IOC Report
finathot.exe

loading gif

Files

File Path
Type
Category
Malicious
finathot.exe
PE32+ executable (GUI) x86-64, for MS Windows
initial sample
 malicious
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_fontdrvhost.exe_d32c824e8915b30da4efd4eabd13e74e4ef8c1_ad0be647_77322fd5-d4be-4e3d-bcbc-091bfc00d3fb\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER67F0.tmp.dmp
Mini DuMP crash report, 14 streams, Sat Dec 21 12:33:23 2024, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER683F.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER686F.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\finathot.exe
"C:\Users\user\Desktop\finathot.exe"
 malicious
C:\Windows\SysWOW64\explorer.exe
"C:\Windows\SysWOW64\explorer.exe"
 malicious
C:\Windows\SysWOW64\svchost.exe
"C:\Windows\System32\svchost.exe"
 malicious
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5652 -s 436
C:\Windows\System32\fontdrvhost.exe
"C:\Windows\System32\fontdrvhost.exe"
C:\Windows\System32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 4412 -s 136

URLs

Name
IP
Malicious
https://195.54.171.197:6118/7b1ac791a375b8e801/ae64vdqq.8rfi5
malicious
http://cookie.krakenlpay.com/Api/v3/zayyqjqiiiab
172.67.178.25
https://cloudflare-dns.com/dns-query
unknown
https://195.54.171.197:6118/7b1ac791a375b8e801/ae64vdqq.8rfi5x
unknown
https://cookie.krakenlpay.com/Api/v3020873936E61F193D0C7E10A95D2l
unknown
http://cookie.krakenlpay.com/Api/v3
172.67.178.25
https://cloudflare-dns.com/dns-queryPOSTContent-TypeContent-LengthHostapplication/dns-message%dMachi
unknown
https://docs.rs/getrandom#nodejs-es-module-supportHash
unknown
http://cookie.krakenlpay.com/Api/v3g
unknown
http://cookie.krakenlpay.com/Api/v3/zayyqjqiiiabxn%
unknown
https://195.54.171.197:6118/7b1ac791a375b8e801/ae64vdqq.8rfi5kernelbasentdllkernel32GetProcessMitiga
unknown
https://cookie.krakenlpay.com/Api/v3020873936E61F193D0C7E10A95D2llaB
unknown
There are 2 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
cookie.krakenlpay.com
172.67.178.25

IPs

IP
Domain
Country
Malicious
195.54.171.197
unknown
unknown
malicious
172.67.178.25
cookie.krakenlpay.com
United States

