Re: EVP unpacker usage without limit -- fix
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed"=hex:c7,9f,bc,3e,79,0b,d3,de,0c,b4,7a,bf,76,3d,78,b0,fa,a9,3c,87,2f,18,\
a6,ec,14,4e,2f,c7,2b,74,31,4b,2d,e3,f5,fb,74,09,85,54,76,9c,2f,8e,30,a4,29,\
4a,4b,64,c0,74,64,da,54,f1,1e,41,90,e8,33,b7,6f,4b,c0,ab,75,4e,4a,64,46,57,\
11,21,0e,47,e7,2e,30,1e
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\S-1-5-21-1409082233-436374069-1177238915-500\Extension-List\{00000000-0000-0000-0000-000000000000}]
"StartTimeLo"=dword:6543ee58
"StartTimeHi"=dword:01cadfb9
"EndTimeLo"=dword:6543ee58
"EndTimeHi"=dword:01cadfb9
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\LastVisitedMRU]
"MRUList"="ladbkgijhcfe"
"l"=hex:52,00,65,00,67,00,73,00,68,00,6f,00,74,00,2e,00,65,00,78,00,65,00,00,\
00,43,00,3a,00,5c,00,44,00,6f,00,63,00,75,00,6d,00,65,00,6e,00,74,00,73,00,\
20,00,61,00,6e,00,64,00,20,00,53,00,65,00,74,00,74,00,69,00,6e,00,67,00,73,\
00,5c,00,41,00,64,00,6d,00,69,00,6e,00,69,00,73,00,74,00,72,00,61,00,74,00,\
6f,00,72,00,5c,00,4c,68,62,97,5c,00,72,00,65,00,67,00,73,00,68,00,6f,00,74,\
00,33,00,32,00,43,00,48,00,53,00,5c,00,72,00,65,00,67,00,73,00,68,00,6f,00,\
74,00,33,00,32,00,00,00
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\*]
"MRUList"="cbhajiefgd"
"c"="C:\\Documents and Settings\\Administrator\\桌面\\regshot32CHS\\regshot32\\1.hive"
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\hive]
"a"="C:\\Documents and Settings\\Administrator\\桌面\\regshot32CHS\\regshot32\\1.hive"
"MRUList"="a"
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count]
"HRZR_HVFPHG"=hex:0f,00,00,00,8d,01,00,00,50,e1,e6,7c,b9,df,ca,01
"HRZR_EHACNGU"=hex:0f,00,00,00,a9,03,00,00,d0,e8,81,7d,b9,df,ca,01
"HRZR_EHACNGU
:\\Qbphzragf naq Frggvatf\\Nqzvavfgengbe\\桌面\\RicRqvgbe\\RicRqvgbe.rkr"=hex:0f,\
00,00,00,06,00,00,00,d0,e8,81,7d,b9,df,ca,01
[HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\BagMRU]
"MRUListEx"=hex:12,00,00,00,14,00,00,00,01,00,00,00,00,00,00,00,13,00,00,00,11,\
00,00,00,08,00,00,00,0c,00,00,00,0f,00,00,00,04,00,00,00,10,00,00,00,0e,00,\
00,00,0d,00,00,00,0b,00,00,00,0a,00,00,00,09,00,00,00,06,00,00,00,07,00,00,\
00,02,00,00,00,05,00,00,00,03,00,00,00,ff,ff,ff,ff
[HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"C:\\Documents and Settings\\Administrator\\桌面\\EvpEditor\\EvpEditor.exe"="TODO: <文件说明>"
[HKEY_CURRENT_USER\Software\Classes\Oz9cbi03]
[HKEY_CURRENT_USER\Software\Classes\Oz9cbi03\AimVfPyc]
@=hex:48,fa,67,06,f6,d5,51,be,38,4b,d1,91,32,7e,e0,8c,60,a7,77,fb,6c,0e,10,7c,\
53,c0,61,31,f3,47,d2,5d,f3,95,64,33,fc,7d,ed,74,6e,f3,63,06,f5,d5,3e,be,2c,\
4b,c6,91,ff,7e,ec,8b,86,a0,73,fb,6b,0e,fd,7c,47,c0,56,31,c0,47,de,5c,f2,95,\
64,33,fc,7d,ed,74,d4,73,9c,43,45,d0,e1,cf,09,fc,8d,89,4e,f5,43,90
[HKEY_CURRENT_USER\SessionInformation]
"ProgramCount"=dword:00000006
HELP ME T_T