WinLogon事件通知包编程序，可以捕获windows启动,登陆,注销,锁定等一系列事件,您可以在此实现系统启动相关加载项，及其他功能。-WinLogon Event Notification Package program, and can capture the windows startup, login, log off, lock and a series of events, where you can start to achieve the system-related add

注入Winlogon 截取管理员密码 很好用 的-截取管理员密码

Winlogon hijacked record 3389 password small tools (open source code)