Checks for common network interception software

Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.

Command and Scripting Interpreter: PowerShell

Run Powershell and hide display window.

Drops file in Drivers directory

Manipulates Digital Signatures

Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.