WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-10 11:47:38 +02:00
Code Issues Packages Projects Releases Wiki Activity

getsids getservicesids

Browse Source
This commit is contained in:
memoryforensics1
2020-09-22 18:21:58 +01:00
committed by ikelos
parent 77312e193a
commit a5d5ff2bda
3 changed files with 864 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility/framework/plugins/windows/getservicesids.py
+85
View File
@@ -0,0 +1,85 @@
# This file is Copyright 2020 Volatility Foundation and licensed under the Volatility Software License 1.0
# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0
import volatility.plugins.windows.registry.hivelist as hivelist
from volatility.framework import renderers, interfaces, objects, constants, exceptions
from volatility.framework.configuration import requirements
from volatility.framework.objects import utility
from volatility.framework.renderers import format_hints
from typing import List
import logging
import hashlib
import struct
import os, json
def createservicesid(svc) -> str:
""" Calculate the Service SID """
uni = ''.join([c + '\x00' for c in svc])
sha = hashlib.sha1(uni.upper().encode("utf-8")).digest() # pylint: disable-msg=E1101
dec = list()
for i in range(5):
## The use of struct here is OK. It doesn't make much sense
## to leverage obj.Object inside this loop.
dec.append(struct.unpack('<I', sha[i * 4 : i * 4 + 4])[0])
return 'S-1-5-80-' + '-'.join([str(n) for n in dec])
class GetServiceSIDs(interfaces.plugins.PluginInterface):
"""Lists process token sids."""
_version = (1, 0, 0)
def __init__(self, *args, **kwargs):
super().__init__(*args, **kwargs)
# Find the sids json path (or raise error if its not in the plugin directory).
for plugin_dir in constants.PLUGINS_PATH:
sids_json_file_name = os.path.join(plugin_dir, os.path.join("windows", "well_known_sids.json"))
if os.path.exists(sids_json_file_name):
break
else:
vollog.log(constants.LOGLOVEL_VVV, 'well_known_sids.json file is missing plugin error')
raise RuntimeError("The well_known_sids.json file missed from you plugin directory")
# Get service sids dictionary (we need only the service sids).
with open(sids_json_file_name, 'r') as file_handle:
self.servicesids = json.load(file_handle)['service sids']
@classmethod
def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]:
# Since we're calling the plugin, make sure we have the plugin's requirements
return [requirements.TranslationLayerRequirement(name = 'primary',
description = 'Memory layer for the kernel',
architectures = ["Intel32", "Intel64"]),
requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols"),
requirements.PluginRequirement(name = 'hivelist', plugin = hivelist.HiveList, version = (1, 0, 0))]
def _generator(self):
# Go all over the hives
for hive in hivelist.HiveList.list_hives(context = self.context,
base_config_path = self.config_path,
layer_name = self.config['primary'],
symbol_table = self.config['nt_symbols'],
hive_offsets = None):
# Get ConrolSet\Services.
try:
services = hive.get_key(r"CurrentControlSet\Services")
except (KeyError, exceptions.InvalidAddressException):
try:
services = hive.get_key(r"ControlSet001\Services")
except (KeyError, exceptions.InvalidAddressException):
continue
if services:
for s in services.get_subkeys():
if s.get_name() not in self.servicesids.values():
sid = createservicesid(s.get_name())
yield (0, [sid, s.get_name()])
def run(self):
return renderers.TreeGrid([("SID", str), ("Service", str)],
self._generator())
volatility/framework/plugins/windows/getsids.py
+167
View File
@@ -0,0 +1,167 @@
# This file is Copyright 2020 Volatility Foundation and licensed under the Volatility Software License 1.0
# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0
import logging
import re, ntpath, os, json
from typing import Callable, List, Generator, Iterable, Dict
from volatility.framework import renderers, interfaces, objects, exceptions, constants
from volatility.framework.configuration import requirements
from volatility.framework.objects import utility
from volatility.framework.renderers import format_hints
from volatility.plugins.windows import pslist
import volatility.framework.layers.registry
import volatility.framework.symbols.windows.extensions.registry as registry
import volatility.plugins.windows.registry.hivelist as hivelist
vollog = logging.getLogger(__name__)
def find_sid_re(sid_string, sid_re_list) -> str:
for reg, name in sid_re_list:
if reg.search(sid_string):
return name
class GetSIDs(interfaces.plugins.PluginInterface):
"""Print the SIDs owning each process"""
_version = (1, 0, 0)
def __init__(self, *args, **kwargs):
super().__init__(*args, **kwargs)
for plugin_dir in constants.PLUGINS_PATH:
sids_json_file_name = os.path.join(plugin_dir, os.path.join("windows", "well_known_sids.json"))
if os.path.exists(sids_json_file_name):
break
else:
vollog.log(constants.LOGLOVEL_VVV, 'well_known_sids.json file is missing plugin error')
raise RuntimeError("The well_known_sids.json file missed from you plugin directory")
# Get all the sids from the json file.
with open(sids_json_file_name, 'r') as file_handle:
sids_json_data = json.load(file_handle)
self.servicesids = sids_json_data['service sids']
self.well_known_sids = sids_json_data['well known']
# Compile all the sids regex.
self.well_known_sid_re = [(re.compile(c_list[0]), c_list[1]) for c_list in sids_json_data['sids re']]
@classmethod
def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]:
return [requirements.TranslationLayerRequirement(name = 'primary',
description = 'Memory layer for the kernel',
architectures = ["Intel32", "Intel64"]),
requirements.SymbolTableRequirement(name = "nt_symbols", description = "Windows kernel symbols"),
requirements.ListRequirement(name = 'pid',
description = 'Filter on specific process IDs',
element_type = int,
optional = True),
requirements.PluginRequirement(name = 'pslist', plugin = pslist.PsList, version = (1, 0, 0)),
requirements.PluginRequirement(name = 'hivelist', plugin = hivelist.HiveList, version = (1, 0, 0))
]
def lookup_user_sids(self) -> Dict[str, str]:
"""
Enumerate the registry for all the users.
Returns:
An dictionary of {sid: user name}
"""
key = "Microsoft\\Windows NT\\CurrentVersion\\ProfileList"
val = "ProfileImagePath"
sids = {}
for hive in hivelist.HiveList.list_hives(context = self.context,
base_config_path = self.config_path,
layer_name = self.config['primary'],
symbol_table = self.config['nt_symbols'],
hive_offsets = None):
try:
for subkey in hive.get_key(key).get_subkeys():
sid = str(subkey.get_name())
path = ""
for node in subkey.get_values():
try:
value_node_name = node.get_name() or "(Default)"
except (exceptions.InvalidAddressException, volatility.framework.layers.registry.RegistryFormatException) as excp:
continue
try:
value_data = node.decode_data()
if isinstance(value_data, int):
value_data = format_hints.MultiTypeData(value_data, encoding = 'utf-8')
elif registry.RegValueTypes.get(node.Type) == registry.RegValueTypes.REG_BINARY:
value_data = format_hints.MultiTypeData(value_data, show_hex = True)
elif registry.RegValueTypes.get(node.Type) == registry.RegValueTypes.REG_MULTI_SZ:
value_data = format_hints.MultiTypeData(value_data,
encoding = 'utf-16-le',
split_nulls = True)
else:
value_data = format_hints.MultiTypeData(value_data, encoding = 'utf-16-le')
if value_node_name == val:
path = str(value_data).replace('\\x00', '')[:-1]
user = ntpath.basename(path)
sids[sid] = user
except (ValueError, exceptions.InvalidAddressException, volatility.framework.layers.registry.RegistryFormatException) as excp:
continue
except (KeyError, exceptions.InvalidAddressException):
continue
return sids
def _generator(self, procs):
user_sids = self.lookup_user_sids()
# Go all over the process list, get the token
for task in procs:
#print('here')
#print(task.UniqueProcessId)
# Make sure we have a valid token
try:
token = task.Token.dereference().cast("_TOKEN")
except exceptions.InvalidAddressException:
token = False
if not token:
yield (0, [int(task.UniqueProcessId),
str(task.ImageFileName),
"Token unreadable",
""])
continue
# Go all over the sids and try to translate them with one of the tables we have
for sid_string in token.get_sids():
if sid_string in self.well_known_sids:
sid_name = self.well_known_sids[sid_string]
elif sid_string in self.servicesids:
sid_name = self.servicesids[sid_string]
elif sid_string in user_sids:
sid_name = user_sids[sid_string]
else:
sid_name_re = find_sid_re(sid_string, self.well_known_sid_re)
if sid_name_re:
sid_name = sid_name_re
else:
sid_name = ""
yield (0, [int(task.UniqueProcessId),
objects.utility.array_to_string(task.ImageFileName),
str(sid_string),
str(sid_name)])
def run(self):
filter_func = pslist.PsList.create_pid_filter(self.config.get('pid', None))
return renderers.TreeGrid([("PID", int),("Process", str),("SID", str),("Name", str)],
self._generator(pslist.PsList.list_processes(context = self.context,
layer_name = self.config['primary'],
symbol_table = self.config['nt_symbols'],
filter_func = filter_func)))
volatility/framework/plugins/windows/sids_and_privileges.json
+612
View File
@@ -0,0 +1,612 @@
{
"well known": {
"S-1-0": "Null Authority",
"S-1-0-0": "Nobody",
"S-1-1": "World Authority",
"S-1-1-0": "Everyone",
"S-1-2": "Local Authority",
"S-1-2-0": "Local (Users with the ability to log in locally)",
"S-1-2-1": "Console Logon (Users who are logged onto the physical console)",
"S-1-3": "Creator Authority",
"S-1-3-0": "Creator Owner",
"S-1-3-1": "Creator Group",
"S-1-3-2": "Creator Owner Server",
"S-1-3-3": "Creator Group Server",
"S-1-3-4": "Owner Rights",
"S-1-4": "Non-unique Authority",
"S-1-5": "NT Authority",
"S-1-5-1": "Dialup",
"S-1-5-2": "Network",
"S-1-5-3": "Batch",
"S-1-5-4": "Interactive",
"S-1-5-6": "Service",
"S-1-5-7": "Anonymous",
"S-1-5-8": "Proxy",
"S-1-5-9": "Enterprise Domain Controllers",
"S-1-5-10": "Principal Self",
"S-1-5-11": "Authenticated Users",
"S-1-5-12": "Restricted Code",
"S-1-5-13": "Terminal Server Users",
"S-1-5-14": "Remote Interactive Logon",
"S-1-5-15": "This Organization",
"S-1-5-17": "This Organization (Used by the default IIS user)",
"S-1-5-18": "Local System",
"S-1-5-19": "NT Authority",
"S-1-5-20": "NT Authority",
"S-1-5-32-544": "Administrators",
"S-1-5-32-545": "Users",
"S-1-5-32-546": "Guests",
"S-1-5-32-547": "Power Users",
"S-1-5-32-548": "Account Operators",
"S-1-5-32-549": "Server Operators",
"S-1-5-32-550": "Print Operators",
"S-1-5-32-551": "Backup Operators",
"S-1-5-32-552": "Replicators",
"S-1-5-32-554": "BUILTIN\\Pre-Windows 2000 Compatible Access",
"S-1-5-32-555": "BUILTIN\\Remote Desktop Users",
"S-1-5-32-556": "BUILTIN\\Network Configuration Operators",
"S-1-5-32-557": "BUILTIN\\Incoming Forest Trust Builders",
"S-1-5-32-558": "BUILTIN\\Performance Monitor Users",
"S-1-5-32-559": "BUILTIN\\Performance Log Users",
"S-1-5-32-560": "BUILTIN\\Windows Authorization Access Group",
"S-1-5-32-561": "BUILTIN\\Terminal Server License Servers",
"S-1-5-32-562": "BUILTIN\\Distributed COM Users",
"S-1-5-32-568": "BUILTIN\\IIS IUSRS",
"S-1-5-32-569": "Cryptographic Operators",
"S-1-5-32-573": "BUILTIN\\Event Log Readers",
"S-1-5-32-574": "BUILTIN\\Certificate Service DCOM Access",
"S-1-5-33": "Write Restricted",
"S-1-5-64-10": "NTLM Authentication",
"S-1-5-64-14": "SChannel Authentication",
"S-1-5-64-21": "Digest Authentication",
"S-1-5-80": "NT Service",
"S-1-5-86-1544737700-199408000-2549878335-3519669259-381336952": "WMI (Local Service)",
"S-1-5-86-615999462-62705297-2911207457-59056572-3668589837": "WMI (Network Service)",
"S-1-5-1000": "Other Organization",
"S-1-16-0": "Untrusted Mandatory Level",
"S-1-16-4096": "Low Mandatory Level",
"S-1-16-8192": "Medium Mandatory Level",
"S-1-16-8448": "Medium Plus Mandatory Level",
"S-1-16-12288": "High Mandatory Level",
"S-1-16-16384": "System Mandatory Level",
"S-1-16-20480": "Protected Process Mandatory Level",
"S-1-16-28672": "Secure Process Mandatory Level",
"S-1-5-21-0-0-0-496": "Compounded Authentication",
"S-1-5-21-0-0-0-497": "Claims Valid",
"S-1-5-32-575": "RDS Remote Application Services",
"S-1-5-32-576": "RDS Endpoint Servers",
"S-1-5-32-577": "RDS Management Servers",
"S-1-5-32-578": "Hyper-V Admins",
"S-1-5-32-579": "Access Control Assistance Ops",
"S-1-5-32-580": "Remote Management Users",
"S-1-5-65-1": "This Organization Certificate (Kerberos PAC)",
"S-1-5-84-0-0-0-0-0": "Usermode Drivers",
"S-1-5-113": "Local Account",
"S-1-5-114": "Local Account (Member of Administrators)",
"S-1-15-2-1": "Application Package Context",
"S-1-18-1": "Authentication Authority Asserted Identity",
"S-1-18-2": "Service Asserted Identity"
},
"service sids": {
"S-1-5-80-3476726845-1218940557-3240126423-1396283824-3706223860": ".NET CLR Data",
"S-1-5-80-3749761688-76038143-2425834820-4129736068-309120712": ".NET CLR Networking",
"S-1-5-80-603392709-3706100282-1779817366-3290147925-2109454977": ".NET Data Provider for Oracle",
"S-1-5-80-1168016597-2140435647-491797002-352772175-817350590": ".NET Data Provider for SqlServer",
"S-1-5-80-255220978-1106536095-1636044468-311807000-281316439": ".NETFramework",
"S-1-5-80-799694863-4024754253-4060439485-3284853837-2852070736": "1394ohci",
"S-1-5-80-550892281-1246201444-2906082186-2301917840-2280485454": "ACPI",
"S-1-5-80-2750316143-92726786-3671103447-4285640526-595803658": "AcpiPmi",
"S-1-5-80-4277731759-3688284049-1726419820-405794046-874834352": "adp94xx",
"S-1-5-80-1668430318-2462354215-3771841206-4231263990-2365432302": "adpahci",
"S-1-5-80-1558789706-915067316-2610504951-4085128407-2746609837": "adpu320",
"S-1-5-80-2580340827-1408356417-1236233457-3361088231-1362281560": "adsi",
"S-1-5-80-1452425288-2709461340-3274533413-2407537074-986069024": "AeLookupSvc",
"S-1-5-80-958185937-3813565417-3041720555-255702914-2218388865": "AFD",
"S-1-5-80-1478021307-2683864309-2840291008-2654641652-1914939368": "agp440",
"S-1-5-80-2964793103-1312530465-1873688160-795174673-2945876561": "aic78xx",
"S-1-5-80-2387347252-3645287876-2469496166-3824418187-3586569773": "ALG",
"S-1-5-80-1587539839-2488332913-1287008632-3751426284-4220573165": "aliide",
"S-1-5-80-2808999507-317517852-2612044860-3916887390-3713671788": "amdagp",
"S-1-5-80-4100430975-1934021090-490597466-3817433801-2954987127": "amdide",
"S-1-5-80-2291534435-3322220689-2735625597-3465650106-1340236923": "AmdK8",
"S-1-5-80-4046459391-4016695280-780100908-1621843708-2839135617": "AmdPPM",
"S-1-5-80-1967003600-1747618720-202510732-1118110944-2056302645": "amdsata",
"S-1-5-80-3946629880-3877146532-1020811794-3209710663-3707805237": "amdsbs",
"S-1-5-80-2663151763-304964558-3327380674-1150567875-3378868591": "amdxata",
"S-1-5-80-4206070390-3011771559-4179333097-3486196663-2896243697": "AppID",
"S-1-5-80-2078495744-2416903469-4072184685-3943858305-976987417": "AppIDSvc",
"S-1-5-80-1345931346-2714066941-3624776837-1617505694-3927660246": "Appinfo",
"S-1-5-80-3213379692-3546485254-1309469428-3810262102-2442199571": "AppMgmt",
"S-1-5-80-2586396289-3967100905-3140788560-3910242148-3554126937": "arc",
"S-1-5-80-4275531960-1601664531-2254151532-3075236607-956726506": "arcsas",
"S-1-5-80-3772676405-1029441937-3739550121-1000989080-3364480489": "AsyncMac",
"S-1-5-80-3126347352-2401679295-1536073615-3396758597-3783091149": "atapi",
"S-1-5-80-1580948945-3239616721-2529237571-3761093093-1214243633": "AudioEndpointBuilder",
"S-1-5-80-2676549577-1911656217-2625096541-4178041876-1366760775": "Audiosrv",
"S-1-5-80-1058592404-331734164-3167594226-3910907650-1299295147": "AxInstSV",
"S-1-5-80-1401731874-3996074688-1963706087-3130220608-1140295258": "b06bdrv",
"S-1-5-80-528874604-3378394362-3426265968-3876211711-2956305666": "b57nd60x",
"S-1-5-80-2490514847-2461341327-10008697-1811907875-602803682": "BattC",
"S-1-5-80-2962817144-200689703-2266453665-3849882635-1986547430": "BDESVC",
"S-1-5-80-3186183977-1861961257-3523979229-167170737-1516062821": "Beep",
"S-1-5-80-1383147646-27650227-2710666058-1662982300-1023958487": "BFE",
"S-1-5-80-864916184-135290571-3087830041-1716922880-4237303741": "BITS",
"S-1-5-80-3199704608-2688121514-1535149675-608666402-3313731745": "blbdrive",
"S-1-5-80-26818074-245702967-483560604-1005139437-3076944027": "bowser",
"S-1-5-80-1926592986-1411939489-3259133927-4064956769-2216240612": "BrFiltLo",
"S-1-5-80-3843808474-1199403037-3395254522-1605808544-3221186762": "BrFiltUp",
"S-1-5-80-764937145-223273921-1726433829-265908364-3948077829": "Browser",
"S-1-5-80-3715020542-2003794336-3716799247-4001019941-1245790858": "Brserid",
"S-1-5-80-4014097382-2743177720-3750454595-1699596626-866516122": "BrSerWdm",
"S-1-5-80-1195671069-1048138941-897119314-1432864274-834752102": "BrUsbMdm",
"S-1-5-80-1736549233-1399426098-2600293700-2473969234-3259996387": "BrUsbSer",
"S-1-5-80-505608135-4274227953-3632766965-1888639892-3184055934": "BTHMODEM",
"S-1-5-80-1409084391-1870647740-2731517552-2815089321-2189562539": "BTHPORT",
"S-1-5-80-2586557155-168560303-1373426920-983201488-1499765686": "bthserv",
"S-1-5-80-3223837281-1527595016-2901219760-1358189227-808820507": "cdfs",
"S-1-5-80-364680967-1232085744-2960737863-915504889-2752576923": "cdrom",
"S-1-5-80-3256172449-2363790065-3617575471-4144056108-756904704": "CertPropSvc",
"S-1-5-80-4066704878-4231214995-2335031091-3527122690-1574766183": "circlass",
"S-1-5-80-1506673549-1532669541-769420574-1605323189-863873827": "CLFS",
"S-1-5-80-776041216-1751974135-1557427478-1892253070-796752000": "clr_optimization_v2.0.50727_32",
"S-1-5-80-452204072-1743664639-1560983493-2640850116-597529692": "CmBatt",
"S-1-5-80-979911607-31916023-2827320217-2656655436-259985251": "cmdide",
"S-1-5-80-3573738861-3694853854-361022443-2442358023-2743921644": "CNG",
"S-1-5-80-3960644792-2999129865-644014482-29643289-3842828219": "Compbatt",
"S-1-5-80-832194277-1022982267-2217674263-2896671990-3011983110": "CompositeBus",
"S-1-5-80-593875016-1044814911-1112741138-2143646632-2690613739": "COMSysApp",
"S-1-5-80-3158764370-1001901224-1854525633-1718604346-2756706540": "crcdisk",
"S-1-5-80-3747264324-1669729390-1715156009-1010652712-2439569381": "Crusoe",
"S-1-5-80-3020380856-1381845346-309829523-1810616773-418643442": "crypt32",
"S-1-5-80-242729624-280608522-2219052887-3187409060-2225943459": "CryptSvc",
"S-1-5-80-3601020880-2087999432-167179594-730776211-2997520967": "CSC",
"S-1-5-80-1987853863-1639573247-1110726908-1137832616-3599624523": "CscService",
"S-1-5-80-1564160128-141119064-743480990-78466790-746535033": "DCLocator",
"S-1-5-80-1601830629-990752416-3372939810-977361409-3075122917": "DcomLaunch",
"S-1-5-80-654447679-1163530548-981569129-3608673666-3128964045": "defragsvc",
"S-1-5-80-3837255464-839197112-3211601036-3795322556-2690640524": "DfsC",
"S-1-5-80-1267473060-1890374259-1137250836-544356534-2546457154": "DFSR",
"S-1-5-80-2940520708-3855866260-481812779-327648279-1710889582": "Dhcp",
"S-1-5-80-2142581517-3954605861-2373846864-2138305209-1019737370": "discache",
"S-1-5-80-1827140278-1118305254-4004251663-1512899043-4081885502": "Disk",
"S-1-5-80-859482183-879914841-863379149-1145462774-2388618682": "Dnscache",
"S-1-5-80-3787436395-2174616005-3003730137-1094982900-1570567328": "dot3svc",
"S-1-5-80-2970612574-78537857-698502321-558674196-1451644582": "DPS",
"S-1-5-80-338020179-181244551-1629881386-919369987-4169324252": "drmkaud",
"S-1-5-80-3820654016-1545322283-1804062181-1022271772-3696306321": "DXGKrnl",
"S-1-5-80-2212058837-3965059022-779215765-3282659977-917192320": "E1G60",
"S-1-5-80-3578261754-285310837-913589462-2834155770-667502746": "EapHost",
"S-1-5-80-2437473203-2648204866-3612751994-635271166-3967841232": "Ecache",
"S-1-5-80-1191957972-1903257272-3657591267-1787121440-2523964525": "ebdrv",
"S-1-5-80-730263862-4055390735-403826019-1175694336-1277635259": "EFS",
"S-1-5-80-567955335-3455378119-3305749985-2554534624-1867504835": "ehRecvr",
"S-1-5-80-3864065939-1897331054-469427076-3133256761-1570309435": "ehSched",
"S-1-5-80-2913099195-3001839937-1914692661-1563395363-459793767": "ehstart",
"S-1-5-80-3118383011-3159412168-3368304685-4081854189-1392756948": "elxstor",
"S-1-5-80-1436322865-2295268783-31549072-3549518694-69512146": "EmdCache",
"S-1-5-80-557382581-4103702789-1349398007-826115979-1301810884": "EMDMgmt",
"S-1-5-80-1580004045-3657569029-3054886754-3760858607-1347140441": "ErrDev",
"S-1-5-80-1163726475-4032819940-2637749356-1655080563-3495319901": "ESENT",
"S-1-5-80-880578595-1860270145-482643319-2788375705-1540778122": "eventlog",
"S-1-5-80-1772571935-1555666882-3369284645-1675012128-2386634627": "EventSystem",
"S-1-5-80-339744372-1785209941-194342311-2969164887-2874010346": "exfat",
"S-1-5-80-3825849991-4144931059-247537738-1429287757-2349637904": "fastfat",
"S-1-5-80-2117685068-4011115449-2646761356-2137676340-222423812": "Fax",
"S-1-5-80-678085088-615808128-1967178352-3804608619-208504977": "fdc",
"S-1-5-80-364023826-931424190-487969545-1024119571-74567675": "fdPHost",
"S-1-5-80-3215268152-2863950836-530904203-4246843131-2183915461": "FDResPub",
"S-1-5-80-3048209083-3162952562-941345871-1437532549-835501875": "FileInfo",
"S-1-5-80-1352441077-2188484239-1994186818-620473926-3758853310": "Filetrace",
"S-1-5-80-2678475722-3718149211-1393662077-3558562392-2203603517": "flpydisk",
"S-1-5-80-916285479-1714977700-1732101595-331036679-1735462769": "FltMgr",
"S-1-5-80-3655275221-2954682349-3644260495-855223267-1438849333": "FontCache",
"S-1-5-80-3782458156-2098404076-3767342964-3617937256-1389734963": "FontCache3.0.0.0",
"S-1-5-80-4244156434-496195918-1908400060-3754471672-3389379472": "FsDepends",
"S-1-5-80-1638897150-273717933-3197303335-567190659-606579740": "Fs_Rec",
"S-1-5-80-221025945-1494805562-2841517651-3196795133-192498206": "fvevol",
"S-1-5-80-1150850083-1108777032-2236282716-3985597815-2701820264": "gagp30kx",
"S-1-5-80-2024188204-2445810227-898691311-2942020084-762398166": "gpsvc",
"S-1-5-80-2384017851-2441776339-3346382083-2430645704-3475981877": "hcw85cir",
"S-1-5-80-2193151998-1100362924-2192368770-2985476713-896696503": "HDAudBus",
"S-1-5-80-1648434057-4219984261-1802816958-334501717-1769477291": "HidBatt",
"S-1-5-80-191977210-1053814073-2805336524-1775407748-120039257": "HidBth",
"S-1-5-80-498696395-104441048-3395182230-3082814586-1375447691": "HidIr",
"S-1-5-80-89818136-74175777-88572358-3912780041-2421659406": "hidserv",
"S-1-5-80-1586586559-167648910-1414982260-3863830924-1724542190": "HidUsb",
"S-1-5-80-1373701630-3910968185-3388013410-2492353-937432973": "hkmsvc",
"S-1-5-80-2291748755-1591405548-1905550586-2340871825-1258388485": "HpCISSs",
"S-1-5-80-4028305664-2774326660-44957573-2454826285-2129126537": "HomeGroupListener",
"S-1-5-80-2620923248-4247863784-3378508180-2659151310-2535246811": "HomeGroupProvider",
"S-1-5-80-3952044490-1864224763-1322162546-396143671-1619397437": "HpSAMD",
"S-1-5-80-3734987283-965611577-2130035942-3636592211-2616856863": "HTTP",
"S-1-5-80-970016657-3034632851-3048190821-4182690298-3323420226": "i2omp",
"S-1-5-80-3096896632-2411553352-2084109408-2930423838-4282791216": "hwpolicy",
"S-1-5-80-738727139-3255065492-2264176241-1836141076-1899426695": "i8042prt",
"S-1-5-80-1156567179-1019273932-444819734-1772733284-2107707318": "iaStorV",
"S-1-5-80-2984992224-2588614340-2167448307-2303456600-125847566": "idsvc",
"S-1-5-80-3218395955-317132717-2440444880-267201483-2700625476": "iirsp",
"S-1-5-80-698886940-375981264-2691324669-2937073286-3841916615": "IKEEXT",
"S-1-5-80-3217419572-1740605331-1127140686-2317006352-2064317000": "inetaccs",
"S-1-5-80-3664101217-2276051299-423734030-2746486177-2766044424": "intelide",
"S-1-5-80-817570274-767070440-2629795609-3336305482-1678804590": "intelppm",
"S-1-5-80-2506443892-94066030-1663014834-2885971264-4189966690": "IPBusEnum",
"S-1-5-80-2750735467-3008441591-3989401642-3215998983-1344927289": "IpFilterDriver",
"S-1-5-80-62724632-2456781206-3863850748-1496050881-1042387526": "iphlpsvc",
"S-1-5-80-1361160473-1867727628-1338406996-3302040194-2851723982": "IpInIp",
"S-1-5-80-2771164118-4094026282-2266286801-3306161409-3436440840": "IPMIDRV",
"S-1-5-80-2368102602-26431353-856636621-1497418614-482242802": "IPNAT",
"S-1-5-80-433158070-3235422099-1317741036-1922328546-1834106188": "IRENUM",
"S-1-5-80-1308614567-1511795785-2741360970-8197000-3264788676": "isapnp",
"S-1-5-80-1446792217-3918178545-2165441202-3760590537-1875255596": "iScsiPrt",
"S-1-5-80-2249099846-2157059493-1994460756-1924820827-2369096692": "iteatapi",
"S-1-5-80-750512324-770881543-4197932906-3645560491-3779161573": "iteraid",
"S-1-5-80-1974511938-2400693546-1685170019-203554928-1466978163": "kbdclass",
"S-1-5-80-3058542000-3285469617-40650340-3734485625-1920508542": "kbdhid",
"S-1-5-80-1206118541-1677721718-2423781911-3372378849-3903984073": "KeyIso",
"S-1-5-80-3810688523-3855579666-1860693470-2666993558-46302070": "KSecDD",
"S-1-5-80-638937566-1168471176-3064579757-2631269312-170126454": "KSecPkg",
"S-1-5-80-2818357584-3387065753-4000393942-342927828-138088443": "KtmRm",
"S-1-5-80-879696042-2351668846-370232824-2524288904-4023536711": "LanmanServer",
"S-1-5-80-719998295-2833700043-1566817583-4093942769-1414026312": "LanmanWorkstation",
"S-1-5-80-3356507721-3148410333-1453554623-2317622189-363686743": "ldap",
"S-1-5-80-1339741203-2503426401-303705627-250156843-1210515524": "lltdio",
"S-1-5-80-940647296-341435850-43817331-158078607-2483727905": "lltdsvc",
"S-1-5-80-172094073-716411664-54255058-185476446-2329512179": "lmhosts",
"S-1-5-80-1037107160-813189200-1860894220-2610408748-1807657940": "Lsa",
"S-1-5-80-973905250-3368826558-2408393701-2645888229-3042295110": "LSI_FC",
"S-1-5-80-3066312493-2787136058-3895654580-111488809-2262703568": "LSI_SAS",
"S-1-5-80-935126585-3333887566-2369146147-2658756633-3860083864": "LSI_SAS2",
"S-1-5-80-702453548-2563122194-4165184037-877730421-2039909086": "LSI_SCSI",
"S-1-5-80-381203785-1552481550-3565819581-4159540168-38965703": "luafv",
"S-1-5-80-3770938798-2726624435-2075025292-3280341113-3618470894": "Mcx2Svc",
"S-1-5-80-1503963800-3543347063-2443146678-2767313893-605308357": "megasas",
"S-1-5-80-4024713676-1017792628-381990976-3540878265-1306153904": "MegaSR",
"S-1-5-80-2799810402-4136494038-1094338311-2889966999-3154753985": "MMCSS",
"S-1-5-80-2005225957-2795451222-469338742-3947262705-2044891099": "Modem",
"S-1-5-80-4207690787-1085901060-2295361997-2227230598-1253819078": "monitor",
"S-1-5-80-675551267-1826535266-117093185-28668227-296166608": "mouclass",
"S-1-5-80-3854853272-3832246511-1244659077-3165440039-2262758429": "mouhid",
"S-1-5-80-3601998905-441174471-4117363912-32772110-2632366064": "mountmgr",
"S-1-5-80-4261667920-1220466518-1749771309-2316901739-273317064": "mpio",
"S-1-5-80-3142377179-3443479297-2149323391-1756545698-484011292": "mpsdrv",
"S-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052": "MpsSvc",
"S-1-5-80-2250298043-1491746124-3447101336-2334414474-2555807208": "Mraid35x",
"S-1-5-80-2688027615-1506195528-3802338144-777155390-618458321": "MRxDAV",
"S-1-5-80-2162099894-1456621096-2119874347-3743340265-2368304946": "mrxsmb",
"S-1-5-80-2676550360-252586896-1701879715-2742386574-1171030092": "mrxsmb10",
"S-1-5-80-3970894941-767821303-4047113619-2738918178-2351404876": "mrxsmb20",
"S-1-5-80-276420989-3971400029-4249224515-3588854300-972083571": "msahci",
"S-1-5-80-827450036-3359053657-3286484322-221598818-2985401197": "msdsm",
"S-1-5-80-3960419045-2460139048-4046793004-1809597027-2250574426": "MSDTC",
"S-1-5-80-1515650939-3601430262-2496924429-640160050-3998290523": "MSDTC Bridge 3.0.0.0",
"S-1-5-80-3825916667-3375043415-3384654478-3177665693-2200644784": "Msfs",
"S-1-5-80-4064639957-1408283007-2091294018-2122350837-1986927883": "mshidkmdf",
"S-1-5-80-537088188-2896597613-2307397767-3752262660-2081934664": "msisadrv",
"S-1-5-80-917953661-2020045820-2727011118-2260243830-4032185929": "MSiSCSI",
"S-1-5-80-685333868-2237257676-1431965530-1907094206-2438021966": "msiserver",
"S-1-5-80-1314579368-1827054856-3801607513-4137797117-3785845944": "MSKSSRV",
"S-1-5-80-3515336427-2373706795-1189292716-3451446183-2383180522": "MSPCLOCK",
"S-1-5-80-2550581486-1497628998-1973453189-3108482975-2816921478": "MSPQM",
"S-1-5-80-4273119239-1126992662-2069961181-78804100-786965295": "MsRPC",
"S-1-5-80-2731410647-2404537004-1422510964-3385838496-1398925663": "MSSCNTRS",
"S-1-5-80-2379877105-2122874852-2028670630-1350450415-3977667049": "mssmbios",
"S-1-5-80-294111013-494549581-4136661504-3518049416-761106507": "MSTEE",
"S-1-5-80-772196467-3194495650-2141286422-1986870660-3602995159": "MTConfig",
"S-1-5-80-2851636321-923882121-3805946377-1773657562-2703951580": "Mup",
"S-1-5-80-2006800713-1441093265-249754844-3404434343-1444102779": "napagent",
"S-1-5-80-3451137062-797777108-3464068327-231871278-2024511519": "NativeWifiP",
"S-1-5-80-2183409222-222800135-1539000935-3109909370-1207982808": "NDIS",
"S-1-5-80-1310191460-362243386-72972191-123604350-1188038626": "NdisCap",
"S-1-5-80-3307576507-4040802919-832577921-47721884-821370673": "NdisTapi",
"S-1-5-80-2426641292-1095310648-1538795067-2456674997-547968854": "Ndisuio",
"S-1-5-80-3137956796-3050520361-1309400342-955303752-3583020413": "NdisWan",
"S-1-5-80-3999445478-1493703614-491198216-2250085872-3662815299": "NDProxy",
"S-1-5-80-298519744-3326885196-200884095-1345730765-1206919721": "NetBIOS",
"S-1-5-80-3481163626-3922336224-2171110286-845444925-873416656": "NetBT",
"S-1-5-80-1589317753-1926951874-3424712441-2302911845-2572860984": "Netlogon",
"S-1-5-80-2898649604-2335086160-1904548223-3761738420-3855444835": "Netman",
"S-1-5-80-3635958274-2059881490-2225992882-984577281-633327304": "netprofm",
"S-1-5-80-1773860938-1487242074-882566118-4272343956-2175834232": "NetTcpPortSharing",
"S-1-5-80-3739586395-593861784-2557645679-4197025642-341497066": "nfrd960",
"S-1-5-80-3141615172-2057878085-1754447212-2405740020-3916490453": "NlaSvc",
"S-1-5-80-1093399993-2276725296-2148262981-2274078422-4284582767": "Npfs",
"S-1-5-80-2310782386-4237065203-3688974353-390202159-3511571085": "nsi",
"S-1-5-80-4100249314-4086313984-28913695-873679419-2144728263": "nsiproxy",
"S-1-5-80-1664281202-2302623734-631624840-3461998672-2259661997": "NTDS",
"S-1-5-80-1256884789-1691082103-446998474-1367286246-1639025938": "Ntfs",
"S-1-5-80-2470698091-2858014709-2643764839-982706939-3434751516": "ntrigdigi",
"S-1-5-80-2407861648-785230825-3529290450-2326204529-1810679516": "Null",
"S-1-5-80-3495072887-919096479-2204902451-1048921326-800355041": "nvraid",
"S-1-5-80-3611874924-3178792031-3565391826-286563291-3680247785": "nvstor",
"S-1-5-80-2661219475-1923594960-1294537542-2454943126-82436970": "nv_agp",
"S-1-5-80-4169196349-563482612-2169411968-43761830-802868667": "NwlnkFlt",
"S-1-5-80-1643415749-1981533051-3884744798-2669202348-601031005": "NwlnkFwd",
"S-1-5-80-1196941233-2569882653-2923823926-962244991-4277418": "ohci1394",
"S-1-5-80-967499406-1694984581-2959056265-2481940682-939264259": "p2pimsvc",
"S-1-5-80-1971585524-2528565899-3324366483-1300752743-2325226580": "p2psvc",
"S-1-5-80-3473791808-4104434288-1928902041-1743473672-1277326840": "Parport",
"S-1-5-80-156989346-1343554423-902067029-1673992682-1866693543": "partmgr",
"S-1-5-80-4196153372-502005009-1971508045-3354250645-3015555128": "Parvdm",
"S-1-5-80-1948712186-1330865447-943413596-1669284603-1648638051": "PcaSvc",
"S-1-5-80-2069178898-4023461412-1711560041-390887617-271771820": "pci",
"S-1-5-80-4052642423-944120264-588619640-546327341-1110646568": "pciide",
"S-1-5-80-2795309555-3957969320-2916397881-2593713121-382316838": "pcmcia",
"S-1-5-80-59707871-3298565586-1716270302-948228651-1074156479": "pcw",
"S-1-5-80-1570874813-103103538-3327933986-104584388-2119773521": "PEAUTH",
"S-1-5-80-3124040864-3101396827-3094488734-3028845762-1939139329": "PeerDistSvc",
"S-1-5-80-4023986828-1464965280-3211893748-414212150-4115790068": "PerfDisk",
"S-1-5-80-2413971036-1590988147-3808667159-2204172745-1373631640": "PerfNet",
"S-1-5-80-3515570427-2977692895-3762163048-1504969852-99088878": "PerfOS",
"S-1-5-80-3544016446-4087985546-3773506770-1472693371-3235341583": "PerfProc",
"S-1-5-80-2661322625-712705077-2999183737-3043590567-590698655": "pla",
"S-1-5-80-1981970923-922788642-3535304421-2999920573-318732269": "PlugPlay",
"S-1-5-80-3141781312-1794533130-3616533224-2008760771-2116720301": "PNRPAutoReg",
"S-1-5-80-372467825-374176116-1198570892-3192490889-1232022613": "PNRPsvc",
"S-1-5-80-3044542841-3639452079-4096941652-1606687743-1256249853": "PolicyAgent",
"S-1-5-80-4126081702-1836807445-3803306975-1029803806-2479180530": "PortProxy",
"S-1-5-80-2343416411-2961288913-598565901-392633850-2111459193": "Power",
"S-1-5-80-3735226416-1729687437-1959510470-190511368-398645692": "PptpMiniport",
"S-1-5-80-3367479018-119754134-174380200-3035551807-2744700953": "Processor",
"S-1-5-80-2422153244-111630262-1029994140-3645224535-4078427153": "PROCEXP",
"S-1-5-80-3816717743-33564931-1112267079-3548917561-928358339": "ProfSvc",
"S-1-5-80-656433041-336319937-100815201-2263438610-4002557366": "ProtectedStorage",
"S-1-5-80-133730547-3458667493-930392497-3658715967-3359215708": "Psched",
"S-1-5-80-1010784341-3590640432-2144716203-2371202623-2111191834": "ql2300",
"S-1-5-80-3680784227-2138494325-1045417256-846249285-1494284974": "ql40xx",
"S-1-5-80-1659118645-3148100556-861291880-3953320898-4045657812": "QWAVE",
"S-1-5-80-3324762131-3390532780-137711907-1761928331-1932425801": "QWAVEdrv",
"S-1-5-80-951069737-1097907447-3199478753-2018050253-2083677786": "RasAcd",
"S-1-5-80-4022575210-2284560452-710265691-3594820739-387418549": "RasAgileVpn",
"S-1-5-80-1802467488-1541022566-2033325545-854566965-652742428": "RasAuto",
"S-1-5-80-1290287420-3502600185-382990664-1700026297-1337626153": "Rasl2tp",
"S-1-5-80-4176366874-305252471-2256717057-2714189771-3552532790": "RasMan",
"S-1-5-80-4122454071-3550668693-4211410744-1298358403-2272725717": "RasPppoe",
"S-1-5-80-1331337031-2474836174-2661672254-391271513-2096420174": "RasSstp",
"S-1-5-80-2489667-2470848582-3865645512-452901963-4178804252": "rdbss",
"S-1-5-80-3687944073-3313860148-3136628839-3387249243-1709534714": "rdpbus",
"S-1-5-80-2431288241-149984296-2543083935-4067350611-1975817884": "RDPCDD",
"S-1-5-80-981872547-3861006530-3984275202-4085961120-2027028908": "RDPDD",
"S-1-5-80-23661045-4033652049-3526044993-1401805078-1749661838": "RDPDR",
"S-1-5-80-3464459778-79086046-1894495498-3954672505-2750168721": "RDPENCDD",
"S-1-5-80-191927475-3325244020-2133763035-2511185485-3827563125": "RDPNP",
"S-1-5-80-1432111213-2818786930-2152807080-3377190559-901933699": "RDPREFMP",
"S-1-5-80-1857653372-1313752195-3783661666-502273730-1171188227": "RDPWD",
"S-1-5-80-3474873350-2412947251-3085823233-2315640422-3546857610": "rdyboost",
"S-1-5-80-1954729425-4294152082-187165618-318331177-3831297489": "RemoteAccess",
"S-1-5-80-2822507136-3601578665-1013168651-121944544-1825232178": "RemoteRegistry",
"S-1-5-80-521322694-906040134-3864710659-1525148216-3451224162": "RpcEptMapper",
"S-1-5-80-4056015446-1496461683-1723632270-3351149576-1119802320": "RpcLocator",
"S-1-5-80-979556362-403687129-3954533659-2335141334-1547273080": "RpcSs",
"S-1-5-80-25112808-303066962-2306571906-3820953744-554449017": "rspndr",
"S-1-5-80-3189092957-1825937568-2097962828-592273195-15751640": "s3cap",
"S-1-5-80-3453257571-682267348-3447719424-2810041157-893746920": "SamSs",
"S-1-5-80-2172748946-1139208647-3745649895-1734051075-2323558886": "sbp2port",
"S-1-5-80-1209419826-1829913269-3824447628-1153237837-3789837839": "SCardSvr",
"S-1-5-80-3145502940-3408664484-1477142494-2517801300-3177717725": "scfilter",
"S-1-5-80-4125092361-1567024937-842823819-2091237918-836075745": "Schedule",
"S-1-5-80-1691538513-4084330536-1620899472-1113280783-3554754292": "SCPolicySvc",
"S-1-5-80-2983134835-1185273323-1712700529-1489848661-2325612824": "SDRSVC",
"S-1-5-80-1722176216-3611007545-3657005850-3814612847-1080390000": "secdrv",
"S-1-5-80-1399994486-219206332-302438500-304602034-1537790326": "seclogon",
"S-1-5-80-4259241309-1822918763-1176128033-1339750638-3428293995": "SENS",
"S-1-5-80-3168472476-176724102-2968832672-2340942973-2241613192": "SensrSvc",
"S-1-5-80-1658387481-2925800327-3198882180-3147662777-2274689045": "Serenum",
"S-1-5-80-3562253942-857828347-2712713407-944836455-3636585461": "Serial",
"S-1-5-80-3369720968-4228855631-3683183521-2094993598-1022421131": "sermouse",
"S-1-5-80-675414407-775065359-1035864904-999747831-2072146957": "ServiceModelEndpoint 3.0.0.0",
"S-1-5-80-1904953591-2738210791-1061154185-3936071259-221446881": "ServiceModelOperation 3.0.0.0",
"S-1-5-80-297390187-2405189348-2222284465-2989988878-4218767654": "ServiceModelService 3.0.0.0",
"S-1-5-80-4022436659-1090538466-1613889075-870485073-3428993833": "SessionEnv",
"S-1-5-80-1220365695-3871163487-2301282001-885120026-718998505": "sffdisk",
"S-1-5-80-1593449009-2408870187-1077724223-1518188577-3728252823": "sffp_mmc",
"S-1-5-80-1659054941-531967795-1983128084-3748020815-2241757750": "sffp_sd",
"S-1-5-80-1407380289-3518059920-3931497022-2754447733-2222417609": "sfloppy",
"S-1-5-80-2009329905-444645132-2728249442-922493431-93864177": "SharedAccess",
"S-1-5-80-1690854464-3758363787-3981977099-3843555589-1401248062": "ShellHWDetection",
"S-1-5-80-2037654479-150732571-4235160932-1988269395-3027078133": "sisagp",
"S-1-5-80-2290943609-1211775869-3660739483-1432647055-1639441565": "SiSRaid2",
"S-1-5-80-1016766434-4163349990-2054491751-1265000292-413406215": "SiSRaid4",
"S-1-5-80-2119565420-4155874467-2934723793-509086461-374458824": "slsvc",
"S-1-5-80-429025866-4105586292-427562881-1309981334-1060966148": "SLUINotify",
"S-1-5-80-97513841-1071082959-3069755588-526311685-2961431215": "Smb",
"S-1-5-80-2400470686-1781479961-2091307112-2920730856-2901594176": "SMSvcHost 3.0.0.0",
"S-1-5-80-3964583643-2633443559-2834438935-3739664028-1580655619": "SNMPTRAP",
"S-1-5-80-2246094146-3761615012-3991572358-959820157-1291755210": "spldr",
"S-1-5-80-3951239711-1671533544-1416304335-3763227691-3930497994": "Spooler",
"S-1-5-80-123231216-2592883651-3715271367-3753151631-4175906628": "sppsvc",
"S-1-5-80-2105443381-1869407242-828286827-1344996006-2512971347": "sppuinotify",
"S-1-5-80-3318989984-2647182497-3022510041-1919214433-3551303480": "srv",
"S-1-5-80-1034188721-156321652-2901307485-3049929104-2850741453": "srv2",
"S-1-5-80-385674269-2427993094-4248660116-187565782-2803330530": "srvnet",
"S-1-5-80-486568272-975562994-1883531608-2732234258-332540751": "SSDPSRV",
"S-1-5-80-3435701886-799518250-3791383489-3228296122-2938884314": "SstpSvc",
"S-1-5-80-2502136977-515215333-1091199184-4078967732-698071891": "stexstor",
"S-1-5-80-3182985763-1431228038-2757062859-428472846-3914011746": "StiSvc",
"S-1-5-80-3877927215-2009774003-1789373229-1350139498-1490546062": "storflt",
"S-1-5-80-3355894222-2288616474-3163838539-1515771758-43395969": "StorSvc",
"S-1-5-80-2227193670-1472088527-4216801891-1255609005-3742950393": "storvsc",
"S-1-5-80-2499453150-1816575225-2698105218-861119070-2299588587": "swenum",
"S-1-5-80-1614360071-3471039648-1078047007-3707138327-1664821506": "swprv",
"S-1-5-80-3277458932-3608563558-2424252742-1006353051-3439664691": "Symc8xx",
"S-1-5-80-714262929-1152213303-426872964-3738532716-4000887735": "Sym_hi",
"S-1-5-80-73616012-2741736120-1450548080-3749295283-3869351969": "Sym_u3",
"S-1-5-80-2590341223-3996088049-3993122417-23640849-324535191": "SysMain",
"S-1-5-80-949921180-3923668869-394927020-528789358-3592448931": "TabletInputService",
"S-1-5-80-4230913304-2206818457-801678004-120036174-1892434133": "TapiSrv",
"S-1-5-80-4167276341-681140529-2035857140-584847688-708058301": "TBS",
"S-1-5-80-2869215396-3426808149-752611693-425565463-2833823703": "Tcpip",
"S-1-5-80-842221325-3630721446-2015653073-424833842-1069621030": "TCPIP6",
"S-1-5-80-1243767512-207181711-1639953288-846964026-179032965": "TCPIP6TUNNEL",
"S-1-5-80-183440435-3873164873-1814133288-2746138770-1127128543": "tcpipreg",
"S-1-5-80-517380867-1805075581-15937331-3649701458-2279870393": "TCPIPTUNNEL",
"S-1-5-80-1205525636-1316560639-1871536985-2915653626-3847227622": "TDPIPE",
"S-1-5-80-2653571336-860310240-1707811817-3246300807-2032786575": "TDTCP",
"S-1-5-80-1811008277-2130293716-2312968959-3698054739-726352487": "tdx",
"S-1-5-80-600900383-3940208308-3622757659-1160125390-3717916961": "TermDD",
"S-1-5-80-446051430-1559341753-4161941529-1950928533-810483104": "TermService",
"S-1-5-80-1189432293-2777010110-2640223427-1344437502-1956879817": "Themes",
"S-1-5-80-56840347-690487168-3179794702-1332568925-762031181": "THREADORDER",
"S-1-5-80-537470750-3688389562-3749243086-269898693-579266445": "TPAutoConnSvc",
"S-1-5-80-1495131930-2676463755-2136540566-1190107536-2533052015": "TPVCGateway",
"S-1-5-80-768763963-4214222998-2156221936-2953597973-713500239": "TrkWks",
"S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464": "TrustedInstaller",
"S-1-5-80-602153688-1728218534-2156437410-2444491971-1703742505": "TSDDD",
"S-1-5-80-3250179172-3414919659-2784612865-1947102831-1832745880": "tssecsrv",
"S-1-5-80-3666930311-739912689-1101093007-1147922636-412121971": "tunmp",
"S-1-5-80-3579196564-3960183121-2393617881-1570124860-2153905208": "tunnel",
"S-1-5-80-3249175164-480052304-527258952-251146422-1017202920": "uagp35",
"S-1-5-80-4290168682-2694755981-2883756118-2205499398-4079537721": "udfs",
"S-1-5-80-2413584400-2834772909-3391057178-2993126719-4094614649": "UGatherer",
"S-1-5-80-900581847-2069635957-4095211819-2149323943-1216697729": "UGTHRSVC",
"S-1-5-80-997887591-2350776071-3817597635-4146973621-2526406719": "UI0Detect",
"S-1-5-80-4194149548-235381792-2829184477-3934495640-667433095": "uliagpkx",
"S-1-5-80-2051301031-3598501189-881763489-2611917303-2352103085": "uliahci",
"S-1-5-80-4294381996-3573690956-4084941264-2318251564-135754816": "UlSata",
"S-1-5-80-2849548708-3602852847-3953931013-1110249439-3333230880": "ulsata2",
"S-1-5-80-3018007626-163191633-622627787-1206491734-2917835273": "umbus",
"S-1-5-80-2029728201-2796881031-2302868875-2454600822-1203790938": "UmPass",
"S-1-5-80-2014626298-1656748749-3847481816-918933055-2469338456": "UmRdpService",
"S-1-5-80-448846144-1414373772-1578130625-718576682-2306699751": "upnphost",
"S-1-5-80-3724553804-53543757-2557641770-141295351-1687883918": "usb",
"S-1-5-80-4022141922-741376770-3260236731-1675477288-3792235576": "usbccgp",
"S-1-5-80-2601879200-4032607390-2815923362-3101623786-2213233685": "usbcir",
"S-1-5-80-1032545752-2203350250-1701939687-317337126-3231707909": "usbehci",
"S-1-5-80-676136802-2607101929-335774531-4135730467-913299484": "usbhub",
"S-1-5-80-3434778094-456680973-2488395463-338906152-1015349184": "usbohci",
"S-1-5-80-3620574345-1163766744-4010839292-3531329841-768311061": "usbprint",
"S-1-5-80-376233901-499118290-773318279-1925188704-297947815": "USBSTOR",
"S-1-5-80-2717376493-4290053016-2054941639-3048903775-1780974753": "usbuhci",
"S-1-5-80-2815190569-4075358141-1041947382-2198045348-980246365": "UxSms",
"S-1-5-80-2901324718-895851292-2096622302-170690027-1637913602": "VaultSvc",
"S-1-5-80-2236596344-777810374-464678914-301799185-133794676": "vdrvroot",
"S-1-5-80-2196396108-1448510645-203779624-3888580976-3789157697": "vds",
"S-1-5-80-1636345116-1749775499-167646407-1402041886-784684825": "vga",
"S-1-5-80-1604054522-1120073184-2766342441-3740248177-2194771659": "VgaSave",
"S-1-5-80-2349230263-3936233330-585165183-483748113-2063106807": "vhdmp",
"S-1-5-80-269018121-2628019534-3958128902-1689023713-3977233287": "viaagp",
"S-1-5-80-702914695-4281403409-954615538-3988029004-192649218": "ViaC7",
"S-1-5-80-3488702259-1115883433-1783531185-1350626685-2323838072": "viaide",
"S-1-5-80-3414199520-1924951526-579304523-1555932441-262361574": "vm3dmp",
"S-1-5-80-3316781363-2712907428-2579548995-1296955556-57435734": "VMAUDIO",
"S-1-5-80-394042835-174396444-3357755573-789530950-2357907384": "vmbus",
"S-1-5-80-3485585108-3288609388-3381644673-894183282-3425970148": "VMBusHID",
"S-1-5-80-2053731399-3564616636-592537298-4187980385-3071434599": "vmci",
"S-1-5-80-4081816966-3135276745-2345987325-2511854693-3099376874": "vmdebug",
"S-1-5-80-2844247271-1920892496-2185725435-2733799570-1491885128": "vmhgfs",
"S-1-5-80-2713566713-2012099321-1704287870-164250842-2950185051": "VMMEMCTL",
"S-1-5-80-616456234-2657522756-2692773202-1293725715-2143369223": "vmmouse",
"S-1-5-80-470576323-3739623512-411527224-1524486745-930631467": "vmrawdsk",
"S-1-5-80-994229404-1081919929-268374983-1858992150-4232923339": "VMTools",
"S-1-5-80-3615470141-4057994987-1930054357-1444440834-2714780835": "VMUpgradeHelper",
"S-1-5-80-3972256235-858188783-2536722634-3029314587-3393749697": "vmvss",
"S-1-5-80-1570634675-3893565091-22195573-2267868061-2898682217": "volmgr",
"S-1-5-80-2228288927-839465256-4097931996-4258784654-3424789253": "volmgrx",
"S-1-5-80-2161309226-1540144261-2901834345-3792977468-1183436922": "volsnap",
"S-1-5-80-1269120828-58111527-683397690-4062780901-3407528550": "vsmraid",
"S-1-5-80-3195062495-2862850656-3724129271-1847284719-4038691091": "VSS",
"S-1-5-80-4271242282-3170619077-2600330701-1558677754-1139114601": "vwifibus",
"S-1-5-80-4267341169-2882910712-659946508-2704364837-2204554466": "W32Time",
"S-1-5-80-989796750-4090848350-2040919084-978865222-2182970707": "W3SVC",
"S-1-5-80-1272828037-3321607953-1682131387-4084423848-3273467238": "WacomPen",
"S-1-5-80-145391760-3682396335-1395736941-2543690743-1822485816": "WANARP",
"S-1-5-80-3957613141-1606606214-622769385-3049525404-2510868034": "Wanarpv6",
"S-1-5-80-1549550529-11381693-4027442525-4081535042-2424139505": "wbengine",
"S-1-5-80-1577343513-2244782562-3500840712-2807016722-4230555396": "WbioSrvc",
"S-1-5-80-1555863574-1012459212-3842453055-37978308-1142448422": "wcncsvc",
"S-1-5-80-4064017820-1559943312-846267769-2219870576-1957141527": "WcsPlugInService",
"S-1-5-80-3405261312-3324525412-773550320-3159108954-1126011555": "Wd",
"S-1-5-80-2731089040-2526960094-3333867314-868407530-1311763772": "Wdf01000",
"S-1-5-80-3139157870-2983391045-3678747466-658725712-1809340420": "WdiServiceHost",
"S-1-5-80-3524758515-3090971750-345616940-2322499744-3530715838": "WdiSystemHost",
"S-1-5-80-324959683-3395802011-921526492-919036580-1730255754": "WebClient",
"S-1-5-80-4059739203-877974739-1245631912-527174227-2996563517": "Wecsvc",
"S-1-5-80-3594706986-2537596223-181334840-1741483385-1351671666": "wercplsupport",
"S-1-5-80-3299868208-4286319593-1091140620-3583751967-1732444380": "WerSvc",
"S-1-5-80-2019001281-2253379323-945087313-3738653069-3773415333": "WfpLwf",
"S-1-5-80-4016954646-3779912912-520790876-2627662839-2216516612": "WIMMount",
"S-1-5-80-1367312344-4235937835-3348187091-2947416599-1643272376": "win32dd",
"S-1-5-80-1913148863-3492339771-4165695881-2087618961-4109116736": "WinDefend",
"S-1-5-80-3760743496-293058752-544796799-945139227-648175845": "Windows Workflow Foundation 3.0.0.0",
"S-1-5-80-2455429942-3131183193-3617688776-595395669-3772047725": "WinHttpAutoProxySvc",
"S-1-5-80-3750560858-172214265-3889451188-1914796615-4100997547": "Winmgmt",
"S-1-5-80-569256582-2953403351-2909559716-1301513147-412116970": "WinRM",
"S-1-5-80-3758380775-581010763-2947690711-3499621892-3054972477": "Winsock",
"S-1-5-80-197470898-1564017914-2276667423-138762734-2890991316": "WinSock2",
"S-1-5-80-1428027539-3309602793-2678353003-1498846795-3763184142": "Wlansvc",
"S-1-5-80-404760553-4074834012-3606039051-2170089041-3496108291": "WmiAcpi",
"S-1-5-80-1672893355-2301755825-1450106782-2724904875-1401714515": "WmiApRpl",
"S-1-5-80-1851371743-411767070-3743290205-1090512353-603110601": "wmiApSrv",
"S-1-5-80-2375682873-768044350-3534595160-1005545032-2873800392": "WMPNetworkSvc",
"S-1-5-80-2153317275-3787551921-2333987345-3394040919-509713777": "WPCSvc",
"S-1-5-80-113310567-2163499630-2787090463-221477905-209227094": "WPDBusEnum",
"S-1-5-80-1339864866-2803517768-580965624-1158720225-1206284216": "ws2ifsl",
"S-1-5-80-3232712927-1625117661-2590453128-1738570065-3637376297": "wscsvc",
"S-1-5-80-117416528-2204451360-1913602512-1355018040-1234992034": "WSearch",
"S-1-5-80-1961591210-2878639619-2091680054-2529124376-3572759234": "WSearchIdxPi",
"S-1-5-80-1014140700-3308905587-3330345912-272242898-93311788": "wuauserv",
"S-1-5-80-69171120-2364612362-2758615892-3595098197-2063739924": "WudfPf",
"S-1-5-80-1839061227-813336325-324579571-4216704371-1399658985": "WUDFRd",
"S-1-5-80-2652678385-582572993-1835434367-1344795993-749280709": "wudfsvc",
"S-1-5-80-3981856537-581775623-1136376035-2066872258-409572886": "WwanSvc",
"S-1-5-80-2933569122-2468899862-1495779727-289297006-142656920": "xmlprov"
},
"sids re":[
["S-1-5-[0-9-]+-500$", "Administrator"],
["S-1-5-[0-9-]+-501$", "Guest"],
["S-1-5-[0-9-]+-502$", "KRBTGT"],
["S-1-5-[0-9-]+-512$", "Domain Admins"],
["S-1-5-[0-9-]+-513$", "Domain Users"],
["S-1-5-[0-9-]+-514$", "Domain Guests"],
["S-1-5-[0-9-]+-515$", "Domain Computers"],
["S-1-5-[0-9-]+-516$", "Domain Controllers"],
["S-1-5-[0-9-]+-517$", "Cert Publishers"],
["S-1-5-[0-9-]+-520$", "Group Policy Creator Owners"],
["S-1-5-[0-9-]+-533$", "RAS and IAS Servers"],
["S-1-5-5-[0-9]+-[0-9]+", "Logon Session"],
["S-1-5-21-[0-9-]+-518$", "Schema Admins"],
["S-1-5-21-[0-9-]+-519$", "Enterprise Admins"],
["S-1-5-21-[0-9-]+-553$", "RAS Servers"],
["S-1-5-21-[0-9-]+-498$", "Enterprise Read-Only Domain Controllers"],
["S-1-5-21-[0-9-]+-521$", "Read-Only Domain Controllers"],
["S-1-5-21-[0-9-]+-522$", "Cloneable Domain Controllers"],
["S-1-5-21-[0-9-]+-525$", "Protected Users"],
["S-1-5-21-[0-9-]+-553$", "Remote Access Services (RAS)"]
],
"privileges":{
2: ['SeCreateTokenPrivilege', "Create a token object"],
3: ['SeAssignPrimaryTokenPrivilege', "Replace a process-level token"],
4: ['SeLockMemoryPrivilege', "Lock pages in memory"],
5: ['SeIncreaseQuotaPrivilege', "Increase quotas"],
6: ['SeMachineAccountPrivilege', "Add workstations to the domain"],
7: ['SeTcbPrivilege', "Act as part of the operating system"],
8: ['SeSecurityPrivilege', "Manage auditing and security log"],
9: ['SeTakeOwnershipPrivilege', "Take ownership of files/objects"],
10: ['SeLoadDriverPrivilege', "Load and unload device drivers"],
11: ['SeSystemProfilePrivilege', "Profile system performance"],
12: ['SeSystemtimePrivilege', "Change the system time"],
13: ['SeProfileSingleProcessPrivilege', "Profile a single process"],
14: ['SeIncreaseBasePriorityPrivilege', "Increase scheduling priority"],
15: ['SeCreatePagefilePrivilege', "Create a pagefile"],
16: ['SeCreatePermanentPrivilege', "Create permanent shared objects"],
17: ['SeBackupPrivilege', "Backup files and directories"],
18: ['SeRestorePrivilege', "Restore files and directories"],
19: ['SeShutdownPrivilege', "Shut down the system"],
20: ['SeDebugPrivilege', "Debug programs"],
21: ['SeAuditPrivilege', "Generate security audits"],
22: ['SeSystemEnvironmentPrivilege', "Edit firmware environment values"],
23: ['SeChangeNotifyPrivilege', "Receive notifications of changes to files or directories"],
24: ['SeRemoteShutdownPrivilege', "Force shutdown from a remote system"],
25: ['SeUndockPrivilege', "Remove computer from docking station"],
26: ['SeSyncAgentPrivilege', "Synch directory service data"],
27: ['SeEnableDelegationPrivilege', "Enable user accounts to be trusted for delegation"],
28: ['SeManageVolumePrivilege', "Manage the files on a volume"],
29: ['SeImpersonatePrivilege', "Impersonate a client after authentication"],
30: ['SeCreateGlobalPrivilege', "Create global objects"],
31: ['SeTrustedCredManAccessPrivilege', "Access Credential Manager as a trusted caller"],
32: ['SeRelabelPrivilege', "Modify the mandatory integrity level of an object"],
33: ['SeIncreaseWorkingSetPrivilege', "Allocate more memory for user applications"],
34: ['SeTimeZonePrivilege', "Adjust the time zone of the computer's internal clock"],
35: ['SeCreateSymbolicLinkPrivilege', "Required to create a symbolic link"],
36: ["SeDelegateSessionUserImpersonatePrivilege", "Obtain an impersonation token for another user in the same session."]
}
}