// question
On Windows, review recent registry changes to detect when the MSC file association was hijacked by a reg add operation. What executable file was configured as the default command under HKCU\Software\Classes\mscfile\shell\open\command?
Reference KQL answer and model-by-model comparison.
02124c37-767e-4b76-9383-c9fc366d9d4c
question id
1/23
models correct
1
valid answer
4%
success rate
// reference answer
Human-validated correct answer for this question.
calc.exe
// model comparison
| Model | Answer | KQL query | Status | Tries | Time | Cost |
|---|---|---|---|---|---|---|
| gemini-2.5-flash-preview-04-17 | no answer | no query generated | fail | 5 | 0.00s | 0.0303 |
| gpt-35-turbo | no answer | no query generated | fail | 5 | 0.00s | 0.0116 |
| gpt-4-turbo-2024-04-09 | no answer | no query generated | fail | 5 | 0.00s | 0.2355 |
| gpt-4.1 | c:\windows\System32\calc.exe | DeviceRegistryEvents | where tolower(RegistryKey) has "mscfile\\shell\\open\\command" | where (tolower(RegistryKey) startswith "hkey_current_user" or tolower(RegistryKey) startswith "hkcu") | where ActionType =~ "RegistryValueSet" | project TimeGenerated, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, RegistryKey, RegistryValueName, RegistryValueData | order by TimeGenerated desc | pass | 3 | 12.97s | 0.0271 |
| gpt-4.1-finetuned | no answer | no query generated | fail | 5 | 0.00s | 0.1119 |
| gpt-4.1-mini | no answer | no query generated | fail | 5 | 0.00s | 0.0064 |
| gpt-4.1-nano | no answer | no query generated | fail | 5 | 0.00s | 0.0015 |
| gpt-4o | no answer | no query generated | fail | 5 | 0.00s | 0.0537 |
| gpt-5-high | no answer | no query generated | fail | 5 | 0.00s | 0.2476 |
| gpt-5-mini-high | no answer | no query generated | fail | 5 | 0.00s | 0.0168 |
| gpt-5-mini-low | no answer | no query generated | fail | 5 | 0.00s | 0.0138 |
| gpt-5-mini-medium | no answer | no query generated | fail | 5 | 0.00s | 0.0204 |
| gpt-5-nano-high | no answer | no query generated | fail | 5 | 0.00s | 0.0108 |
| gpt-5-nano-medium | no answer | no query generated | fail | 5 | 0.00s | 0.0127 |
| grok-3-beta | no answer | no query generated | fail | 5 | 0.00s | 0.0881 |
| grok-3-mini-beta | no answer | no query generated | fail | 5 | 0.00s | 0.0075 |
| o1-high | no answer | no query generated | fail | 5 | 0.00s | 0.6550 |
| o1-low | no answer | no query generated | fail | 5 | 0.00s | 0.8208 |
| o3-high | no answer | no query generated | fail | 5 | 0.00s | 0.1086 |
| o3-mini-high | no answer | no query generated | fail | 5 | 0.00s | 0.0419 |
| o3-mini-low | no answer | no query generated | fail | 5 | 0.00s | 0.0449 |
| o4-mini-high | no answer | no query generated | fail | 5 | 0.00s | 0.0431 |
| o4-mini-low | no answer | no query generated | fail | 5 | 0.00s | 0.0492 |