| | Registry Key | Value Name | Value Data |
 | HKEY_CLASSES_ROOT\CLSID\{00A6FAF1-072E-44cf-8957-5838F569A31D} | | |
 | HKEY_CLASSES_ROOT\CLSID\{00A6FAF1-072E-44cf-8957-5838F569A31D} | | mywebsearch search assistant bho |
 | HKEY_CLASSES_ROOT\CLSID\{00A6FAF1-072E-44cf-8957-5838F569A31D}\InprocS erver32 | | |
 | HKEY_CLASSES_ROOT\CLSID\{00A6FAF1-072E-44cf-8957-5838F569A31D}\InprocS erver32 | | %SYSTEMDRIVE%\data\8965254e205f2696b019c 651f8993b27.exe |
 | HKEY_CLASSES_ROOT\CLSID\{00A6FAF1-072E-44cf-8957-5838F569A31D}\InprocS erver32 | ThreadingModel | apartment |
 | HKEY_CLASSES_ROOT\CLSID\{00A6FAF1-072E-44cf-8957-5838F569A31D}\Program mable | | |
 | HKEY_CLASSES_ROOT\CLSID\{00A6FAF6-072E-44cf-8957-5838F569A31D} | | |
 | HKEY_CLASSES_ROOT\CLSID\{00A6FAF6-072E-44cf-8957-5838F569A31D}\InprocS erver32 | | |
 | HKEY_CLASSES_ROOT\CLSID\{00A6FAF6-072E-44cf-8957-5838F569A31D}\InprocS erver32 | | %SYSTEMDRIVE%\data\8965254e205f2696b019c 651f8993b27.exe |
 | HKEY_CLASSES_ROOT\CLSID\{00A6FAF6-072E-44cf-8957-5838F569A31D}\InprocS erver32 | ThreadingModel | apartment |
 | HKEY_CLASSES_ROOT\CLSID\{00A6FAF6-072E-44cf-8957-5838F569A31D}\Program mable | | |
 | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlSearchHooks | {00A6FAF6-072E-44cf-8957-5838F569A31D} | |
 | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlSearchHooks | {CFBFAE00-17A6-11D0-99CB-00C04FD64497} | |
 | HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\ Browser Helper Objects\{00A6FAF1-072E-44cf-8957-5838F569A31D} | | |
 | HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\ Browser Helper Objects\{00A6FAF1-072E-44cf-8957-5838F569A31D} | | mywebsearch search assistant bho |
 | HKEY_LOCAL_MACHINE\Software\MyWebSearch\SearchAssistant | | |
 | HKEY_LOCAL_MACHINE\Software\MyWebSearch\SearchAssistant | esh | 1 |
 | HKEY_LOCAL_MACHINE\Software\MyWebSearch\SearchAssistant | LastRequest | [reg_binary, size: 8 bytes] |
 | HKEY_LOCAL_MACHINE\Software\MyWebSearch\SearchAssistant | lsp | |
 | HKEY_LOCAL_MACHINE\Software\MyWebSearch\SearchAssistant | NextRequest | [reg_binary, size: 8 bytes] |