The Microsoft Component Object Model (COM) is a platform-independent, distributed, object-oriented system for creating binary software components that can interact. COM is the foundation technology for Microsoft's OLE (compound documents), ActiveX (Internet-enabled components), as well as others.
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\mscfile\shell\open\commanddefault value to point to your binary. In this case I chose powershell.exe:
"C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc" /s
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\mscfile\shell\open\commandto point to powershell, when launching Even Viewer, the powershell is invoked instead:
HKEY_CLASSES_ROOT\mscfile\shell\open\commandcan reveal this hijaking activity: