Parent processes

Child processes

Related files

This is a Windows system installed file with Windows File Protection (WFP) enabled.

winlogon.exe executes as a process under the SYSTEM account with extensive privileges (the system and the administrator accounts have the same file privileges) typically within the context of its parent svchost.exe (Host Process for Windows Services by Microsoft Corporation). This version is designed to run on Windows 7 and is compiled as a 64 bit program.

CPU
Total CPU:	0.00146241%	0.028634%
Kernel CPU:	0.00118260%	0.013761%
User CPU:	0.00027982%	0.014873%
Kernel CPU time:	490,897 ms/min	100,923,805ms/min
CPU cycles:	15,627/sec	17,470,203/sec
Memory
Private memory:	3.21 MB	21.59 MB
Private (maximum):	8.42 MB
Private (minimum):	4.5 MB
Non-paged memory:	3.21 MB	21.59 MB
Virtual memory:	55.29 MB	140.96 MB
Virtual memory (peak):	62.25 MB	169.69 MB
Working set:	5.62 MB	18.61 MB
Working set (peak):	10.54 MB	37.95 MB
Page faults:	5,376/min	2,039/min
I/O
I/O read transfer:	64 Bytes/sec	1.02 MB/min
I/O read operations:	1/sec	343/min
I/O write transfer:	0 Bytes/sec	274.99 KB/min
I/O write operations:	1/sec	227/min
I/O other transfer:	19 Bytes/sec	448.09 KB/min
I/O other operations:	4/sec	1,671/min
Resource allocations
Threads:	3	12
Handles:	118	600
GUI GDI count:	6	103
GUI GDI peak:	61	142
GUI USER peak:	19	71

ntdll.dll
Total CPU:	0.00205208%	0.272967%
Kernel CPU:	0.00110582%	0.107585%
User CPU:	0.00094626%	0.165382%
CPU cycles:	45,980/sec	5,741,424/sec
Memory:	1.66 MB	1.16 MB
winlogon.exe (main module)
Total CPU:	0.00070234%
Kernel CPU:	0.00063249%
User CPU:	0.00006985%
CPU cycles:	17,071/sec
Memory:	456 KB