Registry

Path
Value
Malicious
HKEY_CURRENT_USER\SOFTWARE\SibCode
sn3
\REGISTRY\A\{e8714760-e716-2a2a-d354-57730ddce22d}\Root\InventoryApplicationFile\fontdrvhost.exe|415bd9bd265b6ee3
ProgramId
\REGISTRY\A\{e8714760-e716-2a2a-d354-57730ddce22d}\Root\InventoryApplicationFile\fontdrvhost.exe|415bd9bd265b6ee3
FileId
\REGISTRY\A\{e8714760-e716-2a2a-d354-57730ddce22d}\Root\InventoryApplicationFile\fontdrvhost.exe|415bd9bd265b6ee3
LowerCaseLongPath
\REGISTRY\A\{e8714760-e716-2a2a-d354-57730ddce22d}\Root\InventoryApplicationFile\fontdrvhost.exe|415bd9bd265b6ee3
LongPathHash
\REGISTRY\A\{e8714760-e716-2a2a-d354-57730ddce22d}\Root\InventoryApplicationFile\fontdrvhost.exe|415bd9bd265b6ee3
Name
\REGISTRY\A\{e8714760-e716-2a2a-d354-57730ddce22d}\Root\InventoryApplicationFile\fontdrvhost.exe|415bd9bd265b6ee3
OriginalFileName
\REGISTRY\A\{e8714760-e716-2a2a-d354-57730ddce22d}\Root\InventoryApplicationFile\fontdrvhost.exe|415bd9bd265b6ee3
Publisher
\REGISTRY\A\{e8714760-e716-2a2a-d354-57730ddce22d}\Root\InventoryApplicationFile\fontdrvhost.exe|415bd9bd265b6ee3
Version
\REGISTRY\A\{e8714760-e716-2a2a-d354-57730ddce22d}\Root\InventoryApplicationFile\fontdrvhost.exe|415bd9bd265b6ee3
BinFileVersion
\REGISTRY\A\{e8714760-e716-2a2a-d354-57730ddce22d}\Root\InventoryApplicationFile\fontdrvhost.exe|415bd9bd265b6ee3
BinaryType
\REGISTRY\A\{e8714760-e716-2a2a-d354-57730ddce22d}\Root\InventoryApplicationFile\fontdrvhost.exe|415bd9bd265b6ee3
ProductName
\REGISTRY\A\{e8714760-e716-2a2a-d354-57730ddce22d}\Root\InventoryApplicationFile\fontdrvhost.exe|415bd9bd265b6ee3
ProductVersion
\REGISTRY\A\{e8714760-e716-2a2a-d354-57730ddce22d}\Root\InventoryApplicationFile\fontdrvhost.exe|415bd9bd265b6ee3
LinkDate
\REGISTRY\A\{e8714760-e716-2a2a-d354-57730ddce22d}\Root\InventoryApplicationFile\fontdrvhost.exe|415bd9bd265b6ee3
BinProductVersion
\REGISTRY\A\{e8714760-e716-2a2a-d354-57730ddce22d}\Root\InventoryApplicationFile\fontdrvhost.exe|415bd9bd265b6ee3
AppxPackageFullName
\REGISTRY\A\{e8714760-e716-2a2a-d354-57730ddce22d}\Root\InventoryApplicationFile\fontdrvhost.exe|415bd9bd265b6ee3
AppxPackageRelativeId
\REGISTRY\A\{e8714760-e716-2a2a-d354-57730ddce22d}\Root\InventoryApplicationFile\fontdrvhost.exe|415bd9bd265b6ee3
Size
\REGISTRY\A\{e8714760-e716-2a2a-d354-57730ddce22d}\Root\InventoryApplicationFile\fontdrvhost.exe|415bd9bd265b6ee3
Language
\REGISTRY\A\{e8714760-e716-2a2a-d354-57730ddce22d}\Root\InventoryApplicationFile\fontdrvhost.exe|415bd9bd265b6ee3
IsOsComponent
\REGISTRY\A\{e8714760-e716-2a2a-d354-57730ddce22d}\Root\InventoryApplicationFile\fontdrvhost.exe|415bd9bd265b6ee3
Usn
There are 11 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
32E0000
direct allocation
page execute and read and write
 malicious
3040000
direct allocation
page execute and read and write
 malicious
990000
direct allocation
page read and write
 malicious
3060000
direct allocation
page read and write
 malicious
2F32000
heap
page read and write
2F32000
heap
page read and write
3204000
heap
page read and write
5730000
unkown
page read and write
50DE000
stack
page read and write
2F32000
heap
page read and write
2F42000
heap
page read and write
2F42000
heap
page read and write
5301000
heap
page read and write
50F0000
unkown
page read and write
2F42000
heap
page read and write
2E67000
heap
page read and write
2340C810000
heap
page read and write
2F32000
heap
page read and write
2F32000
heap
page read and write
2F42000
heap
page read and write
2340E231000
heap
page read and write
3060000
heap
page read and write
30D8000
heap
page read and write
7FF67FFB2000
unkown
page readonly
2F42000
heap
page read and write
1D0DDBE0000
heap
page read and write
1D0DDB40000
unkown
page execute and read and write
521D000
unkown
page read and write
2F32000
heap
page read and write
2F42000
heap
page read and write
4F9E000
stack
page read and write
2F32000
heap
page read and write
5800000
heap
page read and write
3204000
heap
page read and write
5073000
unkown
page read and write
2340C8A2000
heap
page read and write
57A3000
unkown
page read and write
2F32000
heap
page read and write
2F32000
