In addition to being called by executing WSREG32.EXE, WSREG.DLL can be called by Workstation Manager's Scheduler when when one of the following events occurs:
The sequence of file calls when one of the above events is detected are:
Windows NT/2000: WM.EXE > WMRUNDLL.EXE > WSREG.DLL.
Windows 95/98: WM95.EXE > WM95SAST.EXE > WSREG.DLL.