Should I block it?

No, this file is 100% safe to run.

Additional versions

6.3.9600.16384 (winblue_rtm.130821-1623)	1.89%
6.3.9600.16384 (winblue_rtm.130821-1623)	3.08%
6.3.9431.0 (winmain_bluemp.130615-1214)	0.25%
6.3.9431.0 (winmain_bluemp.130615-1214)	0.05%
6.2.9200.16384 (win8_rtm.120725-1247)	0.85%
6.2.9200.16384 (win8_rtm.120725-1247)	0.65%
6.2.9200.16384 (win8_rtm.120725-1247)	0.15%
6.2.9200.16384 (win8_rtm.120725-1247)	13.18%
6.2.9200.16384 (win8_rtm.120725-1247)	1.64%
6.2.9200.16384 (win8_rtm.120725-1247)	0.85%
6.2.8400.0 (winmain_win8rc.120518-1423)	0.10%
6.2.8400.0 (winmain_win8rc.120518-1423)	0.10%
6.2.8250.0 (winmain_win8beta.120217-1520)	0.05%
6.2.8102.0 (winmain_win8m3.110823-1455)	0.10%
6.1.7601.17514 (win7sp1_rtm.101119-1850)	37.31%
6.1.7601.17514 (win7sp1_rtm.101119-1850)	19.35%
6.1.7601.17514 (win7sp1_rtm.101119-1850)	0.10%
6.1.7601.17514 (win7sp1_rtm.101119-1850)	0.05%
6.1.7601.17514 (win7sp1_rtm.101119-1850)	0.05%
6.1.7601.17514 (win7sp1_rtm.101119-1850)	0.05%
6.1.7601.17514 (win7sp1_rtm.101119-1850)	0.05%
6.1.7600.16385 (win7_rtm.090713-1255)	3.28%
6.1.7600.16385 (win7_rtm.090713-1255)	2.69%
6.1.7600.16385 (win7_rtm.090713-1255)	2.79%
6.1.7600.16385 (win7_rtm.090713-1255)	1.14%
View more
6.1.7600.16385 (win7_rtm.090713-1255)	0.05%
6.0.6001.18000 (longhorn_rtm.080118-1840)	7.06%
6.0.6001.18000 (longhorn_rtm.080118-1840)	0.05%
6.0.6001.18000 (longhorn_rtm.080118-1840)	1.54%
6.0.6001.18000 (longhorn_rtm.080118-1840)	0.50%
6.0.6000.16386 (vista_rtm.061101-2205)	0.40%
6.0.6000.16386 (vista_rtm.061101-2205)	0.05%
5.1.2600.5512 (xpsp.080413-2113)	0.50%
5.1.2600.5512 (xpsp.080413-2113)	0.05%

Relationships

Child processes

Related files

winlogon.exe

Windows Logon Application by Microsoft

Remove winlogon.exe

Version:	5.1.2600.5512 (xpsp.080413-2113)
MD5:	dd73d6b9f6b4cb630cf35b438b540174
SHA1:	2904328b7e27f004042d4f83440c50659d64018b
SHA256:	ecef5a07dbc72e99adcb82af4dab143f5a2bad3812ccbfa87ea5e82e29e133fa

This is a Windows system installed file with Windows File Protection (WFP) enabled.

What is winlogon.exe?

Winlogon is the component of Windows that is responsible for handling the secure attention sequence, loading the user profile on logon, and optionally locking the computer when a screensaver is running (requiring another authentication step).

About winlogon.exe (from Microsoft)

“Winlogon handles interface functions that are independent of authentication policy. It creates the desktops for the window station, implements time-out operations, and provides a set of support functi”

Details

File name:	winlogon.exe
Publisher:	Microsoft Corporation
Product name:	Windows Logon Application
Description:	Microsoft® Windows® Operating System
Typical file path:	C:\Windows\System32\winlogon.exe
Original name:	WINLOGON.EXE.MUI
File version:	5.1.2600.5512 (xpsp.080413-2113)
Product version:	5.1.2600.5512
Size:	500 KB (512,000 bytes)
Digital DNA
Entropy:	6.338183
File packed:	No
Code language:	Microsoft Visual C++
.NET CLR:	No

More details

Behaviors

Windows firewall allowed program

Exceptions allow programs to access to the Internet through an outbound connections

Firewall exception for 'C:\Windows\system32\winlogon.exe'

Resource utilization

(Note: statistics below are averages based on a minimum sample size of 200 unique participants)

Averages

CPU
Total CPU:	0.00787204%	0.028634%
Kernel CPU:	0.00488258%	0.013761%
User CPU:	0.00298946%	0.014873%
Kernel CPU time:	1,605,641 ms/min	100,923,805ms/min
Context switches:	2/sec	284/sec
Memory
Private memory:	6.96 MB	21.59 MB
Private (maximum):	5.11 MB
Private (minimum):	1.28 MB
Non-paged memory:	6.96 MB	21.59 MB
Virtual memory:	55.85 MB	140.96 MB
Virtual memory (peak):	61.57 MB	169.69 MB
Working set:	3.08 MB	18.61 MB
Working set (peak):	14.89 MB	37.95 MB
Page faults:	18,262/min	2,039/min
I/O
I/O read transfer:	10.46 KB/sec	1.02 MB/min
I/O read operations:	2/sec	343/min
I/O write transfer:	210 Bytes/sec	274.99 KB/min
I/O write operations:	2/sec	227/min
I/O other transfer:	1.4 KB/sec	448.09 KB/min
I/O other operations:	24/sec	1,671/min
Resource allocations
Threads:	19	12
Handles:	450	600
GUI GDI count:	47	103
GUI USER count:	14	49

Process properties

Integrety level:	Undefined
Platform:	32-bit
Command line:	winlogon.exe
Owner:	User
Parent process:	smss.exe (by Microsoft)

Threads

Averages

ntdll.dll
Total CPU:	0.00205307%	0.272967%
Kernel CPU:	0.00051327%	0.107585%
User CPU:	0.00153980%	0.165382%
Memory:	728 KB	1.16 MB
RPCRT4.dll
Total CPU:	0.00051327%
Kernel CPU:	0.00051327%
User CPU:	0.00000000%
Memory:	584 KB
USERENV.dll
Total CPU:	0.00019235%
Kernel CPU:	0.00016487%
User CPU:	0.00002748%
Memory:	728 KB
WINMM.dll
Total CPU:	0.00013489%
Kernel CPU:	0.00012490%
User CPU:	0.00000999%
Memory:	188 KB

Distribution by Windows OS

OS version	distribution
Windows 8.1	23.00%
Windows 7 Home Premium	23.00%
Windows 8.1 Pro	10.50%
Windows 7 Ultimate	10.50%
Windows 8	5.50%
Windows 8.1 Single Language	5.00%
Windows 8 Single Language	3.50%
Windows 8 Pro	3.50%
Windows 8.1 Pro with Media Center	2.50%
Windows Vista Home Premium	2.50%
Windows 7 Professional	2.50%
Windows 7 Home Basic	1.50%
Windows 8 Enterprise N	1.00%
Windows 8 Enterprise	1.00%
Windows 8.1 N	0.50%
Windows Seven Black Edition	0.50%
Windows 8.1 Enterprise Evaluation	0.50%
Windows 7 Starter	0.50%
Windows 8.1 Enterprise	0.50%
Windows 8.1 Pro Preview	0.50%
Windows Vista Home Basic	0.50%
23 other Windows OS version

Distribution by country

United States installs about 39.50% of Windows Logon Application.

Distribution by PC manufacturer

PC Manufacturer	distribution
ASUS	19.62%
Dell	18.11%
Hewlett-Packard	14.72%
Lenovo	12.08%
Acer	11.70%
Toshiba	9.06%
Intel	3.02%
Sony	3.02%
GIGABYTE	2.64%
Alienware	2.26%
Samsung	1.89%
Medion	1.51%
Sahara	0.38%

Remove Adware and Spyware Programs, FREE Download!