HKCU\SOFTWARE\Microsoft\Internet Explorer\* [*] HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\* [*] HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete\* [*] HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\* [*] HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Webcheck\* [*] HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\* [*] HKCU\SOFTWARE\Microsoft\Search Assistant\* [*] %CSIDL_LOCAL_APPDATA%\Microsoft\Internet Explorer\* [*] %CSIDL_LOCAL_APPDATA%\Microsoft\Windows\History\* [*] %CSIDL_APPDATA%\Microsoft\Windows\Cookies\* [*] %CSIDL_APPDATA%\Microsoft\Internet Explorer\* [*] HKCU\SOFTWARE\Microsoft\Internet Explorer\Default Behaviors\* [*] HKCU\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\* [*] HKCU\SOFTWARE\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\* [*] HKCU\SOFTWARE\Microsoft\Internet Explorer\Extensions\CmdMapping\* [*] HKCU\SOFTWARE\Microsoft\Internet Explorer\MenuExt\* [*] HKCU\SOFTWARE\Microsoft\Internet Explorer\Media\\MimeTypes\* [*] HKCU\SOFTWARE\Microsoft\Internet Explorer\Plugins\Extension\* [*] HKCU\SOFTWARE\Microsoft\Internet Explorer\Plugins\MIME\* [*] HKCU\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\* [*] HKCU\SOFTWARE\Microsoft\Internet Explorer\Toolbar\* [*] HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\* [*] HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\* [*] HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings [PrivacyAdvanced] HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1 [Flags] HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1 [Flags] HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 [1A10] HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 [{AEBA21FA-782A-4A90-978D-B72164C80120}] HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 [{A8A88C49-5EB2-4990-A1A2-0876022C854F}] HKCU\SOFTWARE\Microsoft\Internet Explorer\Security\AntiPhishing\* [*] HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings [SecureProtocols] HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\* [*] %CSIDL_QUICKLAUNCH%\* [*] HKCU\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter [EnabledV8] HKCU\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter [EnabledV9] HKCU\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{FAB3E735-69C7-453B-A446-B6823C6DF1C9} [*] HKCU\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{FAF199D2-BFA7-4394-A4DE-044A08E59B32} [*] HKCU\SOFTWARE\Microsoft\Internet Explorer\BrowserEmulation [MSCompatibilityMode] HKCU\SOFTWARE\Microsoft\Internet Explorer\Main [DoNotTrack] HKCU\SOFTWARE\Microsoft\Internet Explorer\CodeIntegrity [DynamicCodePolicy] MigXmlHelper.IsUpgrade() HKCU\Software\Microsoft\Internet Explorer\Styles [Use My Stylesheet] HKCU\Software\Microsoft\Internet Explorer\Styles [User Stylesheet] HKCU\Software\Microsoft\Internet Explorer\Desktop\General [*] HKCU\Software\Microsoft\Internet Explorer\Default HTML Editor\* [*] HKCU\Software\Microsoft\Internet Explorer\Default MHTML Editor\* [*] HKCU\Software\Microsoft\Internet Explorer\Main [Save Directory] %CSIDL_LOCAL_APPDATA%\Microsoft\Internet Explorer [MSIMGSIZ.dat] MigXmlHelper.IsUpgrade() HKCU\Software\Microsoft\Internet Explorer\Main [Check_Associations] HKLM\SOFTWARE\Microsoft\Internet Explorer\* [*] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\* [*] HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383} [IsInstalled] HKLM\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\InstallInfo [IconsVisible] HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\* [*] HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\NavigatorPluginsList\* [*] %WINDIR%\System32 [rsaci.rat] HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURLs\* [*] HKLM\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions\* [*] HKLM\SOFTWARE\Microsoft\Internet Explorer\Unattend\* [*] HKLM\SOFTWARE\Microsoft\Internet Explorer [Build] HKLM\SOFTWARE\Microsoft\Internet Explorer [Version] HKLM\SOFTWARE\Microsoft\Internet Explorer [W2kVersion] HKLM\SOFTWARE\Microsoft\Internet Explorer [svcVersion] HKLM\SOFTWARE\Microsoft\Internet Explorer [svcUpdateVersion] HKLM\SOFTWARE\Microsoft\Internet Explorer [svcKBNumber] HKLM\SOFTWARE\Microsoft\Internet Explorer [svcKBFWLink] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [EnableAutoUpgrade] HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\* [*] HKLM\SOFTWARE\Microsoft\Internet Explorer\Default Behaviors\* [*] HKLM\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\* [*] HKLM\SOFTWARE\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\* [*] HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\* [*] HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\CmdMapping\* [*] HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\* [*] HKLM\SOFTWARE\Microsoft\Internet Explorer\International\* [*] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Isolation] HKLM\SOFTWARE\Microsoft\Internet Explorer\MenuExt\* [*] HKLM\SOFTWARE\Microsoft\Internet Explorer\Media\\MimeTypes\* [*] HKLM\SOFTWARE\Microsoft\Internet Explorer\Plugins\Extension\* [*] HKLM\SOFTWARE\Microsoft\Internet Explorer\Plugins\MIME\* [*] HKLM\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\* [*] HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\* [*] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings [MinorVersion] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\SO\* [*] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\TemplatePolicies\* [*] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\* [*] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1 [Flags] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\* [*] HKLM\SOFTWARE\Microsoft\Internet Explorer\Capabilities\UrlAssociations [gopher] HKLM\SOFTWARE\Microsoft\Internet Explorer\Capabilities\Roaming\ExcludedUrls\* [*] HKLM\SOFTWARE\Microsoft\Internet Explorer\Version Vector\* [*] HKLM\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter [EnabledV8] HKLM\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter [EnabledV9] HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{0002df01-0000-0000-c000-000000000046} HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{FAB3E735-69C7-453B-A446-B6823C6DF1C9} [*] HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{FAF199D2-BFA7-4394-A4DE-044A08E59B32} [*] HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5b71395d-ff8a-4ebc-bca3-abbb32790bec}\* [*] HKLM\SOFTWARE\Microsoft\Internet Explorer\BrowserEmulation [MSCompatibilityMode] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [DoNotTrack] [Policy] MigXmlHelper.IsUpgrade() HKLM\SOFTWARE\Microsoft\Internet Explorer\View Source Editor [Editor Name] HKLM\SOFTWARE\Microsoft\Internet Explorer [BrandGUID] MigXmlHelper.IsUpgrade() MigXmlHelper.DoesObjectExist("Registry", "HKLM\SOFTWARE\Microsoft\Internet Explorer [BrandGUID]") MigXmlHelper.DoesObjectExist("Registry", "HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\%InternetExplorer.BrandGUID%") HKLM\SOFTWARE\Microsoft\Internet Explorer [BrandGUID] HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\%InternetExplorer.BrandGUID%\* [*] Network_and_Internet\Internet_Options