File name:

Orcus.exe

Full analysis: https://app.any.run/tasks/6f9c5501-29e9-4afe-91a2-c5817602f592
Verdict: Malicious activity
Threats:

Orcus is a modular Remote Access Trojan with some unusual functions. This RAT enables attackers to create plugins using a custom development library and offers a robust core feature set that makes it one of the most dangerous malicious programs in its class.

Malware Trends Tracker     >>>
Analysis date: April 15, 2025, 18:27:24
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
rat
orcus
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
MD5:

446FA325166F239C9ADC86AEB8D51FF8

SHA1:

A2E5CE32DCE170C40AEE44A2D3AD6D86E30CBF07

SHA256:

0593237EC31371316E73C2137B79F3DEDDBF8765356114922992D95E57485C69

SSDEEP:

24576:D8WQ3d3P51k22nQE7Wj6wogps/+LLjhcdUUgigmVYdrZlI0AilFEvxHip:D8WKd3P51k22nQE7Wj6wogps/+L/h2gx

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Orcus is detected

      • Orcus.exe (PID: 1964)
      • Orcus.exe (PID: 2304)
      • Orcus.exe (PID: 2916)
      • Orcus.exe (PID: 2916)

    • Starts Visual C# compiler

      • Orcus.exe (PID: 1964)
      • Orcus.exe (PID: 2304)

    • Changes the autorun value in the registry

      • Orcus.exe (PID: 2916)

    • ORCUS has been detected (YARA)

      • Orcus.exe (PID: 2916)

  • SUSPICIOUS

    • Uses .NET C# to load dll

      • Orcus.exe (PID: 1964)
      • Orcus.exe (PID: 2304)

    • Executable content was dropped or overwritten

      • csc.exe (PID: 2360)
      • csc.exe (PID: 2944)
      • Orcus.exe (PID: 2304)

    • Reads security settings of Internet Explorer

      • Orcus.exe (PID: 1964)
      • Orcus.exe (PID: 2304)

    • Reads the Internet Settings

      • Orcus.exe (PID: 1964)
      • Orcus.exe (PID: 2304)

    • Application launched itself

      • Orcus.exe (PID: 1964)

    • Starts itself from another location

      • Orcus.exe (PID: 2304)

    • Connects to unusual port

      • Orcus.exe (PID: 2916)

    • There is functionality for taking screenshot (YARA)

      • Orcus.exe (PID: 2916)

  • INFO

    • Checks supported languages

      • Orcus.exe (PID: 1964)
      • csc.exe (PID: 2360)
      • cvtres.exe (PID: 128)
      • Orcus.exe (PID: 2304)
      • csc.exe (PID: 2944)
      • cvtres.exe (PID: 2024)
      • Orcus.exe (PID: 2916)

    • Reads the machine GUID from the registry

      • Orcus.exe (PID: 1964)
      • csc.exe (PID: 2360)
      • cvtres.exe (PID: 128)
      • Orcus.exe (PID: 2304)
      • csc.exe (PID: 2944)
      • cvtres.exe (PID: 2024)
      • Orcus.exe (PID: 2916)

    • Create files in a temporary directory

      • Orcus.exe (PID: 1964)
      • cvtres.exe (PID: 128)
      • csc.exe (PID: 2360)
      • Orcus.exe (PID: 2304)
      • csc.exe (PID: 2944)
      • cvtres.exe (PID: 2024)

    • Reads the computer name

      • Orcus.exe (PID: 1964)
      • Orcus.exe (PID: 2304)
      • Orcus.exe (PID: 2916)

    • Creates files in the program directory

      • Orcus.exe (PID: 2304)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Orcus

