Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
aion-cracked.exe

Overview

General Information

Sample Name:aion-cracked.exe
Analysis ID:697110
MD5:154e8609046ecf8b45e7b62773b51cc2
SHA1:d41ea7ac08846d7bc0541191327e06dd260d67fc
SHA256:1a1649dead5505b7a692b868d15ebcf964497e284461d927513e7b8cc7f7fb0c
Tags:exe
Infos:

Detection

Score:52
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

.NET source code contains very large array initializations
.NET source code references suspicious native API functions
Yara detected Costura Assembly Loader
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
PE file does not import any functions
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Drops PE files
Uses code obfuscation techniques (call, push, ret)
Binary contains a suspicious time stamp
Detected potential crypto function
Sample execution stops while process was sleeping (likely an evasion)
Enables debug privileges

Classification

Process Tree

  • System is w10x64
  • aion-cracked.exe (PID: 5624 cmdline: "C:\Users\user\Desktop\aion-cracked.exe" MD5: 154E8609046ECF8B45E7B62773B51CC2)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

Initial Sample

SourceRuleDescriptionAuthorStrings
aion-cracked.exeJoeSecurity_CosturaAssemblyLoaderYara detected Costura Assembly LoaderJoe Security

    Memory Dumps

    SourceRuleDescriptionAuthorStrings
    00000000.00000002.533909469.000002BD66BE9000.00000002.00000001.01000000.00000003.sdmpJoeSecurity_CosturaAssemblyLoaderYara detected Costura Assembly LoaderJoe Security
      00000000.00000000.256492023.000002BD66BE9000.00000002.00000001.01000000.00000003.sdmpJoeSecurity_CosturaAssemblyLoaderYara detected Costura Assembly LoaderJoe Security
        00000000.00000002.522205908.000002BD00001000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_CosturaAssemblyLoaderYara detected Costura Assembly LoaderJoe Security
          Process Memory Space: aion-cracked.exe PID: 5624JoeSecurity_CosturaAssemblyLoaderYara detected Costura Assembly LoaderJoe Security

            Unpacked PEs

            SourceRuleDescriptionAuthorStrings
            0.2.aion-cracked.exe.2bd66d242f8.4.raw.unpackJoeSecurity_CosturaAssemblyLoaderYara detected Costura Assembly LoaderJoe Security
              0.0.aion-cracked.exe.2bd66d242f8.1.raw.unpackJoeSecurity_CosturaAssemblyLoaderYara detected Costura Assembly LoaderJoe Security
                0.0.aion-cracked.exe.2bd66b30000.0.unpackJoeSecurity_CosturaAssemblyLoaderYara detected Costura Assembly LoaderJoe Security
                  0.2.aion-cracked.exe.2bd66b30000.3.unpackJoeSecurity_CosturaAssemblyLoaderYara detected Costura Assembly LoaderJoe Security

                    Sigma Signatures

                    ⊘No Sigma rule has matched

                    Snort Signatures

                    ⊘No Snort rule has matched

                    Joe Sandbox Signatures

                    Click to jump to signature section

                    Show All Signature Results
                    Source: aion-cracked.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
                    Source: Binary string: C:\Users\Maxime\Desktop\Bleak-master\InjectorLib\obj\Release\InjectorLib.pdb source: aion-cracked.exe, 00000000.00000002.535074277.000002BD67050000.00000004.08000000.00040000.00000000.sdmp
                    Source: Binary string: C:\Users\DuggF\source\repos\sss\Ui\obj\Debug\Ui.pdb source: aion-cracked.exe, 00000000.00000002.535635150.000002BD692B0000.00000004.08000000.00040000.00000000.sdmp
                    Source: Binary string: C:\Users\Gebruiker.EGON\Downloads\DcRat\Release\ClientsFolder\4E03513B2F3D92C7322D\sexy\CocaineClicker\obj\x64\Release\AnyDesk.pdb source: aion-cracked.exe
                    Source: Binary string: oken=null|Costura.dll|F1F25C01F6ACF33BDD62C4F82D3EF078E76F0906|4608 costura.costura.pdb.compressed|||Costura.pdb|6C6000A5EAF8579850AB82A89BD6268776EB51AD|2608 costura.injectorlib.dll.compressed|1.0.0.0|InjectorLib, Version=1.0.0.0, Culture=neutral, PublicKey source: aion-cracked.exe
                    Source: Binary string: ntdll.pdb source: aion-cracked.exe, 00000000.00000002.532601776.000002BD1003F000.00000004.00000800.00020000.00000000.sdmp
                    Source: Binary string: costura.costura.pdb.compressed source: aion-cracked.exe
                    Source: Binary string: ntdll.pdbUGP source: aion-cracked.exe, 00000000.00000002.532601776.000002BD1003F000.00000004.00000800.00020000.00000000.sdmp
                    Source: Binary string: C:\Users\DuggF\source\repos\sss\Ui\obj\Debug\Ui.pdb n:n ,n_CorDllMainmscoree.dll source: aion-cracked.exe, 00000000.00000002.535635150.000002BD692B0000.00000004.08000000.00040000.00000000.sdmp
                    Source: Binary string: costura=costura.costura.dll.compressed=costura.costura.pdb.compressedccs.microsoft.qualitytools.testing.fakes.resources source: aion-cracked.exe
                    Source: Binary string: {0}-{1}-{2}.pdb source: aion-cracked.exe, 00000000.00000002.535074277.000002BD67050000.00000004.08000000.00040000.00000000.sdmp
                    Source: Binary string: costura.costura.pdb.compressed|||Costura.pdb|6C6000A5EAF8579850AB82A89BD6268776EB51AD|2608 source: aion-cracked.exe
                    Source: Binary string: E:\jeware\CocaineLib\x64\Release\CocaineLib.pdb source: aion-cracked.exe, k42mwtii.osp.dll.0.dr
                    Source: Binary string: 2018 Microsoft Corporation. All Rights Reserved.PdBi source: aion-cracked.exe, 00000000.00000003.266179177.000002BD69438000.00000004.00000020.00020000.00000000.sdmp, aion-cracked.exe, 00000000.00000003.266206784.000002BD69438000.00000004.00000020.00020000.00000000.sdmp, aion-cracked.exe, 00000000.00000003.266329104.000002BD69438000.00000004.00000020.00020000.00000000.sdmp
                    Source: aion-cracked.exe, 00000000.00000003.260433075.000002BD69402000.00000004.00000020.00020000.00000000.sdmp, aion-cracked.exe, 00000000.00000003.267059856.000002BD6941B000.00000004.00000020.00020000.00000000.sdmp, aion-cracked.exe, 00000000.00000003.260905894.000002BD6941B000.00000004.00000020.00020000.00000000.sdmp, aion-cracked.exe, 00000000.00000003.267004352.000002BD6941B000.00000004.00000020.00020000.00000000.sdmp, aion-cracked.exe, 00000000.00000003.266840008.000002BD6941B000.00000004.00000020.00020000.00000000.sdmp, aion-cracked.exe, 00000000.00000003.266796035.000002BD6941B000.00000004.00000020.00020000.00000000.sdmp, aion-cracked.exe, 00000000.00000003.260929026.000002BD69426000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://en.w
                    Source: aion-cracked.exe, 00000000.00000002.536577963.000002BD6A6F2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://fontfabrik.com
                    Source: aion-cracked.exeString found in binary or memory: http://scripts.sil.org/OFLhttp://scripts.sil.o
                    Source: aion-cracked.exeString found in binary or memory: http://scripts.sil.org/OFLhttp://scripts.sil.org/OFL
                    Source: aion-cracked.exe, 00000000.00000002.536577963.000002BD6A6F2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
                    Source: aion-cracked.exe, 00000000.00000003.266441477.000002BD6941C000.00000004.00000020.00020000.00000000.sdmp, aion-cracked.exe, 00000000.00000003.266646287.000002BD6941B000.00000004.00000020.00020000.00000000.sdmp, aion-cracked.exe, 00000000.00000003.266705731.000002BD6941B000.00000004.00000020.00020000.00000000.sdmp, aion-cracked.exe, 00000000.00000003.266574913.000002BD6941B000.00000004.00000020.00020000.00000000.sdmp, aion-cracked.exe, 00000000.00000003.266369748.000002BD6941B000.00000004.00000020.00020000.00000000.sdmp, aion-cracked.exe, 00000000.00000003.266796035.000002BD6941B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.carterandcone.com
                    Source: aion-cracked.exe, 00000000.00000003.266369748.000002BD6941B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.carterandcone.com4
                    Source: aion-cracked.exe, 00000000.00000003.266441477.000002BD6941C000.00000004.00000020.00020000.00000000.sdmp, aion-cracked.exe, 00000000.00000003.266705731.000002BD6941B000.00000004.00000020.00020000.00000000.sdmp, aion-cracked.exe, 00000000.00000003.266574913.000002BD6941B000.00000004.00000020.00020000.00000000.sdmp, aion-cracked.exe, 00000000.00000003.266369748.000002BD6941B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.carterandcone.comAi
                    Source: aion-cracked.exe, 00000000.00000003.266705731.000002BD6941B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.carterandcone.comBi
                    Source: aion-cracked.exe, 00000000.00000002.536577963.000002BD6A6F2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.carterandcone.coml
                    Source: aion-cracked.exe, 00000000.00000003.270487843.000002BD6941B000.00000004.00000020.00020000.00000000.sdmp, aion-cracked.exe, 00000000.00000003.271164013.000002BD6941B000.00000004.00000020.00020000.00000000.sdmp, aion-cracked.exe, 00000000.00000003.272225109.000002BD6941B000.00000004.00000020.00020000.00000000.sdmp, aion-cracked.exe, 00000000.00000002.536577963.000002BD6A6F2000.00000004.00000800.00020000.00000000.sdmp, aion-cracked.exe, 00000000.00000003.272317655.000002BD6941B000.00000004.00000020.00020000.00000000.sdmp, aion-cracked.exe, 00000000.00000003.271822754.000002BD6941B000.00000004.00000020.00020000.00000000.sdmp, aion-cracked.exe, 00000000.00000003.277774804.000002BD6941B000.00000004.00000020.00020000.00000000.sdmp, aion-cracked.exe, 00000000.00000003.272364127.000002BD6941B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com
                    Source: aion-cracked.exe, 00000000.00000003.270770965.000002BD6941B000.00000004.00000020.00020000.00000000.sdmp, aion-cracked.exe, 00000000.00000003.270927104.000002BD6941B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers
                    Source: aion-cracked.exe, 00000000.00000003.270487843.000002BD6941B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers/
                    Source: aion-cracked.exe, 00000000.00000002.536577963.000002BD6A6F2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers/?
                    Source: aion-cracked.exe, 00000000.00000003.270487843.000002BD6941B000.00000004.00000020.00020000.00000000.sdmp, aion-cracked.exe, 00000000.00000003.270608154.000002BD6941B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers/Ci
                    Source: aion-cracked.exe, 00000000.00000003.272225109.000002BD6941B000.00000004.00000020.00020000.00000000.sdmp, aion-cracked.exe, 00000000.00000003.272272052.000002BD6941B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers/cabarga.html
                    Source: aion-cracked.exe, 00000000.00000002.536577963.000002BD6A6F2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
                    Source: aion-cracked.exe, 00000000.00000002.536577963.000002BD6A6F2000.00000004.00000800.00020000.00000000.sdmp, aion-cracked.exe, 00000000.00000003.271822754.000002BD6941B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
                    Source: aion-cracked.exe, 00000000.00000003.271822754.000002BD6941B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers/frere-jones.htmla-dk
                    Source: aion-cracked.exe, 00000000.00000003.271164013.000002BD6941B000.00000004.00000020.00020000.00000000.sdmp, aion-cracked.exe, 00000000.00000003.271374962.000002BD6941B000.00000004.00000020.00020000.00000000.sdmp, aion-cracked.exe, 00000000.00000003.271431870.000002BD6941B000.00000004.00000020.00020000.00000000.sdmp, aion-cracked.exe, 00000000.00000003.271265789.000002BD6941B000.00000004.00000020.00020000.00000000.sdmp, aion-cracked.exe, 00000000.00000003.271480501.000002BD6941B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers0
                    Source: aion-cracked.exe, 00000000.00000003.277873108.000002BD69435000.00000004.00000020.00020000.00000000.sdmp, aion-cracked.exe, 00000000.00000003.277774804.000002BD6941B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers2
                    Source: aion-cracked.exe, 00000000.00000002.536577963.000002BD6A6F2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers8
                    Source: aion-cracked.exe, 00000000.00000002.536577963.000002BD6A6F2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers?
                    Source: aion-cracked.exe, 00000000.00000002.536577963.000002BD6A6F2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designersG
                    Source: aion-cracked.exe, 00000000.00000003.270608154.000002BD6941B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designersers/
                    Source: aion-cracked.exe, 00000000.00000003.271374962.000002BD6941B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com8EBi
                    Source: aion-cracked.exe, 00000000.00000003.272782999.000002BD6941B000.00000004.00000020.00020000.00000000.sdmp, aion-cracked.exe, 00000000.00000003.272719538.000002BD6941B000.00000004.00000020.00020000.00000000.sdmp, aion-cracked.exe, 00000000.00000003.272630059.000002BD6941B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.comCH.TTFBi
                    Source: aion-cracked.exe, 00000000.00000003.270487843.000002BD6941B000.00000004.00000020.00020000.00000000.sdmp, aion-cracked.exe, 00000000.00000003.270608154.000002BD6941B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.comF
                    Source: aion-cracked.exe, 00000000.00000003.272719538.000002BD6941B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.comMAN.TTF
                    Source: aion-cracked.exe, 00000000.00000003.271164013.000002BD6941B000.00000004.00000020.00020000.00000000.sdmp, aion-cracked.exe, 00000000.00000003.271374962.000002BD6941B000.00000004.00000020.00020000.00000000.sdmp, aion-cracked.exe, 00000000.00000003.271265789.000002BD6941B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.comSCI.TTF
                    Source: aion-cracked.exe, 00000000.00000003.271866728.000002BD6941B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.comX
                    Source: aion-cracked.exe, 00000000.00000003.277958537.000002BD6941B000.00000004.00000020.00020000.00000000.sdmp, aion-cracked.exe, 00000000.00000003.277774804.000002BD6941B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.comic
                    Source: aion-cracked.exe, 00000000.00000003.272782999.000002BD6941B000.00000004.00000020.00020000.00000000.sdmp, aion-cracked.exe, 00000000.00000003.272719538.000002BD6941B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.comva
                    Source: aion-cracked.exe, 00000000.00000002.536577963.000002BD6A6F2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fonts.com
                    Source: aion-cracked.exe, 00000000.00000002.536577963.000002BD6A6F2000.00000004.00000800.00020000.00000000.sdmp, aion-cracked.exe, 00000000.00000003.264488481.000002BD6941B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.founder.com.cn/cn
                    Source: aion-cracked.exe, 00000000.00000003.265176078.000002BD6941B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.founder.com.cn/cn/
                    Source: aion-cracked.exe, 00000000.00000002.536577963.000002BD6A6F2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.founder.com.cn/cn/bThe
                    Source: aion-cracked.exe, 00000000.00000002.536577963.000002BD6A6F2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.founder.com.cn/cn/cThe
                    Source: aion-cracked.exe, 00000000.00000003.264608930.000002BD6941B000.00000004.00000020.00020000.00000000.sdmp, aion-cracked.exe, 00000000.00000003.265005726.000002BD6941B000.00000004.00000020.00020000.00000000.sdmp, aion-cracked.exe, 00000000.00000003.264488481.000002BD6941B000.00000004.00000020.00020000.00000000.sdmp, aion-cracked.exe, 00000000.00000003.264962550.000002BD6941B000.00000004.00000020.00020000.00000000.sdmp, aion-cracked.exe, 00000000.00000003.264765286.000002BD6941B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.founder.com.cn/cnAi
                    Source: aion-cracked.exe, 00000000.00000003.264608930.000002BD6941B000.00000004.00000020.00020000.00000000.sdmp, aion-cracked.exe, 00000000.00000003.264488481.000002BD6941B000.00000004.00000020.00020000.00000000.sdmp, aion-cracked.exe, 00000000.00000003.264765286.000002BD6941B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.founder.com.cn/cnBi
                    Source: aion-cracked.exe, 00000000.00000003.264962550.000002BD6941B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.founder.com.cn/cnCX
                    Source: aion-cracked.exe, 00000000.00000003.264488481.000002BD6941B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.founder.com.cn/cnTF
                    Source: aion-cracked.exe, 00000000.00000003.264765286.000002BD6941B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.founder.com.cn/cnx
                    Source: aion-cracked.exe, 00000000.00000003.274611359.000002BD6941B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.galapagosdesign.com/
                    Source: aion-cracked.exe, 00000000.00000002.536577963.000002BD6A6F2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.galapagosdesign.com/DPlease
                    Source: aion-cracked.exe, 00000000.00000002.536577963.000002BD6A6F2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
                    Source: aion-cracked.exe, 00000000.00000002.536577963.000002BD6A6F2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.goodfont.co.kr
                    Source: aion-cracked.exe, 00000000.00000002.536577963.000002BD6A6F2000.00000004.00000800.00020000.00000000.sdmp, aion-cracked.exe, 00000000.00000003.267501620.000002BD6941B000.00000004.00000020.00020000.00000000.sdmp, aion-cracked.exe, 00000000.00000003.267610448.000002BD6941B000.00000004.00000020.00020000.00000000.sdmp, aion-cracked.exe, 00000000.00000003.267743018.000002BD6941B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/
                    Source: aion-cracked.exe, 00000000.00000003.267501620.000002BD6941B000.00000004.00000020.00020000.00000000.sdmp, aion-cracked.exe, 00000000.00000003.267610448.000002BD6941B000.00000004.00000020.00020000.00000000.sdmp, aion-cracked.exe, 00000000.00000003.267743018.000002BD6941B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/Ai
                    Source: aion-cracked.exe, 00000000.00000003.267814456.000002BD6941B000.00000004.00000020.00020000.00000000.sdmp, aion-cracked.exe, 00000000.00000003.267501620.000002BD6941B000.00000004.00000020.00020000.00000000.sdmp, aion-cracked.exe, 00000000.00000003.267610448.000002BD6941B000.00000004.00000020.00020000.00000000.sdmp, aion-cracked.exe, 00000000.00000003.267872869.000002BD6941B000.00000004.00000020.00020000.00000000.sdmp, aion-cracked.exe, 00000000.00000003.267743018.000002BD6941B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/Y0Bi
                    Source: aion-cracked.exe, 00000000.00000003.267501620.000002BD6941B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/jp/
                    Source: aion-cracked.exe, 00000000.00000003.267610448.000002BD6941B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/jp/(=Bi
                    Source: aion-cracked.exe, 00000000.00000003.267501620.000002BD6941B000.00000004.00000020.00020000.00000000.sdmp, aion-cracked.exe, 00000000.00000003.267610448.000002BD6941B000.00000004.00000020.00020000.00000000.sdmp, aion-cracked.exe, 00000000.00000003.267743018.000002BD6941B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/jp/Bi
                    Source: aion-cracked.exe, 00000000.00000002.536577963.000002BD6A6F2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.sajatypeworks.com
                    Source: aion-cracked.exe, 00000000.00000003.260844071.000002BD69424000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.sajatypeworks.comAi
                    Source: aion-cracked.exe, 00000000.00000003.260844071.000002BD69424000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.sajatypeworks.comBi
                    Source: aion-cracked.exe, 00000000.00000003.260844071.000002BD69424000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.sajatypeworks.comI
                    Source: aion-cracked.exe, 00000000.00000003.260844071.000002BD69424000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.sajatypeworks.comn
                    Source: aion-cracked.exe, 00000000.00000003.260844071.000002BD69424000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.sajatypeworks.comywa
                    Source: aion-cracked.exe, 00000000.00000003.267949419.000002BD6941B000.00000004.00000020.00020000.00000000.sdmp, aion-cracked.exe, 00000000.00000002.536577963.000002BD6A6F2000.00000004.00000800.00020000.00000000.sdmp, aion-cracked.exe, 00000000.00000003.268051179.000002BD6942B000.00000004.00000020.00020000.00000000.sdmp, aion-cracked.exe, 00000000.00000003.267994582.000002BD6941B000.00000004.00000020.00020000.00000000.sdmp, aion-cracked.exe, 00000000.00000003.267872869.000002BD6941B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.sakkal.com
                    Source: aion-cracked.exe, 00000000.00000002.536577963.000002BD6A6F2000.00000004.00000800.00020000.00000000.sdmp, aion-cracked.exe, 00000000.00000003.263356906.000002BD6941B000.00000004.00000020.00020000.00000000.sdmp, aion-cracked.exe, 00000000.00000003.263233512.000002BD6941B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.sandoll.co.kr
                    Source: aion-cracked.exe, 00000000.00000003.263356906.000002BD6941B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.sandoll.co.krkk
                    Source: aion-cracked.exe, 00000000.00000003.263233512.000002BD6941B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.sandoll.co.krxk
                    Source: aion-cracked.exeString found in binary or memory: http://www.sansoxygen.comThis
                    Source: aion-cracked.exe, 00000000.00000002.536577963.000002BD6A6F2000.00000004.00000800.00020000.00000000.sdmp, aion-cracked.exe, 00000000.00000003.266705731.000002BD6941B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.tiro.com
                    Source: aion-cracked.exe, 00000000.00000003.266705731.000002BD6941B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.tiro.com(
                    Source: aion-cracked.exe, 00000000.00000003.265512305.000002BD6941B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.tiro.comz-f
                    Source: aion-cracked.exe, 00000000.00000002.536577963.000002BD6A6F2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.typography.netD
                    Source: aion-cracked.exe, 00000000.00000002.536577963.000002BD6A6F2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.urwpp.deDPlease
                    Source: aion-cracked.exe, 00000000.00000003.272833191.000002BD6941B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.urwpp.deF
                    Source: aion-cracked.exe, 00000000.00000003.272833191.000002BD6941B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.urwpp.deh
                    Source: aion-cracked.exe, 00000000.00000002.536577963.000002BD6A6F2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.zhongyicts.com.cn
                    Source: aion-cracked.exe, 00000000.00000003.266246611.000002BD6941B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.zhongyicts.com.cnBi
                    Source: aion-cracked.exeString found in binary or memory: https://buyaion.cc/api/auth/
                    Source: aion-cracked.exeString found in binary or memory: https://github.com/googlefonts/nunito)NunitoRegular3.601;NONE;Nunito-RegularNunito

