HookQQ
Overview
overview
3Static
static
3KillQQAd 1...ay.exe
windows7-x64
3KillQQAd 1...ay.exe
windows10-2004-x64
3KillQQAd 1...Ad.dll
windows7-x64
3KillQQAd 1...Ad.dll
windows10-2004-x64
3KillQQAd 1...QQ.dll
windows7-x64
3KillQQAd 1...QQ.dll
windows10-2004-x64
3KillQQAd 1...il.dll
windows7-x64
3KillQQAd 1...il.dll
windows10-2004-x64
3Static task
static1
Behavioral task
behavioral1
Sample
KillQQAd 1.0.0.40/HKDlls/KQAdTray.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
KillQQAd 1.0.0.40/HKDlls/KQAdTray.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
KillQQAd 1.0.0.40/HKDlls/KillQQAd.dll
Resource
win7-20240729-en
Behavioral task
behavioral4
Sample
KillQQAd 1.0.0.40/HKDlls/KillQQAd.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
KillQQAd 1.0.0.40/HookQQ.dll
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
KillQQAd 1.0.0.40/HookQQ.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
KillQQAd 1.0.0.40/KernelUtil.dll
Resource
win7-20240729-en
Behavioral task
behavioral8
Sample
KillQQAd 1.0.0.40/KernelUtil.dll
Resource
win10v2004-20240802-en
General
-
Target
d71ce04bfcbe0878213a4d901ba8e20e_JaffaCakes118
-
Size
2.2MB
-
MD5
d71ce04bfcbe0878213a4d901ba8e20e
-
SHA1
1aed01d751c248944ed36ff665b9a734ce508d2b
-
SHA256
8bcd6e964c32848aeddf4dc18647236c23c65fcfee4ec0af9fc29558428c4965
-
SHA512
3ea0d5270a00ce50f7301244a550e1fc742066a2330cf447edf0f14c3a271313c6f89d520da12e37af4b1c27e9f359ea6473bfdcf448b3c936252ba6fbfe80b2
-
SSDEEP
49152:8KBxe2wxpNecKbvm/YF/iIZm531AxVrn9OgeK1jB+aqMPLqbLgubsT4VCzuaxX3p:PEx7e4i/s3fKVHqMPLqXguQ0VCr3MO2i
Malware Config
Signatures
-
Unsigned PE 4 IoCs
Checks for missing Authenticode signature.
resource unpack001/KillQQAd 1.0.0.40/HKDlls/KQAdTray.exe unpack001/KillQQAd 1.0.0.40/HKDlls/KillQQAd.dll unpack001/KillQQAd 1.0.0.40/HookQQ.dll unpack001/KillQQAd 1.0.0.40/KernelUtil.dll
Files
-
d71ce04bfcbe0878213a4d901ba8e20e_JaffaCakes118.rar
-
KillQQAd 1.0.0.40/HKDlls/CoralWry.dat
-
KillQQAd 1.0.0.40/HKDlls/KQAdTray.exe.exe windows:4 windows x86 arch:x86
7c70960c10176052975d978c121fac90
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree
user32
UpdateWindow
gdi32
SetWindowExtEx
comdlg32
GetFileTitleA
winspool.drv
OpenPrinterA
advapi32
RegCreateKeyExA
shell32
ShellExecuteA
comctl32
ImageList_Destroy
oledlg
ord8
ole32
CoFreeUnusedLibraries
olepro32
ord253
oleaut32
SysAllocStringByteLen
