Zero‑Dwell Threat Intelligence Report
A narrative, executive‑ready view into the malware’s behavior, exposure, and reliable defenses.
Generated: 2025-09-16 10:40:58 UTC
Executive Overview — What We’re Dealing With
This specimen has persisted long enough to matter. Human experts classified it as Malware, and the telemetry confirms a capable, evasive Trojan with real impact potential.
File
abc81778e20711075941cd11930be3b38a12f429
Type
Win64 Executable (generic)
SHA‑1
abc81778e20711075941cd11930be3b38a12f429
MD5
69f5b19dc9d7675f57de11043992192d
First Seen
2025-09-05 07:17:45.467513
Last Analysis
2025-09-05 10:02:34.517835
Dwell Time
0 days, 7 hours, 33 minutes
Extended Dwell Time Impact
For 2+ hours, this malware remained undetected — a limited but sufficient window for the adversary to complete initial execution and establish basic system access.
Comparative Context
Industry studies report a median dwell time closer to 21–24 days. This case represents rapid detection and containment within hours rather than days.
Timeline
| Time (UTC) | Event | Elapsed |
|---|---|---|
| 2025-09-04 12:37:44 UTC | First VirusTotal submission | — |
| 2025-09-09 07:39:07 UTC | Latest analysis snapshot | 4 days, 19 hours, 1 minutes |
| 2025-09-16 10:40:58 UTC | Report generation time | 11 days, 22 hours, 3 minutes |
Why It Matters
Every additional day of dwell time is not just an abstract number — it is attacker opportunity. Each day equates to more time for lateral movement, stealth persistence, and intelligence gathering.
Global Detection Posture — Who Caught It, Who Missed It
VirusTotal engines: 73. Detected as malicious: 53. Missed: 20. Coverage: 72.6%.
Detected Vendors
- Xcitium
- +52 additional vendors (names not provided)
List includes Xcitium plus an additional 52 vendors per the provided summary.
Missed Vendors
- Acronis
- Antiy-AVL
- Baidu
- ClamAV
- CMC
- Jiangmin
- MaxSecure
- NANO-Antivirus
- SUPERAntiSpyware
- TACHYON
- tehtris
- Trapmine
- TrendMicro
- VBA32
- VirIT
- ViRobot
- Yandex
- Zillya
- ZoneAlarm
- Zoner
Why it matters: if any endpoint relies solely on a missed engine, this malware can operate with zero alerts. Prevention‑first controls close that gap regardless of signature lag.
Behavioral Storyline — How the Malware Operates
Intensive file system activity (49.66% of behavior) indicates data harvesting, file encryption, or dropper behavior. The threat is actively searching for and manipulating files across the system.
Behavior Categories (weighted)
Weight values represent the frequency and intensity of malware interactions with specific system components. Higher weights indicate more aggressive targeting of that category. Each operation (registry access, file modification, network connection, etc.) contributes to the category’s total weight, providing a quantitative measure of the malware’s behavioral focus.
| Category | Weight | Percentage |
|---|---|---|
| File System | 168167 | 49.66% |
| Synchronization | 165532 | 48.88% |
| Registry | 2680 | 0.79% |
| System | 1719 | 0.51% |
| Process | 203 | 0.06% |
| Com | 203 | 0.06% |
| Services | 56 | 0.02% |
| Threading | 44 | 0.01% |
| Device | 25 | 0.01% |
| Misc | 19 | 0.01% |
| Windows | 8 | 0.00% |
| Network | 5 | 0.00% |
| Hooking | 1 | 0.00% |
| Crypto | 1 | 0.00% |
MITRE ATT&CK Mapping
- T1055.003 – inject thread
- T1620 – inject thread
- T1112 – delete registry value
- T1057 – enumerate processes
- T1518 – enumerate processes
- T1546.001 – persist via default file association registry key
- T1129 – parse PE header
- T1539 – Touches a file containing cookies, possibly for information gathering
- T1071 – Suspicious communication with abused trusted site
- T1071 – Attempts to connect to a dead IP:Port
- T1036 – A file was accessed within the Public folder.
- T1055 – Contains .tls (Thread Local Storage) section
- T1548 – A file was accessed within the Public folder.
- T1497 – Checks for mouse movement
- T1497 – SetUnhandledExceptionFilter detected: superseding the top-level exception handler of each thread of a process is a common anti-debug technique.
- T1053.005 – SetUnhandledExceptionFilter detected: superseding the top-level exception handler of each thread of a process is a common anti-debug technique.
- T1213 – SetUnhandledExceptionFilter detected: superseding the top-level exception handler of each thread of a process is a common anti-debug technique.
- T1564.003 – SetUnhandledExceptionFilter detected: superseding the top-level exception handler of each thread of a process is a common anti-debug technique.
- T1222 – SetUnhandledExceptionFilter detected: superseding the top-level exception handler of each thread of a process is a common anti-debug technique.
- T1010 – SetUnhandledExceptionFilter detected: superseding the top-level exception handler of each thread of a process is a common anti-debug technique.
- T1082 – SetUnhandledExceptionFilter detected: superseding the top-level exception handler of each thread of a process is a common anti-debug technique.
- T1129 – SetUnhandledExceptionFilter detected: superseding the top-level exception handler of each thread of a process is a common anti-debug technique.
- T1622 – SetUnhandledExceptionFilter detected: superseding the top-level exception handler of each thread of a process is a common anti-debug technique.
- T1057 – SetUnhandledExceptionFilter detected: superseding the top-level exception handler of each thread of a process is a common anti-debug technique.
