Application Specific

Extracts Search Assistant entries from NTUser hive

Extracts the Internet Explorer anti‑phishing registry hive under NTUser hive

Extracts metadata about each downloaded artifact, including its URL, server IP, size, timestamps and signing status