In addition to checking the value to know if it is disabled, you also have to check the presence of the key to find out if the component has been uninstalled. So... It need to be: Code: reg.exe query "HKLM\SYSTEM\CurrentControlSet\Services\BITS" >nul 2>&1 && ( reg.exe query "HKLM\SYSTEM\CurrentControlSet\Services\BITS" | find /i " Start" | find /i "0x4" >nul && ( start "Downloading !DownloadFileName! file..." /wait /B PowerShell.exe -NoP -C "(New-Object System.Net.WebClient).DownloadFile('!DownloadURI!', '%ROOT%\!DownloadFileName!')" ) || ( :: Preserves Remote Time File Stamp start "Downloading !DownloadFileName! file..." /wait /B PowerShell.exe -NoP -C Start-BitsTransfer -Source "!DownloadURI!" -Destination "%ROOT%\!DownloadFileName!" ) ) || ( start "Downloading !DownloadFileName! file..." /wait /B PowerShell.exe -NoP -C "(New-Object System.Net.WebClient).DownloadFile('!DownloadURI!', '%ROOT%\!DownloadFileName!')" ) I learned a lot in these details, I checked here the information obtained by the "sc.exe query" command and it really does not bring the right information for disabled services and the services standing in manual or automatic mode. find /i " Start" or findstr /i /c:" Start" Nneed to be with that space before Start. Otherwise you find DelayedAutostart too. Thanks, @Dark Dinosaur! Cheers!
Thanks. I'll keep it simple and just stick with this script (corrected in the OP) https://forums.mydigitallife.net/th...r-from-context-menu.80713/page-2#post-1733337
What a crap... My mistake... The correct is: del /q /f /f Force /q Silent Mode /s Delete specified files from all subdireories. Sorry. Glad you put it correctly in the main post. But you did not put the WorkingDir fix, which avoids that problem you gave before adding "cd /d %~dp0" to the script that imports your *.reg files. from: Code: reg add "HKCR\*\shell\Run as TrustedInstaller\command" /v "" /t REG_SZ /d "PowerRun.exe \"%%1\"" /f >NUL to: Code: reg.exe add "HKCR\*\shell\Run as TrustedInstaller\command" /v "" /t REG_EXPAND_SZ /d "cmd.exe /X /D /U /R for %%%%# in (\"%%1\") do PowerRun.exe /WD:\"%%%%~dp#\" \"%%1\"" /f >nul 2>&1
Hey, man! @freddie-o, I managed to fix Native "Run As Administrator" for BAT and CMD script files. Code: rem Fix Native "Run As Administrator" for BAT and CMD script files. reg.exe add "HKCR\batfile\shell\runas\command" /ve /t REG_EXPAND_SZ /d "\"%%SystemROOT%%\System32\cmd.exe\" /X /R \"for %%%%# in (\"%%1\") do (PushD \"%%%%~dp#\" && Start \"%%%%~nx#\" /I \"%%%%~f#\" %%*)\"" /f >nul 2>&1 reg.exe add "HKCR\cmdfile\shell\runas\command" /ve /t REG_EXPAND_SZ /d "\"%%SystemROOT%%\System32\cmd.exe\" /X /R \"for %%%%# in (\"%%1\") do (PushD \"%%%%~dp#\" && Start \"%%%%~nx#\" /I \"%%%%~f#\" %%*)\"" /f >nul 2>&1 reg.exe add "HKLM\SOFTWARE\Classes\batfile\shell\runas\command" /ve /t REG_EXPAND_SZ /d "\"%%SystemROOT%%\System32\cmd.exe\" /X /R \"for %%%%# in (\"%%1\") do (PushD \"%%%%~dp#\" && Start \"%%%%~nx#\" /I \"%%%%~f#\" %%*)\"" /f >nul 2>&1 reg.exe add "HKLM\SOFTWARE\Classes\cmdfile\shell\runas\command" /ve /t REG_EXPAND_SZ /d "\"%%SystemROOT%%\System32\cmd.exe\" /X /R \"for %%%%# in (\"%%1\") do (PushD \"%%%%~dp#\" && Start \"%%%%~nx#\" /I \"%%%%~f#\" %%*)\"" /f >nul 2>&1 NOTE: This code was broken after conversion with "RegConvert_v1.2". It will remain here in a didactic way for comparison with the manualy corrected code posted below.
Did you test it First I got this Then it broke "Run as administrator" Not that I need it... I am always the Administrator I just merged back the exported batfile and cmdfile keys
Yes it is working here. UAC enabled here. And working with your testing script. In conversion with "RegConvert_v1.2" something broke. Code: reg.exe add "HKCR\batfile\shell\runas\command" /ve /t REG_EXPAND_SZ /d "\"%%SystemROOT%%\System32\cmd.exe\" /X /R for %%%%# in (\"%%1\") do (PushD \"%%%%~dp#\" && Start \"%%%%~nx#\" /I \"%%%%~f#\" %%*)" /f >nul 2>&1 reg.exe add "HKCR\cmdfile\shell\runas\command" /ve /t REG_EXPAND_SZ /d "\"%%SystemROOT%%\System32\cmd.exe\" /X /R for %%%%# in (\"%%1\") do (PushD \"%%%%~dp#\" && Start \"%%%%~nx#\" /I \"%%%%~f#\" %%*)" /f >nul 2>&1 reg.exe add "HKLM\SOFTWARE\Classes\batfile\shell\runas\command" /ve /t REG_EXPAND_SZ /d "\"%%SystemROOT%%\System32\cmd.exe\" /X /R for %%%%# in (\"%%1\") do (PushD \"%%%%~dp#\" && Start \"%%%%~nx#\" /I \"%%%%~f#\" %%*)" /f >nul 2>&1 reg.exe add "HKLM\SOFTWARE\Classes\cmdfile\shell\runas\command" /ve /t REG_EXPAND_SZ /d "\"%%SystemROOT%%\System32\cmd.exe\" /X /R for %%%%# in (\"%%1\") do (PushD \"%%%%~dp#\" && Start \"%%%%~nx#\" /I \"%%%%~f#\" %%*)" /f >nul 2>&1 Compare with what I sent before. Folow de registry entries. Code: Windows Registry Editor Version 5.00 [HKEY_CLASSES_ROOT\batfile\shell\runas\command] @=hex(2):22,00,25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,4f,00,4f,00,54,\ 00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,63,00,\ 6d,00,64,00,2e,00,65,00,78,00,65,00,22,00,20,00,2f,00,58,00,20,00,2f,00,52,\ 00,20,00,66,00,6f,00,72,00,20,00,25,00,25,00,23,00,20,00,69,00,6e,00,20,00,\ 28,00,22,00,25,00,31,00,22,00,29,00,20,00,64,00,6f,00,20,00,28,00,50,00,75,\ 00,73,00,68,00,44,00,20,00,22,00,25,00,25,00,7e,00,64,00,70,00,23,00,22,00,\ 20,00,26,00,26,00,20,00,53,00,74,00,61,00,72,00,74,00,20,00,22,00,25,00,25,\ 00,7e,00,6e,00,78,00,23,00,22,00,20,00,2f,00,49,00,20,00,22,00,25,00,25,00,\ 7e,00,66,00,23,00,22,00,20,00,25,00,2a,00,29,00,00,00 [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\batfile\shell\runas\command] @=hex(2):22,00,25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,4f,00,4f,00,54,\ 00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,63,00,\ 6d,00,64,00,2e,00,65,00,78,00,65,00,22,00,20,00,2f,00,58,00,20,00,2f,00,52,\ 00,20,00,66,00,6f,00,72,00,20,00,25,00,25,00,23,00,20,00,69,00,6e,00,20,00,\ 28,00,22,00,25,00,31,00,22,00,29,00,20,00,64,00,6f,00,20,00,28,00,50,00,75,\ 00,73,00,68,00,44,00,20,00,22,00,25,00,25,00,7e,00,64,00,70,00,23,00,22,00,\ 20,00,26,00,26,00,20,00,53,00,74,00,61,00,72,00,74,00,20,00,22,00,25,00,25,\ 00,7e,00,6e,00,78,00,23,00,22,00,20,00,2f,00,49,00,20,00,22,00,25,00,25,00,\ 7e,00,66,00,23,00,22,00,20,00,25,00,2a,00,29,00,00,00 [HKEY_CLASSES_ROOT\cmdfile\shell\runas\command] @=hex(2):22,00,25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,4f,00,4f,00,54,\ 