The spreadsheet also creates a scheduled task named "windows update check" that runs the file C:\Users\<user_name>\.templates\System Manager.exe every minute. Figure 3 provides a snippet of VBA code that creates the scheduled task, clearly obfuscated to avoid simple detection