Me, myself & IT

P(h)un Intended: Phamous Quotes, Phunny Spaces, Phancy Backslashes, plus Phorged Environment Variables, for a Phabulous Backlash

Purpose
Reason
Vendor Documentation
Background Information
Detection: Windows 10 2004 and 20H2, x64 alias AMD64 Processor Architecture; Windows 10 1903 and 1909, x86 alias I386 Processor Architecture
Demonstration: Exploit 0; Exploit 1; Exploit 2; Exploit 3; Exploit 4; Exploit 5
Vendor Statement
Mitigation

Purpose

Demonstrate (trivial but widespread) vulnerabilities of Microsoft^® Windows^™ resulting from exceptionally poor(est) programming practise, ignorance, missing security awareness, plus failure to exercise trustworthy computing and defense in depth.

Note: these well-known weaknesses are documented as CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), CWE-73: External Control of File Name or Path, CWE-426: Untrusted Search Path, CWE-427: Uncontrolled Search Path Element and CWE-428: Unquoted Search Path or Element in the CWE^™, allowing well-known attacks like CAPEC-13: Subverting Environment Variable Values and CAPEC-471: Search Order Hijacking documented in the CAPEC^™.

Reason

30 years after introducing long filenames, and despite their own copious documentation, Microsoft still ships Windows with vulnerable command lines missing (double) quotes as well as fully qualified (absolute) pathnames and COM classes registered with vulnerable unqualified filenames.
Additionally (user-controlled) environment variables are still used (not just) in command lines and the pathnames of COM classes.

The cause for the prevalence of these trivial to exploit vulnerabilities are careless, clueless and sloppy developers who are most obviously not aware of any security (implications) as well as their own company’s documentation, plus the total absence of any (serious) quality assurance and supervision!

Vendor Documentation

For one of the oldest still available documents see the MSKB article 102739:

Use quotation marks when specifying long filenames or paths with spaces.
[…]
Note that the quotation marks must be used.

In section ShellExecute, ShellExecuteEx, and Related Functions the MSDN article Security Considerations: Microsoft Windows Shell specifies:

Make sure you provide an unambiguous definition of the application that is to be executed.

When providing the executable file's path, provide the fully qualified path. Do not depend on the Shell to locate the file.

If you provide a command-line string that contains white space, wrap the string in quotation marks. Otherwise, the parser might interpret a single element that contains spaces as multiple elements.

In section Security Remarks the MSDN article WinExec function specifies:

The executable name is treated as the first white space-delimited string in lpCmdLine. If the executable or path name has a space in it, there is a risk that a different executable could be run because of the way the function parses spaces.

In section Shortcut Menu Verbs the MSDN article Verbs and File Associations specifies:

If any element of the command string contains or might contain spaces, it must be enclosed in quotation marks. Otherwise, if the element contains a space, it will not parse correctly. For instance, "My Program.exe" starts the application properly. If you use My Program.exe without quotation marks, then the system attempts to launch My with Program.exe as its first command line argument. You should always use quotation marks with arguments such as %1 that are expanded to strings by the Shell, because you cannot be certain that the string will not contain a space.

In section Registering an Open Verb the MSDN article Registering Programs with Client Types specifies:

The command line must specify a fully qualified absolute path to the file, followed by optional command-line options. If the entry type is REG_EXPAND_SZ, environment variables can be used in the path. Use quotation marks appropriately to ensure that spaces in the command line are not misinterpreted.

Above section Security Issues the MSDN article Registering an Application to a URI Scheme specifies:

When ShellExecute() executes the pluggable protocol handler with a string on the command line, any non-encoded spaces, quotes, and backslashes in the URI will be interpreted as part of the command line. This means that if you use C/C++'s argc and argv to determine the arguments passed to your application, the string may be broken across multiple parameters. To mitigate this issue:

Avoid spaces, quotes, or backslashes in your URI

Quote the %1 in the registration ("%1" as written in the 'alert' example registration)

In section Security Remarks the MSDN article CreateProcess function specifies:

If the executable or path name has a space in it, there is a risk that a different executable could be run because of the way the function parses spaces.

In section Parameters the MSDN article CreateService function specifies:

lpBinaryPathName [in, optional]

The fully qualified path to the service binary file. If the path contains a space, it must be quoted so that it is correctly interpreted. For example, "d:\\my share\\myservice.exe" should be specified as "\"d:\\my share\\myservice.exe\"".

At its bottom the MSDN article Self-Registration specifies:

The server must register the full path to the installation location of the DLL or EXE module for their respective InprocServer32, InprocHandler32, and LocalServer32 keys in the registry.

In section Remarks the MSDN article DefaultIcon specifies:

This is a REG_SZ value that specifies the full path to the executable name […]

In section Remarks the MSDN article LocalServer specifies:

Specifies the full path to a 16-bit local server application.

In section Remarks the MSDN article LocalServer32 specifies:

Specifies the full path to a 32-bit local server application.
[…]
The ServerExecutable value, which is of type REG_SZ and is supported starting with Windows Server 2003, works in conjunction with the LocalServer32 subkey to prevent any ambiguity when using the CreateProcess function. LocalServer32 specifies the location of the COM server application to launch, and this information is passed as the first parameter lpApplicationName for CreateProcess. Depending on the implementation of CreateProcess, this information might be ambiguous. For this reason, if ServerExecutable is specified, COM passes the ServerExecutable named value to the lpApplicationName parameter of CreateProcess. If ServerExecutable is not specified, COM passes NULL as the value for the first parameter of CreateProcess.
To help provide system security, use quoted strings in the path to indicate where the executable filename ends and the arguments begin.

Note: the MSDN articles InprocHandler, InprocHandler32, InprocServer, InprocServer32 and ToolBoxBitmap32 fail to specify the use of fully qualified (absolute) pathnames and need to be corrected!

Since COM in-process handlers and servers are implemented in DLLs, the MSDN article Dynamic-Link Library Security, the MSKB article 2389418, the Security Advisory 2269637 and the MSRC blog post Load Library Safely apply too:

Wherever possible, specify a fully qualified path when using the LoadLibrary, LoadLibraryEx, CreateProcess, or ShellExecute functions.

Use fully qualified paths for all calls to LoadLibrary, CreateProcess, and ShellExecute where you can.

This exploit may occur when applications do not directly specify the fully qualified path to a library it intends to load.

Always specify the fully qualified path when the library location is constant.

Background Information

Windows Vista^® and newer versions of Windows are shipped as (pre-built) generalised system images, designed to run from a single hard disk partition with the drive letter C assigned. All directories and files contained within these system images have fixed, language-independent (path)names and can neither be relocated nor renamed: see the MSKB articles 933700, 949977 and 2787623 for some details. Additionally the vast majority of files are (nowadays) registered with their absolute (fully qualified) pathname containing the (fixed) drive letter and the language-independent directory name, which renders their change or relocation practically impossible.

The use of environment variables within pathnames serves no (good) purpose, it is not just deprecated and superfluous, but outright dangerous, allowing attacks like those shown below in the first place, and must therefore be avoided and banned!

This holds of course against the use of environment variables in code too, where functions like GetAllUsersProfileDirectory(), GetComputerName(), GetComputerNameEx(), GetComputerObjectName(), GetProfilesDirectory(), GetSystemDirectory(), GetSystemWow64Directory(), GetUserName(), GetUserNameEx(), GetUserProfileDirectory(), GetWindowsDirectory(), SHGetFolderPath() and SHGetKnownFolderPath() are available to get at least the information provided in the environment variables %ALLUSERSPROFILE%, %APPDATA%, %CommonProgramFiles%, %CommonProgramFiles(x86)%, %COMPUTERNAME%, %LOCALAPPDATA%, %ProgramData%, %ProgramFiles%, %ProgramFiles(x86)%, %PUBLIC%, %SystemDrive%, %SystemRoot%, %USERDOMAIN%, %USERNAME% as well as %USERPROFILE%, which ~~should~~ must be used instead of functions like ExpandEnvironmentStrings(), ExpandEnvironmentStringsForUser() or GetEnvironmentVariable()!

Detection

Start the Command Processor and run the following command lines to find some command lines registered with unqualified filenames, with unquoted long pathnames containing spaces, with unquoted pathnames containing environment variables and with unquoted arguments.

Note: the command lines can be copied and pasted as blocks into the Command Processor window!

Note: offending parts of matching command lines are highlighted in the output.

Note: the search is far from exhaustive, it covers just the command lines returned from the FTYPE command, i.e. file types registered with the Verb Open, executables registered with COM classes, cryptography providers and Group Policy client side extensions!

Windows 10 2004 and 20H2, x64 alias AMD64 Processor Architecture

Cryptography providers:

REG.EXE QUERY "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography" /REG:64 /S /V "Dll"
REG.EXE QUERY "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography" /REG:64 /S /V "$DLL"
REG.EXE QUERY "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography" /REG:32 /S /V "Dll"
REG.EXE QUERY "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography" /REG:32 /S /V "$DLL"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\AggregateSSLHandshakeTime\DEFAULT
    Dll    REG_MULTI_SZ    C:\Windows\System32\SecureTimeAggregator.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllLogMismatchPinRules\DEFAULT
    Dll    REG_MULTI_SZ    C:\Windows\System32\cryptui.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllOpenStoreProv\#16
    Dll    REG_SZ    C:\Windows\System32\cryptnet.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllOpenStoreProv\Ldap
    Dll    REG_SZ    C:\Windows\System32\cryptnet.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllProtectedRootMessageBox\DEFAULT
    Dll    REG_MULTI_SZ    C:\Windows\System32\cryptui.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptDllProtectPrompt\DEFAULT
    Dll    REG_MULTI_SZ    C:\Windows\System32\cryptui.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData\{000C10F1-0000-0000-C000-000000000046}
    Dll    REG_SZ    C:\Windows\System32\MSISIP.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData\{06C9E010-38CE-11D4-A2A3-00104BD35090}
    Dll    REG_SZ    C:\Windows\System32\wshext.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData\{0AC5DF4B-CE07-4DE2-B76E-23C839A09FD1}
    Dll    REG_SZ    C:\Windows\System32\AppxSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData\{0F5F58B3-AADE-4B9A-A434-95742D92ECEB}
    Dll    REG_SZ    C:\Windows\System32\AppxSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData\{1629F04E-2799-4DB5-8FE5-ACE10F17EBAB}
    Dll    REG_SZ    C:\Windows\System32\wshext.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData\{1A610570-38CE-11D4-A2A3-00104BD35090}
    Dll    REG_SZ    C:\Windows\System32\wshext.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData\{5598CFF1-68DB-4340-B57F-1CACF88C9A51}
    Dll    REG_SZ    C:\Windows\System32\AppxSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData\{603BCC1F-4B59-4E08-B724-D2C6297EF351}
    Dll    REG_SZ    C:\Windows\System32\WindowsPowerShell\v1.0\pwrshsip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData\{9BA61D3F-E73A-11D0-8CD2-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData\{9F3053C5-439D-4BF7-8A77-04F0450A1D9F}
    Dll    REG_SZ    C:\Windows\System32\EsdSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData\{C689AAB8-8E78-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData\{C689AAB9-8E78-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData\{C689AABA-8E78-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData\{CF78C6DE-64A2-4799-B506-89ADFF5D16D6}
    Dll    REG_SZ    C:\Windows\System32\AppxSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData\{D1D04F0C-9ABA-430D-B0E4-D7E96ACCE66C}
    Dll    REG_SZ    C:\Windows\System32\AppxSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData\{DE351A42-8E59-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData\{DE351A43-8E59-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetCaps\{9BA61D3F-E73A-11D0-8CD2-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetCaps\{9F3053C5-439D-4BF7-8A77-04F0450A1D9F}
    Dll    REG_SZ    C:\Windows\System32\EsdSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetCaps\{C689AAB8-8E78-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetCaps\{C689AAB9-8E78-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetCaps\{C689AABA-8E78-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetCaps\{DE351A42-8E59-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetCaps\{DE351A43-8E59-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSealedDigest\{9BA61D3F-E73A-11D0-8CD2-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSealedDigest\{C689AAB8-8E78-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSealedDigest\{C689AAB9-8E78-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSealedDigest\{C689AABA-8E78-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSealedDigest\{DE351A42-8E59-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSealedDigest\{DE351A43-8E59-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{000C10F1-0000-0000-C000-000000000046}
    Dll    REG_SZ    C:\Windows\System32\MSISIP.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{06C9E010-38CE-11D4-A2A3-00104BD35090}
    Dll    REG_SZ    C:\Windows\System32\wshext.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{0AC5DF4B-CE07-4DE2-B76E-23C839A09FD1}
    Dll    REG_SZ    C:\Windows\System32\AppxSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{0F5F58B3-AADE-4B9A-A434-95742D92ECEB}
    Dll    REG_SZ    C:\Windows\System32\AppxSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{1629F04E-2799-4DB5-8FE5-ACE10F17EBAB}
    Dll    REG_SZ    C:\Windows\System32\wshext.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{1A610570-38CE-11D4-A2A3-00104BD35090}
    Dll    REG_SZ    C:\Windows\System32\wshext.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{5598CFF1-68DB-4340-B57F-1CACF88C9A51}
    Dll    REG_SZ    C:\Windows\System32\AppxSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{603BCC1F-4B59-4E08-B724-D2C6297EF351}
    Dll    REG_SZ    C:\Windows\System32\WindowsPowerShell\v1.0\pwrshsip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{9BA61D3F-E73A-11D0-8CD2-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{9F3053C5-439D-4BF7-8A77-04F0450A1D9F}
    Dll    REG_SZ    C:\Windows\System32\EsdSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{C689AAB8-8E78-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{C689AAB9-8E78-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{C689AABA-8E78-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{CF78C6DE-64A2-4799-B506-89ADFF5D16D6}
    Dll    REG_SZ    C:\Windows\System32\AppxSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{D1D04F0C-9ABA-430D-B0E4-D7E96ACCE66C}
    Dll    REG_SZ    C:\Windows\System32\AppxSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{DE351A42-8E59-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{DE351A43-8E59-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllIsMyFileType2\{000C10F1-0000-0000-C000-000000000046}
    Dll    REG_SZ    C:\Windows\System32\MSISIP.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllIsMyFileType2\{06C9E010-38CE-11D4-A2A3-00104BD35090}
    Dll    REG_SZ    C:\Windows\System32\wshext.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllIsMyFileType2\{0AC5DF4B-CE07-4DE2-B76E-23C839A09FD1}
    Dll    REG_SZ    C:\Windows\System32\AppxSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllIsMyFileType2\{0F5F58B3-AADE-4B9A-A434-95742D92ECEB}
    Dll    REG_SZ    C:\Windows\System32\AppxSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllIsMyFileType2\{1629F04E-2799-4DB5-8FE5-ACE10F17EBAB}
    Dll    REG_SZ    C:\Windows\System32\wshext.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllIsMyFileType2\{1A610570-38CE-11D4-A2A3-00104BD35090}
    Dll    REG_SZ    C:\Windows\System32\wshext.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllIsMyFileType2\{5598CFF1-68DB-4340-B57F-1CACF88C9A51}
    Dll    REG_SZ    C:\Windows\System32\AppxSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllIsMyFileType2\{603BCC1F-4B59-4E08-B724-D2C6297EF351}
    Dll    REG_SZ    C:\Windows\System32\WindowsPowerShell\v1.0\pwrshsip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllIsMyFileType2\{9F3053C5-439D-4BF7-8A77-04F0450A1D9F}
    Dll    REG_SZ    C:\Windows\System32\EsdSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllIsMyFileType2\{CF78C6DE-64A2-4799-B506-89ADFF5D16D6}
    Dll    REG_SZ    C:\Windows\System32\AppxSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllIsMyFileType2\{D1D04F0C-9ABA-430D-B0E4-D7E96ACCE66C}
    Dll    REG_SZ    C:\Windows\System32\AppxSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{000C10F1-0000-0000-C000-000000000046}
    Dll    REG_SZ    C:\Windows\System32\MSISIP.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{06C9E010-38CE-11D4-A2A3-00104BD35090}
    Dll    REG_SZ    C:\Windows\System32\wshext.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{0AC5DF4B-CE07-4DE2-B76E-23C839A09FD1}
    Dll    REG_SZ    C:\Windows\System32\AppxSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{0F5F58B3-AADE-4B9A-A434-95742D92ECEB}
    Dll    REG_SZ    C:\Windows\System32\AppxSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{1629F04E-2799-4DB5-8FE5-ACE10F17EBAB}
    Dll    REG_SZ    C:\Windows\System32\wshext.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{1A610570-38CE-11D4-A2A3-00104BD35090}
    Dll    REG_SZ    C:\Windows\System32\wshext.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{5598CFF1-68DB-4340-B57F-1CACF88C9A51}
    Dll    REG_SZ    C:\Windows\System32\AppxSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{603BCC1F-4B59-4E08-B724-D2C6297EF351}
    Dll    REG_SZ    C:\Windows\System32\WindowsPowerShell\v1.0\pwrshsip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{9BA61D3F-E73A-11D0-8CD2-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{9F3053C5-439D-4BF7-8A77-04F0450A1D9F}
    Dll    REG_SZ    C:\Windows\System32\EsdSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{C689AAB8-8E78-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{C689AAB9-8E78-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{C689AABA-8E78-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{CF78C6DE-64A2-4799-B506-89ADFF5D16D6}
    Dll    REG_SZ    C:\Windows\System32\AppxSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{D1D04F0C-9ABA-430D-B0E4-D7E96ACCE66C}
    Dll    REG_SZ    C:\Windows\System32\AppxSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{DE351A42-8E59-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{DE351A43-8E59-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{000C10F1-0000-0000-C000-000000000046}
    Dll    REG_SZ    C:\Windows\System32\MSISIP.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{06C9E010-38CE-11D4-A2A3-00104BD35090}
    Dll    REG_SZ    C:\Windows\System32\wshext.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{0AC5DF4B-CE07-4DE2-B76E-23C839A09FD1}
    Dll    REG_SZ    C:\Windows\System32\AppxSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{0F5F58B3-AADE-4B9A-A434-95742D92ECEB}
    Dll    REG_SZ    C:\Windows\System32\AppxSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{1629F04E-2799-4DB5-8FE5-ACE10F17EBAB}
    Dll    REG_SZ    C:\Windows\System32\wshext.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{1A610570-38CE-11D4-A2A3-00104BD35090}
    Dll    REG_SZ    C:\Windows\System32\wshext.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{5598CFF1-68DB-4340-B57F-1CACF88C9A51}
    Dll    REG_SZ    C:\Windows\System32\AppxSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{603BCC1F-4B59-4E08-B724-D2C6297EF351}
    Dll    REG_SZ    C:\Windows\System32\WindowsPowerShell\v1.0\pwrshsip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{9BA61D3F-E73A-11D0-8CD2-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{9F3053C5-439D-4BF7-8A77-04F0450A1D9F}
    Dll    REG_SZ    C:\Windows\System32\EsdSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{C689AAB8-8E78-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{C689AAB9-8E78-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{C689AABA-8E78-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{CF78C6DE-64A2-4799-B506-89ADFF5D16D6}
    Dll    REG_SZ    C:\Windows\System32\AppxSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{D1D04F0C-9ABA-430D-B0E4-D7E96ACCE66C}
    Dll    REG_SZ    C:\Windows\System32\AppxSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{DE351A42-8E59-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{DE351A43-8E59-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{000C10F1-0000-0000-C000-000000000046}
    Dll    REG_SZ    C:\Windows\System32\MSISIP.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{06C9E010-38CE-11D4-A2A3-00104BD35090}
    Dll    REG_SZ    C:\Windows\System32\wshext.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{0AC5DF4B-CE07-4DE2-B76E-23C839A09FD1}
    Dll    REG_SZ    C:\Windows\System32\AppxSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{0F5F58B3-AADE-4B9A-A434-95742D92ECEB}
    Dll    REG_SZ    C:\Windows\System32\AppxSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{1629F04E-2799-4DB5-8FE5-ACE10F17EBAB}
    Dll    REG_SZ    C:\Windows\System32\wshext.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{1A610570-38CE-11D4-A2A3-00104BD35090}
    Dll    REG_SZ    C:\Windows\System32\wshext.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{5598CFF1-68DB-4340-B57F-1CACF88C9A51}
    Dll    REG_SZ    C:\Windows\System32\AppxSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{603BCC1F-4B59-4E08-B724-D2C6297EF351}
    Dll    REG_SZ    C:\Windows\System32\WindowsPowerShell\v1.0\pwrshsip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{9BA61D3F-E73A-11D0-8CD2-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{9F3053C5-439D-4BF7-8A77-04F0450A1D9F}
    Dll    REG_SZ    C:\Windows\System32\EsdSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{C689AAB8-8E78-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{C689AAB9-8E78-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{C689AABA-8E78-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{CF78C6DE-64A2-4799-B506-89ADFF5D16D6}
    Dll    REG_SZ    C:\Windows\System32\AppxSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{D1D04F0C-9ABA-430D-B0E4-D7E96ACCE66C}
    Dll    REG_SZ    C:\Windows\System32\AppxSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{DE351A42-8E59-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{DE351A43-8E59-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptsvcDllCtrl\DEFAULT
    Dll    REG_MULTI_SZ    C:\Windows\System32\crypttpmeksvc.dll\0C:\Windows\System32\cryptcatsvc.dll\0C:\Windows\System32\webauthn.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\GetSecureTime\DEFAULT
    Dll    REG_MULTI_SZ    C:\Windows\System32\SecureTimeAggregator.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CertDllVerifyCTLUsage\DEFAULT
    Dll    REG_MULTI_SZ    C:\Windows\System32\cryptnet.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CertDllVerifyRevocation\DEFAULT
    Dll    REG_MULTI_SZ    C:\Windows\System32\cryptnet.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2000
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2001
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2002
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2003
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2004
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2005
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2006
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2007
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2008
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2009
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2010
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2011
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2012
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2130
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2221
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2222
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2223
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.12.2.1
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.12.2.2
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.12.2.3
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.16.1.1
    Dll    REG_SZ    C:\Windows\System32\cryptdlg.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.16.4
    Dll    REG_SZ    C:\Windows\System32\cryptdlg.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.1.10
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.1.11
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.1.12
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.1.15
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.1.20
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.1.25
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.1.26
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.1.27
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.1.28
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.1.30
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.1.4
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.4.2
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.4.3
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.4.4
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObjectEx\1.2.840.113549.1.9.16.1.1
    Dll    REG_SZ    C:\Windows\System32\inetcomm.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObjectEx\1.2.840.113549.1.9.16.2.1
    Dll    REG_SZ    C:\Windows\System32\inetcomm.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObjectEx\1.2.840.113549.1.9.16.2.11
    Dll    REG_SZ    C:\Windows\System32\inetcomm.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObjectEx\1.2.840.113549.1.9.16.2.12
    Dll    REG_SZ    C:\Windows\System32\inetcomm.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObjectEx\1.2.840.113549.1.9.16.2.2
    Dll    REG_SZ    C:\Windows\System32\inetcomm.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObjectEx\1.2.840.113549.1.9.16.2.3
    Dll    REG_SZ    C:\Windows\System32\inetcomm.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObjectEx\1.2.840.113549.1.9.16.2.4
    Dll    REG_SZ    C:\Windows\System32\inetcomm.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2000
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2001
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2002
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2003
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2004
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2005
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2006
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2007
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2008
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2009
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2010
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2011
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2012
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2130
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2221
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2222
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2223
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.12.2.1
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.12.2.2
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.12.2.3
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.16.1.1
    Dll    REG_SZ    C:\Windows\System32\cryptdlg.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.16.4
    Dll    REG_SZ    C:\Windows\System32\cryptdlg.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.10
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.11
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.12
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.15
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.20
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.25
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.26
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.27
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.28
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.30
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.4
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.4.2
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.4.3
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.4.4
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObjectEx\1.2.840.113549.1.9.16.1.1
    Dll    REG_SZ    C:\Windows\System32\inetcomm.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObjectEx\1.2.840.113549.1.9.16.2.1
    Dll    REG_SZ    C:\Windows\System32\inetcomm.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObjectEx\1.2.840.113549.1.9.16.2.11
    Dll    REG_SZ    C:\Windows\System32\inetcomm.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObjectEx\1.2.840.113549.1.9.16.2.12
    Dll    REG_SZ    C:\Windows\System32\inetcomm.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObjectEx\1.2.840.113549.1.9.16.2.2
    Dll    REG_SZ    C:\Windows\System32\inetcomm.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObjectEx\1.2.840.113549.1.9.16.2.3
    Dll    REG_SZ    C:\Windows\System32\inetcomm.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObjectEx\1.2.840.113549.1.9.16.2.4
    Dll    REG_SZ    C:\Windows\System32\inetcomm.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllFormatObject\1.3.6.1.5.5.7.3.4
    Dll    REG_SZ    C:\Windows\System32\cryptdlg.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllFormatObject\2.5.29.32
    Dll    REG_SZ    C:\Windows\System32\cryptdlg.dll

