Shell Execute Hooks Registry Locations

This article provides a direct guide to locating the registered Shell Execute Hooks and related network namespace enumeration handlers within the Windows Registry. In modern and legacy Windows environments, shell execution routines and directory enumeration extensions are cataloged in specific registry hives that govern how Windows Explorer parses, intercepts, and enumerates local and network file paths.

Primary Shell Execute Hooks Registry Key

The Windows Registry catalogs standard registered Shell Execute Hooks under the Explorer configuration branches:

• System-wide:
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks
• User-specific:
  HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks

Under these keys, hooks are stored as individual string values (REG_SZ) where the value name is the Class Identifier (CLSID) GUID of the registered COM object implementing the IShellExecuteHook interface.

Network and Remote Directory Enumeration Keys

When network-specific directory enumeration or remote path parsing occurs, the Windows shell utilizes namespace handlers and network providers defined across several dedicated keys:

• Remote Computer Namespace Handlers:
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\RemoteComputer\NameSpace
  This location defines COM objects called when browsing or enumerating network resources and remote folders.
• Network Neighborhood Namespace:
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\NetworkNeighborhood\NameSpace
  Contains CLSIDs responsible for populating network folder hierarchies.
• Approved Shell Extensions:
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved
  Validates any shell extension, including execution hooks and directory query handlers, before the shell can invoke them.

Resolving Hook Implementations

To identify the underlying dynamic-link library (DLL) associated with any registered hook found in these keys:

1. Copy the CLSID GUID string (e.g., {XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX}).
2. Navigate to HKEY_CLASSES_ROOT\CLSID\{GUID}\InProcServer32.
3. Read the (Default) value, which specifies the exact file path to the binary handling the hook or directory enumeration logic.