00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,63,00,\ 6d,00,64,00,2e,00,65,00,78,00,65,00,22,00,20,00,2f,00,58,00,20,00,2f,00,52,\ 00,20,00,66,00,6f,00,72,00,20,00,25,00,25,00,23,00,20,00,69,00,6e,00,20,00,\ 28,00,22,00,25,00,31,00,22,00,29,00,20,00,64,00,6f,00,20,00,28,00,50,00,75,\ 00,73,00,68,00,44,00,20,00,22,00,25,00,25,00,7e,00,64,00,70,00,23,00,22,00,\ 20,00,26,00,26,00,20,00,53,00,74,00,61,00,72,00,74,00,20,00,22,00,25,00,25,\ 00,7e,00,6e,00,78,00,23,00,22,00,20,00,2f,00,49,00,20,00,22,00,25,00,25,00,\ 7e,00,66,00,23,00,22,00,20,00,25,00,2a,00,29,00,00,00 [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\cmdfile\shell\runas\command] @=hex(2):22,00,25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,4f,00,4f,00,54,\ 00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,63,00,\ 6d,00,64,00,2e,00,65,00,78,00,65,00,22,00,20,00,2f,00,58,00,20,00,2f,00,52,\ 00,20,00,66,00,6f,00,72,00,20,00,25,00,25,00,23,00,20,00,69,00,6e,00,20,00,\ 28,00,22,00,25,00,31,00,22,00,29,00,20,00,64,00,6f,00,20,00,28,00,50,00,75,\ 00,73,00,68,00,44,00,20,00,22,00,25,00,25,00,7e,00,64,00,70,00,23,00,22,00,\ 20,00,26,00,26,00,20,00,53,00,74,00,61,00,72,00,74,00,20,00,22,00,25,00,25,\ 00,7e,00,6e,00,78,00,23,00,22,00,20,00,2f,00,49,00,20,00,22,00,25,00,25,00,\ 7e,00,66,00,23,00,22,00,20,00,25,00,2a,00,29,00,00,00 And direct in regedit value: Code: "%SystemROOT%\System32\cmd.exe" /X /R for %%# in ("%1") do (PushD "%%~dp#" && Start "%%~nx#" /I "%%~f#" %*) @Dark Dinosaur, the fix of the fix, hehehehe Sorry for the inconvenience, hehehehe
OP by @inTerActionVRI https://forums.mydigitallife.net/th...r-from-context-menu.80713/page-3#post-1741952 Run as administrator FIX.cmd Added "cplfile" "exefile" "mscfile" "Microsoft.PowerShellScript.1" and "regfile" Code: @echo off reg delete "HKCR\batfile\shell\runas\command" /f 2>nul reg delete "HKCR\cmdfile\shell\runas\command" /f 2>nul reg delete "HKCR\cplfile\shell\runas\command" /f 2>nul reg delete "HKCR\exefile\shell\runas\command" /f 2>nul reg delete "HKCR\Microsoft.PowerShellScript.1\shell\runas\command" /f 2>nul reg delete "HKCR\mscfile\shell\runas\command" /f 2>nul reg delete "HKCR\regfile\shell\runas\command" /f 2>nul reg delete "HKLM\SOFTWARE\Classes\batfile\shell\runas\command" /f 2>nul reg delete "HKLM\SOFTWARE\Classes\cmdfile\shell\runas\command" /f 2>nul reg delete "HKLM\SOFTWARE\Classes\cplfile\shell\runas\command" /f 2>nul reg delete "HKLM\SOFTWARE\Classes\exefile\shell\runas\command" /f 2>nul reg delete "HKLM\SOFTWARE\Classes\Microsoft.PowerShellScript.1\shell\runas\command" /f 2>nul reg delete "HKLM\SOFTWARE\Classes\mscfile\shell\runas\command" /f 2>nul reg delete "HKLM\SOFTWARE\Classes\regfile\shell\runas\command" /f 2>nul reg add "HKCR\batfile\shell\runas\command" /ve /t REG_EXPAND_SZ /d "\"%%SystemROOT%%\System32\cmd\" /X /R for %%%%# in (\"%%1\") do (PushD \"%%%%~dp#\" && Start \"%%%%~nx#\" /I \"%%%%~f#\" %%*)" /f >nul 2>&1 reg add "HKCR\cmdfile\shell\runas\command" /ve /t