\SysWOW64
    FolderPerms: Administrators [Allow: WriteData/CreateFiles]
    File: C:\Windows\SysWOW64\Rundll32.exe C:\Windows\SysWOW64\mscories.dll,Install
   =================================================================================================
    RegPath: HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}
    RegPerms: Administrators [Allow: FullControl GenericAll]
    Folder: C:\Program Files (x86)\Microsoft\Edge\Application\141.0.3537.85\BHO
    FolderPerms: Administrators [Allow: AllAccess]
    File: C:\Program Files (x86)\Microsoft\Edge\Application\141.0.3537.85\BHO\ie_to_edge_bho_64.dll (Unquoted and Space detected) - C:\,C:\Program Files
   =================================================================================================
    RegPath: HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}
    RegPerms: Administrators [Allow: FullControl GenericAll]
    Folder: C:\Program Files (x86)\Microsoft\Edge\Application\141.0.3537.85\BHO
    FolderPerms: Administrators [Allow: AllAccess]
    File: C:\Program Files (x86)\Microsoft\Edge\Application\141.0.3537.85\BHO\ie_to_edge_bho_64.dll (Unquoted and Space detected) - C:\,C:\Program Files
   =================================================================================================
    Folder: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
    FolderPerms: Administrators [Allow: AllAccess]
    File: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\cptclogging.exe (Unquoted and Space detected) - C:\ProgramData\Microsoft\Windows,C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\cptclogging.exe
    FilePerms: Administrators [Allow: AllAccess]
    Potentially sensitive file content: MZ????@????!?L?!This program cannot be run in DOS mode., }W??0??j??9??-Y?J?X???????~???+?????fqm?k$??????F???;?4<?nX??@??Z??3?'7?0?]T??????c?#+3??)?}, $?]u??w??P???,?????|~??g?T?2Ie?>?1??P?2d??>h?@?h?r??p"?O??Y?4?H?t%??JB??E?6Y??=?Xu'???:???d3?vsA?V?*???O]$?[?L??R??dm???b??Y3e??????????-?R??Q ??/U?*6N??`?(b??/??`S/?*x??0???Y????9E$h????pB?U??????f~'??y???H|^?????D1O??7??OE G???d??;????Iu_?&.`?K?l/9Nd?????8?P/?h?W%g9Y??????:????K?-,??0_o?D?YS?2Y, &?~2C?x?)?[B"?b????W??N0??|?????'"???H?kqP?k???:??/h?x?q??j@?ak???m?p7??&??q?#??l3?b??Y9????c???F????E?O?k?b?FK?????{?Ig???????????%Q]???69ZY"???Zx??#f??@?f?P??UQ?$?|?(e??b??5??2h?????/Q"<?;?????&???!?x?????1^?%i???Ere?????5PN|??L??DX?+?? @6-??Jd??nn?l???_??6C?=?My?5?%??kG6;???{???"?*???{j?_%?1U]`@????\{?/?s??Y[.fq?H9|??X??, ?y?????m??o????}AY7N??h?????}?Ih?ú?yG-1?R*?L??????=P?U43?[?,f???w?A?T???I?t??D???Cz?? ???7g?$sM???Ct?????z??MK@???o?????c??>??i+???)????a?, 1??_4??e\O?;???R?Y??q????1~l?23e????H)v?[?cQ??5??~ ]??*?<???Y???????h????4?wP???!G???Y.?,2%?~?ifE?S$?U????X?#'m?a?p?F?Z?????????K???$?@L?X?AD???t?[?R#?H2?;?_xCi?=?i???=?????z??{?]?N?1?n?$HP?Dv???K??w?????L?h?g?;Q?a?#*+:?6????fRd?P??1??}?L? ??%?X??vq]6qoPa??c1B???.zh??W?I???U??85??<?6n?TqT9??**v?fTj?rl4?*?5x????kqr"
   =================================================================================================
    Folder: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
    FolderPerms: Administrators [Allow: AllAccess]
    File: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini (Unquoted and Space detected) - C:\ProgramData\Microsoft\Windows,C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
    FilePerms: Administrators [Allow: AllAccess]
    Potentially sensitive file content: LocalizedResourceName=@%SystemRoot%\system32\shell32.dll,-21787
   =================================================================================================
    Folder: C:\Users\rdavis\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
    FolderPerms: Administrators [Allow: AllAccess], rdavis [Allow: AllAccess]
    File: C:\Users\rdavis\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini (Unquoted and Space detected) - C:\Users\rdavis\AppData\Roaming\Microsoft\Windows,C:\Users\rdavis\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
    FilePerms: Administrators [Allow: AllAccess], rdavis [Allow: AllAccess]
    Potentially sensitive file content: LocalizedResourceName=@%SystemRoot%\system32\shell32.dll,-21787
   =================================================================================================
    Folder: C:\windows\tasks
    FolderPerms: Authenticated Users [Allow: WriteData/CreateFiles], Administrators [Allow: AllAccess]
   =================================================================================================
    Folder: C:\windows\system32\tasks
    FolderPerms: Authenticated Users [Allow: WriteData/CreateFiles], Administrators [Allow: AllAccess]
   =================================================================================================
    Folder: C:\windows
    FolderPerms: Administrators [Allow: WriteData/CreateFiles]
    File: C:\windows\system.ini
    FilePerms: Administrators [Allow: AllAccess]
   =================================================================================================
    Folder: C:\windows
    FolderPerms: Administrators [Allow: WriteData/CreateFiles]
    File: C:\windows\win.ini
    FilePerms: Administrators [Allow: AllAccess]
   =================================================================================================
    Key: From WMIC
    Folder: C:\windows\system32
    FolderPerms: Administrators [Allow: WriteData/CreateFiles]
    File: C:\windows\system32\SecurityHealthSystray.exe
   =================================================================================================
ÉÍÍÍÍÍÍÍÍÍÍ¹ Scheduled Applications --Non Microsoft--
È Check if you can modify other users scheduled binaries https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/privilege-escalation-with-autorun-binaries.html
    (NT AUTHORITY\SYSTEM) GoogleUpdaterTaskSystem142.0.7416.0{669039E5-2BB3-4C1E-97AF-C91AD1EBB828}: "C:\Program Files (x86)\Google\GoogleUpdater\142.0.7416.0\updater.exe" --wake --system
    Trigger: At log on of any user
             At 8:17 AM every day-After triggered, repeat every 01:00:00 for a duration of 1.00:00:00.
