File name:

Orcus.exe

Full analysis: https://app.any.run/tasks/6f9c5501-29e9-4afe-91a2-c5817602f592
Verdict: Malicious activity
Threats:

Orcus is a modular Remote Access Trojan with some unusual functions. This RAT enables attackers to create plugins using a custom development library and offers a robust core feature set that makes it one of the most dangerous malicious programs in its class.

Malware Trends Tracker     >>>
Analysis date: April 15, 2025, 18:27:24
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
rat
orcus
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
MD5:

446FA325166F239C9ADC86AEB8D51FF8

SHA1:

A2E5CE32DCE170C40AEE44A2D3AD6D86E30CBF07

SHA256:

0593237EC31371316E73C2137B79F3DEDDBF8765356114922992D95E57485C69

SSDEEP:

24576:D8WQ3d3P51k22nQE7Wj6wogps/+LLjhcdUUgigmVYdrZlI0AilFEvxHip:D8WKd3P51k22nQE7Wj6wogps/+L/h2gx

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Starts Visual C# compiler

      • Orcus.exe (PID: 1964)
      • Orcus.exe (PID: 2304)

    • Orcus is detected

      • Orcus.exe (PID: 1964)
      • Orcus.exe (PID: 2304)
      • Orcus.exe (PID: 2916)
      • Orcus.exe (PID: 2916)

    • ORCUS has been detected (YARA)

      • Orcus.exe (PID: 2916)

    • Changes the autorun value in the registry

      • Orcus.exe (PID: 2916)

  • SUSPICIOUS

    • Uses .NET C# to load dll

      • Orcus.exe (PID: 1964)
      • Orcus.exe (PID: 2304)

    • Application launched itself

      • Orcus.exe (PID: 1964)

    • Reads security settings of Internet Explorer

      • Orcus.exe (PID: 1964)
      • Orcus.exe (PID: 2304)

    • Reads the Internet Settings

      • Orcus.exe (PID: 1964)
      • Orcus.exe (PID: 2304)

    • Executable content was dropped or overwritten

      • csc.exe (PID: 2360)
      • csc.exe (PID: 2944)
      • Orcus.exe (PID: 2304)

    • Starts itself from another location

      • Orcus.exe (PID: 2304)

    • There is functionality for taking screenshot (YARA)

      • Orcus.exe (PID: 2916)

    • Connects to unusual port

      • Orcus.exe (PID: 2916)

  • INFO

    • Checks supported languages

      • Orcus.exe (PID: 1964)
      • csc.exe (PID: 2360)
      • cvtres.exe (PID: 128)
      • Orcus.exe (PID: 2304)
      • csc.exe (PID: 2944)
      • cvtres.exe (PID: 2024)
      • Orcus.exe (PID: 2916)

    • Reads the machine GUID from the registry

      • Orcus.exe (PID: 1964)
      • cvtres.exe (PID: 128)
      • csc.exe (PID: 2360)
      • Orcus.exe (PID: 2304)
      • csc.exe (PID: 2944)
      • cvtres.exe (PID: 2024)
      • Orcus.exe (PID: 2916)

    • Create files in a temporary directory

      • cvtres.exe (PID: 128)
      • Orcus.exe (PID: 1964)
      • csc.exe (PID: 2360)
      • Orcus.exe (PID: 2304)
      • cvtres.exe (PID: 2024)
      • csc.exe (PID: 2944)

    • Reads the computer name

      • Orcus.exe (PID: 1964)
      • Orcus.exe (PID: 2304)
      • Orcus.exe (PID: 2916)

    • Creates files in the program directory

      • Orcus.exe (PID: 2304)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Orcus

