File name:

Steam Account Generator FIXED.exe

Full analysis: https://app.any.run/tasks/be4f9d0a-6377-4e0f-b356-f5719bf502ca
Verdict: Malicious activity
Threats:

Amadey is a formidable Windows infostealer threat, characterized by its persistence mechanisms, modular design, and ability to execute various malicious tasks.

Malware Trends Tracker     >>>
Analysis date: May 29, 2025, 20:10:34
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
amadey
botnet
stealer
diamotrix
clipper
auto-reg
python
auto
redline
metastealer
generic
crypto-regex
arch-doc
rust
rdp
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (GUI) x86-64, for MS Windows, 6 sections
MD5:

07ADD688984EC45F5003C2B696822EF0

SHA1:

7FB6FAFBD649EA7A33A6E90DFBCB10BAFD08D79A

SHA256:

379D108F6D40EEF6A248E1E3C1DD2E88094CC4506E603195B55814DE865E6E5E

SSDEEP:

196608:3n2dd2hj+0KCFboh11kYF2WVqfc7JlY+942ASiTg:328K0KCxqAIqfc9lJ91ASi

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • GENERIC has been found (auto)

      • Steam Account Generator FIXED.exe (PID: 4988)

    • DIAMOTRIX mutex has been found

      • gfgdfxwx.exe (PID: 1324)
      • gfgdfxwx.exe (PID: 5868)
      • winapp.exe (PID: 4920)

    • Changes the autorun value in the registry

      • gfgdfxwx.exe (PID: 1324)

    • AMADEY has been found (auto)

      • Steam Account Generator FIXED.exe (PID: 4988)
      • dfssdfxx.exe (PID: 5116)

    • Loads dropped or rewritten executable

      • powershell.exe (PID: 6388)
      • cxvezrfde.exe (PID: 2088)
      • gfgdfxwx.exe (PID: 1324)
      • Steam Account Generator FIXED.exe (PID: 4988)
      • cxvezrfde.exe (PID: 5428)
      • regsvr32.exe (PID: 5800)
      • conhost.exe (PID: 1056)
      • svchost.exe (PID: 4560)
      • conhost.exe (PID: 1228)
      • cvcxxxx.exe (PID: 644)
      • wxcvxverd.exe (PID: 1052)
      • WaaSMedicAgent.exe (PID: 2516)
      • winapp.exe (PID: 4920)
      • WmiPrvSE.exe (PID: 2504)
      • gfgdfxwx.exe (PID: 5868)
      • conhost.exe (PID: 5548)
      • powershell.exe (PID: 5056)
      • notepad.exe (PID: 4068)
      • notepad.exe (PID: 6576)
      • SIHClient.exe (PID: 6068)
      • 3B60.tmp.exe (PID: 5064)
      • notepad.exe (PID: 6112)
      • notepad.exe (PID: 3884)
      • 3B60.tmp.exe (PID: 1168)
      • powershell.exe (PID: 4464)
      • dllhost.exe (PID: 4528)
      • rundll32.exe (PID: 2240)
      • slui.exe (PID: 1052)
      • regsvr32.exe (PID: 5608)
      • conhost.exe (PID: 2800)
      • rundll32.exe (PID: 3268)

    • Registers / Runs the DLL via REGSVR32.EXE

      • bvcbghgf.tmp (PID: 5216)

    • AMADEY has been detected (SURICATA)

      • nudwee.exe (PID: 6872)

    • Connects to the CnC server

      • nudwee.exe (PID: 6872)
      • wxcvxverd.exe (PID: 1052)

    • METASTEALER has been detected (SURICATA)

      • wxcvxverd.exe (PID: 1052)

    • Application was injected by another process

      • explorer.exe (PID: 5492)

    • AMADEY has been detected (YARA)

      • nudwee.exe (PID: 6872)

    • Runs injected code in another process

      • regsvr32.exe (PID: 5800)

    • Actions looks like stealing of personal data

      • cvcxxxx.exe (PID: 644)
      • wxcvxverd.exe (PID: 1052)

    • REDLINE has been detected (SURICATA)

      • wxcvxverd.exe (PID: 1052)

