Why does this run net1.exe?

[CJM]

Also, since "n<<<<<<" matches an ".exe"-file, i would expect "n<<<<<<.exe" to match the same executable, but on my system the first executes "C:\Windows\Notepad.exe" while the last starts "C:\Windows\System32\Narrator.exe".

Yes, but while "n<<<<<<" does indeed match an ".exe"-file, that's not the FIRST one matched on the wildcard PATH+PATHEXE search that is being done on this extension-less wildcard command. Run through the backtrack steps I outlined, and for the directory in questions here, the file used for character substitution is the FIRST file reported by:

DIR C:\Windows\System32\n******.*

which is effectively the same as:

DIR C:\Windows\System32\n*.*

On my system, the FIRST file reported is: NAPCRYPT.DLL

So, starting with the 2nd character, replace the "<<<<<<" in your original command with "APCRYP", making your PATHEXT search in C:\Windows\System32: nAPCRYP.com, nAPCRYP.exe, etc. which will fail to match any file in \System32, so the next PATH directory is C:\Windows where the same wildcard search DIR C:\Windows\n*.* returns first (and only) notepad.exe, so again replace "<<<<<<" with "otepad", and the "notepad" PATHEXE search will fail on notepad.com, then succeed on notepad.exe, and launch!

In order to follow what's happening, it's necessary to do the wildcard search, character replacement, and PATHEXE search on each directory in the PATH order.

I just checked a similar scenario, so all results are:
- "n>>>>>>" executes "C:\Windows\Notepad.exe"
- "n>>>>>>.exe" executes "C:\Windows\System32\nbtstat.exe"
- "n<<<<<<" executes "C:\Windows\Notepad.exe"
- "n<<<<<<.exe" executes "C:\Windows\System32\Narrator.exe"

Same results here. Our systems aren't so different.