(PID) Process(2916) Orcus.exe
C2 (1)hostip00.duckdns.org:10134
Keys
AESc01ba23f4a5c2ad5813126ee9c2985be07dd66eb0a866defcb4d4f363f3ccdb3
Salt
Options
AutostartBuilderProperty
AutostartMethodRegistry
TaskSchedulerTaskNameOrcus
TaskHighestPrivilegestrue
RegistryHiddenStarttrue
RegistryKeyNameOrcus
TryAllAutostartMethodsOnFailtrue
ChangeAssemblyInformationBuilderProperty
ChangeAssemblyInformationfalse
AssemblyTitlenull
AssemblyDescriptionnull
AssemblyCompanyNamenull
AssemblyProductNamenull
AssemblyCopyrightnull
AssemblyTrademarksnull
AssemblyProductVersion1.0.0.0
AssemblyFileVersion1.0.0.0
ChangeCreationDateBuilderProperty
IsEnabledfalse
NewCreationDate2019-10-08T17:50:53
ChangeIconBuilderProperty
ChangeIconfalse
IconPathnull
ClientTagBuilderProperty
ClientTagnull
DataFolderBuilderProperty
Path%appdata%\Orcus
DefaultPrivilegesBuilderProperty
RequireAdministratorRightsfalse
DisableInstallationPromptBuilderProperty
IsDisabledtrue
FrameworkVersionBuilderProperty
FrameworkVersionNET35
HideFileBuilderProperty
HideFiletrue
InstallationLocationBuilderProperty
Path%programfiles%\Orcus\Orcus.exe
InstallBuilderProperty
Installtrue
KeyloggerBuilderProperty
IsEnabledfalse
MutexBuilderProperty
Mutexb4bea4c9ff5349f6a9bbabcbee1f3f7c
ProxyBuilderProperty
ProxyOptionNone
ProxyAddressnull
ProxyPort1080
ProxyType2
ReconnectDelayProperty
Delay10000
RequireAdministratorPrivilegesInstallerBuilderProperty
RequireAdministratorPrivilegestrue
RespawnTaskBuilderProperty
IsEnabledfalse
TaskNameOrcus Respawner
ServiceBuilderProperty
Installfalse
SetRunProgramAsAdminFlagBuilderProperty
SetFlagfalse
WatchdogBuilderProperty
IsEnabledfalse
NameOrcusWatchdog.exe
WatchdogLocationAppData
PreventFileDeletionfalse
Plugins (0)
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (56.7)
.exe | Win64 Executable (generic) (21.3)
.scr | Windows screen saver (10.1)
.dll | Win32 Dynamic Link Library (generic) (5)
.exe | Win32 Executable (generic) (3.4)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2019:10:08 22:51:19+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 8
CodeSize: 920064
InitializedDataSize: 4608
UninitializedDataSize: -
EntryPoint: 0xe281e
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: -
CompanyName: -
FileDescription: -
FileVersion: 1.0.0.0
InternalName: Orcus.exe
LegalCopyright: -
LegalTrademarks: -
OriginalFileName: Orcus.exe
ProductName: -
ProductVersion: 1.0.0.0
AssemblyVersion: 1.0.0.0
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
45
Monitored processes
8
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #ORCUS orcus.exe no specs csc.exe cvtres.exe no specs #ORCUS orcus.exe csc.exe cvtres.exe no specs #ORCUS orcus.exe svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
128C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\admin\AppData\Local\Temp\RES34D7.tmp" "c:\Users\admin\AppData\Local\Temp\CSC34D6.tmp"C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe—csc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft® Resource File To COFF Object Conversion Utility
Exit code:
0
Version:
8.00.50727.5003 (Win7SP1GDR.050727-5400)
Modules
Images
c:\windows\microsoft.net\framework\v2.0.50727\cvtres.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc\msvcr80.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cryptsp.dll
1080C:\Windows\system32\svchost.exe -k NetworkServiceC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1964"C:\Users\admin\Desktop\Orcus.exe" C:\Users\admin\Desktop\Orcus.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\orcus.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2024C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\admin\AppData\Local\Temp\RES3EF9.tmp" "c:\Users\admin\AppData\Local\Temp\CSC3EF8.tmp"C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe—csc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft® Resource File To COFF Object Conversion Utility
