Does it add a registry key to HKCU\Software\Microsoft\Windows\CurrentVersion\Run ?

If a network capture was inside, use Wireshark to follow TCP/HTTP streams.

Execute the contents in a sandbox (e.g., ANY.RUN or a Flare-VM) to observe the "Flow":

The first step is identifying the file type and checking for basic obfuscation.