v-w-v.com: a server that handed out DLL plugins and an exe, and what to do if a PC fetched them

What v-w-v.com is, and what we know about it

v-w-v.com is not a program on your PC. It is a web address that the abuse.ch project URLhaus lists as a place where malware was served. We found no public write-up of this one address, so what follows is what URLhaus shows, what our own request found, and what security vendors have published about the kind of files with these names.

1. 1

   What URLhaus lists

   Five file addresses on v-w-v.com, all added on 15 October 2026 between 15:37 and 15:38 UTC by an anonymous reporter. Four are DLL files in a folder called Plugins (clip.dll, cred.dll, cred64.dll, clip64.dll) and one is an exe called build_amd.exe_Melted.exe in a folder called Uploads. All five sit under the same random looking folder name, g84kfS5n. Each carries the threat label malware_download, and the only tags are dll or exe.

2. 2

   What is offline now

   All five are marked offline in the data we hold. On 17 October 2026 our server asked for the address and the name did not resolve at all (getaddrinfo ENOTFOUND). The registration record read on 15 October shows the status client hold, which in the registry system means the registrar has asked for the name to be left out of the DNS. Who asked, and why, is not shown.

3. 3

   What we could not confirm

   We did not download any file, because the server is gone, and we do not have a sample. We cannot tell you what is inside them, which malware family they belong to or where they report to. URLhaus gives no family tag for these five entries. The family discussion below is our reading of the file names, checked against vendor reports, and not a proof.

4. 4

   What this means for you

   If you only saw the name in a firewall log, a blocked request or a warning, you are not infected by that alone. The risk is for a PC where a program already ran and went to fetch one of these files in the days before the server went dark. Files with these names are not meant for people to open; a normal visitor has no reason to ask for them.

Kind of threat

A server that handed out four plugin DLLs and one exe, listed by URLhaus as malware_download

Where the files were

hxxp://v-w-v[.]com/g84kfS5n/Plugins/ and hxxp://v-w-v[.]com/g84kfS5n/Uploads/: plain http, not https

Domain registered

17 September 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com; status client hold, client delete prohibited, client renew prohibited, client transfer prohibited, client update prohibited (RDAP, read 15 October 2026)

URLhaus entries

5 file addresses, all added on 15 October 2026 between 15:37 and 15:38 UTC; all 5 offline in our data

Likely family (our reading)

Amadey, a Windows bot that fetches plugins named cred64.dll and clip64.dll according to Splunk and Cyble. Not confirmed for this server

Platform

Windows. The files are DLLs and a Windows exe. Nothing we read says Mac, iPhone or Android are affected

What we checked on 17 October 2026, and what we could not

Our check was one plain request from our server to v-w-v.com, not a browser visit. The name did not resolve, so no page, no redirect and no file came back. That clears nothing: it only says the server cannot be reached from where we ask, today.

What happened to v-w-v.com, from registration to our check

The domain was very young when the files were reported: 28 days. The dates come from RDAP and from the URLhaus data we hold; the times are UTC.

1. 17 September 2026

   The domain is registered

   RDAP shows v-w-v.com registered at 19:23 UTC on 17 September 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com. Nothing else is public about the owner.

2. 15 October 2026, 15:37 UTC

   Four files are reported within five seconds

   clip.dll is added at 15:37:12, then cred.dll and cred64.dll at 15:37:13, all in the Plugins folder. The identical second suggests one person submitted a list at once. The reporter is anonymous.

3. 15 October 2026, 15:37 to 15:38 UTC

   The exe and the last plugin

   build_amd.exe_Melted.exe in the Uploads folder is added at 15:37:17 and clip64.dll at 15:38:08. All five entries are within 56 seconds. By the time we read our copy of the data all five were marked offline.

4. 15 October 2026, 18:46 UTC

   The registry record shows a hold

   We read the RDAP record and it shows the status client hold alongside four prohibition flags. We do not know when the hold was set, so we cannot say whether it came before or after the reports.

   

5. 17 October 2026

   Our request

   Our server asks for the address and the name does not resolve. We check again only when a refresh of this guide is ordered, so later changes are not shown here.

What the pattern suggests, and what it does not: a domain that is a few weeks old, a random looking folder name and a list of files that went into a tracker in under a minute look like a short lived server that someone prepared for a campaign. That is our reading of the dates, not something any report says.

What the file names suggest

The names cred.dll, cred64.dll, clip.dll and clip64.dll in a folder called Plugins match plugins that vendors have described for Amadey, a Windows bot that has been seen since at least October 2018 according to MITRE. The match is on names, so treat it as a lead and not as a finding.

What is solid: the file names are specific and the same pair of plugin names is described by more than one vendor. What is not: the vendors saw these plugins on other servers. URLhaus gives no family tag for v-w-v.com, we have no sample, and malware authors copy names. The practical advice does not change either way, because both a credential stealer and a clipboard reader mean that logins and copied text may have been taken.

What Amadey does, as the sources describe it

Amadey is a bot: a first program that settles on a PC, reports to a controller and downloads more programs on request. The plugins above are those extra programs.

1. 1

   It collects facts about the PC

   MITRE says Amadey gathers the computer name, user name, Windows version and IP address, and looks for security software and antivirus folders. It sends this to its controller over http. MITRE also notes that it skips some tasks on machines located in Russia.

2. 2

   It stays after a restart

   MITRE says it changes registry keys so that the Startup folder points to its own file, and it clears the :Zone.Identifier stream of a file, which is the mark that tells Windows a file came from the internet. This is why a restart does not remove it and why a downloaded file may not show the usual warning.

3. 3

   It fetches plugins

   Cyble reports that after contact with the controller the bot downloads two DLLs into the AppData folder and runs them through rundll32.exe. Splunk adds that the call names an export called Main. In Task Manager that shows up as the normal Windows program rundll32.exe, which is not a suspicious name by itself.

4. 4

   It can bring more malware

   MITRE says the bot can download and run further files. That means a PC that fetched these plugins may also have received something else, and the plugin list on v-w-v.com is only what URLhaus recorded.

5. 5

   Not every PC gets every file

   The write-ups describe a bot that asks its controller what to fetch, so which plugins a PC receives depends on what the controller offers at that moment. A PC that contacted a server like this may therefore have received only part of the set, or none of it. We cannot say which for v-w-v.com.

What the plugins can take from a Windows PC

The list below is what the sources say plugins with these names do. It is not proof that these five files do all of it, and it is not a measurement of any one infected PC.

One point worth knowing about a clipboard reader: Cyble describes the botnet as having clipper capabilities. A clipper can also swap a copied payment address for another one. We found no source saying that these files do so, but when a clipboard plugin may have run, check the first and last characters of every payment address on screen before you send money.

What this can cost you

Reading about the site or seeing its name costs nothing. The risks below apply to a Windows PC where a program fetched and ran these plugins.

• High

  Passwords and accounts

  Saved browser passwords may be read and decrypted. Changing passwords from the same PC does not help, because the clipboard plugin and the bot may still be running.

• High

  Crypto and banking

  A clipboard reader sees every wallet address, seed phrase and bank reference you copy. Crypto that is sent to a wrong address cannot be reversed.

• Medium

  More malware on the same PC

  MITRE says Amadey can download and run further files, so the PC may hold programs that never appear on v-w-v.com.

• Medium

  Work and company accounts

  A work login saved in the browser is exposed in the same way as a private one. Tell your IT contact if the PC is used for work.

• Low

  Nothing, if you only saw the name

  A name in a block list, a log or a warning is not an infection.

What you may notice, and what you may not

Bots and stealers are built to be quiet. The signs below come from the sources and from what they imply; none is certain, and many victims notice nothing.

How a PC ends up asking for these files

Nobody visits v-w-v.com on purpose. The request comes from a program that is already on the PC, so the real question is how that program got there. We cannot say for this server. The routes below are those that vendors describe for Amadey.

1. 1

   Phishing sites and fake downloads

   Cyble describes the botnet being pushed through phishing sites. A fake installer or a fake update page runs the first program, and that program then fetches the plugins.

2. 2

   Cracked software and bundles

   Bot loaders commonly ride on fake cracks, keygens and software bundles. We did not find a source tying this exact server to one, so this is a general risk and not a finding.

3. 3

   Another malware family

   MITRE says Amadey can download and run further files, and a bot can itself be delivered by another loader. One infection can therefore bring the next. We do not know what ran first on a PC that asked for these files.

Check your PC before you delete anything

Start with the question that matters: did something on this PC contact v-w-v.com, or did you run a crack, a keygen, a fake installer or an unexpected attachment around mid October 2026 or earlier? If you saw the name in a log from your own network, the device that asked is the one to check. If the answer is yes or you are not sure, do the checks below. None of them deletes anything.

While you check, stop using the PC for banking, email, work or crypto, and disconnect it from the network if you can.

1. 1

   Disconnect first

   Turn off Wi-Fi or unplug the network cable. The bot needs the connection to report and to fetch more files.

2. 2

   Find which device asked for the address

   If you came here from a log, a router page or an alert, note the device and the time. Only that device is in question, not every device on the network.

3. 3

   Open Task Manager

   Press Ctrl + Shift + Esc and look at the Processes tab. Look for rundll32.exe running when you did nothing, and for any process with an odd name or a lot of network use. Right click and choose Open file location: a file in a folder under AppData with the name cred, clip or something random is the clue.

4. 4

   Look at startup apps

   Open Settings > Apps > Startup and look for names you did not install. Also open Task Scheduler and read Task Scheduler Library for tasks with random names that start a program from a user folder. MITRE says Amadey changes registry keys so the Startup folder points to its file, so check the Startup folder as well. Write down names; do not delete yet.

5. 5

   Open Protection history

   In Windows Security > Virus & threat protection > Protection history, look for any detection around the time of the first contact, or for anything blocked or quarantined. Microsoft says the results of a Defender Offline scan also appear there.

6. 6

   Check your accounts from another device

   Look at the sign in activity of your email, bank, shop and exchange accounts, and at crypto balances. This is quicker than any file check, and a login from a place you never visited tells you more than a clean scan.

7. 7

   A scan helps, but it does not clear the PC

   A scan with Microsoft Defender or another product can find known files. Treat a clean result the way you treat a quiet site test: one data point. We have no sample and infected no PC, so the order of the plan is our judgement from Microsoft's pages and the vendor reports, not a tested result.

If you use a Mac, an iPhone or an Android phone

The files are DLLs and a Windows exe, and every source we read describes Amadey as a Windows threat. We found nothing that says these files affect anything else.