These are stored in the registry under “HKLM\SOFTWARE\Wow6432Node\TrendMicro\PC-cillinNTCorp\CurrentVersion\Real Time Scan Configuration”:
"%SYSTEMROOT%\system32\reg.exe" QUERY "HKLM\SOFTWARE\Wow6432Node\TrendMicro\PC-cillinNTCorp\CurrentVersion\Real Time Scan Configuration" /v ExcludedExt "%SYSTEMROOT%\system32\reg.exe" QUERY "HKLM\SOFTWARE\Wow6432Node\TrendMicro\PC-cillinNTCorp\CurrentVersion\Real Time Scan Configuration" /v ExcludedFile "%SYSTEMROOT%\system32\reg.exe" QUERY "HKLM\SOFTWARE\Wow6432Node\TrendMicro\PC-cillinNTCorp\CurrentVersion\Real Time Scan Configuration" /v ExcludedFolder