Exit code:
0
Version:
8.00.50727.5003 (Win7SP1GDR.050727-5400)
Modules
Images
c:\windows\microsoft.net\framework\v2.0.50727\cvtres.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc\msvcr80.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cryptsp.dll
2304"C:\Users\admin\Desktop\Orcus.exe" /waitC:\Users\admin\Desktop\Orcus.exe
Orcus.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\orcus.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2360"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\admin\AppData\Local\Temp\u18njhrd.cmdline"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
Orcus.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Visual C# Command Line Compiler
Exit code:
0
Version:
8.0.50727.5483 (Win7SP1GDR.050727-5400)
Modules
Images
c:\windows\microsoft.net\framework\v2.0.50727\csc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc\msvcr80.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2916"C:\Program Files\Orcus\Orcus.exe" C:\Program Files\Orcus\Orcus.exe
Orcus.exe
User:
admin
Integrity Level:
HIGH
Version:
1.0.0.0
Modules
Images
c:\program files\orcus\orcus.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
Orcus
(PID) Process(2916) Orcus.exe
C2 (1)hostip00.duckdns.org:10134
Keys
AESc01ba23f4a5c2ad5813126ee9c2985be07dd66eb0a866defcb4d4f363f3ccdb3
Salt
Options
AutostartBuilderProperty
AutostartMethodRegistry
TaskSchedulerTaskNameOrcus
TaskHighestPrivilegestrue
RegistryHiddenStarttrue
RegistryKeyNameOrcus
TryAllAutostartMethodsOnFailtrue
ChangeAssemblyInformationBuilderProperty
ChangeAssemblyInformationfalse
AssemblyTitlenull
AssemblyDescriptionnull
AssemblyCompanyNamenull
AssemblyProductNamenull
AssemblyCopyrightnull
AssemblyTrademarksnull
AssemblyProductVersion1.0.0.0
AssemblyFileVersion1.0.0.0
ChangeCreationDateBuilderProperty
IsEnabledfalse
NewCreationDate2019-10-08T17:50:53
ChangeIconBuilderProperty
ChangeIconfalse
IconPathnull
ClientTagBuilderProperty
ClientTagnull
DataFolderBuilderProperty
Path%appdata%\Orcus
DefaultPrivilegesBuilderProperty
RequireAdministratorRightsfalse
DisableInstallationPromptBuilderProperty
IsDisabledtrue
FrameworkVersionBuilderProperty
FrameworkVersionNET35
HideFileBuilderProperty
HideFiletrue
InstallationLocationBuilderProperty
Path%programfiles%\Orcus\Orcus.exe
InstallBuilderProperty
Installtrue
KeyloggerBuilderProperty
IsEnabledfalse
MutexBuilderProperty
Mutexb4bea4c9ff5349f6a9bbabcbee1f3f7c
ProxyBuilderProperty
ProxyOptionNone
ProxyAddressnull
ProxyPort1080
ProxyType2
ReconnectDelayProperty
Delay10000
RequireAdministratorPrivilegesInstallerBuilderProperty
RequireAdministratorPrivilegestrue
RespawnTaskBuilderProperty
IsEnabledfalse
TaskNameOrcus Respawner
ServiceBuilderProperty
Installfalse
SetRunProgramAsAdminFlagBuilderProperty
SetFlagfalse
WatchdogBuilderProperty
IsEnabledfalse
NameOrcusWatchdog.exe
WatchdogLocationAppData
PreventFileDeletionfalse
Plugins (0)
2944"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\admin\AppData\Local\Temp\meoqgm7c.cmdline"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
Orcus.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Visual C# Command Line Compiler
Exit code:
0
Version:
8.0.50727.5483 (Win7SP1GDR.050727-5400)
Modules
Images
c:\windows\microsoft.net\framework\v2.0.50727\csc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc\msvcr80.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
Total events
1 231
Read events
1 214
Write events
17
Delete events
0

