Some very well known cracking/warez groups will add whatever you want to their 0-day releases if you pay them enough. However, I wonder why the perpetrators us

Some very well known cracking/warez groups will add whatever you want to their 0-day releases if you pay them enough. However, I wonder why the perpetrators used "winlogin.exe" as the malware executable file name instead of "winlogon.exe". If I remember correctly, Windows prevents you from killing any file named "winlogon.exe" from the Task Manager. Maybe to help prevent detection by heuristic anti-malware engines?