    • Steals credentials from Web Browsers

      • wxcvxverd.exe (PID: 1052)

    • Stealers network behavior

      • wxcvxverd.exe (PID: 1052)

  • SUSPICIOUS

    • Reads the date of Windows installation

      • Steam Account Generator FIXED.exe (PID: 4988)

    • Reads security settings of Internet Explorer

      • Steam Account Generator FIXED.exe (PID: 4988)
      • bvcbghgf.tmp (PID: 5800)
      • dfssdfxx.exe (PID: 5116)
      • nudwee.exe (PID: 6872)
      • cvcxxxx.exe (PID: 644)

    • Process drops legitimate windows executable

      • Steam Account Generator FIXED.exe (PID: 4988)
      • cxvezrfde.exe (PID: 2088)
      • gfgdfxwx.exe (PID: 1324)
      • bvcbghgf.tmp (PID: 5800)
      • bvcbghgf.tmp (PID: 5216)
      • 3B60.tmp.exe (PID: 5064)

    • Executable content was dropped or overwritten

      • bvcbghgf.exe (PID: 6988)
      • gfgdfxwx.exe (PID: 1324)
      • cxvezrfde.exe (PID: 2088)
      • bvcbghgf.tmp (PID: 5800)
      • Steam Account Generator FIXED.exe (PID: 4988)
      • bvcbghgf.exe (PID: 5008)
      • dfssdfxx.exe (PID: 5116)
      • bvcbghgf.tmp (PID: 5216)
      • Launcher.exe (PID: 6372)
      • explorer.exe (PID: 5492)
      • 3B60.tmp.exe (PID: 5064)

    • Process drops python dynamic module

      • cxvezrfde.exe (PID: 2088)
      • 3B60.tmp.exe (PID: 5064)

    • Reads the Windows owner or organization settings

      • bvcbghgf.tmp (PID: 5800)
      • bvcbghgf.tmp (PID: 5216)

    • The process drops C-runtime libraries

      • cxvezrfde.exe (PID: 2088)
      • 3B60.tmp.exe (PID: 5064)

    • Loads Python modules

      • cxvezrfde.exe (PID: 5428)
      • 3B60.tmp.exe (PID: 1168)

    • Application launched itself

      • cxvezrfde.exe (PID: 2088)
      • 3B60.tmp.exe (PID: 5064)

    • Starts itself from another location

      • dfssdfxx.exe (PID: 5116)

    • Reads the BIOS version

      • Launcher.exe (PID: 6372)

    • Starts POWERSHELL.EXE for commands execution

      • regsvr32.exe (PID: 5800)
      • regsvr32.exe (PID: 5608)

    • Contacting a server suspected of hosting an CnC

      • nudwee.exe (PID: 6872)

    • The process executes via Task Scheduler

      • nudwee.exe (PID: 6592)
      • regsvr32.exe (PID: 5608)
      • nudwee.exe (PID: 1616)

    • Found regular expressions for crypto-addresses (YARA)

      • gfgdfxwx.exe (PID: 1324)

    • The process bypasses the loading of PowerShell profile settings

      • regsvr32.exe (PID: 5800)

    • The process hide an interactive prompt from the user

      • regsvr32.exe (PID: 5800)

    • Connects to the server without a host name

      • cvcxxxx.exe (PID: 644)
      • explorer.exe (PID: 5492)

    • Connects to unusual port

      • wxcvxverd.exe (PID: 1052)

    • There is functionality for taking screenshot (YARA)

      • nudwee.exe (PID: 6872)

    • Potential Corporate Privacy Violation

      • cvcxxxx.exe (PID: 644)

    • There is functionality for enable RDP (YARA)

      • nudwee.exe (PID: 6872)

    • Searches for installed software

      • wxcvxverd.exe (PID: 1052)

    • Uses RUNDLL32.EXE to load library

      • explorer.exe (PID: 5492)