End of search: 207 match(es) found.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\CertCheck\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\CertCheck\{189A3842-3041-11D1-85E1-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\CertCheck\{31D1ADC1-D329-11D1-8ED8-0080C76516C6}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\CertCheck\{573E31F8-AABA-11D0-8CCB-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\CertCheck\{573E31F8-DDBA-11D0-8CCB-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\CertCheck\{6078065b-8f22-4b13-bd9b-5b762776f386}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\CertCheck\{64B9D180-8DA2-11CF-8736-00AA00A485EB}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\CertCheck\{7801EBD0-CF4B-11D0-851F-0060979387EA}
    $DLL    REG_SZ    C:\Windows\System32\Cryptdlg.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\CertCheck\{A7F4C378-21BE-494e-BA0F-BB12C5D208C5}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\CertCheck\{C6B2E8D0-E005-11CF-A134-00C04FD7BF43}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\CertCheck\{D41E4F1D-A407-11D1-8BC9-00C04FA30A41}
    $DLL    REG_SZ    C:\Windows\System32\WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\CertCheck\{D41E4F1F-A407-11D1-8BC9-00C04FA30A41}
    $DLL    REG_SZ    C:\Windows\System32\WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\CertCheck\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\CertCheck\{FC451C16-AC75-11D1-B4B8-00C04FB66EA0}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Certificate\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Certificate\{189A3842-3041-11D1-85E1-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Certificate\{31D1ADC1-D329-11D1-8ED8-0080C76516C6}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Certificate\{573E31F8-AABA-11D0-8CCB-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Certificate\{573E31F8-DDBA-11D0-8CCB-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Certificate\{6078065b-8f22-4b13-bd9b-5b762776f386}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Certificate\{64B9D180-8DA2-11CF-8736-00AA00A485EB}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Certificate\{7801EBD0-CF4B-11D0-851F-0060979387EA}
    $DLL    REG_SZ    C:\Windows\System32\WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Certificate\{A7F4C378-21BE-494e-BA0F-BB12C5D208C5}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Certificate\{C6B2E8D0-E005-11CF-A134-00C04FD7BF43}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Certificate\{D41E4F1D-A407-11D1-8BC9-00C04FA30A41}
    $DLL    REG_SZ    C:\Windows\System32\WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Certificate\{D41E4F1F-A407-11D1-8BC9-00C04FA30A41}
    $DLL    REG_SZ    C:\Windows\System32\WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Certificate\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Certificate\{FC451C16-AC75-11D1-B4B8-00C04FB66EA0}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Cleanup\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Cleanup\{189A3842-3041-11D1-85E1-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Cleanup\{573E31F8-AABA-11D0-8CCB-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Cleanup\{573E31F8-DDBA-11D0-8CCB-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Cleanup\{6078065b-8f22-4b13-bd9b-5b762776f386}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Cleanup\{64B9D180-8DA2-11CF-8736-00AA00A485EB}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Cleanup\{7801EBD0-CF4B-11D0-851F-0060979387EA}
    $DLL    REG_SZ    C:\Windows\System32\Cryptdlg.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Cleanup\{C6B2E8D0-E005-11CF-A134-00C04FD7BF43}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Cleanup\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Cleanup\{FC451C16-AC75-11D1-B4B8-00C04FB66EA0}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\DiagnosticPolicy\{573E31F8-DDBA-11D0-8CCB-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{189A3842-3041-11D1-85E1-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{31D1ADC1-D329-11D1-8ED8-0080C76516C6}
    $DLL    REG_SZ    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsec.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{573E31F8-AABA-11D0-8CCB-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{573E31F8-DDBA-11D0-8CCB-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{6078065b-8f22-4b13-bd9b-5b762776f386}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{64B9D180-8DA2-11CF-8736-00AA00A485EB}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{7801EBD0-CF4B-11D0-851F-0060979387EA}
    $DLL    REG_SZ    C:\Windows\System32\Cryptdlg.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{A7F4C378-21BE-494e-BA0F-BB12C5D208C5}
    $DLL    REG_SZ    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsecimpl.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{C6B2E8D0-E005-11CF-A134-00C04FD7BF43}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{D41E4F1D-A407-11D1-8BC9-00C04FA30A41}
    $DLL    REG_SZ    C:\Windows\System32\urlmon.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{D41E4F1F-A407-11D1-8BC9-00C04FA30A41}
    $DLL    REG_SZ    C:\Windows\System32\ieframe.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{FC451C16-AC75-11D1-B4B8-00C04FB66EA0}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Initialization\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Initialization\{189A3842-3041-11D1-85E1-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Initialization\{31D1ADC1-D329-11D1-8ED8-0080C76516C6}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Initialization\{573E31F8-AABA-11D0-8CCB-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Initialization\{573E31F8-DDBA-11D0-8CCB-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Initialization\{6078065b-8f22-4b13-bd9b-5b762776f386}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Initialization\{64B9D180-8DA2-11CF-8736-00AA00A485EB}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Initialization\{7801EBD0-CF4B-11D0-851F-0060979387EA}
    $DLL    REG_SZ    C:\Windows\System32\Cryptdlg.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Initialization\{A7F4C378-21BE-494e-BA0F-BB12C5D208C5}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Initialization\{C6B2E8D0-E005-11CF-A134-00C04FD7BF43}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Initialization\{D41E4F1D-A407-11D1-8BC9-00C04FA30A41}
    $DLL    REG_SZ    C:\Windows\System32\WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Initialization\{D41E4F1F-A407-11D1-8BC9-00C04FA30A41}
    $DLL    REG_SZ    C:\Windows\System32\WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Initialization\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Initialization\{FC451C16-AC75-11D1-B4B8-00C04FB66EA0}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Message\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Message\{189A3842-3041-11D1-85E1-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Message\{31D1ADC1-D329-11D1-8ED8-0080C76516C6}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Message\{573E31F8-AABA-11D0-8CCB-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Message\{573E31F8-DDBA-11D0-8CCB-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Message\{6078065b-8f22-4b13-bd9b-5b762776f386}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Message\{64B9D180-8DA2-11CF-8736-00AA00A485EB}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Message\{A7F4C378-21BE-494e-BA0F-BB12C5D208C5}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Message\{C6B2E8D0-E005-11CF-A134-00C04FD7BF43}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Message\{D41E4F1D-A407-11D1-8BC9-00C04FA30A41}
    $DLL    REG_SZ    C:\Windows\System32\WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Message\{D41E4F1F-A407-11D1-8BC9-00C04FA30A41}
    $DLL    REG_SZ    C:\Windows\System32\WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Message\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Message\{FC451C16-AC75-11D1-B4B8-00C04FB66EA0}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Signature\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Signature\{189A3842-3041-11D1-85E1-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Signature\{31D1ADC1-D329-11D1-8ED8-0080C76516C6}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Signature\{573E31F8-AABA-11D0-8CCB-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Signature\{573E31F8-DDBA-11D0-8CCB-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Signature\{6078065b-8f22-4b13-bd9b-5b762776f386}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Signature\{64B9D180-8DA2-11CF-8736-00AA00A485EB}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Signature\{A7F4C378-21BE-494e-BA0F-BB12C5D208C5}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Signature\{C6B2E8D0-E005-11CF-A134-00C04FD7BF43}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Signature\{D41E4F1D-A407-11D1-8BC9-00C04FA30A41}
    $DLL    REG_SZ    C:\Windows\System32\WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Signature\{D41E4F1F-A407-11D1-8BC9-00C04FA30A41}
    $DLL    REG_SZ    C:\Windows\System32\WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Signature\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Signature\{FC451C16-AC75-11D1-B4B8-00C04FB66EA0}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Usages\1.3.6.1.4.1.311.10.3.3
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Usages\1.3.6.1.5.5.7.3.1
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Usages\1.3.6.1.5.5.7.3.2
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Usages\2.16.840.1.113730.4.1
    $DLL    REG_SZ    WINTRUST.DLL

End of search: 97 match(es) found.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllLogMismatchPinRules\DEFAULT
    Dll    REG_MULTI_SZ    C:\Windows\SysWOW64\cryptui.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllOpenStoreProv\#16
    Dll    REG_SZ    C:\Windows\SysWOW64\cryptnet.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllOpenStoreProv\Ldap
    Dll    REG_SZ    C:\Windows\SysWOW64\cryptnet.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllProtectedRootMessageBox\DEFAULT
    Dll    REG_MULTI_SZ    C:\Windows\SysWOW64\cryptui.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptDllProtectPrompt\DEFAULT
    Dll    REG_MULTI_SZ    C:\Windows\SysWOW64\cryptui.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData\{000C10F1-0000-0000-C000-000000000046}
    Dll    REG_SZ    C:\Windows\SysWOW64\MSISIP.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData\{06C9E010-38CE-11D4-A2A3-00104BD35090}
    Dll    REG_SZ    C:\Windows\SysWOW64\wshext.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData\{0AC5DF4B-CE07-4DE2-B76E-23C839A09FD1}
    Dll    REG_SZ    C:\Windows\SysWOW64\AppxSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData\{0F5F58B3-AADE-4B9A-A434-95742D92ECEB}
    Dll    REG_SZ    C:\Windows\SysWOW64\AppxSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData\{1629F04E-2799-4DB5-8FE5-ACE10F17EBAB}
    Dll    REG_SZ    C:\Windows\SysWOW64\wshext.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData\{1A610570-38CE-11D4-A2A3-00104BD35090}
    Dll    REG_SZ    C:\Windows\SysWOW64\wshext.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData\{5598CFF1-68DB-4340-B57F-1CACF88C9A51}
    Dll    REG_SZ    C:\Windows\SysWOW64\AppxSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData\{603BCC1F-4B59-4E08-B724-D2C6297EF351}
    Dll    REG_SZ    C:\Windows\SysWOW64\WindowsPowerShell\v1.0\pwrshsip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData\{9BA61D3F-E73A-11D0-8CD2-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData\{9F3053C5-439D-4BF7-8A77-04F0450A1D9F}
    Dll    REG_SZ    C:\Windows\SysWOW64\EsdSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData\{C689AAB8-8E78-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData\{C689AAB9-8E78-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData\{C689AABA-8E78-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData\{CF78C6DE-64A2-4799-B506-89ADFF5D16D6}
    Dll    REG_SZ    C:\Windows\SysWOW64\AppxSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData\{D1D04F0C-9ABA-430D-B0E4-D7E96ACCE66C}
    Dll    REG_SZ    C:\Windows\SysWOW64\AppxSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData\{DE351A42-8E59-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData\{DE351A43-8E59-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetCaps\{9BA61D3F-E73A-11D0-8CD2-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetCaps\{9F3053C5-439D-4BF7-8A77-04F0450A1D9F}
    Dll    REG_SZ    C:\Windows\SysWOW64\EsdSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetCaps\{C689AAB8-8E78-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetCaps\{C689AAB9-8E78-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetCaps\{C689AABA-8E78-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetCaps\{DE351A42-8E59-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetCaps\{DE351A43-8E59-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSealedDigest\{9BA61D3F-E73A-11D0-8CD2-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSealedDigest\{C689AAB8-8E78-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSealedDigest\{C689AAB9-8E78-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSealedDigest\{C689AABA-8E78-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSealedDigest\{DE351A42-8E59-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSealedDigest\{DE351A43-8E59-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{000C10F1-0000-0000-C000-000000000046}
    Dll    REG_SZ    C:\Windows\SysWOW64\MSISIP.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{06C9E010-38CE-11D4-A2A3-00104BD35090}
    Dll    REG_SZ    C:\Windows\SysWOW64\wshext.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{0AC5DF4B-CE07-4DE2-B76E-23C839A09FD1}
    Dll    REG_SZ    C:\Windows\SysWOW64\AppxSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{0F5F58B3-AADE-4B9A-A434-95742D92ECEB}
    Dll    REG_SZ    C:\Windows\SysWOW64\AppxSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{1629F04E-2799-4DB5-8FE5-ACE10F17EBAB}
    Dll    REG_SZ    C:\Windows\SysWOW64\wshext.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{1A610570-38CE-11D4-A2A3-00104BD35090}
    Dll    REG_SZ    C:\Windows\SysWOW64\wshext.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{5598CFF1-68DB-4340-B57F-1CACF88C9A51}
    Dll    REG_SZ    C:\Windows\SysWOW64\AppxSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{603BCC1F-4B59-4E08-B724-D2C6297EF351}
    Dll    REG_SZ    C:\Windows\SysWOW64\WindowsPowerShell\v1.0\pwrshsip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{9BA61D3F-E73A-11D0-8CD2-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{9F3053C5-439D-4BF7-8A77-04F0450A1D9F}
    Dll    REG_SZ    C:\Windows\SysWOW64\EsdSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{C689AAB8-8E78-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{C689AAB9-8E78-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{C689AABA-8E78-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{CF78C6DE-64A2-4799-B506-89ADFF5D16D6}
    Dll    REG_SZ    C:\Windows\SysWOW64\AppxSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{D1D04F0C-9ABA-430D-B0E4-D7E96ACCE66C}
    Dll    REG_SZ    C:\Windows\SysWOW64\AppxSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{DE351A42-8E59-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{DE351A43-8E59-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllIsMyFileType2\{000C10F1-0000-0000-C000-000000000046}
    Dll    REG_SZ    C:\Windows\SysWOW64\MSISIP.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllIsMyFileType2\{06C9E010-38CE-11D4-A2A3-00104BD35090}
    Dll    REG_SZ    C:\Windows\SysWOW64\wshext.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllIsMyFileType2\{0AC5DF4B-CE07-4DE2-B76E-23C839A09FD1}
    Dll    REG_SZ    C:\Windows\SysWOW64\AppxSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllIsMyFileType2\{0F5F58B3-AADE-4B9A-A434-95742D92ECEB}
    Dll    REG_SZ    C:\Windows\SysWOW64\AppxSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllIsMyFileType2\{1629F04E-2799-4DB5-8FE5-ACE10F17EBAB}
    Dll    REG_SZ    C:\Windows\SysWOW64\wshext.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllIsMyFileType2\{1A610570-38CE-11D4-A2A3-00104BD35090}
    Dll    REG_SZ    C:\Windows\SysWOW64\wshext.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllIsMyFileType2\{5598CFF1-68DB-4340-B57F-1CACF88C9A51}
    Dll    REG_SZ    C:\Windows\SysWOW64\AppxSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllIsMyFileType2\{603BCC1F-4B59-4E08-B724-D2C6297EF351}
    Dll    REG_SZ    C:\Windows\SysWOW64\WindowsPowerShell\v1.0\pwrshsip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllIsMyFileType2\{9F3053C5-439D-4BF7-8A77-04F0450A1D9F}
    Dll    REG_SZ    C:\Windows\SysWOW64\EsdSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllIsMyFileType2\{CF78C6DE-64A2-4799-B506-89ADFF5D16D6}
    Dll    REG_SZ    C:\Windows\SysWOW64\AppxSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllIsMyFileType2\{D1D04F0C-9ABA-430D-B0E4-D7E96ACCE66C}
    Dll    REG_SZ    C:\Windows\SysWOW64\AppxSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{000C10F1-0000-0000-C000-000000000046}
    Dll    REG_SZ    C:\Windows\SysWOW64\MSISIP.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{06C9E010-38CE-11D4-A2A3-00104BD35090}
    Dll    REG_SZ    C:\Windows\SysWOW64\wshext.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{0AC5DF4B-CE07-4DE2-B76E-23C839A09FD1}
    Dll    REG_SZ    C:\Windows\SysWOW64\AppxSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{0F5F58B3-AADE-4B9A-A434-95742D92ECEB}
    Dll    REG_SZ    C:\Windows\SysWOW64\AppxSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{1629F04E-2799-4DB5-8FE5-ACE10F17EBAB}
    Dll    REG_SZ    C:\Windows\SysWOW64\wshext.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{1A610570-38CE-11D4-A2A3-00104BD35090}
    Dll    REG_SZ    C:\Windows\SysWOW64\wshext.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{5598CFF1-68DB-4340-B57F-1CACF88C9A51}
    Dll    REG_SZ    C:\Windows\SysWOW64\AppxSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{603BCC1F-4B59-4E08-B724-D2C6297EF351}
    Dll    REG_SZ    C:\Windows\SysWOW64\WindowsPowerShell\v1.0\pwrshsip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{9BA61D3F-E73A-11D0-8CD2-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{9F3053C5-439D-4BF7-8A77-04F0450A1D9F}
    Dll    REG_SZ    C:\Windows\SysWOW64\EsdSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{C689AAB8-8E78-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{C689AAB9-8E78-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{C689AABA-8E78-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{CF78C6DE-64A2-4799-B506-89ADFF5D16D6}
    Dll    REG_SZ    C:\Windows\SysWOW64\AppxSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{D1D04F0C-9ABA-430D-B0E4-D7E96ACCE66C}
    Dll    REG_SZ    C:\Windows\SysWOW64\AppxSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{DE351A42-8E59-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{DE351A43-8E59-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{000C10F1-0000-0000-C000-000000000046}
    Dll    REG_SZ    C:\Windows\SysWOW64\MSISIP.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{06C9E010-38CE-11D4-A2A3-00104BD35090}
    Dll    REG_SZ    C:\Windows\SysWOW64\wshext.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{0AC5DF4B-CE07-4DE2-B76E-23C839A09FD1}
    Dll    REG_SZ    C:\Windows\SysWOW64\AppxSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{0F5F58B3-AADE-4B9A-A434-95742D92ECEB}
    Dll    REG_SZ    C:\Windows\SysWOW64\AppxSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{1629F04E-2799-4DB5-8FE5-ACE10F17EBAB}
    Dll    REG_SZ    C:\Windows\SysWOW64\wshext.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{1A610570-38CE-11D4-A2A3-00104BD35090}
    Dll    REG_SZ    C:\Windows\SysWOW64\wshext.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{5598CFF1-68DB-4340-B57F-1CACF88C9A51}
    Dll    REG_SZ    C:\Windows\SysWOW64\AppxSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{603BCC1F-4B59-4E08-B724-D2C6297EF351}
    Dll    REG_SZ    C:\Windows\SysWOW64\WindowsPowerShell\v1.0\pwrshsip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{9BA61D3F-E73A-11D0-8CD2-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{9F3053C5-439D-4BF7-8A77-04F0450A1D9F}
    Dll    REG_SZ    C:\Windows\SysWOW64\EsdSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{C689AAB8-8E78-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{C689AAB9-8E78-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{C689AABA-8E78-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{CF78C6DE-64A2-4799-B506-89ADFF5D16D6}
    Dll    REG_SZ    C:\Windows\SysWOW64\AppxSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{D1D04F0C-9ABA-430D-B0E4-D7E96ACCE66C}
    Dll    REG_SZ    C:\Windows\SysWOW64\AppxSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{DE351A42-8E59-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{DE351A43-8E59-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{000C10F1-0000-0000-C000-000000000046}
    Dll    REG_SZ    C:\Windows\SysWOW64\MSISIP.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{06C9E010-38CE-11D4-A2A3-00104BD35090}
    Dll    REG_SZ    C:\Windows\SysWOW64\wshext.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{0AC5DF4B-CE07-4DE2-B76E-23C839A09FD1}
    Dll    REG_SZ    C:\Windows\SysWOW64\AppxSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{0F5F58B3-AADE-4B9A-A434-95742D92ECEB}
    Dll    REG_SZ    C:\Windows\SysWOW64\AppxSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{1629F04E-2799-4DB5-8FE5-ACE10F17EBAB}
    Dll    REG_SZ    C:\Windows\SysWOW64\wshext.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{1A610570-38CE-11D4-A2A3-00104BD35090}
    Dll    REG_SZ    C:\Windows\SysWOW64\wshext.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{5598CFF1-68DB-4340-B57F-1CACF88C9A51}
    Dll    REG_SZ    C:\Windows\SysWOW64\AppxSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{603BCC1F-4B59-4E08-B724-D2C6297EF351}
    Dll    REG_SZ    C:\Windows\SysWOW64\WindowsPowerShell\v1.0\pwrshsip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{9BA61D3F-E73A-11D0-8CD2-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{9F3053C5-439D-4BF7-8A77-04F0450A1D9F}
    Dll    REG_SZ    C:\Windows\SysWOW64\EsdSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{C689AAB8-8E78-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{C689AAB9-8E78-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{C689AABA-8E78-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{CF78C6DE-64A2-4799-B506-89ADFF5D16D6}
    Dll    REG_SZ    C:\Windows\SysWOW64\AppxSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{D1D04F0C-9ABA-430D-B0E4-D7E96ACCE66C}
    Dll    REG_SZ    C:\Windows\SysWOW64\AppxSip.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{DE351A42-8E59-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{DE351A43-8E59-11D0-8C47-00C04FC295EE}
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CertDllVerifyCTLUsage\DEFAULT
    Dll    REG_MULTI_SZ    C:\Windows\SysWOW64\cryptnet.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CertDllVerifyRevocation\DEFAULT
    Dll    REG_MULTI_SZ    C:\Windows\SysWOW64\cryptnet.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2000
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2001
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2002
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2003
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2004
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2005
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2006
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2007
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2008
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2009
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2010
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2011
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2012
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2130
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2221
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2222
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2223
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.12.2.1
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.12.2.2
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.12.2.3
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.16.1.1
    Dll    REG_SZ    C:\Windows\SysWOW64\cryptdlg.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.16.4
    Dll    REG_SZ    C:\Windows\SysWOW64\cryptdlg.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.1.10
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.1.11
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.1.12
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.1.15
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.1.20
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.1.25
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.1.26
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.1.27
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.1.28
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.1.30
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.1.4
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.4.2
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.4.3
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.4.4
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObjectEx\1.2.840.113549.1.9.16.1.1
    Dll    REG_SZ    C:\Windows\SysWOW64\inetcomm.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObjectEx\1.2.840.113549.1.9.16.2.1
    Dll    REG_SZ    C:\Windows\SysWOW64\inetcomm.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObjectEx\1.2.840.113549.1.9.16.2.11
    Dll    REG_SZ    C:\Windows\SysWOW64\inetcomm.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObjectEx\1.2.840.113549.1.9.16.2.12
    Dll    REG_SZ    C:\Windows\SysWOW64\inetcomm.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObjectEx\1.2.840.113549.1.9.16.2.2
    Dll    REG_SZ    C:\Windows\SysWOW64\inetcomm.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObjectEx\1.2.840.113549.1.9.16.2.3
    Dll    REG_SZ    C:\Windows\SysWOW64\inetcomm.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObjectEx\1.2.840.113549.1.9.16.2.4
    Dll    REG_SZ    C:\Windows\SysWOW64\inetcomm.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2000
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2001
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2002
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2003
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2004
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2005
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2006
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2007
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2008
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2009
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2010
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2011
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2012
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2130
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2221
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2222
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2223
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.12.2.1
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.12.2.2
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.12.2.3
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.16.1.1
    Dll    REG_SZ    C:\Windows\SysWOW64\cryptdlg.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.16.4
    Dll    REG_SZ    C:\Windows\SysWOW64\cryptdlg.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.10
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.11
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.12
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.15
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.20
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.25
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.26
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.27
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.28
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.30
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.4
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.4.2
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.4.3
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.4.4
    Dll    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObjectEx\1.2.840.113549.1.9.16.1.1
    Dll    REG_SZ    C:\Windows\SysWOW64\inetcomm.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObjectEx\1.2.840.113549.1.9.16.2.1
    Dll    REG_SZ    C:\Windows\SysWOW64\inetcomm.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObjectEx\1.2.840.113549.1.9.16.2.11
    Dll    REG_SZ    C:\Windows\SysWOW64\inetcomm.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObjectEx\1.2.840.113549.1.9.16.2.12
    Dll    REG_SZ    C:\Windows\SysWOW64\inetcomm.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObjectEx\1.2.840.113549.1.9.16.2.2
    Dll    REG_SZ    C:\Windows\SysWOW64\inetcomm.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObjectEx\1.2.840.113549.1.9.16.2.3
    Dll    REG_SZ    C:\Windows\SysWOW64\inetcomm.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObjectEx\1.2.840.113549.1.9.16.2.4
    Dll    REG_SZ    C:\Windows\SysWOW64\inetcomm.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllFormatObject\1.3.6.1.5.5.7.3.4
    Dll    REG_SZ    C:\Windows\SysWOW64\cryptdlg.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllFormatObject\2.5.29.32
    Dll    REG_SZ    C:\Windows\SysWOW64\cryptdlg.dll