REG_EXPAND_SZ /d "\"%%SystemROOT%%\System32\cmd\" /X /R for %%%%# in (\"%%1\") do (PushD \"%%%%~dp#\" && Start \"%%%%~nx#\" /I \"%%%%~f#\" %%*)" /f >nul 2>&1 reg add "HKCR\cplfile\shell\runas\command" /ve /t REG_EXPAND_SZ /d "\"%%SystemROOT%%\System32\cmd\" /X /R for %%%%# in (\"%%1\") do (PushD \"%%%%~dp#\" && Start \"%%%%~nx#\" /I \"%%%%~f#\" %%*)" /f >nul 2>&1 reg add "HKCR\exefile\shell\runas\command" /ve /t REG_EXPAND_SZ /d "\"%%SystemROOT%%\System32\cmd\" /X /R for %%%%# in (\"%%1\") do (PushD \"%%%%~dp#\" && Start \"%%%%~nx#\" /I \"%%%%~f#\" %%*)" /f >nul 2>&1 reg add "HKCR\Microsoft.PowerShellScript.1\shell\runas\command" /ve /t REG_EXPAND_SZ /d "\"%%SystemROOT%%\System32\cmd\" /X /R for %%%%# in (\"%%1\") do (PushD \"%%%%~dp#\" && Start \"%%%%~nx#\" /I \"%%%%~f#\" %%*)" /f >nul 2>&1 reg add "HKCR\mscfile\shell\runas\command" /ve /t REG_EXPAND_SZ /d "\"%%SystemROOT%%\System32\cmd\" /X /R for %%%%# in (\"%%1\") do (PushD \"%%%%~dp#\" && Start \"%%%%~nx#\" /I \"%%%%~f#\" %%*)" /f >nul 2>&1 reg add "HKCR\regfile\shell\runas\command" /ve /t REG_EXPAND_SZ /d "\"%%SystemROOT%%\System32\cmd\" /X /R for %%%%# in (\"%%1\") do (PushD \"%%%%~dp#\" && Start \"%%%%~nx#\" /I \"%%%%~f#\" %%*)" /f >nul 2>&1 reg add "HKLM\SOFTWARE\Classes\batfile\shell\runas\command" /ve /t REG_EXPAND_SZ /d "\"%%SystemROOT%%\System32\cmd\" /X /R for %%%%# in (\"%%1\") do (PushD \"%%%%~dp#\" && Start \"%%%%~nx#\" /I \"%%%%~f#\" %%*)" /f >nul 2>&1 reg add "HKLM\SOFTWARE\Classes\cmdfile\shell\runas\command" /ve /t REG_EXPAND_SZ /d "\"%%SystemROOT%%\System32\cmd\" /X /R for %%%%# in (\"%%1\") do (PushD \"%%%%~dp#\" && Start \"%%%%~nx#\" /I \"%%%%~f#\" %%*)" /f >nul 2>&1 reg add "HKLM\SOFTWARE\Classes\cplfile\shell\runas\command" /ve /t REG_EXPAND_SZ /d "\"%%SystemROOT%%\System32\cmd\" /X /R for %%%%# in (\"%%1\") do (PushD \"%%%%~dp#\" && Start \"%%%%~nx#\" /I \"%%%%~f#\" %%*)" /f >nul 2>&1 reg add "HKLM\SOFTWARE\Classes\exefile\shell\runas\command" /ve /t REG_EXPAND_SZ /d "\"%%SystemROOT%%\System32\cmd\" /X /R for %%%%# in (\"%%1\") do (PushD \"%%%%~dp#\" && Start \"%%%%~nx#\" /I \"%%%%~f#\" %%*)" /f >nul 2>&1 reg add "HKLM\SOFTWARE\Classes\Microsoft.PowerShellScript.1\shell\runas\command" /ve /t REG_EXPAND_SZ /d "\"%%SystemROOT%%\System32\cmd\" /X /R for %%%%# in (\"%%1\") do (PushD \"%%%%~dp#\" && Start \"%%%%~nx#\" /I \"%%%%~f#\" %%*)" /f >nul 2>&1 reg add "HKLM\SOFTWARE\Classes\mscfile\shell\runas\command" /ve /t REG_EXPAND_SZ /d "\"%%SystemROOT%%\System32\cmd\" /X /R for %%%%# in (\"%%1\") do (PushD \"%%%%~dp#\" && Start \"%%%%~nx#\" /I \"%%%%~f#\" %%*)" /f >nul 2>&1 reg add "HKLM\SOFTWARE\Classes\regfile\shell\runas\command" /ve /t REG_EXPAND_SZ /d "\"%%SystemROOT%%\System32\cmd\" /X /R for %%%%# in (\"%%1\") do (PushD \"%%%%~dp#\" && Start \"%%%%~nx#\" /I \"%%%%~f#\" %%*)" /f >nul 2>&1 pause
You liked my post. Then I called because I thought you had used the script that was broken. So you could use the corrected code there.
