Winlogon has support for plugins that get loaded and notified about specific events and LSASS also supports plugins (security packages). Some rootkits bundle Winlogon plugins because they are loaded before any user logs in. Some keys allow multiple comma-separated values to be supplied that allow a malicious program to be executed at the same time as a legitimate system file. The hashing algorithms used to store credentials in the SAM database are weak and can be brute-forced quickly on consumer hardware.