Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SystemEventsBroker]
"DisplayName"="@%windir%\\system32\\SystemEventsBrokerServer.dll,-1001"
"ErrorControl"=dword:00000001
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,44,00,63,00,6f,00,6d,00,4c,00,61,00,75,00,6e,00,63,00,68,00,00,\
00
"Start"=dword:00000002
"Type"=dword:00000020
"Description"="@%windir%\\system32\\SystemEventsBrokerServer.dll,-1002"
"DependOnService"=hex(7):52,00,70,00,63,00,45,00,70,00,74,00,4d,00,61,00,70,00,\
70,00,65,00,72,00,00,00,52,00,70,00,63,00,53,00,73,00,00,00,00,00
"ObjectName"="LocalSystem"
"ServiceSidType"=dword:00000001
"RequiredPrivileges"=hex(7):53,00,65,00,43,00,72,00,65,00,61,00,74,00,65,00,47,\
00,6c,00,6f,00,62,00,61,00,6c,00,50,00,72,00,69,00,76,00,69,00,6c,00,65,00,\
67,00,65,00,00,00,53,00,65,00,49,00,6d,00,70,00,65,00,72,00,73,00,6f,00,6e,\
00,61,00,74,00,65,00,50,00,72,00,69,00,76,00,69,00,6c,00,65,00,67,00,65,00,\
00,00,53,00,65,00,54,00,63,00,62,00,50,00,72,00,69,00,76,00,69,00,6c,00,65,\
00,67,00,65,00,00,00,53,00,65,00,43,00,72,00,65,00,61,00,74,00,65,00,50,00,\
65,00,72,00,6d,00,61,00,6e,00,65,00,6e,00,74,00,50,00,72,00,69,00,76,00,69,\
00,6c,00,65,00,67,00,65,00,00,00,00,00
"FailureActions"=hex:80,51,01,00,00,00,00,00,00,00,00,00,03,00,00,00,14,00,00,\
00,02,00,00,00,c0,d4,01,00,02,00,00,00,c0,d4,01,00,02,00,00,00,c0,d4,01,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SystemEventsBroker\Parameters]
"ServiceDllUnloadOnStop"=dword:00000001
"ServiceDll"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,\
00,74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,\
53,00,79,00,73,00,74,00,65,00,6d,00,45,00,76,00,65,00,6e,00,74,00,73,00,42,\
00,72,00,6f,00,6b,00,65,00,72,00,53,00,65,00,72,00,76,00,65,00,72,00,2e,00,\
64,00,6c,00,6c,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SystemEventsBroker\Security]
"Security"=hex:01,00,14,80,90,00,00,00,9c,00,00,00,14,00,00,00,30,00,00,00,02,\
00,1c,00,01,00,00,00,02,80,14,00,ff,00,0f,00,01,01,00,00,00,00,00,01,00,00,\
00,00,02,00,60,00,04,00,00,00,00,00,14,00,85,00,02,00,01,01,00,00,00,00,00,\
05,0b,00,00,00,00,00,14,00,ff,00,0e,00,01,01,00,00,00,00,00,05,12,00,00,00,\
00,00,18,00,fd,00,0e,00,01,02,00,00,00,00,00,05,20,00,00,00,20,02,00,00,00,\
00,18,00,95,00,00,00,01,02,00,00,00,00,00,05,20,00,00,00,21,02,00,00,01,01,\
00,00,00,00,00,05,12,00,00,00,01,01,00,00,00,00,00,05,12,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SystemEventsBroker\TriggerInfo]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SystemEventsBroker\TriggerInfo\0]
"Type"=dword:00000006
"Action"=dword:00000001
"GUID"=hex:67,d1,90,bc,70,94,39,41,a9,ba,be,0b,bb,f5,b7,4d
"Data0"=hex:39,00,42,00,30,00,30,00,38,00,39,00,35,00,33,00,2d,00,46,00,31,00,\
39,00,35,00,2d,00,34,00,42,00,46,00,39,00,2d,00,42,00,44,00,45,00,30,00,2d,\
00,34,00,34,00,37,00,31,00,39,00,37,00,31,00,45,00,35,00,38,00,45,00,44,00,\
00,00
"DataType0"=dword:00000002
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SystemEventsBroker\TriggerInfo\1]
"Type"=dword:00000007
"Action"=dword:00000001
"GUID"=hex:16,28,7a,2d,5e,0c,fc,45,9c,e7,57,0e,5e,cd,e9,c9
"Data0"=hex:75,08,bc,a3,3e,06,83,0d
"DataType0"=dword:00000001