Drops startup file

Reads user/profile data of web browsers

Infostealers often target stored browser data, which can include saved credentials etc.

Adds Run key to start application

Creates a new local user account

Uses net.exe to create a new local user account, often for persistence or a backdoor account.