Registry: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce

The commands that are listed under the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] subkey are executed either

• immediately after a device has been installed
• when Windows starts up (the commands are not executed if Windows is started in safe mode)

After running these commands, they're removed (hence the name run once).

The commands must only call rundll32.exe, otherwise, WHQL won't digitally sign a driver package.

If the commands are prefixed with a star, they're executed when Windows starts up even in safe mode.