   =================================================================================================
ÉÍÍÍÍÍÍÍÍÍÍ¹ Device Drivers --Non Microsoft--
È Check 3rd party drivers for known vulnerabilities/rootkits. https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#drivers
    Red Hat VirtIO SCSI pass-through controller - 100.90.104.21700 [Red Hat, Inc.]: \\.\GLOBALROOT\SystemRoot\System32\drivers\vioscsi.sys
    Red Hat VirtIO Ethernet Adapter - 100.90.104.21700 [Red Hat, Inc.]: \\.\GLOBALROOT\SystemRoot\System32\drivers\netkvm.sys
    Red Hat VirtIO Serial controller - 100.90.104.21700 [Red Hat, Inc.]: \\.\GLOBALROOT\SystemRoot\System32\drivers\vioser.sys
    Red Hat VirtIO Balloon controller - 100.90.104.21700 [Red Hat, Inc.]: \\.\GLOBALROOT\SystemRoot\System32\drivers\balloon.sys
    Red Hat VirtIO RNG Device - 100.90.104.21700 [Red Hat, Inc.]: \\.\GLOBALROOT\SystemRoot\System32\drivers\viorng.sys
    Windows (R) Win 7 DDK driver - 10.0.10011.16384 [Windows (R) Win 7 DDK provider]: \\.\GLOBALROOT\SystemRoot\system32\DRIVERS\splunkdrv.sys
    Sysinternals Sysmon - 15.15 [Sysinternals - www.sysinternals.com]: \\.\GLOBALROOT\SystemRoot\SysmonDrv.sys
ÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ¹ Network Information ÌÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ
ÉÍÍÍÍÍÍÍÍÍÍ¹ Network Shares
    ADMIN$ (Path: C:\windows)
    C$ (Path: C:\)
    IPC$ (Path: )
ÉÍÍÍÍÍÍÍÍÍÍ¹ Enumerate Network Mapped Drives (WMI)
ÉÍÍÍÍÍÍÍÍÍÍ¹ Host File
ÉÍÍÍÍÍÍÍÍÍÍ¹ Network Ifaces and known hosts
È The masks are only for the IPv4 addresses
    tap1ed31f0d-5f[FA:16:3E:38:55:87]: 10.0.1.20, fe80::3cc4:7281:d91c:11ee%4 / 255.255.255.0
        Gateways: 10.0.1.254
        DNSs: 10.0.1.6
        Known hosts:
          10.0.1.1              FA-16-3E-55-C4-CA     Dynamic
          10.0.1.6              FA-16-3E-28-B6-A9     Dynamic
          10.0.1.21             FA-16-3E-66-B3-6E     Dynamic
          10.0.1.254            FA-16-3E-21-78-E9     Dynamic
          10.0.1.255            FF-FF-FF-FF-FF-FF     Static
          224.0.0.22            01-00-5E-00-00-16     Static
          224.0.0.251           01-00-5E-00-00-FB     Static
          224.0.0.252           01-00-5E-00-00-FC     Static
          255.255.255.255       FF-FF-FF-FF-FF-FF     Static
    Loopback Pseudo-Interface 1[]: 127.0.0.1, ::1 / 255.0.0.0
        DNSs: fec0:0:0:ffff::1%1, fec0:0:0:ffff::2%1, fec0:0:0:ffff::3%1
        Known hosts:
          224.0.0.22            00-00-00-00-00-00     Static
ÉÍÍÍÍÍÍÍÍÍÍ¹ Current TCP Listening Ports
È Check for services restricted from the outside
  Enumerating IPv4 connections

  Protocol   Local Address         Local Port    Remote Address        Remote Port     State             Process ID      Process Name
  TCP        0.0.0.0               135           0.0.0.0               0               Listening         940             C:\windows\system32\svchost.exe
  TCP        0.0.0.0               445           0.0.0.0               0               Listening         4               System
  TCP        0.0.0.0               3389          0.0.0.0               0               Listening         764             C:\windows\System32\svchost.exe
  TCP        0.0.0.0               5985          0.0.0.0               0               Listening         4               System
  TCP        0.0.0.0               5986          0.0.0.0               0               Listening         4               System
  TCP        0.0.0.0               47001         0.0.0.0               0               Listening         4               System
  TCP        0.0.0.0               49664         0.0.0.0               0               Listening         696             C:\windows\system32\lsass.exe
  TCP        0.0.0.0               49665         0.0.0.0               0               Listening         544             wininit
  TCP        0.0.0.0               49666         0.0.0.0               0               Listening         1180            C:\windows\System32\svchost.exe
  TCP        0.0.0.0               49667         0.0.0.0               0               Listening         1732            C:\windows\system32\svchost.exe
  TCP        0.0.0.0               49668         0.0.0.0               0               Listening         696             C:\windows\system32\lsass.exe
  TCP        0.0.0.0               49669         0.0.0.0               0               Listening         2384            C:\windows\System32\svchost.exe
  TCP        0.0.0.0               49676         0.0.0.0               0               Listening         2524            C:\windows\System32\spoolsv.exe
  TCP        0.0.0.0               49691         0.0.0.0               0               Listening         2436            C:\windows\system32\svchost.exe
  TCP        0.0.0.0               49693         0.0.0.0               0               Listening         688             services
  TCP        10.0.1.20             139           0.0.0.0               0               Listening         4               System
  TCP        10.0.1.20             3389          10.0.254.203          46372           Established       764             C:\windows\System32\svchost.exe

  Enumerating IPv6 connections

  Protocol   Local Address                               Local Port    Remote Address                              Remote Port     State             Process ID      Process Name
  TCP        [::]                                        135           [::]                                        0               Listening         940             C:\windows\system32\svchost.exe
  TCP        [::]                                        445           [::]                                        0               Listening         4               System
  TCP        [::]                                        3389          [::]                                        0               Listening         764             C:\windows\System32\svchost.exe
  TCP        [::]                                        5985          [::]                                        0               Listening         4               System
  TCP        [::]                                        5986          [::]                                        0               Listening         4               System
  TCP        [::]                                        47001         [::]                                        0               Listening         4               System
  TCP        [::]                                        49664         [::]                                        0               Listening         696             C:\windows\system32\lsass.exe
  TCP        [::]                                        49665         [::]                                        0               Listening         544             wininit
  TCP        [::]                                        49666         [::]                                        0               Listening         1180            C:\windows\System32\svchost.exe
  TCP        [::]                                        49667         [::]                                        0               Listening         1732            C:\windows\system32\svchost.exe
  TCP        [::]                                        49668         [::]                                        0               Listening         696             C:\windows\system32\lsass.exe
  TCP        [::]                                        49669         [::]                                        0               Listening         2384            C:\windows\System32\svchost.exe
  TCP        [::]                                        49676         [::]                                        0               Listening         2524            C:\windows\System32\spoolsv.exe
  TCP        [::]                                        49691         [::]                                        0               Listening         2436            C:\windows\system32\svchost.exe
  TCP        [::]                                        49693         [::]                                        0               Listening         688             services
  TCP        [fe80::3cc4:7281:d91c:11ee%4]               135           [fe80::3cc4:7281:d91c:11ee%4]               49923           Established       940             C:\windows\system32\svchost.exe
  TCP        [fe80::3cc4:7281:d91c:11ee%4]               49666         [fe80::3cc4:7281:d91c:11ee%4]               49924           Established       1180            C:\windows\System32\svchost.exe
  TCP        [fe80::3cc4:7281:d91c:11ee%4]               49923         [fe80::3cc4:7281:d91c:11ee%4]               135             Established       7244            C:\Users\rdavis\Desktop\winPEASx64 (2).exe
  TCP        [fe80::3cc4:7281:d91c:11ee%4]               49924         [fe80::3cc4:7281:d91c:11ee%4]               49666           Established       7244            C:\Users\rdavis\Desktop\winPEASx64 (2).exe