                    System Summary

                    barindex
                    .NET source code contains very large array initializations
                    Source: aion-cracked.exe, CocaineClicker/Utils/NativeLib.csLarge array initialization: .cctor: array initializer size 10752
                    Source: aion-cracked.exeStatic PE information: No import functions for PE file found
                    Source: aion-cracked.exeBinary or memory string: OriginalFilename vs aion-cracked.exe
                    Source: aion-cracked.exe, 00000000.00000002.533451260.000002BD101A8000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenamentdll.dllj% vs aion-cracked.exe
                    Source: aion-cracked.exe, 00000000.00000002.533909469.000002BD66BE9000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenameAnyDesk.exe0 vs aion-cracked.exe
                    Source: aion-cracked.exe, 00000000.00000002.535635150.000002BD692B0000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameUi.dll& vs aion-cracked.exe
                    Source: aion-cracked.exe, 00000000.00000002.535074277.000002BD67050000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameInjectorLib.dll8 vs aion-cracked.exe
                    Source: aion-cracked.exe, 00000000.00000002.534289934.000002BD66ECD000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameclr.dllT vs aion-cracked.exe
                    Source: aion-cracked.exeBinary or memory string: OriginalFilenameAnyDesk.exe0 vs aion-cracked.exe
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD0F5FB0_3_000002BD6AD0F5FB
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD0F5FB0_3_000002BD6AD0F5FB
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD0F5FB0_3_000002BD6AD0F5FB
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD0F5FB0_3_000002BD6AD0F5FB
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD0F5FB0_3_000002BD6AD0F5FB
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD0F5FB0_3_000002BD6AD0F5FB
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD0F5FB0_3_000002BD6AD0F5FB
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD081EB0_3_000002BD6AD081EB
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD081EB0_3_000002BD6AD081EB
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD081EB0_3_000002BD6AD081EB
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD081EB0_3_000002BD6AD081EB
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD081EB0_3_000002BD6AD081EB
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD081EB0_3_000002BD6AD081EB
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD081EB0_3_000002BD6AD081EB
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD081EB0_3_000002BD6AD081EB
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD081EB0_3_000002BD6AD081EB
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD094130_3_000002BD6AD09413
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD094130_3_000002BD6AD09413
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD094130_3_000002BD6AD09413
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD094130_3_000002BD6AD09413
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD094130_3_000002BD6AD09413
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD094130_3_000002BD6AD09413
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD094130_3_000002BD6AD09413
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD094130_3_000002BD6AD09413
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD0660B0_3_000002BD6AD0660B
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD0660B0_3_000002BD6AD0660B
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD0660B0_3_000002BD6AD0660B
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD0660B0_3_000002BD6AD0660B
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD0660B0_3_000002BD6AD0660B
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD0660B0_3_000002BD6AD0660B
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD0660B0_3_000002BD6AD0660B
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD0660B0_3_000002BD6AD0660B
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD0660B0_3_000002BD6AD0660B
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD07BDB0_3_000002BD6AD07BDB
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD07BDB0_3_000002BD6AD07BDB
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD07BDB0_3_000002BD6AD07BDB
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD07BDB0_3_000002BD6AD07BDB
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD07BDB0_3_000002BD6AD07BDB
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD07BDB0_3_000002BD6AD07BDB
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD07BDB0_3_000002BD6AD07BDB
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD07BDB0_3_000002BD6AD07BDB
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD07BDB0_3_000002BD6AD07BDB
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD0CD7B0_3_000002BD6AD0CD7B
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD0CD7B0_3_000002BD6AD0CD7B
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD0CD7B0_3_000002BD6AD0CD7B
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD0CD7B0_3_000002BD6AD0CD7B
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD0CD7B0_3_000002BD6AD0CD7B
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD0CD7B0_3_000002BD6AD0CD7B
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD0CD7B0_3_000002BD6AD0CD7B
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD0CD7B0_3_000002BD6AD0CD7B
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD0A3980_3_000002BD6AD0A398
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD0A3980_3_000002BD6AD0A398
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD0A3980_3_000002BD6AD0A398
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD0A3980_3_000002BD6AD0A398
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD0A3980_3_000002BD6AD0A398
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD0A3980_3_000002BD6AD0A398
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD0A3980_3_000002BD6AD0A398
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD0A3980_3_000002BD6AD0A398
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD05D330_3_000002BD6AD05D33
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD05D330_3_000002BD6AD05D33
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD05D330_3_000002BD6AD05D33
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD05D330_3_000002BD6AD05D33
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD05D330_3_000002BD6AD05D33
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD05D330_3_000002BD6AD05D33
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD05D330_3_000002BD6AD05D33
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD05D330_3_000002BD6AD05D33
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD05D330_3_000002BD6AD05D33
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD087530_3_000002BD6AD08753
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD087530_3_000002BD6AD08753
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD087530_3_000002BD6AD08753
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD087530_3_000002BD6AD08753
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD087530_3_000002BD6AD08753
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD087530_3_000002BD6AD08753
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD087530_3_000002BD6AD08753
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD087530_3_000002BD6AD08753
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD087530_3_000002BD6AD08753
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD04CFC0_3_000002BD6AD04CFC
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD04CFC0_3_000002BD6AD04CFC
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD04CFC0_3_000002BD6AD04CFC
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD04CFC0_3_000002BD6AD04CFC
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD04CFC0_3_000002BD6AD04CFC
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD04CFC0_3_000002BD6AD04CFC
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD04CFC0_3_000002BD6AD04CFC
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD04CFC0_3_000002BD6AD04CFC
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD04CFC0_3_000002BD6AD04CFC
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD0ACFB0_3_000002BD6AD0ACFB
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD0ACFB0_3_000002BD6AD0ACFB
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD0ACFB0_3_000002BD6AD0ACFB
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD0ACFB0_3_000002BD6AD0ACFB
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD0ACFB0_3_000002BD6AD0ACFB
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD0ACFB0_3_000002BD6AD0ACFB
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD0ACFB0_3_000002BD6AD0ACFB
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD0ACFB0_3_000002BD6AD0ACFB
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD06B1B0_3_000002BD6AD06B1B
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD06B1B0_3_000002BD6AD06B1B
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD06B1B0_3_000002BD6AD06B1B
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD06B1B0_3_000002BD6AD06B1B
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD06B1B0_3_000002BD6AD06B1B
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD06B1B0_3_000002BD6AD06B1B
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD06B1B0_3_000002BD6AD06B1B
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD06B1B0_3_000002BD6AD06B1B
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD06B1B0_3_000002BD6AD06B1B
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD0D11B0_3_000002BD6AD0D11B
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD0D11B0_3_000002BD6AD0D11B
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD0D11B0_3_000002BD6AD0D11B
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD0D11B0_3_000002BD6AD0D11B
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD0D11B0_3_000002BD6AD0D11B
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD0D11B0_3_000002BD6AD0D11B
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD0D11B0_3_000002BD6AD0D11B
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD0D11B0_3_000002BD6AD0D11B
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD0ED030_3_000002BD6AD0ED03
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD0ED030_3_000002BD6AD0ED03
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD0ED030_3_000002BD6AD0ED03
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD0ED030_3_000002BD6AD0ED03
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD0ED030_3_000002BD6AD0ED03
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD0ED030_3_000002BD6AD0ED03
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD0ED030_3_000002BD6AD0ED03
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD098B00_3_000002BD6AD098B0
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD098B00_3_000002BD6AD098B0
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD098B00_3_000002BD6AD098B0
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD098B00_3_000002BD6AD098B0
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD098B00_3_000002BD6AD098B0
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD098B00_3_000002BD6AD098B0
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD098B00_3_000002BD6AD098B0
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD098B00_3_000002BD6AD098B0
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD092AB0_3_000002BD6AD092AB
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD092AB0_3_000002BD6AD092AB
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD092AB0_3_000002BD6AD092AB
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD092AB0_3_000002BD6AD092AB
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD092AB0_3_000002BD6AD092AB
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD092AB0_3_000002BD6AD092AB
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD092AB0_3_000002BD6AD092AB
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD092AB0_3_000002BD6AD092AB
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD054DB0_3_000002BD6AD054DB
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD054DB0_3_000002BD6AD054DB
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD054DB0_3_000002BD6AD054DB
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD054DB0_3_000002BD6AD054DB
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD054DB0_3_000002BD6AD054DB
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD054DB0_3_000002BD6AD054DB
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD054DB0_3_000002BD6AD054DB
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD054DB0_3_000002BD6AD054DB
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD054DB0_3_000002BD6AD054DB
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD0606B0_3_000002BD6AD0606B
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD0606B0_3_000002BD6AD0606B
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD0606B0_3_000002BD6AD0606B
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD0606B0_3_000002BD6AD0606B
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD0606B0_3_000002BD6AD0606B
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD0606B0_3_000002BD6AD0606B
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD0606B0_3_000002BD6AD0606B
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD0606B0_3_000002BD6AD0606B
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD0606B0_3_000002BD6AD0606B
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD06A3B0_3_000002BD6AD06A3B
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD06A3B0_3_000002BD6AD06A3B
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD06A3B0_3_000002BD6AD06A3B
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD06A3B0_3_000002BD6AD06A3B
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD06A3B0_3_000002BD6AD06A3B
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD06A3B0_3_000002BD6AD06A3B
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD06A3B0_3_000002BD6AD06A3B
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD06A3B0_3_000002BD6AD06A3B
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD06A3B0_3_000002BD6AD06A3B
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD0D03B0_3_000002BD6AD0D03B
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD0D03B0_3_000002BD6AD0D03B
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD0D03B0_3_000002BD6AD0D03B
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD0D03B0_3_000002BD6AD0D03B
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD0D03B0_3_000002BD6AD0D03B
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD0D03B0_3_000002BD6AD0D03B
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD0D03B0_3_000002BD6AD0D03B
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD0D03B0_3_000002BD6AD0D03B
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD09E230_3_000002BD6AD09E23
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD09E230_3_000002BD6AD09E23
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD09E230_3_000002BD6AD09E23
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD09E230_3_000002BD6AD09E23
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD09E230_3_000002BD6AD09E23
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD09E230_3_000002BD6AD09E23
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD09E230_3_000002BD6AD09E23
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD09E230_3_000002BD6AD09E23
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD0AA2B0_3_000002BD6AD0AA2B
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD0AA2B0_3_000002BD6AD0AA2B
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD0AA2B0_3_000002BD6AD0AA2B
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD0AA2B0_3_000002BD6AD0AA2B
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD0AA2B0_3_000002BD6AD0AA2B
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD0AA2B0_3_000002BD6AD0AA2B
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD0AA2B0_3_000002BD6AD0AA2B
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD0AA2B0_3_000002BD6AD0AA2B
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD05A5B0_3_000002BD6AD05A5B
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD05A5B0_3_000002BD6AD05A5B
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD05A5B0_3_000002BD6AD05A5B
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD05A5B0_3_000002BD6AD05A5B
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD05A5B0_3_000002BD6AD05A5B
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD05A5B0_3_000002BD6AD05A5B
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD05A5B0_3_000002BD6AD05A5B
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD05A5B0_3_000002BD6AD05A5B
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD05A5B0_3_000002BD6AD05A5B
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD0F5FB0_3_000002BD6AD0F5FB
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD0F5FB0_3_000002BD6AD0F5FB
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD0F5FB0_3_000002BD6AD0F5FB
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD0F5FB0_3_000002BD6AD0F5FB
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD0F5FB0_3_000002BD6AD0F5FB
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD0F5FB0_3_000002BD6AD0F5FB
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD0F5FB0_3_000002BD6AD0F5FB
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD081EB0_3_000002BD6AD081EB
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD081EB0_3_000002BD6AD081EB
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD081EB0_3_000002BD6AD081EB
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD081EB0_3_000002BD6AD081EB
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD081EB0_3_000002BD6AD081EB
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD081EB0_3_000002BD6AD081EB
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD081EB0_3_000002BD6AD081EB
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD081EB0_3_000002BD6AD081EB
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD081EB0_3_000002BD6AD081EB
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD094130_3_000002BD6AD09413
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD094130_3_000002BD6AD09413
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD094130_3_000002BD6AD09413
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD094130_3_000002BD6AD09413
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD094130_3_000002BD6AD09413
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD094130_3_000002BD6AD09413
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD094130_3_000002BD6AD09413
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD094130_3_000002BD6AD09413
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD0660B0_3_000002BD6AD0660B
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD0660B0_3_000002BD6AD0660B
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD0660B0_3_000002BD6AD0660B
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD0660B0_3_000002BD6AD0660B
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD0660B0_3_000002BD6AD0660B
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD0660B0_3_000002BD6AD0660B
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD0660B0_3_000002BD6AD0660B
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD0660B0_3_000002BD6AD0660B
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD0660B0_3_000002BD6AD0660B
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD07BDB0_3_000002BD6AD07BDB
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD07BDB0_3_000002BD6AD07BDB
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD07BDB0_3_000002BD6AD07BDB
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD07BDB0_3_000002BD6AD07BDB
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD07BDB0_3_000002BD6AD07BDB
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD07BDB0_3_000002BD6AD07BDB
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD07BDB0_3_000002BD6AD07BDB
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD07BDB0_3_000002BD6AD07BDB
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD07BDB0_3_000002BD6AD07BDB
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD0CD7B0_3_000002BD6AD0CD7B
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD0CD7B0_3_000002BD6AD0CD7B
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD0CD7B0_3_000002BD6AD0CD7B
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD0CD7B0_3_000002BD6AD0CD7B
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD0CD7B0_3_000002BD6AD0CD7B
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD0CD7B0_3_000002BD6AD0CD7B
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD0CD7B0_3_000002BD6AD0CD7B
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD0CD7B0_3_000002BD6AD0CD7B
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD0A3980_3_000002BD6AD0A398
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD0A3980_3_000002BD6AD0A398
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD0A3980_3_000002BD6AD0A398
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD0A3980_3_000002BD6AD0A398
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD0A3980_3_000002BD6AD0A398
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD0A3980_3_000002BD6AD0A398
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD0A3980_3_000002BD6AD0A398
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD0A3980_3_000002BD6AD0A398
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD05D330_3_000002BD6AD05D33
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD05D330_3_000002BD6AD05D33
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD05D330_3_000002BD6AD05D33
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD05D330_3_000002BD6AD05D33
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD05D330_3_000002BD6AD05D33
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD05D330_3_000002BD6AD05D33
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD05D330_3_000002BD6AD05D33
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD05D330_3_000002BD6AD05D33
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD05D330_3_000002BD6AD05D33
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD087530_3_000002BD6AD08753
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD087530_3_000002BD6AD08753
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD087530_3_000002BD6AD08753
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD087530_3_000002BD6AD08753
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD087530_3_000002BD6AD08753
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD087530_3_000002BD6AD08753
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD087530_3_000002BD6AD08753
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD087530_3_000002BD6AD08753
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD087530_3_000002BD6AD08753
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD04CFC0_3_000002BD6AD04CFC
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD04CFC0_3_000002BD6AD04CFC
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD04CFC0_3_000002BD6AD04CFC
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD04CFC0_3_000002BD6AD04CFC
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD04CFC0_3_000002BD6AD04CFC
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD04CFC0_3_000002BD6AD04CFC
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD04CFC0_3_000002BD6AD04CFC
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD04CFC0_3_000002BD6AD04CFC
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD04CFC0_3_000002BD6AD04CFC
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD0ACFB0_3_000002BD6AD0ACFB
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD0ACFB0_3_000002BD6AD0ACFB
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD0ACFB0_3_000002BD6AD0ACFB
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD0ACFB0_3_000002BD6AD0ACFB
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD0ACFB0_3_000002BD6AD0ACFB
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD0ACFB0_3_000002BD6AD0ACFB
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD0ACFB0_3_000002BD6AD0ACFB
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD0ACFB0_3_000002BD6AD0ACFB
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD06B1B0_3_000002BD6AD06B1B
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD06B1B0_3_000002BD6AD06B1B
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD06B1B0_3_000002BD6AD06B1B
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD06B1B0_3_000002BD6AD06B1B
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD06B1B0_3_000002BD6AD06B1B
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD06B1B0_3_000002BD6AD06B1B
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD06B1B0_3_000002BD6AD06B1B
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD06B1B0_3_000002BD6AD06B1B
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD06B1B0_3_000002BD6AD06B1B
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD0D11B0_3_000002BD6AD0D11B
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD0D11B0_3_000002BD6AD0D11B
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD0D11B0_3_000002BD6AD0D11B
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD0D11B0_3_000002BD6AD0D11B
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD0D11B0_3_000002BD6AD0D11B
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD0D11B0_3_000002BD6AD0D11B
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD0D11B0_3_000002BD6AD0D11B
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD0D11B0_3_000002BD6AD0D11B
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD0ED030_3_000002BD6AD0ED03
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD0ED030_3_000002BD6AD0ED03
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD0ED030_3_000002BD6AD0ED03
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD0ED030_3_000002BD6AD0ED03
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD0ED030_3_000002BD6AD0ED03
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD0ED030_3_000002BD6AD0ED03
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD0ED030_3_000002BD6AD0ED03
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD098B00_3_000002BD6AD098B0
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD098B00_3_000002BD6AD098B0
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD098B00_3_000002BD6AD098B0
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD098B00_3_000002BD6AD098B0
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD098B00_3_000002BD6AD098B0
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD098B00_3_000002BD6AD098B0
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD098B00_3_000002BD6AD098B0
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD098B00_3_000002BD6AD098B0
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD092AB0_3_000002BD6AD092AB
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD092AB0_3_000002BD6AD092AB
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD092AB0_3_000002BD6AD092AB
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD092AB0_3_000002BD6AD092AB
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD092AB0_3_000002BD6AD092AB
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD092AB0_3_000002BD6AD092AB
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD092AB0_3_000002BD6AD092AB
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD092AB0_3_000002BD6AD092AB
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD054DB0_3_000002BD6AD054DB
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD054DB0_3_000002BD6AD054DB
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD054DB0_3_000002BD6AD054DB
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD054DB0_3_000002BD6AD054DB
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD054DB0_3_000002BD6AD054DB
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD054DB0_3_000002BD6AD054DB
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD054DB0_3_000002BD6AD054DB
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD054DB0_3_000002BD6AD054DB
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD054DB0_3_000002BD6AD054DB
                    Source: aion-cracked.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                    Source: C:\Users\user\Desktop\aion-cracked.exeKey opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
                    Source: aion-cracked.exeStatic file information: TRID: Win64 Executable GUI Net Framework (217006/5) 49.88%
                    Source: C:\Users\user\Desktop\aion-cracked.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dllJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeFile created: C:\Users\user\AppData\Local\Temp\BleakJump to behavior
                    Source: classification engineClassification label: mal52.evad.winEXE@1/1@0/0
                    Source: C:\Users\user\Desktop\aion-cracked.exeFile opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dllJump to behavior
                    Source: aion-cracked.exeStatic file information: File size 2121728 > 1048576
                    Source: aion-cracked.exeStatic PE information: Virtual size of .text is bigger than: 0x100000
                    Source: aion-cracked.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
                    Source: aion-cracked.exeStatic PE information: Raw size of .text is bigger than: 0x100000 < 0x205800
                    Source: aion-cracked.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
                    Source: aion-cracked.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
                    Source: Binary string: C:\Users\Maxime\Desktop\Bleak-master\InjectorLib\obj\Release\InjectorLib.pdb source: aion-cracked.exe, 00000000.00000002.535074277.000002BD67050000.00000004.08000000.00040000.00000000.sdmp
                    Source: Binary string: C:\Users\DuggF\source\repos\sss\Ui\obj\Debug\Ui.pdb source: aion-cracked.exe, 00000000.00000002.535635150.000002BD692B0000.00000004.08000000.00040000.00000000.sdmp
                    Source: Binary string: C:\Users\Gebruiker.EGON\Downloads\DcRat\Release\ClientsFolder\4E03513B2F3D92C7322D\sexy\CocaineClicker\obj\x64\Release\AnyDesk.pdb source: aion-cracked.exe
                    Source: Binary string: oken=null|Costura.dll|F1F25C01F6ACF33BDD62C4F82D3EF078E76F0906|4608 costura.costura.pdb.compressed|||Costura.pdb|6C6000A5EAF8579850AB82A89BD6268776EB51AD|2608 costura.injectorlib.dll.compressed|1.0.0.0|InjectorLib, Version=1.0.0.0, Culture=neutral, PublicKey source: aion-cracked.exe
                    Source: Binary string: ntdll.pdb source: aion-cracked.exe, 00000000.00000002.532601776.000002BD1003F000.00000004.00000800.00020000.00000000.sdmp
                    Source: Binary string: costura.costura.pdb.compressed source: aion-cracked.exe
                    Source: Binary string: ntdll.pdbUGP source: aion-cracked.exe, 00000000.00000002.532601776.000002BD1003F000.00000004.00000800.00020000.00000000.sdmp
                    Source: Binary string: C:\Users\DuggF\source\repos\sss\Ui\obj\Debug\Ui.pdb n:n ,n_CorDllMainmscoree.dll source: aion-cracked.exe, 00000000.00000002.535635150.000002BD692B0000.00000004.08000000.00040000.00000000.sdmp
                    Source: Binary string: costura=costura.costura.dll.compressed=costura.costura.pdb.compressedccs.microsoft.qualitytools.testing.fakes.resources source: aion-cracked.exe
                    Source: Binary string: {0}-{1}-{2}.pdb source: aion-cracked.exe, 00000000.00000002.535074277.000002BD67050000.00000004.08000000.00040000.00000000.sdmp
                    Source: Binary string: costura.costura.pdb.compressed|||Costura.pdb|6C6000A5EAF8579850AB82A89BD6268776EB51AD|2608 source: aion-cracked.exe
                    Source: Binary string: E:\jeware\CocaineLib\x64\Release\CocaineLib.pdb source: aion-cracked.exe, k42mwtii.osp.dll.0.dr
                    Source: Binary string: 2018 Microsoft Corporation. All Rights Reserved.PdBi source: aion-cracked.exe, 00000000.00000003.266179177.000002BD69438000.00000004.00000020.00020000.00000000.sdmp, aion-cracked.exe, 00000000.00000003.266206784.000002BD69438000.00000004.00000020.00020000.00000000.sdmp, aion-cracked.exe, 00000000.00000003.266329104.000002BD69438000.00000004.00000020.00020000.00000000.sdmp