psapi
GetModuleInformation
Sections
.text Size: 127KB - Virtual size: 372KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 48KB - Virtual size: 52KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
KillQQAd 1.0.0.40/HKDlls/KillQQAd.dll.dll windows:4 windows x86 arch:x86
9bbfe7f8b664db1dcdfd6e46f5396b2d
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree
user32
GetSysColor
gdi32
SelectObject
comdlg32
GetFileTitleA
winspool.drv
ClosePrinter
shell32
Shell_NotifyIconW
comctl32
ord17
shfolder
SHGetFolderPathA
ws2_32
recv
psapi
GetModuleInformation
gdiplus
GdipCloneBrush
ole32
CoLoadLibrary
Sections
.text Size: 72KB - Virtual size: 192KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 512B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
KillQQAd 1.0.0.40/HKDlls/KillQQAd.ini
-
KillQQAd 1.0.0.40/HKDlls/KillQQAd.xml.xml
-
KillQQAd 1.0.0.40/HKDlls/Version.ini
-
KillQQAd 1.0.0.40/HKPatch/KillQQAd.hki
-
KillQQAd 1.0.0.40/HookQQ.dll.dll windows:5 windows x86 arch:x86
201beb53817b2cbdccbabc43baccbc91
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree
shlwapi
PathFindFileNameA
oleacc
CreateStdAccessibleObject
psapi
GetModuleInformation
user32
wsprintfA
gdi32
RestoreDC
winspool.drv
DocumentPropertiesA
comdlg32
GetFileTitleA
ole32
CoLoadLibrary
oleaut32
VariantClear
Exports
Exports
Sections
.text Size: 90KB - Virtual size: 260KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 512B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
KillQQAd 1.0.0.40/KernelUtil.dll.dll regsvr32 windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
h:\Hummer\platform_QQ1.46\Basic_HummerPlatform_VOB\Platform_fr\Output\bin\KernelUtil.pdb
Exports
Exports
??0CCcSeqManager@@QAE@ABV0@@Z
??0CCcSeqManager@@QAE@XZ
??0CDRStrCodecBase@@QAE@XZ
??0CResultCollection@@QAE@ABV0@@Z
??0CResultCollection@@QAE@XZ
??0CTXCCProtocolStrategy@@QAE@ABV0@@Z
??0CTXCCProtocolStrategy@@QAE@XZ
??0CTXDataReportCodecBase@@QAE@XZ
??1CCcSeqManager@@QAE@XZ
??1CDRStrCodecBase@@UAE@XZ
??1CResultCollection@@QAE@XZ
??1CTXCCProtocolStrategy@@UAE@XZ
??1CTXDataReportCodecBase@@UAE@XZ
??4CCcSeqManager@@QAEAAV0@ABV0@@Z
??4CTXCCProtocolStrategy@@QAEAAV0@ABV0@@Z
??_7CTXCCProtocolStrategy@@6B@
?AddItem@CResultCollection@@QAEXK@Z
?AddOneFaildAgreementInfo@DataReport@Util@@YAJGGEEG@Z
?AddRef@CDRStrCodecBase@@MAGKXZ
?AddReport@URL@Util@@YA?AVCTXStringW@@ABV3@0@Z