  • INFO

    • Reads the computer name

      • Steam Account Generator FIXED.exe (PID: 4988)
      • cxvezrfde.exe (PID: 2088)
      • bvcbghgf.tmp (PID: 5800)
      • bvcbghgf.tmp (PID: 5216)
      • Launcher.exe (PID: 6372)
      • dfssdfxx.exe (PID: 5116)
      • nudwee.exe (PID: 6872)
      • cvcxxxx.exe (PID: 644)
      • wxcvxverd.exe (PID: 1052)
      • 3B60.tmp.exe (PID: 5064)

    • Creates files or folders in the user directory

      • Steam Account Generator FIXED.exe (PID: 4988)
      • gfgdfxwx.exe (PID: 1324)
      • bvcbghgf.tmp (PID: 5216)
      • cvcxxxx.exe (PID: 644)

    • The sample compiled with english language support

      • Steam Account Generator FIXED.exe (PID: 4988)
      • gfgdfxwx.exe (PID: 1324)
      • bvcbghgf.tmp (PID: 5800)
      • cxvezrfde.exe (PID: 2088)
      • bvcbghgf.tmp (PID: 5216)
      • 3B60.tmp.exe (PID: 5064)

    • Create files in a temporary directory

      • bvcbghgf.exe (PID: 6988)
      • Steam Account Generator FIXED.exe (PID: 4988)
      • bvcbghgf.tmp (PID: 5800)
      • bvcbghgf.exe (PID: 5008)
      • bvcbghgf.tmp (PID: 5216)
      • cxvezrfde.exe (PID: 2088)
      • dfssdfxx.exe (PID: 5116)
      • Launcher.exe (PID: 6372)
      • cvcxxxx.exe (PID: 644)
      • 3B60.tmp.exe (PID: 5064)
      • explorer.exe (PID: 5492)

    • Checks supported languages

      • Steam Account Generator FIXED.exe (PID: 4988)
      • cxvezrfde.exe (PID: 2088)
      • gfgdfxwx.exe (PID: 1324)
      • cvcxxxx.exe (PID: 644)
      • dfssdfxx.exe (PID: 5116)
      • bvcbghgf.exe (PID: 6988)
      • wxcvxverd.exe (PID: 1052)
      • bvcbghgf.tmp (PID: 5800)
      • bvcbghgf.exe (PID: 5008)
      • bvcbghgf.tmp (PID: 5216)
      • cxvezrfde.exe (PID: 5428)
      • nudwee.exe (PID: 6872)
      • Launcher.exe (PID: 6372)
      • winapp.exe (PID: 4920)
      • gfgdfxwx.exe (PID: 5868)
      • nudwee.exe (PID: 6592)
      • 3B60.tmp.exe (PID: 5064)
      • 3B60.tmp.exe (PID: 1168)
      • nudwee.exe (PID: 1616)

    • Process checks computer location settings

      • Steam Account Generator FIXED.exe (PID: 4988)
      • bvcbghgf.tmp (PID: 5800)
      • dfssdfxx.exe (PID: 5116)

    • Launch of the file from Registry key

      • gfgdfxwx.exe (PID: 1324)

    • Reads the machine GUID from the registry

      • cxvezrfde.exe (PID: 5428)
      • wxcvxverd.exe (PID: 1052)
      • 3B60.tmp.exe (PID: 1168)

    • Checks proxy server information

      • nudwee.exe (PID: 6872)
      • cvcxxxx.exe (PID: 644)
      • explorer.exe (PID: 5492)

    • Checks if a key exists in the options dictionary (POWERSHELL)

      • powershell.exe (PID: 6388)
      • powershell.exe (PID: 5056)
      • powershell.exe (PID: 4464)

    • Manual execution by a user

      • gfgdfxwx.exe (PID: 5868)
      • winapp.exe (PID: 4920)
      • notepad.exe (PID: 4068)

    • Reads the software policy settings

      • WaaSMedicAgent.exe (PID: 2516)
      • SIHClient.exe (PID: 6068)

    • Creates files in the program directory

      • cvcxxxx.exe (PID: 644)

    • Application based on Rust

      • wxcvxverd.exe (PID: 1052)
      • cvcxxxx.exe (PID: 644)

    • Reads product name

      • wxcvxverd.exe (PID: 1052)

    • Reads Environment values

      • wxcvxverd.exe (PID: 1052)

    • Reads the time zone

      • WmiPrvSE.exe (PID: 2504)

