can be to any of these
protocols can found here :
Code:
Computer\HKEY_CLASSES_ROOT\.sys
Computer\HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.sys
Computer\HKEY_CURRENT_USER\Software\Classes
Computer\HKEY_LOCAL_MACHINE\Software\Classes
Computer\HKEY_LOCAL_MACHINE\Software\Classes\SystemFileAssociations
protocols can found here :
Code:
Computer\HKEY_CLASSES_ROOT\onenote
Computer\HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository\Extensions\windows.protocol\onenote
*Computer\HKEY_CURRENT_USER\SOFTWARE\Classes\onenote
Computer\HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Shell\Associations\UrlAssociations\onenote
Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository\Extensions\windows.protocol\onenote
*Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Protocol\Index\Name\onenote