- T1027 – SetUnhandledExceptionFilter detected: superseding the top-level exception handler of each thread of a process is a common anti-debug technique.
- T1112 – SetUnhandledExceptionFilter detected: superseding the top-level exception handler of each thread of a process is a common anti-debug technique.
- T1497.001 – SetUnhandledExceptionFilter detected: superseding the top-level exception handler of each thread of a process is a common anti-debug technique.
- T1055.003 – SetUnhandledExceptionFilter detected: superseding the top-level exception handler of each thread of a process is a common anti-debug technique.
- T1083 – SetUnhandledExceptionFilter detected: superseding the top-level exception handler of each thread of a process is a common anti-debug technique.
- T1134 – SetUnhandledExceptionFilter detected: superseding the top-level exception handler of each thread of a process is a common anti-debug technique.
- T1115 – SetUnhandledExceptionFilter detected: superseding the top-level exception handler of each thread of a process is a common anti-debug technique.
- T1614 – SetUnhandledExceptionFilter detected: superseding the top-level exception handler of each thread of a process is a common anti-debug technique.
- T1033 – SetUnhandledExceptionFilter detected: superseding the top-level exception handler of each thread of a process is a common anti-debug technique.
- T1055 – SetUnhandledExceptionFilter detected: superseding the top-level exception handler of each thread of a process is a common anti-debug technique.
- T1087 – SetUnhandledExceptionFilter detected: superseding the top-level exception handler of each thread of a process is a common anti-debug technique.
- T1113 – SetUnhandledExceptionFilter detected: superseding the top-level exception handler of each thread of a process is a common anti-debug technique.
- T1056.001 – SetUnhandledExceptionFilter detected: superseding the top-level exception handler of each thread of a process is a common anti-debug technique.
- T1055.001 – SetUnhandledExceptionFilter detected: superseding the top-level exception handler of each thread of a process is a common anti-debug technique.
- T1016 – SetUnhandledExceptionFilter detected: superseding the top-level exception handler of each thread of a process is a common anti-debug technique.
- T1047 – SetUnhandledExceptionFilter detected: superseding the top-level exception handler of each thread of a process is a common anti-debug technique.
- T1140 – SetUnhandledExceptionFilter detected: superseding the top-level exception handler of each thread of a process is a common anti-debug technique.
- T1564 – SetUnhandledExceptionFilter detected: superseding the top-level exception handler of each thread of a process is a common anti-debug technique.
- T1518 – SetUnhandledExceptionFilter detected: superseding the top-level exception handler of each thread of a process is a common anti-debug technique.
- T1012 – SetUnhandledExceptionFilter detected: superseding the top-level exception handler of each thread of a process is a common anti-debug technique.
- T1620 – SetUnhandledExceptionFilter detected: superseding the top-level exception handler of each thread of a process is a common anti-debug technique.
- T1070.004 – SetUnhandledExceptionFilter detected: superseding the top-level exception handler of each thread of a process is a common anti-debug technique.
- T1129 – The process attempted to dynamically load a malicious function
- T1129 – The process tried to load dynamically one or more functions.
- T1497 – Detected a call to the Crypt API containing an IP address, a domain, or a filename
- T1053.005 – Detected a call to the Crypt API containing an IP address, a domain, or a filename
- T1213 – Detected a call to the Crypt API containing an IP address, a domain, or a filename
- T1564.003 – Detected a call to the Crypt API containing an IP address, a domain, or a filename
- T1222 – Detected a call to the Crypt API containing an IP address, a domain, or a filename
- T1010 – Detected a call to the Crypt API containing an IP address, a domain, or a filename
- T1082 – Detected a call to the Crypt API containing an IP address, a domain, or a filename
- T1129 – Detected a call to the Crypt API containing an IP address, a domain, or a filename
- T1622 – Detected a call to the Crypt API containing an IP address, a domain, or a filename
- T1057 – Detected a call to the Crypt API containing an IP address, a domain, or a filename
- T1027 – Detected a call to the Crypt API containing an IP address, a domain, or a filename
- T1112 – Detected a call to the Crypt API containing an IP address, a domain, or a filename
- T1497.001 – Detected a call to the Crypt API containing an IP address, a domain, or a filename
- T1055.003 – Detected a call to the Crypt API containing an IP address, a domain, or a filename
- T1083 – Detected a call to the Crypt API containing an IP address, a domain, or a filename
- T1134 – Detected a call to the Crypt API containing an IP address, a domain, or a filename
- T1115 – Detected a call to the Crypt API containing an IP address, a domain, or a filename
- T1614 – Detected a call to the Crypt API containing an IP address, a domain, or a filename
- T1033 – Detected a call to the Crypt API containing an IP address, a domain, or a filename
- T1055 – Detected a call to the Crypt API containing an IP address, a domain, or a filename
- T1087 – Detected a call to the Crypt API containing an IP address, a domain, or a filename
- T1113 – Detected a call to the Crypt API containing an IP address, a domain, or a filename
- T1056.001 – Detected a call to the Crypt API containing an IP address, a domain, or a filename
- T1055.001 – Detected a call to the Crypt API containing an IP address, a domain, or a filename
- T1016 – Detected a call to the Crypt API containing an IP address, a domain, or a filename
- T1047 – Detected a call to the Crypt API containing an IP address, a domain, or a filename
- T1140 – Detected a call to the Crypt API containing an IP address, a domain, or a filename
- T1564 – Detected a call to the Crypt API containing an IP address, a domain, or a filename
- T1518 – Detected a call to the Crypt API containing an IP address, a domain, or a filename
- T1012 – Detected a call to the Crypt API containing an IP address, a domain, or a filename
- T1620 – Detected a call to the Crypt API containing an IP address, a domain, or a filename
- T1070.004 – Detected a call to the Crypt API containing an IP address, a domain, or a filename
- T1045 – Manalize Local SandBox Packer Harvesting
- T1129 – parse PE header
- T1112 – delete registry value
- T1055 – write process memory
- T1071 – Some process has originated direct HTTPS traffic with one or more hosts.