end up building something else ( not to step up someone else great work .. like to do things in a different way ) Code: Windows Registry Editor Version 5.00 [HKEY_CLASSES_ROOT\lnkfile\shell\RunAsTI] @="Run As TrustedInstaller" "HasLUAShield"="" "Position"="Bottom" "SeparatorBefore"="" [HKEY_CLASSES_ROOT\lnkfile\shell\RunAsTI\command] @="c:\\windows\\NSudoLC.exe -U:T -P:E cmd /c start \"%1\"" [HKEY_CLASSES_ROOT\lnkfile\shell\RunAsTI_x64] @="Run As TrustedInstaller x64" "HasLUAShield"="" "Position"="Bottom" "SeparatorAfter"="" [HKEY_CLASSES_ROOT\lnkfile\shell\RunAsTI_x64\command] @="\"c:\\windows\\NSudoLC x64.exe\" -U:T -P:E cmd /c start \"%1\"" [HKEY_CLASSES_ROOT\regfile\shell\RunAsTI] @="Run As TrustedInstaller" "HasLUAShield"="" "Position"="Bottom" "SeparatorBefore"="" [HKEY_CLASSES_ROOT\regfile\shell\RunAsTI\command] @="c:\\windows\\NSudoLC.exe -U:T -P:E regedit.exe \"%1\"" [HKEY_CLASSES_ROOT\regfile\shell\RunAsTI_x64] @="Run As TrustedInstaller x64" "HasLUAShield"="" "Position"="Bottom" "SeparatorAfter"="" [HKEY_CLASSES_ROOT\regfile\shell\RunAsTI_x64\command] @="\"c:\\windows\\NSudoLC x64.exe\" -U:T -P:E regedit.exe \"%1\"" [HKEY_CLASSES_ROOT\exefile\shell\RunAsTI] @="Run As TrustedInstaller" "HasLUAShield"="" "Position"="Bottom" "SeparatorBefore"="" [HKEY_CLASSES_ROOT\exefile\shell\RunAsTI\command] @="c:\\windows\\NSudoLC.exe -U:T -P:E \"%1\"" [HKEY_CLASSES_ROOT\exefile\shell\RunAsTI_x64] @="Run As TrustedInstaller x64" "HasLUAShield"="" "Position"="Bottom" "SeparatorAfter"="" [HKEY_CLASSES_ROOT\exefile\shell\RunAsTI_x64\command] @="\"c:\\windows\\NSudoLC x64.exe\" -U:T -P:E \"%1\"" [HKEY_CLASSES_ROOT\cmdfile\shell\RunAsTI] @="Run As TrustedInstaller" "HasLUAShield"="" "Position"="Bottom" "SeparatorBefore"="" [HKEY_CLASSES_ROOT\cmdfile\shell\RunAsTI\command] @="c:\\windows\\NSudoLC.exe -U:T -P:E \"%1\"" [HKEY_CLASSES_ROOT\cmdfile\shell\RunAsTI_x64] @="Run As TrustedInstaller x64" "HasLUAShield"="" "Position"="Bottom" "SeparatorAfter"="" [HKEY_CLASSES_ROOT\cmdfile\shell\RunAsTI_x64\command] @="\"c:\\windows\\NSudoLC x64.exe\" -U:T -P:E \"%1\"" [HKEY_CLASSES_ROOT\batfile\shell\RunAsTI] @="Run As TrustedInstaller" "HasLUAShield"="" "Position"="Bottom" "SeparatorBefore"="" [HKEY_CLASSES_ROOT\batfile\shell\RunAsTI\command] @="c:\\windows\\NSudoLC.exe -U:T -P:E \"%1\"" [HKEY_CLASSES_ROOT\batfile\shell\RunAsTI_x64] @="Run As TrustedInstaller x64" "HasLUAShield"="" "Position"="Bottom" "SeparatorAfter"="" [HKEY_CLASSES_ROOT\batfile\shell\RunAsTI_x64\command] @="\"c:\\windows\\NSudoLC x64.exe\" -U:T -P:E \"%1\""
Hello @freddie-o I used your Batch Script, but it only runs with System permissions instead of TrustedInstaller, what happened? And how to fix it? Windows version 22H2
Ive added but when execute a bat file or exe file, is not launched with admin privileges, as a single user seems... i.imgur.com/8SrOa86.png or i.imgur.com/ereWNZ8.png
