AppInit Dlls

These DLLs are loaded at process creation, and lives in the registry key at: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows\

Note that we need to set 2 registry keys, one to enable AppInit DLLs, and one registry key pointing to our persistence DLL.

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows\LoadAppInit_DLLs - 0x1
HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows\LoadAppInit_DLLs - 0x1
 
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\WindowsAppInit_DLLs
HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs

Note that this will only persist on executables that have user32.dll loaded since they implement loading AppInit Dlls from registry. Also note that you have many payloads running at once which is very noisy.