?AddToRecentCommList@Misc@Util@@YAXKE@Z
?AdjustData4CompatMobile@Contact@Util@@YAJKPAUITXDataRead@@PAUITXData@@@Z
?AdjustType4CompatMobile@Contact@Util@@YAJKEAAE@Z
?AdjustUrl@URL@Util@@YA?AVCTXStringW@@ABV3@W4URLMODIFYLEVEL@12@0@Z
?Call@CAsyncCallHelper@@QAE_NPAUITXCallback@@@Z
?ChangeConfig@CTXDataReportCodecBase@@IAEX_N@Z
?CheckKeyID@SvrSeal@Util@@YAHEPAUITXEncrypt@@@Z
?CheckMsgImage@Group@Util@@YAHPAUITXMsgPack@@AAVCTXStringW@@@Z
?CheckUinValid@Misc@Util@@YAHPA_W@Z
?CodeAddBuffer@CTXDataReportCodecBase@@IAEXEPAUITXBuffer@@@Z
?CodeBuf@CDRStrCodecBase@@IAEXEPB_W@Z
?CodeBuffer@CTXDataReportCodecBase@@IAEXEPB_WK@Z
?CodeByte@CDRStrCodecBase@@IAEXEPB_W@Z
?CodeByte@CTXDataReportCodecBase@@IAEXEPB_W@Z
?CodeByteEx@CTXDataReportCodecBase@@IAEXEPB_WE_N1@Z
?CodeChar@CDRStrCodecBase@@IAEXEPB_W@Z
?CodeChar@CTXDataReportCodecBase@@IAEXEPB_W@Z
?CodeCharEx@CTXDataReportCodecBase@@IAEXEPB_WD_N1@Z
?CodeDWord@CDRStrCodecBase@@IAEXEPB_W@Z
?CodeDWord@CTXDataReportCodecBase@@IAEXEPB_W@Z
?CodeDWordEx@CTXDataReportCodecBase@@IAEXEPB_WK_N1@Z
?CodeEnd@CDRStrCodecBase@@IAEXXZ
?CodeInt@CDRStrCodecBase@@IAEXEPB_W@Z
?CodeInt@CTXDataReportCodecBase@@IAEXEPB_W@Z
?CodeIntEx@CTXDataReportCodecBase@@IAEXEPB_WH_N1@Z
?CodeShort@CDRStrCodecBase@@IAEXEPB_W@Z
?CodeShort@CTXDataReportCodecBase@@IAEXEPB_W@Z
?CodeShortEx@CTXDataReportCodecBase@@IAEXEPB_WF_N1@Z
?CodeStr@CDRStrCodecBase@@IAEXEPB_W@Z
?CodeWord@CDRStrCodecBase@@IAEXEPB_W@Z
?CodeWord@CTXDataReportCodecBase@@IAEXEPB_W@Z
?CodeWordEx@CTXDataReportCodecBase@@IAEXEPB_WG_N1@Z
?CodecTLV@CTXDataReportCodecBase@@UAGJKPAUITXData@@PAPAUITXBuffer@@@Z
?ConvertBmpToJpg@CustomFaceHelper@@YAHPA_WAAVCTXStringW@@@Z
?ConvertBmpToJpg@Group@Util@@YAHPA_WAAVCTXStringW@@@Z
?ConvertCharFormatMsgPackToRichEdit@Msg@Util@@YAHPAUITXDataRead@@AAU_charformatw@@@Z
?ConvertCharFormatRichEditToMsgPack@Msg@Util@@YAHABU_charformatw@@PAPAUITXData@@@Z
?ConvertGenderIndexToStr@Misc@Util@@YA?AVCTXStringW@@E@Z
?ConvertGenderIndexToUIIndex@Misc@Util@@YAHE@Z
?ConvertHeadIndexLocalToSvr@Misc@Util@@YAGG@Z
?ConvertHeadIndexSvrToLocal@Misc@Util@@YAGG@Z
?ConvertHeadIndexSvrToStatus@Misc@Util@@YAGG@Z
?ConvertIndexToMsgType@Group@Util@@YAHH@Z
?ConvertMsgTypeToIndex@Group@Util@@YAHH@Z
?ConvertNewClientType@Contact@Util@@YAXKAAE00@Z
?ConvertOldClientTypeEx@Contact@Util@@YAXEAAE00@Z
?ConvertUIIndexToGender@Misc@Util@@YAEH@Z
