Current_User keys needed for association: Sequence,"Time of Day","Process Name","PID","Operation","Path","Result","Detail" n/a,"14:13:36,7039154","rundll32.exe","5124","RegCreateKey","HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au3","SUCCESS","Desired Access: Maximum Allowed" n/a,"14:13:36,7045795","rundll32.exe","5124","RegSetValue","HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au3\Application","SUCCESS","Type: REG_SZ, Length: 20, Data: SciTE.exe" n/a,"14:13:36,7062414","rundll32.exe","5124","RegCreateKey","HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au3\OpenWithList","SUCCESS","Desired Access: Read/Write" n/a,"14:13:36,7110247","rundll32.exe","5124","RegSetValue","HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au3\OpenWithList\MRUList","SUCCESS","Type: REG_SZ, Length: 14, Data: afdbec" n/a,"14:13:36,7113826","rundll32.exe","5124","RegCreateKey","HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au3\OpenWithProgids","SUCCESS","Desired Access: Maximum Allowed" n/a,"14:13:36,7570730","rundll32.exe","5124","RegCreateKey","HKCU\Software\Microsoft\Windows\CurrentVersion","SUCCESS","Desired Access: All Access" Its still in processmonitor format, but im lazy today Creator -edit- which narrows down to "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au3\Application" "Type: REG_SZ, Data: SciTE.exe" the rest is irrelevant