heap
page read and write
2F42000
heap
page read and write
5680000
unkown
page read and write
5201000
heap
page read and write
2F32000
heap
page read and write
2F32000
heap
page read and write
2F32000
heap
page read and write
2F32000
heap
page read and write
5581000
heap
page read and write
2F32000
heap
page read and write
2F32000
heap
page read and write
2F42000
heap
page read and write
2F32000
heap
page read and write
449000
remote allocation
page execute and read and write
2F42000
heap
page read and write
2F9F000
heap
page read and write
800000
heap
page read and write
2F42000
heap
page read and write
2F9F000
heap
page read and write
2F42000
heap
page read and write
2F32000
heap
page read and write
2F42000
heap
page read and write
2F42000
heap
page read and write
2F42000
heap
page read and write
2F32000
heap
page read and write
2DB1000
stack
page read and write
2E5C000
heap
page read and write
2340C7B0000
heap
page read and write
A6579FF000
stack
page read and write
2F42000
heap
page read and write
2F42000
heap
page read and write
57D0000
unkown
page read and write
7FF67FE31000
unkown
page execute read
2F42000
heap
page read and write
2F32000
heap
page read and write
2F53000
heap
page read and write
2340C8A4000
heap
page read and write
5800000
heap
page read and write
3204000
heap
page read and write
2F32000
heap
page read and write
50C0000
unkown
page read and write
5949000
unkown
page read and write
2F32000
heap
page read and write
75B000
stack
page read and write
2F42000
heap
page read and write
2340C87D000
heap
page read and write
515C000
stack
page read and write
2F32000
heap
page read and write
2F42000
heap
page read and write
2F42000
heap
page read and write
2F32000
heap
page read and write
62DB07D000
stack
page read and write
2F42000
heap
page read and write
399F000
stack
page read and write
7FF67FFEA000
unkown
page read and write
2F42000
heap
page read and write
2F32000
heap
page read and write
5A00000
heap
page read and write
2F42000
heap
page read and write
7FF67FE30000
unkown
page readonly
2F42000
heap
page read and write
4FF0000
unkown
page read and write
50C8000
unkown
page read and write
2F32000
heap
page read and write
7FF67FFEA000
unkown
page write copy
2C13000
heap
page read and write
2F32000
heap
page read and write
5000000
unkown
page read and write
2F42000
heap
page read and write
2F42000
heap
page read and write
94E000
stack
page read and write
2F32000
heap
page read and write
52B2000
unkown
page read and write
4FE2000
unkown
page read and write
2340C8AF000
heap
page read and write
2F42000
heap
page read and write
2F32000
heap
page read and write
2F42000
heap
page read and write
2F42000
heap
page read and write
50D0000
unkown
page read and write
2F32000
heap
page read and write
2340C840000
heap
page read and write
2F32000
heap
page read and write
3204000
heap
page read and write
4F50000
unkown
page read and write
52A6000
unkown
page read and write
2F32000
heap
page read and write
2F42000
heap
page read and write
5070000
unkown
page read and write
2F32000
heap
page read and write
2C00000
heap
page read and write
4F50000
unkown
page read and write
1D0DDB50000
heap
page readonly
303E000
stack
page read and write
2F32000
heap
page read and write
2DAC000
stack
page read and write
1D0DDB10000
heap
page read and write
59E2000
unkown
page read and write
2F32000
heap
page read and write
54EE000
heap
page read and write
2F32000
heap
page read and write
2340C800000
direct allocation
page execute and read and write
1D0DDF7A000
heap
page read and write
2F42000
heap
page read and write
3070000
direct allocation
page read and write
5680000
unkown
page read and write
2F42000
heap
page read and write
2F42000
heap
page read and write
2F32000
heap
page read and write
2F42000
heap
page read and write
439000
remote allocation
page execute and read and write
509F000
stack
page read and write
2F32000
heap
page read and write
5700000
heap
page read and write
3790000
heap
page read and write
30FF000
heap
page read and write
5D00000
heap
page read and write
594D000
unkown
page read and write
57F8000
unkown
page read and write
2F42000
heap
page read and write
2F32000
heap
page read and write
A657321000
stack
page read and write
2F32000
heap
page read and write
2F32000
heap
page read and write
2F32000
heap
page read and write
2F32000
heap
page read and write
830000
heap
page read and write
2340C7A0000
heap
page read and write
2F32000
heap
page read and write
2F32000
heap
page read and write
2F42000
heap
page read and write
2F42000
heap
page read and write
2F42000
heap
page read and write
2340E2B0000
heap
page read and write
4F50000
unkown
page read and write
7FF67FE30000
unkown
page readonly
2F42000
heap
page read and write
2F42000
heap
page read and write
98F000
stack
page read and write
2F3D000
heap
page read and write
2F42000
heap
page read and write
62DB17F000
stack
page read and write
2E00000
heap
page read and write
2F42000
heap
page read and write
2F32000
heap
page read and write
2F42000
heap
page read and write
2F42000
heap
page read and write
2F42000
heap
page read and write
2F42000
heap
page read and write
2340C84B000
heap
page read and write
2F42000
heap
page read and write
5580000
heap
page read and write
5430000
heap
page read and write
2F32000
heap
page read and write
57F0000
unkown
page read and write
2340E230000
heap
page read and write
5A67000
unkown
page read and write
2F32000
heap
page read and write
3204000
heap
page read and write
2F32000
heap
page read and write
5680000
unkown
page read and write
2F32000
heap
page read and write
2F32000
heap
page read and write
2F32000
heap
page read and write
2F42000
heap
page read and write
1D0DDB20000
heap
page read and write
2F32000
heap
page read and write
2F32000
heap
page read and write
2F32000
heap
page read and write
2F42000
heap
page read and write
2F42000
heap
page read and write
2F32000
heap
page read and write
2F42000
heap
page read and write
2F42000
heap
page read and write
3090000
heap
page read and write
9A0000
direct allocation
page read and write
2F42000
heap
page read and write
2340E1B0000
heap
page read and write
2F32000
heap
page read and write
2C02000
heap
page read and write
2C13000
heap
page read and write
2F42000
heap
page read and write
59F6000
unkown
page read and write
2F32000
heap
page read and write
58A0000
unkown
page read and write
2F0C000
heap
page read and write
2F42000
heap
page read and write
2F32000
heap
page read and write
2F42000
heap
page read and write
2F32000
heap
page read and write
59BE000
unkown
page read and write
2F32000
heap
page read and write
7D0000
unkown
page execute and read and write
2F42000
heap
page read and write
2F32000
heap
page read and write
2F42000
heap
page read and write
2F32000
heap
page read and write
2F32000
heap
page read and write
2F32000
heap
page read and write
2F32000
heap
page read and write
2F42000
heap
page read and write
7D0000
heap
page read and write
2F32000
heap
page read and write
5680000
unkown
page read and write
2F42000
heap
page read and write
2F42000
heap
page read and write
2340C815000
heap
page read and write
5170000
unkown
page read and write
59D6000
unkown
page read and write
528E000
unkown
page read and write
2340C89B000
heap
page read and write
990000
heap
page read and write
7E0000
heap
page read and write
52C6000
unkown
page read and write
54EF000
heap
page read and write
2340C89B000
heap
page read and write
2F32000
heap
page read and write
2F32000
heap
page read and write
2F42000
heap
page read and write
5400000
direct allocation
page read and write
2F42000
heap
page read and write
2F42000
heap
page read and write
2F32000
heap
page read and write
2F32000
heap
page read and write
389E000
stack
page read and write
2F42000
heap
page read and write
2F00000
heap
page read and write
2F42000
heap
page read and write
519C000
stack
page read and write
2F42000
heap
page read and write
2F42000
heap
page read and write
2F32000
heap
page read and write
7FF67FFEC000
unkown
page readonly
5140000
unkown
page read and write
2F32000
heap
page read and write
2F32000
heap
page read and write
2F32000
heap
page read and write
2F42000
heap
page read and write
2F42000
heap
page read and write
50A0000
unkown
page read and write
2340C886000
heap
page read and write
400000
remote allocation
page execute and read and write
62DB27F000
stack
page read and write
62DB2FE000
unkown
page readonly
2F32000
heap
page read and write
2F32000
heap
page read and write
1D0DDAF0000
unkown
page execute and read and write
A6577FE000
stack
page read and write
2F42000
heap
page read and write
2F42000
heap
page read and write
511F000
stack
page read and write
7FF67FFB2000
unkown
page readonly
2F32000
heap
page read and write
2F32000
heap
page read and write
2F42000
heap
page read and write
A65732B000
stack
page read and write
2F42000
heap
page read and write
2340E1B1000
heap
page read and write
2F32000
heap
page read and write
5219000
unkown
page read and write
5870000
unkown
page read and write
2F32000
heap
page read and write
5523000
heap
page read and write
2F32000
heap
page read and write
3050000
heap
page read and write
2F32000
heap
page read and write
2340C7E0000
heap
page read and write
2340C8AA000
heap
page read and write
2F42000
heap
page read and write
2F32000
heap
page read and write
2F9F000
heap
page read and write
2F42000
heap
page read and write
2F42000
heap
page read and write
2340C8AA000
heap
page read and write
2F32000
heap
page read and write
7FF67FF38000
unkown
page readonly
311F000
heap
page read and write
2F32000
heap
page read and write
2F12000
heap
page read and write
3204000
heap
page read and write
2F32000
heap
page read and write
2F32000
heap
page read and write
2F42000
heap
page read and write
2F10000
heap
page read and write
2F9F000
heap
page read and write
5712000
unkown
page read and write
5480000
heap
page read and write
7FF67FE31000
unkown
page execute read
5720000
unkown
page read and write
2F42000
heap
page read and write
2F42000
heap
page read and write
2340C89A000
heap
page read and write
29FE000
stack
page read and write
79C000
stack
page read and write
4F50000
unkown
page read and write
371E000
stack
page read and write
449000
remote allocation
page execute and read and write
3200000
heap
page read and write
2F32000
heap
page read and write
2F32000
heap
page read and write
2F9F000
heap
page read and write
2F42000
heap
page read and write
2340C8A2000
heap
page read and write
2F32000
heap
page read and write
2F32000
heap
page read and write
2F42000
heap
page read and write
2F42000
heap
page read and write
54EF000
heap
page read and write
30D7000
heap
page read and write
5581000
heap
page read and write
5351000
unkown
page read and write
2F42000
heap
page read and write
2F32000
heap
page read and write
2F9F000
heap
page read and write
1D0DDBEA000
heap
page read and write
5A81000
unkown
page read and write
2F42000
heap
page read and write
2F42000
heap
page read and write
2F42000
heap
page read and write
2F42000
heap
page read and write
5820000
unkown
page read and write
2F32000
heap
page read and write
2F42000
heap
page read and write
3122000
heap
page read and write
A6576FF000
stack
page read and write
2F42000
heap
page read and write
31CE000
stack
page read and write
2F42000
heap
page read and write
2F42000
heap
page read and write
7FF67FF38000
unkown
page readonly
5800000
unkown
page read and write
A6578FE000
stack
page read and write
3793000
heap
page read and write
2E12000
heap
page read and write
2F42000
heap
page read and write
3204000
heap
page read and write
3440000
direct allocation
page read and write
2F32000
heap
page read and write
2F32000
heap
page read and write
2F32000
heap
page read and write
2F32000
heap
page read and write
2F32000
heap
page read and write
2F42000
heap
page read and write
7FF67FFEC000
unkown
page readonly
2F32000
heap
page read and write
5337000
unkown
page read and write
2F32000
heap
page read and write
2F32000
heap
page read and write
57A0000
unkown
page read and write
2F42000
heap
page read and write
2C13000
heap
page read and write
2F32000
heap
page read and write
2F42000
heap
page read and write
2F42000
heap
page read and write
2F42000
heap
page read and write
2F42000
heap
page read and write
There are 384 hidden memdumps, click here to show them.