(PID) Process(2916) Orcus.exe
C2 (1)hostip00.duckdns.org:10134
Keys
AESc01ba23f4a5c2ad5813126ee9c2985be07dd66eb0a866defcb4d4f363f3ccdb3
Salt
Options
AutostartBuilderProperty
AutostartMethodRegistry
TaskSchedulerTaskNameOrcus
TaskHighestPrivilegestrue
RegistryHiddenStarttrue
RegistryKeyNameOrcus
TryAllAutostartMethodsOnFailtrue
ChangeAssemblyInformationBuilderProperty
ChangeAssemblyInformationfalse
AssemblyTitlenull
AssemblyDescriptionnull
AssemblyCompanyNamenull
AssemblyProductNamenull
AssemblyCopyrightnull
AssemblyTrademarksnull
AssemblyProductVersion1.0.0.0
AssemblyFileVersion1.0.0.0
ChangeCreationDateBuilderProperty
IsEnabledfalse
NewCreationDate2019-10-08T17:50:53
ChangeIconBuilderProperty
ChangeIconfalse
IconPathnull
ClientTagBuilderProperty
ClientTagnull
DataFolderBuilderProperty
Path%appdata%\Orcus
DefaultPrivilegesBuilderProperty
RequireAdministratorRightsfalse
DisableInstallationPromptBuilderProperty
IsDisabledtrue
FrameworkVersionBuilderProperty
FrameworkVersionNET35
HideFileBuilderProperty
HideFiletrue
InstallationLocationBuilderProperty
Path%programfiles%\Orcus\Orcus.exe
InstallBuilderProperty
Installtrue
KeyloggerBuilderProperty
IsEnabledfalse
MutexBuilderProperty
Mutexb4bea4c9ff5349f6a9bbabcbee1f3f7c
ProxyBuilderProperty
ProxyOptionNone
ProxyAddressnull
ProxyPort1080
ProxyType2
ReconnectDelayProperty
Delay10000
RequireAdministratorPrivilegesInstallerBuilderProperty
RequireAdministratorPrivilegestrue
RespawnTaskBuilderProperty
IsEnabledfalse
TaskNameOrcus Respawner
ServiceBuilderProperty
Installfalse
SetRunProgramAsAdminFlagBuilderProperty
SetFlagfalse
WatchdogBuilderProperty
IsEnabledfalse
NameOrcusWatchdog.exe
WatchdogLocationAppData
PreventFileDeletionfalse
Plugins (0)
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (56.7)
.exe | Win64 Executable (generic) (21.3)
.scr | Windows screen saver (10.1)
.dll | Win32 Dynamic Link Library (generic) (5)
.exe | Win32 Executable (generic) (3.4)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2019:10:08 22:51:19+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 8
CodeSize: 920064
InitializedDataSize: 4608
UninitializedDataSize: -
EntryPoint: 0xe281e
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: -
CompanyName: -
FileDescription: -
FileVersion: 1.0.0.0
InternalName: Orcus.exe
LegalCopyright: -
LegalTrademarks: -
OriginalFileName: Orcus.exe
ProductName: -
ProductVersion: 1.0.0.0
AssemblyVersion: 1.0.0.0
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
45
Monitored processes
8
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #ORCUS orcus.exe no specs csc.exe cvtres.exe no specs #ORCUS orcus.exe csc.exe cvtres.exe no specs #ORCUS orcus.exe svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
128C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\admin\AppData\Local\Temp\RES34D7.tmp" "c:\Users\admin\AppData\Local\Temp\CSC34D6.tmp"C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe—csc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft® Resource File To COFF Object Conversion Utility
Exit code:
0
Version:
8.00.50727.5003 (Win7SP1GDR.050727-5400)
Modules
Images
c:\windows\microsoft.net\framework\v2.0.50727\cvtres.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc\msvcr80.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cryptsp.dll
1080C:\Windows\system32\svchost.exe -k NetworkServiceC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1964"C:\Users\admin\Desktop\Orcus.exe" C:\Users\admin\Desktop\Orcus.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\orcus.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2024C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\admin\AppData\Local\Temp\RES3EF9.tmp" "c:\Users\admin\AppData\Local\Temp\CSC3EF8.tmp"C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe—csc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft® Resource File To COFF Object Conversion Utility
Exit code:
0
Version:
8.00.50727.5003 (Win7SP1GDR.050727-5400)
Modules
Images
c:\windows\microsoft.net\framework\v2.0.50727\cvtres.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc\msvcr80.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cryptsp.dll
2304"C:\Users\admin\Desktop\Orcus.exe" /waitC:\Users\admin\Desktop\Orcus.exe
Orcus.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\orcus.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2360"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\admin\AppData\Local\Temp\u18njhrd.cmdline"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
Orcus.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Visual C# Command Line Compiler
Exit code:
0
Version:
8.0.50727.5483 (Win7SP1GDR.050727-5400)
Modules
Images
c:\windows\microsoft.net\framework\v2.0.50727\csc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc\msvcr80.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2916"C:\Program Files\Orcus\Orcus.exe" C:\Program Files\Orcus\Orcus.exe
Orcus.exe
User:
admin
Integrity Level:
HIGH
Version:
1.0.0.0
Modules
Images
c:\program files\orcus\orcus.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
Orcus
(PID) Process(2916) Orcus.exe
C2 (1)hostip00.duckdns.org:10134
Keys
AESc01ba23f4a5c2ad5813126ee9c2985be07dd66eb0a866defcb4d4f363f3ccdb3
Salt
Options
AutostartBuilderProperty
AutostartMethodRegistry
TaskSchedulerTaskNameOrcus
TaskHighestPrivilegestrue
RegistryHiddenStarttrue
RegistryKeyNameOrcus
TryAllAutostartMethodsOnFailtrue
ChangeAssemblyInformationBuilderProperty
ChangeAssemblyInformationfalse
AssemblyTitlenull
AssemblyDescriptionnull
AssemblyCompanyNamenull
AssemblyProductNamenull
AssemblyCopyrightnull
AssemblyTrademarksnull
AssemblyProductVersion1.0.0.0
AssemblyFileVersion1.0.0.0
ChangeCreationDateBuilderProperty
IsEnabledfalse
NewCreationDate2019-10-08T17:50:53
ChangeIconBuilderProperty
ChangeIconfalse
IconPathnull
ClientTagBuilderProperty
ClientTagnull
DataFolderBuilderProperty
Path%appdata%\Orcus
DefaultPrivilegesBuilderProperty
RequireAdministratorRightsfalse
DisableInstallationPromptBuilderProperty
IsDisabledtrue
FrameworkVersionBuilderProperty
FrameworkVersionNET35
HideFileBuilderProperty
HideFiletrue
InstallationLocationBuilderProperty
Path%programfiles%\Orcus\Orcus.exe
InstallBuilderProperty
Installtrue
KeyloggerBuilderProperty
IsEnabledfalse
MutexBuilderProperty
Mutexb4bea4c9ff5349f6a9bbabcbee1f3f7c
ProxyBuilderProperty
ProxyOptionNone
ProxyAddressnull
ProxyPort1080
ProxyType2
ReconnectDelayProperty
Delay10000
RequireAdministratorPrivilegesInstallerBuilderProperty
RequireAdministratorPrivilegestrue
RespawnTaskBuilderProperty
IsEnabledfalse
TaskNameOrcus Respawner
ServiceBuilderProperty
Installfalse
SetRunProgramAsAdminFlagBuilderProperty
SetFlagfalse
WatchdogBuilderProperty
IsEnabledfalse
NameOrcusWatchdog.exe
WatchdogLocationAppData
PreventFileDeletionfalse
Plugins (0)
2944"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\admin\AppData\Local\Temp\meoqgm7c.cmdline"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
Orcus.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Visual C# Command Line Compiler
Exit code:
0
Version:
8.0.50727.5483 (Win7SP1GDR.050727-5400)
Modules
Images
c:\windows\microsoft.net\framework\v2.0.50727\csc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc\msvcr80.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
Total events
1 231
Read events
1 214
Write events
17
Delete events
0

