The “AdapterTroubleshooter.exe” file is a legitimate binary which is leveraged to use the famous DLL search order hijacking technique. Once loaded, the DLL will then inject FinSpy into the Winlogon process