    • Reads security settings of Internet Explorer

      • explorer.exe (PID: 5492)
      • notepad.exe (PID: 4068)
      • notepad.exe (PID: 6576)
      • notepad.exe (PID: 6112)
      • notepad.exe (PID: 3884)
      • rundll32.exe (PID: 3268)

    • Reads Windows Product ID

      • WmiPrvSE.exe (PID: 2504)

    • Reads Microsoft Office registry keys

      • rundll32.exe (PID: 3268)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2025:05:22 13:49:50+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 14.4
CodeSize: 123392
InitializedDataSize: 24038400
UninitializedDataSize: -
EntryPoint: 0x5f2c
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 1.2.1.1
ProductVersionNumber: 3.1.1.1
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
FileDescription: Opwcv
FileVersion: 6.0.0.0
InternalName: Opwcv.exe
LegalCopyright: (C) 2026
OriginalFileName: Opwcv.exe
ProductName: Opwcv
ProductVersion: 3.1.1.1
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
166
Monitored processes
44
Malicious processes
14
Suspicious processes
10

Behavior graph

Click at the process to see the details
start #AMADEY steam account generator fixed.exe bvcbghgf.exe cxvezrfde.exe #DIAMOTRIX gfgdfxwx.exe #REDLINE wxcvxverd.exe bvcbghgf.tmp cvcxxxx.exe #AMADEY dfssdfxx.exe launcher.exe bvcbghgf.exe bvcbghgf.tmp cxvezrfde.exe no specs #AMADEY nudwee.exe regsvr32.exe no specs regsvr32.exe no specs powershell.exe no specs conhost.exe no specs conhost.exe no specs waasmedicagent.exe no specs svchost.exe no specs #DIAMOTRIX winapp.exe no specs #DIAMOTRIX gfgdfxwx.exe no specs wmiprvse.exe no specs powershell.exe no specs conhost.exe no specs nudwee.exe no specs sihclient.exe explorer.exe notepad.exe no specs notepad.exe no specs notepad.exe no specs notepad.exe no specs 3b60.tmp.exe 3b60.tmp.exe no specs rundll32.exe no specs rundll32.exe no specs Thumbnail Cache Out of Proc Server no specs slui.exe regsvr32.exe no specs powershell.exe no specs conhost.exe no specs nudwee.exe no specs svchost.exe no specs svchost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
644"C:\Users\admin\AppData\Roaming\cvcxxxx.exe" C:\Users\admin\AppData\Roaming\cvcxxxx.exe
Steam Account Generator FIXED.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
EM
Exit code:
0
Version:
10.0.19041.1566 (WinBuild.160101.0800)
Modules
Images
c:\users\admin\appdata\roaming\cvcxxxx.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
660"regsvr32.exe" /s /i:--type=renderer "C:\Users\admin\AppData\Roaming\microsoft\systemcertificates\\PackageSupportFramework_7.pfx"C:\Windows\SysWOW64\regsvr32.exe—bvcbghgf.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft(C) Register Server
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\regsvr32.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
1052"C:\Users\admin\AppData\Roaming\wxcvxverd.exe" C:\Users\admin\AppData\Roaming\wxcvxverd.exe
Steam Account Generator FIXED.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Features
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\users\admin\appdata\roaming\wxcvxverd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
1052C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
1056\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1168C:\Users\admin\AppData\Local\Temp\3B60.tmp.exeC:\Users\admin\AppData\Local\Temp\3B60.tmp.exe—3B60.tmp.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\3b60.tmp.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
1228\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—WaaSMedicAgent.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1324"C:\Users\admin\AppData\Roaming\gfgdfxwx.exe" C:\Users\admin\AppData\Roaming\gfgdfxwx.exe
Steam Account Generator FIXED.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
System
Version:
6.0.0.1
Modules
Images
c:\users\admin\appdata\roaming\gfgdfxwx.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
1616"C:\Users\admin\AppData\Local\Temp\56e51a1e3a\nudwee.exe"C:\Users\admin\AppData\Local\Temp\56e51a1e3a\nudwee.exe—svchost.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\56e51a1e3a\nudwee.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
2088"C:\Users\admin\AppData\Roaming\cxvezrfde.exe" C:\Users\admin\AppData\Roaming\cxvezrfde.exe
Steam Account Generator FIXED.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\roaming\cxvezrfde.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
Total events
47 316
Read events
47 206
Write events
107
Delete events
3

Modification events

(PID) Process:(5492) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\5\ApplicationViewManagement\W32:000000000005034A
Operation:writeName:VirtualDesktop
Value:
1000000030304456BFA0DB55E4278845B426357D5B5F97B3
(PID) Process:(5492) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\5\ApplicationViewManagement\W32:000000000005034A
Operation:delete keyName:(default)
Value:
(PID) Process:(5492) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\5\ApplicationViewManagement\W32:000000000008034E
Operation:writeName:VirtualDesktop
Value:
1000000030304456BFA0DB55E4278845B426357D5B5F97B3
(PID) Process:(5492) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\5\ApplicationViewManagement\W32:000000000008034E
Operation:delete keyName:(default)
Value:
(PID) Process:(1324) gfgdfxwx.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:SystemServices
Value:
C:\Users\admin\AppData\Roaming\gfgdfxwx.exe
(PID) Process:(1324) gfgdfxwx.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:SystemServices
Value:
C:\Users\admin\AppData\Roaming\winapp\winapp.exe
(PID) Process:(5492) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\5\ApplicationViewManagement\W32:0000000000060292
Operation:writeName:VirtualDesktop
Value:
1000000030304456BFA0DB55E4278845B426357D5B5F97B3
(PID) Process:(5492) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\5\ApplicationViewManagement\W32:0000000000060292
Operation:delete keyName:(default)
Value:
(PID) Process:(6872) nudwee.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(6872) nudwee.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
Executable files
119
Suspicious files
8
Text files
15
Unknown types
5

Dropped files

PID
Process
Filename
Type
4988Steam Account Generator FIXED.exeC:\Users\admin\AppData\Roaming\cxvezrfde.exeexecutable
MD5:73EC96E86A9C1D656AC35B522EF74A9B
SHA256:789BEC99500EB4B2C3CE10D651F9BC46ACC89BAC5636C731DC0414CE36E391C4
2088cxvezrfde.exeC:\Users\admin\AppData\Local\Temp\_MEI20882\_ctypes.pydexecutable
MD5:F1E33A8F6F91C2ED93DC5049DD50D7B8
SHA256:9459D246DF7A3C638776305CF3683946BA8DB26A7DE90DF8B60E1BE0B27E53C4
4988Steam Account Generator FIXED.exeC:\Users\admin\AppData\Roaming\wxcvxverd.exeexecutable
MD5:7C85687956E00BDBBF28D98A44780BB5
SHA256:631491FD39EC560D77B9C0BF55C1FB8C144E2B7EFFD25FE52342ED99C052D4EE
1324gfgdfxwx.exeC:\Users\admin\AppData\Roaming\winapp\winapp.exeexecutable
MD5:FA8A3DFE625E06D74B4931E31236A971
SHA256:47EC05FA7ED4B24C51CE19C2CCA63982A8D376278247391910B4EBAF7AF4DCEE
2088cxvezrfde.exeC:\Users\admin\AppData\Local\Temp\_MEI20882\VCRUNTIME140.dllexecutable
MD5:0E675D4A7A5B7CCD69013386793F68EB
SHA256:BF5FF4603557C9959ACEC995653D052D9054AD4826DF967974EFD2F377C723D1
4988Steam Account Generator FIXED.exeC:\Users\admin\AppData\Roaming\gfgdfxwx.exeexecutable
MD5:FA8A3DFE625E06D74B4931E31236A971
SHA256:47EC05FA7ED4B24C51CE19C2CCA63982A8D376278247391910B4EBAF7AF4DCEE
2088cxvezrfde.exeC:\Users\admin\AppData\Local\Temp\_MEI20882\_bz2.pydexecutable
MD5:3DC8AF67E6EE06AF9EEC52FE985A7633
SHA256:C55821F5FDB0064C796B2C0B03B51971F073140BC210CBE6ED90387DB2BED929
2088cxvezrfde.exeC:\Users\admin\AppData\Local\Temp\_MEI20882\_hashlib.pydexecutable
MD5:A6448BC5E5DA21A222DE164823ADD45C
SHA256:3692FC8E70E6E29910032240080FC8109248CE9A996F0A70D69ACF1542FCA69A
2088cxvezrfde.exeC:\Users\admin\AppData\Local\Temp\_MEI20882\_lzma.pydexecutable
MD5:37057C92F50391D0751F2C1D7AD25B02
SHA256:9442DC46829485670A6AC0C02EF83C54B401F1570D1D5D1D85C19C1587487764
4988Steam Account Generator FIXED.exeC:\Users\admin\AppData\Roaming\cvcxxxx.exeexecutable
MD5:4F17FF0609C453A1D2DE788D8F9744C3
SHA256:FBCBE26A6C1A6FC8B451D3AEC8A91384A15124C8CA9931363BDD9ED174631B11
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
15
TCP/UDP connections
26
DNS requests
14
Threats
38