No problem on my end. Spoiler Standard user Run as administrator Standard user Run as administrator This is my Registry Spoiler
ok thanks weird ;( possible to share you reg file? will import for see if something is wrong... thanks
I used the batch script https://forums.mydigitallife.net/th...r-from-context-menu.80713/page-3#post-1741960 I don't know why your reg entry looks different. Maybe it didn't add properly
Here's the REG file Run as administrator FIX.reg Code: Windows Registry Editor Version 5.00 [-HKEY_CLASSES_ROOT\batfile\shell\runas\command] [-HKEY_CLASSES_ROOT\cmdfile\shell\runas\command] [-HKEY_CLASSES_ROOT\cplfile\shell\runas\command] [-HKEY_CLASSES_ROOT\exefile\shell\runas\command] [-HKEY_CLASSES_ROOT\mscfile\shell\RunAs\command] [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\batfile\shell\runas\command] [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\cmdfile\shell\runas\command] [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\cplfile\shell\runas\command] [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\shell\runas\command] [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\mscfile\shell\RunAs\command] [HKEY_CLASSES_ROOT\batfile\shell\runas\command] @=hex(2):22,00,25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,4f,00,4f,00,54,\ 00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,63,00,\ 6d,00,64,00,2e,00,65,00,78,00,65,00,22,00,20,00,2f,00,58,00,20,00,2f,00,52,\ 00,20,00,66,00,6f,00,72,00,20,00,25,00,25,00,23,00,20,00,69,00,6e,00,20,00,\ 28,00,22,00,25,00,31,00,22,00,29,00,20,00,64,00,6f,00,20,00,28,00,50,00,75,\ 00,73,00,68,00,44,00,20,00,22,00,25,00,25,00,7e,00,64,00,70,00,23,00,22,00,\ 20,00,26,00,26,00,20,00,53,00,74,00,61,00,72,00,74,00,20,00,22,00,25,00,25,\ 00,7e,00,6e,00,78,00,23,00,22,00,20,00,2f,00,49,00,20,00,22,00,25,00,25,00,\ 7e,00,66,00,23,00,22,00,20,00,25,00,2a,00,29,00,00,00 [HKEY_CLASSES_ROOT\cmdfile\shell\runas\command] @=hex(2):22,00,25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,4f,00,4f,00,54,\ 00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,63,00,\ 6d,00,64,00,2e,00,65,00,78,00,65,00,22,00,20,00,2f,00,58,00,20,00,2f,00,52,\ 00,20,00,66,00,6f,00,72,00,20,00,25,00,25,00,23,00,20,00,69,00,6e,00,20,00,\ 28,00,22,00,25,00,31,00,22,00,29,00,20,00,64,00,6f,00,20,00,28,00,50,00,75,\ 00,73,00,68,00,44,00,20,00,22,00,25,00,25,00,7e,00,64,00,70,00,23,00,22,00,\ 20,00,26,00,26,00,20,00,53,00,74,00,61,00,72,00,74,00,20,00,22,00,25,00,25,\ 00,7e,00,6e,00,78,00,23,00,22,00,20,00,2f,00,49,00,20,00,22,00,25,00,25,00,\ 7e,00,66,00,23,00,22,00,20,00,25,00,2a,00,29,00,00,00 [HKEY_CLASSES_ROOT\cplfile\shell\runas\command] @=hex(2):22,00,25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,4f,00,4f,00,54,\ 00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,63,00,\ 