ÉÍÍÍÍÍÍÍÍÍÍ¹ Current UDP Listening Ports
È Check for services restricted from the outside
  Enumerating IPv4 connections

  Protocol   Local Address         Local Port    Remote Address:Remote Port     Process ID        Process Name
  UDP        0.0.0.0               123           *:*                            1188              C:\windows\system32\svchost.exe
  UDP        0.0.0.0               500           *:*                            2424              C:\windows\system32\svchost.exe
  UDP        0.0.0.0               3389          *:*                            764               C:\windows\System32\svchost.exe
  UDP        0.0.0.0               4500          *:*                            2424              C:\windows\system32\svchost.exe
  UDP        0.0.0.0               5353          *:*                            6580              C:\Program Files\Google\Chrome\Application\chrome.exe
  UDP        0.0.0.0               5353          *:*                            1268              C:\windows\system32\svchost.exe
  UDP        0.0.0.0               5353          *:*                            6580              C:\Program Files\Google\Chrome\Application\chrome.exe
  UDP        0.0.0.0               5355          *:*                            1268              C:\windows\system32\svchost.exe
  UDP        0.0.0.0               50011         *:*                            6424              C:\Program Files\Google\Chrome\Application\chrome.exe
  UDP        0.0.0.0               51648         *:*                            1268              C:\windows\system32\svchost.exe
  UDP        0.0.0.0               63914         *:*                            1268              C:\windows\system32\svchost.exe
  UDP        0.0.0.0               65266         *:*                            6424              C:\Program Files\Google\Chrome\Application\chrome.exe
  UDP        10.0.1.20             137           *:*                            4                 System
  UDP        10.0.1.20             138           *:*                            4                 System
  UDP        127.0.0.1             51650         *:*                            7244              C:\Users\rdavis\Desktop\winPEASx64 (2).exe
  UDP        127.0.0.1             56730         *:*                            1544              C:\windows\system32\svchost.exe
  UDP        127.0.0.1             63343         *:*                            2172              C:\windows\System32\svchost.exe
  UDP        127.0.0.1             63345         *:*                            696               C:\windows\system32\lsass.exe
  UDP        127.0.0.1             63347         *:*                            1460              C:\windows\System32\svchost.exe
  UDP        127.0.0.1             64017         *:*                            4268              C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe

  Enumerating IPv6 connections

  Protocol   Local Address                               Local Port    Remote Address:Remote Port     Process ID        Process Name
  UDP        [::]                                        123           *:*                            1188              C:\windows\system32\svchost.exe
  UDP        [::]                                        500           *:*                            2424              C:\windows\system32\svchost.exe
  UDP        [::]                                        3389          *:*                            764               C:\windows\System32\svchost.exe
  UDP        [::]                                        4500          *:*                            2424              C:\windows\system32\svchost.exe
  UDP        [::]                                        5353          *:*                            1268              C:\windows\system32\svchost.exe
  UDP        [::]                                        5353          *:*                            6580              C:\Program Files\Google\Chrome\Application\chrome.exe
  UDP        [::]                                        5355          *:*                            1268              C:\windows\system32\svchost.exe
  UDP        [::]                                        51648         *:*                            1268              C:\windows\system32\svchost.exe
  UDP        [::]                                        63914         *:*                            1268              C:\windows\system32\svchost.exe
ÉÍÍÍÍÍÍÍÍÍÍ¹ Firewall Rules
È Showing only DENY rules (too many ALLOW rules always)
    Current Profiles: DOMAIN
    FirewallEnabled (Domain):    False
    FirewallEnabled (Private):    False
    FirewallEnabled (Public):    False
    DENY rules:
ÉÍÍÍÍÍÍÍÍÍÍ¹ DNS cached --limit 70--
    Entry                                 Name                                  Data
    files.cp.tc                           files.cp.tc                           129.21.33.139
    ...p._tcp.pdc._msdcs.allports.local   ...p._tcp.pdc._msdcs.allports.local   ...t-dc-01.allports.local 0 100 389
    ...p._tcp.pdc._msdcs.allports.local   apt-dc-01.allports.local              10.0.1.6
    edgedl.me.gvt1.com                    edgedl.me.gvt1.com                    34.104.35.123
    idx03.cp.tc                           idx03.cp.tc                           129.21.249.222
    idx02.cp.tc                           idx02.cp.tc                           129.21.249.223
    idx01.cp.tc                           idx01.cp.tc                           129.21.249.131
    ds01.cp.tc                            ds01.cp.tc                            129.21.249.208
    ...._sites.gc._msdcs.allports.local   ...._sites.gc._msdcs.allports.local   ...-dc-01.allports.local 0 100 3268
    ...._sites.gc._msdcs.allports.local   apt-dc-01.allports.local              10.0.1.6
    apt-dc-01.allports.local              APT-DC-01.allports.local              10.0.1.6
    ...._sites.dc._msdcs.allports.local   ...._sites.dc._msdcs.allports.local   ...t-dc-01.allports.local 0 100 389
    ...._sites.dc._msdcs.allports.local   apt-dc-01.allports.local              10.0.1.6
ÉÍÍÍÍÍÍÍÍÍÍ¹ Enumerating Internet settings, zone and proxy configuration
  General Settings
  Hive        Key                                       Value
  HKCU        CertificateRevocation                     1
  HKCU        DisableCachingOfSSLPages                  1
  HKCU        IE5_UA_Backup_Flag                        5.0
  HKCU        PrivacyAdvanced                           1
  HKCU        SecureProtocols                           10240
  HKCU        User Agent                                Mozilla/4.0 (compatible; MSIE 8.0; Win32)
  HKCU        ZonesSecurityUpgrade                      System.Byte[]
  HKCU        WarnonZoneCrossing                        1
  HKCU        EnableNegotiate                           1
  HKCU        ProxyEnable                               0
  HKCU        MigrateProxy                              1
  HKLM        ActiveXCache                              C:\Windows\Downloaded Program Files
  HKLM        CodeBaseSearchPath                        CODEBASE
  HKLM        EnablePunycode                            1
  HKLM        MinorVersion                              0
  HKLM        WarnOnIntranet                            1

  Zone Maps
  No URLs configured

  Zone Auth Settings
  No Zone Auth Settings
ÉÍÍÍÍÍÍÍÍÍÍ¹ Internet Connectivity
È Checking if internet access is possible via different methods
    HTTP (80) Access: Accessible
    HTTPS (443) Access: Accessible
    HTTPS (443) Access by Domain Name: Accessible
    DNS (53) Access: Accessible
    ICMP (ping) Access: Accessible
ÉÍÍÍÍÍÍÍÍÍÍ¹ Hostname Resolution
È Checking if the hostname can be resolved externally
    External Check Result:
{
    "hostname": "Deckhand-01",
    "source_ip": "129.21.249.241",
    "checks": {
        "IP in AbuseIPDB": {
            "rate_limited": true,
            "status": 429
        },
        "Hostname in Pastes": {
            "totalResults": "0",
            "matches": []
        },
        "Hostname in VirusTotal": {


_raw:
    RegPath: HKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32
    RegPerms: Administrators [Allow: FullControl GenericAll]
    Key: wave
    Folder: None (PATH Injection)
    File: wdmaud.drv
   =================================================================================================
    RegPath: HKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32
    RegPerms: Administrators [Allow: FullControl GenericAll]
    Key: wavemapper
    Folder: None (PATH Injection)
    File: msacm32.drv
   =================================================================================================
    RegPath: HKLM\Software\Classes\htmlfile\shell\open\command
    RegPerms: Administrators [Allow: FullControl GenericAll]
