Me, myself & IT

Unicode Homoglyphs – or `.ΒΑΤ` out of Hell

Purpose
Background Information
Demonstration (Greek)
Demonstration (Cyrillic)

Purpose

That’s all Greek to me …

Background Information

Most of the Unicode fonts available on Windows^™ NT (ab)use some glyphs of Latin characters, especially letters, for characters of other alphabets and scripts, for example Greek and Cyrillic.

The following table shows these so-called Homoglyphs with their Unicode code points:

Unicode Homoglyphs
Capital Letters						Small Letters
Latin		Greek		Cyrillic		Latin		Greek		Cyrillic

A	U+0041	Α	U+0391	А	U+0410	a	U+0061			а	U+0430
B	U+0042	Β	U+0392	В	U+0412
C	U+0043	Ϲ	U+03F9	С	U+0421	c	U+0063	ϲ	U+03F2	с	U+0441
E	U+0045	Ε	U+0395	Е	U+0415	e	U+0065			е	U+0435
H	U+0048	Η	U+0397	Н	U+041D
I	U+0049	Ι	U+0399	І	U+0406	i	U+0069			і	U+0456
J	U+004A			Ј	U+0408	j	U+006A	ϳ	U+03F3	ј	U+0458
K	U+004B	Κ	U+039A
M	U+004D	Μ	U+039C	М	U+041C
N	U+004E	Ν	U+039D
O	U+004F	Ο	U+039F	О	U+041E	o	U+006F	ο	U+03BF	о	U+043E
P	U+0050	Ρ	U+03A1	Р	U+0420	p	U+0070			р	U+0440
S	U+0053			Ѕ	U+0405	s	U+0073			ѕ	U+0455
T	U+0054	Τ	U+03A4	Т	U+0422
						v	U+0076	ν	U+03BD
X	U+0058	Χ	U+03A7	Х	U+0425	x	U+0078			х	U+0445
Y	U+0059	Υ	U+03A5			y	U+0079			у	U+0443
Z	U+005A	Ζ	U+0396

Note: the Unicode Consortium provides an extensive list of such Confusables.

Note: the CWE^™ classifies this well-known weakness as CWE-1007: Insufficient Visual Distinction of Homoglyphs Presented to User.

Like its predecessors, Windows determines a file’s type (and in consequence how to handle it) from its extension, i.e. the part of the filename after the rightmost dot.

When a command is entered without extension, the Command Processor Cmd.exe appends the extensions listed in the environment variable PATHEXT to search for executable files in the directories listed in the environment variable PATH:

SET PATH

Path=C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\Stefan\AppData\Local\Microsoft\WindowsApps;
PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC

Several well-known extensions of (not only) executable file types can be written with Greek and Cyrillic homoglyphs:

Homoglyph File Extensions
Capital Letters			Small Letters			Capital Letters			Small Letters
Latin	Greek	Cyrillic	Latin	Greek	Cyrillic	Latin	Greek	Cyrillic	Latin	Greek	Cyrillic

