File Version : 5.1.2600.2180 File Description : Windows NT Logon Application (winlogon.exe) File Path : C:\WINDOWS\system32\winlogon.exe Process ID : 0x36C (Heximal) 876 (Decimal) Connection origin : local initiated Protocol : TCP Local Address : 172.16.35.94 Local Port : 1107 Remote Name : Remote Address : 211.160.17.195 Remote Port : 80 (HTTP - World Wide Web) Ethernet packet details: Ethernet II (Packet Length: 80) Destination: 00-90-fb-03-05-43 Source: 00-32-1d-6c-3a-4b Type: IP (0x0800) Internet Protocol Version: 4 Header Length: 20 bytes Flags: .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset:0 Time to live: 128 Protocol: 0x6 (TCP - Transmission Control Protocol) Header checksum: 0xb33f (Correct) Source: 172.16.35.94 Destination: 211.160.17.195 Transmission Control Protocol (TCP) Source port: 1107 Destination port: 80 Sequence number: 3739174665 Acknowledgment number: 0 Header length: 32 Flags: 0... .... = Congestion Window Reduce (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...0 .... = Acknowledgment: Not set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..1. = Syn: Set .... ...0 = Fin: Not set Checksum: 0xc18f (Correct) Data (0 Bytes) Binary dump of the packet: 0000: 00 90 FB 03 05 43 00 32 : 1D 6C 3A 4B 08 00 45 00 | .....C.2.l:K..E. 0010: 00 34 06 3F 40 00 80 06 : 3F B3 AC 10 23 5E D3 A0 | .4.?@...?...#^.. 0020: 11 C3 04 53 00 50 DE DF : 47 09 00 00 00 00 80 02 | ...S.P..G....... 0030: FF FF 8F C1 00 00 02 04 : 05 AC 01 03 03 01 01 01 | ................ 0040: 04 02 45 45 50 46 41 44 : 42 44 44 44 44 44 48 43 | ..EEPFADBDDDDDHC