    Folder: C:\Program Files\Internet Explorer
    FolderPerms: Administrators [Allow: WriteData/CreateFiles]
    File: C:\Program Files\Internet Explorer\iexplore.exe %1 (Unquoted and Space detected) - C:\,C:\Program Files,C:\Program Files\Internet Explorer\iexplore.exe
   =================================================================================================
    RegPath: HKLM\System\CurrentControlSet\Control\Session Manager\KnownDlls
    Key: *kernel32
    Folder: None (PATH Injection)
    File: kernel32.dll
   =================================================================================================
    RegPath: HKLM\System\CurrentControlSet\Control\Session Manager\KnownDlls
    Key: _wow64cpu
    Folder: None (PATH Injection)
    File: wow64cpu.dll
   =================================================================================================
    RegPath: HKLM\System\CurrentControlSet\Control\Session Manager\KnownDlls
    Key: _wowarmhw
    Folder: None (PATH Injection)
    File: wowarmhw.dll
   =================================================================================================
    RegPath: HKLM\System\CurrentControlSet\Control\Session Manager\KnownDlls
    Key: _xtajit
    Folder: None (PATH Injection)
    File: xtajit.dll
   =================================================================================================
    RegPath: HKLM\System\CurrentControlSet\Control\Session Manager\KnownDlls
    Key: _xtajit64
    Folder: None (PATH Injection)
    File: xtajit64.dll
   =================================================================================================
    RegPath: HKLM\System\CurrentControlSet\Control\Session Manager\KnownDlls
    Key: advapi32
    Folder: None (PATH Injection)
    File: advapi32.dll
   =================================================================================================
    RegPath: HKLM\System\CurrentControlSet\Control\Session Manager\KnownDlls
    Key: clbcatq
    Folder: None (PATH Injection)
    File: clbcatq.dll
   =================================================================================================
    RegPath: HKLM\System\CurrentControlSet\Control\Session Manager\KnownDlls
    Key: combase
    Folder: None (PATH Injection)
    File: combase.dll
   =================================================================================================
    RegPath: HKLM\System\CurrentControlSet\Control\Session Manager\KnownDlls
    Key: COMDLG32
    Folder: None (PATH Injection)
    File: COMDLG32.dll
   =================================================================================================
    RegPath: HKLM\System\CurrentControlSet\Control\Session Manager\KnownDlls
    Key: coml2
    Folder: None (PATH Injection)
    File: coml2.dll
   =================================================================================================
    RegPath: HKLM\System\CurrentControlSet\Control\Session Manager\KnownDlls
    Key: DifxApi
    Folder: None (PATH Injection)
    File: difxapi.dll
   =================================================================================================
    RegPath: HKLM\System\CurrentControlSet\Control\Session Manager\KnownDlls
    Key: gdi32
    Folder: None (PATH Injection)
    File: gdi32.dll
   =================================================================================================
    RegPath: HKLM\System\CurrentControlSet\Control\Session Manager\KnownDlls
    Key: gdiplus
    Folder: None (PATH Injection)
    File: gdiplus.dll
   =================================================================================================
    RegPath: HKLM\System\CurrentControlSet\Control\Session Manager\KnownDlls
    Key: IMAGEHLP
    Folder: None (PATH Injection)
    File: IMAGEHLP.dll
   =================================================================================================
    RegPath: HKLM\System\CurrentControlSet\Control\Session Manager\KnownDlls
    Key: IMM32
    Folder: None (PATH Injection)
    File: IMM32.dll
   =================================================================================================
    RegPath: HKLM\System\CurrentControlSet\Control\Session Manager\KnownDlls
    Key: MSCTF
    Folder: None (PATH Injection)
    File: MSCTF.dll
   =================================================================================================
    RegPath: HKLM\System\CurrentControlSet\Control\Session Manager\KnownDlls
    Key: MSVCRT
    Folder: None (PATH Injection)
    File: MSVCRT.dll
   =================================================================================================
    RegPath: HKLM\System\CurrentControlSet\Control\Session Manager\KnownDlls
    Key: NORMALIZ
    Folder: None (PATH Injection)
    File: NORMALIZ.dll
   =================================================================================================
    RegPath: HKLM\System\CurrentControlSet\Control\Session Manager\KnownDlls
    Key: NSI
    Folder: None (PATH Injection)
    File: NSI.dll
   =================================================================================================
    RegPath: HKLM\System\CurrentControlSet\Control\Session Manager\KnownDlls
    Key: ole32
    Folder: None (PATH Injection)
    File: ole32.dll
   =================================================================================================
    RegPath: HKLM\System\CurrentControlSet\Control\Session Manager\KnownDlls
    Key: OLEAUT32
    Folder: None (PATH Injection)
    File: OLEAUT32.dll
   =================================================================================================
    RegPath: HKLM\System\CurrentControlSet\Control\Session Manager\KnownDlls
    Key: PSAPI
    Folder: None (PATH Injection)
    File: PSAPI.DLL
   =================================================================================================
    RegPath: HKLM\System\CurrentControlSet\Control\Session Manager\KnownDlls
    Key: rpcrt4
    Folder: None (PATH Injection)
    File: rpcrt4.dll
   =================================================================================================
    RegPath: HKLM\System\CurrentControlSet\Control\Session Manager\KnownDlls
    Key: sechost
    Folder: None (PATH Injection)
    File: sechost.dll
   =================================================================================================
    RegPath: HKLM\System\CurrentControlSet\Control\Session Manager\KnownDlls
    Key: Setupapi
    Folder: None (PATH Injection)
    File: Setupapi.dll
   =================================================================================================
    RegPath: HKLM\System\CurrentControlSet\Control\Session Manager\KnownDlls
    Key: SHCORE
    Folder: None (PATH Injection)
    File: SHCORE.dll
   =================================================================================================
    RegPath: HKLM\System\CurrentControlSet\Control\Session Manager\KnownDlls
    Key: SHELL32
    Folder: None (PATH Injection)
    File: SHELL32.dll
   =================================================================================================
    RegPath: HKLM\System\CurrentControlSet\Control\Session Manager\KnownDlls
    Key: SHLWAPI
    Folder: None (PATH Injection)
    File: SHLWAPI.dll
   =================================================================================================
    RegPath: HKLM\System\CurrentControlSet\Control\Session Manager\KnownDlls
    Key: user32
    Folder: None (PATH Injection)
    File: user32.dll
   =================================================================================================
    RegPath: HKLM\System\CurrentControlSet\Control\Session Manager\KnownDlls
    Key: WLDAP32
    Folder: None (PATH Injection)
    File: WLDAP32.dll
   =================================================================================================
    RegPath: HKLM\System\CurrentControlSet\Control\Session Manager\KnownDlls
    Key: wow64
    Folder: None (PATH Injection)
    File: wow64.dll
   =================================================================================================
    RegPath: HKLM\System\CurrentControlSet\Control\Session Manager\KnownDlls
    Key: wow64base
    Folder: None (PATH Injection)
    File: wow64base.dll
   =================================================================================================
    RegPath: HKLM\System\CurrentControlSet\Control\Session Manager\KnownDlls
    Key: wow64con
    Folder: None (PATH Injection)
    File: wow64con.dll
   =================================================================================================
    RegPath: HKLM\System\CurrentControlSet\Control\Session Manager\KnownDlls
    Key: wow64win
    Folder: None (PATH Injection)
    File: wow64win.dll
   =================================================================================================
