in registry, it seats here :
Computer\HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains
each record is a key
for example domain test.local will be :
Computer\HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\test.local\
Trolling the forum for dead threads while my wife is doing a kitchen project.
You could try this line of relevance in an analysis, and then pull it into a report.
unique values of following texts of lasts "\" of (it as string) of keys of keys "Domains" of keys "ZoneMap" of keys "Internet Settings" of keys "CurrentVersion" of keys "Windows" of keys "Microsoft" of keys "Software" of keys of keys "HKEY_USERS" of (x32 registry; x64 registry)