Reads ssh keys stored on the system

Tries to access SSH used by SSH programs.

Unsecured Credentials: Credentials In Files

Steal credentials from unsecured files.

Accesses cryptocurrency files/wallets, possible credential harvesting

Boot or Logon Autostart Execution: Active Setup

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

Enumerates connected drives

Attempts to read the root path of hard drives other than the default C: drive.

Checks computer location settings

Looks up country code configured in the registry, likely geofence.