Python bytecode cryptor with ransom note: cryptor.pyc:0x370d
Python bytecode recursive encrypt with note: cryptor.pyc:0x399a
Decrypt note paired with cryptor extension: cryptor.pyc
virussign.com_3e1da925fa3fb644a2684599ef1b09f0.vir
pe
| 0x2dfd8 |
65006400200074006f00200069006d00 |
e.d. .t.o. .i.m. |
| 0x2dfe8 |
70006f00720074002000730079006d00 |
p.o.r.t. .s.y.m. |
| 0x2dff8 |
62006f006c0020002500680073002000 |
b.o.l. .%.h.s. . |
| 0x2e008 |
660072006f006d002000540063006c00 |
f.r.o.m. .T.c.l. |
| 0x2e018 |
200044004c004c002e000a0000000000 |
.D.L.L......... |
| 0x2e028 |
54636c5f496e69740000000000000000 |
Tcl_Init........ |
| 0x2e038 |
54636c5f437265617465496e74657270 |
Tcl_CreateInterp |
| 0x2e048 |
000000000000000054636c5f46696e64 |
........Tcl_Find |
| 0x2e058 |
45786563757461626c65000000000000 |
Executable...... |
| 0x2e068 |
54636c5f446f4f6e654576656e740000 |
Tcl_DoOneEvent.. |
| 0x2e078 |
54636c5f46696e616c697a6500000000 |
Tcl_Finalize.... |
| 0x2e088 |
54636c5f46696e616c697a6554687265 |
Tcl_FinalizeThre |
| 0x2e098 |
616400000000000054636c5f44656c65 |
ad......Tcl_DeleModify memory page protection |
| 0x2e0a8 |
7465496e746572700000000000000000 |
teInterp........ |
| 0x2e0b8 |
54636c5f437265617465546872656164 |
Tcl_CreateThread |
| 0x2e0c8 |
000000000000000054636c5f47657443 |
........Tcl_GetC |
| 0x2e0d8 |
757272656e7454687265616400000000 |
urrentThread.... |
| 0x2e0e8 |
54636c5f4a6f696e5468726561640000 |
Tcl_JoinThread.. |
| 0x2e0f8 |
54636c5f4d757465784c6f636b000000 |
Tcl_MutexLock... |
| 0x2e108 |
54636c5f4d75746578556e6c6f636b00 |
Tcl_MutexUnlock. |
| 0x2e118 |
54636c5f4d7574657846696e616c697a |
Tcl_MutexFinaliz |
| 0x2e128 |
650000000000000054636c5f436f6e64 |
e.......Tcl_Cond |
| 0x2e138 |
6974696f6e46696e616c697a65000000 |
itionFinalize... |
| 0x2e148 |
54636c5f436f6e646974696f6e4e6f74 |
Tcl_ConditionNot |
| 0x2e158 |
696679000000000054636c5f436f6e64 |
ify.....Tcl_Cond |
| 0x2e168 |
6974696f6e5761697400000000000000 |
itionWait....... |
| 0x2e178 |
54636c5f546872656164517565756545 |
Tcl_ThreadQueueE |
| 0x2e188 |
76656e740000000054636c5f54687265 |
vent....Tcl_Thre |
| 0x2e198 |
6164416c6572740054636c5f47657456 |
adAlert.Tcl_GetV |
| 0x2e1a8 |
617232000000000054636c5f53657456 |
ar2.....Tcl_SetV |
| 0x2e1b8 |
617232000000000054636c5f556e7365 |
ar2.....Tcl_Unse |
| 0x2e1c8 |
745661723200000054636c5f43726561 |
tVar2...Tcl_Crea |
| 0x2e1d8 |
74654f626a436f6d6d616e6400000000 |
teObjCommand.... |
| 0x2e1e8 |
54636c5f476574537472696e67000000 |
Tcl_GetString... |
| 0x2e1f8 |
54636c5f4e6577537472696e674f626a |
Tcl_NewStringObj |
| 0x2e208 |
000000000000000054636c5f4e657742 |
........Tcl_NewB |
| 0x2e218 |
79746541727261794f626a0000000000 |
yteArrayObj..... |
| 0x2e228 |