.ACM	.ΑϹΜ	.АСМ				.JS		.ЈЅ	.js		.јѕ
.APPX	.ΑΡΡΧ	.АРРХ	.appx		.аррх	.JSE		.ЈЅЕ	.jse		.јѕе
.ASA		.АЅА	.asa		.аѕа	.MHT	.ΜΗΤ	.МНТ
.ASP		.АЅР	.asp		.аѕр	.MSC		.МЅС
.AX	.ΑΧ	.АХ	.ax		.ах	.MSI		.МЅІ
.BAT	.ΒΑΤ	.ВАТ				.MSP		.МЅР
.CAB	.ϹΑΒ	.САВ				.MST		.МЅТ
.CHM	.ϹΗΜ	.СНМ				.OCX	.ΟϹΧ	.ОСХ	.ocx		.осх
.COM	.ϹΟΜ	.СОМ				.ONE	.ΟΝΕ
.CONTACT	.ϹΟΝΤΑϹΤ					.OXPS		.ОХРЅ	.oxps		.охрѕ
.EXE	.ΕΧΕ	.ЕХЕ	.exe		.ехе	.PPT	.ΡΡΤ	.РРТ
.HTA	.ΗΤΑ	.НТА				.PPTM	.ΡΡΤΜ	.РРТМ
.HTC	.ΗΤϹ	.НТС				.PPTX	.ΡΡΤΧ	.РРТХ
.HTM	.ΗΤΜ	.НТМ				.SCT		.ЅСТ
.IME	.ΙΜΕ	.ІМЕ				.SHB		.ЅНВ
.INI	.ΙΝΙ					.SHS		.ЅНЅ
.ISO		.ІЅО	.iso		.іѕо				.sys		.ѕуѕ
.ISP		.ІЅР	.isp		.іѕр	.TMP	.ΤΜΡ	.ТМР
.ITS		.ІТЅ				.TSP		.ТЅР
.JOB		.ЈОВ				.XPS		.ХРЅ	.xps		.хрѕ

Note: the table lists only a subset of all homoglyph extensions.

The association of an extension to a file type can be viewed (and modified) with the ASSOC builtin of the Command Processor Cmd.exe:

FOR %? IN (%PATHEXT%) DO ASSOC %?

.COM=comfile
.EXE=exefile
.BAT=batfile
.CMD=cmdfile
.VBS=VBSFile
.VBE=VBEFile
.JS=JSFile
.JSE=JSEFile
.WSF=WSFFile
.WSH=WSHFile
.MSC=MSCFile

The associations are stored in the Registry in subkeys of the HKEY_CLASSES_ROOT key:

FOR %? IN (%PATHEXT%) DO REG.EXE QUERY HKEY_CLASSES_ROOT\%? /VE

HKEY_CLASSES_ROOT\.COM
    (Default)    REG_SZ    comfile

HKEY_CLASSES_ROOT\.EXE
    (Default)    REG_SZ    exefile

HKEY_CLASSES_ROOT\.BAT
    (Default)    REG_SZ    batfile

HKEY_CLASSES_ROOT\.CMD
    (Default)    REG_SZ    cmdfile

HKEY_CLASSES_ROOT\.VBS
    (Default)    REG_SZ    VBSFile

HKEY_CLASSES_ROOT\.VBE
    (Default)    REG_SZ    VBEFile

HKEY_CLASSES_ROOT\.JS
    (Default)    REG_SZ    JSFile

HKEY_CLASSES_ROOT\.JSE
    (Default)    REG_SZ    JSEFile

HKEY_CLASSES_ROOT\.WSF
    (Default)    REG_SZ    WSFFile

HKEY_CLASSES_ROOT\.WSH
    (Default)    REG_SZ    WSHFile

HKEY_CLASSES_ROOT\.MSC
    (Default)    REG_SZ    MSCFile

Note: for details see the MSDN article File Types and File Associations and all following ones.

HKEY_CLASSES_ROOT is the overlay of HKEY_LOCAL_MACHINE\SOFTWARE\Classes and HKEY_CURRENT_USER\Software\Classes, with entries of the latter having precedence. HKEY_CLASSES_ROOT

Demonstration (Greek)

Perform the following 4 simple steps to show how to (ab)use capital Greek letters in file extensions.

Create the UTF-16LE encoded text file UNICODE.INF with the following content in an arbitrary, preferable empty directory:

; Copyright © 2002-2024, Stefan Kanthak <‍stefan‍.‍kanthak‍@‍nexgo‍.‍de‍>

[Version]
DriverVer = 04/27/2022,0.8.1.5
Provider  = "Stefan Kanthak"
Signature = "$Windows NT$"

[SourceDisksNames]
; Cabinet file names and associated disks
; ‹disk or cabinet number› = ‹disk description›,[‹tag or cabinet file›],‹identifier (unused, must be 0)›,[‹relative source path›]

42 = "That’s all Greek to me – .ΒΑΤ out of Hell",UNICODE.INF,0000-0000,

[SourceDisksFiles]
; ‹file› = ‹disk or cabinet number›,[‹subdirectory›],[‹file›],[‹size›],[‹checksum›]
; NOTE: ‹file› is neither on a disk nor in a cabinet if ‹disk or cabinet number› is 0

UNICODE.INF = 42

[DestinationDirs]
; ‹section name› = ‹directory identifier›[,‹subdirectory›]

CopyFiles = 16412,"Microsoft\WindowsApps" ; %LOCALAPPDATA%

[DefaultInstall]
AddReg    = AddReg
CopyFiles = CopyFiles

[CopyFiles]
; ‹destination file›,[‹source file›],[‹temporary file›],[‹flags›]

UNICODE.ΑСΜ,UNICODE.INF
UNICODE.ΑΙ,UNICODE.INF
UNICODE.ΑΝΙ,UNICODE.INF
UNICODE.ΑΧ,UNICODE.INF
UNICODE.ΒΑΤ,UNICODE.INF
UNICODE.ΒΙΝ,UNICODE.INF
UNICODE.ΒΜΡ,UNICODE.INF
UNICODE.СΑΒ,UNICODE.INF
UNICODE.СΑΤ,UNICODE.INF
UNICODE.СΗΜ,UNICODE.INF
UNICODE.СΟΜ,UNICODE.INF
UNICODE.СΟΝΤΑСΤ,UNICODE.INF
UNICODE.ΕΟΤ,UNICODE.INF
UNICODE.ΕΧΕ,UNICODE.INF
UNICODE.ΗΤΑ,UNICODE.INF
UNICODE.ΗΤС,UNICODE.INF
UNICODE.ΗΤΜ,UNICODE.INF
UNICODE.ΙСΜ,UNICODE.INF
UNICODE.ΙСΟ,UNICODE.INF
UNICODE.ΙΜΕ,UNICODE.INF
UNICODE.ΙΝΙ,UNICODE.INF
UNICODE.ΜΗΤ,UNICODE.INF
UNICODE.ΜΡΕ,UNICODE.INF
UNICODE.ΟСΧ,UNICODE.INF
UNICODE.ΡΕΜ,UNICODE.INF
UNICODE.ΡΟΤ,UNICODE.INF
UNICODE.ΡΟΤΜ,UNICODE.INF
UNICODE.ΡΟΤΧ,UNICODE.INF
UNICODE.ΡΡΤ,UNICODE.INF
UNICODE.ΡΡΤΜ,UNICODE.INF
UNICODE.ΡΡΤΧ,UNICODE.INF
UNICODE.ΤΜΡ,UNICODE.INF
UNICODE.ΤΤС,UNICODE.INF
UNICODE.ΤΧΤ,UNICODE.INF
UNICODE.ΧΗΤ,UNICODE.INF
UNICODE.ΧΗΤΜ,UNICODE.INF

[AddReg]
HKCU,"Environment","PATHEXT",0,".СΟΜ;.ΕΧΕ;.ΒΑΤ;.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC"
HKCU,"Software\Classes\.ΑСΜ","Content Type",0,"application/vnd.microsoft.portable-executable"
HKCU,"Software\Classes\.ΑΙ","Content Type",0,"application/postscript"
HKCU,"Software\Classes\.ΑΝΙ",,0,"anifile"
HKCU,"Software\Classes\.ΑΧ","Content Type",0,"application/vnd.microsoft.portable-executable"
HKCU,"Software\Classes\.ΒΑΤ",,0,"batfile"
HKCU,"Software\Classes\.ΒΑΤ","Content Type",0,"text/plain"
HKCU,"Software\Classes\.ΒΙΝ","Content Type",0,"application/octet-stream"
HKCU,"Software\Classes\.ΒΜΡ",,0,"Paint.Picture"
HKCU,"Software\Classes\.ΒΜΡ","Content Type",0,"image/bmp"
HKCU,"Software\Classes\.СΑΒ",,0,"CABFolder"
HKCU,"Software\Classes\.СΑΒ","Content Type",0,"application/vnd.ms-cab-compressed"
HKCU,"Software\Classes\.СΑΒ","PerceivedType",0,"Compressed"
HKCU,"Software\Classes\.СΑΤ",,0,"catfile"
HKCU,"Software\Classes\.СΑΤ","Content Type",0,"application/vnd.ms-pki.seccat"
HKCU,"Software\Classes\.СΗΜ",,0,"chm.file"
HKCU,"Software\Classes\.СΗΜ","Content Type",0,"application/vnd.ms-htmlhelp"
HKCU,"Software\Classes\.СΝΤ",,0,"cntfile"
HKCU,"Software\Classes\.СΟΜ",,0,"comfile"
HKCU,"Software\Classes\.СΟΜ","Content Type",0,"application/vnd.microsoft.portable-executable"
HKCU,"Software\Classes\.СΟΝΤΑСΤ",,0,"contact_wab_auto_file"
HKCU,"Software\Classes\.СΟΝΤΑСΤ","Content Type",0,"text/x-ms-contact"
HKCU,"Software\Classes\.ΕΟΤ","Content Type",0,"application/vnd.ms-fontobject"
HKCU,"Software\Classes\.ΕΧΕ",,0,"exefile"
HKCU,"Software\Classes\.ΕΧΕ","Content Type",0,"application/vnd.microsoft.portable-executable"
HKCU,"Software\Classes\.ΗΤΑ",,0,"htafile"
HKCU,"Software\Classes\.ΗΤΑ","Content Type",0,"application/hta"
HKCU,"Software\Classes\.ΗΤС","Content Type",0,"text/x-component"
HKCU,"Software\Classes\.ΗΤΜ",,0,"htmfile"
HKCU,"Software\Classes\.ΗΤΜ","Content Type",0,"text/html"
HKCU,"Software\Classes\.ΙСΜ",,0,"icmfile"
HKCU,"Software\Classes\.ΙСΟ",,0,"icofile"
HKCU,"Software\Classes\.ΙСΟ","Content Type",0,"application/vnd.microsoft.icon"
HKCU,"Software\Classes\.ΙΜΕ","Content Type",0,"application/vnd.microsoft.portable-executable"
HKCU,"Software\Classes\.ΙΝΙ",,0,"inifile"
HKCU,"Software\Classes\.ΙΝΙ","Content Type",0,"text/plain"
HKCU,"Software\Classes\.ΜΗΤ",,0,"mhtfile"
HKCU,"Software\Classes\.ΜΗΤ","Content Type",0,"message/rfc822"
HKCU,"Software\Classes\.ΜΡΕ",,0,"mpegfile"
HKCU,"Software\Classes\.ΜΡΕ","Content Type",0,"video/mpeg"
HKCU,"Software\Classes\.ΟСΧ",,0,"ocxfile"
HKCU,"Software\Classes\.ΟСΧ","Content Type",0,"application/vnd.microsoft.portable-executable"
HKCU,"Software\Classes\.ΡΕΜ",,0,"cerfile"
HKCU,"Software\Classes\.ΡΕΜ","Content Type",0,"application/x-x509-ca-cert"
HKCU,"Software\Classes\.ΡΟΤ",,0,"PowerPoint.Template.8"
HKCU,"Software\Classes\.ΡΟΤ","Content Type",0,"application/vnd.ms-powerpoint.template"
HKCU,"Software\Classes\.ΡΟΤΜ",,0,"PowerPoint.TemplateMacroEnabled.12"
HKCU,"Software\Classes\.ΡΟΤΜ","Content Type",0,"application/vnd.ms-powerpoint.template.macroenabled.12"
HKCU,"Software\Classes\.ΡΟΤΧ",,0,"PowerPoint.Template.12"
HKCU,"Software\Classes\.ΡΟΤΧ","Content Type",0,"application/vnd.ms-powerpoint.template.12"
HKCU,"Software\Classes\.ΡΡΤ",,0,"PowerPoint.Show.8"
HKCU,"Software\Classes\.ΡΡΤ","Content Type",0,"application/vnd.ms-powerpoint"
HKCU,"Software\Classes\.ΡΡΤΜ",,0,"PowerPoint.ShowMacroEnabled.12"
HKCU,"Software\Classes\.ΡΡΤΜ","Content Type",0,"application/vnd.ms-powerpoint.presentation.macroenabled.12"
HKCU,"Software\Classes\.ΡΡΤΧ",,0,"PowerPoint.Show.12"
HKCU,"Software\Classes\.ΡΡΤΧ","Content Type",0,"application/vnd.ms-powerpoint.presentation.12"
HKCU,"Software\Classes\.ΤΜΡ","Content Type",0,"application/x-msdownload"
HKCU,"Software\Classes\.ΤΤС",,0,"ttcfile"
HKCU,"Software\Classes\.ΤΧΤ",,0,"txtfile"
HKCU,"Software\Classes\.ΤΧΤ","Content Type",0,"text/plain"
HKCU,"Software\Classes\.ΧΗΤ",,0,"xhtmlfile"
HKCU,"Software\Classes\.ΧΗΤ","Content Type",0,"application/xhtml+xml"
HKCU,"Software\Classes\.ΧΗΤΜ",,0,"xhtmlfile"
HKCU,"Software\Classes\.ΧΗΤΜ","Content Type",0,"application/xhtml+xml"

On Windows before Windows Vista right-click on the setup script UNICODE.INF to display its context menu, then click Install.
On Windows Vista and newer versions of Windows NT run one of the following command lines:
```
RUNDLL32.EXE "%SystemRoot%\System32\AdvPack.dll",LaunchInfSection UNICODE.INF,DefaultInstall
RUNDLL32.EXE "%SystemRoot%\System32\SetupAPI.dll",InstallHinfSection DefaultInstall 132 UNICODE.INF
```
Note: InfDefaultInstall.exe, the application associated with .inf files, always requests administrative rights – which are but neither needed nor wanted here.
Start File Explorer, navigate to the directory %USERPROFILE%\AppData\Local\Microsoft\WindowsApps\ alias %LOCALAPPDATA%\Microsoft\WindowsApps\ where the files UNICODE.* with Greek extensions have been created, then open (one of) the executable files UNICODE.ΒΑΤ, UNICODE.СΟΜ, UNICODE.ΕΧΕ or UNICODE.ΗΤΑ per double-click…

Demonstration (Cyrillic)

Perform the following 8 simple steps to show how to (ab)use capital Cyrillic letters in file extensions.

Create the text file UNICODE.VBS with the following content in an arbitrary, preferable empty directory:

Rem Copyright © 2002-2024, Stefan Kanthak <‍stefan‍.‍kanthak‍@‍nexgo‍.‍de‍>

With WScript.CreateObject("Scripting.FileSystemObject")
	Const fsoWindowsFolder   = 0
	Const fsoSystemFolder    = 1
	Const fsoTemporaryFolder = 2

	Const fsoRead   = 1
	Const fsoWrite  = 2
	Const fsoAppend = 8

	Const fsoASCII   = 0
	Const fsoUnicode = -1
	Const fsoDefault = -2

	' Greek homoglyphs
'	Const A = &h391
'	Const B = &h392
'	Const C = &h3F9	' c = &h3F2
'	Const E = &h395
'	Const H = &h397
'	Const I = &h399
'			' j = &h3F3
'	Const K = &h39A
'	Const M = &h39C
'	Const N = &h39D
'	Const O = &h39F	' o = &h3BF
'	Const P = &h3A1
'	Const T = &h3A4
'			' v = &h3BD
'	Const X = &h3A7
'	Const Y = &h3A5
'	Const Z = &h396

	' Cyrillic homoglyphs
	Const A = &h410	' a = &h430
	Const B = &h412
	Const C = &h421	' c = &h441
	Const E = &h415	' e = &h435
	Const H = &h41D
	Const I = &h406	' i = &h456
	Const J = &h408	' j = &h458
	Const M = &h41C
	Const O = &h41E	' o = &h43E
	Const P = &h420	' p = &h440
	Const S = &h405	' s = &h455
	Const T = &h422
	Const X = &h425	' x = &h445
			' y = &h443

	If WScript.Arguments.Count <> 0 Then	' Windows Vista and Windows 7
		strFolder = .GetSpecialFolder(fsoWindowsFolder).Path
	Else					' Windows 8[.1], Windows 10 and Windows 11
		strFolder = .BuildPath(.GetSpecialFolder(fsoTemporaryFolder).ParentFolder.Path, .BuildPath("Microsoft", "WindowsApps"))
	End If

	WScript.CreateObject("Shell.Application").Explore strFolder

	strPathExt = WScript.CreateObject("WScript.Shell").Environment("PROCESS").Item("PATHEXT")
'	strPathExt = WScript.CreateObject("WScript.Shell").RegRead("HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Environment\PATHEXT")
'	strPathExt = WScript.CreateObject("WScript.Shell").Environment("SYSTEM").Item("PATHEXT")
'	strPathExt = WScript.CreateObject("WScript.Shell").RegRead("HKEY_CURRENT_USER\Environment\PATHEXT")
'	strPathExt = WScript.CreateObject("WScript.Shell").Environment("USER").Item("PATHEXT")
'	strPathExt = WScript.CreateObject("WScript.Shell").RegRead("HKEY_CURRENT_USER\Volatile Environment\PATHEXT")
'	strPathExt = WScript.CreateObject("WScript.Shell").Environment("VOLATILE").Item("PATHEXT")

	strUnicode = .BuildPath(strFolder, "UNICODE.TXT")
	.OpenTextFile(strUnicode, fsoWrite, vbTrue, fsoUnicode).WriteLine "Windows Registry Editor Version 5.00"

	blnFlag = vbFalse
	For Each strExtension In Array("ACM", ChrW(A) & ChrW(C) & ChrW(M), _
	                               "ASA", ChrW(A) & ChrW(S) & ChrW(A), _
	                               "ASP", ChrW(A) & ChrW(S) & ChrW(P), _
	                               "AX",  ChrW(A) & ChrW(X), _
	                               "BAT", ChrW(B) & ChrW(A) & ChrW(T), _
	                               "CAB", ChrW(C) & ChrW(A) & ChrW(B), _
	                               "CHM", ChrW(C) & ChrW(H) & ChrW(M), _
	                               "COM", ChrW(C) & ChrW(O) & ChrW(M), _
	                               "EXE", ChrW(E) & ChrW(X) & ChrW(E), _
	                               "HTA", ChrW(H) & ChrW(T) & ChrW(A), _
	                               "HTC", ChrW(H) & ChrW(T) & ChrW(C), _
	                               "HTM", ChrW(H) & ChrW(T) & ChrW(M), _
	                               "IME", ChrW(I) & ChrW(M) & ChrW(E), _
	                               "ISO", ChrW(I) & ChrW(S) & ChrW(O), _
	                               "ISP", ChrW(I) & ChrW(S) & ChrW(P), _
	                               "ITS", ChrW(I) & ChrW(T) & ChrW(S), _
	                               "JOB", ChrW(J) & ChrW(O) & ChrW(B), _
	                               "JS",  ChrW(J) & ChrW(S), _
	                               "JSE", ChrW(J) & ChrW(S) & ChrW(E), _
	                               "MSC", ChrW(M) & ChrW(S) & ChrW(C), _
	                               "MSI", ChrW(M) & ChrW(S) & ChrW(I), _
	                               "MSP", ChrW(M) & ChrW(S) & ChrW(P), _
	                               "MST", ChrW(M) & ChrW(S) & ChrW(T), _
	                               "OCX", ChrW(O) & ChrW(C) & ChrW(X), _
	                               "PPT", ChrW(P) & ChrW(P) & ChrW(T), _
	                               "SCT", ChrW(S) & ChrW(C) & ChrW(T), _
	                               "SHB", ChrW(S) & ChrW(H) & ChrW(B), _
	                               "SHS", ChrW(S) & ChrW(H) & ChrW(S), _
	                               "TMP", ChrW(T) & ChrW(M) & ChrW(P), _
	                               "TSP", ChrW(T) & ChrW(S) & ChrW(P), _
	                               "TXT", ChrW(T) & ChrW(X) & ChrW(T), _
	                               "XPS", ChrW(X) & ChrW(P) & ChrW(S))
		blnFlag = Not blnFlag
		If blnFlag Then
			On Error Resume Next
			strAssoc = WScript.CreateObject("WScript.Shell").RegRead("HKEY_CLASSES_ROOT\." & strExtension & "\")
			If Err.Number <> 0 Then strAssoc = vbNullString
			strMIME = WScript.CreateObject("WScript.Shell").RegRead("HKEY_CLASSES_ROOT\." & strExtension & "\Content Type")
			If Err.Number <> 0 Then strMIME = vbNullString
			On Error Goto 0
		Else
			.CopyFile WScript.FullName, .BuildPath(strFolder, "UNICODE." & strExtension), vbTrue

		' BUG: .RegWrite converts UTF-16LE to ANSI and creates the subkeys ".??" and ".???"
		'	WScript.CreateObject("WScript.Shell").RegWrite "HKEY_CURRENT_USER\Software\Classes\." & strExtension & "\", strAssoc, "REG_SZ"
		'	WScript.CreateObject("WScript.Shell").RegWrite "HKEY_CURRENT_USER\Software\Classes\." & strExtension & "\Content Type", strMIME, "REG_SZ"

			With .OpenTextFile(strUnicode, fsoAppend, vbFalse, fsoUnicode)
				.WriteLine
				.WriteLine "[HKEY_CURRENT_USER\Software\Classes\." & strExtension & "]"
				.WriteLine "@=""" & strAssoc & """"
				.WriteLine """Content Type""=""" & strMIME & """"
			End With

			strPathExt = "." & strExtension & ";" & strPathExt
		End If
	Next

	With .OpenTextFile(strUnicode, fsoAppend, vbFalse, fsoUnicode)
		.WriteLine
		.WriteLine "[HKEY_CURRENT_USER\Volatile Environment]"
	'	.WriteLine """PATH""=""" & strFolder & """"
		.WriteLine """PATHEXT""=""" & strPathExt & """"
	End With

	With WScript.CreateObject("WScript.Shell")
	'	.Environment("VOLATILE").Item("PATH") = strFolder
	'	.Run """%SystemRoot%\System32\Reg.exe"" IMPORT """ & strUnicode & """", 0, vbTrue
		.Environment("PROCESS").Item("__COMPAT_LAYER") = "RunAsInvoker"
		.Run """%SystemRoot%\RegEdit.exe"" /S """ & strUnicode & """", 10, vbTrue
		.Environment("VOLATILE").Item("PATHEXT") = strPathExt
	'	.Run """%SystemRoot%\System32\Cmd.exe"" /D /K UNICODE", 10, vbTrue
	End With
End With