?CreateDiscuss@Group@Util@@YAJPAUITXData@@PAUITXCallback@@AAVCTXStringW@@K@Z
?CreateDiscussForSelect@Group@Util@@YAJPAUITXArray@@PAUITXCallback@@@Z
?CreateMsgPack@Msg@Util@@YAHPAPAUITXMsgPack@@@Z
?CreateQQParams@Misc@Util@@YAHPAPAUIQQParams@@@Z
?CreateSvrSeal@SvrSeal@Util@@YAJEPAPAUITXIMSvrSealCrypto@@@Z
?DRCodecStr@CDRStrCodecBase@@UAGJEPAUITXData@@PAPA_W@Z
?DecodeBody@CTXCCProtocolStrategy@@UAEHPAUITXCmdCodec@@PAUITXData@@PAPAU3@@Z
?DecodePacket@CTXCCProtocolStrategy@@UAEHPBEHAAKAAG2@Z
?DelOldVerPluginRegDomain@Misc@Util@@YAHABVCTXStringW@@@Z
?DumpString@CTXDataReportCodecBase@@IAEXXZ
?EncodePacket@CTXCCProtocolStrategy@@UAEHGGKPAUITXData@@PAUITXCmdCodec@@AAVCTXBuffer@@@Z
?FixAge@Misc@Util@@YAEE@Z
?FixStr@Misc@Util@@YAXAAVCTXStringW@@@Z
?Get32ByteValueAddedSign@Misc@Util@@YA?AVCTXStringW@@XZ
?GetAccountInfo@Account@Util@@YAXKPAPAUITXDataRead@@@Z
?GetAccountInfoFromValue@Account@Util@@YAXVCTXStringW@@PAPAUITXDataRead@@@Z
?GetAccountName@Account@Util@@YA?AVCTXStringW@@K@Z
?GetAccountStatus@Account@Util@@YAEK@Z
?GetAccountType@Account@Util@@YAEK@Z
?GetAccountValue@Account@Util@@YA?AVCTXStringW@@K@Z
?GetAllGroupUnifyMsgType@Group@Util@@YAEXZ
?GetBufferOut@CTXDataReportCodecBase@@IAEJPAPAUITXBuffer@@@Z
?GetBuildVer@Version@@YAKXZ
?GetByteFromBuffer@RichStatusHelper@@YAHABVCTXBuffer@@IAAEAAI@Z
?GetByteFromBufferNoLen@RichStatusHelper@@YAHABVCTXBuffer@@IAAEAAI@Z
?GetClientType@Version@@YAKXZ
?GetCombineName@Contact@Util@@YA?AVCTXStringW@@K@Z
?GetCombineName@Contact@Util@@YA?AVCTXStringW@@KV3@@Z
?GetCombineName@Contact@Util@@YA?AVCTXStringW@@V3@0@Z
?GetDWordFromBuffer@RichStatusHelper@@YAHABVCTXBuffer@@IAAKAAI@Z
?GetDataDWord@DataReport@Util@@YAJKPB_WAAK@Z
?GetDiscussHeadFile@Group@Util@@YA?AVCTXStringW@@XZ
?GetDiscussMemCombineName@Group@Util@@YA?AVCTXStringW@@KK@Z
?GetDiscussMemShowName@Group@Util@@YA?AVCTXStringW@@KK@Z
?GetDiscussMemStatus@Group@Util@@YAGKK@Z
?GetDiscussMsgType@Group@Util@@YAKK@Z
?GetDiscussName@Group@Util@@YA?AVCTXStringW@@K@Z
?GetDiscussType@Group@Util@@YAEK@Z
?GetGlobalDataDir@Sys@Util@@YA?AVCTXStringW@@XZ
?GetGlobalDataPublicDir@Sys@Util@@YA?AVCTXStringW@@XZ
?GetGlobalDataUsersDir@Sys@Util@@YA?AVCTXStringW@@XZ
?GetGlobalSysDir@Sys@Util@@YA?AVCTXStringW@@XZ
?GetGlobalSysIMDir@Sys@Util@@YA?AVCTXStringW@@XZ
?GetGlobalSysUsersDir@Sys@Util@@YA?AVCTXStringW@@XZ
?GetGroupBasicInfo@Group@Util@@YAXKPAPAUITXDataRead@@@Z
