Shell Execute Hooks Registry Location in Windows

Shell Execute Hooks are legacy COM-based extensions designed to intercept, modify, or block system execution calls initiated by ShellExecute and ShellExecuteEx in Windows. This article provides the exact Windows Registry paths where the operating system records these registered hooks, explains how they are structured, and details their behavior in both 32-bit and 64-bit environments.

The Primary Registry Key Location

The Windows Registry records the list of all registered Shell Execute Hooks under the HKEY_LOCAL_MACHINE (HKLM) hive. The exact path is:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks

In this registry location, the system stores hooks as named values. Instead of conventional application names, each value name represents the unique Class Identifier (CLSID) Globally Unique Identifier (GUID) of the registered COM object.

Structure of the Registry Values

Within the ShellExecuteHooks key: * Value Name: The CLSID GUID of the hook extension (e.g., {AEB71A5E-8E19-11D0-BC64-0080C750974E}). * Value Type: REG_SZ (String). * Value Data: Typically empty, or contains a brief description of the associated COM component.

The Windows Shell references the GUID specified in the value name and looks up its corresponding implementation details and binary file path under:

HKEY_CLASSES_ROOT\CLSID\{GUID}\InprocServer32

32-Bit Extensions on 64-Bit Windows (WoW64)

On 64-bit versions of Windows, 32-bit applications running under the Windows-on-Windows subsystem (WoW64) query a redirected registry location. The 32-bit Shell Execute Hooks are recorded at:

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks

Modern Support and Legacy Status

Shell Execute Hooks were primarily utilized in Windows 95, Windows 98, Windows 2000, and Windows XP. Starting with Windows Vista and fully enforced in modern Windows versions, Shell Execute Hooks are largely deprecated and ignored by Windows Explorer for security and performance reasons. Modern systems rely on user-mode application isolation, standard shell extension handlers, or system-level virtualization rather than relying on legacy ShellExecuteHooks registry entries.