On Windows Vista, Windows 7 and Windows Server 2008 [R2], execute the VBScript UNICODE.VBS created in step 1. with the 32-bit Console Based Script Host CScript.exe or the 32-bit Windows Based Script Host WScript.exe, which are shipped without embedded Application Manifest and therefore subject to File Virtualisation:
```
IF "%PROCESSOR_ARCHITECTURE%" == "x86" (
"%SystemRoot%\System32\CScript.exe" UNICODE.VBS *
) ELSE (
"%SystemRoot%\SysWoW64\CScript.exe" UNICODE.VBS *
)
```
Note: the command lines can be copied and pasted as block into a Command Processor window!
The VBScript launches Windows Explorer to display the Windows directory %SystemRoot%\ where it writes several (virtualised) files UNICODE.* with Cyrillic extensions; click the button Compatibility Files shown on the Explorer Toolbar to display the directory %USERPROFILE%\AppData\Local\VirtualStore\Windows\ alias %LOCALAPPDATA%\VirtualStore\Windows\ with the (real) files UNICODE.* created there.
On Windows 8 and newer versions of Windows NT, execute the VBScript UNICODE.VBS created in step 1. per double-click: it launches File Explorer to display the directory %USERPROFILE%\AppData\Local\Microsoft\WindowsApps\ alias %LOCALAPPDATA%\Microsoft\WindowsApps\ with the files UNICODE.* created there.
Open (one of) the executable files UNICODE.ВАТ, UNICODE.СОМ and UNICODE.ЕХЕ, which are copies of the script host executable used to run the VBScript UNICODE.VBS, per double-click to verify their proper function.
Create the text file UNICODE.BAT with the following content in the still open directory:
```
PAUSE
```
Open the batch script UNICODE.BAT created in step 5. per double-click to verify its proper function, then press Return to close its window.
Start the Command Processor Cmd.exe, type UNICODE (without extension) and press Return …
Close the Explorer window, then open the Run dialog of the Start Menu, enter UNICODE (without extension) and click OK …

Contact

If you miss anything here, have additions, comments, corrections, criticism or questions, want to give feedback, hints or tipps, report broken links, bugs, deficiencies, errors, inaccuracies, misrepresentations, omissions, shortcomings, vulnerabilities or weaknesses, …: don’t hesitate to contact me and feel free to ask, comment, criticise, flame, notify or report!

Use the X.509 certificate to send S/MIME encrypted mail.

Note: email in weird format and without a proper sender name is likely to be discarded!

I dislike HTML (and even weirder formats too) in email, I prefer to receive plain text.
I also expect to see your full (real) name as sender, not your nickname.
I abhor top posts and expect inline quotes in replies.

Terms and Conditions

By using this site, you signify your agreement to these terms and conditions. If you do not agree to these terms and conditions, do not use this site!

The software and the documentation on this site are provided as is without any warranty, neither express nor implied.
In no event will the author be held liable for any damage(s) arising from the use of the software or the documentation.
Permission is granted to use the current version of the software and the current version of the documentation solely for personal private and non-commercial purposes.
An individuals use of the software or the documentation in his or her capacity or function as an agent, (independent) contractor, employee, member or officer of a business, corporation or organisation (commercial or non-commercial) does not qualify as personal private and non-commercial purpose.
Without written approval from the author the software or the documentation must not be used for a business, for commercial, corporate, governmental, military or organisational purposes of any kind, or in a commercial, corporate, governmental, military or organisational environment of any kind.
Redistribution of the software and the documentation is allowed only in unmodified form of its current version and free of charge.

Data Protection Declaration

This web page records no (personal) data and stores no cookies in the web browser.

The web service is operated and provided by

Telekom Deutschland GmbH
Business Center
D-64306 Darmstadt
Germany
<‍hosting‍@‍telekom‍.‍de‍>
+49 800 5252033

The web service provider stores a session cookie in the web browser and records every visit of this web site with the following data in an access log on their server(s):

the (pseudonymised) IP address;
the date and time of the request;
the URL of the requested web page or file;
the Referer and User-Agent HTTP headers sent by the web browser;
the result (success or failure) of the request;
the amount of data received and sent.