?GetGroupClassId@Group@Util@@YAHKAAK00@Z
?GetGroupClassName@Group@Util@@YA?AVCTXStringW@@K@Z
?GetGroupCombineName@Group@Util@@YA?AVCTXStringW@@K@Z
?GetGroupCreatorUin@Group@Util@@YAKK@Z
?GetGroupMemAccountValue@Group@Util@@YA?AVCTXStringW@@KK@Z
?GetGroupMemCombineName@Group@Util@@YA?AVCTXStringW@@KK@Z
?GetGroupMemHeadFile@Group@Util@@YA?AVCTXStringW@@KK@Z
?GetGroupMemHeaderIndex@Group@Util@@YAGKK@Z
?GetGroupMemLongNickname@Group@Util@@YAHKKAAVCTXStringW@@@Z
?GetGroupMemQQLevel@Group@Util@@YAHKKAAG0@Z
?GetGroupMemShowName@Group@Util@@YA?AVCTXStringW@@KK@Z
?GetGroupMemStatus@Group@Util@@YAGKK@Z
?GetGroupMemStrGender@Group@Util@@YA?AVCTXStringW@@KK@Z
?GetGroupMemVASFlag@Group@Util@@YAHKKAAVCTXBuffer@@@Z
?GetGroupMsgRecvType@Group@Util@@YAEK@Z
?GetGroupName@Group@Util@@YA?AVCTXStringW@@K@Z
?GetGroupSelfMsgType@Group@Util@@YAEK@Z
?GetHeadFile16@Misc@Util@@YA?AVCTXStringW@@G@Z
?GetHeadFile@Misc@Util@@YA?AVCTXStringW@@G@Z
?GetIMProduct@Contact@Util@@YA?AW4ProductType@BasicInfo@ContactInfo@@K@Z
?GetIMVersion@Contact@Util@@YAGK@Z
?GetImageFileSavePath@Misc@Util@@YA?AVCTXStringW@@AAV3@@Z
?GetItem@GroupLayer@Util@@YAHHPB_W0AAVCTXStringW@@AAK@Z
?GetItemCount@CResultCollection@@QBEIXZ
?GetKeyFmt@URL@Util@@YAXAAVCFmtString@@@Z
?GetLangFmt@URL@Util@@YAXAAVCFmtString@@@Z
?GetMajorVer@Version@@YAEXZ
?GetManagerHeadFile@Group@Util@@YA?AVCTXStringW@@K@Z
?GetMaskFlag@Contact@Util@@YAJKEKIAAK@Z
?GetMinorVer@Version@@YAEXZ
?GetMode@Contact@Util@@YA?AW4__MIDL___MIDL_itf_IRegistry_0000_0004@@K@Z
?GetMsgAbstract@Msg@Util@@YA?AVCTXStringW@@PAUITXMsgPack@@@Z
?GetMsgRand32@Msg@Util@@YAKPAUITXMsgPack@@@Z
?GetMsgSeq@Msg@Util@@YAKPAUITXMsgPack@@@Z
?GetMsgTime@Msg@Util@@YA_JPAUITXMsgPack@@@Z
?GetNextSendSeq@CCcSeqManager@@QAEGKG@Z
?GetNickname@Contact@Util@@YA?AVCTXStringW@@K@Z
?GetOption@CTXCCProtocolStrategy@@UAEXPAPAUITXDataRead@@@Z
?GetOwnerHeadFile@Group@Util@@YA?AVCTXStringW@@K@Z
?GetProgramBinDir@Sys@Util@@YA?AVCTXStringW@@V3@@Z
?GetProgramRootDir@Sys@Util@@YA?AVCTXStringW@@XZ
?GetPubNo@Version@@YAKXZ
?GetPublicEmail@Contact@Util@@YA?AVCTXStringW@@K@Z
?GetPublicGender@Contact@Util@@YAEK@Z
?GetPublicHeadFile@Contact@Util@@YA?AVCTXStringW@@K@Z
?GetPublicMobile@Contact@Util@@YA?AVCTXStringW@@K@Z
?GetPublicName@Contact@Util@@YA?AVCTXStringW@@K@Z
?GetQQParams@Misc@Util@@YAHAAUtagVARIANT@@PAPAUIQQParams@@@Z
?GetRTypeByUin@Contact@Util@@YAKK@Z