Modification events

(PID) Process:(1964) Orcus.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(1964) Orcus.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(1964) Orcus.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(1964) Orcus.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(2304) Orcus.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2304) Orcus.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(2304) Orcus.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(2304) Orcus.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(2916) Orcus.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:Orcus
Value:
"C:\Program Files\Orcus\Orcus.exe"
Executable files
3
Suspicious files
4
Text files
7
Unknown types
0

Dropped files

PID
Process
Filename
Type
2360csc.exeC:\Users\admin\AppData\Local\Temp\u18njhrd.dllexecutable
MD5:703404DF2F4095471802ADFAD8256755
SHA256:50716CA2308D58CC72A25736C6E4362F69EA3B09D24BF4DA702C9B6488E8A6F7
1964Orcus.exeC:\Users\admin\AppData\Local\Temp\u18njhrd.cmdlinetext
MD5:9C61FA6E16A600AFE78E8CF5913500B5
SHA256:5D2A17AE44576CFA52862C10BFF4E57BE7C3A25A3F9B7A34C08434CDFA1196F2
128cvtres.exeC:\Users\admin\AppData\Local\Temp\RES34D7.tmpbinary
MD5:127C5D7EFF8C8AEB4BCDACD2CA2FF1A3
SHA256:18A87F02D55A4C0056B5D3DED982E14520996E534940DB23ED4C617CCD0914A2
2360csc.exeC:\Users\admin\AppData\Local\Temp\u18njhrd.outtext
MD5:39C86D7DCE6C7ACFD4F5F1DDE291EB6D
SHA256:F5D25B27A7866E5065EAE7192D9CF3758A40C8B3EA612CCA48F3774AB9A56750
2360csc.exeC:\Users\admin\AppData\Local\Temp\CSC34D6.tmpbinary
MD5:199D7A2FEE75A3CD6D9F078369FA5127
SHA256:65E38CCFCCA837B270BAAFAA266708C53F5017B66B7386CE4484AE0A823362B9
2304Orcus.exeC:\Users\admin\AppData\Local\Temp\meoqgm7c.0.cstext
MD5:6A95B8EB587A4BED5CCEB69ACE270787
SHA256:7D5AF16CF59229DD3F5969A734A1E4CF8882EC4E11B761878F4DA4C95670E249
2024cvtres.exeC:\Users\admin\AppData\Local\Temp\RES3EF9.tmpbinary
MD5:69E545184C0936782070BA123BB5F4B9
SHA256:41C1DF50996335852C287C873301AC26C1CEC11F0F29243975A2BB1EEC34E30C
2304Orcus.exeC:\Users\admin\AppData\Local\Temp\meoqgm7c.cmdlinetext
MD5:8CD5F4E584F2F272C3ED834CB12029AD
SHA256:C3FEC5EF957A097E851180C208AF535C696A141C569CAC4B7F6B51C6746A21B0
2944csc.exeC:\Users\admin\AppData\Local\Temp\CSC3EF8.tmpbinary
MD5:A6F1F6465A8860B20DE67E859ED6EFC8
SHA256:E677618700C065FBDD0D7E5B32E5F7D733AAE4F56992A92DA8BF7D696B59F175
1964Orcus.exeC:\Users\admin\AppData\Local\Temp\u18njhrd.0.cstext
MD5:E79D883FF188B2531112FE2D79EDC3ED
SHA256:2043335A4EF044954DE830909AB110C40D932D8438BD635E38951F81B7A7A8D3
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
10
DNS requests
4
Threats
4

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
224.0.0.252:5355
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
whitelisted
2916
Orcus.exe
189.198.27.14:10134
hostip00.duckdns.org
—
MX
unknown

DNS requests

Domain
IP
Reputation
google.com
  • 172.217.18.110
whitelisted
hostip00.duckdns.org
  • 189.198.27.14
unknown
dns.msftncsi.com
  • 131.107.255.255
whitelisted

Threats

PID
Process
Class
Message
1080
svchost.exe
Misc activity
ET DYN_DNS DYNAMIC_DNS Query to *.duckdns. Domain
1080
svchost.exe
Potentially Bad Traffic
ET DYN_DNS DYNAMIC_DNS Query to a *.duckdns .org Domain
1080
svchost.exe
Potentially Bad Traffic
ET DYN_DNS DYNAMIC_DNS Query to a *.duckdns .org Domain
1080
svchost.exe
Misc activity
ET DYN_DNS DYNAMIC_DNS Query to *.duckdns. Domain
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Orcus.exe