Changes to the Windows Registry that redirect any default document or file paths to unknown or unexpected executables are suspicious and could indicate the presence of malware or unauthorized tampering. Attackers may use such tactics to execute malicious code when a user attempts to open a file. True configurations of this nature are seldom benign and should be thoroughly investigated.