?GetRawName@Contact@Util@@YA?AVCTXStringW@@K@Z
?GetRidFromUin@Contact@Util@@YAKK@Z
?GetSelfUin@Contact@Util@@YAKXZ
?GetShareHolderHeadFile@Group@Util@@YA?AVCTXStringW@@K@Z
?GetSignFmt@URL@Util@@YAXAAVCFmtString@@@Z
?GetSignature@Misc@Util@@YA?AVCTXStringW@@PB_W@Z
?GetStatus@Contact@Util@@YAGK@Z
?GetStatus@Contact@Util@@YAXKAAGAAVCTXStringW@@@Z
?GetStrOut@CDRStrCodecBase@@IAEJAAVCTXStringW@@@Z
?GetStreamLength@CustomFaceHelper@@YAHPAUIStream@@@Z
?GetStringFromBuffer@RichStatusHelper@@YAHABVCTXBuffer@@IAAVCTXBSTR@@AAIH@Z
?GetStringFromBufferWordLen@RichStatusHelper@@YAHABVCTXBuffer@@IAAVCTXBSTR@@AAIH@Z
?GetSubBufferFromBuffer@RichStatusHelper@@YAHABVCTXBuffer@@IAAV2@AAI@Z
?GetSubBufferFromBufferNoLen@RichStatusHelper@@YAHABVCTXBuffer@@IIAAV2@@Z
?GetSubBufferFromBufferWordLen@RichStatusHelper@@YAHABVCTXBuffer@@IAAV2@AAI@Z
?GetSysFaceCodeFromIndex@Msg@Util@@YAEE@Z
?GetUin@CTXCCProtocolStrategy@@IAEKXZ
?GetUinFromRid@Contact@Util@@YAKK@Z
?GetUserDataSaveSetting@Sys@Util@@YA?AVCTXStringW@@AAKAAV3@@Z
?GetUserPrivacyFlag@Contact@Util@@YAIKK@Z
?GetVASFlag@Contact@Util@@YAHKPAPAUITXBuffer@@@Z
?GetVersionExW@Version@@YAXAAUtagVersionInfo@1@@Z
?GetWordFromBuffer@RichStatusHelper@@YAHABVCTXBuffer@@IAAGAAI@Z
?HaveRightModifyCard@Group@Util@@YAHKK@Z
?IncDataDWord@DataReport@Util@@YAJPAUITXData@@PB_W@Z
?IncDataInt@DataReport@Util@@YAJPAUITXData@@PB_W@Z
?IncHelper@DataReport@Util@@YAJKPB_WK@Z
?Init@CAsyncCallHelper@@QAEXH@Z
?Init@Version@@YAHXZ
?IsADVGroup@Group@Util@@YAHK@Z
?IsAllowSendCCCmd@Contact@Util@@YAHK@Z
?IsBindMobile@Contact@Util@@YAHK@Z
?IsBuddy@Contact@Util@@YAHK@Z
?IsCRMAccount@Misc@Util@@YAHAAVCTXStringW@@@Z
?IsCmdSeqRecved@CCcSeqManager@@QAEHKGG@Z
?IsDiscussExit@Group@Util@@YAHK@Z
?IsEmailAccount@Misc@Util@@YAHAAVCTXStringW@@@Z
?IsEmailFormat@Misc@Util@@YAHAAVCTXStringW@@@Z
?IsEmailMainShow@Contact@Util@@YAHK@Z
?IsFlagValid@Contact@Util@@YAHKK@Z
?IsGroupExit@Group@Util@@YAHK@Z
?IsGroupForbidPic@Group@Util@@YAHK@Z
?IsGroupMemSheild@Group@Util@@YAHKK@Z
?IsInBlackList@Contact@Util@@YAHK@Z
?IsInvisible@Contact@Util@@YAHK@Z
?IsMaskFlagValid@Contact@Util@@YAJKEKAAH@Z
?IsMobileClient@Contact@Util@@YAHK@Z
?IsMobileTerminal@Contact@Util@@YAHK@Z
?IsMsgOffline@Msg@Util@@YAHPAUITXMsgPack@@@Z
?IsNewFlagValid@Contact@Util@@YAHKK@Z
?IsOnline@Contact@Util@@YAHK@Z
?IsOpenThirdPartyMailNotify@Misc@Util@@YAHXZ
?IsOpenUrlWithTTDefault@URL@Util@@YAHXZ
