Differentiating between the real Winlogon and a virus can be tricky

as viruses can often mimic legitimate system processes. One way to identify the real Winlogon is by checking its file location