    RegPath: HKLM\System\CurrentControlSet\Control\Session Manager\KnownDlls
    Key: WS2_32
    Folder: None (PATH Injection)
    File: WS2_32.dll
   =================================================================================================
    RegPath: HKLM\Software\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}
    RegPerms: Administrators [Allow: FullControl]
    Key: StubPath
    Folder: \
    FolderPerms: Administrators [Allow: AllAccess], Users [Allow: AppendData/CreateDirectories]
    File: /UserInstall
   =================================================================================================
    RegPath: HKLM\Software\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}
    RegPerms: Administrators [Allow: FullControl]
    Key: StubPath
    Folder: C:\windows\system32
    FolderPerms: Administrators [Allow: WriteData/CreateFiles]
    File: C:\windows\system32\unregmp2.exe /FirstLogon
   =================================================================================================
    RegPath: HKLM\Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4340}
    RegPerms: Administrators [Allow: FullControl]
    Key: StubPath
    Folder: None (PATH Injection)
    File: U
   =================================================================================================
    RegPath: HKLM\Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}
    RegPerms: Administrators [Allow: FullControl]
    Key: StubPath
    Folder: C:\Windows\System32
    FolderPerms: Administrators [Allow: WriteData/CreateFiles]
    File: C:\Windows\System32\ie4uinit.exe -UserConfig
   =================================================================================================
    RegPath: HKLM\Software\Microsoft\Active Setup\Installed Components\{89B4C1CD-B018-4511-B0A1-5476DBF70820}
    RegPerms: Administrators [Allow: FullControl]
    Key: StubPath
    Folder: C:\Windows\System32
    FolderPerms: Administrators [Allow: WriteData/CreateFiles]
    File: C:\Windows\System32\Rundll32.exe C:\Windows\System32\mscories.dll,Install
   =================================================================================================
    RegPath: HKLM\Software\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}
    RegPerms: Administrators [Allow: FullControl]
    Key: StubPath
    Folder: C:\Program Files\Google\Chrome\Application\141.0.7390.108\Installer
    FolderPerms: Administrators [Allow: AllAccess]
    File: C:\Program Files\Google\Chrome\Application\141.0.7390.108\Installer\chrmstp.exe --configure-user-settings --verbose-logging --system-level --channel=stable (Unquoted and Space detected) - C:\
   =================================================================================================
    RegPath: HKLM\Software\Microsoft\Active Setup\Installed Components\{9459C573-B17A-45AE-9F64-1857B5D58CEE}
    RegPerms: Administrators [Allow: FullControl]
    Key: StubPath
    Folder: C:\Program Files (x86)\Microsoft\Edge\Application\141.0.3537.85\Installer
    FolderPerms: Administrators [Allow: AllAccess]
    File: C:\Program Files (x86)\Microsoft\Edge\Application\141.0.3537.85\Installer\setup.exe --configure-user-settings --verbose-logging --system-level --msedge --channel=stable (Unquoted and Space detected) - C:\,C:\Program Files
   =================================================================================================
    RegPath: HKLM\Software\Microsoft\Active Setup\Installed Components\{A509B1A7-37EF-4b3f-8CFC-4F3A74704073}
    RegPerms: Administrators [Allow: FullControl]
    Key: StubPath
    Folder: C:\Windows\System32
    FolderPerms: Administrators [Allow: WriteData/CreateFiles]
    File: C:\Windows\System32\rundll32.exe C:\Windows\System32\iesetup.dll,IEHardenAdmin
   =================================================================================================
    RegPath: HKLM\Software\Microsoft\Active Setup\Installed Components\{A509B1A8-37EF-4b3f-8CFC-4F3A74704073}
    RegPerms: Administrators [Allow: FullControl]
    Key: StubPath
    Folder: C:\Windows\System32
    FolderPerms: Administrators [Allow: WriteData/CreateFiles]
    File: C:\Windows\System32\rundll32.exe C:\Windows\System32\iesetup.dll,IEHardenUser
   =================================================================================================
    RegPath: HKLM\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}
    RegPerms: Administrators [Allow: FullControl]


_raw:
    FolderPerms: Administrators [Allow: AllAccess] (Unquoted and Space detected) - C:\ProgramData\Microsoft\Windows,C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
   =================================================================================================
    RegPath: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
    RegPerms: Administrators [Allow: FullControl GenericAll]
    Key: Userinit
    Folder: C:\windows\system32
    FolderPerms: Administrators [Allow: WriteData/CreateFiles]
    File: C:\windows\system32\userinit.exe,
   =================================================================================================
    RegPath: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
    RegPerms: Administrators [Allow: FullControl GenericAll]
    Key: Shell
    Folder: None (PATH Injection)
    File: explorer.exe
   =================================================================================================
    RegPath: HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot
    RegPerms: Administrators [Allow: FullControl]
    Key: AlternateShell
    Folder: None (PATH Injection)
    File: cmd.exe
   =================================================================================================
    RegPath: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Font Drivers
    RegPerms: Administrators [Allow: FullControl GenericAll]
    Key: Adobe Type Manager
    Folder: None (PATH Injection)
    File: atmfd.dll
   =================================================================================================
    RegPath: HKLM\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Font Drivers
    RegPerms: Administrators [Allow: FullControl GenericAll]
    Key: Adobe Type Manager
    Folder: None (PATH Injection)
    File: atmfd.dll
   =================================================================================================
    RegPath: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Drivers32
    RegPerms: Administrators [Allow: FullControl GenericAll]
    Key: aux
    Folder: None (PATH Injection)
    File: wdmaud.drv
   =================================================================================================
    RegPath: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Drivers32
    RegPerms: Administrators [Allow: FullControl GenericAll]
    Key: midi
    Folder: None (PATH Injection)
    File: wdmaud.drv
   =================================================================================================
    RegPath: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Drivers32
    RegPerms: Administrators [Allow: FullControl GenericAll]
    Key: midimapper
    Folder: None (PATH Injection)
    File: midimap.dll
   =================================================================================================
    RegPath: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Drivers32
    RegPerms: Administrators [Allow: FullControl GenericAll]
    Key: mixer
    Folder: None (PATH Injection)
    File: wdmaud.drv
   =================================================================================================
    RegPath: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Drivers32
    RegPerms: Administrators [Allow: FullControl GenericAll]
    Key: msacm.imaadpcm
    Folder: None (PATH Injection)
    File: imaadp32.acm
   =================================================================================================
    RegPath: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Drivers32
    RegPerms: Administrators [Allow: FullControl GenericAll]
    Key: msacm.l3acm
    Folder: C:\Windows\System32
    FolderPerms: Administrators [Allow: WriteData/CreateFiles]
    File: C:\Windows\System32\l3codeca.acm
   =================================================================================================
    RegPath: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Drivers32
    RegPerms: Administrators [Allow: FullControl GenericAll]
    Key: msacm.msadpcm
    Folder: None (PATH Injection)
    File: msadp32.acm
   =================================================================================================
    RegPath: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Drivers32
    RegPerms: Administrators [Allow: FullControl GenericAll]
    Key: msacm.msg711
    Folder: None (PATH Injection)
    File: msg711.acm
   =================================================================================================
    RegPath: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Drivers32
    RegPerms: Administrators [Allow: FullControl GenericAll]
    Key: msacm.msgsm610
    Folder: None (PATH Injection)
    File: msgsm32.acm
   =================================================================================================
    RegPath: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Drivers32
    RegPerms: Administrators [Allow: FullControl GenericAll]
    Key: vidc.i420
    Folder: None (PATH Injection)
    File: iyuv_32.dll
   =================================================================================================
    RegPath: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Drivers32
    RegPerms: Administrators [Allow: FullControl GenericAll]
    Key: vidc.iyuv
    Folder: None (PATH Injection)
    File: iyuv_32.dll
   =================================================================================================
    RegPath: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Drivers32
    RegPerms: Administrators [Allow: FullControl GenericAll]
    Key: vidc.mrle
    Folder: None (PATH Injection)
    File: msrle32.dll
   =================================================================================================
    RegPath: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Drivers32
    RegPerms: Administrators [Allow: FullControl GenericAll]
    Key: vidc.msvc
    Folder: None (PATH Injection)
    File: msvidc32.dll
   =================================================================================================
    RegPath: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Drivers32
    RegPerms: Administrators [Allow: FullControl GenericAll]
    Key: vidc.uyvy
    Folder: None (PATH Injection)
    File: msyuv.dll
   =================================================================================================
    RegPath: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Drivers32
    RegPerms: Administrators [Allow: FullControl GenericAll]
    Key: vidc.yuy2
    Folder: None (PATH Injection)
    File: msyuv.dll
   =================================================================================================
    RegPath: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Drivers32
    RegPerms: Administrators [Allow: FullControl GenericAll]
    Key: vidc.yvu9
    Folder: None (PATH Injection)
    File: tsbyuv.dll
   =================================================================================================
    RegPath: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Drivers32
    RegPerms: Administrators [Allow: FullControl GenericAll]
    Key: vidc.yvyu
    Folder: None (PATH Injection)
    File: msyuv.dll
   =================================================================================================
    RegPath: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Drivers32
    RegPerms: Administrators [Allow: FullControl GenericAll]
    Key: wave
    Folder: None (PATH Injection)
    File: wdmaud.drv
   =================================================================================================
    RegPath: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Drivers32
    RegPerms: Administrators [Allow: FullControl GenericAll]
    Key: wavemapper
    Folder: None (PATH Injection)
    File: msacm32.drv
   =================================================================================================
    RegPath: HKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32
    RegPerms: Administrators [Allow: FullControl GenericAll]
    Key: aux
    Folder: None (PATH Injection)
    File: wdmaud.drv
   =================================================================================================
    RegPath: HKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32
    RegPerms: Administrators [Allow: FullControl GenericAll]
    Key: midi
    Folder: None (PATH Injection)
    File: wdmaud.drv
   =================================================================================================
    RegPath: HKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32
    RegPerms: Administrators [Allow: FullControl GenericAll]
    Key: midimapper
    Folder: None (PATH Injection)
    File: midimap.dll
   =================================================================================================
    RegPath: HKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32
    RegPerms: Administrators [Allow: FullControl GenericAll]
    Key: mixer
    Folder: None (PATH Injection)
    File: wdmaud.drv
   =================================================================================================
    RegPath: HKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32
    RegPerms: Administrators [Allow: FullControl GenericAll]
    Key: msacm.imaadpcm
    Folder: None (PATH Injection)
    File: imaadp32.acm
   =================================================================================================
    RegPath: HKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32
    RegPerms: Administrators [Allow: FullControl GenericAll]
    Key: msacm.l3acm
    Folder: C:\Windows\SysWOW64
    FolderPerms: Administrators [Allow: WriteData/CreateFiles]
    File: C:\Windows\SysWOW64\l3codeca.acm
   =================================================================================================
    RegPath: HKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32
    RegPerms: Administrators [Allow: FullControl GenericAll]
    Key: msacm.msadpcm
    Folder: None (PATH Injection)
    File: msadp32.acm
   =================================================================================================
    RegPath: HKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32
    RegPerms: Administrators [Allow: FullControl GenericAll]
    Key: msacm.msg711
    Folder: None (PATH Injection)
    File: msg711.acm
   =================================================================================================
    RegPath: HKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32
    RegPerms: Administrators [Allow: FullControl GenericAll]
    Key: msacm.msgsm610
    Folder: None (PATH Injection)
    File: msgsm32.acm
   =================================================================================================
    RegPath: HKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32
    RegPerms: Administrators [Allow: FullControl GenericAll]
    Key: vidc.cvid
    Folder: None (PATH Injection)
    File: iccvid.dll
   =================================================================================================
    RegPath: HKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32
    RegPerms: Administrators [Allow: FullControl GenericAll]
    Key: vidc.i420
    Folder: None (PATH Injection)
    File: iyuv_32.dll
   =================================================================================================
    RegPath: HKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32
    RegPerms: Administrators [Allow: FullControl GenericAll]
    Key: vidc.iyuv
    Folder: None (PATH Injection)
    File: iyuv_32.dll
   =================================================================================================
    RegPath: HKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32
    RegPerms: Administrators [Allow: FullControl GenericAll]
    Key: vidc.mrle
    Folder: None (PATH Injection)
    File: msrle32.dll
   =================================================================================================
    RegPath: HKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32
    RegPerms: Administrators [Allow: FullControl GenericAll]
    Key: vidc.msvc
    Folder: None (PATH Injection)
    File: msvidc32.dll
   =================================================================================================
    RegPath: HKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32
    RegPerms: Administrators [Allow: FullControl GenericAll]
    Key: vidc.uyvy
    Folder: None (PATH Injection)
    File: msyuv.dll
   =================================================================================================
    RegPath: HKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32
    RegPerms: Administrators [Allow: FullControl GenericAll]
    Key: vidc.yuy2
    Folder: None (PATH Injection)
    File: msyuv.dll
   =================================================================================================
    RegPath: HKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32
    RegPerms: Administrators [Allow: FullControl GenericAll]
    Key: vidc.yvu9
    Folder: None (PATH Injection)
    File: tsbyuv.dll
   =================================================================================================
    RegPath: HKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32
    RegPerms: Administrators [Allow: FullControl GenericAll]
    Key: vidc.yvyu
    Folder: None (PATH Injection)
    File: msyuv.dll
   =================================================================================================


_raw:
    HKLM\system\currentcontrolset\services\SerCx2 (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\Serenum (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\Serial (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\sermouse (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\SessionEnv (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\sfloppy (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\SgrmAgent (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\SgrmBroker (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\SharedAccess (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\ShellHWDetection (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\shpamsvc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\SiSRaid2 (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\SiSRaid4 (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\SmartSAMD (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\smbdirect (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\smphost (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\SMSvcHost 4.0.0.0 (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\SNMPTRAP (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\spaceparser (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\spaceport (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\SpbCx (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\splknetdrv (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\splunkdrv (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\SplunkForwarder (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\SplunkMonitorNoHandle (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\Spooler (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\sppsvc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\srv2 (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\srvnet (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\SSDPSRV (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\ssh-agent (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\SstpSvc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\StateRepository (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\stexstor (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\StiSvc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\storahci (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\storflt (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\stornvme (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\storqosflt (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\StorSvc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\storufs (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\storvsc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\svsvc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\swenum (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\swprv (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\SysMain (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\Sysmon64 (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\SysmonDrv (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\SystemEventsBroker (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\TabletInputService (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\tapisrv (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\Tcpip (Administrators [Allow: FullControl])
    HKLM\system\currentcontrolset\services\Tcpip6 (Administrators [Allow: FullControl])
    HKLM\system\currentcontrolset\services\TCPIP6TUNNEL (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\tcpipreg (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\TCPIPTUNNEL (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\tdx (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\terminpt (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\TermService (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\Themes (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\TieringEngineService (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\TimeBrokerSvc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\TokenBroker (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\TPM (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\TSDDD (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\TsUsbFlt (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\TsUsbGD (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\tsusbhub (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\tunnel (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\tzautoupdate (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\UALSVC (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\UASPStor (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\UcmCx0101 (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\UcmTcpciCx0101 (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\UcmUcsiAcpiClient (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\UcmUcsiCx0101 (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\Ucx01000 (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\UdeCx (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\udfs (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\UdkUserSvc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\UdkUserSvc_6085e53 (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\UEFI (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\UevAgentDriver (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\UevAgentService (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\Ufx01000 (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\UfxChipidea (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\ufxsynopsys (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\UGatherer (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\UGTHRSVC (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\umbus (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\UmPass (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\UmRdpService (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\UnistoreSvc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\UnistoreSvc_6085e53 (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\upnphost (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\UrsChipidea (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\UrsCx01000 (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\UrsSynopsys (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\Usb4DeviceRouter (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\Usb4HostRouter (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\usbaudio (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\usbaudio2 (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\usbccgp (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\usbehci (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\usbhub (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\USBHUB3 (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\usbohci (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\usbprint (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\usbser (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\USBSTOR (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\usbuhci (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\USBXHCI (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\UserDataSvc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\UserDataSvc_6085e53 (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\UserManager (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\UsoSvc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\VaultSvc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\vdrvroot (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\vds (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\VerifierExt (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\vhdmp (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\vhf (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\viohidkmdf (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\vioscsi (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\viostor (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\VirtioInput (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\VirtioSerial (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\VirtRng (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\VirtualRender (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\vmbus (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\VMBusHID (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\vmgid (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\vmicguestinterface (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\vmicheartbeat (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\vmickvpexchange (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\vmicrdv (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\vmicshutdown (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\vmictimesync (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\vmicvmsession (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\vmicvss (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\volmgr (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\volmgrx (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\volsnap (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\volume (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\vpci (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\vsmraid (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\VSS (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\VSTXRAID (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\vwifibus (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\W32Time (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\WaaSMedicSvc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\WacomPen (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\WalletService (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\wanarp (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\wanarpv6 (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\WarpJITSvc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\WbioSrvc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\wcifs (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\Wcmsvc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\WdBoot (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\Wdf01000 (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\WdFilter (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\WdmCompanionFilter (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\WdNisDrv (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\WdNisSvc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\Wecsvc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\WEPHOSTSVC (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\wercplsupport (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\WerSvc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\WFPLWFS (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\WiaRpc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\WIMMount (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\WinDefend (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\Windows Workflow Foundation 4.0.0.0 (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\WindowsTrustedRT (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\WindowsTrustedRTProxy (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\WinHttpAutoProxySvc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\WinMad (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\Winmgmt (Administrators [Allow: GenericAll FullControl])
    HKLM\system\currentcontrolset\services\WinNat (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\WinRM (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\Winsock (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\WinSock2 (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\WINUSB (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\WinVerbs (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\wisvc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\wlidsvc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\WmiAcpi (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\WmiApRpl (Administrators [Allow: GenericAll FullControl])
    HKLM\system\currentcontrolset\services\wmiApSrv (Administrators [Allow: GenericAll FullControl])
    HKLM\system\currentcontrolset\services\WMPNetworkSvc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\Wof (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\workerdd (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\WPDBusEnum (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\WpdUpFltr (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\WpnService (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\WpnUserService (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\WpnUserService_6085e53 (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\ws2ifsl (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\WSearch (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\WSearchIdxPi (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\wuauserv (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\WudfPf (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\WUDFRd (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\xmlprov (Administrators [Allow: FullControl GenericAll])
ÉÍÍÍÍÍÍÍÍÍÍ¹ Checking write permissions in PATH folders (DLL Hijacking)
È Check for DLL Hijacking in PATH folders https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#dll-hijacking
    (DLL Hijacking) C:\windows\system32: Administrators [Allow: WriteData/CreateFiles]
    (DLL Hijacking) C:\windows: Administrators [Allow: WriteData/CreateFiles]
    (DLL Hijacking) C:\windows\System32\Wbem: Administrators [Allow: WriteData/CreateFiles]
    (DLL Hijacking) C:\windows\System32\WindowsPowerShell\v1.0\: Administrators [Allow: WriteData/CreateFiles]
    (DLL Hijacking) C:\windows\System32\OpenSSH\: Administrators [Allow: WriteData/CreateFiles]
    (DLL Hijacking) C:\ProgramData\chocolatey\bin: Administrators [Allow: AllAccess]
ÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ¹ Applications Information ÌÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ
ÉÍÍÍÍÍÍÍÍÍÍ¹ Current Active Window Application
    Select Administrator: Command Prompt - "winPEASx64 (2).exe"
ÉÍÍÍÍÍÍÍÍÍÍ¹ Installed Applications --Via Program Files/Uninstall registry--
È Check if you can modify installed software https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#applications
    C:\Program Files\Cloudbase Solutions(Administrators [Allow: AllAccess])
    C:\Program Files\Common Files(Administrators [Allow: WriteData/CreateFiles])
    C:\Program Files\desktop.ini(Administrators [Allow: AllAccess])
    C:\Program Files\Google(Administrators [Allow: AllAccess])
    C:\Program Files\Internet Explorer(Administrators [Allow: WriteData/CreateFiles])
    C:\Program Files\ModifiableWindowsApps
    C:\Program Files\Mozilla Firefox(Administrators [Allow: AllAccess])
    C:\Program Files\Poseidon Booking(Users [Allow: WriteData/CreateFiles], Administrators [Allow: AllAccess])
    C:\Program Files\Qemu-ga(Administrators [Allow: AllAccess])
    C:\Program Files\SplunkUniversalForwarder(Administrators [Allow: AllAccess])
    C:\Program Files\Uninstall Information(Administrators [Allow: AllAccess])
    C:\Program Files\Windows Defender(Administrators [Allow: WriteData/CreateFiles])
    C:\Program Files\Windows Defender Advanced Threat Protection(Administrators [Allow: WriteData/CreateFiles])
    C:\Program Files\Windows Mail(Administrators [Allow: WriteData/CreateFiles])
    C:\Program Files\Windows Media Player(Administrators [Allow: WriteData/CreateFiles])
    C:\Program Files\Windows NT(Administrators [Allow: WriteData/CreateFiles])
    C:\Program Files\Windows Photo Viewer(Administrators [Allow: WriteData/CreateFiles])
    C:\Program Files\Windows Sidebar(Administrators [Allow: WriteData/CreateFiles])
    C:\Program Files\WindowsApps
    C:\Program Files\WindowsPowerShell(Administrators [Allow: WriteData/CreateFiles])
ÉÍÍÍÍÍÍÍÍÍÍ¹ Autorun Applications
È Check if you can modify other users AutoRuns binaries (Note that is normal that you can modify HKCU registry and binaries indicated there) https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/privilege-escalation-with-autorun-binaries.html
    RegPath: HKLM\Software\Microsoft\Windows\CurrentVersion\Run
    RegPerms: Administrators [Allow: FullControl GenericAll]
    Key: SecurityHealth
    Folder: C:\windows\system32
    FolderPerms: Administrators [Allow: WriteData/CreateFiles]
    File: C:\windows\system32\SecurityHealthSystray.exe
   =================================================================================================
    RegPath: HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
    RegPerms: Administrators [Allow: FullControl GenericAll]
    Key: Common Startup
    Folder: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
    FolderPerms: Administrators [Allow: AllAccess] (Unquoted and Space detected) - C:\ProgramData\Microsoft\Windows,C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
   =================================================================================================
    RegPath: HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
    RegPerms: Administrators [Allow: GenericAll FullControl]
    Key: Common Startup
    Folder: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup