_raw:
    Key: wow64con
    Folder: None (PATH Injection)
    File: wow64con.dll
   =================================================================================================
    RegPath: HKLM\System\CurrentControlSet\Control\Session Manager\KnownDlls
    Key: wow64win
    Folder: None (PATH Injection)
    File: wow64win.dll
   =================================================================================================
    RegPath: HKLM\System\CurrentControlSet\Control\Session Manager\KnownDlls
    Key: WS2_32
    Folder: None (PATH Injection)
    File: WS2_32.dll
   =================================================================================================
    RegPath: HKLM\Software\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}
    RegPerms: Administrators [Allow: FullControl]
    Key: StubPath
    Folder: \
    FolderPerms: Administrators [Allow: AllAccess], Users [Allow: AllAccess]
    File: /UserInstall
   =================================================================================================
    RegPath: HKLM\Software\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}
    RegPerms: Administrators [Allow: FullControl]
    Key: StubPath
    Folder: C:\windows\system32
    FolderPerms: Administrators [Allow: WriteData/CreateFiles]
    File: C:\windows\system32\unregmp2.exe /FirstLogon
   =================================================================================================
    RegPath: HKLM\Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4340}
    RegPerms: Administrators [Allow: FullControl]
    Key: StubPath
    Folder: None (PATH Injection)
    File: U
   =================================================================================================
    RegPath: HKLM\Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}
    RegPerms: Administrators [Allow: FullControl]
    Key: StubPath
    Folder: C:\Windows\System32
    FolderPerms: Administrators [Allow: WriteData/CreateFiles]
    File: C:\Windows\System32\ie4uinit.exe -UserConfig
   =================================================================================================
    RegPath: HKLM\Software\Microsoft\Active Setup\Installed Components\{89B4C1CD-B018-4511-B0A1-5476DBF70820}
    RegPerms: Administrators [Allow: FullControl]
    Key: StubPath
    Folder: C:\Windows\System32
    FolderPerms: Administrators [Allow: WriteData/CreateFiles]
    File: C:\Windows\System32\Rundll32.exe C:\Windows\System32\mscories.dll,Install
   =================================================================================================
    RegPath: HKLM\Software\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}
    RegPerms: Administrators [Allow: FullControl]
    Key: StubPath
    Folder: C:\Program Files\Google\Chrome\Application\142.0.7444.60\Installer
    FolderPerms: Administrators [Allow: AllAccess]
    File: C:\Program Files\Google\Chrome\Application\142.0.7444.60\Installer\chrmstp.exe --configure-user-settings --verbose-logging --system-level --channel=stable (Unquoted and Space detected) - C:\
   =================================================================================================
    RegPath: HKLM\Software\Microsoft\Active Setup\Installed Components\{9459C573-B17A-45AE-9F64-1857B5D58CEE}
    RegPerms: Administrators [Allow: FullControl]
    Key: StubPath
    Folder: C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.53\Installer
    FolderPerms: Administrators [Allow: AllAccess]
    File: C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.53\Installer\setup.exe --configure-user-settings --verbose-logging --system-level --msedge --channel=stable (Unquoted and Space detected) - C:\,C:\Program Files
   =================================================================================================
    RegPath: HKLM\Software\Microsoft\Active Setup\Installed Components\{A509B1A7-37EF-4b3f-8CFC-4F3A74704073}
    RegPerms: Administrators [Allow: FullControl]
    Key: StubPath
    Folder: C:\Windows\System32
    FolderPerms: Administrators [Allow: WriteData/CreateFiles]
    File: C:\Windows\System32\rundll32.exe C:\Windows\System32\iesetup.dll,IEHardenAdmin
   =================================================================================================
    RegPath: HKLM\Software\Microsoft\Active Setup\Installed Components\{A509B1A8-37EF-4b3f-8CFC-4F3A74704073}
    RegPerms: Administrators [Allow: FullControl]
    Key: StubPath
    Folder: C:\Windows\System32
    FolderPerms: Administrators [Allow: WriteData/CreateFiles]
    File: C:\Windows\System32\rundll32.exe C:\Windows\System32\iesetup.dll,IEHardenUser
   =================================================================================================
    RegPath: HKLM\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}
    RegPerms: Administrators [Allow: FullControl]
    Key: StubPath
    Folder: C:\windows\system32
    FolderPerms: Administrators [Allow: WriteData/CreateFiles]
    File: C:\windows\system32\unregmp2.exe /FirstLogon
   =================================================================================================
    RegPath: HKLM\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{89B4C1CD-B018-4511-B0A1-5476DBF70820}
    RegPerms: Administrators [Allow: FullControl]
    Key: StubPath
    Folder: C:\Windows\SysWOW64
    FolderPerms: Administrators [Allow: WriteData/CreateFiles]
    File: C:\Windows\SysWOW64\Rundll32.exe C:\Windows\SysWOW64\mscories.dll,Install
   =================================================================================================
    RegPath: HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}
    RegPerms: Administrators [Allow: FullControl GenericAll]
    Folder: C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.53\BHO
    FolderPerms: Administrators [Allow: AllAccess]
    File: C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.53\BHO\ie_to_edge_bho_64.dll (Unquoted and Space detected) - C:\,C:\Program Files
   =================================================================================================
    RegPath: HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}
    RegPerms: Administrators [Allow: FullControl GenericAll]
    Folder: C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.53\BHO
    FolderPerms: Administrators [Allow: AllAccess]
    File: C:\Program Files (x86)\Microsoft\Edge\Application\142.0.3595.53\BHO\ie_to_edge_bho_64.dll (Unquoted and Space detected) - C:\,C:\Program Files
   =================================================================================================
    Folder: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
    FolderPerms: Administrators [Allow: AllAccess]
    File: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\cptclogging.exe (Unquoted and Space detected) - C:\ProgramData\Microsoft\Windows,C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\cptclogging.exe
    FilePerms: Administrators [Allow: AllAccess]
    Potentially sensitive file content: MZ????@????!?L?!This program cannot be run in DOS mode., }W??0??j??9??-Y?J?X???????~???+?????fqm?k$??????F???;?4<?nX??@??Z??3?'7?0?]T??????c?#+3??)?}, $?]u??w??P???,?????|~??g?T?2Ie?>?1??P?2d??>h?@?h?r??p"?O??Y?4?H?t%??JB??E?6Y??=?Xu'???:???d3?vsA?V?*???O]$?[?L??R??dm???b??Y3e??????????-?R??Q ??/U?*6N??`?(b??/??`S/?*x??0???Y????9E$h????pB?U??????f~'??y???H|^?????D1O??7??OE G???d??;????Iu_?&.`?K?l/9Nd?????8?P/?h?W%g9Y??????:????K?-,??0_o?D?YS?2Y, &?~2C?x?)?[B"?b????W??N0??|?????'"???H?kqP?k???:??/h?x?q??j@?ak???m?p7??&??q?#??l3?b??Y9????c???F????E?O?k?b?FK?????{?Ig???????????%Q]???69ZY"???Zx??#f??@?f?P??UQ?$?|?(e??b??5??2h?????/Q"<?;?????&???!?x?????1^?%i???Ere?????5PN|??L??DX?+?? @6-??Jd??nn?l???_??6C?=?My?5?%??kG6;???{???"?*???{j?_%?1U]`@????\{?/?s??Y[.fq?H9|??X??, ?y?????m??o????}AY7N??h?????}?Ih?·?yG-1?R*?L??????=P?U43?[?,f???w?A?T???I?t??D???Cz?? ???7g?$sM???Ct?????z??MK@???o?????c??>??i+???)????a?, 1??_4??e\O?;???R?Y??q????1~l?23e????H)v?[?cQ??5??~ ]??*?<???Y???????h????4?wP???!G???Y.?,2%?~?ifE?S$?U????X?#'m?a?p?F?Z?????????K???$?@L?X?AD???t?[?R#?H2?;?_xCi?=?i???=?????z??{?]?N?1?n?$HP?Dv???K??w?????L?h?g?;Q?a?#*+:?6????fRd?P??1??}?L? ??%?X??vq]6qoPa??c1B???.zh??W?I???U??85??<?6n?TqT9??**v?fTj?rl4?*?5x????kqr"
   =================================================================================================
    Folder: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
    FolderPerms: Administrators [Allow: AllAccess]
    File: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini (Unquoted and Space detected) - C:\ProgramData\Microsoft\Windows,C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
    FilePerms: Administrators [Allow: AllAccess]
    Potentially sensitive file content: LocalizedResourceName=@%SystemRoot%\system32\shell32.dll,-21787
   =================================================================================================
    Folder: C:\Users\Guest\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
    FolderPerms: Administrators [Allow: AllAccess], Guest [Allow: AllAccess]
    File: C:\Users\Guest\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini (Unquoted and Space detected) - C:\Users\Guest\AppData\Roaming\Microsoft\Windows,C:\Users\Guest\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
    FilePerms: Administrators [Allow: AllAccess], Guest [Allow: AllAccess]
    Potentially sensitive file content: LocalizedResourceName=@%SystemRoot%\system32\shell32.dll,-21787
   =================================================================================================
    Folder: C:\windows\tasks
    FolderPerms: Administrators [Allow: AllAccess]
   =================================================================================================
    Folder: C:\windows\system32\tasks
    FolderPerms: Administrators [Allow: AllAccess]
   =================================================================================================
    Folder: C:\windows
    FolderPerms: Administrators [Allow: WriteData/CreateFiles]
    File: C:\windows\system.ini
    FilePerms: Administrators [Allow: AllAccess]
   =================================================================================================
    Folder: C:\windows
    FolderPerms: Administrators [Allow: WriteData/CreateFiles]
    File: C:\windows\win.ini
    FilePerms: Administrators [Allow: AllAccess]
   =================================================================================================
╔══════════╣ Scheduled Applications --Non Microsoft--
╚ Check if you can modify other users scheduled binaries https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/privilege-escalation-with-autorun-binaries.html
    (NT AUTHORITY\SYSTEM) GoogleUpdaterTaskSystem143.0.7482.0{B5B08ED8-D20D-4B28-9E47-CFC5CE7FE26A}: "C:\Program Files (x86)\Google\GoogleUpdater\143.0.7482.0\updater.exe" --wake --system
    Trigger: At log on of any user
             At 12:44 PM every day-After triggered, repeat every 01:00:00 for a duration of 1.00:00:00.
   =================================================================================================
    (Mozilla) Firefox Background Update S-1-5-21-2288084429-921088559-2964959546-501 308046B0AF4A39CB: C:\Program Files\Mozilla Firefox\firefox.exe --MOZ_LOG sync,prependheader,timestamp,append,maxsize:1,Dump:5 --MOZ_LOG_FILE C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\backgroundupdate.moz_log --backgroundtask backgroundupdate
    Permissions file: Administrators [Allow: AllAccess]
    Permissions folder(DLL Hijacking): Administrators [Allow: AllAccess]


_raw:
    RegPerms: Administrators [Allow: FullControl GenericAll]
    Key: msacm.l3acm
    Folder: C:\Windows\SysWOW64
    FolderPerms: Administrators [Allow: WriteData/CreateFiles]
    File: C:\Windows\SysWOW64\l3codeca.acm
   =================================================================================================
    RegPath: HKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32
    RegPerms: Administrators [Allow: FullControl GenericAll]
    Key: msacm.msadpcm
    Folder: None (PATH Injection)
    File: msadp32.acm
   =================================================================================================
    RegPath: HKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32
    RegPerms: Administrators [Allow: FullControl GenericAll]
    Key: msacm.msg711
    Folder: None (PATH Injection)
    File: msg711.acm
   =================================================================================================
    RegPath: HKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32
    RegPerms: Administrators [Allow: FullControl GenericAll]
    Key: msacm.msgsm610
    Folder: None (PATH Injection)
    File: msgsm32.acm
   =================================================================================================
    RegPath: HKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32
    RegPerms: Administrators [Allow: FullControl GenericAll]
    Key: vidc.cvid
    Folder: None (PATH Injection)
    File: iccvid.dll
   =================================================================================================
    RegPath: HKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32
    RegPerms: Administrators [Allow: FullControl GenericAll]
    Key: vidc.i420
    Folder: None (PATH Injection)
    File: iyuv_32.dll
   =================================================================================================
    RegPath: HKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32
    RegPerms: Administrators [Allow: FullControl GenericAll]
    Key: vidc.iyuv
    Folder: None (PATH Injection)
    File: iyuv_32.dll
   =================================================================================================
    RegPath: HKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32
    RegPerms: Administrators [Allow: FullControl GenericAll]
    Key: vidc.mrle
    Folder: None (PATH Injection)
    File: msrle32.dll
   =================================================================================================
    RegPath: HKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32
    RegPerms: Administrators [Allow: FullControl GenericAll]
    Key: vidc.msvc
    Folder: None (PATH Injection)
    File: msvidc32.dll
   =================================================================================================
    RegPath: HKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32
    RegPerms: Administrators [Allow: FullControl GenericAll]
    Key: vidc.uyvy
    Folder: None (PATH Injection)
    File: msyuv.dll
   =================================================================================================
    RegPath: HKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32
    RegPerms: Administrators [Allow: FullControl GenericAll]
    Key: vidc.yuy2
    Folder: None (PATH Injection)
    File: msyuv.dll
   =================================================================================================
    RegPath: HKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32
    RegPerms: Administrators [Allow: FullControl GenericAll]
    Key: vidc.yvu9
    Folder: None (PATH Injection)
    File: tsbyuv.dll
   =================================================================================================
    RegPath: HKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32
    RegPerms: Administrators [Allow: FullControl GenericAll]
    Key: vidc.yvyu
    Folder: None (PATH Injection)
    File: msyuv.dll
   =================================================================================================
    RegPath: HKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32
    RegPerms: Administrators [Allow: FullControl GenericAll]
    Key: wave
    Folder: None (PATH Injection)
    File: wdmaud.drv
   =================================================================================================
    RegPath: HKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32
    RegPerms: Administrators [Allow: FullControl GenericAll]
    Key: wavemapper
    Folder: None (PATH Injection)
    File: msacm32.drv
   =================================================================================================
    RegPath: HKLM\Software\Classes\htmlfile\shell\open\command
    RegPerms: Administrators [Allow: FullControl GenericAll]
    Folder: C:\Program Files\Internet Explorer
    FolderPerms: Administrators [Allow: WriteData/CreateFiles]
    File: C:\Program Files\Internet Explorer\iexplore.exe %1 (Unquoted and Space detected) - C:\,C:\Program Files,C:\Program Files\Internet Explorer\iexplore.exe
   =================================================================================================
    RegPath: HKLM\System\CurrentControlSet\Control\Session Manager\KnownDlls
    Key: *kernel32
    Folder: None (PATH Injection)
    File: kernel32.dll
   =================================================================================================
    RegPath: HKLM\System\CurrentControlSet\Control\Session Manager\KnownDlls
    Key: _wow64cpu
    Folder: None (PATH Injection)
    File: wow64cpu.dll
   =================================================================================================
    RegPath: HKLM\System\CurrentControlSet\Control\Session Manager\KnownDlls
    Key: _wowarmhw
    Folder: None (PATH Injection)
    File: wowarmhw.dll
   =================================================================================================
    RegPath: HKLM\System\CurrentControlSet\Control\Session Manager\KnownDlls
    Key: _xtajit
    Folder: None (PATH Injection)
    File: xtajit.dll
   =================================================================================================
    RegPath: HKLM\System\CurrentControlSet\Control\Session Manager\KnownDlls
    Key: _xtajit64
    Folder: None (PATH Injection)
    File: xtajit64.dll
   =================================================================================================
    RegPath: HKLM\System\CurrentControlSet\Control\Session Manager\KnownDlls
    Key: advapi32
    Folder: None (PATH Injection)
    File: advapi32.dll
   =================================================================================================
    RegPath: HKLM\System\CurrentControlSet\Control\Session Manager\KnownDlls
    Key: clbcatq
    Folder: None (PATH Injection)
    File: clbcatq.dll
   =================================================================================================
    RegPath: HKLM\System\CurrentControlSet\Control\Session Manager\KnownDlls
    Key: combase
    Folder: None (PATH Injection)
    File: combase.dll
   =================================================================================================
    RegPath: HKLM\System\CurrentControlSet\Control\Session Manager\KnownDlls
    Key: COMDLG32
    Folder: None (PATH Injection)
    File: COMDLG32.dll
   =================================================================================================
    RegPath: HKLM\System\CurrentControlSet\Control\Session Manager\KnownDlls
    Key: coml2
    Folder: None (PATH Injection)
    File: coml2.dll
   =================================================================================================
    RegPath: HKLM\System\CurrentControlSet\Control\Session Manager\KnownDlls
    Key: DifxApi
    Folder: None (PATH Injection)
    File: difxapi.dll
   =================================================================================================
    RegPath: HKLM\System\CurrentControlSet\Control\Session Manager\KnownDlls
    Key: gdi32
    Folder: None (PATH Injection)
    File: gdi32.dll
   =================================================================================================
    RegPath: HKLM\System\CurrentControlSet\Control\Session Manager\KnownDlls
    Key: gdiplus
    Folder: None (PATH Injection)
    File: gdiplus.dll
   =================================================================================================
    RegPath: HKLM\System\CurrentControlSet\Control\Session Manager\KnownDlls
    Key: IMAGEHLP
    Folder: None (PATH Injection)
    File: IMAGEHLP.dll
   =================================================================================================
    RegPath: HKLM\System\CurrentControlSet\Control\Session Manager\KnownDlls
    Key: IMM32
    Folder: None (PATH Injection)
    File: IMM32.dll
   =================================================================================================
    RegPath: HKLM\System\CurrentControlSet\Control\Session Manager\KnownDlls
    Key: MSCTF
    Folder: None (PATH Injection)
    File: MSCTF.dll
   =================================================================================================
    RegPath: HKLM\System\CurrentControlSet\Control\Session Manager\KnownDlls
    Key: MSVCRT
    Folder: None (PATH Injection)
    File: MSVCRT.dll
   =================================================================================================
    RegPath: HKLM\System\CurrentControlSet\Control\Session Manager\KnownDlls
    Key: NORMALIZ
    Folder: None (PATH Injection)
    File: NORMALIZ.dll
   =================================================================================================
    RegPath: HKLM\System\CurrentControlSet\Control\Session Manager\KnownDlls
    Key: NSI
    Folder: None (PATH Injection)
    File: NSI.dll
   =================================================================================================
    RegPath: HKLM\System\CurrentControlSet\Control\Session Manager\KnownDlls
    Key: ole32
    Folder: None (PATH Injection)
    File: ole32.dll
   =================================================================================================
    RegPath: HKLM\System\CurrentControlSet\Control\Session Manager\KnownDlls
    Key: OLEAUT32
    Folder: None (PATH Injection)
    File: OLEAUT32.dll
   =================================================================================================
    RegPath: HKLM\System\CurrentControlSet\Control\Session Manager\KnownDlls
    Key: PSAPI
    Folder: None (PATH Injection)
    File: PSAPI.DLL
   =================================================================================================
    RegPath: HKLM\System\CurrentControlSet\Control\Session Manager\KnownDlls
    Key: rpcrt4
    Folder: None (PATH Injection)
    File: rpcrt4.dll
   =================================================================================================
    RegPath: HKLM\System\CurrentControlSet\Control\Session Manager\KnownDlls
    Key: sechost
    Folder: None (PATH Injection)
    File: sechost.dll
   =================================================================================================
    RegPath: HKLM\System\CurrentControlSet\Control\Session Manager\KnownDlls
    Key: Setupapi
    Folder: None (PATH Injection)
    File: Setupapi.dll
   =================================================================================================
    RegPath: HKLM\System\CurrentControlSet\Control\Session Manager\KnownDlls
    Key: SHCORE
    Folder: None (PATH Injection)
    File: SHCORE.dll
   =================================================================================================
    RegPath: HKLM\System\CurrentControlSet\Control\Session Manager\KnownDlls
    Key: SHELL32
    Folder: None (PATH Injection)
    File: SHELL32.dll
   =================================================================================================
    RegPath: HKLM\System\CurrentControlSet\Control\Session Manager\KnownDlls
    Key: SHLWAPI
    Folder: None (PATH Injection)
    File: SHLWAPI.dll
   =================================================================================================
    RegPath: HKLM\System\CurrentControlSet\Control\Session Manager\KnownDlls
    Key: user32
    Folder: None (PATH Injection)
    File: user32.dll
   =================================================================================================
    RegPath: HKLM\System\CurrentControlSet\Control\Session Manager\KnownDlls
    Key: WLDAP32
    Folder: None (PATH Injection)
    File: WLDAP32.dll
   =================================================================================================
    RegPath: HKLM\System\CurrentControlSet\Control\Session Manager\KnownDlls
    Key: wow64
    Folder: None (PATH Injection)
    File: wow64.dll
   =================================================================================================
    RegPath: HKLM\System\CurrentControlSet\Control\Session Manager\KnownDlls
    Key: wow64base
    Folder: None (PATH Injection)
    File: wow64base.dll
   =================================================================================================
    RegPath: HKLM\System\CurrentControlSet\Control\Session Manager\KnownDlls


_raw:
    HKLM\system\currentcontrolset\services\WINUSB (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\WinVerbs (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\wisvc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\wlidsvc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\WmiAcpi (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\WmiApRpl (Administrators [Allow: GenericAll FullControl])
    HKLM\system\currentcontrolset\services\wmiApSrv (Administrators [Allow: GenericAll FullControl])
    HKLM\system\currentcontrolset\services\WMPNetworkSvc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\Wof (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\workerdd (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\WPDBusEnum (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\WpdUpFltr (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\WpnService (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\WpnUserService (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\WpnUserService_73dcad9 (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\ws2ifsl (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\WSearch (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\WSearchIdxPi (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\wuauserv (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\WudfPf (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\WUDFRd (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\xmlprov (Administrators [Allow: FullControl GenericAll])
╔══════════╣ Checking write permissions in PATH folders (DLL Hijacking)
╚ Check for DLL Hijacking in PATH folders https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#dll-hijacking
    (DLL Hijacking) C:\windows\system32: Administrators [Allow: WriteData/CreateFiles]
    (DLL Hijacking) C:\windows: Administrators [Allow: WriteData/CreateFiles]
    (DLL Hijacking) C:\windows\System32\Wbem: Administrators [Allow: WriteData/CreateFiles]
    (DLL Hijacking) C:\windows\System32\WindowsPowerShell\v1.0\: Administrators [Allow: WriteData/CreateFiles]
    (DLL Hijacking) C:\windows\System32\OpenSSH\: Administrators [Allow: WriteData/CreateFiles]
    (DLL Hijacking) C:\ProgramData\chocolatey\bin: Administrators [Allow: AllAccess]
════════════════════════════════════╣ Applications Information ╠════════════════════════════════════
╔══════════╣ Current Active Window Application
    Administrator: Windows PowerShell
╔══════════╣ Installed Applications --Via Program Files/Uninstall registry--
╚ Check if you can modify installed software https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#applications
    C:\Program Files\Cloudbase Solutions(Administrators [Allow: AllAccess])
    C:\Program Files\Common Files(Administrators [Allow: WriteData/CreateFiles])
    C:\Program Files\desktop.ini(Administrators [Allow: AllAccess])
    C:\Program Files\Google(Administrators [Allow: AllAccess])
    C:\Program Files\Internet Explorer(Administrators [Allow: WriteData/CreateFiles])
    C:\Program Files\ModifiableWindowsApps
    C:\Program Files\Mozilla Firefox(Administrators [Allow: AllAccess])
    C:\Program Files\Poseidon Booking(Users [Allow: WriteData/CreateFiles], Administrators [Allow: AllAccess])
    C:\Program Files\Qemu-ga(Administrators [Allow: AllAccess])
    C:\Program Files\SplunkUniversalForwarder(Administrators [Allow: AllAccess])
    C:\Program Files\Uninstall Information(Administrators [Allow: AllAccess])
    C:\Program Files\Windows Defender(Administrators [Allow: WriteData/CreateFiles])
    C:\Program Files\Windows Defender Advanced Threat Protection(Administrators [Allow: WriteData/CreateFiles])
    C:\Program Files\Windows Mail(Administrators [Allow: WriteData/CreateFiles])
    C:\Program Files\Windows Media Player(Administrators [Allow: WriteData/CreateFiles])
    C:\Program Files\Windows NT(Administrators [Allow: WriteData/CreateFiles])
    C:\Program Files\Windows Photo Viewer(Administrators [Allow: WriteData/CreateFiles])
    C:\Program Files\Windows Sidebar(Administrators [Allow: WriteData/CreateFiles])
    C:\Program Files\WindowsApps
    C:\Program Files\WindowsPowerShell(Administrators [Allow: WriteData/CreateFiles])
╔══════════╣ Autorun Applications
╚ Check if you can modify other users AutoRuns binaries (Note that is normal that you can modify HKCU registry and binaries indicated there) https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/privilege-escalation-with-autorun-binaries.html
Error getting autoruns from WMIC: System.UnauthorizedAccessException
   at System.Runtime.InteropServices.Marshal.ThrowExceptionForHRInternal(Int32 errorCode, IntPtr errorInfo)
   at System.Management.ManagementObjectCollection.ManagementObjectEnumerator.MoveNext()
   at winPEAS.Info.ApplicationInfo.AutoRuns.GetAutoRunsWMIC()
    RegPath: HKLM\Software\Microsoft\Windows\CurrentVersion\Run
    RegPerms: Administrators [Allow: FullControl GenericAll]
    Key: SecurityHealth
    Folder: C:\windows\system32
    FolderPerms: Administrators [Allow: WriteData/CreateFiles]
    File: C:\windows\system32\SecurityHealthSystray.exe
   =================================================================================================
    RegPath: HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
    RegPerms: Administrators [Allow: FullControl GenericAll]
    Key: Common Startup
    Folder: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
    FolderPerms: Administrators [Allow: AllAccess] (Unquoted and Space detected) - C:\ProgramData\Microsoft\Windows,C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
   =================================================================================================
    RegPath: HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
    RegPerms: Administrators [Allow: GenericAll FullControl]
    Key: Common Startup
    Folder: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
    FolderPerms: Administrators [Allow: AllAccess] (Unquoted and Space detected) - C:\ProgramData\Microsoft\Windows,C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
   =================================================================================================
    RegPath: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
    RegPerms: Administrators [Allow: FullControl GenericAll]
    Key: Userinit
    Folder: C:\windows\system32
    FolderPerms: Administrators [Allow: WriteData/CreateFiles]
    File: C:\windows\system32\userinit.exe,
   =================================================================================================
    RegPath: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
    RegPerms: Administrators [Allow: FullControl GenericAll]
    Key: Shell
    Folder: None (PATH Injection)
    File: explorer.exe
   =================================================================================================
    RegPath: HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot
    RegPerms: Administrators [Allow: FullControl]
    Key: AlternateShell
    Folder: None (PATH Injection)
    File: cmd.exe
   =================================================================================================
    RegPath: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Font Drivers
    RegPerms: Administrators [Allow: FullControl GenericAll]
    Key: Adobe Type Manager
    Folder: None (PATH Injection)
    File: atmfd.dll
   =================================================================================================
    RegPath: HKLM\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Font Drivers
    RegPerms: Administrators [Allow: FullControl GenericAll]
    Key: Adobe Type Manager
    Folder: None (PATH Injection)
    File: atmfd.dll
   =================================================================================================
    RegPath: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Drivers32
    RegPerms: Administrators [Allow: FullControl GenericAll]
    Key: aux
    Folder: None (PATH Injection)
    File: wdmaud.drv
   =================================================================================================
    RegPath: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Drivers32
    RegPerms: Administrators [Allow: FullControl GenericAll]
    Key: midi
    Folder: None (PATH Injection)
    File: wdmaud.drv
   =================================================================================================
    RegPath: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Drivers32
    RegPerms: Administrators [Allow: FullControl GenericAll]
    Key: midimapper
    Folder: None (PATH Injection)
    File: midimap.dll
   =================================================================================================
    RegPath: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Drivers32
    RegPerms: Administrators [Allow: FullControl GenericAll]
    Key: mixer
    Folder: None (PATH Injection)
    File: wdmaud.drv
   =================================================================================================
    RegPath: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Drivers32
    RegPerms: Administrators [Allow: FullControl GenericAll]
    Key: msacm.imaadpcm
    Folder: None (PATH Injection)
    File: imaadp32.acm
   =================================================================================================
    RegPath: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Drivers32
    RegPerms: Administrators [Allow: FullControl GenericAll]
    Key: msacm.l3acm
    Folder: C:\Windows\System32
    FolderPerms: Administrators [Allow: WriteData/CreateFiles]
    File: C:\Windows\System32\l3codeca.acm
   =================================================================================================
    RegPath: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Drivers32
    RegPerms: Administrators [Allow: FullControl GenericAll]
    Key: msacm.msadpcm
    Folder: None (PATH Injection)
    File: msadp32.acm
   =================================================================================================
    RegPath: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Drivers32
    RegPerms: Administrators [Allow: FullControl GenericAll]
    Key: msacm.msg711
    Folder: None (PATH Injection)
    File: msg711.acm
   =================================================================================================
    RegPath: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Drivers32
    RegPerms: Administrators [Allow: FullControl GenericAll]
    Key: msacm.msgsm610
    Folder: None (PATH Injection)
    File: msgsm32.acm
   =================================================================================================
    RegPath: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Drivers32
    RegPerms: Administrators [Allow: FullControl GenericAll]
    Key: vidc.i420
    Folder: None (PATH Injection)
    File: iyuv_32.dll
   =================================================================================================
    RegPath: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Drivers32
    RegPerms: Administrators [Allow: FullControl GenericAll]
    Key: vidc.iyuv
    Folder: None (PATH Injection)
    File: iyuv_32.dll
   =================================================================================================
    RegPath: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Drivers32
    RegPerms: Administrators [Allow: FullControl GenericAll]
    Key: vidc.mrle
    Folder: None (PATH Injection)
    File: msrle32.dll
   =================================================================================================
    RegPath: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Drivers32
    RegPerms: Administrators [Allow: FullControl GenericAll]
    Key: vidc.msvc
    Folder: None (PATH Injection)
    File: msvidc32.dll
   =================================================================================================
    RegPath: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Drivers32
    RegPerms: Administrators [Allow: FullControl GenericAll]
    Key: vidc.uyvy
    Folder: None (PATH Injection)
    File: msyuv.dll
   =================================================================================================
    RegPath: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Drivers32
    RegPerms: Administrators [Allow: FullControl GenericAll]
    Key: vidc.yuy2
    Folder: None (PATH Injection)
    File: msyuv.dll
   =================================================================================================
    RegPath: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Drivers32
    RegPerms: Administrators [Allow: FullControl GenericAll]
    Key: vidc.yvu9
    Folder: None (PATH Injection)
    File: tsbyuv.dll
   =================================================================================================
    RegPath: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Drivers32
    RegPerms: Administrators [Allow: FullControl GenericAll]
    Key: vidc.yvyu
    Folder: None (PATH Injection)
    File: msyuv.dll
   =================================================================================================
    RegPath: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Drivers32
    RegPerms: Administrators [Allow: FullControl GenericAll]
    Key: wave
    Folder: None (PATH Injection)
    File: wdmaud.drv
   =================================================================================================
    RegPath: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Drivers32
    RegPerms: Administrators [Allow: FullControl GenericAll]
    Key: wavemapper
    Folder: None (PATH Injection)
    File: msacm32.drv
   =================================================================================================
    RegPath: HKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32
    RegPerms: Administrators [Allow: FullControl GenericAll]
    Key: aux
    Folder: None (PATH Injection)
    File: wdmaud.drv
   =================================================================================================
    RegPath: HKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32
    RegPerms: Administrators [Allow: FullControl GenericAll]
    Key: midi
    Folder: None (PATH Injection)
    File: wdmaud.drv
   =================================================================================================
    RegPath: HKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32
    RegPerms: Administrators [Allow: FullControl GenericAll]
    Key: midimapper
    Folder: None (PATH Injection)
    File: midimap.dll
   =================================================================================================
    RegPath: HKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32
    RegPerms: Administrators [Allow: FullControl GenericAll]
    Key: mixer
    Folder: None (PATH Injection)
    File: wdmaud.drv
   =================================================================================================
    RegPath: HKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32
    RegPerms: Administrators [Allow: FullControl GenericAll]
    Key: msacm.imaadpcm
    Folder: None (PATH Injection)
    File: imaadp32.acm
   =================================================================================================
    RegPath: HKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32


_raw:
    HKLM\system\currentcontrolset\services\PNPMEM (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\PolicyAgent (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\portcfg (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\PortProxy (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\PoseidonBooking (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\Power (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\PptpMiniport (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\PrintNotify (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\PrintWorkflowUserSvc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\PrintWorkflowUserSvc_73dcad9 (Administrators [Allow: FullControl GenericAll])    HKLM\system\currentcontrolset\services\PRM (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\Processor (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\ProfSvc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\Psched (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\PushToInstall (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\PVPanic (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\pvscsi (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\qebdrv (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\qefcoe (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\QEMU Guest Agent VSS Provider (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\QEMU-GA (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\qeois (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\ql2300i (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\ql40xx2i (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\qlfcoei (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\QWAVE (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\QWAVEdrv (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\Ramdisk (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\RasAcd (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\RasAgileVpn (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\RasAuto (Administrators [Allow: GenericAll FullControl])
    HKLM\system\currentcontrolset\services\RasGre (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\Rasl2tp (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\RasMan (Administrators [Allow: GenericAll FullControl])
    HKLM\system\currentcontrolset\services\RasPppoe (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\RasSstp (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\rdbss (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\RDMANDK (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\rdpbus (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\RDPDR (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\RDPNP (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\RDPUDD (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\RdpVideoMiniport (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\ReFS (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\ReFSv1 (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\RemoteAccess (Administrators [Allow: GenericAll FullControl])
    HKLM\system\currentcontrolset\services\RemoteRegistry (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\RFCOMM (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\rhproxy (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\RmSvc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\RpcEptMapper (Administrators [Allow: TakeOwnership FullControl GenericAll])
    HKLM\system\currentcontrolset\services\RpcLocator (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\RSoPProv (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\rspndr (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\s3cap (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\sacdrv (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\sacsvr (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\sbp2port (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\SCardSvr (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\ScDeviceEnum (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\scfilter (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\Schedule (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\scmbus (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\SCPolicySvc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\sdbus (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\SDFRd (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\sdstor (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\seclogon (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\SEMgrSvc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\SENS (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\Sense (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\SensorDataService (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\SensorService (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\SensrSvc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\SerCx (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\SerCx2 (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\Serenum (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\Serial (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\sermouse (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\SessionEnv (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\sfloppy (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\SgrmAgent (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\SgrmBroker (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\SharedAccess (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\ShellHWDetection (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\shpamsvc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\SiSRaid2 (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\SiSRaid4 (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\SmartSAMD (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\smbdirect (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\smphost (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\SMSvcHost 4.0.0.0 (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\SNMPTRAP (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\spaceparser (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\spaceport (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\SpbCx (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\splknetdrv (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\splunkdrv (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\SplunkForwarder (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\SplunkMonitorNoHandle (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\Spooler (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\sppsvc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\srv2 (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\srvnet (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\SSDPSRV (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\ssh-agent (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\SstpSvc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\StateRepository (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\stexstor (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\StiSvc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\storahci (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\storflt (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\stornvme (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\storqosflt (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\StorSvc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\storufs (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\storvsc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\svsvc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\swenum (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\swprv (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\SysMain (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\Sysmon64 (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\SysmonDrv (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\SystemEventsBroker (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\TabletInputService (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\tapisrv (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\Tcpip (Administrators [Allow: FullControl])
    HKLM\system\currentcontrolset\services\Tcpip6 (Administrators [Allow: FullControl])
    HKLM\system\currentcontrolset\services\TCPIP6TUNNEL (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\tcpipreg (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\TCPIPTUNNEL (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\tdx (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\terminpt (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\TermService (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\Themes (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\TieringEngineService (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\TimeBrokerSvc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\TokenBroker (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\TPM (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\TSDDD (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\TsUsbFlt (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\TsUsbGD (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\tsusbhub (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\tunnel (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\tzautoupdate (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\UALSVC (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\UASPStor (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\UcmCx0101 (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\UcmTcpciCx0101 (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\UcmUcsiAcpiClient (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\UcmUcsiCx0101 (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\Ucx01000 (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\UdeCx (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\udfs (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\UdkUserSvc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\UdkUserSvc_73dcad9 (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\UEFI (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\UevAgentDriver (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\UevAgentService (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\Ufx01000 (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\UfxChipidea (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\ufxsynopsys (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\UGatherer (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\UGTHRSVC (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\umbus (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\UmPass (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\UmRdpService (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\UnistoreSvc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\UnistoreSvc_73dcad9 (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\upnphost (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\UrsChipidea (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\UrsCx01000 (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\UrsSynopsys (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\Usb4DeviceRouter (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\Usb4HostRouter (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\usbaudio (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\usbaudio2 (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\usbccgp (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\usbehci (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\usbhub (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\USBHUB3 (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\usbohci (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\usbprint (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\usbser (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\USBSTOR (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\usbuhci (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\USBXHCI (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\UserDataSvc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\UserDataSvc_73dcad9 (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\UserManager (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\UsoSvc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\VaultSvc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\vdrvroot (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\vds (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\VerifierExt (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\vhdmp (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\vhf (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\viohidkmdf (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\vioscsi (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\viostor (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\VirtioInput (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\VirtioSerial (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\VirtRng (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\VirtualRender (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\vmbus (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\VMBusHID (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\vmgid (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\vmicguestinterface (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\vmicheartbeat (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\vmickvpexchange (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\vmicrdv (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\vmicshutdown (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\vmictimesync (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\vmicvmsession (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\vmicvss (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\volmgr (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\volmgrx (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\volsnap (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\volume (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\vpci (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\vsmraid (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\VSS (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\VSTXRAID (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\vwifibus (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\W32Time (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\WaaSMedicSvc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\WacomPen (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\WalletService (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\wanarp (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\wanarpv6 (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\WarpJITSvc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\WbioSrvc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\wcifs (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\Wcmsvc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\WdBoot (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\Wdf01000 (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\WdFilter (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\WdmCompanionFilter (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\WdNisDrv (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\WdNisSvc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\Wecsvc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\WEPHOSTSVC (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\wercplsupport (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\WerSvc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\WFPLWFS (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\WiaRpc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\WIMMount (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\WinDefend (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\Windows Workflow Foundation 4.0.0.0 (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\WindowsTrustedRT (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\WindowsTrustedRTProxy (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\WinHttpAutoProxySvc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\WinMad (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\Winmgmt (Administrators [Allow: GenericAll FullControl])
    HKLM\system\currentcontrolset\services\WinNat (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\WinRM (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\Winsock (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\WinSock2 (Administrators [Allow: FullControl GenericAll])


_raw:
    HKLM\system\currentcontrolset\services\cloudbase-init (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\clr_optimization_v4.0.30319_32 (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\clr_optimization_v4.0.30319_64 (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\CmBatt (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\CNG (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\cnghwassist (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\CompositeBus (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\COMSysApp (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\condrv (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\ConsentUxUserSvc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\ConsentUxUserSvc_73dcad9 (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\CoreMessagingRegistrar (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\CoreUI (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\CredentialEnrollmentManagerUserSvc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\CredentialEnrollmentManagerUserSvc_73dcad9 (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\crypt32 (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\CryptSvc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\CSC (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\CscService (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\dam (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\DCLocator (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\defragsvc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\DeviceAssociationBrokerSvc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\DeviceAssociationBrokerSvc_73dcad9 (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\DeviceAssociationService (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\DeviceInstall (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\DevicePickerUserSvc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\DevicePickerUserSvc_73dcad9 (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\DevicesFlowUserSvc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\DevicesFlowUserSvc_73dcad9 (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\DevQueryBroker (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\Dfsc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\Dhcp (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\diagnosticshub.standardcollector.service (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\DiagTrack (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\disk (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\DispBrokerDesktopSvc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\DmEnrollmentSvc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\dmvsc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\dmwappushservice (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\Dnscache (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\DoSvc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\dot3svc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\drmkaud (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\DsmSvc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\DsSvc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\DXGKrnl (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\EapHost (Administrators [Allow: WriteKey FullControl GenericAll])
    HKLM\system\currentcontrolset\services\ebdrv (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\ebdrv0 (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\edgeupdate (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\edgeupdatem (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\EFS (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\EhStorClass (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\EhStorTcgDrv (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\elxfcoe (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\elxstor (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\embeddedmode (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\EntAppSvc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\ErrDev (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\ESENT (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\EventLog (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\EventSystem (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\ExecutionContext (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\exfat (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\fastfat (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\fcvsc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\fdc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\fdPHost (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\FDResPub (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\FileCrypt (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\FileInfo (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\Filetrace (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\flpydisk (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\FltMgr (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\FontCache (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\FrameServer (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\FrameServerMonitor (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\FsDepends (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\Fs_Rec (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\gencounter (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\genericusbfn (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\GoogleChromeElevationService (Administrators [Allow: FullControl GenericAll])    HKLM\system\currentcontrolset\services\GoogleUpdaterInternalService143.0.7482.0 (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\GoogleUpdaterService143.0.7482.0 (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\GPIOClx0101 (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\GraphicsPerfSvc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\HdAudAddService (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\HDAudBus (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\HidBatt (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\hidinterrupt (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\hidserv (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\HidUsb (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\HpSAMD (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\HTTP (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\hvcrash (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\HvHost (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\hvservice (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\HwNClx0101 (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\hwpolicy (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\hyperkbd (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\HyperVideo (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\i8042prt (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\iaLPSSi_GPIO (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\iaLPSSi_I2C (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\iaStorAV (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\iaStorAVC (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\iaStorV (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\ibbus (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\IKEEXT (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\IndirectKmd (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\inetaccs (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\InstallService (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\intelide (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\intelpep (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\IntelPMT (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\intelppm (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\iorate (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\IpFilterDriver (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\iphlpsvc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\IPMIDRV (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\IPNAT (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\IPT (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\isapnp (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\iScsiPrt (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\ItSas35i (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\kbdclass (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\kbdhid (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\kdnic (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\KeyIso (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\KPSSVC (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\KSecDD (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\KSecPkg (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\KslD (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\ksthunk (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\KtmRm (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\laforge-agent (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\LanmanServer (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\LanmanWorkstation (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\ldap (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\lfsvc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\LicenseManager (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\lltdio (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\lltdsvc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\lmhosts (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\LSI_SAS (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\LSI_SAS2i (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\LSI_SAS3i (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\LSM (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\luafv (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\MapsBroker (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\mausbhost (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\mausbip (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\McpManagementService (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\MDCoreSvc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\megasas2i (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\megasas35i (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\megasr (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\MicrosoftEdgeElevationService (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\mlx4_bus (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\MMCSS (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\Modem (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\monitor (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\mouclass (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\mouhid (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\mountmgr (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\MozillaMaintenance (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\mpi3drvi (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\mpsdrv (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\mpssvc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\mrxsmb (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\mrxsmb20 (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\MsBridge (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\MSDTC (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\MSDTC Bridge 4.0.0.0 (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\Msfs (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\msgpiowin32 (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\mshidkmdf (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\mshidumdf (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\msisadrv (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\MSiSCSI (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\msiserver (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\MSKSSRV (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\MsLbfoProvider (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\MsLldp (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\MSPCLOCK (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\MSPQM (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\MsQuic (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\MsRPC (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\MsSecFlt (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\mssmbios (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\MSTEE (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\MTConfig (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\Mup (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\mvumis (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\napagent (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\NcaSvc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\NcbService (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\ndfltr (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\NDIS (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\NdisCap (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\NdisImPlatform (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\NdisTapi (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\Ndisuio (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\NdisVirtualBus (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\NdisWan (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\ndiswanlegacy (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\NDKPerf (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\NDKPing (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\ndproxy (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\NetAdapterCx (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\NetBIOS (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\NetbiosSmb (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\NetBT (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\netkvm (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\NETKVMP (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\Netlogon (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\Netman (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\netprofm (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\NetSetupSvc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\NetTcpPortSharing (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\netvsc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\NETVSCVFPP (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\NgcCtnrSvc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\NgcSvc (Administrators [Allow: TakeOwnership FullControl GenericAll])
    HKLM\system\currentcontrolset\services\NlaSvc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\Npfs (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\npsvctrig (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\nsi (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\nsiproxy (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\NTDS (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\Ntfs (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\Null (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\nvdimm (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\nvraid (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\nvstor (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\Parport (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\partmgr (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\PcaSvc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\pci (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\pciide (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\pcmcia (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\pcw (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\pdc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\PEAUTH (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\percsas2i (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\percsas3i (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\PerfDisk (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\PerfHost (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\PerfNet (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\PerfOS (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\PerfProc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\PimIndexMaintenanceSvc (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\PimIndexMaintenanceSvc_73dcad9 (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\PktMon (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\pla (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\PlugPlay (Administrators [Allow: FullControl GenericAll])
    HKLM\system\currentcontrolset\services\pmem (Administrators [Allow: FullControl GenericAll])