                    Data Obfuscation

                    barindex
                    Yara detected Costura Assembly Loader
                    Source: Yara matchFile source: aion-cracked.exe, type: SAMPLE
                    Source: Yara matchFile source: 0.2.aion-cracked.exe.2bd66d242f8.4.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 0.0.aion-cracked.exe.2bd66d242f8.1.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 0.0.aion-cracked.exe.2bd66b30000.0.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 0.2.aion-cracked.exe.2bd66b30000.3.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 00000000.00000002.533909469.000002BD66BE9000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000000.00000000.256492023.000002BD66BE9000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000000.00000002.522205908.000002BD00001000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: Process Memory Space: aion-cracked.exe PID: 5624, type: MEMORYSTR
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD01663 push ds; iretd 0_3_000002BD6AD0166A
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD01663 push ds; iretd 0_3_000002BD6AD0166A
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD01663 push ds; iretd 0_3_000002BD6AD0166A
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD01663 push ds; iretd 0_3_000002BD6AD0166A
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD01663 push ds; iretd 0_3_000002BD6AD0166A
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD01663 push ds; iretd 0_3_000002BD6AD0166A
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD01663 push ds; iretd 0_3_000002BD6AD0166A
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD01663 push ds; iretd 0_3_000002BD6AD0166A
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD01663 push ds; iretd 0_3_000002BD6AD0166A
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD0164C push ds; iretd 0_3_000002BD6AD01662
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD0164C push ds; iretd 0_3_000002BD6AD01662
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD0164C push ds; iretd 0_3_000002BD6AD01662
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD0164C push ds; iretd 0_3_000002BD6AD01662
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD0164C push ds; iretd 0_3_000002BD6AD01662
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD0164C push ds; iretd 0_3_000002BD6AD01662
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD0164C push ds; iretd 0_3_000002BD6AD01662
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD0164C push ds; iretd 0_3_000002BD6AD01662
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD0164C push ds; iretd 0_3_000002BD6AD01662
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD01663 push ds; iretd 0_3_000002BD6AD0166A
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD01663 push ds; iretd 0_3_000002BD6AD0166A
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD01663 push ds; iretd 0_3_000002BD6AD0166A
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD01663 push ds; iretd 0_3_000002BD6AD0166A
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD01663 push ds; iretd 0_3_000002BD6AD0166A
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD01663 push ds; iretd 0_3_000002BD6AD0166A
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD01663 push ds; iretd 0_3_000002BD6AD0166A
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD01663 push ds; iretd 0_3_000002BD6AD0166A
                    Source: C:\Users\user\Desktop\aion-cracked.exeCode function: 0_3_000002BD6AD01663 push ds; iretd 0_3_000002BD6AD0166A
                    Source: aion-cracked.exeStatic PE information: 0xA2C068EF [Tue Jul 11 05:26:07 2056 UTC]
                    Source: C:\Users\user\Desktop\aion-cracked.exeFile created: C:\Users\user\AppData\Local\Temp\Bleak\DLL\k42mwtii.osp.dllJump to dropped file
                    Source: C:\Users\user\Desktop\aion-cracked.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeWindow / User API: threadDelayed 387Jump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeWindow / User API: threadDelayed 1447Jump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeLast function: Thread delayed
                    Source: C:\Users\user\Desktop\aion-cracked.exeProcess information queried: ProcessInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeProcess token adjusted: DebugJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeProcess token adjusted: DebugJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeMemory allocated: page read and write | page guardJump to behavior

                    HIPS / PFW / Operating System Protection Evasion

                    barindex
                    .NET source code references suspicious native API functions
                    Source: aion-cracked.exe, CocaineClicker/Utils/Wrapper.csReference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32.dll')
                    Source: aion-cracked.exe, CocaineClicker/Utils/WinApi.csReference to suspicious API methods: ('MapVirtualKey', 'MapVirtualKey@user32.dll'), ('GetAsyncKeyState', 'GetAsyncKeyState@user32.dll')
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Users\user\Desktop\aion-cracked.exe VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\arial.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\comic.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\comici.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\consola.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\constan.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\constani.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\cour.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\couri.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\framd.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\impact.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\taile.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\pala.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\palai.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\palab.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeQueries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\aion-cracked.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

                    Mitre Att&ck Matrix

                    Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
                    Valid Accounts1
                    Native API                    		Path InterceptionPath Interception1
                    Disable or Modify Tools                    		OS Credential Dumping1
                    Process Discovery                    		Remote Services1
                    Archive Collected Data                    		Exfiltration Over Other Network Medium1
                    Encrypted Channel                    		Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
                    Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization Scripts1
                    Timestomp                    		LSASS Memory1
                    Application Window Discovery                    		Remote Desktop ProtocolData from Removable MediaExfiltration Over BluetoothJunk DataExploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
                    Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)1
                    Obfuscated Files or Information                    		Security Account Manager12
                    System Information Discovery                    		SMB/Windows Admin SharesData from Network Shared DriveAutomated ExfiltrationSteganographyExploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data

                    Behavior Graph

                    Hide Legend

                    Legend:

                    • Process
                    • Signature
                    • Created File
                    • DNS/IP Info
                    • Is Dropped
                    • Is Windows Process
                    • Number of created Registry Values
                    • Number of created Files
                    • Visual Basic
                    • Delphi
                    • Java
                    • .Net C# or VB.NET
                    • C, C++ or other language
                    • Is malicious
                    • Internet

                    Screenshots

                    Thumbnails

                    This section contains all screenshots as thumbnails, including those not shown in the slideshow.


                    windows-stand

                    Antivirus, Machine Learning and Genetic Malware Detection

                    Initial Sample

                    SourceDetectionScannerLabelLink
                    aion-cracked.exe4%ReversingLabs
                    aion-cracked.exe3%VirustotalBrowse

                    Dropped Files

                    ⊘No Antivirus matches

                    Unpacked PE Files

                    ⊘No Antivirus matches

                    Domains

                    ⊘No Antivirus matches

                    URLs

                    SourceDetectionScannerLabelLink
                    http://www.founder.com.cn/cn/bThe0%URL Reputationsafe
                    http://www.founder.com.cn/cn/bThe0%URL Reputationsafe
                    http://www.tiro.com0%URL Reputationsafe
                    http://www.carterandcone.com40%URL Reputationsafe
                    http://www.goodfont.co.kr0%URL Reputationsafe
                    http://www.carterandcone.com0%URL Reputationsafe
                    http://www.sajatypeworks.com0%URL Reputationsafe
                    http://www.typography.netD0%URL Reputationsafe
                    http://www.founder.com.cn/cn/cThe0%URL Reputationsafe
                    http://www.galapagosdesign.com/staff/dennis.htm0%URL Reputationsafe
                    http://fontfabrik.com0%URL Reputationsafe
                    http://www.fontbureau.comva0%URL Reputationsafe
                    http://www.founder.com.cn/cnx0%URL Reputationsafe
                    http://www.galapagosdesign.com/DPlease0%URL Reputationsafe
                    http://www.sandoll.co.kr0%URL Reputationsafe
                    http://www.urwpp.deDPlease0%URL Reputationsafe
                    http://www.zhongyicts.com.cn0%URL Reputationsafe
                    http://www.sakkal.com0%URL Reputationsafe
                    http://www.galapagosdesign.com/0%URL Reputationsafe
                    http://www.fontbureau.comF0%URL Reputationsafe
                    http://www.fontbureau.comic0%URL Reputationsafe
                    http://www.founder.com.cn/cnTF0%URL Reputationsafe
                    http://www.urwpp.deF0%URL Reputationsafe
                    http://www.fontbureau.comX0%URL Reputationsafe
                    http://www.jiyu-kobo.co.jp/jp/0%URL Reputationsafe
                    http://en.w0%URL Reputationsafe
                    http://www.carterandcone.coml0%URL Reputationsafe
                    http://www.founder.com.cn/cn/0%URL Reputationsafe
                    http://www.founder.com.cn/cn0%URL Reputationsafe
                    http://www.jiyu-kobo.co.jp/0%URL Reputationsafe
                    http://www.carterandcone.comAi0%Avira URL Cloudsafe
                    http://www.sandoll.co.krkk0%Avira URL Cloudsafe
                    http://www.fontbureau.com8EBi0%Avira URL Cloudsafe
                    http://www.jiyu-kobo.co.jp/jp/Bi0%Avira URL Cloudsafe
                    http://www.sansoxygen.comThis0%Avira URL Cloudsafe
                    http://www.sajatypeworks.comI0%Avira URL Cloudsafe
                    http://www.fontbureau.comSCI.TTF0%Avira URL Cloudsafe
                    http://www.jiyu-kobo.co.jp/jp/(=Bi0%Avira URL Cloudsafe
                    http://www.tiro.com(0%Avira URL Cloudsafe
                    http://www.zhongyicts.com.cnBi0%Avira URL Cloudsafe
                    http://www.jiyu-kobo.co.jp/Ai0%Avira URL Cloudsafe
                    http://www.sandoll.co.krxk0%Avira URL Cloudsafe
                    http://www.sajatypeworks.comn0%Avira URL Cloudsafe
                    http://www.founder.com.cn/cnCX0%Avira URL Cloudsafe
                    http://www.founder.com.cn/cnBi0%Avira URL Cloudsafe
                    http://www.sajatypeworks.comBi0%Avira URL Cloudsafe
                    http://www.fontbureau.comCH.TTFBi0%Avira URL Cloudsafe
                    http://www.founder.com.cn/cnAi0%Avira URL Cloudsafe
                    http://www.tiro.comz-f0%Avira URL Cloudsafe
                    http://www.sajatypeworks.comAi0%Avira URL Cloudsafe
                    http://www.urwpp.deh0%Avira URL Cloudsafe
                    http://www.carterandcone.comBi0%Avira URL Cloudsafe
                    http://www.sajatypeworks.comywa0%Avira URL Cloudsafe
                    https://buyaion.cc/api/auth/0%Avira URL Cloudsafe
                    http://www.jiyu-kobo.co.jp/Y0Bi0%Avira URL Cloudsafe
                    http://www.fontbureau.comMAN.TTF0%Avira URL Cloudsafe

