_raw:
    edgeupdatem: AllAccess
    EFS: Start, ChangeConfig
    embeddedmode: Start, GenericExecute (Start/Stop)
    EntAppSvc: Start, GenericExecute (Start/Stop)
    EventLog: AllAccess
    EventSystem: AllAccess
    fdPHost: AllAccess
    FDResPub: AllAccess
    FontCache: Start, AllAccess
    FrameServer: AllAccess
    FrameServerMonitor: AllAccess
    GraphicsPerfSvc: AllAccess
    hidserv: AllAccess
    HvHost: AllAccess
    IKEEXT: AllAccess
    InstallService: AllAccess
    iphlpsvc: AllAccess
    KeyIso: Start, AllAccess
    KPSSVC: AllAccess
    KtmRm: Start, AllAccess
    laforge-agent: AllAccess
    LanmanServer: AllAccess
    LanmanWorkstation: AllAccess
    lfsvc: Start, AllAccess
    LicenseManager: AllAccess
    lltdsvc: AllAccess
    lmhosts: AllAccess
    MapsBroker: AllAccess
    McpManagementService: AllAccess
    MicrosoftEdgeElevationService: AllAccess
    mpssvc: WriteDac
    MSDTC: Start, ChangeConfig
    MSiSCSI: AllAccess
    msiserver: Start, GenericExecute (Start/Stop)
    NcaSvc: AllAccess
    NcbService: AllAccess
    Netlogon: AllAccess
    Netman: AllAccess
    netprofm: AllAccess
    NetSetupSvc: AllAccess, Start
    NetTcpPortSharing: Start, AllAccess
    NgcCtnrSvc: WriteDac
    NgcSvc: WriteDac
    NlaSvc: Start, AllAccess
    nsi: AllAccess
    PcaSvc: Start, AllAccess
    PerfHost: AllAccess
    pla: Start, AllAccess
    PlugPlay: AllAccess
    PolicyAgent: AllAccess
    PoseidonBooking: AllAccess
    Power: AllAccess
    PrintNotify: AllAccess
    ProfSvc: AllAccess
    PushToInstall: AllAccess
    QEMU Guest Agent VSS Provider: AllAccess
    QEMU-GA: AllAccess
    QWAVE: Start, AllAccess
    RasAuto: AllAccess
    RasMan: AllAccess
    RemoteAccess: AllAccess
    RemoteRegistry: AllAccess
    RmSvc: ChangeConfig, GenericExecute (Start/Stop)
    RpcEptMapper: WriteDac, Start
    RpcLocator: AllAccess
    RpcSs: WriteDac
    RSoPProv: AllAccess
    sacsvr: AllAccess
    SamSs: AllAccess
    SCardSvr: ChangeConfig
    ScDeviceEnum: ChangeConfig
    Schedule: WriteDac
    SCPolicySvc: ChangeConfig
    seclogon: Start, AllAccess
    SEMgrSvc: Start, AllAccess
    SENS: AllAccess
    Sense: Start, ChangeConfig
    SensorDataService: AllAccess
    SensorService: AllAccess
    SensrSvc: AllAccess
    SessionEnv: AllAccess
    SgrmBroker: AllAccess
    SharedAccess: AllAccess
    ShellHWDetection: AllAccess
    shpamsvc: AllAccess
    smphost: AllAccess
    SNMPTRAP: AllAccess
    Spooler: AllAccess
    sppsvc: Start, WriteDac
    SSDPSRV: Start, AllAccess
    ssh-agent: AllAccess
    SstpSvc: AllAccess
    StateRepository: Start, GenericExecute (Start/Stop)
    StiSvc: AllAccess
    StorSvc: AllAccess
    svsvc: AllAccess
    swprv: AllAccess
    SysMain: AllAccess
    SystemEventsBroker: WriteDac, Start
    TabletInputService: Start, AllAccess
    tapisrv: Start, AllAccess
    TermService: AllAccess
    Themes: AllAccess
    TieringEngineService: AllAccess
    TimeBrokerSvc: WriteDac, Start
    TokenBroker: AllAccess
    TrkWks: AllAccess
    TrustedInstaller: ChangeConfig
    tzautoupdate: AllAccess
    UALSVC: AllAccess
    UevAgentService: AllAccess
    UmRdpService: AllAccess
    upnphost: Start, AllAccess
    UserManager: AllAccess
    UsoSvc: AllAccess
    VaultSvc: Start, AllAccess
    vds: AllAccess
    vmicguestinterface: AllAccess
    vmicheartbeat: AllAccess
    vmickvpexchange: AllAccess
    vmicshutdown: AllAccess
    vmictimesync: AllAccess
    vmicvmsession: AllAccess
    vmicvss: AllAccess
    VSS: AllAccess
    W32Time: AllAccess
    WaaSMedicSvc: AllAccess
    WalletService: AllAccess
    WarpJITSvc: AllAccess
    WbioSrvc: Start, AllAccess
    Wcmsvc: AllAccess
    WdiServiceHost: ChangeConfig
    WdiSystemHost: ChangeConfig
    Wecsvc: AllAccess
    WEPHOSTSVC: AllAccess
    wercplsupport: AllAccess
    WerSvc: AllAccess
    WiaRpc: AllAccess
    Winmgmt: AllAccess
    WinRM: AllAccess
    wisvc: AllAccess
    wlidsvc: Start, AllAccess
    wmiApSrv: AllAccess
    WMPNetworkSvc: Start, AllAccess
    WPDBusEnum: AllAccess
    WpnService: AllAccess
    WSearch: AllAccess
    wuauserv: AllAccess
    GoogleUpdaterInternalService143.0.7482.0: AllAccess
    GoogleUpdaterService143.0.7482.0: AllAccess
    GoogleChromeElevationService: AllAccess
    MozillaMaintenance: Start, AllAccess
    SplunkForwarder: AllAccess
    Sysmon64: AllAccess
    CaptureService_73dcad9: AllAccess
    cbdhsvc_73dcad9: AllAccess
    CDPUserSvc_73dcad9: AllAccess
    ConsentUxUserSvc_73dcad9: GenericExecute (Start/Stop), AllAccess
    CredentialEnrollmentManagerUserSvc_73dcad9: GenericExecute (Start/Stop)
    DeviceAssociationBrokerSvc_73dcad9: GenericExecute (Start/Stop)
    DevicePickerUserSvc_73dcad9: GenericExecute (Start/Stop), AllAccess
    DevicesFlowUserSvc_73dcad9: GenericExecute (Start/Stop), AllAccess
    PimIndexMaintenanceSvc_73dcad9: GenericExecute (Start/Stop), AllAccess
    PrintWorkflowUserSvc_73dcad9: GenericExecute (Start/Stop)
    UdkUserSvc_73dcad9: GenericExecute (Start/Stop), AllAccess
    UnistoreSvc_73dcad9: GenericExecute (Start/Stop), AllAccess
    UserDataSvc_73dcad9: GenericExecute (Start/Stop), AllAccess
    WpnUserService_73dcad9: GenericExecute (Start/Stop), AllAccess
╔══════════╣ Looking if you can modify any service registry
╚ Check if you can modify the registry of a service https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#services-registry-modify-permissions
    HKLM\system\currentcontrolset\services\.NET CLR Data (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\.NET CLR Networking (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\.NET CLR Networking 4.0.0.0 (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\.NET Data Provider for Oracle (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\.NET Data Provider for SqlServer (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\.NET Memory Cache 4.0 (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\.NETFramework (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\1394ohci (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\3ware (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\ACPI (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\AcpiDev (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\acpiex (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\acpipagr (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\AcpiPmi (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\acpitime (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\Acx01000 (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\ADOVMPPackage (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\ADP80XX (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\adsi (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\AFD (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\afunix (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\ahcache (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\AJRouter (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\ALG (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\AmdK8 (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\AmdPPM (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\amdsata (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\amdsbs (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\amdxata (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\AppID (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\AppIDSvc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\Appinfo (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\applockerfltr (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\AppMgmt (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\AppReadiness (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\AppVClient (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\AppvStrm (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\AppvVemgr (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\AppvVfs (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\AppXSvc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\arcsas (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\AsyncMac (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\atapi (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\AudioEndpointBuilder (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\Audiosrv (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\AxInstSV (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\b06bdrv (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\BALLOON (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\bam (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\BasicDisplay (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\BasicRender (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\BattC (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\Beep (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\bfadfcoei (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\bfadi (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\BFE (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\bindflt (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\BITS (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\bowser (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\BrokerInfrastructure (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\BthEnum (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\BthLEEnum (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\BthMini (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\BTHPORT (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\bthserv (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\BTHUSB (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\bttflt (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\buttonconverter (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\bxfcoe (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\bxois (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\camsvc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\CaptureService (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\CaptureService_73dcad9 (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\cbdhsvc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\cbdhsvc_73dcad9 (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\cdfs (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\CDPSvc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\CDPUserSvc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\CDPUserSvc_73dcad9 (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\cdrom (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\CertPropSvc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\cht4iscsi (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\cht4vbd (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\CimFS (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\CldFlt (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\CLFS (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\ClipSVC (Administrators [Allow: FullControl GenericAll])


_raw:
    Logon Time:                   11/5/2025 5:37:58 PM
    Logon Type:                   Interactive
    Start Time:
    Domain:                       Font Driver Host
    Authentication Package:       Negotiate
    Start Time:
    User Name:                    UMFD-1
    User Principal Name:          DECKHAND-01$@allports.local
    User SID:                     S-1-5-96-0-1
   =================================================================================================
════════════════════════════════════╣ Processes Information ╠════════════════════════════════════
╔══════════╣ Interesting Processes -non Microsoft-
╚ Check if any interesting processes for memory dump or if you could overwrite some binary running https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#running-processes
  [X] Exception:
╔══════════╣ Vulnerable Leaked Handlers
╚  https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#leaked-handlers
╚ Getting Leaked Handlers, it might take some time...
    Handle: 756(file)
    Handle Owner: Pid is 7716(taskhostw) with owner: Guest
    Reason: WriteData/CreateFiles
    File Path: \Users\Guest\AppData\Local\Microsoft\Windows\WebCache\V01.log
    File Owner: BUILTIN\Administrators
   =================================================================================================
    Handle: 784(file)
    Handle Owner: Pid is 7716(taskhostw) with owner: Guest
    Reason: WriteData/CreateFiles
    File Path: \Users\Guest\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.jfm
    File Owner: BUILTIN\Administrators
   =================================================================================================
    Handle: 788(file)
    Handle Owner: Pid is 7716(taskhostw) with owner: Guest
    Reason: WriteData/CreateFiles
    File Path: \Users\Guest\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat
    File Owner: BUILTIN\Administrators
   =================================================================================================
    Handle: 1008(file)
    Handle Owner: Pid is 7716(taskhostw) with owner: Guest
    Reason: WriteData/CreateFiles
    File Path: \Users\Guest\AppData\Local\Microsoft\Windows\WebCache\V01tmp.log
    File Owner: BUILTIN\Administrators
   =================================================================================================
    Handle: 2452(file)
    Handle Owner: Pid is 7312(powershell) with owner: Guest
    Reason: WriteData/CreateFiles
    File Path: \Users\Guest\Desktop\10.0.1.20.winpeas.guest_user.administrator.txt
    File Owner: BUILTIN\Administrators
   =================================================================================================
════════════════════════════════════╣ Services Information ╠════════════════════════════════════
╔══════════╣ Interesting Services -non Microsoft-
╚ Check if you can overwrite some service binary or perform a DLL hijacking, also check for unquoted paths https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#services
  [X] Exception:
    @arcsas.inf,%arcsas_ServiceName%;Adaptec SAS/SATA-II RAID Storport's Miniport Driver(PMC-Sierra, Inc. - @arcsas.inf,%arcsas_ServiceName%;Adaptec SAS/SATA-II RAID Storport's Miniport Driver)[System32\drivers\arcsas.sys] - Boot
    File Permissions: Administrators [Allow: AllAccess]
    Possible DLL Hijacking in binary folder: C:\windows\System32\drivers (Administrators [Allow: WriteData/CreateFiles])   =================================================================================================
    @netbvbda.inf,%vbd_srv_desc%;QLogic Network Adapter VBD(QLogic Corporation - @netbvbda.inf,%vbd_srv_desc%;QLogic Network Adapter VBD)[System32\drivers\bxvbda.sys] - Boot
    File Permissions: Administrators [Allow: AllAccess]
    Possible DLL Hijacking in binary folder: C:\windows\System32\drivers (Administrators [Allow: WriteData/CreateFiles])   =================================================================================================
    @oem0.inf,%BALLOON.SVCDESC%;VirtIO Balloon Service(Red Hat, Inc. - @oem0.inf,%BALLOON.SVCDESC%;VirtIO Balloon Service)[C:\windows\System32\drivers\balloon.sys] - System
    Possible DLL Hijacking in binary folder: C:\windows\System32\drivers (Administrators [Allow: WriteData/CreateFiles])   =================================================================================================
    @bxfcoe.inf,%BXFCOE.SVCDESC%;QLogic FCoE Offload driver(Marvell Semiconductor Inc. - @bxfcoe.inf,%BXFCOE.SVCDESC%;QLogic FCoE Offload driver)[System32\drivers\bxfcoe.sys] - Boot
    File Permissions: Administrators [Allow: AllAccess]
    Possible DLL Hijacking in binary folder: C:\windows\System32\drivers (Administrators [Allow: WriteData/CreateFiles])   =================================================================================================
    @bxois.inf,%BXOIS.SVCDESC%;QLogic Offload iSCSI Driver(Marvell Semiconductor Inc. - @bxois.inf,%BXOIS.SVCDESC%;QLogic Offload iSCSI Driver)[System32\drivers\bxois.sys] - Boot
    File Permissions: Administrators [Allow: AllAccess]
    Possible DLL Hijacking in binary folder: C:\windows\System32\drivers (Administrators [Allow: WriteData/CreateFiles])   =================================================================================================
    @cht4vx64.inf,%cht4vbd.generic%;Chelsio Virtual Bus Driver(Chelsio Communications - @cht4vx64.inf,%cht4vbd.generic%;Chelsio Virtual Bus Driver)[C:\windows\System32\drivers\cht4vx64.sys] - System
    File Permissions: Administrators [Allow: AllAccess]
    Possible DLL Hijacking in binary folder: C:\windows\System32\drivers (Administrators [Allow: WriteData/CreateFiles])   =================================================================================================
    Cloudbase-Init(Cloudbase Solutions Srl - Cloudbase-Init)["C:\Program Files\Cloudbase Solutions\Cloudbase-Init\bin\OpenStackService.exe" cloudbase-init "C:\Program Files\Cloudbase Solutions\Cloudbase-Init\Python\Scripts\cloudbase-init.exe" --config-file "C:\Program Files\Cloudbase Solutions\Cloudbase-Init\conf\cloudbase-init.conf"] - Autoload
    File Permissions: Administrators [Allow: AllAccess]
    Possible DLL Hijacking in binary folder: C:\Program Files\Cloudbase Solutions\Cloudbase-Init\bin (Administrators [Allow: AllAccess])
    Cloud Initialization Service
   =================================================================================================
    @netevbda.inf,%vbd_srv_desc%;QLogic 10 Gigabit Ethernet Adapter VBD(Marvell Semiconductor Inc. - @netevbda.inf,%vbd_srv_desc%;QLogic 10 Gigabit Ethernet Adapter VBD)[System32\drivers\evbda.sys] - Boot
    Possible DLL Hijacking in binary folder: C:\windows\System32\drivers (Administrators [Allow: WriteData/CreateFiles])   =================================================================================================
    @netevbd0a.inf,%vbd_srv_desc%;QLogic Legacy Ethernet Adapter VBD(QLogic Corporation - @netevbd0a.inf,%vbd_srv_desc%;QLogic Legacy Ethernet Adapter VBD)[System32\drivers\evbd0a.sys] - Boot
    File Permissions: Administrators [Allow: AllAccess]
    Possible DLL Hijacking in binary folder: C:\windows\System32\drivers (Administrators [Allow: WriteData/CreateFiles])   =================================================================================================
    Google Chrome Elevation Service (GoogleChromeElevationService)(Google LLC - Google Chrome Elevation Service (GoogleChromeElevationService))["C:\Program Files\Google\Chrome\Application\142.0.7444.60\elevation_service.exe"] - System
    Possible DLL Hijacking in binary folder: C:\Program Files\Google\Chrome\Application\142.0.7444.60 (Administrators [Allow: AllAccess])
    Provides encryption services and a secure way for recovering Google Chrome if it gets out of date. If this service is disabled, Google Chrome may lose access to encrypted data, and Google Chrome may not be able recover itself.
   =================================================================================================
    Google Updater Internal Service (GoogleUpdaterInternalService143.0.7482.0)(Google LLC - Google Updater Internal Service (GoogleUpdaterInternalService143.0.7482.0))["C:\Program Files (x86)\Google\GoogleUpdater\143.0.7482.0\updater.exe" --system --windows-service --service=update-internal] - Autoload
    Possible DLL Hijacking in binary folder: C:\Program Files (x86)\Google\GoogleUpdater\143.0.7482.0 (Administrators [Allow: AllAccess])
    Keeps your Google software up to date. If this service is disabled or stopped, your Google software will not be kept up to date, meaning security vulnerabilities that may arise cannot be fixed and features may not work. This service uninstalls itself when there is no Google software using it.
   =================================================================================================
    Google Updater Service (GoogleUpdaterService143.0.7482.0)(Google LLC - Google Updater Service (GoogleUpdaterService143.0.7482.0))["C:\Program Files (x86)\Google\GoogleUpdater\143.0.7482.0\updater.exe" --system --windows-service --service=update] - Autoload
    Possible DLL Hijacking in binary folder: C:\Program Files (x86)\Google\GoogleUpdater\143.0.7482.0 (Administrators [Allow: AllAccess])
    Keeps your Google software up to date. If this service is disabled or stopped, your Google software will not be kept up to date, meaning security vulnerabilities that may arise cannot be fixed and features may not work. This service uninstalls itself when there is no Google software using it.
   =================================================================================================
    @ialpssi_gpio.inf,%iaLPSSi_GPIO.SVCDESC%;Intel(R) Serial IO GPIO Controller Driver(Intel Corporation - @ialpssi_gpio.inf,%iaLPSSi_GPIO.SVCDESC%;Intel(R) Serial IO GPIO Controller Driver)[C:\windows\System32\drivers\iaLPSSi_GPIO.sys] - System
    File Permissions: Administrators [Allow: AllAccess]
    Possible DLL Hijacking in binary folder: C:\windows\System32\drivers (Administrators [Allow: WriteData/CreateFiles])   =================================================================================================
    @ialpssi_i2c.inf,%iaLPSSi_I2C.SVCDESC%;Intel(R) Serial IO I2C Controller Driver(Intel Corporation - @ialpssi_i2c.inf,%iaLPSSi_I2C.SVCDESC%;Intel(R) Serial IO I2C Controller Driver)[C:\windows\System32\drivers\iaLPSSi_I2C.sys] - System
    File Permissions: Administrators [Allow: AllAccess]
    Possible DLL Hijacking in binary folder: C:\windows\System32\drivers (Administrators [Allow: WriteData/CreateFiles])   =================================================================================================
    @iastorav.inf,%iaStorAVC.DeviceDesc%;Intel Chipset SATA RAID Controller(Intel Corporation - @iastorav.inf,%iaStorAVC.DeviceDesc%;Intel Chipset SATA RAID Controller)[System32\drivers\iaStorAVC.sys] - Boot
    File Permissions: Administrators [Allow: AllAccess]
    Possible DLL Hijacking in binary folder: C:\windows\System32\drivers (Administrators [Allow: WriteData/CreateFiles])   =================================================================================================
    @iastorv.inf,%*PNP0600.DeviceDesc%;Intel RAID Controller Windows 7(Intel Corporation - @iastorv.inf,%*PNP0600.DeviceDesc%;Intel RAID Controller Windows 7)[System32\drivers\iaStorV.sys] - Boot
    File Permissions: Administrators [Allow: AllAccess]
    Possible DLL Hijacking in binary folder: C:\windows\System32\drivers (Administrators [Allow: WriteData/CreateFiles])   =================================================================================================
    @mlx4_bus.inf,%Ibbus.ServiceDesc%;Mellanox InfiniBand Bus/AL (Filter Driver)(Mellanox - @mlx4_bus.inf,%Ibbus.ServiceDesc%;Mellanox InfiniBand Bus/AL (Filter Driver))[C:\windows\System32\drivers\ibbus.sys] - System
    File Permissions: Administrators [Allow: AllAccess]
    Possible DLL Hijacking in binary folder: C:\windows\System32\drivers (Administrators [Allow: WriteData/CreateFiles])   =================================================================================================
    Laforge Agent(Laforge Agent)[C:\ProgramData\Laforge\laforge.exe] - Autoload
    File Permissions: Administrators [Allow: AllAccess]
    Possible DLL Hijacking in binary folder: C:\ProgramData\Laforge (Administrators [Allow: AllAccess], Users [Allow: WriteData/CreateFiles])
    Tool used for monitoring hosts. NOT IN COMPETITION SCOPE
   =================================================================================================
    @mlx4_bus.inf,%MLX4BUS.ServiceDesc%;Mellanox ConnectX Bus Enumerator(Mellanox - @mlx4_bus.inf,%MLX4BUS.ServiceDesc%;Mellanox ConnectX Bus Enumerator)[C:\windows\System32\drivers\mlx4_bus.sys] - System
    File Permissions: Administrators [Allow: AllAccess]
    Possible DLL Hijacking in binary folder: C:\windows\System32\drivers (Administrators [Allow: WriteData/CreateFiles])   =================================================================================================
    Mozilla Maintenance Service(Mozilla Foundation - Mozilla Maintenance Service)["C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"] - System
    File Permissions: Administrators [Allow: AllAccess]
    Possible DLL Hijacking in binary folder: C:\Program Files (x86)\Mozilla Maintenance Service (Administrators [Allow: AllAccess])
    The Mozilla Maintenance Service ensures that you have the latest and most secure version of Mozilla Firefox on your computer. Keeping Firefox up to date is very important for your online security, and Mozilla strongly recommends that you keep this service enabled.
   =================================================================================================
    @mlx4_bus.inf,%ndfltr.ServiceDesc%;NetworkDirect Service(Mellanox - @mlx4_bus.inf,%ndfltr.ServiceDesc%;NetworkDirect Service)[C:\windows\System32\drivers\ndfltr.sys] - System
    File Permissions: Administrators [Allow: AllAccess]
    Possible DLL Hijacking in binary folder: C:\windows\System32\drivers (Administrators [Allow: WriteData/CreateFiles])   =================================================================================================
    NDKPerf Driver(NDKPerf Driver)[system32\drivers\NDKPerf.sys] - System
    Possible DLL Hijacking in binary folder: C:\windows\system32\drivers (Administrators [Allow: WriteData/CreateFiles])   =================================================================================================
    @oem1.inf,%kvmnet6.Service.DispName%;Red Hat VirtIO Ethernet Adapter Service(Red Hat, Inc. - @oem1.inf,%kvmnet6.Service.DispName%;Red Hat VirtIO Ethernet Adapter Service)[C:\windows\System32\drivers\netkvm.sys] - System
    Possible DLL Hijacking in binary folder: C:\windows\System32\drivers (Administrators [Allow: WriteData/CreateFiles])   =================================================================================================
    @oem2.inf,%PVPanic.Service%;QEMU PVPanic Service(Red Hat, Inc. - @oem2.inf,%PVPanic.Service%;QEMU PVPanic Service)[C:\windows\System32\drivers\pvpanic.sys] - System
    Possible DLL Hijacking in binary folder: C:\windows\System32\drivers (Administrators [Allow: WriteData/CreateFiles])   =================================================================================================
    @pvscsii.inf,%pvscsi.DiskName%;pvscsi Storage Controller Driver(VMware, Inc. - @pvscsii.inf,%pvscsi.DiskName%;pvscsi Storage Controller Driver)[System32\drivers\pvscsii.sys] - Boot
    Possible DLL Hijacking in binary folder: C:\windows\System32\drivers (Administrators [Allow: WriteData/CreateFiles])   =================================================================================================
    @netqevbda.inf,%vbd_srv_desc%;QLogic FastLinQ Ethernet VBD(Marvell Semiconductor Inc. - @netqevbda.inf,%vbd_srv_desc%;QLogic FastLinQ Ethernet VBD)[System32\drivers\qevbda.sys] - Boot
    Possible DLL Hijacking in binary folder: C:\windows\System32\drivers (Administrators [Allow: WriteData/CreateFiles])   =================================================================================================
    @qefcoe.inf,%QEFCOE.SVCDESC%;QLogic FCoE driver(Marvell Semiconductor Inc. - @qefcoe.inf,%QEFCOE.SVCDESC%;QLogic FCoE driver)[System32\drivers\qefcoe.sys] - Boot
    File Permissions: Administrators [Allow: AllAccess]
    Possible DLL Hijacking in binary folder: C:\windows\System32\drivers (Administrators [Allow: WriteData/CreateFiles])   =================================================================================================
    QEMU Guest Agent(https://www.qemu.org - QEMU Guest Agent)["C:\Program Files\Qemu-ga\qemu-ga.exe" -d --retry-path] - Autoload
    File Permissions: Administrators [Allow: AllAccess]
    Possible DLL Hijacking in binary folder: C:\Program Files\Qemu-ga (Administrators [Allow: AllAccess])
    QEMU Guest Agent
   =================================================================================================
    @qeois.inf,%QEOIS.SVCDESC%;QLogic 40G iSCSI Driver(Marvell Semiconductor Inc. - @qeois.inf,%QEOIS.SVCDESC%;QLogic 40G iSCSI Driver)[System32\drivers\qeois.sys] - Boot
    File Permissions: Administrators [Allow: AllAccess]
    Possible DLL Hijacking in binary folder: C:\windows\System32\drivers (Administrators [Allow: WriteData/CreateFiles])   =================================================================================================
    @ql2300.inf,%ql2300i.DriverDesc%;QLogic Fibre Channel STOR Miniport Inbox Driver (wx64)(Marvell Semiconductor Inc. - @ql2300.inf,%ql2300i.DriverDesc%;QLogic Fibre Channel STOR Miniport Inbox Driver (wx64))[System32\drivers\ql2300i.sys] - Boot
    File Permissions: Administrators [Allow: AllAccess]
    Possible DLL Hijacking in binary folder: C:\windows\System32\drivers (Administrators [Allow: WriteData/CreateFiles])   =================================================================================================
    @ql40xx2i.inf,%ql40xx2i.DriverDesc%;QLogic iSCSI Miniport Inbox Driver(QLogic Corporation - @ql40xx2i.inf,%ql40xx2i.DriverDesc%;QLogic iSCSI Miniport Inbox Driver)[System32\drivers\ql40xx2i.sys] - Boot
    File Permissions: Administrators [Allow: AllAccess]
    Possible DLL Hijacking in binary folder: C:\windows\System32\drivers (Administrators [Allow: WriteData/CreateFiles])   =================================================================================================
    @qlfcoei.inf,%qlfcoei.DriverDesc%;QLogic [FCoE] STOR Miniport Inbox Driver (wx64)(QLogic Corporation - @qlfcoei.inf,%qlfcoei.DriverDesc%;QLogic [FCoE] STOR Miniport Inbox Driver (wx64))[System32\drivers\qlfcoei.sys] - Boot
    File Permissions: Administrators [Allow: AllAccess]
    Possible DLL Hijacking in binary folder: C:\windows\System32\drivers (Administrators [Allow: WriteData/CreateFiles])   =================================================================================================
    splknetdrv(Windows (R) Win 7 DDK provider - splknetdrv)[C:\windows\system32\DRIVERS\splknetdrv.sys] - System
    File Permissions: Administrators [Allow: AllAccess]
    Possible DLL Hijacking in binary folder: C:\windows\system32\DRIVERS (Administrators [Allow: WriteData/CreateFiles])    Splunk Network Monitor Kernel Driver
   =================================================================================================
    Splunk Trace Kernel Mode Driver(Windows (R) Win 7 DDK provider - Splunk Trace Kernel Mode Driver)[C:\windows\system32\DRIVERS\splunkdrv.sys] - System
    File Permissions: Administrators [Allow: AllAccess]
    Possible DLL Hijacking in binary folder: C:\windows\system32\DRIVERS (Administrators [Allow: WriteData/CreateFiles])   =================================================================================================
    SplunkForwarder(Splunk Inc. - SplunkForwarder)["C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service] - Autoload
    YOU CAN MODIFY THIS SERVICE: AllAccess
    File Permissions: Administrators [Allow: AllAccess]
    Possible DLL Hijacking in binary folder: C:\Program Files\SplunkUniversalForwarder\bin (Administrators [Allow: AllAccess])
    SplunkForwarder is the remote data collection service for Splunk, a data platform for operational intelligence. If it is stopped, Splunk will stop collecting and sending data to Splunk indexers, which may result in data loss. Please see www.splunk.com for more information. Questions can be submitted to www.splunk.com/answers or for supported customers www.splunk.com/page/submit_issue
   =================================================================================================
    SplunkMonitorNoHandle(Windows (R) Win 7 DDK provider - SplunkMonitorNoHandle)[system32\DRIVERS\SplunkMonitorNoHandleDrv.sys] - System
    File Permissions: Administrators [Allow: AllAccess]
    Possible DLL Hijacking in binary folder: C:\windows\system32\DRIVERS (Administrators [Allow: WriteData/CreateFiles])    SplunkMonitorNoHandle mini-filter driver
   =================================================================================================
    OpenSSH Authentication Agent(OpenSSH Authentication Agent)[C:\windows\System32\OpenSSH\ssh-agent.exe] - Manual
    Possible DLL Hijacking in binary folder: C:\windows\System32\OpenSSH (Administrators [Allow: WriteData/CreateFiles])    Agent to hold private keys used for public key authentication.
   =================================================================================================
    Sysmon64(Sysinternals - www.sysinternals.com - Sysmon64)[C:\windows\Sysmon64.exe] - Autoload
    YOU CAN MODIFY THIS SERVICE: AllAccess
    File Permissions: Administrators [Allow: AllAccess]
    Possible DLL Hijacking in binary folder: C:\windows (Administrators [Allow: WriteData/CreateFiles])
    System Monitor service
   =================================================================================================
    SysmonDrv(Sysinternals - www.sysinternals.com - SysmonDrv)[SysmonDrv.sys] - Boot
    File Permissions: Administrators [Allow: AllAccess]
    Possible DLL Hijacking in binary folder: C:\windows (Administrators [Allow: WriteData/CreateFiles])
    System Monitor driver
   =================================================================================================
    @Usb4HostRouter.inf,%Usb4HostRouter.SVCDESC%;USB4 Host Router Service(@Usb4HostRouter.inf,%Usb4HostRouter.SVCDESC%;USB4 Host Router Service)[C:\windows\System32\drivers\Usb4HostRouter.sys] - System
    File Permissions: Administrators [Allow: AllAccess]
    Possible DLL Hijacking in binary folder: C:\windows\System32\drivers (Administrators [Allow: WriteData/CreateFiles])   =================================================================================================
    @usbstor.inf,%USBSTOR.SvcDesc%;USB Mass Storage Driver(@usbstor.inf,%USBSTOR.SvcDesc%;USB Mass Storage Driver)[C:\windows\System32\drivers\USBSTOR.SYS] - System
   =================================================================================================
    @usbxhci.inf,%PCI\CC_0C0330.DeviceDesc%;USB xHCI Compliant Host Controller(@usbxhci.inf,%PCI\CC_0C0330.DeviceDesc%;USB xHCI Compliant Host Controller)[C:\windows\System32\drivers\USBXHCI.SYS] - System
   =================================================================================================
    @oem7.inf,%VirtioScsi.SVCDESC%;Red Hat VirtIO SCSI pass-through Service(Red Hat, Inc. - @oem7.inf,%VirtioScsi.SVCDESC%;Red Hat VirtIO SCSI pass-through Service)[System32\drivers\vioscsi.sys] - Boot
    Possible DLL Hijacking in binary folder: C:\windows\System32\drivers (Administrators [Allow: WriteData/CreateFiles])   =================================================================================================
    @oem5.inf,%VirtioInput.ServiceDesc%;VirtIO Input Service(Red Hat, Inc. - @oem5.inf,%VirtioInput.ServiceDesc%;VirtIO Input Service)[C:\windows\System32\drivers\vioinput.sys] - System
    Possible DLL Hijacking in binary folder: C:\windows\System32\drivers (Administrators [Allow: WriteData/CreateFiles])   =================================================================================================
    @oem8.inf,%VirtioSerial.ServiceDesc%;VirtIO Serial Service(Red Hat, Inc. - @oem8.inf,%VirtioSerial.ServiceDesc%;VirtIO Serial Service)[C:\windows\System32\drivers\vioser.sys] - System
    Possible DLL Hijacking in binary folder: C:\windows\System32\drivers (Administrators [Allow: WriteData/CreateFiles])   =================================================================================================
    @oem6.inf,%VirtRng.Service%;VirtIO RNG Service(Red Hat, Inc. - @oem6.inf,%VirtRng.Service%;VirtIO RNG Service)[C:\windows\System32\drivers\viorng.sys] - System
    Possible DLL Hijacking in binary folder: C:\windows\System32\drivers (Administrators [Allow: WriteData/CreateFiles])   =================================================================================================
    @vstxraid.inf,%Driver.DeviceDesc%;VIA StorX Storage RAID Controller Windows Driver(VIA Corporation - @vstxraid.inf,%Driver.DeviceDesc%;VIA StorX Storage RAID Controller Windows Driver)[System32\drivers\vstxraid.sys] - Boot
    File Permissions: Administrators [Allow: AllAccess]
    Possible DLL Hijacking in binary folder: C:\windows\System32\drivers (Administrators [Allow: WriteData/CreateFiles])   =================================================================================================
    @%SystemRoot%\System32\drivers\vwifibus.sys,-257(@%SystemRoot%\System32\drivers\vwifibus.sys,-257)[C:\windows\System32\drivers\vwifibus.sys] - System
    Possible DLL Hijacking in binary folder: C:\windows\System32\drivers (Administrators [Allow: WriteData/CreateFiles])    @%SystemRoot%\System32\drivers\vwifibus.sys,-258
   =================================================================================================
    @mlx4_bus.inf,%WinMad.ServiceDesc%;WinMad Service(Mellanox - @mlx4_bus.inf,%WinMad.ServiceDesc%;WinMad Service)[C:\windows\System32\drivers\winmad.sys] - System
    File Permissions: Administrators [Allow: AllAccess]
    Possible DLL Hijacking in binary folder: C:\windows\System32\drivers (Administrators [Allow: WriteData/CreateFiles])   =================================================================================================
    @winusb.inf,%WINUSB_SvcName%;WinUsb Driver(@winusb.inf,%WINUSB_SvcName%;WinUsb Driver)[C:\windows\System32\drivers\WinUSB.SYS] - System
    @winusb.inf,%WINUSB_SvcDesc%;Generic driver for USB devices
   =================================================================================================
    @mlx4_bus.inf,%WinVerbs.ServiceDesc%;WinVerbs Service(Mellanox - @mlx4_bus.inf,%WinVerbs.ServiceDesc%;WinVerbs Service)[C:\windows\System32\drivers\winverbs.sys] - System
    File Permissions: Administrators [Allow: AllAccess]
    Possible DLL Hijacking in binary folder: C:\windows\System32\drivers (Administrators [Allow: WriteData/CreateFiles])   =================================================================================================
╔══════════╣ Modifiable Services
╚ Check if you can modify any service https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#services
    LOOKS LIKE YOU CAN MODIFY OR START/STOP SOME SERVICE/s:
    AJRouter: AllAccess
    ALG: AllAccess
    AppIDSvc: AllAccess
    Appinfo: Start, AllAccess
    AppMgmt: Start, AllAccess
    AppReadiness: AllAccess
    AppVClient: AllAccess
    AppXSvc: Start, GenericExecute (Start/Stop)
    AudioEndpointBuilder: AllAccess
    Audiosrv: AllAccess
    AxInstSV: AllAccess
    BFE: WriteDac
    BITS: AllAccess
    BrokerInfrastructure: WriteDac, Start
    bthserv: AllAccess
    camsvc: AllAccess
    CDPSvc: AllAccess
    CertPropSvc: ChangeConfig
    ClipSVC: Start, WriteDac
    cloudbase-init: AllAccess
    COMSysApp: AllAccess
    CoreMessagingRegistrar: Start, GenericExecute (Start/Stop)
    CryptSvc: AllAccess
    CscService: AllAccess
    DcomLaunch: WriteDac
    defragsvc: AllAccess
    DeviceAssociationService: AllAccess
    DeviceInstall: AllAccess
    DevQueryBroker: AllAccess
    Dhcp: AllAccess
    diagnosticshub.standardcollector.service: AllAccess
    DiagTrack: AllAccess
    DispBrokerDesktopSvc: AllAccess
    DmEnrollmentSvc: AllAccess
    dmwappushservice: Start, AllAccess
    DoSvc: AllAccess
    dot3svc: AllAccess
    DPS: ChangeConfig
    DsmSvc: AllAccess, Start
    DsSvc: Start, AllAccess
    EapHost: AllAccess
    edgeupdate: AllAccess


_raw:
    Logon Time:                   11/5/2025 5:37:58 PM
    Logon Type:                   Interactive
    Start Time:
    Domain:                       Font Driver Host
    Authentication Package:       Negotiate
    Start Time:
    User Name:                    UMFD-0
    User Principal Name:          DECKHAND-01$@allports.local
    User SID:                     S-1-5-96-0-0
   =================================================================================================
    Method:                       LSA
    Logon Server:
    Logon Server Dns Domain:      allports.local
    Logon Id:                     121226683


_raw:
    Logon Time:                   11/5/2025 5:37:58 PM
    Logon Type:                   Service
    Start Time:
    Domain:                       APT
    Authentication Package:       Negotiate
    Start Time:
    User Name:                    DECKHAND-01$
    User Principal Name:          DECKHAND-01$@allports.local
    User SID:                     S-1-5-20
   =================================================================================================
    Method:                       LSA
    Logon Server:
    Logon Server Dns Domain:      allports.local
    Logon Id:                     23524


_raw:
    Logon Time:                   11/5/2025 5:37:58 PM
    Logon Type:                   Interactive
    Start Time:
    Domain:                       Window Manager
    Authentication Package:       Negotiate
    Start Time:
    User Name:                    DWM-1
    User Principal Name:
    User SID:                     S-1-5-90-0-1
   =================================================================================================
    Method:                       LSA
    Logon Server:
    Logon Server Dns Domain:      allports.local
    Logon Id:                     996


_raw:
    Folder: None (PATH Injection)
    File: wdmaud.drv
   =================================================================================================
    RegPath: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Drivers32
    RegPerms: Administrators [Allow: FullControl GenericAll]
    Key: wavemapper
    Folder: None (PATH Injection)
    File: msacm32.drv
   =================================================================================================
    RegPath: HKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32
    RegPerms: Administrators [Allow: FullControl GenericAll]
    Key: aux
    Folder: None (PATH Injection)
    File: wdmaud.drv
   =================================================================================================
    RegPath: HKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32
    RegPerms: Administrators [Allow: FullControl GenericAll]
    Key: midi
    Folder: None (PATH Injection)
    File: wdmaud.drv
   =================================================================================================
    RegPath: HKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32
    RegPerms: Administrators [Allow: FullControl GenericAll]
    Key: midimapper
    Folder: None (PATH Injection)
    File: midimap.dll
   =================================================================================================
    RegPath: HKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32
    RegPerms: Administrators [Allow: FullControl GenericAll]
    Key: mixer
    Folder: None (PATH Injection)
    File: wdmaud.drv
   =================================================================================================
    RegPath: HKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32
    RegPerms: Administrators [Allow: FullControl GenericAll]
    Key: msacm.imaadpcm
    Folder: None (PATH Injection)
    File: imaadp32.acm
   =================================================================================================
    RegPath: HKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32
    RegPerms: Administrators [Allow: FullControl GenericAll]
    Key: msacm.l3acm
    Folder: C:\Windows\SysWOW64
    FolderPerms: Administrators [Allow: WriteData/CreateFiles]
    File: C:\Windows\SysWOW64\l3codeca.acm
   =================================================================================================
    RegPath: HKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32
    RegPerms: Administrators [Allow: FullControl GenericAll]
    Key: msacm.msadpcm
    Folder: None (PATH Injection)
    File: msadp32.acm
   =================================================================================================
    RegPath: HKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32
    RegPerms: Administrators [Allow: FullControl GenericAll]
    Key: msacm.msg711
    Folder: None (PATH Injection)
    File: msg711.acm
   =================================================================================================
    RegPath: HKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32
    RegPerms: Administrators [Allow: FullControl GenericAll]
    Key: msacm.msgsm610
    Folder: None (PATH Injection)
    File: msgsm32.acm
   =================================================================================================
    RegPath: HKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32
    RegPerms: Administrators [Allow: FullControl GenericAll]
    Key: vidc.cvid
    Folder: None (PATH Injection)
    File: iccvid.dll
   =================================================================================================
    RegPath: HKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32
    RegPerms: Administrators [Allow: FullControl GenericAll]
    Key: vidc.i420
    Folder: None (PATH Injection)
    File: iyuv_32.dll
   =================================================================================================
    RegPath: HKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32
    RegPerms: Administrators [Allow: FullControl GenericAll]
    Key: vidc.iyuv
    Folder: None (PATH Injection)
    File: iyuv_32.dll
   =================================================================================================
    RegPath: HKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32
    RegPerms: Administrators [Allow: FullControl GenericAll]
    Key: vidc.mrle
    Folder: None (PATH Injection)
    File: msrle32.dll
   =================================================================================================
    RegPath: HKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32
    RegPerms: Administrators [Allow: FullControl GenericAll]
    Key: vidc.msvc
    Folder: None (PATH Injection)
    File: msvidc32.dll
   =================================================================================================
    RegPath: HKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32
    RegPerms: Administrators [Allow: FullControl GenericAll]
    Key: vidc.uyvy
    Folder: None (PATH Injection)
    File: msyuv.dll
   =================================================================================================
    RegPath: HKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32
    RegPerms: Administrators [Allow: FullControl GenericAll]
    Key: vidc.yuy2
    Folder: None (PATH Injection)
    File: msyuv.dll
   =================================================================================================
    RegPath: HKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32
    RegPerms: Administrators [Allow: FullControl GenericAll]
    Key: vidc.yvu9
    Folder: None (PATH Injection)
    File: tsbyuv.dll
   =================================================================================================
    RegPath: HKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32
    RegPerms: Administrators [Allow: FullControl GenericAll]
    Key: vidc.yvyu
    Folder: None (PATH Injection)
    File: msyuv.dll
   =================================================================================================
    RegPath: HKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32
    RegPerms: Administrators [Allow: FullControl GenericAll]
    Key: wave
    Folder: None (PATH Injection)
    File: wdmaud.drv
   =================================================================================================
    RegPath: HKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32
    RegPerms: Administrators [Allow: FullControl GenericAll]
    Key: wavemapper
    Folder: None (PATH Injection)
    File: msacm32.drv
   =================================================================================================
    RegPath: HKLM\Software\Classes\htmlfile\shell\open\command
    RegPerms: Administrators [Allow: FullControl GenericAll]
    Folder: C:\Program Files\Internet Explorer
    FolderPerms: Administrators [Allow: WriteData/CreateFiles]
    File: C:\Program Files\Internet Explorer\iexplore.exe %1 (Unquoted and Space detected) - C:\,C:\Program Files,C:\Program Files\Internet Explorer\iexplore.exe
   =================================================================================================
    RegPath: HKLM\System\CurrentControlSet\Control\Session Manager\KnownDlls
    Key: *kernel32
    Folder: None (PATH Injection)
    File: kernel32.dll
   =================================================================================================
    RegPath: HKLM\System\CurrentControlSet\Control\Session Manager\KnownDlls
    Key: _wow64cpu
    Folder: None (PATH Injection)
    File: wow64cpu.dll
   =================================================================================================
    RegPath: HKLM\System\CurrentControlSet\Control\Session Manager\KnownDlls
    Key: _wowarmhw
    Folder: None (PATH Injection)
    File: wowarmhw.dll
   =================================================================================================
    RegPath: HKLM\System\CurrentControlSet\Control\Session Manager\KnownDlls
    Key: _xtajit
    Folder: None (PATH Injection)
    File: xtajit.dll
   =================================================================================================
    RegPath: HKLM\System\CurrentControlSet\Control\Session Manager\KnownDlls
    Key: _xtajit64
    Folder: None (PATH Injection)
    File: xtajit64.dll
   =================================================================================================
    RegPath: HKLM\System\CurrentControlSet\Control\Session Manager\KnownDlls
    Key: advapi32
    Folder: None (PATH Injection)
    File: advapi32.dll
   =================================================================================================
    RegPath: HKLM\System\CurrentControlSet\Control\Session Manager\KnownDlls
    Key: clbcatq
    Folder: None (PATH Injection)
    File: clbcatq.dll
   =================================================================================================
    RegPath: HKLM\System\CurrentControlSet\Control\Session Manager\KnownDlls
    Key: combase
    Folder: None (PATH Injection)
    File: combase.dll
   =================================================================================================
    RegPath: HKLM\System\CurrentControlSet\Control\Session Manager\KnownDlls
    Key: COMDLG32
    Folder: None (PATH Injection)
    File: COMDLG32.dll
   =================================================================================================
    RegPath: HKLM\System\CurrentControlSet\Control\Session Manager\KnownDlls
    Key: coml2
    Folder: None (PATH Injection)
    File: coml2.dll
   =================================================================================================
    RegPath: HKLM\System\CurrentControlSet\Control\Session Manager\KnownDlls
    Key: DifxApi
    Folder: None (PATH Injection)
    File: difxapi.dll
   =================================================================================================
    RegPath: HKLM\System\CurrentControlSet\Control\Session Manager\KnownDlls
    Key: gdi32
    Folder: None (PATH Injection)
    File: gdi32.dll
   =================================================================================================
    RegPath: HKLM\System\CurrentControlSet\Control\Session Manager\KnownDlls
    Key: gdiplus
    Folder: None (PATH Injection)
    File: gdiplus.dll
   =================================================================================================
    RegPath: HKLM\System\CurrentControlSet\Control\Session Manager\KnownDlls
    Key: IMAGEHLP
    Folder: None (PATH Injection)
    File: IMAGEHLP.dll
   =================================================================================================
    RegPath: HKLM\System\CurrentControlSet\Control\Session Manager\KnownDlls
    Key: IMM32
    Folder: None (PATH Injection)
    File: IMM32.dll
   =================================================================================================
    RegPath: HKLM\System\CurrentControlSet\Control\Session Manager\KnownDlls
    Key: MSCTF
    Folder: None (PATH Injection)
    File: MSCTF.dll
   =================================================================================================
    RegPath: HKLM\System\CurrentControlSet\Control\Session Manager\KnownDlls
    Key: MSVCRT
    Folder: None (PATH Injection)
    File: MSVCRT.dll
   =================================================================================================
    RegPath: HKLM\System\CurrentControlSet\Control\Session Manager\KnownDlls
    Key: NORMALIZ
    Folder: None (PATH Injection)
    File: NORMALIZ.dll
   =================================================================================================
    RegPath: HKLM\System\CurrentControlSet\Control\Session Manager\KnownDlls
    Key: NSI
    Folder: None (PATH Injection)
    File: NSI.dll
   =================================================================================================
    RegPath: HKLM\System\CurrentControlSet\Control\Session Manager\KnownDlls
    Key: ole32
    Folder: None (PATH Injection)
    File: ole32.dll
   =================================================================================================
    RegPath: HKLM\System\CurrentControlSet\Control\Session Manager\KnownDlls
    Key: OLEAUT32
    Folder: None (PATH Injection)
    File: OLEAUT32.dll
   =================================================================================================
    RegPath: HKLM\System\CurrentControlSet\Control\Session Manager\KnownDlls
    Key: PSAPI
    Folder: None (PATH Injection)
    File: PSAPI.DLL
   =================================================================================================
    RegPath: HKLM\System\CurrentControlSet\Control\Session Manager\KnownDlls
    Key: rpcrt4
    Folder: None (PATH Injection)
    File: rpcrt4.dll
   =================================================================================================
    RegPath: HKLM\System\CurrentControlSet\Control\Session Manager\KnownDlls
    Key: sechost
    Folder: None (PATH Injection)
    File: sechost.dll
   =================================================================================================
    RegPath: HKLM\System\CurrentControlSet\Control\Session Manager\KnownDlls


_raw:
    HKLM\system\currentcontrolset\services\volume (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\vpci (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\vsmraid (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\VSS (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\VSTXRAID (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\vwifibus (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\W32Time (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\WaaSMedicSvc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\WacomPen (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\WalletService (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\wanarp (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\wanarpv6 (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\WarpJITSvc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\WbioSrvc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\wcifs (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\Wcmsvc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\WdBoot (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\Wdf01000 (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\WdFilter (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\WdmCompanionFilter (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\WdNisDrv (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\WdNisSvc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\Wecsvc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\WEPHOSTSVC (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\wercplsupport (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\WerSvc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\WFPLWFS (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\WiaRpc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\WIMMount (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\WinDefend (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\Windows Workflow Foundation 4.0.0.0 (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\WindowsTrustedRT (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\WindowsTrustedRTProxy (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\WinHttpAutoProxySvc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\WinMad (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\Winmgmt (Administrators [Allow: GenericAll FullControl])
    HKLM\system\currentcontrolset\services\WinNat (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\WinRM (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\Winsock (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\WinSock2 (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\WINUSB (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\WinVerbs (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\wisvc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\wlidsvc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\WmiAcpi (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\WmiApRpl (Administrators [Allow: GenericAll FullControl])
    HKLM\system\currentcontrolset\services\wmiApSrv (Administrators [Allow: GenericAll FullControl])
    HKLM\system\currentcontrolset\services\WMPNetworkSvc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\Wof (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\workerdd (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\WPDBusEnum (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\WpdUpFltr (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\WpnService (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\WpnUserService (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\WpnUserService_73dcad9 (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\ws2ifsl (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\WSearch (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\WSearchIdxPi (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\wuauserv (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\WudfPf (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\WUDFRd (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\xmlprov (Administrators [Allow: FullControl GenericAll])
╔══════════╣ Checking write permissions in PATH folders (DLL Hijacking)
╚ Check for DLL Hijacking in PATH folders https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#dll-hijacking
    (DLL Hijacking) C:\windows\system32: Administrators [Allow: WriteData/CreateFiles]
    (DLL Hijacking) C:\windows: Administrators [Allow: WriteData/CreateFiles]
    (DLL Hijacking) C:\windows\System32\Wbem: Administrators [Allow: WriteData/CreateFiles]
    (DLL Hijacking) C:\windows\System32\WindowsPowerShell\v1.0\: Administrators [Allow: WriteData/CreateFiles]
    (DLL Hijacking) C:\windows\System32\OpenSSH\: Administrators [Allow: WriteData/CreateFiles]
    (DLL Hijacking) C:\ProgramData\chocolatey\bin: Administrators [Allow: AllAccess]
════════════════════════════════════╣ Applications Information ╠════════════════════════════════════
╔══════════╣ Current Active Window Application
    Administrator: Windows PowerShell
╔══════════╣ Installed Applications --Via Program Files/Uninstall registry--
╚ Check if you can modify installed software https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#applications
    C:\Program Files\Cloudbase Solutions(Administrators [Allow: AllAccess])
    C:\Program Files\Common Files(Administrators [Allow: WriteData/CreateFiles])
    C:\Program Files\desktop.ini(Administrators [Allow: AllAccess])
    C:\Program Files\Google(Administrators [Allow: AllAccess])
    C:\Program Files\Internet Explorer(Administrators [Allow: WriteData/CreateFiles])
    C:\Program Files\ModifiableWindowsApps
    C:\Program Files\Mozilla Firefox(Administrators [Allow: AllAccess])
    C:\Program Files\Poseidon Booking(Users [Allow: WriteData/CreateFiles], Administrators [Allow: AllAccess])
    C:\Program Files\Qemu-ga(Administrators [Allow: AllAccess])
    C:\Program Files\SplunkUniversalForwarder(Administrators [Allow: AllAccess])
    C:\Program Files\Uninstall Information(Administrators [Allow: AllAccess])
    C:\Program Files\Windows Defender(Administrators [Allow: WriteData/CreateFiles])
    C:\Program Files\Windows Defender Advanced Threat Protection(Administrators [Allow: WriteData/CreateFiles])
    C:\Program Files\Windows Mail(Administrators [Allow: WriteData/CreateFiles])
    C:\Program Files\Windows Media Player(Administrators [Allow: WriteData/CreateFiles])
    C:\Program Files\Windows NT(Administrators [Allow: WriteData/CreateFiles])
    C:\Program Files\Windows Photo Viewer(Administrators [Allow: WriteData/CreateFiles])
    C:\Program Files\Windows Sidebar(Administrators [Allow: WriteData/CreateFiles])
    C:\Program Files\WindowsApps
    C:\Program Files\WindowsPowerShell(Administrators [Allow: WriteData/CreateFiles])
╔══════════╣ Autorun Applications
╚ Check if you can modify other users AutoRuns binaries (Note that is normal that you can modify HKCU registry and binaries indicated there) https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/privilege-escalation-with-autorun-binaries.html
Error getting autoruns from WMIC: System.UnauthorizedAccessException
   at System.Runtime.InteropServices.Marshal.ThrowExceptionForHRInternal(Int32 errorCode, IntPtr errorInfo)
   at System.Management.ManagementObjectCollection.ManagementObjectEnumerator.MoveNext()
   at winPEAS.Info.ApplicationInfo.AutoRuns.GetAutoRunsWMIC()
    RegPath: HKLM\Software\Microsoft\Windows\CurrentVersion\Run
    RegPerms: Administrators [Allow: FullControl GenericAll]
    Key: SecurityHealth
    Folder: C:\windows\system32
    FolderPerms: Administrators [Allow: WriteData/CreateFiles]
    File: C:\windows\system32\SecurityHealthSystray.exe
   =================================================================================================
    RegPath: HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
    RegPerms: Administrators [Allow: FullControl GenericAll]
    Key: Common Startup
    Folder: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
    FolderPerms: Administrators [Allow: AllAccess] (Unquoted and Space detected) - C:\ProgramData\Microsoft\Windows,C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
   =================================================================================================
    RegPath: HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
    RegPerms: Administrators [Allow: GenericAll FullControl]
    Key: Common Startup
    Folder: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
    FolderPerms: Administrators [Allow: AllAccess] (Unquoted and Space detected) - C:\ProgramData\Microsoft\Windows,C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
   =================================================================================================
    RegPath: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
    RegPerms: Administrators [Allow: FullControl GenericAll]
    Key: Userinit
    Folder: C:\windows\system32
    FolderPerms: Administrators [Allow: WriteData/CreateFiles]
    File: C:\windows\system32\userinit.exe,
   =================================================================================================
    RegPath: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
    RegPerms: Administrators [Allow: FullControl GenericAll]
    Key: Shell
    Folder: None (PATH Injection)
    File: explorer.exe
   =================================================================================================
    RegPath: HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot
    RegPerms: Administrators [Allow: FullControl]
    Key: AlternateShell
    Folder: None (PATH Injection)
    File: cmd.exe
   =================================================================================================
    RegPath: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Font Drivers
    RegPerms: Administrators [Allow: FullControl GenericAll]
    Key: Adobe Type Manager
    Folder: None (PATH Injection)
    File: atmfd.dll
   =================================================================================================
    RegPath: HKLM\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Font Drivers
    RegPerms: Administrators [Allow: FullControl GenericAll]
    Key: Adobe Type Manager
    Folder: None (PATH Injection)
    File: atmfd.dll
   =================================================================================================
    RegPath: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Drivers32
    RegPerms: Administrators [Allow: FullControl GenericAll]
    Key: aux
    Folder: None (PATH Injection)
    File: wdmaud.drv
   =================================================================================================
    RegPath: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Drivers32
    RegPerms: Administrators [Allow: FullControl GenericAll]
    Key: midi
    Folder: None (PATH Injection)
    File: wdmaud.drv
   =================================================================================================
    RegPath: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Drivers32
    RegPerms: Administrators [Allow: FullControl GenericAll]
    Key: midimapper
    Folder: None (PATH Injection)
    File: midimap.dll
   =================================================================================================
    RegPath: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Drivers32
    RegPerms: Administrators [Allow: FullControl GenericAll]
    Key: mixer
    Folder: None (PATH Injection)
    File: wdmaud.drv
   =================================================================================================
    RegPath: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Drivers32
    RegPerms: Administrators [Allow: FullControl GenericAll]
    Key: msacm.imaadpcm
    Folder: None (PATH Injection)
    File: imaadp32.acm
   =================================================================================================
    RegPath: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Drivers32
    RegPerms: Administrators [Allow: FullControl GenericAll]
    Key: msacm.l3acm
    Folder: C:\Windows\System32
    FolderPerms: Administrators [Allow: WriteData/CreateFiles]
    File: C:\Windows\System32\l3codeca.acm
   =================================================================================================
    RegPath: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Drivers32
    RegPerms: Administrators [Allow: FullControl GenericAll]
    Key: msacm.msadpcm
    Folder: None (PATH Injection)
    File: msadp32.acm
   =================================================================================================
    RegPath: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Drivers32
    RegPerms: Administrators [Allow: FullControl GenericAll]
    Key: msacm.msg711
    Folder: None (PATH Injection)
    File: msg711.acm
   =================================================================================================
    RegPath: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Drivers32
    RegPerms: Administrators [Allow: FullControl GenericAll]
    Key: msacm.msgsm610
    Folder: None (PATH Injection)
    File: msgsm32.acm
   =================================================================================================
    RegPath: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Drivers32
    RegPerms: Administrators [Allow: FullControl GenericAll]
    Key: vidc.i420
    Folder: None (PATH Injection)
    File: iyuv_32.dll
   =================================================================================================
    RegPath: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Drivers32
    RegPerms: Administrators [Allow: FullControl GenericAll]
    Key: vidc.iyuv
    Folder: None (PATH Injection)
    File: iyuv_32.dll
   =================================================================================================
    RegPath: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Drivers32
    RegPerms: Administrators [Allow: FullControl GenericAll]
    Key: vidc.mrle
    Folder: None (PATH Injection)
    File: msrle32.dll
   =================================================================================================
    RegPath: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Drivers32
    RegPerms: Administrators [Allow: FullControl GenericAll]
    Key: vidc.msvc
    Folder: None (PATH Injection)
    File: msvidc32.dll
   =================================================================================================
    RegPath: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Drivers32
    RegPerms: Administrators [Allow: FullControl GenericAll]
    Key: vidc.uyvy
    Folder: None (PATH Injection)
    File: msyuv.dll
   =================================================================================================
    RegPath: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Drivers32
    RegPerms: Administrators [Allow: FullControl GenericAll]
    Key: vidc.yuy2
    Folder: None (PATH Injection)
    File: msyuv.dll
   =================================================================================================
    RegPath: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Drivers32
    RegPerms: Administrators [Allow: FullControl GenericAll]
    Key: vidc.yvu9
    Folder: None (PATH Injection)
    File: tsbyuv.dll
   =================================================================================================
    RegPath: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Drivers32
    RegPerms: Administrators [Allow: FullControl GenericAll]
    Key: vidc.yvyu
    Folder: None (PATH Injection)
    File: msyuv.dll
   =================================================================================================
    RegPath: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Drivers32
    RegPerms: Administrators [Allow: FullControl GenericAll]
    Key: wave