Find out what process registered a global hotkey? (Windows API)

One possible way is to use the Visual Studio tool Spy++.

Give this a try:

1. Run the tool (for me, it’s at C:\Program Files (x86)\Microsoft Visual Studio\2017\Community\Common7\Tools\spyxx_amd64.exe or you can download it). Note: there is spyxx.exe (32-bit version) and spyxx_amd64.exe (64-bit version) – if you don’t see anything in 64-bit use the 32-bit version (ie.catches messages only in same architecture)
2. In the menu bar, select Spy -> Log messages… (or hit Ctrl + M)
3. Check All Windows in System in the Additional Windows frame
4. Switch to the Messages tab
5. Click the Clear All button
6. Select WM_HOTKEY in the listbox, or check Keyboard in Message Groups (if you’re OK with more potential noise)
7. Click the OK button
8. Press the hotkey in question (Win + R, for example)
9. Select the WM_HOTKEY line in the Messages (All Windows) window, right click, and select Properties… in the context menu
10. In the Message Properties dialog, click the Window Handle link (this will be the handle for the window that received the message)
11. Click the Synchronize button on the Window Properties dialog. This will show the window in the main Spy++ window treeview (if it’s windows itself or some popup application it shows nothing).
12. On the Window Properties dialog, select the Process tab
13. Click the Process ID link. This will show you the process (In my Win + R case: EXPLORER)