While the file properties state the file is developed by 'Microsoft Corporation', this is not the case and it is designed just to look like a legitimate Microsoft system file. The application winlogon.exe has been detected as a potentially unwanted program by 28 anti-malware scanners. It is set to automatically execute when any user logs into Windows (through the local user run registry setting) with the name ‘winlogon’. While running, it connects to the Internet address s106.nnuu.net on port 80 using the HTTP protocol.