End of search: 204 match(es) found.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\CertCheck\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\CertCheck\{189A3842-3041-11D1-85E1-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\CertCheck\{31D1ADC1-D329-11D1-8ED8-0080C76516C6}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\CertCheck\{573E31F8-AABA-11D0-8CCB-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\CertCheck\{573E31F8-DDBA-11D0-8CCB-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\CertCheck\{6078065b-8f22-4b13-bd9b-5b762776f386}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\CertCheck\{64B9D180-8DA2-11CF-8736-00AA00A485EB}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\CertCheck\{7801EBD0-CF4B-11D0-851F-0060979387EA}
    $DLL    REG_SZ    C:\Windows\SysWOW64\Cryptdlg.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\CertCheck\{A7F4C378-21BE-494e-BA0F-BB12C5D208C5}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\CertCheck\{C6B2E8D0-E005-11CF-A134-00C04FD7BF43}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\CertCheck\{D41E4F1D-A407-11D1-8BC9-00C04FA30A41}
    $DLL    REG_SZ    C:\Windows\SysWOW64\WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\CertCheck\{D41E4F1F-A407-11D1-8BC9-00C04FA30A41}
    $DLL    REG_SZ    C:\Windows\SysWOW64\WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\CertCheck\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\CertCheck\{FC451C16-AC75-11D1-B4B8-00C04FB66EA0}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Certificate\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Certificate\{189A3842-3041-11D1-85E1-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Certificate\{31D1ADC1-D329-11D1-8ED8-0080C76516C6}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Certificate\{573E31F8-AABA-11D0-8CCB-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Certificate\{573E31F8-DDBA-11D0-8CCB-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Certificate\{6078065b-8f22-4b13-bd9b-5b762776f386}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Certificate\{64B9D180-8DA2-11CF-8736-00AA00A485EB}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Certificate\{7801EBD0-CF4B-11D0-851F-0060979387EA}
    $DLL    REG_SZ    C:\Windows\SysWOW64\WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Certificate\{A7F4C378-21BE-494e-BA0F-BB12C5D208C5}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Certificate\{C6B2E8D0-E005-11CF-A134-00C04FD7BF43}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Certificate\{D41E4F1D-A407-11D1-8BC9-00C04FA30A41}
    $DLL    REG_SZ    C:\Windows\SysWOW64\WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Certificate\{D41E4F1F-A407-11D1-8BC9-00C04FA30A41}
    $DLL    REG_SZ    C:\Windows\SysWOW64\WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Certificate\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Certificate\{FC451C16-AC75-11D1-B4B8-00C04FB66EA0}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Cleanup\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Cleanup\{189A3842-3041-11D1-85E1-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Cleanup\{573E31F8-AABA-11D0-8CCB-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Cleanup\{573E31F8-DDBA-11D0-8CCB-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Cleanup\{6078065b-8f22-4b13-bd9b-5b762776f386}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Cleanup\{64B9D180-8DA2-11CF-8736-00AA00A485EB}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Cleanup\{7801EBD0-CF4B-11D0-851F-0060979387EA}
    $DLL    REG_SZ    C:\Windows\SysWOW64\Cryptdlg.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Cleanup\{C6B2E8D0-E005-11CF-A134-00C04FD7BF43}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Cleanup\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Cleanup\{FC451C16-AC75-11D1-B4B8-00C04FB66EA0}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\DiagnosticPolicy\{573E31F8-DDBA-11D0-8CCB-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{189A3842-3041-11D1-85E1-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{31D1ADC1-D329-11D1-8ED8-0080C76516C6}
    $DLL    REG_SZ    C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsec.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{573E31F8-AABA-11D0-8CCB-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{573E31F8-DDBA-11D0-8CCB-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{6078065b-8f22-4b13-bd9b-5b762776f386}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{64B9D180-8DA2-11CF-8736-00AA00A485EB}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{7801EBD0-CF4B-11D0-851F-0060979387EA}
    $DLL    REG_SZ    C:\Windows\SysWOW64\Cryptdlg.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{A7F4C378-21BE-494e-BA0F-BB12C5D208C5}
    $DLL    REG_SZ    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsecimpl.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{C6B2E8D0-E005-11CF-A134-00C04FD7BF43}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{D41E4F1D-A407-11D1-8BC9-00C04FA30A41}
    $DLL    REG_SZ    C:\Windows\SysWOW64\urlmon.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{D41E4F1F-A407-11D1-8BC9-00C04FA30A41}
    $DLL    REG_SZ    C:\Windows\SysWOW64\ieframe.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{FC451C16-AC75-11D1-B4B8-00C04FB66EA0}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Initialization\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Initialization\{189A3842-3041-11D1-85E1-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Initialization\{31D1ADC1-D329-11D1-8ED8-0080C76516C6}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Initialization\{573E31F8-AABA-11D0-8CCB-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Initialization\{573E31F8-DDBA-11D0-8CCB-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Initialization\{6078065b-8f22-4b13-bd9b-5b762776f386}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Initialization\{64B9D180-8DA2-11CF-8736-00AA00A485EB}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Initialization\{7801EBD0-CF4B-11D0-851F-0060979387EA}
    $DLL    REG_SZ    C:\Windows\SysWOW64\Cryptdlg.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Initialization\{A7F4C378-21BE-494e-BA0F-BB12C5D208C5}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Initialization\{C6B2E8D0-E005-11CF-A134-00C04FD7BF43}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Initialization\{D41E4F1D-A407-11D1-8BC9-00C04FA30A41}
    $DLL    REG_SZ    C:\Windows\SysWOW64\WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Initialization\{D41E4F1F-A407-11D1-8BC9-00C04FA30A41}
    $DLL    REG_SZ    C:\Windows\SysWOW64\WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Initialization\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Initialization\{FC451C16-AC75-11D1-B4B8-00C04FB66EA0}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Message\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Message\{189A3842-3041-11D1-85E1-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Message\{31D1ADC1-D329-11D1-8ED8-0080C76516C6}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Message\{573E31F8-AABA-11D0-8CCB-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Message\{573E31F8-DDBA-11D0-8CCB-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Message\{6078065b-8f22-4b13-bd9b-5b762776f386}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Message\{64B9D180-8DA2-11CF-8736-00AA00A485EB}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Message\{A7F4C378-21BE-494e-BA0F-BB12C5D208C5}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Message\{C6B2E8D0-E005-11CF-A134-00C04FD7BF43}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Message\{D41E4F1D-A407-11D1-8BC9-00C04FA30A41}
    $DLL    REG_SZ    C:\Windows\SysWOW64\WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Message\{D41E4F1F-A407-11D1-8BC9-00C04FA30A41}
    $DLL    REG_SZ    C:\Windows\SysWOW64\WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Message\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Message\{FC451C16-AC75-11D1-B4B8-00C04FB66EA0}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Signature\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Signature\{189A3842-3041-11D1-85E1-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Signature\{31D1ADC1-D329-11D1-8ED8-0080C76516C6}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Signature\{573E31F8-AABA-11D0-8CCB-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Signature\{573E31F8-DDBA-11D0-8CCB-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Signature\{6078065b-8f22-4b13-bd9b-5b762776f386}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Signature\{64B9D180-8DA2-11CF-8736-00AA00A485EB}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Signature\{A7F4C378-21BE-494e-BA0F-BB12C5D208C5}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Signature\{C6B2E8D0-E005-11CF-A134-00C04FD7BF43}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Signature\{D41E4F1D-A407-11D1-8BC9-00C04FA30A41}
    $DLL    REG_SZ    C:\Windows\SysWOW64\WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Signature\{D41E4F1F-A407-11D1-8BC9-00C04FA30A41}
    $DLL    REG_SZ    C:\Windows\SysWOW64\WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Signature\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Signature\{FC451C16-AC75-11D1-B4B8-00C04FB66EA0}
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Usages\1.3.6.1.4.1.311.10.3.3
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Usages\1.3.6.1.5.5.7.3.1
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Usages\1.3.6.1.5.5.7.3.2
    $DLL    REG_SZ    WINTRUST.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Usages\2.16.840.1.113730.4.1
    $DLL    REG_SZ    WINTRUST.DLL

End of search: 97 match(es) found.

Note: only 231 of these 607 entries comply with Microsoft’s own recommendation and security guidance, while the other 378 entries show a total number of 378 bugs!

Group Policy client side extensions:

REG.EXE QUERY "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions" /F "D*Name" /S
REM REG.EXE QUERY "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions" /S /V "DisplayName"
REM REG.EXE QUERY "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions" /S /V "DllName"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{0ACDD40C-75AC-47ab-BAA0-BF6DE7E7FE63}
    DisplayName    REG_EXPAND_SZ    @wlgpclnt.dll,-100
    DllName    REG_EXPAND_SZ    wlgpclnt.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{0E28E245-9368-4853-AD84-6DA3BA35BB75}
    DisplayName    REG_EXPAND_SZ    @gpprefcl.dll,-1
    DllName    REG_SZ    C:\Windows\System32\gpprefcl.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{169EBF44-942F-4C43-87CE-13C93996EBBE}
    DllName    REG_EXPAND_SZ    AppManagementConfiguration.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{16be69fa-4209-4250-88cb-716cf41954e0}
    DisplayName    REG_EXPAND_SZ    @auditcse.dll,-4000
    DllName    REG_EXPAND_SZ    auditcse.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{17D89FEC-5C44-4972-B12D-241CAEF74509}
    DisplayName    REG_EXPAND_SZ    @gpprefcl.dll,-2
    DllName    REG_SZ    C:\Windows\System32\gpprefcl.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{1A6364EB-776B-4120-ADE1-B63A406A76B5}
    DisplayName    REG_EXPAND_SZ    @gpprefcl.dll,-3
    DllName    REG_SZ    C:\Windows\System32\gpprefcl.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{25537BA6-77A8-11D2-9B6C-0000F8080861}
    DisplayName    REG_EXPAND_SZ    @fdeploy.dll,-261
    DllName    REG_EXPAND_SZ    fdeploy.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{2A8FDC61-2347-4C87-92F6-B05EB91A201A}
    DisplayName    REG_EXPAND_SZ    @gpprefcl.dll,-22
    DllName    REG_SZ    C:\Windows\System32\gpprefcl.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{2BFCC077-22D2-48DE-BDE1-2F618D9B476D}
    DllName    REG_EXPAND_SZ    AppManagementConfiguration.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{3610eda5-77ef-11d2-8dc5-00c04fa31a66}
    DisplayName    REG_EXPAND_SZ    @%SystemRoot%\System32\dskquota.dll,-100
    DllName    REG_EXPAND_SZ    %SystemRoot%\System32\dskquota.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{3A0DBA37-F8B2-4356-83DE-3E90BD5C261F}
    DisplayName    REG_EXPAND_SZ    @gpprefcl.dll,-4
    DllName    REG_SZ    C:\Windows\System32\gpprefcl.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{426031c0-0b47-4852-b0ca-ac3d37bfcb39}
    DisplayName    REG_EXPAND_SZ    @gptext.dll,-201
    DllName    REG_EXPAND_SZ    gptext.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{42B5FAAE-6536-11d2-AE5A-0000F87571E3}
    DisplayName    REG_EXPAND_SZ    @gpscript.dll,-1
    DllName    REG_SZ    C:\Windows\System32\gpscript.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{4B7C3B0F-E993-4E06-A241-3FBE06943684}
    DisplayName    REG_EXPAND_SZ    @gpprefcl.dll,-22
    DllName    REG_SZ    C:\Windows\System32\gpprefcl.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{4bcd6cde-777b-48b6-9804-43568e23545d}
    DisplayName    REG_EXPAND_SZ    @%SystemRoot%\System32\TsUsbRedirectionGroupPolicyExtension.dll,-100
    DllName    REG_EXPAND_SZ    %SystemRoot%\System32\TsUsbRedirectionGroupPolicyExtension.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{4CFB60C1-FAA6-47f1-89AA-0B18730C9FD3}
    DisplayName    REG_SZ    @C:\Windows\System32\iedkcs32.dll,-3051
    DllName    REG_SZ    C:\Windows\System32\iedkcs32.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{4D2F9B6F-1E52-4711-A382-6A8B1A003DE6}
    DllName    REG_SZ    C:\Windows\System32\tsworkspace.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{4d968b55-cac2-4ff5-983f-0a54603781a3}
    DisplayName    REG_EXPAND_SZ    @WorkFoldersGPExt.dll,-261
    DllName    REG_EXPAND_SZ    WorkFoldersGPExt.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{5794DAFD-BE60-433f-88A2-1A31939AC01F}
    DisplayName    REG_EXPAND_SZ    @gpprefcl.dll,-5
    DllName    REG_SZ    C:\Windows\System32\gpprefcl.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{6232C319-91AC-4931-9385-E70C2B099F0E}
    DisplayName    REG_EXPAND_SZ    @gpprefcl.dll,-6
    DllName    REG_SZ    C:\Windows\System32\gpprefcl.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{6A4C88C6-C502-4f74-8F60-2CB23EDC24E2}
    DisplayName    REG_EXPAND_SZ    @gpprefcl.dll,-7
    DllName    REG_SZ    C:\Windows\System32\gpprefcl.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{7150F9BF-48AD-4da4-A49C-29EF4A8369BA}
    DisplayName    REG_EXPAND_SZ    @gpprefcl.dll,-8
    DllName    REG_SZ    C:\Windows\System32\gpprefcl.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{728EE579-943C-4519-9EF7-AB56765798ED}
    DisplayName    REG_EXPAND_SZ    @gpprefcl.dll,-9
    DllName    REG_SZ    C:\Windows\System32\gpprefcl.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{74EE6C03-5363-4554-B161-627540339CAB}
    DisplayName    REG_EXPAND_SZ    @gpprefcl.dll,-10
    DllName    REG_SZ    C:\Windows\System32\gpprefcl.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{7909AD9E-09EE-4247-BAB9-7029D5F0A278}
    DllName    REG_EXPAND_SZ    dmenrollengine.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{7933F41E-56F8-41d6-A31C-4148A711EE93}
    DllName    REG_EXPAND_SZ    %SystemRoot%\System32\srchadmin.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{7B849a69-220F-451E-B3FE-2CB811AF94AE}
    DisplayName    REG_SZ    @C:\Windows\System32\iedkcs32.dll,-3051
    DllName    REG_SZ    C:\Windows\System32\iedkcs32.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{827D319E-6EAC-11D2-A4EA-00C04F79F83A}
    DisplayName    REG_EXPAND_SZ    @(runtime.system32)\scecli.dll,-7650
    DllName    REG_EXPAND_SZ    scecli.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{8A28E2C5-8D06-49A4-A08C-632DAA493E17}
    DisplayName    REG_EXPAND_SZ    @%systemroot%\system32\gpprnext.dll,-1
    DllName    REG_EXPAND_SZ    %systemroot%\system32\gpprnext.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{91FBB303-0CD5-4055-BF42-E512A681B325}
    DisplayName    REG_EXPAND_SZ    @gpprefcl.dll,-11
    DllName    REG_SZ    C:\Windows\System32\gpprefcl.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{9650FDBC-053A-4715-AD14-FC2DC65E8330}
    DllName    REG_EXPAND_SZ    hvsigpext.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{A3F3E39B-5D83-4940-B954-28315B82F0A8}
    DisplayName    REG_EXPAND_SZ    @gpprefcl.dll,-12
    DllName    REG_SZ    C:\Windows\System32\gpprefcl.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{AADCED64-746C-4633-A97C-D61349046527}
    DisplayName    REG_EXPAND_SZ    @gpprefcl.dll,-13
    DllName    REG_SZ    C:\Windows\System32\gpprefcl.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{B087BE9D-ED37-454f-AF9C-04291E351182}
    DisplayName    REG_EXPAND_SZ    @gpprefcl.dll,-14
    DllName    REG_SZ    C:\Windows\System32\gpprefcl.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{B587E2B1-4D59-4e7e-AED9-22B9DF11D053}
    DisplayName    REG_EXPAND_SZ    @dot3gpclnt.dll,-100
    DllName    REG_EXPAND_SZ    dot3gpclnt.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{BA649533-0AAC-4E04-B9BC-4DBAE0325B12}
    DllName    REG_EXPAND_SZ    pwlauncher.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{BC75B1ED-5833-4858-9BB8-CBF0B166DF9D}
    DisplayName    REG_EXPAND_SZ    @gpprefcl.dll,-16
    DllName    REG_SZ    C:\Windows\System32\gpprefcl.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{C34B2751-1CF4-44F5-9262-C3FC39666591}
    DllName    REG_EXPAND_SZ    pwlauncher.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{C418DD9D-0D14-4efb-8FBF-CFE535C8FAC7}
    DisplayName    REG_EXPAND_SZ    @gpprefcl.dll,-17
    DllName    REG_SZ    C:\Windows\System32\gpprefcl.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{C631DF4C-088F-4156-B058-4375F0853CD8}
    DllName    REG_EXPAND_SZ    %SystemRoot%\System32\cscobj.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{c6dc5466-785a-11d2-84d0-00c04fb169f7}
    DisplayName    REG_EXPAND_SZ    @appmgmts.dll,-3252
    DllName    REG_EXPAND_SZ    appmgmts.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{cdeafc3d-948d-49dd-ab12-e578ba4af7aa}
    DisplayName    REG_EXPAND_SZ    @gptext.dll,-204
    DllName    REG_EXPAND_SZ    gptext.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D}
    DisplayName    REG_SZ    @C:\Windows\System32\iedkcs32.dll,-3051
    DllName    REG_SZ    C:\Windows\System32\iedkcs32.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{CFF649BD-601D-4361-AD3D-0FC365DB4DB7}
    DllName    REG_EXPAND_SZ    %SystemRoot%\system32\domgmt.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{e437bc1c-aa7d-11d2-a382-00c04f991e27}
    DisplayName    REG_EXPAND_SZ    @C:\Windows\System32\polstore.dll,-5012
    DllName    REG_EXPAND_SZ    %SystemRoot%\System32\polstore.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{E47248BA-94CC-49c4-BBB5-9EB7F05183D0}
    DisplayName    REG_EXPAND_SZ    @gpprefcl.dll,-18
    DllName    REG_SZ    C:\Windows\System32\gpprefcl.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{E4F48E54-F38D-4884-BFB9-D4D2E5729C18}
    DisplayName    REG_EXPAND_SZ    @gpprefcl.dll,-19
    DllName    REG_SZ    C:\Windows\System32\gpprefcl.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{E5094040-C46C-4115-B030-04FB2E545B00}
    DisplayName    REG_EXPAND_SZ    @gpprefcl.dll,-20
    DllName    REG_SZ    C:\Windows\System32\gpprefcl.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{E62688F0-25FD-4c90-BFF5-F508B9D2E31F}
    DisplayName    REG_EXPAND_SZ    @gpprefcl.dll,-21
    DllName    REG_SZ    C:\Windows\System32\gpprefcl.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{F312195E-3D9D-447A-A3F5-08DFFA24735E}
    DisplayName    REG_EXPAND_SZ    @dggpext.dll,-600
    DllName    REG_EXPAND_SZ    dggpext.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{f3ccc681-b74c-4060-9f26-cd84525dca2a}
    DisplayName    REG_EXPAND_SZ    @auditcse.dll,-3000
    DllName    REG_EXPAND_SZ    auditcse.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{F9C77450-3A41-477E-9310-9ACD617BD9E3}
    DisplayName    REG_EXPAND_SZ    @gpprefcl.dll,-15
    DllName    REG_SZ    C:\Windows\System32\gpprefcl.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{FB2CA36D-0B40-4307-821B-A13B252DE56C}
    DisplayName    REG_EXPAND_SZ    @gptext.dll,-203
    DllName    REG_EXPAND_SZ    gptext.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{fbf687e6-f063-4d9f-9f4f-fd9a26acdd5f}
    DisplayName    REG_EXPAND_SZ    @gptext.dll,-205
    DllName    REG_EXPAND_SZ    gptext.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{FC491EF1-C4AA-4CE1-B329-414B101DB823}
    DisplayName    REG_EXPAND_SZ    @dggpext.dll,-600
    DllName    REG_EXPAND_SZ    dggpext.dll

End of search: 100 match(es) found.

Note: 68 of these 100 filenames are either unqualified or contain an environment variable.

All command lines registered with Programmatic Identifiers or Client Types:

REG.EXE QUERY "HKEY_LOCAL_MACHINE\SOFTWARE" /E /F "Command" /K /S /VE

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Application.Manifest\shell\open\command
    (Default)    REG_SZ    "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\dfshim.dll",ShOpenVerbApplication %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Application.Reference\shell\open\command
    (Default)    REG_SZ    "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\dfshim.dll",ShOpenVerbShortcut %1|%2

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\iexplore.exe\shell\open\command
    (Default)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\mspaint.exe\shell\edit\command
    (Default)    REG_EXPAND_SZ    "%systemroot%\system32\mspaint.exe" "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\notepad.exe\shell\edit\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\NOTEPAD.EXE %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\notepad.exe\shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\NOTEPAD.EXE %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\photoviewer.dll\shell\print\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe "%ProgramFiles%\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\provtool.exe\shell\open\command
    (Default)    REG_EXPAND_SZ    "%SystemRoot%\System32\provtool.exe" "%1" /source ShellOpen

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\wmplayer.exe\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /Open "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\wmplayer.exe\shell\play\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /Play "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\wordpad.exe\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows NT\Accessories\WORDPAD.EXE" "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AudioCD\shell\play\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /prefetch:3 /device:AudioCD "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\batfile\shell\edit\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\NOTEPAD.EXE %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\batfile\shell\open\command
    (Default)    REG_SZ    "%1" %*

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\batfile\shell\print\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\NOTEPAD.EXE /p %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\batfile\shell\runas\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\cmd.exe /C "%1" %*

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\brmFile\shell\Open\command
    (Default)    REG_SZ    "PrintBrmUI.exe" /import /file:"%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CABFolder\Shell\find\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CABFolder\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe /idlist,%I,%L

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\campfile\shell\Install Profile\command
    (Default)    REG_SZ    "colorcpl.exe" "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CATFile\shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenCAT %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\cdmpfile\shell\Install Profile\command
    (Default)    REG_SZ    "colorcpl.exe" "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CERFile\shell\add\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtAddCER %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CERFile\shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenCER %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CertificateStoreFile\shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenSTR %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\certificate_wab_auto_file\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Mail\wab.exe" /certificate "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\chm.file\shell\open\command
    (Default)    REG_EXPAND_SZ    "%SystemRoot%\hh.exe" %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00021400-0000-0000-C000-000000000046}\shell\cmd\command
    (Default)    REG_SZ    cmd.exe /s /k pushd "%V"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0AFACED1-E828-11D1-9187-B532F1E9575D}\shell\find\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0DF44EAA-FF21-4412-828E-260A8728E7F1}\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Options_RunDLL 1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\shell\find\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\shell\find\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\shell\Manage\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\CompMgmtLauncher.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{38A98528-6CBF-4CA9-8DC0-B1E1D10F7B1B}\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    rundll32.exe %SystemRoot%\system32\van.dll,RunVAN

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{38A98528-6CBF-4CA9-8DC0-B1E1D10F7B1B}\Shell\OpenWithoutDiagnostics\Command
    (Default)    REG_EXPAND_SZ    rundll32.exe %SystemRoot%\system32\van.dll,RunVAN /disablediagnostics

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3f6bc534-dfa1-4ab4-ae54-ef25a74e0107}\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\rstrui.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{40419485-C444-4567-851A-2DD7BFA1684D}\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Control_RunDLL %SystemRoot%\System32\telephon.cpl

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{450D8FBA-AD25-11D0-98A8-0800361B1103}\shell\cmd\command
    (Default)    REG_SZ    cmd.exe /s /k pushd "%V"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{450D8FBA-AD25-11D0-98A8-0800361B1103}\shell\find\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{48e7caab-b918-4e58-a94d-505519c795dc}\shell\find\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5ea4f148-308c-46d7-98a9-49041b1dd468}\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\mblctr.exe /open

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{62D8ED13-C9D0-4CE8-A914-47DD628FB1B0}\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Control_RunDLL %SystemRoot%\System32\intl.cpl

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{67718415-c450-4f3c-bf8a-b487642dc39b}\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\optionalfeatures.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6C8EEC18-8D75-41B2-A177-8831D59D2D50}\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Control_RunDLL %SystemRoot%\System32\main.cpl

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6DFD7C5C-2451-11d3-A299-00C04F8EF6AF}\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Options_RunDLL 0

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6DFD7C5C-2451-11d3-A299-00C04F8EF6AF}\Shell\RunAs\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Options_RunDLL 0

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{725BE8F7-668E-4C7B-8F90-46BDB0936430}\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Control_RunDLL %SystemRoot%\System32\main.cpl,@1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{74246bfc-4c96-11d0-abef-0020af6b0b7a}\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\mmc.exe %SystemRoot%\system32\devmgmt.msc

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{74246bfc-4c96-11d0-abef-0020af6b0b7a}\Shell\RunAs\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\mmc.exe %SystemRoot%\system32\devmgmt.msc

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7A9D77BD-5403-11d2-8785-2E0420524153}\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    netplwiz.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{80F3F1D5-FECA-45F3-BC32-752C152E456E}\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Control_RunDLL %SystemRoot%\System32\tabletpc.cpl @1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\NoAddOns\Command
    (Default)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" -extoff

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage\Command
    (Default)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{87D66A43-7B11-4A28-9811-C86EE395ACF7}\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Control_RunDLL %SystemRoot%\System32\srchadmin.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A3DD4F92-658A-410F-84FD-6FBBBEF2FFFE}\Shell\Open\Command
    (Default)    REG_SZ    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,Control_RunDLL C:\Windows\System32\inetcpl.cpl

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B2C761C6-29BC-4f19-9251-E6195265BAF1}\Shell\Open\Command
    (Default)    REG_SZ    "C:\Windows\System32\colorcpl.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B4FB3F98-C1EA-428d-A78A-D1F5659CBA93}\shell\changehomegroupsettings\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\control.exe /name Microsoft.HomeGroup

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B4FB3F98-C1EA-428d-A78A-D1F5659CBA93}\shell\sharewithdevices\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\control.exe /name Microsoft.NetworkAndSharingCenter /page ShareMedia

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B4FB3F98-C1EA-428d-A78A-D1F5659CBA93}\shell\starthomegrouptroubleshooter\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\msdt.exe -id HomegroupDiagnostic

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B4FB3F98-C1EA-428d-A78A-D1F5659CBA93}\shell\viewhomegrouppassword\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\control.exe /name Microsoft.HomeGroup /page Passkey

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D17D1D6D-CC3F-4815-8FE3-607E7D5D10B3}\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Control_RunDLL %SystemRoot%\System32\Speech\SpeechUX\sapi.cpl

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4480A50-BA28-11d1-8E75-00C04FA31A86}\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    rundll32 %SystemRoot%\System32\shwebsvc.dll,AddNetPlaceRunDll

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2E7934B-DCE5-43C4-9576-7FE4F75E7480}\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Control_RunDLL %SystemRoot%\System32\timedate.cpl

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E44E5D18-0652-4508-A4E2-8A090067BCB0}\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\control.exe /name Microsoft.DefaultPrograms

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F2DDFC82-8F12-4CDD-B7DC-D4FE1425AA4D}\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Control_RunDLL %SystemRoot%\System32\mmsys.cpl

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F82DF8F7-8B9F-442E-A48C-818EA735FF9B}\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Control_RunDLL %SystemRoot%\System32\tabletpc.cpl @0

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\cmdfile\shell\edit\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\NOTEPAD.EXE %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\cmdfile\shell\open\command
    (Default)    REG_SZ    "%1" %*

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\cmdfile\shell\print\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\NOTEPAD.EXE /p %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\cmdfile\shell\runas\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\cmd.exe /C "%1" %*

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\comfile\shell\open\command
    (Default)    REG_SZ    "%1" %*

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\Shell\find\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe /idlist,%I,%L

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\contact_wab_auto_file\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Mail\wab.exe" /contact "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\contact_wab_auto_file\shell\print\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Mail\wab.exe" /Print "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\cplfile\shell\cplopen\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\control.exe "%1",%*

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\cplfile\shell\runas\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe shell32.dll,Control_RunDLLAsUser "%1",%*

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CRLFile\shell\add\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtAddCRL %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CRLFile\shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenCRL %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\desktopthemepackfile\shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\themecpl.dll,OpenThemeAction %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\DeviceDisplayObject\AllItems\Shell\Microsoft.DxpOpen\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\DeviceDisplayObject\AllItems\Shell\Microsoft.DxpOpenInNewWindow\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\DeviceDisplayObject\InterfaceClass\{0850302A-B344-4fda-9BE9-90576B8D46F0}\Shell\Bluetooth\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Control_RunDLL %SystemRoot%\System32\bthprops.cpl,,1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\DeviceDisplayObject\InterfaceClass\{70FFD812-4C7F-4C7D-926A-637B7DD852AF}\Shell\DeviceInstall\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\newdev.dll,DeviceInternetSettingUi 2

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\DeviceDisplayObject\InterfaceClass\{884b96c3-56ef-11d1-bc8c-00a0c91405dd}\Shell\Regional\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\control.exe %SystemRoot%\System32\intl.cpl,,/p:"keyboard"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Diagnostic.Cabinet\shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\msdt.exe /cab "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Diagnostic.Config\shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\msdt.exe /path "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Diagnostic.Document\shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\msdt.exe /path "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Diagnostic.Perfmon.Config\shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\perfmon /sys /load "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Diagnostic.Perfmon.Document\shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\perfmon /sys /open "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Diagnostic.Resmon.Config\shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\perfmon /res /load "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\background\shell\cmd\command
    (Default)    REG_SZ    cmd.exe /s /k pushd "%V"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\background\shell\Powershell\command
    (Default)    REG_SZ    powershell.exe -noexit -command Set-Location -literalPath '%V'

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shell\cmd\command
    (Default)    REG_SZ    cmd.exe /s /k pushd "%V"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shell\find\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shell\Powershell\command
    (Default)    REG_SZ    powershell.exe -noexit -command Set-Location -literalPath '%V'

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\DLNA-PLAYSINGLE\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\docxfile\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows NT\Accessories\WORDPAD.EXE" "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\docxfile\shell\print\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows NT\Accessories\WORDPAD.EXE" /p "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\docxfile\shell\printto\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows NT\Accessories\WORDPAD.EXE" /pt "%1" "%2" "%3" "%4"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shell\change-passphrase\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\bdechangepin.exe -pw %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shell\change-pin\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\bdechangepin.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shell\cmd\command
    (Default)    REG_SZ    cmd.exe /s /k pushd "%V"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shell\encrypt-bde\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\BitLockerWizard.exe %1 T

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shell\encrypt-bde-elev\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\BitLockerWizardElev.exe %1 T

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shell\find\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shell\manage-bde\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\control.exe /name Microsoft.BitLockerDriveEncryption /page ?InitialVolume==%1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shell\Powershell\command
    (Default)    REG_SZ    powershell.exe -noexit -command Set-Location -literalPath '%V'

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shell\resume-bde\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\BitLockerWizard.exe %1 V

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shell\resume-bde-elev\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\BitLockerWizardElev.exe %1 V

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shell\unlock-bde\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\bdeunlock.exe %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\emffile\shell\open\command
    (Default)    REG_EXPAND_SZ    "%systemroot%\system32\mspaint.exe" "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\emffile\shell\print\command
    (Default)    REG_EXPAND_SZ    "%systemroot%\system32\mspaint.exe" /p "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\emffile\shell\printto\command
    (Default)    REG_EXPAND_SZ    "%systemroot%\system32\mspaint.exe" /pt "%1" "%2" "%3" "%4"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\evtfile\Shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\eventvwr.exe /l:"%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\evtxfile\Shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\eventvwr.exe /l:"%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\shell\open\command
    (Default)    REG_SZ    "%1" %*

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\shell\runas\command
    (Default)    REG_SZ    "%1" %*

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Explorer.AssocActionId.BurnSelection\shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\explorer.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Explorer.AssocActionId.EraseDisc\shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\explorer.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Explorer.AssocActionId.ZipSelection\shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\explorer.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Explorer.AssocProtocol.search-ms\shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\FaxCover.Document\shell\open\command
    (Default)    REG_SZ    C:\Windows\System32\fxscover.exe "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\FaxCover.Document\shell\print\command
    (Default)    REG_SZ    C:\Windows\System32\fxscover.exe /P "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\FindApp.DVD\Shell\Play\command
    (Default)    REG_EXPAND_SZ    explorer "ms-windows-store://search/?query=DVD"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\fonfile\shell\preview\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\fontview.exe %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\fonfile\shell\print\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\fontview.exe /p %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ftp\shell\open\command
    (Default)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\giffile\shell\Open\command
    (Default)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\giffile\shell\printto\command
    (Default)    REG_EXPAND_SZ    "%SystemRoot%\System32\rundll32.exe" "%SystemRoot%\System32\shimgvw.dll",ImageView_PrintTo /pt "%1" "%2" "%3" "%4"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\gmmpfile\shell\Install Profile\command
    (Default)    REG_SZ    "colorcpl.exe" "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\group_wab_auto_file\shell\edit\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Mail\wab.exe" /Group "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\group_wab_auto_file\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Mail\wab.exe" /Group "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\group_wab_auto_file\shell\print\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Mail\wab.exe" /Print "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\hlpfile\shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\winhlp32.exe %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\htafile\Shell\Open\Command
    (Default)    REG_SZ    C:\Windows\SysWOW64\mshta.exe "%1" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}%U{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5} %*

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\htmlfile\shell\open\command
    (Default)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\htmlfile\shell\print\command
    (Default)    REG_EXPAND_SZ    "%systemroot%\system32\rundll32.exe" "%systemroot%\system32\mshtml.dll",PrintHTML "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\htmlfile\shell\printto\command
    (Default)    REG_EXPAND_SZ    "%systemroot%\system32\rundll32.exe" "%systemroot%\system32\mshtml.dll",PrintHTML "%1" "%2" "%3" "%4"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\http\shell\open\command
    (Default)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\https\shell\open\command
    (Default)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\icmfile\shell\Install Profile\command
    (Default)    REG_SZ    "colorcpl.exe" "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IE.AssocFile.HTM\shell\open\command
    (Default)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IE.AssocFile.HTM\shell\opennew\command
    (Default)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IE.AssocFile.HTM\shell\print\command
    (Default)    REG_SZ    "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IE.AssocFile.HTM\shell\printto\command
    (Default)    REG_SZ    "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" "%2" "%3" "%4"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IE.AssocFile.MHT\shell\open\command
    (Default)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IE.AssocFile.MHT\shell\opennew\command
    (Default)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IE.AssocFile.PARTIAL\shell\open\command
    (Default)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IE.AssocFile.SVG\shell\open\command
    (Default)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IE.AssocFile.SVG\shell\opennew\command
    (Default)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IE.AssocFile.SVG\shell\print\command
    (Default)    REG_SZ    "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IE.AssocFile.SVG\shell\printto\command
    (Default)    REG_SZ    "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" "%2" "%3" "%4"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IE.AssocFile.URL\Shell\Open\Command
    (Default)    REG_SZ    "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IE.AssocFile.URL\Shell\print\command
    (Default)    REG_SZ    "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IE.AssocFile.URL\Shell\printto\command
    (Default)    REG_SZ    "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" "%2" "%3" "%4"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IE.AssocFile.WEBSITE\Shell\Open\Command
    (Default)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" -w "%l" %*

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IE.AssocFile.XHT\shell\open\command
    (Default)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IE.AssocFile.XHT\shell\opennew\command
    (Default)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IE.AssocFile.XHT\shell\print\command
    (Default)    REG_SZ    "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintXHTML "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IE.AssocFile.XHT\shell\printto\command
    (Default)    REG_SZ    "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintXHTML "%1" "%2" "%3" "%4"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IE.FTP\shell\open\command
    (Default)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IE.HTTP\shell\open\command
    (Default)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IE.HTTPS\shell\open\command
    (Default)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IMEDictionaryCompiler\shell\open\command
    (Default)    REG_EXPAND_SZ    "%WINDIR%\system32\IME\SHARED\imewdbld.exe" "%1" %*

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\imesxfile\shell\open\command
    (Default)    REG_EXPAND_SZ    "%WINDIR%\system32\IME\SHARED\imesearch.exe" "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\inffile\shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\NOTEPAD.EXE %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\inffile\shell\print\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\NOTEPAD.EXE /p %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\inifile\shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\NOTEPAD.EXE %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\inifile\shell\print\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\NOTEPAD.EXE /p %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\InternetShortcut\shell\Open\Command
    (Default)    REG_SZ    "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\InternetShortcut\shell\print\command
    (Default)    REG_SZ    "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\InternetShortcut\shell\printto\command
    (Default)    REG_SZ    "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" "%2" "%3" "%4"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\jpegfile\shell\printto\command
    (Default)    REG_EXPAND_SZ    "%SystemRoot%\System32\rundll32.exe" "%SystemRoot%\System32\shimgvw.dll",ImageView_PrintTo /pt "%1" "%2" "%3" "%4"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\JSEFile\Shell\Edit\Command
    (Default)    REG_SZ    C:\Windows\System32\Notepad.exe %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\JSEFile\Shell\Open\Command
    (Default)    REG_SZ    C:\Windows\System32\WScript.exe "%1" %*

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\JSEFile\Shell\Open2\Command
    (Default)    REG_SZ    C:\Windows\System32\CScript.exe "%1" %*

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\JSEFile\Shell\Print\Command
    (Default)    REG_SZ    C:\Windows\System32\Notepad.exe /p %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\JSFile\Shell\Edit\Command
    (Default)    REG_SZ    C:\Windows\System32\Notepad.exe %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\JSFile\Shell\Open\Command
    (Default)    REG_SZ    C:\Windows\System32\WScript.exe "%1" %*

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\JSFile\Shell\Open2\Command
    (Default)    REG_SZ    C:\Windows\System32\CScript.exe "%1" %*

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\JSFile\Shell\Print\Command
    (Default)    REG_SZ    C:\Windows\System32\Notepad.exe /p %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Launcher.Computer\Shell\Manage\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\CompMgmtLauncher.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\LDAP\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Mail\wab.exe" "/ldap:%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\LpkSetup.1\Shell\install\command
    (Default)    REG_EXPAND_SZ    %systemroot%\system32\lpksetup.exe /p "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MacromediaFlashPaper.MacromediaFlashPaper\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Internet Explorer\iexplore.exe" "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\mhtmlfile\shell\open\command
    (Default)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\mhtmlfile\shell\opennew\command
    (Default)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Microsoft.PowerShellConsole.1\Shell\0\Command
    (Default)    REG_SZ    "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -p "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Microsoft.PowerShellConsole.1\Shell\Open\Command
    (Default)    REG_SZ    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -p "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Microsoft.PowerShellData.1\Shell\Open\Command
    (Default)    REG_SZ    "C:\Windows\System32\notepad.exe" "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Microsoft.PowerShellModule.1\Shell\Open\Command
    (Default)    REG_SZ    "C:\Windows\System32\notepad.exe" "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Microsoft.PowerShellScript.1\Shell\Open\Command
    (Default)    REG_SZ    "C:\Windows\System32\notepad.exe" "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Microsoft.ProvTool.Provisioning.1\Shell\open\command
    (Default)    REG_EXPAND_SZ    "%SystemRoot%\System32\provtool.exe" "%1" /source ShellOpen

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Microsoft.System.Update.1\shell\open\command
    (Default)    REG_EXPAND_SZ    "%systemroot%\system32\wusa.exe" "%1" %*

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Microsoft.Website\Shell\Open\Command
    (Default)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" -w "%l" %*

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Microsoft.Workfolders\Shell\Open\command
    (Default)    REG_SZ    C:\Windows\System32\control.exe /name Microsoft.WorkFolders

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MMS\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ms-availablenetworks\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    "%SystemRoot%\system32\LaunchWinApp.exe" "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ms-mmsys\shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Control_RunDLL %SystemRoot%\System32\mmsys.cpl %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ms-msdt\shell\open\command
    (Default)    REG_EXPAND_SZ    "%SystemRoot%\system32\msdt.exe" %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ms-msime-imepad\shell\open\command
    (Default)    REG_SZ    C:\Windows\System32\IME\SHARED\IMEPADSV.EXE %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ms-msime-imjpdct\shell\open\command
    (Default)    REG_SZ    C:\Windows\System32\IME\IMEJP\IMJPDCT.EXE %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ms-perception-simulation\shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\PerceptionSimulation\PerceptionSimulationInput.exe %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ms-quick-assist\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    "%SystemRoot%\system32\quickassist.exe" %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ms-rdx-document\shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\RDXService,OpenRDXDocument %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ms-settings-connectabledevices\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    "%SystemRoot%\system32\LaunchWinApp.exe" "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ms-settings-displays-topology\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    "%SystemRoot%\system32\LaunchWinApp.exe" "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ms-virtualtouchpad\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    "%SystemRoot%\system32\LaunchWinApp.exe" "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\mscfile\shell\Author\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\mmc.exe /a "%1" %*

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\mscfile\shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\mmc.exe "%1" %*

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\mscfile\shell\RunAs\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\mmc.exe "%1" %*

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MSDASC\shell\open\command
    (Default)    REG_EXPAND_SZ    Rundll32.exe "%CommonProgramFiles%\System\OLE DB\oledb32.dll",OpenDSLFile %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Msi.Package\shell\Open\command
    (Default)    REG_EXPAND_SZ    "%SystemRoot%\System32\msiexec.exe" /i "%1" %*

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Msi.Package\shell\Repair\command
    (Default)    REG_EXPAND_SZ    "%SystemRoot%\System32\msiexec.exe" /f "%1" %*

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Msi.Package\shell\Uninstall\command
    (Default)    REG_EXPAND_SZ    "%SystemRoot%\System32\msiexec.exe" /x "%1" %*

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Msi.Patch\shell\Open\command
    (Default)    REG_EXPAND_SZ    "%SystemRoot%\System32\msiexec.exe" /p "%1" %*

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MSInfoFile\shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\msinfo32.exe "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MSSppLicenseFile\shell\open\command
    (Default)    REG_SZ    "iexplore.exe" "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MSStorageSense\shell\open\command
    (Default)    REG_EXPAND_SZ    explorer ms-settings:storagesense

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\msstylesfile\shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,Control_RunDLL %SystemRoot%\system32\desk.cpl desk,@Appearance /Action:OpenMSTheme /file:"%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\NetServer\shell\remotedesktop\command
    (Default)    REG_SZ    mstsc.exe -v %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\NetworkExplorerPlugins\urn:schemas-upnp-org:device:MediaServer:1\shell\Open Media Player\command
    (Default)    REG_EXPAND_SZ    C:\Program Files\Windows Media Player\wmplayer.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\odtfile\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows NT\Accessories\WORDPAD.EXE" "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\odtfile\shell\print\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows NT\Accessories\WORDPAD.EXE" /p "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\odtfile\shell\printto\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows NT\Accessories\WORDPAD.EXE" /pt "%1" "%2" "%3" "%4"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\opensearchdescription\shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\explorer.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\opensearchfilefolderresult\shell\open\command
    (Default)    REG_SZ     

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\opensearchresult\shell\open\command
    (Default)    REG_SZ     

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\opensearchresult\shell\print\command
    (Default)    REG_EXPAND_SZ    rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\otffile\shell\preview\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\fontview.exe %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\otffile\shell\print\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\fontview.exe /p %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\P7RFile\shell\add\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtAddP7R %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\P7RFile\shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenP7R %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\P7SFile\shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\\rundll32.exe cryptext.dll,CryptExtOpenPKCS7 %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Paint.Picture\shell\edit\command
    (Default)    REG_EXPAND_SZ    "%systemroot%\system32\mspaint.exe" "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Paint.Picture\shell\printto\command
    (Default)    REG_EXPAND_SZ    "%systemroot%\system32\mspaint.exe" /pt "%1" "%2" "%3" "%4"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\pbkfile\Shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\rasphone.exe -f "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PBrush\shell\edit\command
    (Default)    REG_EXPAND_SZ    "%systemroot%\system32\mspaint.exe" "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PBrush\shell\print\command
    (Default)    REG_EXPAND_SZ    "%systemroot%\system32\mspaint.exe" /p "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PBrush\shell\printto\command
    (Default)    REG_EXPAND_SZ    "%systemroot%\system32\mspaint.exe" /pt "%1" "%2" "%3" "%4"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PerfFile\shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\mmc.exe %systemroot%\system32\perfmon.msc /F "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\pfmfile\shell\preview\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\fontview.exe %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\pfmfile\shell\print\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\fontview.exe /p %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PFXFile\shell\add\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtAddPFX %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PFXFile\shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenPFX %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PhotoViewer.FileAssoc.Tiff\shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe "%ProgramFiles%\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\piffile\shell\open\command
    (Default)    REG_SZ    "%1" %*

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\pjpegfile\shell\printto\command
    (Default)    REG_EXPAND_SZ    "%SystemRoot%\System32\rundll32.exe" "%SystemRoot%\System32\shimgvw.dll",ImageView_PrintTo /pt "%1" "%2" "%3" "%4"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\pngfile\shell\printto\command
    (Default)    REG_EXPAND_SZ    "%SystemRoot%\System32\rundll32.exe" "%SystemRoot%\System32\shimgvw.dll",ImageView_PrintTo /pt "%1" "%2" "%3" "%4"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\prffile\shell\Open\command
    (Default)    REG_EXPAND_SZ    "%SystemRoot%\System32\rundll32.exe" "%SystemRoot%\System32\msrating.dll",ClickedOnPRF %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ratfile\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    "%SystemRoot%\System32\rundll32.exe" "%SystemRoot%\System32\msrating.dll",ClickedOnRAT %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\RDP.File\shell\Connect\command
    (Default)    REG_SZ    mstsc.exe "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\RDP.File\shell\Edit\command
    (Default)    REG_SZ    mstsc.exe -edit "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\RDP.File\shell\Open\command
    (Default)    REG_EXPAND_SZ    "%systemroot%\system32\mstsc.exe" "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\regedit\shell\open\command
    (Default)    REG_SZ    regedit.exe "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\regfile\shell\edit\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\notepad.exe "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\regfile\shell\open\command
    (Default)    REG_SZ    regedit.exe "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\regfile\shell\print\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\notepad.exe /p "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\RemoteAssistance.1\Shell\open\command
    (Default)    REG_EXPAND_SZ    "%systemRoot%\system32\msra.exe" -openfile "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\rlefile\shell\open\command
    (Default)    REG_EXPAND_SZ    "%systemroot%\system32\mspaint.exe" "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\rlefile\shell\print\command
    (Default)    REG_EXPAND_SZ    "%systemroot%\system32\mspaint.exe" /p "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\rlefile\shell\printto\command
    (Default)    REG_EXPAND_SZ    "%systemroot%\system32\mspaint.exe" /pt "%1" "%2" "%3" "%4"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\rlogin\shell\open\command
    (Default)    REG_SZ    "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\url.dll",TelnetProtocolHandler %l

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\rtffile\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows NT\Accessories\WORDPAD.EXE" "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\rtffile\shell\print\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows NT\Accessories\WORDPAD.EXE" /p "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\rtffile\shell\printto\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows NT\Accessories\WORDPAD.EXE" /pt "%1" "%2" "%3" "%4"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SavedDsQuery\Shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\dsquery.dll,OpenSavedDsQuery %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\scrfile\shell\config\command
    (Default)    REG_SZ    "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\scrfile\shell\install\command
    (Default)    REG_SZ    rundll32.exe desk.cpl,InstallScreenSaver %l

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\scrfile\shell\open\command
    (Default)    REG_SZ    "%1" /S

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\scriptletfile\Shell\Generate Typelib\command
    (Default)    REG_SZ    "C:\Windows\System32\RUNDLL32.EXE" "C:\Windows\System32\scrobj.dll",GenerateTypeLib "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\scriptletfile\Shell\Open\command
    (Default)    REG_SZ    "C:\Windows\System32\NOTEPAD.EXE" "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\scriptletfile\Shell\Register\command
    (Default)    REG_SZ    "C:\Windows\System32\REGSVR32.EXE" /i:"%1" "C:\Windows\System32\scrobj.dll"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\scriptletfile\Shell\Unregister\command
    (Default)    REG_SZ    "C:\Windows\System32\REGSVR32.EXE" /u /n /i:"%1" "C:\Windows\System32\scrobj.dll"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\search\shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\search-ms\shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SHCmdFile\shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\explorer.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Shell.CDBurn\Shell\Prepare\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,PrepareDiscForBurnRunDll %L

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SPCFile\shell\add\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtAddSPC %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SPCFile\shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenPKCS7 %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\svgfile\shell\open\command
    (Default)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\svgfile\shell\opennew\command
    (Default)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\svgfile\shell\print\command
    (Default)    REG_EXPAND_SZ    "%systemroot%\system32\rundll32.exe" "%systemroot%\system32\mshtml.dll",PrintHTML "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\svgfile\shell\printto\command
    (Default)    REG_EXPAND_SZ    "%systemroot%\system32\rundll32.exe" "%systemroot%\system32\mshtml.dll",PrintHTML "%1" "%2" "%3" "%4"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.3mf\Shell\3D Edit\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\mspaint.exe "%1" /ForceBootstrapPaint3D

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.avci\Shell\print\command
    (Default)    REG_EXPAND_SZ    rundll32.exe %SystemRoot%\system32\shimgvw.dll,ImageView_Fullscreen %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.avci\Shell\setdesktopwallpaper\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.avcs\Shell\print\command
    (Default)    REG_EXPAND_SZ    rundll32.exe %SystemRoot%\system32\shimgvw.dll,ImageView_Fullscreen %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.avcs\Shell\setdesktopwallpaper\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.avif\Shell\print\command
    (Default)    REG_EXPAND_SZ    rundll32.exe %SystemRoot%\system32\shimgvw.dll,ImageView_Fullscreen %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.avif\Shell\setdesktopwallpaper\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.avifs\Shell\print\command
    (Default)    REG_EXPAND_SZ    rundll32.exe %SystemRoot%\system32\shimgvw.dll,ImageView_Fullscreen %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.avifs\Shell\setdesktopwallpaper\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.bmp\Shell\3D Edit\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\mspaint.exe "%1" /ForceBootstrapPaint3D

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.bmp\Shell\setdesktopwallpaper\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.dib\Shell\setdesktopwallpaper\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.fbx\Shell\3D Edit\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\mspaint.exe "%1" /ForceBootstrapPaint3D

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.gif\Shell\3D Edit\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\mspaint.exe "%1" /ForceBootstrapPaint3D

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.gif\Shell\setdesktopwallpaper\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.glb\Shell\3D Edit\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\mspaint.exe "%1" /ForceBootstrapPaint3D

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.heic\Shell\print\command
    (Default)    REG_EXPAND_SZ    rundll32.exe %SystemRoot%\system32\shimgvw.dll,ImageView_Fullscreen %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.heic\Shell\setdesktopwallpaper\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.heics\Shell\print\command
    (Default)    REG_EXPAND_SZ    rundll32.exe %SystemRoot%\system32\shimgvw.dll,ImageView_Fullscreen %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.heics\Shell\setdesktopwallpaper\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.heif\Shell\print\command
    (Default)    REG_EXPAND_SZ    rundll32.exe %SystemRoot%\system32\shimgvw.dll,ImageView_Fullscreen %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.heif\Shell\setdesktopwallpaper\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.heifs\Shell\print\command
    (Default)    REG_EXPAND_SZ    rundll32.exe %SystemRoot%\system32\shimgvw.dll,ImageView_Fullscreen %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.heifs\Shell\setdesktopwallpaper\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.inf\shell\Install\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\InfDefaultInstall.exe "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jfif\Shell\3D Edit\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\mspaint.exe "%1" /ForceBootstrapPaint3D

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jfif\Shell\setdesktopwallpaper\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jpe\Shell\3D Edit\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\mspaint.exe "%1" /ForceBootstrapPaint3D

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jpe\Shell\setdesktopwallpaper\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jpeg\Shell\3D Edit\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\mspaint.exe "%1" /ForceBootstrapPaint3D

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jpeg\Shell\setdesktopwallpaper\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jpg\Shell\3D Edit\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\mspaint.exe "%1" /ForceBootstrapPaint3D

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jpg\Shell\setdesktopwallpaper\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.obj\Shell\3D Edit\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\mspaint.exe "%1" /ForceBootstrapPaint3D

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.ply\Shell\3D Edit\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\mspaint.exe "%1" /ForceBootstrapPaint3D

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.png\Shell\3D Edit\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\mspaint.exe "%1" /ForceBootstrapPaint3D

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.png\Shell\setdesktopwallpaper\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.ps1\Shell\0\Command
    (Default)    REG_SZ    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "-Command" "if((Get-ExecutionPolicy ) -ne 'AllSigned') { Set-ExecutionPolicy -Scope Process Bypass }; & '%1'"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.ps1\Shell\Edit\Command
    (Default)    REG_SZ    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe" "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.psd1\Shell\Edit\Command
    (Default)    REG_SZ    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe" "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.psm1\Shell\Edit\Command
    (Default)    REG_SZ    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe" "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.stl\Shell\3D Edit\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\mspaint.exe "%1" /ForceBootstrapPaint3D

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.tif\Shell\3D Edit\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\mspaint.exe "%1" /ForceBootstrapPaint3D

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.tif\Shell\setdesktopwallpaper\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.tiff\Shell\3D Edit\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\mspaint.exe "%1" /ForceBootstrapPaint3D

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.tiff\Shell\setdesktopwallpaper\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.wdp\Shell\setdesktopwallpaper\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\image\shell\edit\command
    (Default)    REG_EXPAND_SZ    "%systemroot%\system32\mspaint.exe" "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\image\shell\print\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe "%ProgramFiles%\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\text\shell\edit\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\NOTEPAD.EXE %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\text\shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\NOTEPAD.EXE %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\telnet\shell\open\command
    (Default)    REG_SZ    "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\url.dll",TelnetProtocolHandler %l

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\textfile\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows NT\Accessories\WORDPAD.EXE" "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\textfile\shell\print\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows NT\Accessories\WORDPAD.EXE" /p "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\textfile\shell\printto\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows NT\Accessories\WORDPAD.EXE" /pt "%1" "%2" "%3" "%4"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\themefile\shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\themecpl.dll,OpenThemeAction %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\themepackfile\shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\themecpl.dll,OpenThemeAction %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TIFImage.Document\shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe "%ProgramFiles%\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TIFImage.Document\shell\printto\command
    (Default)    REG_EXPAND_SZ    "%SystemRoot%\System32\rundll32.exe" "%SystemRoot%\System32\shimgvw.dll",ImageView_PrintTo /pt "%1" "%2" "%3" "%4"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\tn3270\shell\open\command
    (Default)    REG_SZ    "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\url.dll",TelnetProtocolHandler %l

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ttcfile\shell\preview\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\fontview.exe %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ttcfile\shell\print\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\fontview.exe /p %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ttffile\shell\preview\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\fontview.exe %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ttffile\shell\print\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\fontview.exe /p %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\txtfile\shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\NOTEPAD.EXE %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\txtfile\shell\print\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\NOTEPAD.EXE /p %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\txtfile\shell\printto\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\notepad.exe /pt "%1" "%2" "%3" "%4"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Undecided\shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\OpenWith.exe "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\Open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\OpenWith.exe "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\openas\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\OpenWith.exe "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\OpenWithSetDefaultOn\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\OpenWith.exe -override "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VBEFile\Shell\Edit\Command
    (Default)    REG_EXPAND_SZ    "%SystemRoot%\System32\Notepad.exe" %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VBEFile\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    "%SystemRoot%\System32\WScript.exe" "%1" %*

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VBEFile\Shell\Open2\Command
    (Default)    REG_EXPAND_SZ    "%SystemRoot%\System32\CScript.exe" "%1" %*

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VBEFile\Shell\Print\Command
    (Default)    REG_EXPAND_SZ    "%SystemRoot%\System32\Notepad.exe" /p %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command
    (Default)    REG_EXPAND_SZ    "%SystemRoot%\System32\Notepad.exe" %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    "%SystemRoot%\System32\WScript.exe" "%1" %*

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command
    (Default)    REG_EXPAND_SZ    "%SystemRoot%\System32\CScript.exe" "%1" %*

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VBSFile\Shell\Print\Command
    (Default)    REG_EXPAND_SZ    "%SystemRoot%\System32\Notepad.exe" /p %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\vcard_wab_auto_file\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Mail\wab.exe" /vcard "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WAB.AssocProtocol.LDAP\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Mail\wab.exe" "/ldap:%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\wab_auto_file\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Mail\wab.exe" /Import "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\wbcatfile\shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\sdclt.exe /restorepage

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\wcxfile\shell\Open\Command
    (Default)    REG_SZ    "C:\Windows\System32\xwizard.exe" RunWizard /u {7940acf8-60ba-4213-a7c3-f3b400ee266d} /z%1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\wdpfile\shell\print\command
    (Default)    REG_EXPAND_SZ    rundll32.exe %SystemRoot%\system32\shimgvw.dll,ImageView_Fullscreen %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\wdpfile\shell\printto\command
    (Default)    REG_EXPAND_SZ    rundll32.exe %SystemRoot%\system32\shimgvw.dll,ImageView_PrintTo /pt "%1" "%2" "%3" "%4"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\webpnpFile\shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\wpnpinst.exe %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Windows.CompositeFont\shell\open\command
    (Default)    REG_EXPAND_SZ    "%SystemRoot%\System32\notepad.exe" "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Windows.IsoFile\shell\burn\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\isoburn.exe "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Windows.IsoFile\shell\mount\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Windows.VhdFile\shell\mount\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Windows.XamlDocument\shell\edit\command
    (Default)    REG_EXPAND_SZ    "%SystemRoot%\System32\notepad.exe" "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Windows.XamlDocument\shell\open\command
    (Default)    REG_SZ    "C:\Windows\System32\PresentationHost.exe" "%1" %*

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Windows.Xbap\shell\edit\command
    (Default)    REG_EXPAND_SZ    "%SystemRoot%\System32\notepad.exe" "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Windows.Xbap\shell\open\command
    (Default)    REG_SZ    "C:\Windows\System32\PresentationHost.exe" "%1" %*

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WindowsBackupFolderOptions\shell\openDesktopIni\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\sdclt.exe /FOLDEROPTIONS %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WindowsStore.License\shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\licensemanagershellext.exe "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\wmffile\shell\open\command
    (Default)    REG_EXPAND_SZ    "%systemroot%\system32\mspaint.exe" "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\wmffile\shell\print\command
    (Default)    REG_EXPAND_SZ    "%systemroot%\system32\mspaint.exe" /p "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\wmffile\shell\printto\command
    (Default)    REG_EXPAND_SZ    "%systemroot%\system32\mspaint.exe" /pt "%1" "%2" "%3" "%4"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP.AudioCD\shell\play\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /prefetch:3 /device:AudioCD "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP.BurnCD\Shell\Burn\Command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /prefetch:3 /Task:CDWrite /Device:"%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP.DVD\shell\play\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /prefetch:4 /device:DVD "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP.DVR-MSFile\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /Open "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP.DVR-MSFile\shell\play\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /Play "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP.VCD\shell\play\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /prefetch:4 /device:VCD "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP.WTVFile\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /Open "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP.WTVFile\shell\play\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /Play "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.3G2\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.3G2\shell\play\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /prefetch:6 /Play "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.3GP\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.3GP\shell\play\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /prefetch:6 /Play "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.ADTS\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.ADTS\shell\play\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /prefetch:6 /Play "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.AIFF\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /Open "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.AIFF\shell\play\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /Play "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.ASF\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /prefetch:7 /Open "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.ASF\shell\play\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /prefetch:7 /Play "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.ASX\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /Open "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.ASX\shell\play\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /Play "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.AU\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /Open "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.AU\shell\play\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /Play "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.AVI\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /prefetch:8 /Open "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.AVI\shell\play\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /prefetch:8 /Play "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.CDA\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /Open "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.CDA\shell\play\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /Play "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.FLAC\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.FLAC\shell\play\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /prefetch:6 /Play "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.M2TS\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /prefetch:12 /Open "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.M2TS\shell\play\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /prefetch:12 /Play "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.M3U\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.M3U\shell\play\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /prefetch:6 /Play "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.M4A\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.M4A\shell\play\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /prefetch:6 /Play "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.MIDI\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /Open "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.MIDI\shell\play\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /Play "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.MK3D\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.MK3D\shell\play\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /prefetch:6 /Play "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.MKA\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.MKA\shell\play\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /prefetch:6 /Play "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.MKV\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.MKV\shell\play\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /prefetch:6 /Play "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.MOV\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.MOV\shell\play\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /prefetch:6 /Play "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.MP3\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.MP3\shell\play\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /prefetch:6 /Play "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.MP4\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.MP4\shell\play\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /prefetch:6 /Play "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.MPEG\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /prefetch:9 /Open "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.MPEG\shell\play\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /prefetch:9 /Play "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.TTS\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /prefetch:12 /Open "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.TTS\shell\play\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /prefetch:12 /Play "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.WAV\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /Open "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.WAV\shell\play\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /Play "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.WAX\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /Open "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.WAX\shell\play\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /Play "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.wma\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /prefetch:5 /Open "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.wma\shell\play\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /prefetch:5 /Play "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.WMD\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /WMPackage:"%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.WMS\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /layout:"%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.WMV\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /prefetch:7 /Open "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.WMV\shell\play\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /prefetch:7 /Play "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.WMZ\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /layout:"%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.WPL\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /Open "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.WPL\shell\play\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /Play "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.WVX\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /Open "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocFile.WVX\shell\play\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /Play "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocProtocol.DLNA-PLAYSINGLE\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMP11.AssocProtocol.MMS\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" "%L"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wordpad.Document.1\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows NT\Accessories\WORDPAD.EXE" "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wordpad.Document.1\shell\print\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows NT\Accessories\WORDPAD.EXE" /p "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wordpad.Document.1\shell\printto\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows NT\Accessories\WORDPAD.EXE" /pt "%1" "%2" "%3" "%4"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00021400-0000-0000-C000-000000000046}\shell\cmd\command
    (Default)    REG_SZ    cmd.exe /s /k pushd "%V"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0AFACED1-E828-11D1-9187-B532F1E9575D}\shell\find\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0DF44EAA-FF21-4412-828E-260A8728E7F1}\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Options_RunDLL 1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\shell\find\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\shell\find\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\shell\Manage\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\CompMgmtLauncher.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{38A98528-6CBF-4CA9-8DC0-B1E1D10F7B1B}\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    rundll32.exe %SystemRoot%\system32\van.dll,RunVAN

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{38A98528-6CBF-4CA9-8DC0-B1E1D10F7B1B}\Shell\OpenWithoutDiagnostics\Command
    (Default)    REG_EXPAND_SZ    rundll32.exe %SystemRoot%\system32\van.dll,RunVAN /disablediagnostics

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3f6bc534-dfa1-4ab4-ae54-ef25a74e0107}\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\rstrui.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{40419485-C444-4567-851A-2DD7BFA1684D}\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Control_RunDLL %SystemRoot%\System32\telephon.cpl

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{450D8FBA-AD25-11D0-98A8-0800361B1103}\shell\cmd\command
    (Default)    REG_SZ    cmd.exe /s /k pushd "%V"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{450D8FBA-AD25-11D0-98A8-0800361B1103}\shell\find\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48e7caab-b918-4e58-a94d-505519c795dc}\shell\find\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62D8ED13-C9D0-4CE8-A914-47DD628FB1B0}\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Control_RunDLL %SystemRoot%\System32\intl.cpl

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6C8EEC18-8D75-41B2-A177-8831D59D2D50}\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Control_RunDLL %SystemRoot%\System32\main.cpl

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6DFD7C5C-2451-11d3-A299-00C04F8EF6AF}\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Options_RunDLL 0

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6DFD7C5C-2451-11d3-A299-00C04F8EF6AF}\Shell\RunAs\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Options_RunDLL 0

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{725BE8F7-668E-4C7B-8F90-46BDB0936430}\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Control_RunDLL %SystemRoot%\System32\main.cpl,@1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{74246bfc-4c96-11d0-abef-0020af6b0b7a}\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\mmc.exe %SystemRoot%\system32\devmgmt.msc

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{74246bfc-4c96-11d0-abef-0020af6b0b7a}\Shell\RunAs\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\mmc.exe %SystemRoot%\system32\devmgmt.msc

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7A9D77BD-5403-11d2-8785-2E0420524153}\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    netplwiz.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{87D66A43-7B11-4A28-9811-C86EE395ACF7}\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Control_RunDLL %SystemRoot%\System32\srchadmin.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A3DD4F92-658A-410F-84FD-6FBBBEF2FFFE}\Shell\Open\Command
    (Default)    REG_SZ    C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\shell32.dll,Control_RunDLL C:\Windows\SysWOW64\inetcpl.cpl

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B2C761C6-29BC-4f19-9251-E6195265BAF1}\Shell\Open\Command
    (Default)    REG_SZ    "C:\Windows\SysWOW64\colorcpl.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4FB3F98-C1EA-428d-A78A-D1F5659CBA93}\shell\changehomegroupsettings\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\control.exe /name Microsoft.HomeGroup

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4FB3F98-C1EA-428d-A78A-D1F5659CBA93}\shell\sharewithdevices\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\control.exe /name Microsoft.NetworkAndSharingCenter /page ShareMedia

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4FB3F98-C1EA-428d-A78A-D1F5659CBA93}\shell\starthomegrouptroubleshooter\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\msdt.exe -id HomegroupDiagnostic

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4FB3F98-C1EA-428d-A78A-D1F5659CBA93}\shell\viewhomegrouppassword\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\control.exe /name Microsoft.HomeGroup /page Passkey

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D17D1D6D-CC3F-4815-8FE3-607E7D5D10B3}\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Control_RunDLL %SystemRoot%\System32\Speech\SpeechUX\sapi.cpl

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D4480A50-BA28-11d1-8E75-00C04FA31A86}\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    rundll32 %SystemRoot%\System32\shwebsvc.dll,AddNetPlaceRunDll

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E2E7934B-DCE5-43C4-9576-7FE4F75E7480}\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Control_RunDLL %SystemRoot%\System32\timedate.cpl

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E44E5D18-0652-4508-A4E2-8A090067BCB0}\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\control.exe /name Microsoft.DefaultPrograms

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F2DDFC82-8F12-4CDD-B7DC-D4FE1425AA4D}\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Control_RunDLL %SystemRoot%\System32\mmsys.cpl

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WPDContextMenu.Url\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    "%SystemRoot%\System32\rundll32.exe" "%SystemRoot%\System32\ieframe.dll",OpenURL %l

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WSFFile\Shell\Edit\Command
    (Default)    REG_EXPAND_SZ    "%SystemRoot%\System32\Notepad.exe" %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WSFFile\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    "%SystemRoot%\System32\WScript.exe" "%1" %*

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WSFFile\Shell\Open2\Command
    (Default)    REG_EXPAND_SZ    "%SystemRoot%\System32\CScript.exe" "%1" %*

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WSFFile\Shell\Print\Command
    (Default)    REG_EXPAND_SZ    "%SystemRoot%\System32\Notepad.exe" /p %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WSHFile\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    "%SystemRoot%\System32\WScript.exe" "%1" %*

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WSHFile\Shell\Open2\Command
    (Default)    REG_EXPAND_SZ    "%SystemRoot%\System32\CScript.exe" "%1" %*

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\xhtmlfile\shell\open\command
    (Default)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\xhtmlfile\shell\opennew\command
    (Default)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\xhtmlfile\shell\print\command
    (Default)    REG_EXPAND_SZ    "%systemroot%\system32\rundll32.exe" "%systemroot%\system32\mshtml.dll",PrintHTML "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\xhtmlfile\shell\printto\command
    (Default)    REG_EXPAND_SZ    "%systemroot%\system32\rundll32.exe" "%systemroot%\system32\mshtml.dll",PrintHTML "%1" "%2" "%3" "%4"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\xmlfile\shell\Open\command
    (Default)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\xslfile\shell\Open\command
    (Default)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\zapfile\shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\NOTEPAD.EXE %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\zapfile\shell\print\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\NOTEPAD.EXE /p %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\zapfile\shell\printto\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\notepad.exe /pt "%1" "%2" "%3" "%4"

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\Contacts\Address Book\Protocols\certificate_wab_auto_file\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Mail\wab.exe" /certificate "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\Contacts\Address Book\Protocols\contact_wab_auto_file\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Mail\wab.exe" /contact "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\Contacts\Address Book\Protocols\group_wab_auto_file\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Mail\wab.exe" /Group "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\Contacts\Address Book\Protocols\LDAP\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Mail\wab.exe" "/ldap:%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\Contacts\Address Book\Protocols\vcard_wab_auto_file\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Mail\wab.exe" /vcard "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\Contacts\Address Book\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Mail\wab.exe" /showexisting

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\Mail\Hotmail\Protocols\mailto\shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\rundll32.exe "%ProgramFiles%\Internet Explorer\hmmapi.dll",MailToProtocolHandler %1

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\Mail\Hotmail\shell\open\command
    (Default)    REG_EXPAND_SZ    %systemRoot%\system32\rundll32.exe "%ProgramFiles%\Internet Explorer\hmmapi.dll",OpenInboxHandler

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\Media\Windows Media Player\shell\open\command
    (Default)    REG_EXPAND_SZ    %ProgramFiles(x86)%\Windows Media Player\wmplayer.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\naom\command
    (Default)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" -extoff

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command
    (Default)    REG_SZ    C:\Program Files\Internet Explorer\iexplore.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.AddNetworkLocation\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32 %SystemRoot%\System32\shwebsvc.dll,AddNetPlaceRunDll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.AddPrinter\command
    (Default)    REG_EXPAND_SZ    %systemroot%\system32\rundll32.exe printui.dll,PrintUIEntry /il

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.HistoryVaultRestore\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\FileHistory.exe "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderTypes\{de2b70ec-9bf7-4a93-bd3d-243f7881d492}\TasksItemsSelected\0\{27dfca82-8593-46e4-98d8-23eb83452f65}\shell\InvokeTask\command
    (Default)    REG_EXPAND_SZ    rundll32.exe "%CommonProgramFiles%\System\wab32.dll",ShellUICommand_OnNewEmail %*

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderTypes\{de2b70ec-9bf7-4a93-bd3d-243f7881d492}\TasksItemsSelected\1\{5099caf3-7ab4-4c18-ab35-3f3e664638e4}\shell\InvokeTask\command
    (Default)    REG_EXPAND_SZ    rundll32.exe "%CommonProgramFiles%\System\wab32.dll",ShellUICommand_OnNewContact %*

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderTypes\{de2b70ec-9bf7-4a93-bd3d-243f7881d492}\TasksItemsSelected\2\{da8c976e-ec82-48ad-8ae4-38872e958dc5}\shell\InvokeTask\command
    (Default)    REG_EXPAND_SZ    rundll32.exe "%CommonProgramFiles%\System\wab32.dll",ShellUICommand_OnNewGroup %*

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderTypes\{de2b70ec-9bf7-4a93-bd3d-243f7881d492}\TasksItemsSelected\3\{9d4b9c0a-7b4e-4c0d-926e-a536d781cff6}\shell\InvokeTask\command
    (Default)    REG_EXPAND_SZ    rundll32.exe "%CommonProgramFiles%\System\wab32.dll",ShellUICommand_OnEdit %*

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderTypes\{de2b70ec-9bf7-4a93-bd3d-243f7881d492}\TasksItemsSelected\6\{0b51213d-c59c-4b59-bc10-f27d0b330294}\shell\InvokeTask\command
    (Default)    REG_EXPAND_SZ    rundll32.exe "%CommonProgramFiles%\System\wab32.dll",ShellUICommand_OnImport

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderTypes\{de2b70ec-9bf7-4a93-bd3d-243f7881d492}\TasksItemsSelected\7\{165095b1-322d-47b1-bc9f-2a9234c1c4cb}\shell\InvokeTask\command
    (Default)    REG_EXPAND_SZ    rundll32.exe "%CommonProgramFiles%\System\wab32.dll",ShellUICommand_OnExport

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderTypes\{de2b70ec-9bf7-4a93-bd3d-243f7881d492}\TasksNoItemsSelected\0\{5099caf3-7ab4-4c18-ab35-3f3e664638e4}\shell\InvokeTask\command
    (Default)    REG_EXPAND_SZ    rundll32.exe "%CommonProgramFiles%\System\wab32.dll",ShellUICommand_OnNewContact %*

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderTypes\{de2b70ec-9bf7-4a93-bd3d-243f7881d492}\TasksNoItemsSelected\1\{da8c976e-ec82-48ad-8ae4-38872e958dc5}\shell\InvokeTask\command
    (Default)    REG_EXPAND_SZ    rundll32.exe "%CommonProgramFiles%\System\wab32.dll",ShellUICommand_OnNewGroup %*

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderTypes\{de2b70ec-9bf7-4a93-bd3d-243f7881d492}\TasksNoItemsSelected\2\{0b51213d-c59c-4b59-bc10-f27d0b330294}\shell\InvokeTask\command
    (Default)    REG_EXPAND_SZ    rundll32.exe "%CommonProgramFiles%\System\wab32.dll",ShellUICommand_OnImport

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderTypes\{de2b70ec-9bf7-4a93-bd3d-243f7881d492}\TasksNoItemsSelected\3\{165095b1-322d-47b1-bc9f-2a9234c1c4cb}\shell\InvokeTask\command
    (Default)    REG_EXPAND_SZ    rundll32.exe "%CommonProgramFiles%\System\wab32.dll",ShellUICommand_OnExport

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.AddNetworkLocation\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32 %SystemRoot%\System32\shwebsvc.dll,AddNetPlaceRunDll

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.AddPrinter\command
    (Default)    REG_EXPAND_SZ    %systemroot%\system32\rundll32.exe printui.dll,PrintUIEntry /il

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderTypes\{de2b70ec-9bf7-4a93-bd3d-243f7881d492}\TasksItemsSelected\0\{27dfca82-8593-46e4-98d8-23eb83452f65}\shell\InvokeTask\command
    (Default)    REG_EXPAND_SZ    rundll32.exe "%CommonProgramFiles%\System\wab32.dll",ShellUICommand_OnNewEmail %*

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderTypes\{de2b70ec-9bf7-4a93-bd3d-243f7881d492}\TasksItemsSelected\1\{5099caf3-7ab4-4c18-ab35-3f3e664638e4}\shell\InvokeTask\command
    (Default)    REG_EXPAND_SZ    rundll32.exe "%CommonProgramFiles%\System\wab32.dll",ShellUICommand_OnNewContact %*

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderTypes\{de2b70ec-9bf7-4a93-bd3d-243f7881d492}\TasksItemsSelected\2\{da8c976e-ec82-48ad-8ae4-38872e958dc5}\shell\InvokeTask\command
    (Default)    REG_EXPAND_SZ    rundll32.exe "%CommonProgramFiles%\System\wab32.dll",ShellUICommand_OnNewGroup %*

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderTypes\{de2b70ec-9bf7-4a93-bd3d-243f7881d492}\TasksItemsSelected\3\{9d4b9c0a-7b4e-4c0d-926e-a536d781cff6}\shell\InvokeTask\command
    (Default)    REG_EXPAND_SZ    rundll32.exe "%CommonProgramFiles%\System\wab32.dll",ShellUICommand_OnEdit %*

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderTypes\{de2b70ec-9bf7-4a93-bd3d-243f7881d492}\TasksItemsSelected\6\{0b51213d-c59c-4b59-bc10-f27d0b330294}\shell\InvokeTask\command
    (Default)    REG_EXPAND_SZ    rundll32.exe "%CommonProgramFiles%\System\wab32.dll",ShellUICommand_OnImport

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderTypes\{de2b70ec-9bf7-4a93-bd3d-243f7881d492}\TasksItemsSelected\7\{165095b1-322d-47b1-bc9f-2a9234c1c4cb}\shell\InvokeTask\command
    (Default)    REG_EXPAND_SZ    rundll32.exe "%CommonProgramFiles%\System\wab32.dll",ShellUICommand_OnExport

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderTypes\{de2b70ec-9bf7-4a93-bd3d-243f7881d492}\TasksNoItemsSelected\0\{5099caf3-7ab4-4c18-ab35-3f3e664638e4}\shell\InvokeTask\command
    (Default)    REG_EXPAND_SZ    rundll32.exe "%CommonProgramFiles%\System\wab32.dll",ShellUICommand_OnNewContact %*

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderTypes\{de2b70ec-9bf7-4a93-bd3d-243f7881d492}\TasksNoItemsSelected\1\{da8c976e-ec82-48ad-8ae4-38872e958dc5}\shell\InvokeTask\command
    (Default)    REG_EXPAND_SZ    rundll32.exe "%CommonProgramFiles%\System\wab32.dll",ShellUICommand_OnNewGroup %*

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderTypes\{de2b70ec-9bf7-4a93-bd3d-243f7881d492}\TasksNoItemsSelected\2\{0b51213d-c59c-4b59-bc10-f27d0b330294}\shell\InvokeTask\command
    (Default)    REG_EXPAND_SZ    rundll32.exe "%CommonProgramFiles%\System\wab32.dll",ShellUICommand_OnImport

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderTypes\{de2b70ec-9bf7-4a93-bd3d-243f7881d492}\TasksNoItemsSelected\3\{165095b1-322d-47b1-bc9f-2a9234c1c4cb}\shell\InvokeTask\command
    (Default)    REG_EXPAND_SZ    rundll32.exe "%CommonProgramFiles%\System\wab32.dll",ShellUICommand_OnExport

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Classes\CLSID\{00021400-0000-0000-C000-000000000046}\shell\cmd\command
    (Default)    REG_SZ    cmd.exe /s /k pushd "%V"

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Classes\CLSID\{0AFACED1-E828-11D1-9187-B532F1E9575D}\shell\find\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Classes\CLSID\{0DF44EAA-FF21-4412-828E-260A8728E7F1}\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Options_RunDLL 1

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Classes\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\shell\find\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\shell\find\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\shell\Manage\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\CompMgmtLauncher.exe

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Classes\CLSID\{38A98528-6CBF-4CA9-8DC0-B1E1D10F7B1B}\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    rundll32.exe %SystemRoot%\system32\van.dll,RunVAN

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Classes\CLSID\{38A98528-6CBF-4CA9-8DC0-B1E1D10F7B1B}\Shell\OpenWithoutDiagnostics\Command
    (Default)    REG_EXPAND_SZ    rundll32.exe %SystemRoot%\system32\van.dll,RunVAN /disablediagnostics

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Classes\CLSID\{3f6bc534-dfa1-4ab4-ae54-ef25a74e0107}\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\rstrui.exe

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Classes\CLSID\{40419485-C444-4567-851A-2DD7BFA1684D}\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Control_RunDLL %SystemRoot%\System32\telephon.cpl

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Classes\CLSID\{450D8FBA-AD25-11D0-98A8-0800361B1103}\shell\cmd\command
    (Default)    REG_SZ    cmd.exe /s /k pushd "%V"

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Classes\CLSID\{450D8FBA-AD25-11D0-98A8-0800361B1103}\shell\find\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Classes\CLSID\{48e7caab-b918-4e58-a94d-505519c795dc}\shell\find\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Classes\CLSID\{62D8ED13-C9D0-4CE8-A914-47DD628FB1B0}\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Control_RunDLL %SystemRoot%\System32\intl.cpl

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Classes\CLSID\{6C8EEC18-8D75-41B2-A177-8831D59D2D50}\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Control_RunDLL %SystemRoot%\System32\main.cpl

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Classes\CLSID\{6DFD7C5C-2451-11d3-A299-00C04F8EF6AF}\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Options_RunDLL 0

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Classes\CLSID\{6DFD7C5C-2451-11d3-A299-00C04F8EF6AF}\Shell\RunAs\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Options_RunDLL 0

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Classes\CLSID\{725BE8F7-668E-4C7B-8F90-46BDB0936430}\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Control_RunDLL %SystemRoot%\System32\main.cpl,@1

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Classes\CLSID\{74246bfc-4c96-11d0-abef-0020af6b0b7a}\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\mmc.exe %SystemRoot%\system32\devmgmt.msc

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Classes\CLSID\{74246bfc-4c96-11d0-abef-0020af6b0b7a}\Shell\RunAs\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\mmc.exe %SystemRoot%\system32\devmgmt.msc

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Classes\CLSID\{7A9D77BD-5403-11d2-8785-2E0420524153}\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    netplwiz.exe

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Classes\CLSID\{87D66A43-7B11-4A28-9811-C86EE395ACF7}\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Control_RunDLL %SystemRoot%\System32\srchadmin.dll

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Classes\CLSID\{A3DD4F92-658A-410F-84FD-6FBBBEF2FFFE}\Shell\Open\Command
    (Default)    REG_SZ    C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\shell32.dll,Control_RunDLL C:\Windows\SysWOW64\inetcpl.cpl

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Classes\CLSID\{B2C761C6-29BC-4f19-9251-E6195265BAF1}\Shell\Open\Command
    (Default)    REG_SZ    "C:\Windows\SysWOW64\colorcpl.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Classes\CLSID\{B4FB3F98-C1EA-428d-A78A-D1F5659CBA93}\shell\changehomegroupsettings\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\control.exe /name Microsoft.HomeGroup

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Classes\CLSID\{B4FB3F98-C1EA-428d-A78A-D1F5659CBA93}\shell\sharewithdevices\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\control.exe /name Microsoft.NetworkAndSharingCenter /page ShareMedia

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Classes\CLSID\{B4FB3F98-C1EA-428d-A78A-D1F5659CBA93}\shell\starthomegrouptroubleshooter\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\msdt.exe -id HomegroupDiagnostic

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Classes\CLSID\{B4FB3F98-C1EA-428d-A78A-D1F5659CBA93}\shell\viewhomegrouppassword\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\control.exe /name Microsoft.HomeGroup /page Passkey

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Classes\CLSID\{D17D1D6D-CC3F-4815-8FE3-607E7D5D10B3}\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Control_RunDLL %SystemRoot%\System32\Speech\SpeechUX\sapi.cpl

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Classes\CLSID\{D4480A50-BA28-11d1-8E75-00C04FA31A86}\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    rundll32 %SystemRoot%\System32\shwebsvc.dll,AddNetPlaceRunDll

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Classes\CLSID\{E2E7934B-DCE5-43C4-9576-7FE4F75E7480}\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Control_RunDLL %SystemRoot%\System32\timedate.cpl

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Classes\CLSID\{E44E5D18-0652-4508-A4E2-8A090067BCB0}\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\control.exe /name Microsoft.DefaultPrograms

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Classes\CLSID\{F2DDFC82-8F12-4CDD-B7DC-D4FE1425AA4D}\Shell\Open\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Control_RunDLL %SystemRoot%\System32\mmsys.cpl

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Clients\Contacts\Address Book\Protocols\certificate_wab_auto_file\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Mail\wab.exe" /certificate "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Clients\Contacts\Address Book\Protocols\contact_wab_auto_file\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Mail\wab.exe" /contact "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Clients\Contacts\Address Book\Protocols\group_wab_auto_file\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Mail\wab.exe" /Group "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Clients\Contacts\Address Book\Protocols\LDAP\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Mail\wab.exe" "/ldap:%1"

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Clients\Contacts\Address Book\Protocols\vcard_wab_auto_file\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Mail\wab.exe" /vcard "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Clients\Contacts\Address Book\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Mail\wab.exe" /showexisting

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Clients\Mail\Hotmail\Protocols\mailto\shell\open\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\rundll32.exe "%ProgramFiles%\Internet Explorer\hmmapi.dll",MailToProtocolHandler %1

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Clients\Mail\Hotmail\shell\open\command
    (Default)    REG_EXPAND_SZ    %systemRoot%\system32\rundll32.exe "%ProgramFiles%\Internet Explorer\hmmapi.dll",OpenInboxHandler

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Clients\Media\Windows Media Player\shell\open\command
    (Default)    REG_EXPAND_SZ    %ProgramFiles(x86)%\Windows Media Player\wmplayer.exe

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Clients\StartMenuInternet\IEXPLORE.EXE\shell\naom\command
    (Default)    REG_SZ    "C:\Program Files\Internet Explorer\iexplore.exe" -extoff

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command
    (Default)    REG_SZ    C:\Program Files\Internet Explorer\iexplore.exe

End of search: 587 match(es) found.

Note: only 219 of these 587 command lines comply with Microsoft’s own documentation, while the other 368 command lines show a total number of 573 bugs!

Command lines without a dot, i.e. without any file extension:

FTYPE | FIND.EXE /V "."

batfile="%1" %*
cmdfile="%1" %*
comfile="%1" %*
exefile="%1" %*
MSStorageSense=explorer ms-settings:storagesense
piffile="%1" %*
scrfile="%1" /S

Command lines without a backslash, i.e. without any qualified pathname:

FTYPE | FIND.EXE /V "\"

batfile="%1" %*
brmFile="PrintBrmUI.exe" /import /file:"%1"
cmdfile="%1" %*
comfile="%1" %*
exefile="%1" %*
MSSppLicenseFile="iexplore.exe" "%1"
MSStorageSense=explorer ms-settings:storagesense
piffile="%1" %*
regedit=regedit.exe "%1"
regfile=regedit.exe "%1"
scrfile="%1" /S

Command lines without a (double) quote:

FTYPE | FIND.EXE /V """"

CABFolder=%SystemRoot%\Explorer.exe /idlist,%I,%L
CATFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenCAT %1
CERFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenCER %1
CertificateStoreFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenSTR %1
CompressedFolder=%SystemRoot%\Explorer.exe /idlist,%I,%L
CRLFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenCRL %1
desktopthemepackfile=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\themecpl.dll,OpenThemeAction %1
Explorer.AssocActionId.BurnSelection=%SystemRoot%\explorer.exe
Explorer.AssocActionId.EraseDisc=%SystemRoot%\explorer.exe
Explorer.AssocActionId.ZipSelection=%SystemRoot%\explorer.exe
Explorer.AssocProtocol.search-ms=%SystemRoot%\Explorer.exe /separate,/idlist,%I,%L
Folder=%SystemRoot%\Explorer.exe
hlpfile=%SystemRoot%\winhlp32.exe %1
inffile=%SystemRoot%\system32\NOTEPAD.EXE %1
inifile=%SystemRoot%\system32\NOTEPAD.EXE %1
Microsoft.Workfolders=C:\Windows\System32\control.exe /name Microsoft.WorkFolders
ms-mmsys=%SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Control_RunDLL %SystemRoot%\System32\mmsys.cpl %1
ms-msime-imepad=C:\Windows\System32\IME\SHARED\IMEPADSV.EXE %1
ms-msime-imjpdct=C:\Windows\System32\IME\IMEJP\IMJPDCT.EXE %1
ms-perception-simulation=%SystemRoot%\system32\PerceptionSimulation\PerceptionSimulationInput.exe %1
ms-rdx-document=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\RDXService,OpenRDXDocument %1
MSStorageSense=explorer ms-settings:storagesense
opensearchdescription=%SystemRoot%\explorer.exe
P7RFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenP7R %1
P7SFile=%SystemRoot%\system32\\rundll32.exe cryptext.dll,CryptExtOpenPKCS7 %1
PFXFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenPFX %1
SavedDsQuery=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\dsquery.dll,OpenSavedDsQuery %1
search=%SystemRoot%\Explorer.exe /separate,/idlist,%I,%L
search-ms=%SystemRoot%\Explorer.exe /separate,/idlist,%I,%L
SHCmdFile=%SystemRoot%\explorer.exe
SPCFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenPKCS7 %1
themefile=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\themecpl.dll,OpenThemeAction %1
themepackfile=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\themecpl.dll,OpenThemeAction %1
txtfile=%SystemRoot%\system32\NOTEPAD.EXE %1
wbcatfile=%SystemRoot%\system32\sdclt.exe /restorepage
webpnpFile=%SystemRoot%\system32\wpnpinst.exe %1
zapfile=%SystemRoot%\system32\NOTEPAD.EXE %1

Command lines with an unquoted environment variable in the application’s pathname:

FTYPE | FIND.EXE "=%"

CABFolder=%SystemRoot%\Explorer.exe /idlist,%I,%L
CATFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenCAT %1
CERFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenCER %1
CertificateStoreFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenSTR %1
CompressedFolder=%SystemRoot%\Explorer.exe /idlist,%I,%L
CRLFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenCRL %1
desktopthemepackfile=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\themecpl.dll,OpenThemeAction %1
Diagnostic.Cabinet=%SystemRoot%\system32\msdt.exe /cab "%1"
Diagnostic.Config=%SystemRoot%\system32\msdt.exe /path "%1"
Diagnostic.Document=%SystemRoot%\system32\msdt.exe /path "%1"
Diagnostic.Perfmon.Config=%SystemRoot%\system32\perfmon /sys /load "%1"
Diagnostic.Perfmon.Document=%SystemRoot%\system32\perfmon /sys /open "%1"
Diagnostic.Resmon.Config=%SystemRoot%\system32\perfmon /res /load "%1"
evtfile=%SystemRoot%\system32\eventvwr.exe /l:"%1"
evtxfile=%SystemRoot%\system32\eventvwr.exe /l:"%1"
Explorer.AssocActionId.BurnSelection=%SystemRoot%\explorer.exe
Explorer.AssocActionId.EraseDisc=%SystemRoot%\explorer.exe
Explorer.AssocActionId.ZipSelection=%SystemRoot%\explorer.exe
Explorer.AssocProtocol.search-ms=%SystemRoot%\Explorer.exe /separate,/idlist,%I,%L
Folder=%SystemRoot%\Explorer.exe
hlpfile=%SystemRoot%\winhlp32.exe %1
inffile=%SystemRoot%\system32\NOTEPAD.EXE %1
inifile=%SystemRoot%\system32\NOTEPAD.EXE %1
ms-mmsys=%SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Control_RunDLL %SystemRoot%\System32\mmsys.cpl %1
ms-perception-simulation=%SystemRoot%\system32\PerceptionSimulation\PerceptionSimulationInput.exe %1
ms-rdx-document=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\RDXService,OpenRDXDocument %1
mscfile=%SystemRoot%\system32\mmc.exe "%1" %*
MSInfoFile=%SystemRoot%\system32\msinfo32.exe "%1"
msstylesfile=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,Control_RunDLL %SystemRoot%\system32\desk.cpl desk,@Appearance /Action:OpenMSTheme /file:"%1"
opensearchdescription=%SystemRoot%\explorer.exe
P7RFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenP7R %1
P7SFile=%SystemRoot%\system32\\rundll32.exe cryptext.dll,CryptExtOpenPKCS7 %1
pbkfile=%SystemRoot%\system32\rasphone.exe -f "%1"
PerfFile=%SystemRoot%\system32\mmc.exe %systemroot%\system32\perfmon.msc /F "%1"
PFXFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenPFX %1
PhotoViewer.FileAssoc.Tiff=%SystemRoot%\System32\rundll32.exe "%ProgramFiles%\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen %1
SavedDsQuery=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\dsquery.dll,OpenSavedDsQuery %1
search=%SystemRoot%\Explorer.exe /separate,/idlist,%I,%L
search-ms=%SystemRoot%\Explorer.exe /separate,/idlist,%I,%L
SHCmdFile=%SystemRoot%\explorer.exe
SPCFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenPKCS7 %1
themefile=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\themecpl.dll,OpenThemeAction %1
themepackfile=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\themecpl.dll,OpenThemeAction %1
TIFImage.Document=%SystemRoot%\System32\rundll32.exe "%ProgramFiles%\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen %1
txtfile=%SystemRoot%\system32\NOTEPAD.EXE %1
Undecided=%SystemRoot%\system32\OpenWith.exe "%1"
Unknown=%SystemRoot%\system32\OpenWith.exe "%1"
wbcatfile=%SystemRoot%\system32\sdclt.exe /restorepage
webpnpFile=%SystemRoot%\system32\wpnpinst.exe %1
WindowsStore.License=%SystemRoot%\System32\licensemanagershellext.exe "%1"
zapfile=%SystemRoot%\system32\NOTEPAD.EXE %1

Command lines with an unquoted long argument:

FTYPE | FIND.EXE /I " %L"

IE.AssocFile.URL="C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l
InternetShortcut="C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l
rlogin="C:\Windows\System32\rundll32.exe" "C:\Windows\System32\url.dll",TelnetProtocolHandler %l
telnet="C:\Windows\System32\rundll32.exe" "C:\Windows\System32\url.dll",TelnetProtocolHandler %l
tn3270="C:\Windows\System32\rundll32.exe" "C:\Windows\System32\url.dll",TelnetProtocolHandler %l
WPDContextMenu.Url="%SystemRoot%\System32\rundll32.exe" "%SystemRoot%\System32\ieframe.dll",OpenURL %l

Command lines with an unquoted argument:

FTYPE | FIND.EXE " %1"

Application.Manifest="C:\Windows\System32\rundll32.exe" "C:\Windows\System32\dfshim.dll",ShOpenVerbApplication %1
Application.Reference="C:\Windows\System32\rundll32.exe" "C:\Windows\System32\dfshim.dll",ShOpenVerbShortcut %1|%2
CATFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenCAT %1
CERFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenCER %1
CertificateStoreFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenSTR %1
chm.file="%SystemRoot%\hh.exe" %1
CRLFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenCRL %1
desktopthemepackfile=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\themecpl.dll,OpenThemeAction %1
ftp="C:\Program Files\Internet Explorer\iexplore.exe" %1
giffile="C:\Program Files\Internet Explorer\iexplore.exe" %1
hlpfile=%SystemRoot%\winhlp32.exe %1
htmlfile="C:\Program Files\Internet Explorer\iexplore.exe" %1
http="C:\Program Files\Internet Explorer\iexplore.exe" %1
https="C:\Program Files\Internet Explorer\iexplore.exe" %1
IE.AssocFile.HTM="C:\Program Files\Internet Explorer\iexplore.exe" %1
IE.AssocFile.MHT="C:\Program Files\Internet Explorer\iexplore.exe" %1
IE.AssocFile.PARTIAL="C:\Program Files\Internet Explorer\iexplore.exe" %1
IE.AssocFile.SVG="C:\Program Files\Internet Explorer\iexplore.exe" %1
IE.AssocFile.XHT="C:\Program Files\Internet Explorer\iexplore.exe" %1
IE.FTP="C:\Program Files\Internet Explorer\iexplore.exe" %1
IE.HTTP="C:\Program Files\Internet Explorer\iexplore.exe" %1
IE.HTTPS="C:\Program Files\Internet Explorer\iexplore.exe" %1
inffile=%SystemRoot%\system32\NOTEPAD.EXE %1
inifile=%SystemRoot%\system32\NOTEPAD.EXE %1
mhtmlfile="C:\Program Files\Internet Explorer\iexplore.exe" %1
ms-mmsys=%SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Control_RunDLL %SystemRoot%\System32\mmsys.cpl %1
ms-msdt="%SystemRoot%\system32\msdt.exe" %1
ms-msime-imepad=C:\Windows\System32\IME\SHARED\IMEPADSV.EXE %1
ms-msime-imjpdct=C:\Windows\System32\IME\IMEJP\IMJPDCT.EXE %1
ms-perception-simulation=%SystemRoot%\system32\PerceptionSimulation\PerceptionSimulationInput.exe %1
ms-quick-assist="%SystemRoot%\system32\quickassist.exe" %1
ms-rdx-document=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\RDXService,OpenRDXDocument %1
MSDASC=Rundll32.exe "%CommonProgramFiles%\System\OLE DB\oledb32.dll",OpenDSLFile %1
P7RFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenP7R %1
P7SFile=%SystemRoot%\system32\\rundll32.exe cryptext.dll,CryptExtOpenPKCS7 %1
PFXFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenPFX %1
PhotoViewer.FileAssoc.Tiff=%SystemRoot%\System32\rundll32.exe "%ProgramFiles%\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen %1
prffile="%SystemRoot%\System32\rundll32.exe" "%SystemRoot%\System32\msrating.dll",ClickedOnPRF %1
ratfile="%SystemRoot%\System32\rundll32.exe" "%SystemRoot%\System32\msrating.dll",ClickedOnRAT %1
SavedDsQuery=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\dsquery.dll,OpenSavedDsQuery %1
SPCFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenPKCS7 %1
svgfile="C:\Program Files\Internet Explorer\iexplore.exe" %1
themefile=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\themecpl.dll,OpenThemeAction %1
themepackfile=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\themecpl.dll,OpenThemeAction %1
TIFImage.Document=%SystemRoot%\System32\rundll32.exe "%ProgramFiles%\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen %1
txtfile=%SystemRoot%\system32\NOTEPAD.EXE %1
webpnpFile=%SystemRoot%\system32\wpnpinst.exe %1
xhtmlfile="C:\Program Files\Internet Explorer\iexplore.exe" %1
xmlfile="C:\Program Files\Internet Explorer\iexplore.exe" %1
xslfile="C:\Program Files\Internet Explorer\iexplore.exe" %1
zapfile=%SystemRoot%\system32\NOTEPAD.EXE %1

Command lines with unquoted environment variable(s) in an argument or with unquoted argument(s):

FTYPE | FIND.EXE " %"

Application.Manifest="C:\Windows\System32\rundll32.exe" "C:\Windows\System32\dfshim.dll",ShOpenVerbApplication %1
Application.Reference="C:\Windows\System32\rundll32.exe" "C:\Windows\System32\dfshim.dll",ShOpenVerbShortcut %1|%2
batfile="%1" %*
CATFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenCAT %1
CERFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenCER %1
CertificateStoreFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenSTR %1
chm.file="%SystemRoot%\hh.exe" %1
cmdfile="%1" %*
comfile="%1" %*
CRLFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenCRL %1
desktopthemepackfile=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\themecpl.dll,OpenThemeAction %1
exefile="%1" %*
ftp="C:\Program Files\Internet Explorer\iexplore.exe" %1
giffile="C:\Program Files\Internet Explorer\iexplore.exe" %1
hlpfile=%SystemRoot%\winhlp32.exe %1
htafile=C:\Windows\SysWOW64\mshta.exe "%1" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}%U{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5} %*
htmlfile="C:\Program Files\Internet Explorer\iexplore.exe" %1
http="C:\Program Files\Internet Explorer\iexplore.exe" %1
https="C:\Program Files\Internet Explorer\iexplore.exe" %1
IE.AssocFile.HTM="C:\Program Files\Internet Explorer\iexplore.exe" %1
IE.AssocFile.MHT="C:\Program Files\Internet Explorer\iexplore.exe" %1
IE.AssocFile.PARTIAL="C:\Program Files\Internet Explorer\iexplore.exe" %1
IE.AssocFile.SVG="C:\Program Files\Internet Explorer\iexplore.exe" %1
IE.AssocFile.URL="C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l
IE.AssocFile.WEBSITE="C:\Program Files\Internet Explorer\iexplore.exe" -w "%l" %*
IE.AssocFile.XHT="C:\Program Files\Internet Explorer\iexplore.exe" %1
IE.FTP="C:\Program Files\Internet Explorer\iexplore.exe" %1
IE.HTTP="C:\Program Files\Internet Explorer\iexplore.exe" %1
IE.HTTPS="C:\Program Files\Internet Explorer\iexplore.exe" %1
IMEDictionaryCompiler="%WINDIR%\system32\IME\SHARED\imewdbld.exe" "%1" %*
inffile=%SystemRoot%\system32\NOTEPAD.EXE %1
inifile=%SystemRoot%\system32\NOTEPAD.EXE %1
InternetShortcut="C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l
JSEFile=C:\Windows\System32\WScript.exe "%1" %*
JSFile=C:\Windows\System32\WScript.exe "%1" %*
mhtmlfile="C:\Program Files\Internet Explorer\iexplore.exe" %1
Microsoft.System.Update.1="%systemroot%\system32\wusa.exe" "%1" %*
Microsoft.Website="C:\Program Files\Internet Explorer\iexplore.exe" -w "%l" %*
ms-mmsys=%SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Control_RunDLL %SystemRoot%\System32\mmsys.cpl %1
ms-msdt="%SystemRoot%\system32\msdt.exe" %1
ms-msime-imepad=C:\Windows\System32\IME\SHARED\IMEPADSV.EXE %1
ms-msime-imjpdct=C:\Windows\System32\IME\IMEJP\IMJPDCT.EXE %1
ms-perception-simulation=%SystemRoot%\system32\PerceptionSimulation\PerceptionSimulationInput.exe %1
ms-quick-assist="%SystemRoot%\system32\quickassist.exe" %1
ms-rdx-document=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\RDXService,OpenRDXDocument %1
mscfile=%SystemRoot%\system32\mmc.exe "%1" %*
MSDASC=Rundll32.exe "%CommonProgramFiles%\System\OLE DB\oledb32.dll",OpenDSLFile %1
Msi.Package="%SystemRoot%\System32\msiexec.exe" /i "%1" %*
Msi.Patch="%SystemRoot%\System32\msiexec.exe" /p "%1" %*
msstylesfile=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,Control_RunDLL %SystemRoot%\system32\desk.cpl desk,@Appearance /Action:OpenMSTheme /file:"%1"
P7RFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenP7R %1
P7SFile=%SystemRoot%\system32\\rundll32.exe cryptext.dll,CryptExtOpenPKCS7 %1
PerfFile=%SystemRoot%\system32\mmc.exe %systemroot%\system32\perfmon.msc /F "%1"
PFXFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenPFX %1
PhotoViewer.FileAssoc.Tiff=%SystemRoot%\System32\rundll32.exe "%ProgramFiles%\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen %1
piffile="%1" %*
prffile="%SystemRoot%\System32\rundll32.exe" "%SystemRoot%\System32\msrating.dll",ClickedOnPRF %1
ratfile="%SystemRoot%\System32\rundll32.exe" "%SystemRoot%\System32\msrating.dll",ClickedOnRAT %1
rlogin="C:\Windows\System32\rundll32.exe" "C:\Windows\System32\url.dll",TelnetProtocolHandler %l
SavedDsQuery=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\dsquery.dll,OpenSavedDsQuery %1
SPCFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenPKCS7 %1
svgfile="C:\Program Files\Internet Explorer\iexplore.exe" %1
telnet="C:\Windows\System32\rundll32.exe" "C:\Windows\System32\url.dll",TelnetProtocolHandler %l
themefile=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\themecpl.dll,OpenThemeAction %1
themepackfile=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\themecpl.dll,OpenThemeAction %1
TIFImage.Document=%SystemRoot%\System32\rundll32.exe "%ProgramFiles%\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen %1
tn3270="C:\Windows\System32\rundll32.exe" "C:\Windows\System32\url.dll",TelnetProtocolHandler %l
txtfile=%SystemRoot%\system32\NOTEPAD.EXE %1
VBEFile="%SystemRoot%\System32\WScript.exe" "%1" %*
VBSFile="%SystemRoot%\System32\WScript.exe" "%1" %*
webpnpFile=%SystemRoot%\system32\wpnpinst.exe %1
Windows.XamlDocument="C:\Windows\System32\PresentationHost.exe" "%1" %*
Windows.Xbap="C:\Windows\System32\PresentationHost.exe" "%1" %*
WPDContextMenu.Url="%SystemRoot%\System32\rundll32.exe" "%SystemRoot%\System32\ieframe.dll",OpenURL %l
WSFFile="%SystemRoot%\System32\WScript.exe" "%1" %*
WSHFile="%SystemRoot%\System32\WScript.exe" "%1" %*
xhtmlfile="C:\Program Files\Internet Explorer\iexplore.exe" %1
xmlfile="C:\Program Files\Internet Explorer\iexplore.exe" %1
xslfile="C:\Program Files\Internet Explorer\iexplore.exe" %1
zapfile=%SystemRoot%\system32\NOTEPAD.EXE %1

Command lines containing an environment variable:

SET SLOPPY=APPDATA CommonProgramFiles CommonProgramFiles(x86) CommonProgramW6432 ComSpec LOCALAPPDATA LOGONSERVER ProgramData ProgramFiles ProgramFiles(x86) ProgramW6432 PUBLIC SystemDrive SystemRoot TEMP TMP USERPROFILE WINDIR
FTYPE | FINDSTR.EXE /I "%!SLOPPY: =% %!%"

CABFolder=%SystemRoot%\Explorer.exe /idlist,%I,%L
CATFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenCAT %1
CERFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenCER %1
CertificateStoreFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenSTR %1
certificate_wab_auto_file="%ProgramFiles%\Windows Mail\wab.exe" /certificate "%1"
chm.file="%SystemRoot%\hh.exe" %1
CompressedFolder=%SystemRoot%\Explorer.exe /idlist,%I,%L
contact_wab_auto_file="%ProgramFiles%\Windows Mail\wab.exe" /contact "%1"
CRLFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenCRL %1
desktopthemepackfile=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\themecpl.dll,OpenThemeAction %1
Diagnostic.Cabinet=%SystemRoot%\system32\msdt.exe /cab "%1"
Diagnostic.Config=%SystemRoot%\system32\msdt.exe /path "%1"
Diagnostic.Document=%SystemRoot%\system32\msdt.exe /path "%1"
Diagnostic.Perfmon.Config=%SystemRoot%\system32\perfmon /sys /load "%1"
Diagnostic.Perfmon.Document=%SystemRoot%\system32\perfmon /sys /open "%1"
Diagnostic.Resmon.Config=%SystemRoot%\system32\perfmon /res /load "%1"
docxfile="%ProgramFiles%\Windows NT\Accessories\WORDPAD.EXE" "%1"
emffile="%systemroot%\system32\mspaint.exe" "%1"
evtfile=%SystemRoot%\system32\eventvwr.exe /l:"%1"
evtxfile=%SystemRoot%\system32\eventvwr.exe /l:"%1"
Explorer.AssocActionId.BurnSelection=%SystemRoot%\explorer.exe
Explorer.AssocActionId.EraseDisc=%SystemRoot%\explorer.exe
Explorer.AssocActionId.ZipSelection=%SystemRoot%\explorer.exe
Explorer.AssocProtocol.search-ms=%SystemRoot%\Explorer.exe /separate,/idlist,%I,%L
Folder=%SystemRoot%\Explorer.exe
group_wab_auto_file="%ProgramFiles%\Windows Mail\wab.exe" /Group "%1"
hlpfile=%SystemRoot%\winhlp32.exe %1
IMEDictionaryCompiler="%WINDIR%\system32\IME\SHARED\imewdbld.exe" "%1" %*
imesxfile="%WINDIR%\system32\IME\SHARED\imesearch.exe" "%1"
inffile=%SystemRoot%\system32\NOTEPAD.EXE %1
inifile=%SystemRoot%\system32\NOTEPAD.EXE %1
LDAP="%ProgramFiles%\Windows Mail\wab.exe" "/ldap:%1"
MacromediaFlashPaper.MacromediaFlashPaper="%ProgramFiles%\Internet Explorer\iexplore.exe" "%1"
Microsoft.ProvTool.Provisioning.1="%SystemRoot%\System32\provtool.exe" "%1" /source ShellOpen
Microsoft.System.Update.1="%systemroot%\system32\wusa.exe" "%1" %*
ms-availablenetworks="%SystemRoot%\system32\LaunchWinApp.exe" "%1"
ms-mmsys=%SystemRoot%\System32\rundll32.exe %SystemRoot%\System32\shell32.dll,Control_RunDLL %SystemRoot%\System32\mmsys.cpl %1
ms-msdt="%SystemRoot%\system32\msdt.exe" %1
ms-perception-simulation=%SystemRoot%\system32\PerceptionSimulation\PerceptionSimulationInput.exe %1
ms-quick-assist="%SystemRoot%\system32\quickassist.exe" %1
ms-rdx-document=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\RDXService,OpenRDXDocument %1
ms-settings-connectabledevices="%SystemRoot%\system32\LaunchWinApp.exe" "%1"
ms-settings-displays-topology="%SystemRoot%\system32\LaunchWinApp.exe" "%1"
ms-virtualtouchpad="%SystemRoot%\system32\LaunchWinApp.exe" "%1"
mscfile=%SystemRoot%\system32\mmc.exe "%1" %*
MSDASC=Rundll32.exe "%CommonProgramFiles%\System\OLE DB\oledb32.dll",OpenDSLFile %1
Msi.Package="%SystemRoot%\System32\msiexec.exe" /i "%1" %*
Msi.Patch="%SystemRoot%\System32\msiexec.exe" /p "%1" %*
MSInfoFile=%SystemRoot%\system32\msinfo32.exe "%1"
msstylesfile=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,Control_RunDLL %SystemRoot%\system32\desk.cpl desk,@Appearance /Action:OpenMSTheme /file:"%1"
odtfile="%ProgramFiles%\Windows NT\Accessories\WORDPAD.EXE" "%1"
opensearchdescription=%SystemRoot%\explorer.exe
P7RFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenP7R %1
P7SFile=%SystemRoot%\system32\\rundll32.exe cryptext.dll,CryptExtOpenPKCS7 %1
pbkfile=%SystemRoot%\system32\rasphone.exe -f "%1"
PerfFile=%SystemRoot%\system32\mmc.exe %systemroot%\system32\perfmon.msc /F "%1"
PFXFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenPFX %1
PhotoViewer.FileAssoc.Tiff=%SystemRoot%\System32\rundll32.exe "%ProgramFiles%\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen %1
prffile="%SystemRoot%\System32\rundll32.exe" "%SystemRoot%\System32\msrating.dll",ClickedOnPRF %1
ratfile="%SystemRoot%\System32\rundll32.exe" "%SystemRoot%\System32\msrating.dll",ClickedOnRAT %1
RDP.File="%systemroot%\system32\mstsc.exe" "%1"
RemoteAssistance.1="%systemRoot%\system32\msra.exe" -openfile "%1"
rlefile="%systemroot%\system32\mspaint.exe" "%1"
rtffile="%ProgramFiles%\Windows NT\Accessories\WORDPAD.EXE" "%1"
SavedDsQuery=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\dsquery.dll,OpenSavedDsQuery %1
search=%SystemRoot%\Explorer.exe /separate,/idlist,%I,%L
search-ms=%SystemRoot%\Explorer.exe /separate,/idlist,%I,%L
SHCmdFile=%SystemRoot%\explorer.exe
SPCFile=%SystemRoot%\system32\rundll32.exe cryptext.dll,CryptExtOpenPKCS7 %1
textfile="%ProgramFiles%\Windows NT\Accessories\WORDPAD.EXE" "%1"
themefile=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\themecpl.dll,OpenThemeAction %1
themepackfile=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\themecpl.dll,OpenThemeAction %1
TIFImage.Document=%SystemRoot%\System32\rundll32.exe "%ProgramFiles%\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen %1
txtfile=%SystemRoot%\system32\NOTEPAD.EXE %1
Undecided=%SystemRoot%\system32\OpenWith.exe "%1"
Unknown=%SystemRoot%\system32\OpenWith.exe "%1"
VBEFile="%SystemRoot%\System32\WScript.exe" "%1" %*
VBSFile="%SystemRoot%\System32\WScript.exe" "%1" %*
vcard_wab_auto_file="%ProgramFiles%\Windows Mail\wab.exe" /vcard "%1"
WAB.AssocProtocol.LDAP="%ProgramFiles%\Windows Mail\wab.exe" "/ldap:%1"
wab_auto_file="%ProgramFiles%\Windows Mail\wab.exe" /Import "%1"
wbcatfile=%SystemRoot%\system32\sdclt.exe /restorepage
webpnpFile=%SystemRoot%\system32\wpnpinst.exe %1
Windows.CompositeFont="%SystemRoot%\System32\notepad.exe" "%1"
WindowsStore.License=%SystemRoot%\System32\licensemanagershellext.exe "%1"
wmffile="%systemroot%\system32\mspaint.exe" "%1"
Wordpad.Document.1="%ProgramFiles%\Windows NT\Accessories\WORDPAD.EXE" "%1"
WPDContextMenu.Url="%SystemRoot%\System32\rundll32.exe" "%SystemRoot%\System32\ieframe.dll",OpenURL %l
WSFFile="%SystemRoot%\System32\WScript.exe" "%1" %*
WSHFile="%SystemRoot%\System32\WScript.exe" "%1" %*
zapfile=%SystemRoot%\system32\NOTEPAD.EXE %1

All registered path names containing environment variables:
```
REG.EXE QUERY "HKEY_LOCAL_MACHINE" /D /F "%*^%\\" /S
```

COM classes registered with an unqualified filename or a pathname containing an environment variable:

( REG.EXE QUERY "HKEY_LOCAL_MACHINE\SOFTWARE" /E /F "InProcHandler" /K /S /VE
  REG.EXE QUERY "HKEY_LOCAL_MACHINE\SOFTWARE" /E /F "InProcHandler32" /K /S /VE
  REG.EXE QUERY "HKEY_LOCAL_MACHINE\SOFTWARE" /E /F "InProcServer" /K /S /VE
  REG.EXE QUERY "HKEY_LOCAL_MACHINE\SOFTWARE" /E /F "InProcServer32" /K /S /VE
) | FINDSTR.EXE /B /C:"    (Default)    REG_" 1>"%TMP%\Sloppy.tmp"
FINDSTR.EXE /V "\\" "%TMP%\Sloppy.tmp"
FINDSTR.EXE "%" "%TMP%\Sloppy.tmp"

COM servers registered with an unquoted long pathname containing a space:

( REG.EXE QUERY "HKEY_LOCAL_MACHINE\SOFTWARE" /E /F "LocalServer" /K /S /VE
  REG.EXE QUERY "HKEY_LOCAL_MACHINE\SOFTWARE" /E /F "LocalServer32" /K /S /VE
) | FINDSTR.EXE /B /C:"    (Default)    REG_" 1>"%TMP%\Sloppy.tmp"
FINDSTR.EXE /I /C:"_SZ    %CommonProgram" "%TMP%\Sloppy.tmp"
FINDSTR.EXE /I /C:"_SZ    %Program" "%TMP%\Sloppy.tmp"
FINDSTR.EXE /I /C:"_SZ    %ProgramFiles%" "%TMP%\Sloppy.tmp"

Command lines of services with unquoted long pathnames containing a space:

WMIC.EXE /APPEND:"%USERPROFILE%\Desktop\Sloppy.log" Service WHERE "NOT PathName LIKE '%.%' OR NOT PathName LIKE '%\\%' OR PathName LIKE '%SystemDrive%\\Program %' OR PathName LIKE '%\\Windows %'" GET Name, PathName, StartName

Name           PathName                                                                        StartName
Sense          "C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe"      LocalSystem
WdNisSvc       "C:\ProgramData\Microsoft\Windows Defender\platform\4.18.2004.6-0\NisSrv.exe"   NT AUTHORITY\LocalService
WinDefend      "C:\ProgramData\Microsoft\Windows Defender\platform\4.18.2004.6-0\MsMpEng.exe"  LocalSystem
WMPNetworkSvc  "C:\Program Files\Windows Media Player\wmpnetwk.exe"                            NT AUTHORITY\NetworkService