- T1082 – Queries for the computername
- T1497 – Manalize Local SandBox Strings
- T1053.005 – Manalize Local SandBox Strings
- T1213 – Manalize Local SandBox Strings
- T1564.003 – Manalize Local SandBox Strings
- T1222 – Manalize Local SandBox Strings
- T1010 – Manalize Local SandBox Strings
- T1082 – Manalize Local SandBox Strings
- T1129 – Manalize Local SandBox Strings
- T1622 – Manalize Local SandBox Strings
- T1057 – Manalize Local SandBox Strings
- T1027 – Manalize Local SandBox Strings
- T1112 – Manalize Local SandBox Strings
- T1497.001 – Manalize Local SandBox Strings
- T1055.003 – Manalize Local SandBox Strings
- T1083 – Manalize Local SandBox Strings
- T1134 – Manalize Local SandBox Strings
- T1115 – Manalize Local SandBox Strings
- T1614 – Manalize Local SandBox Strings
- T1033 – Manalize Local SandBox Strings
- T1055 – Manalize Local SandBox Strings
- T1087 – Manalize Local SandBox Strings
- T1113 – Manalize Local SandBox Strings
- T1056.001 – Manalize Local SandBox Strings
- T1055.001 – Manalize Local SandBox Strings
- T1016 – Manalize Local SandBox Strings
- T1047 – Manalize Local SandBox Strings
- T1140 – Manalize Local SandBox Strings
- T1564 – Manalize Local SandBox Strings
- T1518 – Manalize Local SandBox Strings
- T1012 – Manalize Local SandBox Strings
- T1620 – Manalize Local SandBox Strings
- T1070.004 – Manalize Local SandBox Strings
- T1057 – enumerate processes
- T1518 – enumerate processes
- T1055.003 – inject thread
- T1620 – inject thread
- T1053 – It registers tasks through ITaskFolder::RegisterTaskDefinition
- T1053 – Creates COM task schedule object (often to register a task for autostart)
- T1036 – Creates files inside the user directory
- T1057 – Queries a list of all running processes
- T1573 – Uses HTTPS
- T1071 – Uses HTTPS
Following the Trail — Network & DNS Activity
Outbound activity leans on reputable infrastructure (e.g., CDNs, cloud endpoints) to blend in. TLS sessions and
HTTP calls show routine beaconing and IP‑lookup behavior that can masquerade as normal browsing.
Contacted Domains
| Domain | IP | Country | ASN/Org |
|---|---|---|---|
| www.aieov.com | 76.223.54.146 | United States | Amazon.com, Inc. |
| github.com | 140.82.114.4 | United States | GitHub, Inc. |
Observed IPs
| IP | Country | ASN/Org |
|---|---|---|
| 224.0.0.252 | — | — |
| 8.8.4.4 | United States | Google LLC |
| 8.8.8.8 | United States | Google LLC |
DNS Queries
| Request | Type |
|---|---|
| 5isohu.com | A |
| github.com | A |
| www.aieov.com | A |
Contacted IPs
| IP | Country | ASN/Org |
|---|---|---|
| 224.0.0.252 | — | — |
| 8.8.4.4 | United States | Google LLC |
| 8.8.8.8 | United States | Google LLC |
Port Distribution
| Port | Count | Protocols |
|---|---|---|
| 137 | 1 | udp |
| 5355 | 8 | udp |
| 53 | 28 | udp |
UDP Packets
| Source IP | Dest IP | Sport | Dport | Time | Proto |
|---|---|---|---|---|---|
| 192.168.56.14 | 192.168.56.255 | 137 | 137 | 3.0808470249176025 | udp |
| 192.168.56.14 | 224.0.0.252 | 51209 | 5355 | 3.0170650482177734 | udp |
| 192.168.56.14 | 224.0.0.252 | 53401 | 5355 | 4.741152048110962 | udp |
| 192.168.56.14 | 224.0.0.252 | 54683 | 5355 | 137.5025610923767 | udp |
| 192.168.56.14 | 224.0.0.252 | 55094 | 5355 | 5.614001989364624 | udp |
| 192.168.56.14 | 224.0.0.252 | 55848 | 5355 | 3.0172250270843506 | udp |
| 192.168.56.14 | 224.0.0.252 | 56399 | 5355 | 134.87545490264893 | udp |
| 192.168.56.14 | 224.0.0.252 | 62022 | 5355 | 132.03460097312927 | udp |
| 192.168.56.14 | 224.0.0.252 | 63205 | 5355 | 140.17645907402039 | udp |
| 192.168.56.14 | 8.8.4.4 | 49916 | 53 | 81.09376907348633 | udp |
| 192.168.56.14 | 8.8.4.4 | 50180 | 53 | 128.23440790176392 | udp |
| 192.168.56.14 | 8.8.4.4 | 50710 | 53 | 52.15424108505249 | udp |
| 192.168.56.14 | 8.8.4.4 | 50914 | 53 | 161.0310459136963 | udp |
| 192.168.56.14 | 8.8.4.4 | 52815 | 53 | 7.578085899353027 | udp |
| 192.168.56.14 | 8.8.4.4 | 54579 | 53 | 37.42216205596924 | udp |
| 192.168.56.14 | 8.8.4.4 | 55827 | 53 | 175.43913292884827 | udp |
| 192.168.56.14 | 8.8.4.4 | 55914 | 53 | 113.81301808357239 | udp |
| 192.168.56.14 | 8.8.4.4 | 60117 | 53 | 66.57828307151794 | udp |
| 192.168.56.14 | 8.8.4.4 | 60713 | 53 | 193.73454189300537 | udp |
| 192.168.56.14 | 8.8.4.4 | 62112 | 53 | 22.984916925430298 | udp |
| 192.168.56.14 | 8.8.4.4 | 62548 | 53 | 146.54687905311584 | udp |
| 192.168.56.14 | 8.8.4.4 | 64753 | 53 | 99.43803191184998 | udp |
| 192.168.56.14 | 8.8.4.4 | 65148 | 53 | 8.26596999168396 | udp |
| 192.168.56.14 | 8.8.8.8 | 49916 | 53 | 80.09412288665771 | udp |
| 192.168.56.14 | 8.8.8.8 | 50180 | 53 | 127.23556089401245 | udp |
| 192.168.56.14 | 8.8.8.8 | 50710 | 53 | 51.14125895500183 | udp |
| 192.168.56.14 | 8.8.8.8 | 50914 | 53 | 160.03242897987366 | udp |
| 192.168.56.14 | 8.8.8.8 | 52815 | 53 | 8.57807207107544 | udp |
| 192.168.56.14 | 8.8.8.8 | 54579 | 53 | 36.42261600494385 | udp |
| 192.168.56.14 | 8.8.8.8 | 55827 | 53 | 174.43813490867615 | udp |
| 192.168.56.14 | 8.8.8.8 | 55914 | 53 | 112.8262689113617 | udp |
| 192.168.56.14 | 8.8.8.8 | 60117 | 53 | 65.57913994789124 | udp |
| 192.168.56.14 | 8.8.8.8 | 60713 | 53 | 192.73471593856812 | udp |
| 192.168.56.14 | 8.8.8.8 | 62112 | 53 | 21.985204935073853 | udp |
| 192.168.56.14 | 8.8.8.8 | 62548 | 53 | 145.5470929145813 | udp |
| 192.168.56.14 | 8.8.8.8 | 64753 | 53 | 98.44442296028137 | udp |
| 192.168.56.14 | 8.8.8.8 | 65148 | 53 | 9.266356945037842 | udp |
Hunting tip: alert on unknown binaries initiating TLS to IP‑lookup services or unusual CDN endpoints — especially early in execution.
Persistence & Policy — Registry and Services
Registry and service telemetry points to policy awareness and environment reconnaissance rather than noisy persistence. Below is a compact view of the most relevant keys and handles; expand to see the full lists where available.
Registry Opened
404
Registry Set
18
Services Started
2
Services Opened
1
Registry Opened (Top 25)
| Key |
|---|
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 |
| HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1 |
| HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\FolderValueFlags |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\ |
| HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\ValidateRegItems |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 |
| HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\AutoConfigURL |
| HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Explorer |
| HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Explorer |
| HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoControlPanel |
| HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 |
| HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0 |
| HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSetFolders |
| HKEY_CLASSES_ROOT\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder |
| HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy\STE |
| HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ |
| HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0 |
| HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\Flags |
| HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoPropertiesMyComputer |
| HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy |
| HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoPropertiesMyComputer |
| HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\ |
| HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ |
| HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1 |
| HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy\Enabled |
| HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\LanmanWorkstation\Parameters\RpcCacheTimeout |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer |
| HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ |
| HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ |
| HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSetFolders |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\NonEnum |
| HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy\MDMEnabled |
| HKEY_LOCAL_MACHINE\SYSTEM\Setup\SystemSetupInProgress |
| HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoPropertiesRecycleBin |
| HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\NonEnum\{20D04FE0-3AEA-1069-A2D8-08002B30309D} |
| HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Themes\Personalize |
| HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2 |
| HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0 |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2 |
| HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet |
| HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ |
| HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\Attributes |
| HKEY_LOCAL_MACHINE\System\Setup |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\App Paths\program.exe |
| HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\KnownFolders |
| HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyServer |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ |
Show all (404 total)
| Key |
|---|
| HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Security_HKLM_only |
| HKEY_CURRENT_USER\ZoneMap\Ranges\ |
| HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellCompatibility\Applications\program.exe |
| HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoInternetIcon |
| HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\ValidateRegItems |
| HKEY_LOCAL_MACHINE\Software\Microsoft\windows\CurrentVersion\Internet Settings |
| HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\ |
| HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder |
| HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\RestrictedAttributes |
| HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\Flags |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\NonEnum |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0 |
| HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shellex\FolderExtensions\{fbeb8a05-beee-4442-804e-409d6c4515e9}\DriveMask |
| HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName |
| HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\WinHttpLowerCaseHost |
| HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Windows\Explorer\DisableKnownFolders |
| HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\CallForAttributes |
| HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable |
| HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 |
| HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 |
| HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\MonitorRegistry |
| HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace |
| HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\Flags |
| HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\Flags |
| HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 |
| HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2 |
| HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache |
| HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyOverride |
| HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass |
| HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\WinHttp |
| HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 |
| HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Themes\Personalize\AppsUseLightTheme |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache |
| HKEY_LOCAL_MACHINE\ZoneMap\Ranges\ |
| HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoControlPanel |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ |
| HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoInternetIcon |
| HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\WinHttp\AutoProxyAutoLogonIfChallenged |
| HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoPropertiesRecycleBin |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\KnownFolderSettings |
| HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoCommonGroups |
| HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect |
| HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Cookies |
| HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoCommonGroups |
| HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\MonitorRegistry |
| HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\TrustedPeople |
| \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root\CTLs |
| \REGISTRY\USER\S-1-5-20\Software\Classes\Local Settings\MuiCache |
| HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\CloudStore\SystemMetaData |
| HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs |
| HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs |
| HKEY_LOCAL_MACHINE\Software\Microsoft\SystemCertificates\My\CTLs |
| HKEY_LOCAL_MACHINE\Software\Policies\Microsoft |
| HKEY_LOCAL_MACHINE\Software |
| HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\CA\CRLs |
| HKEY_LOCAL_MACHINE\Software\Microsoft\SystemCertificates\Disallowed |
| HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\trust |
| HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\Root |
| HKEY_LOCAL_MACHINE\Software\Microsoft\EnterpriseCertificates\TrustedPeople |
| \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs |
| HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\SystemCertificates\Disallowed |
| \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed\CTLs |
| HKEY_CURRENT_USER\Software |
| HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\CA\Certificates |
| HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates |
| HKEY_LOCAL_MACHINE\Software\Microsoft\IdentityStore\Cache\S-1-5-21-4226853953-3309226944-3078887307-1000 |
| HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\trust\Certificates |
| \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust\Certificates |
| \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust\Certificates |
| HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SecurityProviders\Schannel |
| HKEY_LOCAL_MACHINE\Software\Microsoft\EnterpriseCertificates\CA |
| HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\CloudStore\Store |
| HKEY_LOCAL_MACHINE\Software\Microsoft\WBEM\CIMOM |
| \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA\CTLs |
| \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs |
| HKEY_LOCAL_MACHINE\Software\Microsoft\EnterpriseCertificates\Root |
| HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\Disallowed\CTLs |
| HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates |
| HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\SystemCertificates\trust |
| \REGISTRY\USER\S-1-5-19\Software\Classes\Local Settings\MuiCache |
| \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates |
| \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA |
| HKEY_LOCAL_MACHINE\Software\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 |
| \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust\CRLs |
| HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\CloudStore |
| HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs |
| HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\RunTime |
| HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\trust |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing |
| HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\CloudStore\StoreInit |
| \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs |
| \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust\CTLs |
| \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates |
| HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters |
| \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust\CTLs |
| \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA\CRLs |
| \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed |
| HKEY_LOCAL_MACHINE\Software\Microsoft\SystemCertificates\AuthRoot\AutoUpdate |
| HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs |
| HKEY_LOCAL_MACHINE\Software\Microsoft\SystemCertificates\My |
| HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\trust\CRLs |
| HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\Disallowed |
| HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\Disallowed |
| \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root\CRLs |
| HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\Root\CRLs |
| HKEY_LOCAL_MACHINE\Software\Microsoft\SystemCertificates\AuthRoot\Certificates |
| HKEY_CURRENT_USER\Software\Policies\Microsoft |
| HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\SystemCertificates\Root |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\taskhostw_RASAPI32 |
| HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\SystemCertificates |
| \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates |
| HKEY_LOCAL_MACHINE\Software\Microsoft\SystemCertificates\CA |
| \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates |
| \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root |
| HKEY_LOCAL_MACHINE\Software\Microsoft\SystemCertificates\trust |
| \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople |
| HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\CA\CTLs |
| HKEY_LOCAL_MACHINE\Software\Microsoft\SystemCertificates\My\CRLs |
| \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust |
| HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\SystemCertificates\TrustedPeople |
| HKEY_LOCAL_MACHINE\Software\Microsoft\SystemCertificates\AuthRoot |
| HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\CA |
| HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\Root\CTLs |
| HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\TrustedPeople |
| \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA\Certificates |
| \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust |
| \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA\Certificates |
| HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\Disallowed\CRLs |
| HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\SmartCardRoot |
| HKEY_LOCAL_MACHINE\Software\Microsoft\SystemCertificates\AuthRoot\CTLs |
| HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\Disallowed\Certificates |
| \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed\Certificates |
| \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA\CRLs |
| HKEY_LOCAL_MACHINE\Software\Microsoft\EnterpriseCertificates |
| HKEY_CURRENT_USER\Software\Policies |
| HKEY_LOCAL_MACHINE\Software\Microsoft\EnterpriseCertificates\trust |
| \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA |
| HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA |
| HKEY_LOCAL_MACHINE\Software\Microsoft\SystemCertificates\Root |
| \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs |
| HKEY_LOCAL_MACHINE\Software\Policies |
| HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\Root\Certificates |
| HKEY_CURRENT_USER\Software\Microsoft\LanguageOverlay\UpdateFailures |
| \REGISTRY\USER\S-1-5-20\Software\Classes\Local Settings\MuiCache\3e\52C64B7E |
| \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople |
| HKEY_LOCAL_MACHINE\Software\Microsoft\SystemCertificates\AuthRoot\CRLs |
| \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root\Certificates |
| \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA\CTLs |
| \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs |
| HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates |
| \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed\CRLs |
| HKEY_LOCAL_MACHINE\Software\Microsoft |