54636c5f536574566172324578000000 |
Tcl_SetVar2Ex... |
| 0x2e238 |
54636c5f4765744f626a526573756c74 |
Tcl_GetObjResult |
| 0x2e248 |
000000000000000054636c5f5365744f |
........Tcl_SetO |
| 0x2e258 |
626a526573756c740000000000000000 |
bjResult........ |
| 0x2e268 |
54636c5f4576616c46696c6500000000 |
Tcl_EvalFile.... |
| 0x2e278 |
54636c5f4576616c4578000000000000 |
Tcl_EvalEx...... |
| 0x2e288 |
54636c5f4576616c4f626a7600000000 |
Tcl_EvalObjv.... |
| 0x2e298 |
54636c5f416c6c6f6300000000000000 |
Tcl_Alloc....... |
| 0x2e2a8 |
54636c5f467265650000000000000000 |
Tcl_Free........ |
| 0x2e2b8 |
546b5f496e6974004600610069006c00 |
Tk_Init.F.a.i.l. |
| 0x2e2c8 |
65006400200074006f00200069006d00 |
e.d. .t.o. .i.m. |
| 0x2eb00 |
6f20636f6e7665727420444c4c207365 |
o convert DLL se |
| 0x2eb10 |
617263682070617468210a0000000000 |
arch path!...... |
| 0x2eb20 |
7079692d707974686f6e2d666c616700 |
pyi-python-flag. |
| 0x2eb30 |
50795f47494c5f44495341424c454400 |
Py_GIL_DISABLED. |
| 0x2eb40 |
7079692d72756e74696d652d746d7064 |
pyi-runtime-tmpdPyInstaller onefile temp bootstrap |
| 0x2eb50 |
69720000000000007079692d636f6e74 |
ir......pyi-contPyInstaller onefile temp extraction stage |
| 0x2eb60 |
656e74732d6469726563746f72790000 |
ents-directory.. |
| 0x2eb70 |
7079692d64697361626c652d77696e64 |
pyi-disable-wind |
| 0x2eb80 |
6f7765642d74726163656261636b0000 |
owed-traceback.. |
| 0x2eb90 |
4661696c656420746f206c6f61642073 |
Failed to load s |
| 0x2eba0 |
706c6173682073637265656e20726573 |
plash screen res |
| 0x2ebb0 |
6f7572636573210a0000000000000000 |
ources!......... |
| 0x2ebc0 |
4661696c656420746f20756e7061636b |
Failed to unpack |
| 0x2ebd0 |
2073706c6173682073637265656e2064 |
splash screen d |
| 0x2ebe0 |
6570656e64656e63696573206672 |
ependencies fr |
| 0x2ed90 |
74002000650078006500630075007400 |
t. .e.x.e.c.u.t. |
| 0x2eda0 |
610062006c0065002000700061007400 |
a.b.l.e. .p.a.t. |
| 0x2edb0 |
6800200074006f002000550054004600 |
h. .t.o. .U.T.F. |
| 0x2edc0 |
2d0038002e000a000000000000000000 |
-.8............. |
| 0x2edd0 |
436f756c64206e6f74206c6f61642050 |
Could not load PPyInstaller onefile temp bootstrap |
| 0x2ede0 |
79496e7374616c6c6572277320656d62 |
yInstaller's emb |
| 0x2edf0 |
656464656420504b4720617263686976 |
edded PKG archiv |
| 0x2ee00 |
652066726f6d20746865206578656375 |
e from the execu |
| 0x2ee10 |
7461626c6520282573290a0000000000 |
table (%s)...... |
| 0x2ee20 |
436f756c64206e6f7420736964652d6c |
Could not side-l |
| 0x2ee30 |
6f6164205079496e7374616c6c657227 |
oad PyInstaller' |
| 0x2ee40 |
7320504b472061726368697665206672 |
s PKG archive fr |
| 0x2ee50 |
6f6d2065787465726e616c2066696c65 |
om external file |
| 0x2ee60 |
20282573290a00004d6178696d756d20 |
(%s)...Maximum |
| 0x2ee70 |
6172636869766520706f6f6c2073697a |
archive pool siz |
| 0x2ee80 |
65207265616368656421000000000000 |
e reached!...... |
| 0x2ee90 |
4661696c656420746f20 |
Failed to |
| 0x2f010 |
756e6275666665726564000000000000 |
unbuffered...... |
| 0x2f020 |
6f7074696d697a650000000057200000 |
optimize....W .. |
| 0x2f030 |
5820000000000000686173685f736565 |
X ......hash_see |
| 0x2f040 |
64000000757466380000000064657600 |
d...utf8....dev. |
| 0x2f050 |
25735c626173655f6c6962726172792e |
%s\base_library.PyInstaller onefile temp bootstrap |
| 0x2f060 |
7a6970000000000025735c707974686f |
zip.....%s\pytho |
| 0x2f070 |
6e25642e25645c6c69622d64796e6c6f |
n%d.%d\lib-dynlo |
| 0x2f080 |
616400000000000070726f6772616d5f |
ad......program_ |
| 0x2f090 |
6e616d65000000004661696c65642074 |
name....Failed t |
| 0x2f0a0 |
6f207365742070726f6772616d206e61 |
o set program na |
| 0x2f0b0 |
6d653a2025730a00686f6d6500000000 |
me: %s..home.... |
| 0x2f0c0 |
4661696c656420746f20736574207079 |
Failed to set py |
| 0x2f0d0 |
74686f6e20686f6d6520706174683a20 |
thon home path: |
| 0x2f0e0 |
25730a |
%s. |
| 0x2f69e |
7420656d62656464656420707974686f |
t embedded pytho |
| 0x2f6ae |
6e20696e746572707265746572210a00 |
n interpreter!.. |
| 0x2f6be |
000073747269637400007574662d3800 |
..strict..utf-8. |
| 0x2f6ce |
00004661696c656420746f2067657420 |
..Failed to get |
| 0x2f6de |
5f4d4549504153532061732050794f62 |
_MEIPASS as PyObPyInstaller onefile temp extraction stage |
| 0x2f6ee |
6a6563742e0a000000005f4d45495041 |
ject......_MEIPA |
| 0x2f6fe |
535300000000000000004661696c6564 |
SS........Failed |
| 0x2f70e |
20746f20756e6d61727368616c20636f |
to unmarshal co |
| 0x2f71e |
6465206f626a65637420666f72206d6f |
de object for mo |
| 0x2f72e |
64756c65202573210a004d6f64756c65 |
dule %s!..Module |
| 0x2f73e |
206f626a65637420666f722025732069 |
object for %s i |
| 0x2f74e |
73204e554c4c210a00005f7079696e73 |
s NULL!..._pyins |
| 0x2f75e |
74616c6c65725f70797a000000000000 |
taller_pyz...... |
| 0x2f76e |
000050595a206172636869766520656e |
..PYZ archive enPyInstaller onefile temp bootstrap |
| 0x2f77e |
747279206e6f7420666f756e6420696e |
try not found in |
| 0x2f78e |
2074686520544f43210a000000000000 |
the TOC!....... |
| 0x2f79e |
000025553f256c6c75004661696c6564 |
..%U?%llu.Failed |
| 0x2f7ae |
20746f20666f726d61742050595a2061 |
to format PYZ a |
| 0x2f7be |
726368697665207061746820616e6420 |
rchive path and |
| 0x2f7ce |
6f66667365740a0000004661696c6564 |
offset....Failed |
| 0x2f7de |
20746f2073746f726520706174682074 |
to store path t |
| 0x2f7ee |
6f2050595a206172636869766520696e |
o PYZ archive in |
| 0x2f7fe |
746f207379732e2573210a0000000000 |
to sys.%s!...... |
| 0x2f80e |
000053504c4153483a |
..SPLASH: |