Technical Information
- <SYSTEM32>\tasks\winurl
- %PROGRAMDATA%\{6badefbe-ba9b-cae1-976b-e8266c403411}\services_update.exe
- %PROGRAMDATA%\microsoft\windows\start menu\programs\startup\winurl.url
- %PROGRAMDATA%\{6badefbe-ba9b-cae1-976b-e8266c403411}\services_update.exe
- '5.###.231.110':80
- '%PROGRAMDATA%\{6badefbe-ba9b-cae1-976b-e8266c403411}\services_update.exe'
- '%WINDIR%\syswow64\schtasks.exe' /create /tn WinUrl /tr %PROGRAMDATA%\{6badefbe-ba9b-cae1-976b-e8266c403411}\services_update.exe /sc minute /F' (with hidden window)
- '%PROGRAMDATA%\{6badefbe-ba9b-cae1-976b-e8266c403411}\services_update.exe' ' (with hidden window)
- '%WINDIR%\syswow64\schtasks.exe' /create /tn WinUrl /tr %PROGRAMDATA%\{6badefbe-ba9b-cae1-976b-e8266c403411}\services_update.exe /sc minute /F
- '<SYSTEM32>\taskeng.exe' {038321B7-72C1-4FCA-B751-ABD17D2B082E} S-1-5-21-1960123792-2022915161-3775307078-1001:xeqpupwpyw\user:Interactive:[1]