.@attrc Is a plugin the appropriate tactic to adding shellbag analysis to RegDecoder? Are there any samples? http://www.williballenthin.com/forensics/shellbags/index.html