Technical Information
- '<LS_APPDATA>\Orlfchor\Orflchor.exe'
- '<SYSTEM32>\reg.exe' add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Orlfocho" /d "cmd /c type "%TEMP%\Orlfocho.txt" | cmd"
- '<SYSTEM32>\cmd.exe'
- %APPDATA%\Imminent\Logs\15-08-2017
- %TEMP%\Orlfocho.txt
- <LS_APPDATA>\Orlfchor\Orflchor.exe
- '17#.#0.124.232':6060