                    Domains and IPs

                    Contacted Domains

                    ⊘No contacted domains info

                    URLs from Memory and Binaries

                    NameSourceMaliciousAntivirus DetectionReputation
                    http://www.fontbureau.com/designersGaion-cracked.exe, 00000000.00000002.536577963.000002BD6A6F2000.00000004.00000800.00020000.00000000.sdmpfalse
                      		high
                      http://www.fontbureau.com/designers/?aion-cracked.exe, 00000000.00000002.536577963.000002BD6A6F2000.00000004.00000800.00020000.00000000.sdmpfalse
                        		high
                        http://www.founder.com.cn/cn/bTheaion-cracked.exe, 00000000.00000002.536577963.000002BD6A6F2000.00000004.00000800.00020000.00000000.sdmpfalse
                        • URL Reputation: safe
                        • URL Reputation: safe
                        		unknown
                        http://www.fontbureau.com/designers?aion-cracked.exe, 00000000.00000002.536577963.000002BD6A6F2000.00000004.00000800.00020000.00000000.sdmpfalse
                          		high
                          http://www.carterandcone.comAiaion-cracked.exe, 00000000.00000003.266441477.000002BD6941C000.00000004.00000020.00020000.00000000.sdmp, aion-cracked.exe, 00000000.00000003.266705731.000002BD6941B000.00000004.00000020.00020000.00000000.sdmp, aion-cracked.exe, 00000000.00000003.266574913.000002BD6941B000.00000004.00000020.00020000.00000000.sdmp, aion-cracked.exe, 00000000.00000003.266369748.000002BD6941B000.00000004.00000020.00020000.00000000.sdmpfalse
                          • Avira URL Cloud: safe
                          		unknown
                          http://www.tiro.comaion-cracked.exe, 00000000.00000002.536577963.000002BD6A6F2000.00000004.00000800.00020000.00000000.sdmp, aion-cracked.exe, 00000000.00000003.266705731.000002BD6941B000.00000004.00000020.00020000.00000000.sdmpfalse
                          • URL Reputation: safe
                          		unknown
                          http://www.sandoll.co.krkkaion-cracked.exe, 00000000.00000003.263356906.000002BD6941B000.00000004.00000020.00020000.00000000.sdmpfalse
                          • Avira URL Cloud: safe
                          		unknown
                          http://www.fontbureau.com/designersaion-cracked.exe, 00000000.00000003.270770965.000002BD6941B000.00000004.00000020.00020000.00000000.sdmp, aion-cracked.exe, 00000000.00000003.270927104.000002BD6941B000.00000004.00000020.00020000.00000000.sdmpfalse
                            		high
                            http://www.fontbureau.com8EBiaion-cracked.exe, 00000000.00000003.271374962.000002BD6941B000.00000004.00000020.00020000.00000000.sdmpfalse
                            • Avira URL Cloud: safe
                            		unknown
                            http://www.carterandcone.com4aion-cracked.exe, 00000000.00000003.266369748.000002BD6941B000.00000004.00000020.00020000.00000000.sdmpfalse
                            • URL Reputation: safe
                            		unknown
                            http://www.goodfont.co.kraion-cracked.exe, 00000000.00000002.536577963.000002BD6A6F2000.00000004.00000800.00020000.00000000.sdmpfalse
                            • URL Reputation: safe
                            		unknown
                            http://www.carterandcone.comaion-cracked.exe, 00000000.00000003.266441477.000002BD6941C000.00000004.00000020.00020000.00000000.sdmp, aion-cracked.exe, 00000000.00000003.266646287.000002BD6941B000.00000004.00000020.00020000.00000000.sdmp, aion-cracked.exe, 00000000.00000003.266705731.000002BD6941B000.00000004.00000020.00020000.00000000.sdmp, aion-cracked.exe, 00000000.00000003.266574913.000002BD6941B000.00000004.00000020.00020000.00000000.sdmp, aion-cracked.exe, 00000000.00000003.266369748.000002BD6941B000.00000004.00000020.00020000.00000000.sdmp, aion-cracked.exe, 00000000.00000003.266796035.000002BD6941B000.00000004.00000020.00020000.00000000.sdmpfalse
                            • URL Reputation: safe
                            		unknown
                            http://www.sansoxygen.comThisaion-cracked.exefalse
                            • Avira URL Cloud: safe
                            		unknown
                            http://www.sajatypeworks.comIaion-cracked.exe, 00000000.00000003.260844071.000002BD69424000.00000004.00000020.00020000.00000000.sdmpfalse
                            • Avira URL Cloud: safe
                            		unknown
                            http://www.sajatypeworks.comaion-cracked.exe, 00000000.00000002.536577963.000002BD6A6F2000.00000004.00000800.00020000.00000000.sdmpfalse
                            • URL Reputation: safe
                            		unknown
                            http://www.typography.netDaion-cracked.exe, 00000000.00000002.536577963.000002BD6A6F2000.00000004.00000800.00020000.00000000.sdmpfalse
                            • URL Reputation: safe
                            		unknown
                            http://www.founder.com.cn/cn/cTheaion-cracked.exe, 00000000.00000002.536577963.000002BD6A6F2000.00000004.00000800.00020000.00000000.sdmpfalse
                            • URL Reputation: safe
                            		unknown
                            http://www.galapagosdesign.com/staff/dennis.htmaion-cracked.exe, 00000000.00000002.536577963.000002BD6A6F2000.00000004.00000800.00020000.00000000.sdmpfalse
                            • URL Reputation: safe
                            		unknown
                            http://fontfabrik.comaion-cracked.exe, 00000000.00000002.536577963.000002BD6A6F2000.00000004.00000800.00020000.00000000.sdmpfalse
                            • URL Reputation: safe
                            		unknown
                            http://www.fontbureau.comvaaion-cracked.exe, 00000000.00000003.272782999.000002BD6941B000.00000004.00000020.00020000.00000000.sdmp, aion-cracked.exe, 00000000.00000003.272719538.000002BD6941B000.00000004.00000020.00020000.00000000.sdmpfalse
                            • URL Reputation: safe
                            		unknown
                            http://www.founder.com.cn/cnxaion-cracked.exe, 00000000.00000003.264765286.000002BD6941B000.00000004.00000020.00020000.00000000.sdmpfalse
                            • URL Reputation: safe
                            		unknown
                            http://www.jiyu-kobo.co.jp/jp/Biaion-cracked.exe, 00000000.00000003.267501620.000002BD6941B000.00000004.00000020.00020000.00000000.sdmp, aion-cracked.exe, 00000000.00000003.267610448.000002BD6941B000.00000004.00000020.00020000.00000000.sdmp, aion-cracked.exe, 00000000.00000003.267743018.000002BD6941B000.00000004.00000020.00020000.00000000.sdmpfalse
                            • Avira URL Cloud: safe
                            		unknown
                            http://www.galapagosdesign.com/DPleaseaion-cracked.exe, 00000000.00000002.536577963.000002BD6A6F2000.00000004.00000800.00020000.00000000.sdmpfalse
                            • URL Reputation: safe
                            		unknown
                            http://scripts.sil.org/OFLhttp://scripts.sil.oaion-cracked.exefalse
                              		high
                              http://www.fontbureau.comSCI.TTFaion-cracked.exe, 00000000.00000003.271164013.000002BD6941B000.00000004.00000020.00020000.00000000.sdmp, aion-cracked.exe, 00000000.00000003.271374962.000002BD6941B000.00000004.00000020.00020000.00000000.sdmp, aion-cracked.exe, 00000000.00000003.271265789.000002BD6941B000.00000004.00000020.00020000.00000000.sdmpfalse
                              • Avira URL Cloud: safe
                              		unknown
                              http://www.fonts.comaion-cracked.exe, 00000000.00000002.536577963.000002BD6A6F2000.00000004.00000800.00020000.00000000.sdmpfalse
                                		high
                                http://www.sandoll.co.kraion-cracked.exe, 00000000.00000002.536577963.000002BD6A6F2000.00000004.00000800.00020000.00000000.sdmp, aion-cracked.exe, 00000000.00000003.263356906.000002BD6941B000.00000004.00000020.00020000.00000000.sdmp, aion-cracked.exe, 00000000.00000003.263233512.000002BD6941B000.00000004.00000020.00020000.00000000.sdmpfalse
                                • URL Reputation: safe
                                		unknown
                                http://scripts.sil.org/OFLhttp://scripts.sil.org/OFLaion-cracked.exefalse
                                  		high
                                  http://www.urwpp.deDPleaseaion-cracked.exe, 00000000.00000002.536577963.000002BD6A6F2000.00000004.00000800.00020000.00000000.sdmpfalse
                                  • URL Reputation: safe
                                  		unknown
                                  http://www.jiyu-kobo.co.jp/jp/(=Biaion-cracked.exe, 00000000.00000003.267610448.000002BD6941B000.00000004.00000020.00020000.00000000.sdmpfalse
                                  • Avira URL Cloud: safe
                                  		unknown
                                  http://www.tiro.com(aion-cracked.exe, 00000000.00000003.266705731.000002BD6941B000.00000004.00000020.00020000.00000000.sdmpfalse
                                  • Avira URL Cloud: safe
                                  		low
                                  http://www.zhongyicts.com.cnaion-cracked.exe, 00000000.00000002.536577963.000002BD6A6F2000.00000004.00000800.00020000.00000000.sdmpfalse
                                  • URL Reputation: safe
                                  		unknown
                                  http://www.zhongyicts.com.cnBiaion-cracked.exe, 00000000.00000003.266246611.000002BD6941B000.00000004.00000020.00020000.00000000.sdmpfalse
                                  • Avira URL Cloud: safe
                                  		unknown
                                  http://www.sakkal.comaion-cracked.exe, 00000000.00000003.267949419.000002BD6941B000.00000004.00000020.00020000.00000000.sdmp, aion-cracked.exe, 00000000.00000002.536577963.000002BD6A6F2000.00000004.00000800.00020000.00000000.sdmp, aion-cracked.exe, 00000000.00000003.268051179.000002BD6942B000.00000004.00000020.00020000.00000000.sdmp, aion-cracked.exe, 00000000.00000003.267994582.000002BD6941B000.00000004.00000020.00020000.00000000.sdmp, aion-cracked.exe, 00000000.00000003.267872869.000002BD6941B000.00000004.00000020.00020000.00000000.sdmpfalse
                                  • URL Reputation: safe
                                  		unknown
                                  http://www.fontbureau.com/designers/Ciaion-cracked.exe, 00000000.00000003.270487843.000002BD6941B000.00000004.00000020.00020000.00000000.sdmp, aion-cracked.exe, 00000000.00000003.270608154.000002BD6941B000.00000004.00000020.00020000.00000000.sdmpfalse
                                    		high
                                    http://www.fontbureau.com/designersers/aion-cracked.exe, 00000000.00000003.270608154.000002BD6941B000.00000004.00000020.00020000.00000000.sdmpfalse
                                      		high
                                      http://www.sandoll.co.krxkaion-cracked.exe, 00000000.00000003.263233512.000002BD6941B000.00000004.00000020.00020000.00000000.sdmpfalse
                                      • Avira URL Cloud: safe
                                      		unknown
                                      http://www.sajatypeworks.comnaion-cracked.exe, 00000000.00000003.260844071.000002BD69424000.00000004.00000020.00020000.00000000.sdmpfalse
                                      • Avira URL Cloud: safe
                                      		unknown
                                      http://www.jiyu-kobo.co.jp/Aiaion-cracked.exe, 00000000.00000003.267501620.000002BD6941B000.00000004.00000020.00020000.00000000.sdmp, aion-cracked.exe, 00000000.00000003.267610448.000002BD6941B000.00000004.00000020.00020000.00000000.sdmp, aion-cracked.exe, 00000000.00000003.267743018.000002BD6941B000.00000004.00000020.00020000.00000000.sdmpfalse
                                      • Avira URL Cloud: safe
                                      		unknown
                                      http://www.apache.org/licenses/LICENSE-2.0aion-cracked.exe, 00000000.00000002.536577963.000002BD6A6F2000.00000004.00000800.00020000.00000000.sdmpfalse
                                        		high
                                        http://www.fontbureau.comaion-cracked.exe, 00000000.00000003.270487843.000002BD6941B000.00000004.00000020.00020000.00000000.sdmp, aion-cracked.exe, 00000000.00000003.271164013.000002BD6941B000.00000004.00000020.00020000.00000000.sdmp, aion-cracked.exe, 00000000.00000003.272225109.000002BD6941B000.00000004.00000020.00020000.00000000.sdmp, aion-cracked.exe, 00000000.00000002.536577963.000002BD6A6F2000.00000004.00000800.00020000.00000000.sdmp, aion-cracked.exe, 00000000.00000003.272317655.000002BD6941B000.00000004.00000020.00020000.00000000.sdmp, aion-cracked.exe, 00000000.00000003.271822754.000002BD6941B000.00000004.00000020.00020000.00000000.sdmp, aion-cracked.exe, 00000000.00000003.277774804.000002BD6941B000.00000004.00000020.00020000.00000000.sdmp, aion-cracked.exe, 00000000.00000003.272364127.000002BD6941B000.00000004.00000020.00020000.00000000.sdmpfalse
                                          		high
                                          http://www.galapagosdesign.com/aion-cracked.exe, 00000000.00000003.274611359.000002BD6941B000.00000004.00000020.00020000.00000000.sdmpfalse
                                          • URL Reputation: safe
                                          		unknown
                                          http://www.fontbureau.comFaion-cracked.exe, 00000000.00000003.270487843.000002BD6941B000.00000004.00000020.00020000.00000000.sdmp, aion-cracked.exe, 00000000.00000003.270608154.000002BD6941B000.00000004.00000020.00020000.00000000.sdmpfalse
                                          • URL Reputation: safe
                                          		unknown
                                          http://www.founder.com.cn/cnBiaion-cracked.exe, 00000000.00000003.264608930.000002BD6941B000.00000004.00000020.00020000.00000000.sdmp, aion-cracked.exe, 00000000.00000003.264488481.000002BD6941B000.00000004.00000020.00020000.00000000.sdmp, aion-cracked.exe, 00000000.00000003.264765286.000002BD6941B000.00000004.00000020.00020000.00000000.sdmpfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          http://www.fontbureau.comicaion-cracked.exe, 00000000.00000003.277958537.000002BD6941B000.00000004.00000020.00020000.00000000.sdmp, aion-cracked.exe, 00000000.00000003.277774804.000002BD6941B000.00000004.00000020.00020000.00000000.sdmpfalse
                                          • URL Reputation: safe
                                          		unknown
                                          http://www.founder.com.cn/cnCXaion-cracked.exe, 00000000.00000003.264962550.000002BD6941B000.00000004.00000020.00020000.00000000.sdmpfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          http://www.founder.com.cn/cnTFaion-cracked.exe, 00000000.00000003.264488481.000002BD6941B000.00000004.00000020.00020000.00000000.sdmpfalse
                                          • URL Reputation: safe
                                          		unknown
                                          http://www.sajatypeworks.comBiaion-cracked.exe, 00000000.00000003.260844071.000002BD69424000.00000004.00000020.00020000.00000000.sdmpfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          http://www.urwpp.deFaion-cracked.exe, 00000000.00000003.272833191.000002BD6941B000.00000004.00000020.00020000.00000000.sdmpfalse
                                          • URL Reputation: safe
                                          		unknown
                                          http://www.fontbureau.comXaion-cracked.exe, 00000000.00000003.271866728.000002BD6941B000.00000004.00000020.00020000.00000000.sdmpfalse
                                          • URL Reputation: safe
                                          		unknown
                                          http://www.jiyu-kobo.co.jp/jp/aion-cracked.exe, 00000000.00000003.267501620.000002BD6941B000.00000004.00000020.00020000.00000000.sdmpfalse
                                          • URL Reputation: safe
                                          		unknown
                                          http://www.fontbureau.comCH.TTFBiaion-cracked.exe, 00000000.00000003.272782999.000002BD6941B000.00000004.00000020.00020000.00000000.sdmp, aion-cracked.exe, 00000000.00000003.272719538.000002BD6941B000.00000004.00000020.00020000.00000000.sdmp, aion-cracked.exe, 00000000.00000003.272630059.000002BD6941B000.00000004.00000020.00020000.00000000.sdmpfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          http://en.waion-cracked.exe, 00000000.00000003.260433075.000002BD69402000.00000004.00000020.00020000.00000000.sdmp, aion-cracked.exe, 00000000.00000003.267059856.000002BD6941B000.00000004.00000020.00020000.00000000.sdmp, aion-cracked.exe, 00000000.00000003.260905894.000002BD6941B000.00000004.00000020.00020000.00000000.sdmp, aion-cracked.exe, 00000000.00000003.267004352.000002BD6941B000.00000004.00000020.00020000.00000000.sdmp, aion-cracked.exe, 00000000.00000003.266840008.000002BD6941B000.00000004.00000020.00020000.00000000.sdmp, aion-cracked.exe, 00000000.00000003.266796035.000002BD6941B000.00000004.00000020.00020000.00000000.sdmp, aion-cracked.exe, 00000000.00000003.260929026.000002BD69426000.00000004.00000020.00020000.00000000.sdmpfalse
                                          • URL Reputation: safe
                                          		unknown
                                          http://www.carterandcone.comlaion-cracked.exe, 00000000.00000002.536577963.000002BD6A6F2000.00000004.00000800.00020000.00000000.sdmpfalse
                                          • URL Reputation: safe
                                          		unknown
                                          http://www.founder.com.cn/cn/aion-cracked.exe, 00000000.00000003.265176078.000002BD6941B000.00000004.00000020.00020000.00000000.sdmpfalse
                                          • URL Reputation: safe
                                          		unknown
                                          http://www.fontbureau.com/designers/cabarga.htmlNaion-cracked.exe, 00000000.00000002.536577963.000002BD6A6F2000.00000004.00000800.00020000.00000000.sdmpfalse
                                            		high
                                            http://www.founder.com.cn/cnaion-cracked.exe, 00000000.00000002.536577963.000002BD6A6F2000.00000004.00000800.00020000.00000000.sdmp, aion-cracked.exe, 00000000.00000003.264488481.000002BD6941B000.00000004.00000020.00020000.00000000.sdmpfalse
                                            • URL Reputation: safe
                                            		unknown
                                            http://www.fontbureau.com/designers/frere-jones.htmlaion-cracked.exe, 00000000.00000002.536577963.000002BD6A6F2000.00000004.00000800.00020000.00000000.sdmp, aion-cracked.exe, 00000000.00000003.271822754.000002BD6941B000.00000004.00000020.00020000.00000000.sdmpfalse
                                              		high
                                              http://www.founder.com.cn/cnAiaion-cracked.exe, 00000000.00000003.264608930.000002BD6941B000.00000004.00000020.00020000.00000000.sdmp, aion-cracked.exe, 00000000.00000003.265005726.000002BD6941B000.00000004.00000020.00020000.00000000.sdmp, aion-cracked.exe, 00000000.00000003.264488481.000002BD6941B000.00000004.00000020.00020000.00000000.sdmp, aion-cracked.exe, 00000000.00000003.264962550.000002BD6941B000.00000004.00000020.00020000.00000000.sdmp, aion-cracked.exe, 00000000.00000003.264765286.000002BD6941B000.00000004.00000020.00020000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              https://github.com/googlefonts/nunito)NunitoRegular3.601;NONE;Nunito-RegularNunitoaion-cracked.exefalse
                                                		high
                                                http://www.fontbureau.com/designers/cabarga.htmlaion-cracked.exe, 00000000.00000003.272225109.000002BD6941B000.00000004.00000020.00020000.00000000.sdmp, aion-cracked.exe, 00000000.00000003.272272052.000002BD6941B000.00000004.00000020.00020000.00000000.sdmpfalse
                                                  		high
                                                  http://www.tiro.comz-faion-cracked.exe, 00000000.00000003.265512305.000002BD6941B000.00000004.00000020.00020000.00000000.sdmpfalse
                                                  • Avira URL Cloud: safe
                                                  		unknown
                                                  http://www.jiyu-kobo.co.jp/aion-cracked.exe, 00000000.00000002.536577963.000002BD6A6F2000.00000004.00000800.00020000.00000000.sdmp, aion-cracked.exe, 00000000.00000003.267501620.000002BD6941B000.00000004.00000020.00020000.00000000.sdmp, aion-cracked.exe, 00000000.00000003.267610448.000002BD6941B000.00000004.00000020.00020000.00000000.sdmp, aion-cracked.exe, 00000000.00000003.267743018.000002BD6941B000.00000004.00000020.00020000.00000000.sdmpfalse
                                                  • URL Reputation: safe
                                                  		unknown
                                                  http://www.sajatypeworks.comAiaion-cracked.exe, 00000000.00000003.260844071.000002BD69424000.00000004.00000020.00020000.00000000.sdmpfalse
                                                  • Avira URL Cloud: safe
                                                  		unknown
                                                  http://www.urwpp.dehaion-cracked.exe, 00000000.00000003.272833191.000002BD6941B000.00000004.00000020.00020000.00000000.sdmpfalse
                                                  • Avira URL Cloud: safe
                                                  		unknown
                                                  http://www.carterandcone.comBiaion-cracked.exe, 00000000.00000003.266705731.000002BD6941B000.00000004.00000020.00020000.00000000.sdmpfalse
                                                  • Avira URL Cloud: safe
                                                  		unknown
                                                  http://www.fontbureau.com/designers8aion-cracked.exe, 00000000.00000002.536577963.000002BD6A6F2000.00000004.00000800.00020000.00000000.sdmpfalse
                                                    		high
                                                    http://www.sajatypeworks.comywaaion-cracked.exe, 00000000.00000003.260844071.000002BD69424000.00000004.00000020.00020000.00000000.sdmpfalse
                                                    • Avira URL Cloud: safe
                                                    		unknown
                                                    http://www.fontbureau.com/designers/frere-jones.htmla-dkaion-cracked.exe, 00000000.00000003.271822754.000002BD6941B000.00000004.00000020.00020000.00000000.sdmpfalse
                                                      		high
                                                      http://www.fontbureau.com/designers0aion-cracked.exe, 00000000.00000003.271164013.000002BD6941B000.00000004.00000020.00020000.00000000.sdmp, aion-cracked.exe, 00000000.00000003.271374962.000002BD6941B000.00000004.00000020.00020000.00000000.sdmp, aion-cracked.exe, 00000000.00000003.271431870.000002BD6941B000.00000004.00000020.00020000.00000000.sdmp, aion-cracked.exe, 00000000.00000003.271265789.000002BD6941B000.00000004.00000020.00020000.00000000.sdmp, aion-cracked.exe, 00000000.00000003.271480501.000002BD6941B000.00000004.00000020.00020000.00000000.sdmpfalse
                                                        		high
                                                        http://www.fontbureau.com/designers/aion-cracked.exe, 00000000.00000003.270487843.000002BD6941B000.00000004.00000020.00020000.00000000.sdmpfalse
                                                          		high
                                                          https://buyaion.cc/api/auth/aion-cracked.exefalse
                                                          • Avira URL Cloud: safe
                                                          		unknown
                                                          http://www.fontbureau.comMAN.TTFaion-cracked.exe, 00000000.00000003.272719538.000002BD6941B000.00000004.00000020.00020000.00000000.sdmpfalse
                                                          • Avira URL Cloud: safe
                                                          		unknown
                                                          http://www.jiyu-kobo.co.jp/Y0Biaion-cracked.exe, 00000000.00000003.267814456.000002BD6941B000.00000004.00000020.00020000.00000000.sdmp, aion-cracked.exe, 00000000.00000003.267501620.000002BD6941B000.00000004.00000020.00020000.00000000.sdmp, aion-cracked.exe, 00000000.00000003.267610448.000002BD6941B000.00000004.00000020.00020000.00000000.sdmp, aion-cracked.exe, 00000000.00000003.267872869.000002BD6941B000.00000004.00000020.00020000.00000000.sdmp, aion-cracked.exe, 00000000.00000003.267743018.000002BD6941B000.00000004.00000020.00020000.00000000.sdmpfalse
                                                          • Avira URL Cloud: safe
                                                          		unknown
                                                          http://www.fontbureau.com/designers2aion-cracked.exe, 00000000.00000003.277873108.000002BD69435000.00000004.00000020.00020000.00000000.sdmp, aion-cracked.exe, 00000000.00000003.277774804.000002BD6941B000.00000004.00000020.00020000.00000000.sdmpfalse
                                                            		high