Modification events

(PID) Process:(1964) Orcus.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(1964) Orcus.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(1964) Orcus.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(1964) Orcus.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(2304) Orcus.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2304) Orcus.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(2304) Orcus.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(2304) Orcus.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(2916) Orcus.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:Orcus
Value:
"C:\Program Files\Orcus\Orcus.exe"
Executable files
3
Suspicious files
4
Text files
7
Unknown types
0

Dropped files

PID
Process
Filename
Type
1964Orcus.exeC:\Users\admin\AppData\Local\Temp\u18njhrd.0.cstext
MD5:E79D883FF188B2531112FE2D79EDC3ED
SHA256:2043335A4EF044954DE830909AB110C40D932D8438BD635E38951F81B7A7A8D3
2944csc.exeC:\Users\admin\AppData\Local\Temp\CSC3EF8.tmpbinary
MD5:A6F1F6465A8860B20DE67E859ED6EFC8
SHA256:33EEAFCFE6C1562DF5649EBA2730A080D3FFF3EE43F47D789EA17C2A1E1E4C2A
2360csc.exeC:\Users\admin\AppData\Local\Temp\u18njhrd.outtext
MD5:39C86D7DCE6C7ACFD4F5F1DDE291EB6D
SHA256:F5D25B27A7866E5065EAE7192D9CF3758A40C8B3EA612CCA48F3774AB9A56750
1964Orcus.exeC:\Users\admin\AppData\Local\Temp\u18njhrd.cmdlinetext
MD5:9C61FA6E16A600AFE78E8CF5913500B5
SHA256:5D2A17AE44576CFA52862C10BFF4E57BE7C3A25A3F9B7A34C08434CDFA1196F2
2024cvtres.exeC:\Users\admin\AppData\Local\Temp\RES3EF9.tmpbinary
MD5:69E545184C0936782070BA123BB5F4B9
SHA256:9D5D1CFA220E06B9A9136761CE55C882BE3B34DB090093A0B49BEC6A4DB18DD1
2304Orcus.exeC:\Users\admin\AppData\Local\Temp\meoqgm7c.cmdlinetext
MD5:8CD5F4E584F2F272C3ED834CB12029AD
SHA256:C3FEC5EF957A097E851180C208AF535C696A141C569CAC4B7F6B51C6746A21B0
2304Orcus.exeC:\Program Files\Orcus\Orcus.exeexecutable
MD5:446FA325166F239C9ADC86AEB8D51FF8
SHA256:0593237EC31371316E73C2137B79F3DEDDBF8765356114922992D95E57485C69
2944csc.exeC:\Users\admin\AppData\Local\Temp\meoqgm7c.dllexecutable
MD5:0755D46E4386A84EE023043FA1F57290
SHA256:80A686183772DD861C7703680C04CEE371E658042A1B2ACE633CCFE9F68812FB
2304Orcus.exeC:\Program Files\Orcus\Orcus.exe.configxml
MD5:A2B76CEA3A59FA9AF5EA21FF68139C98
SHA256:F99EF5BF79A7C43701877F0BB0B890591885BB0A3D605762647CC8FFBF10C839
2304Orcus.exeC:\Users\admin\AppData\Local\Temp\meoqgm7c.0.cstext
MD5:6A95B8EB587A4BED5CCEB69ACE270787
SHA256:7D5AF16CF59229DD3F5969A734A1E4CF8882EC4E11B761878F4DA4C95670E249
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
10
DNS requests
4
Threats
4

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
224.0.0.252:5355
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
whitelisted
2916
Orcus.exe
189.198.27.14:10134
hostip00.duckdns.org
—
MX
unknown

DNS requests

Domain
IP
Reputation
google.com
  • 172.217.18.110
whitelisted
hostip00.duckdns.org
  • 189.198.27.14
unknown
dns.msftncsi.com
  • 131.107.255.255
whitelisted

Threats

PID
Process
Class
Message
—
—
Misc activity
ET DYN_DNS DYNAMIC_DNS Query to *.duckdns. Domain
—
—
Potentially Bad Traffic
ET DYN_DNS DYNAMIC_DNS Query to a *.duckdns .org Domain
—
—
Potentially Bad Traffic
ET DYN_DNS DYNAMIC_DNS Query to a *.duckdns .org Domain
—
—
Misc activity
ET DYN_DNS DYNAMIC_DNS Query to *.duckdns. Domain
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Orcus.exe