_raw:
    HKLM\system\currentcontrolset\services\FrameServer (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\FrameServerMonitor (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\FsDepends (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\Fs_Rec (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\gencounter (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\genericusbfn (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\GoogleChromeElevationService (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\GoogleUpdaterInternalService142.0.7416.0 (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\GoogleUpdaterService142.0.7416.0 (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\GPIOClx0101 (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\GraphicsPerfSvc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\HdAudAddService (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\HDAudBus (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\HidBatt (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\hidinterrupt (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\hidserv (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\HidUsb (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\HpSAMD (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\HTTP (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\hvcrash (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\HvHost (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\hvservice (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\HwNClx0101 (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\hwpolicy (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\hyperkbd (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\HyperVideo (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\i8042prt (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\iaLPSSi_GPIO (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\iaLPSSi_I2C (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\iaStorAV (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\iaStorAVC (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\iaStorV (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\ibbus (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\IKEEXT (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\IndirectKmd (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\inetaccs (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\InstallService (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\intelide (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\intelpep (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\IntelPMT (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\intelppm (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\iorate (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\IpFilterDriver (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\iphlpsvc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\IPMIDRV (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\IPNAT (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\IPT (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\isapnp (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\iScsiPrt (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\ItSas35i (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\kbdclass (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\kbdhid (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\kdnic (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\KeyIso (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\KPSSVC (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\KSecDD (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\KSecPkg (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\KslD (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\ksthunk (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\KtmRm (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\laforge-agent (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\LanmanServer (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\LanmanWorkstation (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\ldap (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\lfsvc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\LicenseManager (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\lltdio (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\lltdsvc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\lmhosts (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\LSI_SAS (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\LSI_SAS2i (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\LSI_SAS3i (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\LSM (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\luafv (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\MapsBroker (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\mausbhost (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\mausbip (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\McpManagementService (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\MDCoreSvc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\megasas2i (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\megasas35i (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\megasr (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\MicrosoftEdgeElevationService (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\mlx4_bus (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\MMCSS (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\Modem (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\monitor (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\mouclass (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\mouhid (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\mountmgr (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\MozillaMaintenance (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\mpi3drvi (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\mpsdrv (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\mpssvc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\mrxsmb (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\mrxsmb20 (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\MsBridge (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\MSDTC (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\MSDTC Bridge 4.0.0.0 (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\Msfs (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\msgpiowin32 (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\mshidkmdf (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\mshidumdf (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\msisadrv (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\MSiSCSI (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\msiserver (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\MSKSSRV (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\MsLbfoProvider (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\MsLldp (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\MSPCLOCK (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\MSPQM (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\MsQuic (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\MsRPC (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\MsSecFlt (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\mssmbios (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\MSTEE (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\MTConfig (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\Mup (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\mvumis (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\napagent (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\NcaSvc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\NcbService (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\ndfltr (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\NDIS (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\NdisCap (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\NdisImPlatform (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\NdisTapi (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\Ndisuio (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\NdisVirtualBus (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\NdisWan (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\ndiswanlegacy (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\NDKPerf (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\NDKPing (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\ndproxy (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\NetAdapterCx (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\NetBIOS (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\NetbiosSmb (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\NetBT (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\netkvm (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\NETKVMP (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\Netlogon (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\Netman (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\netprofm (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\NetSetupSvc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\NetTcpPortSharing (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\netvsc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\NETVSCVFPP (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\NgcCtnrSvc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\NgcSvc (Administrators [Allow: TakeOwnership FullControl GenericAll])
    HKLM\system\currentcontrolset\services\NlaSvc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\Npfs (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\npsvctrig (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\nsi (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\nsiproxy (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\NTDS (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\Ntfs (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\Null (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\nvdimm (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\nvraid (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\nvstor (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\Parport (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\partmgr (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\PcaSvc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\pci (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\pciide (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\pcmcia (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\pcw (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\pdc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\PEAUTH (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\percsas2i (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\percsas3i (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\PerfDisk (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\PerfHost (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\PerfNet (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\PerfOS (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\PerfProc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\PimIndexMaintenanceSvc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\PimIndexMaintenanceSvc_6085e53 (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\PktMon (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\pla (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\PlugPlay (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\pmem (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\PNPMEM (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\PolicyAgent (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\portcfg (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\PortProxy (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\PoseidonBooking (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\Power (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\PptpMiniport (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\PrintNotify (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\PrintWorkflowUserSvc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\PrintWorkflowUserSvc_6085e53 (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\PRM (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\Processor (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\ProfSvc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\Psched (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\PushToInstall (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\PVPanic (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\pvscsi (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\qebdrv (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\qefcoe (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\QEMU Guest Agent VSS Provider (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\QEMU-GA (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\qeois (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\ql2300i (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\ql40xx2i (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\qlfcoei (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\QWAVE (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\QWAVEdrv (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\Ramdisk (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\RasAcd (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\RasAgileVpn (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\RasAuto (Administrators [Allow: GenericAll FullControl])
    HKLM\system\currentcontrolset\services\RasGre (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\Rasl2tp (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\RasMan (Administrators [Allow: GenericAll FullControl])
    HKLM\system\currentcontrolset\services\RasPppoe (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\RasSstp (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\rdbss (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\RDMANDK (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\rdpbus (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\RDPDR (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\RDPNP (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\RDPUDD (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\RdpVideoMiniport (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\ReFS (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\ReFSv1 (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\RemoteAccess (Administrators [Allow: GenericAll FullControl])
    HKLM\system\currentcontrolset\services\RemoteRegistry (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\RFCOMM (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\rhproxy (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\RmSvc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\RpcEptMapper (Administrators [Allow: TakeOwnership FullControl GenericAll])
    HKLM\system\currentcontrolset\services\RpcLocator (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\RSoPProv (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\rspndr (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\s3cap (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\sacdrv (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\sacsvr (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\sbp2port (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\SCardSvr (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\ScDeviceEnum (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\scfilter (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\Schedule (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\scmbus (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\SCPolicySvc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\sdbus (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\SDFRd (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\sdstor (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\seclogon (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\SEMgrSvc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\SENS (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\Sense (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\SensorDataService (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\SensorService (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\SensrSvc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\SerCx (Administrators [Allow: FullControl GenericAll])


_raw:
    Sense: Start, ChangeConfig
    SensorDataService: AllAccess
    SensorService: Start, AllAccess
    SensrSvc: Start, AllAccess
    SessionEnv: AllAccess
    SgrmBroker: AllAccess
    SharedAccess: AllAccess
    ShellHWDetection: AllAccess
    shpamsvc: AllAccess
    smphost: Start, AllAccess
    SNMPTRAP: AllAccess
    Spooler: AllAccess
    sppsvc: Start, WriteDac
    SSDPSRV: Start, AllAccess
    ssh-agent: Start, AllAccess
    SstpSvc: Start, AllAccess
    StateRepository: Start, GenericExecute (Start/Stop)
    StiSvc: AllAccess
    StorSvc: AllAccess
    svsvc: AllAccess
    swprv: AllAccess
    SysMain: AllAccess
    SystemEventsBroker: WriteDac, Start
    TabletInputService: Start, AllAccess
    tapisrv: Start, AllAccess
    TermService: AllAccess
    Themes: AllAccess
    TieringEngineService: AllAccess
    TimeBrokerSvc: WriteDac, Start
    TokenBroker: AllAccess
    TrkWks: AllAccess
    TrustedInstaller: ChangeConfig
    tzautoupdate: AllAccess
    UALSVC: AllAccess
    UevAgentService: Start, AllAccess
    UmRdpService: AllAccess
    upnphost: Start, AllAccess
    UserManager: AllAccess
    UsoSvc: Start, AllAccess
    VaultSvc: Start, AllAccess
    vds: AllAccess
    vmicguestinterface: AllAccess
    vmicheartbeat: AllAccess
    vmickvpexchange: AllAccess
    vmicshutdown: AllAccess
    vmictimesync: AllAccess
    vmicvmsession: AllAccess
    vmicvss: AllAccess
    VSS: AllAccess
    W32Time: AllAccess
    WaaSMedicSvc: Start, AllAccess
    WalletService: AllAccess
    WarpJITSvc: AllAccess
    WbioSrvc: Start, AllAccess
    Wcmsvc: AllAccess
    WdiServiceHost: ChangeConfig
    WdiSystemHost: ChangeConfig
    Wecsvc: AllAccess
    WEPHOSTSVC: AllAccess
    wercplsupport: AllAccess
    WerSvc: AllAccess
    WiaRpc: AllAccess
    Winmgmt: AllAccess
    WinRM: AllAccess
    wisvc: AllAccess
    wlidsvc: Start, AllAccess
    wmiApSrv: AllAccess
    WMPNetworkSvc: Start, AllAccess
    WPDBusEnum: AllAccess
    WpnService: AllAccess
    WSearch: AllAccess
    wuauserv: Start, AllAccess
    GoogleUpdaterInternalService142.0.7416.0: AllAccess
    GoogleUpdaterService142.0.7416.0: AllAccess
    GoogleChromeElevationService: AllAccess
    MozillaMaintenance: Start, AllAccess
    SplunkForwarder: AllAccess
    Sysmon64: AllAccess
    CaptureService_6085e53: AllAccess
    cbdhsvc_6085e53: AllAccess
    CDPUserSvc_6085e53: AllAccess
    ConsentUxUserSvc_6085e53: GenericExecute (Start/Stop), AllAccess
    CredentialEnrollmentManagerUserSvc_6085e53: GenericExecute (Start/Stop)
    DeviceAssociationBrokerSvc_6085e53: GenericExecute (Start/Stop)
    DevicePickerUserSvc_6085e53: GenericExecute (Start/Stop), AllAccess
    DevicesFlowUserSvc_6085e53: GenericExecute (Start/Stop), AllAccess
    PimIndexMaintenanceSvc_6085e53: GenericExecute (Start/Stop), AllAccess
    PrintWorkflowUserSvc_6085e53: GenericExecute (Start/Stop)
    UdkUserSvc_6085e53: GenericExecute (Start/Stop), AllAccess
    UnistoreSvc_6085e53: GenericExecute (Start/Stop), AllAccess
    UserDataSvc_6085e53: GenericExecute (Start/Stop), AllAccess
    WpnUserService_6085e53: GenericExecute (Start/Stop), AllAccess
ÉÍÍÍÍÍÍÍÍÍÍ¹ Looking if you can modify any service registry
È Check if you can modify the registry of a service https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#services-registry-modify-permissions
    HKLM\system\currentcontrolset\services\.NET CLR Data (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\.NET CLR Networking (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\.NET CLR Networking 4.0.0.0 (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\.NET Data Provider for Oracle (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\.NET Data Provider for SqlServer (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\.NET Memory Cache 4.0 (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\.NETFramework (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\1394ohci (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\3ware (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\ACPI (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\AcpiDev (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\acpiex (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\acpipagr (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\AcpiPmi (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\acpitime (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\Acx01000 (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\ADOVMPPackage (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\ADP80XX (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\adsi (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\AFD (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\afunix (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\ahcache (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\AJRouter (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\ALG (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\AmdK8 (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\AmdPPM (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\amdsata (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\amdsbs (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\amdxata (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\AppID (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\AppIDSvc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\Appinfo (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\applockerfltr (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\AppMgmt (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\AppReadiness (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\AppVClient (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\AppvStrm (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\AppvVemgr (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\AppvVfs (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\AppXSvc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\arcsas (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\AsyncMac (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\atapi (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\AudioEndpointBuilder (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\Audiosrv (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\AxInstSV (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\b06bdrv (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\BALLOON (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\bam (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\BasicDisplay (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\BasicRender (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\BattC (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\Beep (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\bfadfcoei (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\bfadi (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\BFE (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\bindflt (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\BITS (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\bowser (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\BrokerInfrastructure (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\BthEnum (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\BthLEEnum (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\BthMini (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\BTHPORT (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\bthserv (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\BTHUSB (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\bttflt (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\buttonconverter (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\bxfcoe (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\bxois (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\camsvc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\CaptureService (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\CaptureService_6085e53 (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\cbdhsvc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\cbdhsvc_6085e53 (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\cdfs (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\CDPSvc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\CDPUserSvc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\CDPUserSvc_6085e53 (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\cdrom (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\CertPropSvc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\cht4iscsi (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\cht4vbd (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\CimFS (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\CldFlt (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\CLFS (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\ClipSVC (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\cloudbase-init (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\clr_optimization_v4.0.30319_32 (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\clr_optimization_v4.0.30319_64 (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\CmBatt (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\CNG (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\cnghwassist (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\CompositeBus (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\COMSysApp (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\condrv (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\ConsentUxUserSvc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\ConsentUxUserSvc_6085e53 (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\CoreMessagingRegistrar (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\CoreUI (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\CredentialEnrollmentManagerUserSvc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\CredentialEnrollmentManagerUserSvc_6085e53 (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\crypt32 (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\CryptSvc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\CSC (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\CscService (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\dam (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\DCLocator (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\defragsvc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\DeviceAssociationBrokerSvc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\DeviceAssociationBrokerSvc_6085e53 (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\DeviceAssociationService (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\DeviceInstall (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\DevicePickerUserSvc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\DevicePickerUserSvc_6085e53 (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\DevicesFlowUserSvc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\DevicesFlowUserSvc_6085e53 (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\DevQueryBroker (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\Dfsc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\Dhcp (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\diagnosticshub.standardcollector.service (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\DiagTrack (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\disk (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\DispBrokerDesktopSvc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\DmEnrollmentSvc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\dmvsc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\dmwappushservice (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\Dnscache (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\DoSvc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\dot3svc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\drmkaud (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\DsmSvc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\DsSvc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\DXGKrnl (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\EapHost (Administrators [Allow: WriteKey FullControl GenericAll])
    HKLM\system\currentcontrolset\services\ebdrv (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\ebdrv0 (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\edgeupdate (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\edgeupdatem (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\EFS (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\EhStorClass (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\EhStorTcgDrv (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\elxfcoe (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\elxstor (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\embeddedmode (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\EntAppSvc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\ErrDev (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\ESENT (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\EventLog (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\EventSystem (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\ExecutionContext (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\exfat (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\fastfat (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\fcvsc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\fdc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\fdPHost (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\FDResPub (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\FileCrypt (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\FileInfo (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\Filetrace (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\flpydisk (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\FltMgr (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\FontCache (Administrators [Allow: FullControl GenericAll])


_raw:
    File Owner: BUILTIN\Administrators
   =================================================================================================
    Handle: 896(file)
    Handle Owner: Pid is 7888(chrome) with owner: rdavis
    Reason: WriteData/CreateFiles
    File Path: \Users\rdavis\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Session Storage\000003.log
    File Owner: BUILTIN\Administrators
   =================================================================================================
    Handle: 812(file)
    Handle Owner: Pid is 5756(chrome) with owner: rdavis
    Reason: WriteData/CreateFiles
    File Path: \Users\rdavis\AppData\Local\Temp\2\95170124-a79e-43f3-a633-ad190d50f2e9.tmp
    File Owner: BUILTIN\Administrators
   =================================================================================================
    Handle: 796(file)
    Handle Owner: Pid is 8036(chrome) with owner: rdavis
    Reason: WriteData/CreateFiles
    File Path: \Users\rdavis\AppData\Local\Temp\2\80601f8a-1c4c-4e21-b46a-3aa98864d39e.tmp
    File Owner: BUILTIN\Administrators
   =================================================================================================
    Handle: 804(file)
    Handle Owner: Pid is 2664(chrome) with owner: rdavis
    Reason: WriteData/CreateFiles
    File Path: \Users\rdavis\AppData\Local\Temp\2\b730d37e-d261-4647-b62b-8f9ad263438d.tmp
    File Owner: BUILTIN\Administrators
   =================================================================================================
    Handle: 92(file)
    Handle Owner: Pid is 7244(winPEASx64 (2)) with owner: rdavis
    Reason: WriteData/CreateFiles
    File Path: \Users\rdavis\Desktop\output.txt
    File Owner: BUILTIN\Administrators
   =================================================================================================
    Handle: 716(file)
    Handle Owner: Pid is 7244(winPEASx64 (2)) with owner: rdavis
    Reason: WriteData/CreateFiles
    File Path: \Users\rdavis\Desktop\output.txt
    File Owner: BUILTIN\Administrators
   =================================================================================================
    Handle: 2496(thread)
    Handle Owner: Pid is 7244(winPEASx64 (2)) with owner: rdavis
    Reason: THREAD_ALL_ACCESS
    Handle PID: 5212(SYSTEM)
   =================================================================================================
    Handle: 2568(file)
    Handle Owner: Pid is 7244(winPEASx64 (2)) with owner: rdavis
    Reason: AllAccess
    File Path: \Windows\System32
    File Owner: NT SERVICE\TrustedInstaller
   =================================================================================================
    Handle: 2732(key)
    Handle Owner: Pid is 7244(winPEASx64 (2)) with owner: rdavis
    Reason: TakeOwnership
    Registry: HKLM\software\microsoft\windowsruntime\activatableclassid
   =================================================================================================
    Handle: 2752(file)
    Handle Owner: Pid is 7244(winPEASx64 (2)) with owner: rdavis
    Reason: AllAccess
    File Path: \Users\rdavis\AppData\Local\Microsoft\Windows\WebCache\V01.log
    File Owner: BUILTIN\Administrators
   =================================================================================================
    Handle: 2824(thread)
    Handle Owner: Pid is 7244(winPEASx64 (2)) with owner: rdavis
    Reason: THREAD_ALL_ACCESS
    Handle PID: 5144(SYSTEM)
   =================================================================================================
    Handle: 2856(file)
    Handle Owner: Pid is 7244(winPEASx64 (2)) with owner: rdavis
    Reason: AllAccess
    File Path: \Windows\System32\en-US\KernelBase.dll.mui
    File Owner: NT SERVICE\TrustedInstaller
   =================================================================================================
    Handle: 3096(file)
    Handle Owner: Pid is 7244(winPEASx64 (2)) with owner: rdavis
    Reason: AllAccess
    File Path: \Windows\System32\en-US\svchost.exe.mui
    File Owner: NT SERVICE\TrustedInstaller
   =================================================================================================
ÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ¹ Services Information ÌÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ
ÉÍÍÍÍÍÍÍÍÍÍ¹ Interesting Services -non Microsoft-
È Check if you can overwrite some service binary or perform a DLL hijacking, also check for unquoted paths https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#services
    cloudbase-init(Cloudbase Solutions Srl - cloudbase-init)["C:\Program Files\Cloudbase Solutions\Cloudbase-Init\bin\OpenStackService.exe" cloudbase-init "C:\Program Files\Cloudbase Solutions\Cloudbase-Init\Python\Scripts\cloudbase-init.exe" --config-file "C:\Program Files\Cloudbase Solutions\Cloudbase-Init\conf\cloudbase-init.conf"] - Auto - Stopped
    YOU CAN MODIFY THIS SERVICE: AllAccess
    File Permissions: Administrators [Allow: AllAccess]
    Possible DLL Hijacking in binary folder: C:\Program Files\Cloudbase Solutions\Cloudbase-Init\bin (Administrators [Allow: AllAccess])
    Cloud Initialization Service
   =================================================================================================
    laforge-agent(Laforge Agent)[C:\ProgramData\Laforge\laforge.exe] - Auto - Running
    YOU CAN MODIFY THIS SERVICE: AllAccess
    File Permissions: Administrators [Allow: AllAccess]
    Possible DLL Hijacking in binary folder: C:\ProgramData\Laforge (Administrators [Allow: AllAccess], Users [Allow: WriteData/CreateFiles])
    Tool used for monitoring hosts. NOT IN COMPETITION SCOPE
   =================================================================================================
    QEMU-GA(https://www.qemu.org - QEMU Guest Agent)["C:\Program Files\Qemu-ga\qemu-ga.exe" -d --retry-path] - Auto - Running
    YOU CAN MODIFY THIS SERVICE: AllAccess
    File Permissions: Administrators [Allow: AllAccess]
    Possible DLL Hijacking in binary folder: C:\Program Files\Qemu-ga (Administrators [Allow: AllAccess])
    QEMU Guest Agent
   =================================================================================================
    ssh-agent(OpenSSH Authentication Agent)[C:\windows\System32\OpenSSH\ssh-agent.exe] - Disabled - Stopped
    YOU CAN MODIFY THIS SERVICE: Start, AllAccess
    Possible DLL Hijacking in binary folder: C:\windows\System32\OpenSSH (Administrators [Allow: WriteData/CreateFiles])
    Agent to hold private keys used for public key authentication.
   =================================================================================================
    GoogleUpdaterInternalService142.0.7416.0(Google LLC - Google Updater Internal Service (GoogleUpdaterInternalService142.0.7416.0))["C:\Program Files (x86)\Google\GoogleUpdater\142.0.7416.0\updater.exe" --system --windows-service --service=update-internal] - Auto - Stopped
    YOU CAN MODIFY THIS SERVICE: AllAccess
    Possible DLL Hijacking in binary folder: C:\Program Files (x86)\Google\GoogleUpdater\142.0.7416.0 (Administrators [Allow: AllAccess])
    Keeps your Google software up to date. If this service is disabled or stopped, your Google software will not be kept up to date, meaning security vulnerabilities that may arise cannot be fixed and features may not work. This service uninstalls itself when there is no Google software using it.
   =================================================================================================
    GoogleUpdaterService142.0.7416.0(Google LLC - Google Updater Service (GoogleUpdaterService142.0.7416.0))["C:\Program Files (x86)\Google\GoogleUpdater\142.0.7416.0\updater.exe" --system --windows-service --service=update] - Auto - Stopped
    YOU CAN MODIFY THIS SERVICE: AllAccess
    Possible DLL Hijacking in binary folder: C:\Program Files (x86)\Google\GoogleUpdater\142.0.7416.0 (Administrators [Allow: AllAccess])
    Keeps your Google software up to date. If this service is disabled or stopped, your Google software will not be kept up to date, meaning security vulnerabilities that may arise cannot be fixed and features may not work. This service uninstalls itself when there is no Google software using it.
   =================================================================================================
    GoogleChromeElevationService(Google LLC - Google Chrome Elevation Service (GoogleChromeElevationService))["C:\Program Files\Google\Chrome\Application\141.0.7390.108\elevation_service.exe"] - Manual - Stopped
    YOU CAN MODIFY THIS SERVICE: AllAccess
    Possible DLL Hijacking in binary folder: C:\Program Files\Google\Chrome\Application\141.0.7390.108 (Administrators [Allow: AllAccess])
    Provides encryption services and a secure way for recovering Google Chrome if it gets out of date. If this service is disabled, Google Chrome may lose access to encrypted data, and Google Chrome may not be able recover itself.
   =================================================================================================
    MozillaMaintenance(Mozilla Foundation - Mozilla Maintenance Service)["C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"] - Manual - Stopped
    YOU CAN MODIFY THIS SERVICE: Start, AllAccess
    File Permissions: Administrators [Allow: AllAccess]
    Possible DLL Hijacking in binary folder: C:\Program Files (x86)\Mozilla Maintenance Service (Administrators [Allow: AllAccess])
    The Mozilla Maintenance Service ensures that you have the latest and most secure version of Mozilla Firefox on your computer. Keeping Firefox up to date is very important for your online security, and Mozilla strongly recommends that you keep this service enabled.
   =================================================================================================
    SplunkForwarder(Splunk Inc. - SplunkForwarder)["C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service] - Auto - Running
    YOU CAN MODIFY THIS SERVICE: AllAccess
    File Permissions: Administrators [Allow: AllAccess]
    Possible DLL Hijacking in binary folder: C:\Program Files\SplunkUniversalForwarder\bin (Administrators [Allow: AllAccess])
    SplunkForwarder is the remote data collection service for Splunk, a data platform for operational intelligence. If it is stopped, Splunk will stop collecting and sending data to Splunk indexers, which may result in data loss. Please see www.splunk.com for more information. Questions can be submitted to www.splunk.com/answers or for supported customers www.splunk.com/page/submit_issue
   =================================================================================================
    Sysmon64(Sysinternals - www.sysinternals.com - Sysmon64)[C:\windows\Sysmon64.exe] - Auto - Running
    YOU CAN MODIFY THIS SERVICE: AllAccess
    File Permissions: Administrators [Allow: AllAccess]
    Possible DLL Hijacking in binary folder: C:\windows (Administrators [Allow: WriteData/CreateFiles])
    System Monitor service
   =================================================================================================
ÉÍÍÍÍÍÍÍÍÍÍ¹ Modifiable Services
È Check if you can modify any service https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#services
    LOOKS LIKE YOU CAN MODIFY OR START/STOP SOME SERVICE/s:
    AJRouter: AllAccess
    ALG: AllAccess
    AppIDSvc: AllAccess
    Appinfo: Start, AllAccess
    AppMgmt: Start, AllAccess
    AppReadiness: AllAccess
    AppVClient: Start, AllAccess
    AppXSvc: Start, GenericExecute (Start/Stop)
    AudioEndpointBuilder: AllAccess
    Audiosrv: AllAccess
    AxInstSV: AllAccess
    BFE: WriteDac
    BITS: AllAccess
    BrokerInfrastructure: WriteDac, Start
    bthserv: AllAccess
    camsvc: AllAccess
    CDPSvc: AllAccess
    CertPropSvc: ChangeConfig
    ClipSVC: Start, WriteDac
    cloudbase-init: AllAccess
    COMSysApp: AllAccess
    CoreMessagingRegistrar: Start, GenericExecute (Start/Stop)
    CryptSvc: AllAccess
    CscService: AllAccess
    DcomLaunch: WriteDac
    defragsvc: AllAccess
    DeviceAssociationService: AllAccess
    DeviceInstall: AllAccess
    DevQueryBroker: AllAccess
    Dhcp: AllAccess
    diagnosticshub.standardcollector.service: AllAccess
    DiagTrack: AllAccess
    DispBrokerDesktopSvc: AllAccess
    DmEnrollmentSvc: AllAccess
    dmwappushservice: Start, AllAccess
    DoSvc: Start, AllAccess
    dot3svc: AllAccess
    DPS: ChangeConfig
    DsmSvc: AllAccess, Start
    DsSvc: Start, AllAccess
    EapHost: AllAccess
    edgeupdate: AllAccess
    edgeupdatem: AllAccess
    EFS: Start, ChangeConfig
    embeddedmode: Start, GenericExecute (Start/Stop)
    EntAppSvc: Start, GenericExecute (Start/Stop)
    EventLog: AllAccess
    EventSystem: AllAccess
    fdPHost: AllAccess
    FDResPub: AllAccess
    FontCache: Start, AllAccess
    FrameServer: AllAccess
    FrameServerMonitor: AllAccess
    GraphicsPerfSvc: AllAccess
    hidserv: AllAccess
    HvHost: AllAccess
    IKEEXT: AllAccess
    InstallService: AllAccess
    iphlpsvc: AllAccess
    KeyIso: Start, AllAccess
    KPSSVC: AllAccess
    KtmRm: Start, AllAccess
    laforge-agent: AllAccess
    LanmanServer: AllAccess
    LanmanWorkstation: AllAccess
    lfsvc: Start, AllAccess
    LicenseManager: AllAccess
    lltdsvc: AllAccess
    lmhosts: AllAccess
    MapsBroker: Start, AllAccess
    McpManagementService: AllAccess
    MicrosoftEdgeElevationService: AllAccess
    mpssvc: WriteDac
    MSDTC: Start, ChangeConfig
    MSiSCSI: AllAccess
    msiserver: Start, GenericExecute (Start/Stop)
    NcaSvc: AllAccess
    NcbService: AllAccess
    Netlogon: AllAccess
    Netman: AllAccess
    netprofm: AllAccess
    NetSetupSvc: AllAccess, Start
    NetTcpPortSharing: Start, AllAccess
    NgcCtnrSvc: WriteDac
    NgcSvc: WriteDac
    NlaSvc: Start, AllAccess
    nsi: AllAccess
    PcaSvc: Start, AllAccess
    PerfHost: AllAccess
    pla: Start, AllAccess
    PlugPlay: AllAccess
    PolicyAgent: AllAccess
    PoseidonBooking: AllAccess
    Power: AllAccess
    PrintNotify: AllAccess
    ProfSvc: AllAccess
    PushToInstall: AllAccess
    QEMU Guest Agent VSS Provider: AllAccess
    QEMU-GA: AllAccess
    QWAVE: Start, AllAccess
    RasAuto: AllAccess
    RasMan: Start, AllAccess
    RemoteAccess: AllAccess
    RemoteRegistry: AllAccess
    RmSvc: ChangeConfig, GenericExecute (Start/Stop)
    RpcEptMapper: WriteDac, Start
    RpcLocator: AllAccess
    RpcSs: WriteDac
    RSoPProv: AllAccess
    sacsvr: AllAccess
    SamSs: AllAccess
    SCardSvr: ChangeConfig
    ScDeviceEnum: ChangeConfig
    Schedule: WriteDac
    SCPolicySvc: ChangeConfig
    seclogon: Start, AllAccess
    SEMgrSvc: Start, AllAccess
    SENS: AllAccess


_raw:
   =================================================================================================
    Handle: 4656(file)
    Handle Owner: Pid is 6580(chrome) with owner: rdavis
    Reason: WriteData/CreateFiles
    File Path: \Users\rdavis\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_0
    File Owner: BUILTIN\Administrators
   =================================================================================================
    Handle: 4672(file)
    Handle Owner: Pid is 6580(chrome) with owner: rdavis
    Reason: WriteData/CreateFiles
    File Path: \Users\rdavis\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_3
    File Owner: BUILTIN\Administrators
   =================================================================================================
    Handle: 4676(file)
    Handle Owner: Pid is 6580(chrome) with owner: rdavis
    Reason: WriteData/CreateFiles
    File Path: \Users\rdavis\AppData\Local\Google\Chrome\User Data\GraphiteDawnCache\data_2
    File Owner: BUILTIN\Administrators
   =================================================================================================
    Handle: 4680(file)
    Handle Owner: Pid is 6580(chrome) with owner: rdavis
    Reason: WriteData/CreateFiles
    File Path: \Users\rdavis\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_3
    File Owner: BUILTIN\Administrators
   =================================================================================================
    Handle: 4688(file)
    Handle Owner: Pid is 6580(chrome) with owner: rdavis
    Reason: WriteData/CreateFiles
    File Path: \Users\rdavis\AppData\Local\Google\Chrome\User Data\GraphiteDawnCache\index
    File Owner: BUILTIN\Administrators
   =================================================================================================
    Handle: 4692(file)
    Handle Owner: Pid is 6580(chrome) with owner: rdavis
    Reason: WriteData/CreateFiles
    File Path: \Users\rdavis\AppData\Local\Google\Chrome\User Data\GraphiteDawnCache\index
    File Owner: BUILTIN\Administrators
   =================================================================================================
    Handle: 4700(file)
    Handle Owner: Pid is 6580(chrome) with owner: rdavis
    Reason: WriteData/CreateFiles
    File Path: \Users\rdavis\AppData\Local\Google\Chrome\User Data\GraphiteDawnCache\data_0
    File Owner: BUILTIN\Administrators
   =================================================================================================
    Handle: 4704(file)
    Handle Owner: Pid is 6580(chrome) with owner: rdavis
    Reason: WriteData/CreateFiles
    File Path: \Users\rdavis\AppData\Local\Google\Chrome\User Data\GraphiteDawnCache\data_0
    File Owner: BUILTIN\Administrators
   =================================================================================================
    Handle: 4712(file)
    Handle Owner: Pid is 6580(chrome) with owner: rdavis
    Reason: WriteData/CreateFiles
    File Path: \Users\rdavis\AppData\Local\Google\Chrome\User Data\GraphiteDawnCache\data_1
    File Owner: BUILTIN\Administrators
   =================================================================================================
    Handle: 4716(file)
    Handle Owner: Pid is 6580(chrome) with owner: rdavis
    Reason: WriteData/CreateFiles
    File Path: \Users\rdavis\AppData\Local\Google\Chrome\User Data\GraphiteDawnCache\data_1
    File Owner: BUILTIN\Administrators
   =================================================================================================
    Handle: 4724(file)
    Handle Owner: Pid is 6580(chrome) with owner: rdavis
    Reason: WriteData/CreateFiles
    File Path: \Users\rdavis\AppData\Local\Google\Chrome\User Data\GraphiteDawnCache\data_2
    File Owner: BUILTIN\Administrators
   =================================================================================================
    Handle: 4732(file)
    Handle Owner: Pid is 6580(chrome) with owner: rdavis
    Reason: WriteData/CreateFiles
    File Path: \Users\rdavis\AppData\Local\Google\Chrome\User Data\GraphiteDawnCache\data_3
    File Owner: BUILTIN\Administrators
   =================================================================================================
    Handle: 4736(file)
    Handle Owner: Pid is 6580(chrome) with owner: rdavis
    Reason: WriteData/CreateFiles
    File Path: \Users\rdavis\AppData\Local\Google\Chrome\User Data\GraphiteDawnCache\data_3
    File Owner: BUILTIN\Administrators
   =================================================================================================
    Handle: 4748(file)
    Handle Owner: Pid is 6580(chrome) with owner: rdavis
    Reason: WriteData/CreateFiles
    File Path: \Users\rdavis\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\000003.log
    File Owner: BUILTIN\Administrators
   =================================================================================================
    Handle: 5504(file)
    Handle Owner: Pid is 6580(chrome) with owner: rdavis
    Reason: WriteData/CreateFiles
    File Path: \Users\rdavis\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\LOG
    File Owner: BUILTIN\Administrators
   =================================================================================================
    Handle: 5516(file)
    Handle Owner: Pid is 6580(chrome) with owner: rdavis
    Reason: WriteData/CreateFiles
    File Path: \Users\rdavis\AppData\Local\Google\Chrome\User Data\Default\GCM Store\LOG
    File Owner: BUILTIN\Administrators
   =================================================================================================
    Handle: 5700(file)
    Handle Owner: Pid is 6580(chrome) with owner: rdavis
    Reason: AppendData/CreateDirectories
    File Path: \Users\rdavis\AppData\Local\Google\Chrome\User Data\Default\GCM Store\MANIFEST-000001
    File Owner: BUILTIN\Administrators
   =================================================================================================
    Handle: 5740(file)
    Handle Owner: Pid is 6580(chrome) with owner: rdavis
    Reason: AppendData/CreateDirectories
    File Path: \Users\rdavis\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\MANIFEST-000001
    File Owner: BUILTIN\Administrators
   =================================================================================================
    Handle: 5996(file)
    Handle Owner: Pid is 6580(chrome) with owner: rdavis
    Reason: AppendData/CreateDirectories
    File Path: \Users\rdavis\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
    File Owner: BUILTIN\Administrators
   =================================================================================================
    Handle: 6024(file)
    Handle Owner: Pid is 6580(chrome) with owner: rdavis
    Reason: WriteData/CreateFiles
    File Path: \Users\rdavis\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\LOG
    File Owner: BUILTIN\Administrators
   =================================================================================================