                                                            World Map of Contacted IPs

                                                            ⊘No contacted IP infos

                                                            General Information

                                                            Joe Sandbox Version:35.0.0 Citrine
                                                            Analysis ID:697110
                                                            Start date and time:2022-09-03 19:48:12 +02:00
                                                            Joe Sandbox Product:CloudBasic
                                                            Overall analysis duration:0h 5m 44s
                                                            Hypervisor based Inspection enabled:false
                                                            Report type:full
                                                            Sample file name:aion-cracked.exe
                                                            Cookbook file name:default.jbs
                                                            Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
                                                            Number of analysed new started processes analysed:12
                                                            Number of new started drivers analysed:0
                                                            Number of existing processes analysed:0
                                                            Number of existing drivers analysed:0
                                                            Number of injected processes analysed:0
                                                            Technologies:
                                                            • HCA enabled
                                                            • EGA enabled
                                                            • HDC enabled
                                                            • AMSI enabled
                                                            Analysis Mode:default
                                                            Analysis stop reason:Timeout
                                                            Detection:MAL
                                                            Classification:mal52.evad.winEXE@1/1@0/0
                                                            EGA Information:Failed
                                                            HDC Information:Failed
                                                            HCA Information:
                                                            • Successful, ratio: 100%
                                                            • Number of executed functions: 0
                                                            • Number of non-executed functions: 23
                                                            Cookbook Comments:
                                                            • Found application associated with file extension: .exe
                                                            • Adjust boot time
                                                            • Enable AMSI

                                                            Warnings

                                                            • Exclude process from analysis (whitelisted): MpCmdRun.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe
                                                            • Excluded domains from analysis (whitelisted): fs.microsoft.com, ctldl.windowsupdate.com
                                                            • Execution Graph export aborted for target aion-cracked.exe, PID 5624 because there are no executed function
                                                            • Not all processes where analyzed, report is missing behavior information
                                                            • Report size getting too big, too many NtAllocateVirtualMemory calls found.