?IsPrevented@Contact@Util@@YAHK@Z
?IsServerControlBitOn@Misc@Util@@YAHK@Z
?IsStatusLegal@Misc@Util@@YAHG@Z
?IsStatusProtected@Contact@Util@@YAHK@Z
?IsStranger@Contact@Util@@YAHK@Z
?IsSuperGroup@Group@Util@@YAHK@Z
?IsTLVValid@DataReport@Util@@YA_NPAEI_N@Z
?IsTOCGroup@Group@Util@@YAHK@Z
?IsUinShareHolder@Group@Util@@YA_NKK@Z
?IsVASFlagValid@Contact@Util@@YAHKE@Z
?IsVASFlagValidEx@Contact@Util@@YAKKEI@Z
?IsValidAccount@Misc@Util@@YAHVCTXStringW@@@Z
?IsVisible@Contact@Util@@YAHK@Z
?IsWebQQUser@Contact@Util@@YAHK@Z
?MakeC2CKey@CTXCCProtocolStrategy@@IAEHKABVCTXBuffer@@AAV2@@Z
?MakeCmdPacket@CTXCCProtocolStrategy@@QAEXKKABVCTXBuffer@@PBEHAAV2@@Z
?MakeFaceId@CustomFaceHelper@@YAHPA_WAAVCTXStringW@@@Z
?MakeFixedImage@CustomFaceHelper@@YAHVCTXStringW@@H0H@Z
?Notify@CAsyncCallHelper@@QAEXHHHKPAUITXData@@@Z
?OpenUrlInIM@URL@Util@@YAXABVCTXStringW@@@Z
?OpenUrlInIM@URL@Util@@YAXABVCTXStringW@@W4URLMODIFYLEVEL@12@0@Z
?OpenUrlWithDefBrowser@URL@Util@@YAXABVCTXStringW@@W4URLMODIFYLEVEL@12@0@Z
?OpenUrlWithIE@URL@Util@@YAHABVCTXStringW@@W4URLMODIFYLEVEL@12@0@Z
?OpenUrlWithTT@URL@Util@@YAHABVCTXStringW@@W4URLMODIFYLEVEL@12@0@Z
?PreTranslateMsgImage@Msg@Util@@YAHPAUITXMsgImage@@@Z
?QueryInterface@CDRStrCodecBase@@MAGJABU_GUID@@PAPAX@Z
?QueryItemCount@CResultCollection@@QBEIW4ItemStatus@1@@Z
?QueryItemStatus@CResultCollection@@QAE?AW4ItemStatus@1@K@Z
?RegisterCodec@DataReport@Util@@YAJKKPAUITXDataReportCodecExt@@@Z
?Release@CDRStrCodecBase@@MAGKXZ
?RemoveFormlackList@Contact@Util@@YAHK@Z
?SaveBufferToTempFile@CustomFaceHelper@@YAHAAVCTXStringW@@ABV2@AAVCTXBuffer@@@Z
?SaveMsg@Msg@Util@@YAHPB_W000KKPAUITXMsgPack@@PAUITXData@@@Z
?SaveMsg@Msg@Util@@YAHPB_WKKKPAUITXMsgPack@@PAUITXData@@@Z
?SetBit@LoginDataReport@Misc@Util@@YAXEH@Z
?SetBit@OnlineStatusDataReport@Misc@Util@@YAXEH@Z
?SetClientTransProc@Msg@Util@@YAP6GHPAUITXMsgPack@@PB_WIK@ZP6GH01IK@Z@Z
?SetCodeStruct@CTXDataReportCodecBase@@MAEXK@Z
?SetDataDWord@DataReport@Util@@YAJKPB_WK@Z
?SetDataInt@DataReport@Util@@YAJKPB_WH@Z
?SetDataReportBit@DataReport@Util@@YAJKPB_WE@Z
?SetGroupForbidPic@Group@Util@@YAXKH@Z
?SetGroupMemSheildStatus@Group@Util@@YAXKKH@Z
?SetHttpCodeStruct@CDRStrCodecBase@@MAEXE@Z
?SetItemStatus@CResultCollection@@QAEHKW4ItemStatus@1@PB_W@Z
?SetMsgTime@Msg@Util@@YAXPAUITXMsgPack@@_J@Z
?SetOpenUrlWithTTDefault@URL@Util@@YAXH@Z