    Handle: 6120(file)
    Handle Owner: Pid is 6580(chrome) with owner: rdavis
    Reason: WriteData/CreateFiles
    File Path: \Users\rdavis\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\000003.log
    File Owner: BUILTIN\Administrators
   =================================================================================================
    Handle: 6216(file)
    Handle Owner: Pid is 6580(chrome) with owner: rdavis
    Reason: WriteData/CreateFiles
    File Path: \Users\rdavis\AppData\Local\Google\Chrome\User Data\Default\Sessions\Session_13405295112261598
    File Owner: BUILTIN\Administrators
   =================================================================================================
    Handle: 1172(file)
    Handle Owner: Pid is 6424(chrome) with owner: rdavis
    Reason: WriteData/CreateFiles
    File Path: \Users\rdavis\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\index
    File Owner: BUILTIN\Administrators
   =================================================================================================
    Handle: 1176(file)
    Handle Owner: Pid is 6424(chrome) with owner: rdavis
    Reason: WriteData/CreateFiles
    File Path: \Users\rdavis\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\index
    File Owner: BUILTIN\Administrators
   =================================================================================================
    Handle: 1184(file)
    Handle Owner: Pid is 6424(chrome) with owner: rdavis
    Reason: WriteData/CreateFiles
    File Path: \Users\rdavis\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_0
    File Owner: BUILTIN\Administrators
   =================================================================================================
    Handle: 1188(file)
    Handle Owner: Pid is 6424(chrome) with owner: rdavis
    Reason: WriteData/CreateFiles
    File Path: \Users\rdavis\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_0
    File Owner: BUILTIN\Administrators
   =================================================================================================
    Handle: 1196(file)
    Handle Owner: Pid is 6424(chrome) with owner: rdavis
    Reason: WriteData/CreateFiles
    File Path: \Users\rdavis\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_1
    File Owner: BUILTIN\Administrators
   =================================================================================================
    Handle: 1200(file)
    Handle Owner: Pid is 6424(chrome) with owner: rdavis
    Reason: WriteData/CreateFiles
    File Path: \Users\rdavis\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_1
    File Owner: BUILTIN\Administrators
   =================================================================================================
    Handle: 1212(file)
    Handle Owner: Pid is 6424(chrome) with owner: rdavis
    Reason: WriteData/CreateFiles
    File Path: \Users\rdavis\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_2
    File Owner: BUILTIN\Administrators
   =================================================================================================
    Handle: 1216(file)
    Handle Owner: Pid is 6424(chrome) with owner: rdavis
    Reason: WriteData/CreateFiles
    File Path: \Users\rdavis\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_2
    File Owner: BUILTIN\Administrators
   =================================================================================================
    Handle: 1224(file)
    Handle Owner: Pid is 6424(chrome) with owner: rdavis
    Reason: WriteData/CreateFiles
    File Path: \Users\rdavis\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_3
    File Owner: BUILTIN\Administrators
   =================================================================================================
    Handle: 1228(file)
    Handle Owner: Pid is 6424(chrome) with owner: rdavis
    Reason: WriteData/CreateFiles
    File Path: \Users\rdavis\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_3
    File Owner: BUILTIN\Administrators
   =================================================================================================
    Handle: 776(file)
    Handle Owner: Pid is 7888(chrome) with owner: rdavis
    Reason: WriteData/CreateFiles
    File Path: \Users\rdavis\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG
    File Owner: BUILTIN\Administrators
   =================================================================================================
    Handle: 784(file)
    Handle Owner: Pid is 7888(chrome) with owner: rdavis
    Reason: WriteData/CreateFiles
    File Path: \Users\rdavis\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log
    File Owner: BUILTIN\Administrators
   =================================================================================================
    Handle: 796(file)
    Handle Owner: Pid is 7888(chrome) with owner: rdavis
    Reason: AppendData/CreateDirectories
    File Path: \Users\rdavis\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\MANIFEST-000001
    File Owner: BUILTIN\Administrators
   =================================================================================================
    Handle: 800(file)
    Handle Owner: Pid is 7888(chrome) with owner: rdavis
    Reason: WriteData/CreateFiles
    File Path: \Users\rdavis\AppData\Local\Google\Chrome\User Data\Default\Session Storage\LOG
    File Owner: BUILTIN\Administrators
   =================================================================================================
    Handle: 804(file)
    Handle Owner: Pid is 7888(chrome) with owner: rdavis
    Reason: WriteData/CreateFiles
    File Path: \Users\rdavis\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\000003.log
    File Owner: BUILTIN\Administrators
   =================================================================================================
    Handle: 816(file)
    Handle Owner: Pid is 7888(chrome) with owner: rdavis
    Reason: AppendData/CreateDirectories
    File Path: \Users\rdavis\AppData\Local\Google\Chrome\User Data\Default\Session Storage\MANIFEST-000001
    File Owner: BUILTIN\Administrators
   =================================================================================================
    Handle: 824(file)
    Handle Owner: Pid is 7888(chrome) with owner: rdavis
    Reason: WriteData/CreateFiles
    File Path: \Users\rdavis\AppData\Local\Google\Chrome\User Data\Default\Session Storage\000003.log
    File Owner: BUILTIN\Administrators
   =================================================================================================
    Handle: 832(file)
    Handle Owner: Pid is 7888(chrome) with owner: rdavis
    Reason: WriteData/CreateFiles
    File Path: \Users\rdavis\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\LOG
    File Owner: BUILTIN\Administrators
   =================================================================================================
    Handle: 848(file)
    Handle Owner: Pid is 7888(chrome) with owner: rdavis
    Reason: AppendData/CreateDirectories
    File Path: \Users\rdavis\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
    File Owner: BUILTIN\Administrators
   =================================================================================================
    Handle: 876(file)
    Handle Owner: Pid is 7888(chrome) with owner: rdavis
    Reason: WriteData/CreateFiles
    File Path: \Users\rdavis\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Session Storage\LOG
    File Owner: BUILTIN\Administrators
   =================================================================================================
    Handle: 888(file)
    Handle Owner: Pid is 7888(chrome) with owner: rdavis
    Reason: AppendData/CreateDirectories
    File Path: \Users\rdavis\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Session Storage\MANIFEST-000001


_raw:
    Handle: 3316(file)
    Handle Owner: Pid is 6580(chrome) with owner: rdavis
    Reason: WriteData/CreateFiles
    File Path: \Users\rdavis\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1
    File Owner: BUILTIN\Administrators
   =================================================================================================
    Handle: 3320(file)
    Handle Owner: Pid is 6580(chrome) with owner: rdavis
    Reason: WriteData/CreateFiles
    File Path: \Users\rdavis\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1
    File Owner: BUILTIN\Administrators
   =================================================================================================
    Handle: 3332(file)
    Handle Owner: Pid is 6580(chrome) with owner: rdavis
    Reason: WriteData/CreateFiles
    File Path: \Users\rdavis\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_2
    File Owner: BUILTIN\Administrators
   =================================================================================================
    Handle: 3336(file)
    Handle Owner: Pid is 6580(chrome) with owner: rdavis
    Reason: WriteData/CreateFiles
    File Path: \Users\rdavis\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_2
    File Owner: BUILTIN\Administrators
   =================================================================================================
    Handle: 3344(file)
    Handle Owner: Pid is 6580(chrome) with owner: rdavis
    Reason: WriteData/CreateFiles
    File Path: \Users\rdavis\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_3
    File Owner: BUILTIN\Administrators
   =================================================================================================
    Handle: 3348(file)
    Handle Owner: Pid is 6580(chrome) with owner: rdavis
    Reason: WriteData/CreateFiles
    File Path: \Users\rdavis\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_3
    File Owner: BUILTIN\Administrators
   =================================================================================================
    Handle: 3356(file)
    Handle Owner: Pid is 6580(chrome) with owner: rdavis
    Reason: WriteData/CreateFiles
    File Path: \Users\rdavis\AppData\Local\Google\Chrome\User Data\Default\DawnWebGPUCache\index
    File Owner: BUILTIN\Administrators
   =================================================================================================
    Handle: 3364(file)
    Handle Owner: Pid is 6580(chrome) with owner: rdavis
    Reason: WriteData/CreateFiles
    File Path: \Users\rdavis\AppData\Local\Google\Chrome\User Data\Default\DawnWebGPUCache\index
    File Owner: BUILTIN\Administrators
   =================================================================================================
    Handle: 3372(file)
    Handle Owner: Pid is 6580(chrome) with owner: rdavis
    Reason: WriteData/CreateFiles
    File Path: \Users\rdavis\AppData\Local\Google\Chrome\User Data\Default\DawnWebGPUCache\data_0
    File Owner: BUILTIN\Administrators
   =================================================================================================
    Handle: 3376(file)
    Handle Owner: Pid is 6580(chrome) with owner: rdavis
    Reason: WriteData/CreateFiles
    File Path: \Users\rdavis\AppData\Local\Google\Chrome\User Data\Default\DawnWebGPUCache\data_0
    File Owner: BUILTIN\Administrators
   =================================================================================================
    Handle: 3384(file)
    Handle Owner: Pid is 6580(chrome) with owner: rdavis
    Reason: WriteData/CreateFiles
    File Path: \Users\rdavis\AppData\Local\Google\Chrome\User Data\Default\DawnWebGPUCache\data_1
    File Owner: BUILTIN\Administrators
   =================================================================================================
    Handle: 3388(file)
    Handle Owner: Pid is 6580(chrome) with owner: rdavis
    Reason: WriteData/CreateFiles
    File Path: \Users\rdavis\AppData\Local\Google\Chrome\User Data\Default\DawnWebGPUCache\data_1
    File Owner: BUILTIN\Administrators
   =================================================================================================
    Handle: 3396(file)
    Handle Owner: Pid is 6580(chrome) with owner: rdavis
    Reason: WriteData/CreateFiles
    File Path: \Users\rdavis\AppData\Local\Google\Chrome\User Data\Default\DawnWebGPUCache\data_2
    File Owner: BUILTIN\Administrators
   =================================================================================================
    Handle: 3400(file)
    Handle Owner: Pid is 6580(chrome) with owner: rdavis
    Reason: WriteData/CreateFiles
    File Path: \Users\rdavis\AppData\Local\Google\Chrome\User Data\Default\DawnWebGPUCache\data_2
    File Owner: BUILTIN\Administrators
   =================================================================================================
    Handle: 3412(file)
    Handle Owner: Pid is 6580(chrome) with owner: rdavis
    Reason: WriteData/CreateFiles
    File Path: \Users\rdavis\AppData\Local\Google\Chrome\User Data\Default\DawnWebGPUCache\data_3
    File Owner: BUILTIN\Administrators
   =================================================================================================
    Handle: 3416(file)
    Handle Owner: Pid is 6580(chrome) with owner: rdavis
    Reason: WriteData/CreateFiles
    File Path: \Users\rdavis\AppData\Local\Google\Chrome\User Data\Default\DawnWebGPUCache\data_3
    File Owner: BUILTIN\Administrators
   =================================================================================================
    Handle: 3428(file)
    Handle Owner: Pid is 6580(chrome) with owner: rdavis
    Reason: WriteData/CreateFiles
    File Path: \Users\rdavis\AppData\Local\Google\Chrome\User Data\Default\DawnGraphiteCache\index
    File Owner: BUILTIN\Administrators
   =================================================================================================
    Handle: 3548(file)
    Handle Owner: Pid is 6580(chrome) with owner: rdavis
    Reason: WriteData/CreateFiles
    File Path: \Users\rdavis\AppData\Local\Google\Chrome\User Data\Default\DawnGraphiteCache\data_0
    File Owner: BUILTIN\Administrators
   =================================================================================================
    Handle: 3556(file)
    Handle Owner: Pid is 6580(chrome) with owner: rdavis
    Reason: WriteData/CreateFiles
    File Path: \Users\rdavis\AppData\Local\Google\Chrome\User Data\Default\DawnGraphiteCache\data_1
    File Owner: BUILTIN\Administrators
   =================================================================================================
    Handle: 3560(file)
    Handle Owner: Pid is 6580(chrome) with owner: rdavis
    Reason: WriteData/CreateFiles
    File Path: \Users\rdavis\AppData\Local\Google\Chrome\User Data\Default\DawnGraphiteCache\data_1
    File Owner: BUILTIN\Administrators
   =================================================================================================
    Handle: 3568(file)
    Handle Owner: Pid is 6580(chrome) with owner: rdavis
    Reason: WriteData/CreateFiles
    File Path: \Users\rdavis\AppData\Local\Google\Chrome\User Data\Default\DawnGraphiteCache\data_2
    File Owner: BUILTIN\Administrators
   =================================================================================================
    Handle: 3572(file)
    Handle Owner: Pid is 6580(chrome) with owner: rdavis
    Reason: WriteData/CreateFiles
    File Path: \Users\rdavis\AppData\Local\Google\Chrome\User Data\Default\DawnGraphiteCache\data_2
    File Owner: BUILTIN\Administrators
   =================================================================================================
    Handle: 3580(file)
    Handle Owner: Pid is 6580(chrome) with owner: rdavis
    Reason: WriteData/CreateFiles
    File Path: \Users\rdavis\AppData\Local\Google\Chrome\User Data\Default\DawnGraphiteCache\data_3
    File Owner: BUILTIN\Administrators
   =================================================================================================
    Handle: 3584(file)
    Handle Owner: Pid is 6580(chrome) with owner: rdavis
    Reason: WriteData/CreateFiles
    File Path: \Users\rdavis\AppData\Local\Google\Chrome\User Data\Default\DawnGraphiteCache\data_3
    File Owner: BUILTIN\Administrators
   =================================================================================================
    Handle: 3908(file)
    Handle Owner: Pid is 6580(chrome) with owner: rdavis
    Reason: WriteData/CreateFiles
    File Path: \Users\rdavis\AppData\Local\Google\Chrome\User Data\Default\GCM Store\000003.log
    File Owner: BUILTIN\Administrators
   =================================================================================================
    Handle: 3924(file)
    Handle Owner: Pid is 6580(chrome) with owner: rdavis
    Reason: WriteData/CreateFiles
    File Path: \Users\rdavis\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\LOG
    File Owner: BUILTIN\Administrators
   =================================================================================================
    Handle: 4260(file)
    Handle Owner: Pid is 6580(chrome) with owner: rdavis
    Reason: WriteData/CreateFiles
    File Path: \Users\rdavis\AppData\Local\Google\Chrome\User Data\GrShaderCache\index
    File Owner: BUILTIN\Administrators
   =================================================================================================
    Handle: 4352(file)
    Handle Owner: Pid is 6580(chrome) with owner: rdavis
    Reason: WriteData/CreateFiles
    File Path: \Users\rdavis\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\000003.log
    File Owner: BUILTIN\Administrators
   =================================================================================================
    Handle: 4504(file)
    Handle Owner: Pid is 6580(chrome) with owner: rdavis
    Reason: WriteData/CreateFiles
    File Path: \Users\rdavis\AppData\Local\Google\Chrome\User Data\Default\Extension State\000003.log
    File Owner: BUILTIN\Administrators
   =================================================================================================
    Handle: 4516(file)
    Handle Owner: Pid is 6580(chrome) with owner: rdavis
    Reason: AppendData/CreateDirectories
    File Path: \Users\rdavis\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\MANIFEST-000001
    File Owner: BUILTIN\Administrators
   =================================================================================================
    Handle: 4520(file)
    Handle Owner: Pid is 6580(chrome) with owner: rdavis
    Reason: AppendData/CreateDirectories
    File Path: \Users\rdavis\AppData\Local\Google\Chrome\User Data\Default\Extension State\MANIFEST-000001
    File Owner: BUILTIN\Administrators
   =================================================================================================
    Handle: 4524(file)
    Handle Owner: Pid is 6580(chrome) with owner: rdavis
    Reason: WriteData/CreateFiles
    File Path: \Users\rdavis\AppData\Local\Google\Chrome\User Data\Default\Extension State\LOG
    File Owner: BUILTIN\Administrators
   =================================================================================================
    Handle: 4536(file)
    Handle Owner: Pid is 6580(chrome) with owner: rdavis
    Reason: WriteData/CreateFiles
    File Path: \Users\rdavis\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG
    File Owner: BUILTIN\Administrators
   =================================================================================================
    Handle: 4556(file)
    Handle Owner: Pid is 6580(chrome) with owner: rdavis
    Reason: WriteData/CreateFiles
    File Path: \Users\rdavis\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\LOG
    File Owner: BUILTIN\Administrators
   =================================================================================================
    Handle: 4564(file)
    Handle Owner: Pid is 6580(chrome) with owner: rdavis
    Reason: AppendData/CreateDirectories
    File Path: \Users\rdavis\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\MANIFEST-000001
    File Owner: BUILTIN\Administrators
   =================================================================================================
    Handle: 4568(file)
    Handle Owner: Pid is 6580(chrome) with owner: rdavis
    Reason: WriteData/CreateFiles
    File Path: \Users\rdavis\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_2
    File Owner: BUILTIN\Administrators
   =================================================================================================
    Handle: 4572(file)
    Handle Owner: Pid is 6580(chrome) with owner: rdavis
    Reason: WriteData/CreateFiles
    File Path: \Users\rdavis\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_1
    File Owner: BUILTIN\Administrators
   =================================================================================================
    Handle: 4604(file)
    Handle Owner: Pid is 6580(chrome) with owner: rdavis
    Reason: WriteData/CreateFiles
    File Path: \Users\rdavis\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_1
    File Owner: BUILTIN\Administrators
   =================================================================================================
    Handle: 4612(file)
    Handle Owner: Pid is 6580(chrome) with owner: rdavis
    Reason: AppendData/CreateDirectories
    File Path: \Users\rdavis\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\MANIFEST-000001
    File Owner: BUILTIN\Administrators
   =================================================================================================
    Handle: 4620(file)
    Handle Owner: Pid is 6580(chrome) with owner: rdavis
    Reason: WriteData/CreateFiles
    File Path: \Users\rdavis\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\000003.log
    File Owner: BUILTIN\Administrators
   =================================================================================================
    Handle: 4624(file)
    Handle Owner: Pid is 6580(chrome) with owner: rdavis
    Reason: WriteData/CreateFiles
    File Path: \Users\rdavis\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\000003.log
    File Owner: BUILTIN\Administrators
   =================================================================================================
    Handle: 4628(file)
    Handle Owner: Pid is 6580(chrome) with owner: rdavis
    Reason: WriteData/CreateFiles
    File Path: \Users\rdavis\AppData\Local\Google\Chrome\User Data\GrShaderCache\index
    File Owner: BUILTIN\Administrators
   =================================================================================================
    Handle: 4652(file)
    Handle Owner: Pid is 6580(chrome) with owner: rdavis
    Reason: WriteData/CreateFiles
    File Path: \Users\rdavis\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_0
    File Owner: BUILTIN\Administrators