Executes a file named after a Windows system binary

The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

Executes dropped EXE

Registers new Windows logon scripts automatically executed at logon.

Accesses cryptocurrency files/wallets, possible credential harvesting

Enumerates connected drives

Attempts to read the root path of hard drives other than the default C: drive.

Suspicious use of SetThreadContext