| \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\taskhostw_RASMANCS |
| \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs |
| HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\SystemCertificates\CA |
| HKEY_LOCAL_MACHINE\Software\Microsoft\SystemCertificates\My\Certificates |
| \REGISTRY\USER\S-1-5-19\Software\Classes\Local Settings\MuiCache\3e\52C64B7E |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\BackgroundAccessApplications |
| \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust\CRLs |
| HKEY_LOCAL_MACHINE\Software\Microsoft\SystemCertificates |
| HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\CloudStore\Store\Cache |
| \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs |
| HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections |
| HKEY_LOCAL_MACHINE\Software\Microsoft\LanguageOverlay\UpdateFailures |
| HKEY_LOCAL_MACHINE\Software\Microsoft\EnterpriseCertificates\Disallowed |
| HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\trust\CTLs |
| \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed |
| HKEY_LOCAL_MACHINE\Software\Microsoft\WBEM |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileService\References\S-1-5-21-4226853953-3309226944-3078887307-1000 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\SystemCertificates\SmartCardRoot |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileService\References |
| HKEY_LOCAL_MACHINE\Software\Microsoft\SystemCertificates\TrustedPeople |
| HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{a499fa48-7057-4ac1-9702-44c6fd924058} |
| \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs |
| HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\ |
| HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3 |
| HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BUFFERBREAKING_818408 |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache |
| HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\program.exe |
| HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BUFFERBREAKING_818408 |
| HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings |
| HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings |
| HKEY_LOCAL_MACHINE\Software\Classes |
| HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_INCLUDE_PORT_IN_SPN_KB908209 |
| HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_USE_UTF8_FOR_BASIC_AUTH_KB967545 |
| HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings |
| HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_COMPAT_USE_CONNECTION_BASED_NEGOTIATE_AUTH_KB2151543 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\SdbUpdates\ManifestedMergeStubSdbs |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0 |
| HKEY_CURRENT_USER_Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder |
| HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{A168AADC-1674-49DA-AD4F-4F27DF8760D0} |
| HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_IGNORE_MAPPINGS_FOR_CREDPOLICY |
| HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_PERMIT_CACHE_FOR_AUTHENTICATED_FTP_KB910274 |
| HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\program.exe |
| HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Download |
| HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\PolicyExtensions\TenantRestrictionsPlugin.dll |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Ole |
| HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\Elevation |
| HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2 |
| HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONES_CHECK_ZONEMAP_POLICY_KB941001 |
| HKEY_CURRENT_USER_Classes |
| HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BYPASS_CACHE_FOR_CREDPOLICY_KB936611 |
| HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_HTTP_USERNAME_PASSWORD_DISABLE |
| HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 |
| HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main |
| HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_IGNORE_MAPPINGS_FOR_CREDPOLICY |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main |
| HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InprocServer32 |
| HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ALLOW_REVERSE_SOLIDUS_IN_USERINFO_KB932562 |
| HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F1B32785-6FBA-4FCF-9D55-7B8E7F157091}\PropertyBag |
| HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Winsock\Parameters |
| HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer |
| HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_USE_IETLDLIST_FOR_DOMAIN_DETERMINATION |
| HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\PropertyBag |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings |
| HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Security |
| HKEY_CURRENT_USER\Software\Microsoft\windows\CurrentVersion\Internet Settings |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer |
| HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_FIX_CHUNKED_PROXY_SCRIPT_DOWNLOAD_KB843289 |
| HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_URI_DISABLECACHE |
| HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DIGEST_NO_EXTRAS_IN_URI |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced |
| HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISALLOW_NULL_IN_RESPONSE_HEADERS |
| HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\SspiCache\credssp.dll |
| HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_PERMIT_CACHE_FOR_AUTHENTICATED_FTP_KB910274 |
| HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl |
| HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{2B0F765D-C0E9-4171-908E-08A611B84FF6}\PropertyBag |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults\ |
| HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Internet Explorer\Security |
| HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_EXCLUDE_INVALID_CLIENT_CERT_KB929477 |
| HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32 |
| HKEY_LOCAL_MACHINE\OSDATA\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags |
| HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN |
| HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_NOTIFY_UNVERIFIED_SPN_KB2385266 |
| HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Security |
| HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InprocHandler |
| HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\LocalServer32 |
| HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{a168aadc-1674-49da-ad4f-4f27df8760d0}\ProxyStubClsid32 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Rpc\Extensions |
| HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl |
| HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ENABLE_TOKEN_BINDING |
| HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SKIP_POST_RETRY_ON_INTERNETWRITEFILE_KB895954 |
| HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_HANDLING |
| HKEY_LOCAL_MACHINE\Software\Microsoft\COM3 |
| HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Main |
| HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_PRESERVE_SPACES_IN_FILENAMES_KB952730 |
| HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ALWAYS_USE_DNS_FOR_SPN_KB3022771 |
| HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\PolicyExtensions |
| HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173} |
| HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_HTTP_USERNAME_PASSWORD_DISABLE |
| HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SCH_SEND_AUX_RECORD_KB_2618444 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Rpc |
| HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DIGEST_NO_EXTRAS_IN_URI |
| HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{352481E8-33BE-4251-BA85-6007CAEDCF9D} |
| HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD} |
| HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer |
| HKEY_CURRENT_USER_Classes\Drive\shellex\FolderExtensions\{fbeb8a05-beee-4442-804e-409d6c4515e9} |
| HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C} |
| HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler |
| HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\MUI\StringCacheSettings |
| HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN |
| HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_FIX_CHUNKED_PROXY_SCRIPT_DOWNLOAD_KB843289 |
| HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_INCLUDE_PORT_IN_SPN_KB908209 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\SdbUpdates |
| HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_IGNORE_POLICIES_ZONEMAP_IF_ESC_ENABLED_KB918915 |
| HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Winsock\Setup Migration\Providers\Tcpip6 |
| HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer32 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags |
| HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4 |
| HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_COMPAT_USE_CONNECTION_BASED_NEGOTIATE_AUTH_KB2151543 |
| HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE |
| HKEY_CURRENT_USER_Classes\Drive\shellex\FolderExtensions |
| HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModelUnlock |
| HKEY_LOCAL_MACHINE\Software\Classes\Drive\shellex\FolderExtensions |
| HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_USE_CNAME_FOR_SPN_KB911149 |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Ole\FeatureDevelopmentProperties |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1 |
| HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\LocalServer |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2 |
| HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager |
| HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Appx |
| HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BYPASS_CACHE_FOR_CREDPOLICY_KB936611 |
| HKEY_LOCAL_MACHINE\Software\Classes\Drive\shellex\FolderExtensions\{fbeb8a05-beee-4442-804e-409d6c4515e9} |
| HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_USE_IETLDLIST_FOR_DOMAIN_DETERMINATION |
| HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\RETRY_HEADERONLYPOST_ONCONNECTIONRESET |
| HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_UNICODE_HANDLE_CLOSING_CALLBACK |
| HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_USE_CNAME_FOR_SPN_KB911149 |
| HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings |
| HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\RETRY_HEADERONLYPOST_ONCONNECTIONRESET |
| HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\ |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ |
| HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\TreatAs |
| HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLEAUT |
| HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Containers |
| HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_IGNORE_POLICIES_ZONEMAP_IF_ESC_ENABLED_KB918915 |
| HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONES_CHECK_ZONEMAP_POLICY_KB941001 |
| HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0 |
| HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\LanguageOverlay\OverlayPackages\en-US |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\KnownFolders |
| HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Winsock\Setup Migration\Providers |
| HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISALLOW_NULL_IN_RESPONSE_HEADERS |
| HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RETURN_FAILED_CONNECT_CONTENT_KB942615 |
| HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\TenantRestrictions\Payload |
| HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InprocHandler32 |
| HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_HANDLING |
| HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ENABLE_PASSPORT_SESSION_STORE_KB948608 |
| HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_PRESERVE_SPACES_IN_FILENAMES_KB952730 |
| HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Dnscache\Parameters\dnscache |
| HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_EXCLUDE_INVALID_CLIENT_CERT_KB929477 |
| HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SKIP_POST_RETRY_ON_INTERNETWRITEFILE_KB895954 |
| HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1 |
| HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\Elevation |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1 |
| HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_NOTIFY_UNVERIFIED_SPN_KB2385266 |
| HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\32\52C64B7E |
| HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ALWAYS_USE_DNS_FOR_SPN_KB3022771 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\OLE\AppCompat |
| HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Segment Heap |
| HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{352481E8-33BE-4251-BA85-6007CAEDCF9D}\PropertyBag |
| HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AppModel\Lookaside\user |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\OID |
| HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_USE_UTF8_FOR_BASIC_AUTH_KB967545 |
| HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_UNICODE_HANDLE_CLOSING_CALLBACK |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders |
| HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F1B32785-6FBA-4FCF-9D55-7B8E7F157091} |
| HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_URI_DISABLECACHE |
| HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SCH_SEND_AUX_RECORD_KB_2618444 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Security |
| HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Dnscache\Parameters |
| HKEY_LOCAL_MACHINE\Software\Microsoft\OLE\Tracing |
| HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ENABLE_TOKEN_BINDING |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3 |
| HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{2B0F765D-C0E9-4171-908E-08A611B84FF6} |
| HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Winsock\Setup Migration\Providers\Tcpip |
| HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ALLOW_REVERSE_SOLIDUS_IN_USERINFO_KB932562 |
| HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder |
| HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RETURN_FAILED_CONNECT_CONTENT_KB942615 |
| HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2 |
| HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs |
| HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Policies\Microsoft\Cryptography\Configuration |
| HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AppModel\Lookaside\machine |
| HKEY_LOCAL_MACHINE\Software\Microsoft\OLE |
Registry Set (Top 25)
| Key | Value |
|---|---|
| HKEY_USERS\S-1-5-21-575823232-3065301323-1442773979-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyServer | %HTTP_PROXY%:8080 |
| HKEY_USERS\S-1-5-21-575823232-3065301323-1442773979-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable | 1 |
| HKEY_USERS\S-1-5-21-575823232-3065301323-1442773979-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings | 46 00 00 00 04 01 00 00 03 00 00 00 14 00 00 00 65 78 74 72 61 63 74 6F 72 2E 70 72 6F 78 79 3A 38 30 38 30 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 D0 5C 01 4D C1 D5 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix | Cookie: |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect | 0x00000000 |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix | Visited: |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix | — |
| HKEY_LOCAL_MACHINE\Software\Microsoft\SystemCertificates\AuthRoot\AutoUpdate\LastSyncTime | \x7f\xf8\x11\xda\x82\x1d\xdc\x01 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\SystemCertificates\AuthRoot\AutoUpdate\DisallowedCertLastSyncTime | \x8f\x0e\x65\x72\xa0\x1d\xdc\x01 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\SystemCertificates\AuthRoot\AutoUpdate\PinRulesLastSyncTime | \x91\x82\x5a\x72\xa0\x1d\xdc\x01 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\SystemCertificates\AuthRoot\AutoUpdate\HpkpEncodedCtl | \x30\x81\xd9\x06\x09\x2a\x86\x48\x86\xf7\x0d\x01\x07\x02\xa0\x81\xcb\x30\x81\xc8\x02\x01\x01\x31\x00\x30\x81\xbe\x06\x09\x2b\x06\x01\x04\x01\x82\x37\x0a\x01\xa0\x81\xb0\x30\x81\xad\x30\x0c\x06\x0a\x2b\x06\x01\x04\x01\x82\x37\x0a\x03\x3c\x02\x08\x01\xdc\x1d\xa0\x72\x39\x7e\x78\x17\x0d\x32\x35\x30\x39\x30\x34\x31\x33\x33\x33\x30\x36\x5a\x30… |
| HKEY_LOCAL_MACHINE\Software\Microsoft\SystemCertificates\AuthRoot\AutoUpdate\EncodedCtl | \x30\x83\x02\xe4\xcf\x06\x09\x2a\x86\x48\x86\xf7\x0d\x01\x07\x02\xa0\x83\x02\xe4\xbf\x30\x83\x02\xe4\xba\x02\x01\x01\x31\x0f\x30\x0d\x06\x09\x60\x86\x48\x01\x65\x03\x04\x02\x01\x05\x00\x30\x83\x02\xd5\x28\x06\x09\x2b\x06\x01\x04\x01\x82\x37\x0a\x01\xa0\x83\x02\xd5\x18\x30\x83\x02\xd5\x13\x30\x0c\x06\x0a\x2b\x06\x01\x04\x01\x82\x37\x0a\x03… |
| HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Epoch2\Epoch | 0x00000009 |
| HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{a499fa48-7057-4ac1-9702-44c6fd924058}\DynamicInfo | \x03\x00\x00\x00\xfd\xb8\xb5\x15\x53\xec\xda\x01\xcf\x88\xa2\x5e\xa0\x1d\xdc\x01\x00\x00\x00\x00\x00\x00\x00\x00\x2c\xdb\xd0\x5e\xa0\x1d\xdc\x01 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileService\References\S-1-5-21-4226853953-3309226944-3078887307-1000\RefCount | \x06\x00\x00\x00 |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Notifications\Data\418A073AA3BC3475 | \xb9\x00\x00\x00\x00\x00\x00\x00\x04\x00\x04\x00\x01\x02\x06\x00\x00\x00\x00\x00\x05\x00\x00\x00\x6b\x50\x7e\x00\x02\x00\x00\x00\x87\xde\x83\x00\x02\x00\x00\x00\x90\xa6\xa1\x01\xa0\x02\x00\x00\xa1\x9f\x5e\x00\x04\x00\x00\x00\xdb\xb4\xef\x00\x01\x00\x00\x00\xfe\xd3\x7a\x00\x05\x00\x01\x00\x00\x00\x08\x00\x00\x00\x18\x7d\xc7\x00\xf9\x00\x00… |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Notifications\Data\418A073AA3BC4C75 | \x05\x00\x00\x00\x00\x00\x00\x00\x04\x00\x00\x00\x01\x01\x01\x00\x59\x0f\x1c\x01\x04\x00\x83\x00\x02\x00\x07\x80\x0b\x01\x24\x00\x66\x00\x66\x00\x73\x96\x00\x00\x00\x00\x38\x01\x24\x00\x66\x00\xf9\xf9\x09\x00\x76\x00\x00\x00\x59\x00\x00\x00\x73\x68\x65\x6c\x6c\x5c\x72\x6f\x61\x6d\x69\x6e\x67\x5c\x73\x65\x74\x74\x69\x6e\x67\x73\x79\x6e\x63… |
| HKEY_LOCAL_MACHINE\Software\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob | \x0f\x00\x00\x00\x01\x00\x00\x00\x14\x00\x00\x00\x3e\x8e\x64\x87\xf8\xfd\x27\xd3\x22\xa2\x69\xa7\x1e\xda\xac\x5d\x57\x81\x12\x86\x09\x00\x00\x00\x01\x00\x00\x00\x54\x00\x00\x00\x30\x52\x06\x08\x2b\x06\x01\x05\x05\x07\x03\x01\x06\x08\x2b\x06\x01\x05\x05\x07\x03\x02\x06\x08\x2b\x06\x01\x05\x05\x07\x03\x04\x06\x08\x2b\x06\x01\x05\x05\x07\x03… |
Services Started (Top 15)
| Service |
|---|
| WSearch |
| LxpSvc |
Services Opened (Top 15)
| Service |
|---|
| wscsvc |
What To Do Now — Practical Defense Playbook
- Contain unknowns: block first‑run binaries by default — signatures catch up, containment works now.
- EDR controls: alert on keyboard hooks, screen capture APIs, VM/sandbox checks, and command‑shell launches.
- Registry watch: flag queries/sets under policy paths (e.g., …\FipsAlgorithmPolicy\*).
- Network rules: inspect outbound TLS to IP‑lookup services and unexpected CDN endpoints.
- Hunt broadly: sweep endpoints for the indicators above and quarantine positives immediately.
Dwell time equals attacker opportunity. Reducing execution privileges and egress shrinks that window even when vendors disagree.