» logonsessions.exe
Overview
Analysis
File Details
Programs (1)
Downloads (1)

logonsessions.exe

Sysinternals LogonSessions

Microsoft Corporation

This is installed with Sysinternals Software. The file has been seen being downloaded from live.sysinternals.com.

File name:

logonsessions.exe

Publisher:

Sysinternals (signed by Microsoft Corporation)

Product:

Sysinternals LogonSessions

Description:

logonsessions

Version:

1.30

MD5:

28f3da40571b6db4879c893303c511f0

SHA-1:

defcf1fd5ee23d8945f25a5a50590e820b8f768d

SHA-256:

dde9c443e2139d26f5edae56ba293f992e5702b414821d518d5139911f1f52b0

Scanner detections:

0 / 68

Status:

Clean (as of last analysis)
Whitelisted (by digital signature)

Analysis date:

11/24/2024 12:32:53 AM UTC (today)

File size:

194.7 KB (199,328 bytes)

Product version:

1.30

Original file name:

logonsessions.exe

File type:

Executable application (Win32 EXE)

Language:

English (United States)

Common path:

C:\users\{user}\downloads\sysinternalssuite\logonsessions.exe

Digital Signature

Signed by:

Microsoft Corporation

Authority:

Microsoft Corporation

Valid from:

6/4/2015 12:42:45 PM

Valid to:

9/4/2016 12:42:45 PM

Subject:

CN=Microsoft Corporation, OU=MOPR, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

Issuer:

CN=Microsoft Code Signing PCA, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

Serial number:

330000010A2C79AED7797BA6AC00010000010A

File PE Metadata

Compilation timestamp:

7/20/2015 4:50:34 PM

OS version:

5.1

OS bitness:

Win32

Subsystem:

Windows Console

Linker version:

12.0

CTPH (ssdeep):

3072:jRpj238475KUbWqJSoxkjDKkkKfJyukEYcWKhgoLF4CxN:dpj2M/X82kabkEjWK/b

Entry address:

0x4C0C

Entry point:

E8, 7A, 84, 00, 00, E9, 7B, FE, FF, FF, 55, 8B, EC, 81, EC, 28, 03, 00, 00, A1, C0, E0, 41, 00, 33, C5, 89, 45, FC, 83, 7D, 08, FF, 57, 74, 09, FF, 75, 08, E8, 4A, 89, 00, 00, 59, 83, A5, E0, FC, FF, FF, 00, 8D, 85, E4, FC, FF, FF, 6A, 4C, 6A, 00, 50, E8, 80, EC, FF, FF, 8D, 85, E0, FC, FF, FF, 83, C4, 0C, 89, 85, D8, FC, FF, FF, 8D, 85, 30, FD, FF, FF, 89, 85, DC, FC, FF, FF, 89, 85, E0, FD, FF, FF, 89, 8D, DC, FD, FF, FF, 89, 95, D8, FD, FF, FF, 89, 9D, D4, FD, FF, FF, 89, B5, D0, FD, FF, FF, 89, BD, CC... 
[+]

Entropy:

6.5444

Code size:

77.5 KB (79,360 bytes)

The file logonsessions.exe has been discovered within the following program.

Sysinternals Software by Sysinternals - www.sysinternals.com

technet.microsoft.com/en-us/sysinternals/bb545027.aspx

4% remove it

The file logonsessions.exe has been seen being distributed by the following URL.

https://live.sysinternals.com/logonsessions.exe

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.