6d,00,64,00,2e,00,65,00,78,00,65,00,22,00,20,00,2f,00,58,00,20,00,2f,00,52,\ 00,20,00,66,00,6f,00,72,00,20,00,25,00,25,00,23,00,20,00,69,00,6e,00,20,00,\ 28,00,22,00,25,00,31,00,22,00,29,00,20,00,64,00,6f,00,20,00,28,00,50,00,75,\ 00,73,00,68,00,44,00,20,00,22,00,25,00,25,00,7e,00,64,00,70,00,23,00,22,00,\ 20,00,26,00,26,00,20,00,53,00,74,00,61,00,72,00,74,00,20,00,22,00,25,00,25,\ 00,7e,00,6e,00,78,00,23,00,22,00,20,00,2f,00,49,00,20,00,22,00,25,00,25,00,\ 7e,00,66,00,23,00,22,00,20,00,25,00,2a,00,29,00,00,00 [HKEY_CLASSES_ROOT\exefile\shell\runas\command] @=hex(2):22,00,25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,4f,00,4f,00,54,\ 00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,63,00,\ 6d,00,64,00,2e,00,65,00,78,00,65,00,22,00,20,00,2f,00,58,00,20,00,2f,00,52,\ 00,20,00,66,00,6f,00,72,00,20,00,25,00,25,00,23,00,20,00,69,00,6e,00,20,00,\ 28,00,22,00,25,00,31,00,22,00,29,00,20,00,64,00,6f,00,20,00,28,00,50,00,75,\ 00,73,00,68,00,44,00,20,00,22,00,25,00,25,00,7e,00,64,00,70,00,23,00,22,00,\ 20,00,26,00,26,00,20,00,53,00,74,00,61,00,72,00,74,00,20,00,22,00,25,00,25,\ 00,7e,00,6e,00,78,00,23,00,22,00,20,00,2f,00,49,00,20,00,22,00,25,00,25,00,\ 7e,00,66,00,23,00,22,00,20,00,25,00,2a,00,29,00,00,00 [HKEY_CLASSES_ROOT\mscfile\shell\RunAs\command] @=hex(2):22,00,25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,4f,00,4f,00,54,\ 00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,63,00,\ 6d,00,64,00,2e,00,65,00,78,00,65,00,22,00,20,00,2f,00,58,00,20,00,2f,00,52,\ 00,20,00,66,00,6f,00,72,00,20,00,25,00,25,00,23,00,20,00,69,00,6e,00,20,00,\ 28,00,22,00,25,00,31,00,22,00,29,00,20,00,64,00,6f,00,20,00,28,00,50,00,75,\ 00,73,00,68,00,44,00,20,00,22,00,25,00,25,00,7e,00,64,00,70,00,23,00,22,00,\ 20,00,26,00,26,00,20,00,53,00,74,00,61,00,72,00,74,00,20,00,22,00,25,00,25,\ 00,7e,00,6e,00,78,00,23,00,22,00,20,00,2f,00,49,00,20,00,22,00,25,00,25,00,\ 7e,00,66,00,23,00,22,00,20,00,25,00,2a,00,29,00,00,00 [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\batfile\shell\runas\command] @=hex(2):22,00,25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,4f,00,4f,00,54,\ 00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,63,00,\ 6d,00,64,00,2e,00,65,00,78,00,65,00,22,00,20,00,2f,00,58,00,20,00,2f,00,52,\ 00,20,00,66,00,6f,00,72,00,20,00,25,00,25,00,23,00,20,00,69,00,6e,00,20,00,\ 28,00,22,00,25,00,31,00,22,00,29,00,20,00,64,00,6f,00,20,00,28,00,50,00,75,\ 00,73,00,68,00,44,00,20,00,22,00,25,00,25,00,7e,00,64,00,70,00,23,00,22,00,\ 20,00,26,00,26,00,20,00,53,00,74,00,61,00,72,00,74,00,20,00,22,00,25,00,25,\ 00,7e,00,6e,00,78,00,23,00,22,00,20,00,2f,00,49,00,20,00,22,00,25,00,25,00,\ 7e,00,66,00,23,00,22,00,20,00,25,00,2a,00,29,00,00,00 [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\cmdfile\shell\runas\command] @=hex(2):22,00,25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,4f,00,4f,00,54,\ 