HKEY_CURRENT_USER\Software\Classes\ms-officeapp\Shell\Open\Command is set to rundll32, the so-called hyper key is inactive. cmd.exe command does exactly that: C:\> reg add HKCU\Software\Classes\ms-officeapp\Shell\Open\Command /t REG_SZ /d rundll32
C:\> reg delete HKCU\Software\Classes\ms-officeapp\Shell\Open\Command