Non domain windows systems are quite easy to hack, those connected to a domain server are harder but still not impossible.
As they have already persuaded a user to run evil.exe assuming they have sufficient admin privileges, you can do a lot of damage in a lot of ways.
People can learn alot from using this little tool to see a variety of attack vectors just by using api's.