Behavioral Analysis

powershell.exe "powershell.exe" Remove -ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'RynMd';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'RynMd' -Value '"C:\Users\test22\AppData\Roaming\RynMd\RynMd.exe"' -PropertyType 'String'

cmd.exe "cmd" /C schtasks /create /tn \RynMd /tr "C:\Users\test22\AppData\Roaming\RynMd\RynMd.exe" /st 00:00 /du 9999:59 /sc once /ri 60 /rl HIGHEST /f

timeout.exe timeout 3

Winder.exe "C:\Users\test22\AppData\Roaming\Winder.exe"

schtasks.exe schtasks /create /f /sc onlogon /rl highest /tn "Winder" /tr '"C:\Users\test22\AppData\Roaming\Winder.exe"'