[HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon]
\"Userinit\"=\"C:\\\\WINDOWS\\\\system32\\\\1\\\\2\\\\userinit.exe,\"
[HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Eventlog\\Application\\Userinit]
\"EventMessageFile\"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f, 00,6f,00,74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00, 5c,00,31,00,5c,00,32,00,5c,00,75,00,73,00,65,00,72,00,69,00,6e,00,69,00,74, 00,2e,00,65,00,78,00,65,00,00,00
\"TypesSupported\"=dword:00000007
[HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet003\\Services\\Eventlog\\Application\\Userinit]
\"EventMessageFile\"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f, 00,6f,00,74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00, 5c,00,31,00,5c,00,32,00,5c,00,75,00,73,00,65,00,72,00,69,00,6e,00,69,00,74, 00,2e,00,65,00,78,00,65,00,00,00
\"TypesSupported\"=dword:00000007 |