                                                            Simulations

                                                            Behavior and APIs

                                                            ⊘No simulations

                                                            Joe Sandbox View / Context

                                                            IPs

                                                            ⊘No context

                                                            Domains

                                                            ⊘No context

                                                            ASNs

                                                            ⊘No context

                                                            JA3 Fingerprints

                                                            ⊘No context

                                                            Dropped Files

                                                            ⊘No context

                                                            Created / dropped Files

                                                            C:\Users\user\AppData\Local\Temp\Bleak\DLL\k42mwtii.osp.dll

                                                            Download File
                                                            Process:C:\Users\user\Desktop\aion-cracked.exe
                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                            Category:dropped
                                                            Size (bytes):10752
                                                            Entropy (8bit):4.711447947816425
                                                            Encrypted:false
                                                            SSDEEP:96:GO0PwuBLEPhgmGjNLofGuU01JVarP3JZUvzXsPUTUNfzk4SgGG/7o5WKR4SXiU/g:J4LFmIwvU0L+nUzR0XD0KQiU/D
                                                            MD5:41C15B5C8BBD14348788F15D69C7E45E
                                                            SHA1:8D904545B85CA4633FEECC0A3564B81D66B85DF0
                                                            SHA-256:3A8066B5ADC64D3C9A330A74EB47DE9B8855DE0FA25E9ABCEC51DC2454B245D7
                                                            SHA-512:900700D6013D73669D86602F78D70971A6CDC651D2483B8E0E86F2DE5E3A42767BDFAA73F414BE0B5F1D303FAA689503FA55559A2B73D4657B6D37B44FBEADAC
                                                            Malicious:false
                                                            Reputation:low
                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........I.(..(..(..P..(..>Y..(..>Y..(..>Y..(..>Y..(...@..(..(..(...Z..(...Z..(...Zt.(...Z..(..Rich.(..................PE..d...6..a.........." .........................................................p............`..........................................'.......(..d....P.......@...............`..$....!..p............................"..8............ ...............................text............................... ..`.rdata....... ......................@..@.data...H....0......."..............@....pdata.......@.......$..............@..@.rsrc........P.......&..............@..@.reloc..$....`.......(..............@..B................................................................................................................................................................................................................................................

                                                            Static File Info

                                                            General

                                                            File type:PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
                                                            Entropy (8bit):6.148589140616308
                                                            TrID:
                                                            • Win64 Executable GUI Net Framework (217006/5) 49.88%
                                                            • Win64 Executable GUI (202006/5) 46.43%
                                                            • Win64 Executable (generic) (12005/4) 2.76%
                                                            • Generic Win/DOS Executable (2004/3) 0.46%
                                                            • DOS Executable Generic (2002/1) 0.46%
                                                            File name:aion-cracked.exe
                                                            File size:2121728
                                                            MD5:154e8609046ecf8b45e7b62773b51cc2
                                                            SHA1:d41ea7ac08846d7bc0541191327e06dd260d67fc
                                                            SHA256:1a1649dead5505b7a692b868d15ebcf964497e284461d927513e7b8cc7f7fb0c
                                                            SHA512:e912630e60330f6ca929672a6631daa8b33f15c0e23e4f2f3ff8f43729e368246fd92b854c22127daba91ead4772be17b7bc3d69d354f0fe10302b512c3bb25f
                                                            SSDEEP:24576:95wgrBlbK5HdekH+lTZeOW5z3x7KapD+2XNyoaC/NCrA0lcIJcv:TSdekHkTZ4N5Kah/aC/NcA0l
                                                            TLSH:25A5AE52B6658E06C82D4EB5486397E157B27E537F1AC38B78C536CE2EF3BC10612683
                                                            File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d....h............"...0..X .............. ....@...... ........................ ...........`...@......@............... .....

                                                            File Icon

                                                            Icon Hash:00828e8e8686b000

                                                            Static PE Info

                                                            General

                                                            Entrypoint:0x400000
                                                            Entrypoint Section:
                                                            Digitally signed:false
                                                            Imagebase:0x400000
                                                            Subsystem:windows gui
                                                            Image File Characteristics:EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
                                                            DLL Characteristics:HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
                                                            Time Stamp:0xA2C068EF [Tue Jul 11 05:26:07 2056 UTC]
                                                            TLS Callbacks:
                                                            CLR (.Net) Version:
                                                            OS Version Major:4
                                                            OS Version Minor:0
                                                            File Version Major:4
                                                            File Version Minor:0
                                                            Subsystem Version Major:4
                                                            Subsystem Version Minor:0
                                                            Import Hash:

                                                            Entrypoint Preview

                                                            Instruction
                                                            dec ebp
                                                            pop edx
                                                            nop
                                                            add byte ptr [ebx], al
                                                            add byte ptr [eax], al
                                                            add byte ptr [eax+eax], al
                                                            add byte ptr [eax], al

                                                            Data Directories

                                                            NameVirtual AddressVirtual Size Is in Section
                                                            IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                            IMAGE_DIRECTORY_ENTRY_IMPORT0x00x0
                                                            IMAGE_DIRECTORY_ENTRY_RESOURCE0x2080000x59c.rsrc
                                                            IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                            IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                            IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
                                                            IMAGE_DIRECTORY_ENTRY_DEBUG0x2076440x38.text
                                                            IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                            IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                            IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                            IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                            IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                            IMAGE_DIRECTORY_ENTRY_IAT0x00x0
                                                            IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                            IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x20000x48.text
                                                            IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                            Sections

                                                            NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                            .text0x20000x2057180x205800unknownunknownunknownunknownIMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                            .rsrc0x2080000x59c0x600False0.41015625data4.051018678748145IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

                                                            Resources

                                                            NameRVASizeTypeLanguageCountry
                                                            RT_VERSION0x2080900x30cdata
                                                            RT_MANIFEST0x2083ac0x1eaXML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

                                                            Network Behavior

                                                            ⊘No network behavior found

                                                            Statistics

                                                            CPU Usage

                                                            Click to jump to process

                                                            Memory Usage

                                                            Click to jump to process

                                                            High Level Behavior Distribution

                                                            Click to dive into process behavior distribution

                                                            System Behavior

                                                            General

                                                            Target ID:0
                                                            Start time:19:49:10
                                                            Start date:03/09/2022
                                                            Path:C:\Users\user\Desktop\aion-cracked.exe
                                                            Wow64 process (32bit):false
                                                            Commandline:"C:\Users\user\Desktop\aion-cracked.exe"
                                                            Imagebase:0x2bd66b30000
                                                            File size:2121728 bytes
                                                            MD5 hash:154E8609046ECF8B45E7B62773B51CC2
                                                            Has elevated privileges:true
                                                            Has administrator privileges:true
                                                            Programmed in:.Net C# or VB.NET
                                                            Yara matches:
                                                            • Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000000.00000002.533909469.000002BD66BE9000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security
                                                            • Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000000.00000000.256492023.000002BD66BE9000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security
                                                            • Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000000.00000002.522205908.000002BD00001000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                            Reputation:low

                                                            Disassembly

                                                            Reset < >

                                                              Non-executed Functions

                                                              Function 000002BD6AD0D11B Relevance: .6, Instructions: 636COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000003.301878072.000002BD6AD00000.00000004.00000800.00020000.00000000.sdmp, Offset: 000002BD6AD00000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_3_2bd6ad00000_aion-cracked.1.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: de18d79be36bc40e73f53720e6ca9bdfd98dfa702eca069a27859a37504d8afe
                                                              • Instruction ID: fbc0304fba21a5c031ed625258942f59da594e36ffb124b8acc8721ce224f7da
                                                              • Opcode Fuzzy Hash: de18d79be36bc40e73f53720e6ca9bdfd98dfa702eca069a27859a37504d8afe
                                                              • Instruction Fuzzy Hash: 4332345244E3D25FC71787B858B8194BFB09E4B02079E4ADBC0E08F4F3E649295BE726
                                                              Uniqueness

                                                              Uniqueness Score: -1.00%

                                                              Function 000002BD6AD04CFC Relevance: .6, Instructions: 580COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000003.301878072.000002BD6AD00000.00000004.00000800.00020000.00000000.sdmp, Offset: 000002BD6AD00000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_3_2bd6ad00000_aion-cracked.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 844c3c1f31d178d1ac37ddc012e9bc397d6e7e74c6f851c86bf1682a3135a862
                                                              • Instruction ID: 2b1fd51516944e91e0598a51921af717f0778440166f784439d1a66859c9a96a
                                                              • Opcode Fuzzy Hash: 844c3c1f31d178d1ac37ddc012e9bc397d6e7e74c6f851c86bf1682a3135a862
                                                              • Instruction Fuzzy Hash: 3A22E2A240E3C40FC7178B7848BA5A4BFB19E5B110B5E49DBC8D18F0F3E518686BD762
                                                              Uniqueness

                                                              Uniqueness Score: -1.00%

                                                              Function 000002BD6AD0A398 Relevance: .5, Instructions: 546COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000003.301878072.000002BD6AD00000.00000004.00000800.00020000.00000000.sdmp, Offset: 000002BD6AD00000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_3_2bd6ad00000_aion-cracked.1.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 8455250bc8237ebf33dcb2ce2ca82288e24a9cb988b57c5d9bf30f64e1f15af3
                                                              • Instruction ID: 5a3ed6725a5daf88e2dc4d2663dc6d02e8113db0a18c383ced63c7f14285f566
                                                              • Opcode Fuzzy Hash: 8455250bc8237ebf33dcb2ce2ca82288e24a9cb988b57c5d9bf30f64e1f15af3
                                                              • Instruction Fuzzy Hash: 7D12155140E7C10FC317877859B91A4BFB09E5B110B8E4ADBC0E1CF5E3E60969ABE362
                                                              Uniqueness

                                                              Uniqueness Score: -1.00%

                                                              Function 000002BD6AD06A3B Relevance: .5, Instructions: 486COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000003.301878072.000002BD6AD00000.00000004.00000800.00020000.00000000.sdmp, Offset: 000002BD6AD00000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_3_2bd6ad00000_aion-cracked.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: b08fb974acf564fce2aa4518886130c755af3c7de1794ba9215a19f1ad6f6794
                                                              • Instruction ID: 8259efc4ab521a56e51f8afcc7085dd12289407589ffa8b8df0b2d5f72c76bf9
                                                              • Opcode Fuzzy Hash: b08fb974acf564fce2aa4518886130c755af3c7de1794ba9215a19f1ad6f6794
                                                              • Instruction Fuzzy Hash: 1F12015140E7C10FC71797B849B9594BFB09E47014B8E86DBC0E1CF9E3EA09699BE362
                                                              Uniqueness

                                                              Uniqueness Score: -1.00%

                                                              Function 000002BD6AD07BDB Relevance: .5, Instructions: 465COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000003.301878072.000002BD6AD00000.00000004.00000800.00020000.00000000.sdmp, Offset: 000002BD6AD00000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_3_2bd6ad00000_aion-cracked.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 3b013c4c0149682a0edb18a68c270823456647bbcbf8599980b5b7ba00548534
                                                              • Instruction ID: 2cf4879df1945b43c562701e19b6e80cb68e07023227dbd83f3ffc091e1d2402
                                                              • Opcode Fuzzy Hash: 3b013c4c0149682a0edb18a68c270823456647bbcbf8599980b5b7ba00548534
                                                              • Instruction Fuzzy Hash: 8D02E04640E7D22FD70747B81DB46A4BFB09E1B120B5E0ACBD1E49F0F7E609185AE722
                                                              Uniqueness

                                                              Uniqueness Score: -1.00%

                                                              Function 000002BD6AD06B1B Relevance: .4, Instructions: 449COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000003.301878072.000002BD6AD00000.00000004.00000800.00020000.00000000.sdmp, Offset: 000002BD6AD00000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_3_2bd6ad00000_aion-cracked.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 60962e8ab20a94a30d39da9582982c2f7051d6d87894763959c66c203244c06b
                                                              • Instruction ID: 6b0fe66dc1eabcddf0849c8925866ee14a2b3160f58fd198fa7e9188f64be6af
                                                              • Opcode Fuzzy Hash: 60962e8ab20a94a30d39da9582982c2f7051d6d87894763959c66c203244c06b
                                                              • Instruction Fuzzy Hash: 1D02025140E7C10FC717977849B9594BFB09E47014B8E86DBC0E1CF9F3EA09695AE362
                                                              Uniqueness

                                                              Uniqueness Score: -1.00%

                                                              Function 000002BD6AD0F5FB Relevance: .4, Instructions: 408COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000003.301878072.000002BD6AD00000.00000004.00000800.00020000.00000000.sdmp, Offset: 000002BD6AD00000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_3_2bd6ad00000_aion-cracked.1.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 0ecdf39472038b9394aa1d5a19318d24d4cc0560335b9092aab52e09e82e64f9
                                                              • Instruction ID: 7edee54708e68cb15353b8f7ead6c03e2a40713b7e9e291ab99dff089827e5f7
                                                              • Opcode Fuzzy Hash: 0ecdf39472038b9394aa1d5a19318d24d4cc0560335b9092aab52e09e82e64f9
                                                              • Instruction Fuzzy Hash: 7AE1181540E7C25FD70787B859B95A8BFB09E4702079E46DBC4E18F4F3EA09295BE322
                                                              Uniqueness

                                                              Uniqueness Score: -1.00%

                                                              Function 000002BD6AD0606B Relevance: .4, Instructions: 391COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000003.301878072.000002BD6AD00000.00000004.00000800.00020000.00000000.sdmp, Offset: 000002BD6AD00000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_3_2bd6ad00000_aion-cracked.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 185c68aad3c0392eb9f57f7d74a7bc0ab05a91df1fa51374befdda214aa5e630
                                                              • Instruction ID: 0fad3991c5cb75920ed1fc4df7a7b8176852924079d7dac1a62a64eef5fd61ba
                                                              • Opcode Fuzzy Hash: 185c68aad3c0392eb9f57f7d74a7bc0ab05a91df1fa51374befdda214aa5e630
                                                              • Instruction Fuzzy Hash: 01E1321240E3C15FC70797B859B95A4BFB09E5B02079E46DBC0E1CF4F7EA49285AE362
                                                              Uniqueness

