Shell Execute Hooks Registry Key Location

This guide explains the exact Windows Registry locations where Shell Execute Hooks are registered and managed by the operating system. Shell Execute Hooks are extension points used by Windows Explorer to intercept, validate, or modify execution calls before a process starts, and their registrations are recorded as COM Class Identifiers (CLSIDs) within specific registry keys.

In the Windows Registry Editor (regedit.exe), system-wide Shell Execute Hooks are recorded under the following path:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks

For 32-bit applications running on a 64-bit version of Windows, the 32-bit hooks are registered under the WOW64 registry key:

HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks

In some configurations, hooks can also be registered on a per-user basis at:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks

How the Registry Stores Shell Execute Hooks

Within these keys, registered hooks are listed as individual registry values: * Value Name: The CLSID (GUID) of the COM object implementing the IShellExecuteHook interface (e.g., {AEB71A5E-8E19-11D0-BC64-0080C7013F62}). * Value Type: REG_SZ (String). * Value Data: Typically left blank or used to store a descriptive name for the hook.

To view or manage these entries, press Win + R, type regedit, press Enter, and navigate to the specified paths.