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
2.16.168.114:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6872
nudwee.exe
POST
200
185.156.72.8:80
http://185.156.72.8/rob75u9v/index.php
unknown
—
—
malicious
—
—
GET
200
2.23.181.156:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
644
cvcxxxx.exe
POST
200
185.156.72.8:80
http://185.156.72.8/zpaxpjz/get.php
unknown
—
—
malicious
6872
nudwee.exe
POST
200
185.156.72.8:80
http://185.156.72.8/rob75u9v/index.php
unknown
—
—
malicious
644
cvcxxxx.exe
POST
200
185.156.72.8:80
http://185.156.72.8/zpaxpjz/get.php
unknown
—
—
malicious
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6068
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6068
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
644
cvcxxxx.exe
POST
200
185.156.72.8:80
http://185.156.72.8/zpaxpjz/get.php
unknown
—
—
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
2.16.168.114:80
crl.microsoft.com
Akamai International B.V.
RU
whitelisted
—
—
2.23.181.156:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
2104
svchost.exe
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3216
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6872
nudwee.exe
185.156.72.8:80
—
Tov Vaiz Partner
RU
malicious
6544
svchost.exe
20.190.160.22:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
crl.microsoft.com
  • 2.16.168.114
  • 2.16.168.124
whitelisted
www.microsoft.com
  • 2.23.181.156
  • 95.101.149.131
whitelisted
google.com
  • 142.250.185.78
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
login.live.com
  • 20.190.160.22
  • 20.190.160.5
  • 40.126.32.134
  • 20.190.160.67
  • 40.126.32.133
  • 40.126.32.74
  • 20.190.160.132
  • 20.190.160.14
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
settings-win.data.microsoft.com
  • 4.231.128.59
whitelisted
slscr.update.microsoft.com
  • 4.245.163.56
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.85.23.206
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted

Threats

PID
Process
Class
Message
6872
nudwee.exe
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 35
6872
nudwee.exe
Malware Command and Control Activity Detected
BOTNET [ANY.RUN] Amadey HTTP POST Request (st=s)
6872
nudwee.exe
Malware Command and Control Activity Detected
ET MALWARE Amadey CnC Response
6872
nudwee.exe
Malware Command and Control Activity Detected
ET MALWARE Amadey CnC Response
644
cvcxxxx.exe
Misc activity
INFO [ANY.RUN] USER_AGENTS Suspicious User-Agent (Mozilla/5.0)
644
cvcxxxx.exe
Potential Corporate Privacy Violation
POLICY [ANY.RUN] Sending Screenshot in Archive via POST Request
1052
wxcvxverd.exe
Potentially Bad Traffic
ET INFO Microsoft net.tcp Connection Initialization Activity
644
cvcxxxx.exe
Misc activity
INFO [ANY.RUN] USER_AGENTS Suspicious User-Agent (Mozilla/5.0)
644
cvcxxxx.exe
Misc activity
INFO [ANY.RUN] USER_AGENTS Suspicious User-Agent (Mozilla/5.0)
1052
wxcvxverd.exe
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 7
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Steam Account Generator FIXED.exe