                                                              Uniqueness Score: -1.00%

                                                              Function 000002BD6AD081EB Relevance: .4, Instructions: 383COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000003.301878072.000002BD6AD00000.00000004.00000800.00020000.00000000.sdmp, Offset: 000002BD6AD00000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_3_2bd6ad00000_aion-cracked.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: c0916e72a76ef0f7d56322dcbf66027dfd7ab455c4956f328a4a79d45a2dd7ec
                                                              • Instruction ID: 6b093cc1730ce36f9c94afe503c7eba452f753a7b3e8e0492e35fbd389af6e04
                                                              • Opcode Fuzzy Hash: c0916e72a76ef0f7d56322dcbf66027dfd7ab455c4956f328a4a79d45a2dd7ec
                                                              • Instruction Fuzzy Hash: FAE1434240E3C10FD70797B858B92A4BFB19E57120B9E46DBC4E1CF1F3E609596AD722
                                                              Uniqueness

                                                              Uniqueness Score: -1.00%

                                                              Function 000002BD6AD054DB Relevance: .4, Instructions: 381COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000003.301878072.000002BD6AD00000.00000004.00000800.00020000.00000000.sdmp, Offset: 000002BD6AD00000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_3_2bd6ad00000_aion-cracked.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 258a8eb6ec747ad11c0d55c713e5f57ba617912fc49609a81c1b866567041ec9
                                                              • Instruction ID: 40146aafc63f3468110b6c48ef1780205e58547a78a3591421d170d941aba16f
                                                              • Opcode Fuzzy Hash: 258a8eb6ec747ad11c0d55c713e5f57ba617912fc49609a81c1b866567041ec9
                                                              • Instruction Fuzzy Hash: 4DE1EF0144E7C21FC31787B859B55A5BFB09E4712478E4ADBC4E1CF4F7E60929AAE322
                                                              Uniqueness

                                                              Uniqueness Score: -1.00%

                                                              Function 000002BD6AD0ED03 Relevance: .4, Instructions: 364COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000003.301878072.000002BD6AD00000.00000004.00000800.00020000.00000000.sdmp, Offset: 000002BD6AD00000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_3_2bd6ad00000_aion-cracked.1.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 7879ebd74714824cad2f0bacdc0bb479d55b0e1b8c371bbd3bef4e651b0e93b7
                                                              • Instruction ID: ff6190637b2d8c5fa57350fb1d4c6ea4b9c1288386459a61b60336f1a4e8a8e6
                                                              • Opcode Fuzzy Hash: 7879ebd74714824cad2f0bacdc0bb479d55b0e1b8c371bbd3bef4e651b0e93b7
                                                              • Instruction Fuzzy Hash: EFE11A1140F7C24FD31797B849B91A4BFB09E4702078E46DBC4E18F8B3E649699BE762
                                                              Uniqueness

                                                              Uniqueness Score: -1.00%

                                                              Function 000002BD6AD08753 Relevance: .3, Instructions: 348COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000003.301878072.000002BD6AD00000.00000004.00000800.00020000.00000000.sdmp, Offset: 000002BD6AD00000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_3_2bd6ad00000_aion-cracked.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: e749e01bae1e774750658938cb4b92454aa852a7a5f51ab9b56d23ebd6a4f17c
                                                              • Instruction ID: c2d178d2d58dbeef5de7b5dbeb6faba737b7871cc9e9fd6b3e867e9afe8f398a
                                                              • Opcode Fuzzy Hash: e749e01bae1e774750658938cb4b92454aa852a7a5f51ab9b56d23ebd6a4f17c
                                                              • Instruction Fuzzy Hash: 7AD1FE5650E3D21FC7078B781CA45A4BFB09E57120B5E4ADBD0E0CF4F7E609296AE322
                                                              Uniqueness

                                                              Uniqueness Score: -1.00%

                                                              Function 000002BD6AD09E23 Relevance: .3, Instructions: 328COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000003.301878072.000002BD6AD00000.00000004.00000800.00020000.00000000.sdmp, Offset: 000002BD6AD00000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_3_2bd6ad00000_aion-cracked.1.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 5d64f59998e5b48f37efa1d36f28c4775d0dec66997bbb7da1ce7978a6d69806
                                                              • Instruction ID: f776917f7ebfda55b6c65ff679e67fbc03a922b3767c71a3c31ab29eedf00388
                                                              • Opcode Fuzzy Hash: 5d64f59998e5b48f37efa1d36f28c4775d0dec66997bbb7da1ce7978a6d69806
                                                              • Instruction Fuzzy Hash: 5EC1124144E7C20FC317877858B9194BFB09E57014B9E46DBC4E1CF9E3EA0969ABE722
                                                              Uniqueness

                                                              Uniqueness Score: -1.00%

                                                              Function 000002BD6AD0660B Relevance: .3, Instructions: 321COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000003.301878072.000002BD6AD00000.00000004.00000800.00020000.00000000.sdmp, Offset: 000002BD6AD00000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_3_2bd6ad00000_aion-cracked.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 38e32e3de5041cbd2e08710ef3e3a9bdb451a5f287cef0693b189882dd6bf0ca
                                                              • Instruction ID: 31551d9bf58873964e4c9c51a08e3b3ac069bb0456b1d499bd4692e83393ddc6
                                                              • Opcode Fuzzy Hash: 38e32e3de5041cbd2e08710ef3e3a9bdb451a5f287cef0693b189882dd6bf0ca
                                                              • Instruction Fuzzy Hash: FFC1FF1140E7C21FC31797B859B9594BFB09E5702079E46DBC0E1DF8E3E60969ABE322
                                                              Uniqueness

                                                              Uniqueness Score: -1.00%

                                                              Function 000002BD6AD05A5B Relevance: .3, Instructions: 298COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000003.301878072.000002BD6AD00000.00000004.00000800.00020000.00000000.sdmp, Offset: 000002BD6AD00000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_3_2bd6ad00000_aion-cracked.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 26447c654fb8555150045cf376fc4fe1506b510ba957995d1a0558bac8f192ce
                                                              • Instruction ID: 48fc725006dab348b408c8df26c18733ec7a6846cafb166417b2344651954de4
                                                              • Opcode Fuzzy Hash: 26447c654fb8555150045cf376fc4fe1506b510ba957995d1a0558bac8f192ce
                                                              • Instruction Fuzzy Hash: AEB1C10154F7C20FC71B87B959B9594BFB09D4B02079E45DBC4E18F9E3D60929ABE322
                                                              Uniqueness

                                                              Uniqueness Score: -1.00%

                                                              Function 000002BD6AD0AA2B Relevance: .3, Instructions: 296COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000003.301878072.000002BD6AD00000.00000004.00000800.00020000.00000000.sdmp, Offset: 000002BD6AD00000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_3_2bd6ad00000_aion-cracked.1.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: c95f1a46c44f18925a6ac2ca0c37da3655bcc4c65cf875a4078915b6d3522e17
                                                              • Instruction ID: 0b27be2bf4eee44003e8369b36b65544372977912f1f485297b212e7309b31d3
                                                              • Opcode Fuzzy Hash: c95f1a46c44f18925a6ac2ca0c37da3655bcc4c65cf875a4078915b6d3522e17
                                                              • Instruction Fuzzy Hash: C5B1E55150E7C11FC31787B859B91A4BFB08E4B010B8E49DBC0E1CF5B3D949699BE362
                                                              Uniqueness

                                                              Uniqueness Score: -1.00%

                                                              Function 000002BD6AD09413 Relevance: .2, Instructions: 232COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000003.301878072.000002BD6AD00000.00000004.00000800.00020000.00000000.sdmp, Offset: 000002BD6AD00000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_3_2bd6ad00000_aion-cracked.1.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: cd1e466949b95493c595c68707efce1c7ff10c5490537364dcacae91fb9fee75
                                                              • Instruction ID: be32d15374628bffc5f948a9ce785be5ba095ac08e0824eec526238f1337c2cb
                                                              • Opcode Fuzzy Hash: cd1e466949b95493c595c68707efce1c7ff10c5490537364dcacae91fb9fee75
                                                              • Instruction Fuzzy Hash: 2D91131104E7D60FC31787B859B9594BFB09E47010B9E45EBC0E1CF5F3EA0969AAE362
                                                              Uniqueness

                                                              Uniqueness Score: -1.00%

                                                              Function 000002BD6AD098B0 Relevance: .2, Instructions: 227COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000003.301878072.000002BD6AD00000.00000004.00000800.00020000.00000000.sdmp, Offset: 000002BD6AD00000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_3_2bd6ad00000_aion-cracked.1.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 3980b5b862075d82afce262bd7bb79f11a701bbc84347f250f997a92bab11eb2
                                                              • Instruction ID: d1ab00119d79ebd4456be2f82da9d22cc71fb2cbcfbddcfe2732d516ab283a64
                                                              • Opcode Fuzzy Hash: 3980b5b862075d82afce262bd7bb79f11a701bbc84347f250f997a92bab11eb2
                                                              • Instruction Fuzzy Hash: 5D81270144F7D10FD31797B858B91A4BFB09E47010B5E49DBC4E18F4E3EA09699BE362
                                                              Uniqueness

                                                              Uniqueness Score: -1.00%

                                                              Function 000002BD6AD05D33 Relevance: .2, Instructions: 163COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000003.301878072.000002BD6AD00000.00000004.00000800.00020000.00000000.sdmp, Offset: 000002BD6AD00000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_3_2bd6ad00000_aion-cracked.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 7e8fca381abeda7433b53e2ff75bcbd13ba18d0a56c5097145032057ce8a0217
                                                              • Instruction ID: 811e94ef9777552fb3d8856c78cd1347da659daf5b3e64f58771aa6faf253df8
                                                              • Opcode Fuzzy Hash: 7e8fca381abeda7433b53e2ff75bcbd13ba18d0a56c5097145032057ce8a0217
                                                              • Instruction Fuzzy Hash: 1C61021600E7D50FC71787B859B5594BFB09E4712078E4ADBC0E1CF4F3EA0969AAE322
                                                              Uniqueness

                                                              Uniqueness Score: -1.00%

                                                              Function 000002BD6AD092AB Relevance: .2, Instructions: 158COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000003.301878072.000002BD6AD00000.00000004.00000800.00020000.00000000.sdmp, Offset: 000002BD6AD00000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_3_2bd6ad00000_aion-cracked.1.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 6f3cb48a690c39b97a3572f15ddcf9b3e5dcdb98dd3ea82babb25252bf973aef
                                                              • Instruction ID: e98fe1754066beb93dd58aa4414a0cc323d26f7fc5441d286030233611174d3e
                                                              • Opcode Fuzzy Hash: 6f3cb48a690c39b97a3572f15ddcf9b3e5dcdb98dd3ea82babb25252bf973aef
                                                              • Instruction Fuzzy Hash: 2E51471104E7D60FC317877859B9598BF708D4701078E46EBC4E18F5F3E609696BE362
                                                              Uniqueness

                                                              Uniqueness Score: -1.00%

                                                              Function 000002BD6AD0ACFB Relevance: .2, Instructions: 156COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000003.301878072.000002BD6AD00000.00000004.00000800.00020000.00000000.sdmp, Offset: 000002BD6AD00000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_3_2bd6ad00000_aion-cracked.1.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 927fd08a05d5ea74b14b2ecdf08a9a489616f96a58b3177afac2ee2c9bb45b75
                                                              • Instruction ID: c247c3a622d01e7f0000e552e677109a26daa7d65fb69fdb9273d791c58edf85
                                                              • Opcode Fuzzy Hash: 927fd08a05d5ea74b14b2ecdf08a9a489616f96a58b3177afac2ee2c9bb45b75
                                                              • Instruction Fuzzy Hash: 2F51125140E7C10FC71787B459B91A4BFB09E47011B8E46DBC0E1CF5F3EA48689AE362
                                                              Uniqueness

                                                              Uniqueness Score: -1.00%

                                                              Function 000002BD6AD0CD7B Relevance: .1, Instructions: 116COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000003.301878072.000002BD6AD00000.00000004.00000800.00020000.00000000.sdmp, Offset: 000002BD6AD00000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_3_2bd6ad00000_aion-cracked.1.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 0a1437e4470451e2fbca7baeb336eabedafb20e3b41d71da31464bfc59796009
                                                              • Instruction ID: a5f3ee7c90a80808925f5b988d88f0df65a9dadb987443b07ff0ab5b65f7ee31
                                                              • Opcode Fuzzy Hash: 0a1437e4470451e2fbca7baeb336eabedafb20e3b41d71da31464bfc59796009
                                                              • Instruction Fuzzy Hash: 4C41E05244F7C15FC35787B849B9594BFB08E5702079E4ADBC0E18F8B3E649289AE722
                                                              Uniqueness

                                                              Uniqueness Score: -1.00%

                                                              Function 000002BD6AD0D03B Relevance: .1, Instructions: 94COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000003.301878072.000002BD6AD00000.00000004.00000800.00020000.00000000.sdmp, Offset: 000002BD6AD00000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_3_2bd6ad00000_aion-cracked.1.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: c7278564e397e4d50a6d5caef00cd0855ae7fa84fe1d1b7a82bade899fa8e379
                                                              • Instruction ID: a0f6a5e07a340d4b54cb66eb428f3cfdd54efd78fdf579ba611e29cd8542d623
                                                              • Opcode Fuzzy Hash: c7278564e397e4d50a6d5caef00cd0855ae7fa84fe1d1b7a82bade899fa8e379
                                                              • Instruction Fuzzy Hash: F131E81104E7C55FC35793B849B9598BFB09D8B02078E46DBC0E18F9F3E649295BE722
                                                              Uniqueness

                                                              Uniqueness Score: -1.00%