Registry: Application/Executable Path/Location
Location#1: “HKLMSoftwareMicrosoftWindowsCurrentVersionApp Paths" C:>reg query "HKLMSoftwareMicrosoftWindowsCurrentVersionApp Paths" /s | tail -7 HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionApp PathsWORDPAD.EXE (Default) REG_EXPAND_SZ "%ProgramFiles%Windows NTAccessoriesWORDPAD.EXE" HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionApp PathsWRITE.EXE (Default) REG_EXPAND_SZ "%ProgramFiles%Windows NTAccessoriesWORDPAD.EXE" C:> Location#2: HKCRApplications C:>reg query HKCRApplications /s | tail -15 HKEY_CLASSES_ROOTApplicationswordpad.exeshellopencommand (Default) REG_EXPAND_SZ "%ProgramFiles%Windows NTAccessoriesWORDPAD.EXE" "%1" HKEY_CLASSES_ROOTApplicationswpnpinst.exe NoOpenWith REG_SZ HKEY_CLASSES_ROOTApplicationsWScript.exe NoOpenWith REG_SZ HKEY_CLASSES_ROOTApplicationswusa.exe NoOpenWith REG_SZ HKEY_CLASSES_ROOTApplicationszipfldr.dll NoOpenWith REG_SZ C:>
Read more