00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,63,00,\ 6d,00,64,00,2e,00,65,00,78,00,65,00,22,00,20,00,2f,00,58,00,20,00,2f,00,52,\ 00,20,00,66,00,6f,00,72,00,20,00,25,00,25,00,23,00,20,00,69,00,6e,00,20,00,\ 28,00,22,00,25,00,31,00,22,00,29,00,20,00,64,00,6f,00,20,00,28,00,50,00,75,\ 00,73,00,68,00,44,00,20,00,22,00,25,00,25,00,7e,00,64,00,70,00,23,00,22,00,\ 20,00,26,00,26,00,20,00,53,00,74,00,61,00,72,00,74,00,20,00,22,00,25,00,25,\ 00,7e,00,6e,00,78,00,23,00,22,00,20,00,2f,00,49,00,20,00,22,00,25,00,25,00,\ 7e,00,66,00,23,00,22,00,20,00,25,00,2a,00,29,00,00,00 [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\cplfile\shell\runas\command] @=hex(2):22,00,25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,4f,00,4f,00,54,\ 00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,63,00,\ 6d,00,64,00,2e,00,65,00,78,00,65,00,22,00,20,00,2f,00,58,00,20,00,2f,00,52,\ 00,20,00,66,00,6f,00,72,00,20,00,25,00,25,00,23,00,20,00,69,00,6e,00,20,00,\ 28,00,22,00,25,00,31,00,22,00,29,00,20,00,64,00,6f,00,20,00,28,00,50,00,75,\ 00,73,00,68,00,44,00,20,00,22,00,25,00,25,00,7e,00,64,00,70,00,23,00,22,00,\ 20,00,26,00,26,00,20,00,53,00,74,00,61,00,72,00,74,00,20,00,22,00,25,00,25,\ 00,7e,00,6e,00,78,00,23,00,22,00,20,00,2f,00,49,00,20,00,22,00,25,00,25,00,\ 7e,00,66,00,23,00,22,00,20,00,25,00,2a,00,29,00,00,00 [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\shell\runas\command] @=hex(2):22,00,25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,4f,00,4f,00,54,\ 00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,63,00,\ 6d,00,64,00,2e,00,65,00,78,00,65,00,22,00,20,00,2f,00,58,00,20,00,2f,00,52,\ 00,20,00,66,00,6f,00,72,00,20,00,25,00,25,00,23,00,20,00,69,00,6e,00,20,00,\ 28,00,22,00,25,00,31,00,22,00,29,00,20,00,64,00,6f,00,20,00,28,00,50,00,75,\ 00,73,00,68,00,44,00,20,00,22,00,25,00,25,00,7e,00,64,00,70,00,23,00,22,00,\ 20,00,26,00,26,00,20,00,53,00,74,00,61,00,72,00,74,00,20,00,22,00,25,00,25,\ 00,7e,00,6e,00,78,00,23,00,22,00,20,00,2f,00,49,00,20,00,22,00,25,00,25,00,\ 7e,00,66,00,23,00,22,00,20,00,25,00,2a,00,29,00,00,00 [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\mscfile\shell\RunAs\command] @=hex(2):22,00,25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,4f,00,4f,00,54,\ 00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,63,00,\ 6d,00,64,00,2e,00,65,00,78,00,65,00,22,00,20,00,2f,00,58,00,20,00,2f,00,52,\ 00,20,00,66,00,6f,00,72,00,20,00,25,00,25,00,23,00,20,00,69,00,6e,00,20,00,\ 28,00,22,00,25,00,31,00,22,00,29,00,20,00,64,00,6f,00,20,00,28,00,50,00,75,\ 00,73,00,68,00,44,00,20,00,22,00,25,00,25,00,7e,00,64,00,70,00,23,00,22,00,\ 20,00,26,00,26,00,20,00,53,00,74,00,61,00,72,00,74,00,20,00,22,00,25,00,25,\ 00,7e,00,6e,00,78,00,23,00,22,00,20,00,2f,00,49,00,20,00,22,00,25,00,25,00,\ 7e,00,66,00,23,00,22,00,20,00,25,00,2a,00,29,00,00,00