Solved Removing 'Bitmap image' from 'New' context menu...

' finding (and changing) the shellnew key for managed apps
' the (grandparent) key looks like this:
' HKCU\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.WindowsNotepad_11.2401.26.0_x64__8wekyb3d8bbwe%5Cmicrosoft.system.package.metadata%5CS-1-5-21-4080321234-480219373-812125678-1002-MergedResources-0.pri
' there are subkeys with apparently random numerical names underneath this.

' that grandparent subkey is the full path name of the CachedMergedResourcesPriFileName.
' The \ characters which aren't allowed in key names are replaced with %5C.

' from the appName:
' via "Software\RegisteredApplications\PackagedApps" we can find the \App\Capabilities key
' The "PackageRootFolder" value can be found two subkeys higher
' The CachedMergedResourcesPriFileName is stored under a version independent key

'appName = "Microsoft.WindowsNotepad_8wekyb3d8bbwe"
appName = "microsoft.paint_8wekyb3d8bbwe"

If WScript.Arguments.Count > 1 Then
    WScript.Echo " only 1 (optional) argument allowed"
    WScript.Quit
End If   

Const dQuote = """"

Const HKEY_CURRENT_USER = &H80000001

Set oReg = GetObject("winmgmts://./root/default:StdRegProv")

packagedApps = "Software\RegisteredApplications\PackagedApps"

oReg.GetStringValue HKEY_CURRENT_USER, packagedApps, appName & "!App", appInfo

' remove \App\Capabilities

appInfo = Replace(Appinfo, "\App\Capabilities", "")

oReg.GetStringValue HKEY_CURRENT_USER, appInfo, "PackageRootFolder", appRoot

appRoot = Replace(appRoot, "\", "%5C")

' the CachedMergedResourcesPriFileName is found under a key like this:
' HKCU\Software\classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windowsnotepad_8wekyb3d8bbwe\ResourcesConfig

ResourcesConfig = "Software\classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\" & appName & "\ResourcesConfig"
oReg.GetStringValue HKEY_CURRENT_USER, ResourcesConfig, "CachedMergedResourcesPriFileName", ResourcesPriFileName

'wscript.echo ResourcesConfig
'wscript.echo ResourcesPriFileName

resourceKey = "Software\Classes\Local Settings\MrtCache\" & appRoot & "%5Cmicrosoft.system.package.metadata%5C" & ResourcesPriFileName

'WScript.echo resourceKey

' recursive search for value containing "ShellNewDisplayName"
EnumerateKeys HKEY_CURRENT_USER, resourceKey

Sub EnumerateKeys(hive, key)
    ' WScript.Echo key
    ' first look for value in current key
    oReg.EnumValues HKEY_CURRENT_USER, key, arrValueNames, arrValueTypes
    If IsArray(arrValueNames) Then
        For i = 0 To UBound(arrValueNames)
            If InStr(1,  arrValueNames(i), "ShellNewDisplayName", 1) Then
                WScript.Echo "Value Name: " & arrValueNames(i)
                If WScript.Arguments.Count = 1 Then
                    oReg.SetStringValue HKEY_CURRENT_USER, key, arrValueNames(i), WScript.Arguments.Item(0)
                End If
                oReg.GetStringValue HKEY_CURRENT_USER, key, arrValueNames(i), data
                WScript.echo "Value Data: " & dQuote & data & dQuote
            End If
        Next
    End If
    ' now look for subkeys to process
    oReg.EnumKey hive, key, arrSubKeys
    If Not IsNull(arrSubKeys) Then
        For Each subkey In arrSubKeys
            EnumerateKeys hive, key & "\" & subkey
        Next
    End If
End Sub