?SetOption@CTXCCProtocolStrategy@@UAEXPAUITXData@@@Z
?SplitMsg@Msg@Util@@YAHABVCTXBuffer@@AAV?$vector@VCTXBuffer@@V?$allocator@VCTXBuffer@@@std@@@std@@_N@Z
?SplitSigTLVMsg@Msg@Util@@YAHABVCTXBuffer@@AAV?$vector@VCTXBuffer@@V?$allocator@VCTXBuffer@@@std@@@std@@@Z
?SplitTLVMsg@Msg@Util@@YAHABVCTXBuffer@@AAV?$vector@VCTXBuffer@@V?$allocator@VCTXBuffer@@@std@@@std@@@Z
?StreamSeekToBegin@CustomFaceHelper@@YAXPAUIStream@@@Z
?SyncSelfCameraStatus@Misc@Util@@YAJXZ
?TranlateClassIdToId@GroupLayer@Util@@YAHKPAK00@Z
?TranlateToId@GroupLayer@Util@@YAHPB_W00PAK11@Z
?TransformMsg@Msg@Util@@YAXAAV?$vector@VCTXStringW@@V?$allocator@VCTXStringW@@@std@@@std@@PAUITXMsgPack@@PAPAU5@KABU_GUID@@@Z
?TransformMsg@Msg@Util@@YAXPAUITXMsgPack@@PAPAU3@K@Z
?TranslateBuddyMsgToMsgPack@Msg@Util@@YAHABVCTXBuffer@@PAUITXMsgPack@@@Z
?TranslateGroupMsgToMsgPack@Msg@Util@@YAHABVCTXBuffer@@_JPAUITXMsgPack@@PAUITXArray@@@Z
?TranslateGroupPicData@Group@Util@@YAHPAUITXData@@PAUtagGroupPicInfo@@@Z
?TranslateMsgPackToBuddyMsg@Msg@Util@@YAHPAUITXMsgPack@@AAVCTXBuffer@@@Z
?TranslateMsgPackToBuddyMsgWithOfflinePic@Msg@Util@@YAHPAUITXMsgPack@@AAVCTXBuffer@@PAUITXArray@@@Z
?TranslateMsgPackToGroupMsg@Msg@Util@@YAHPAUITXMsgPack@@AAVCTXBuffer@@PAUITXArray@@H@Z
?TranslateMsgPackToMobileMsg@Msg@Util@@YAHPAUITXMsgPack@@AAVCTXBuffer@@AA_N@Z
?TranslateOldBuddyMsgToMsgPack@Msg@Util@@YAHABVCTXBuffer@@_JPAUITXMsgPack@@@Z
?TranslateOldGroupMsgToMsgPack@Msg@Util@@YAHABVCTXBuffer@@_JPAUITXMsgPack@@HPAUITXArray@@@Z
?TranslateOldMsgToMsgPack@Msg@Util@@YAHEABVCTXBuffer@@_JKHPAUITXMsgPack@@@Z
?TranslateOldQQLiveMsgToMsgPack@Msg@Util@@YAHABVCTXBuffer@@_JPAUITXMsgPack@@2@Z
?TranslateToName@GroupLayer@Util@@YAHKKKPAVCTXStringW@@00@Z
?UnRegisterCodec@DataReport@Util@@YAJPAUITXDataReportCodecExt@@@Z
?Uninit@CAsyncCallHelper@@AAEXXZ
?UpdateMsgStorageInfo@Msg@Util@@YAHPB_W000@Z
?UploadUserCfgList@Misc@Util@@YAXPAUITXArray@@@Z
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
InitBugReport
SetBugReportUin
ValidateBugReport
Sections
.text Size: 384KB - Virtual size: 382KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 124KB - Virtual size: 120KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 24KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 40KB - Virtual size: 37KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.Silvana Size: 288B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE