ElfFile[;ElfChnkAA8Gu-8`=f?mMFiO&** Ab/ E'b&E'bUa4UxLIDwEAM Eventjxmlns5http://schemas.microsoft.com/win/2004/08/events/eventoTSystemAY{Provider6F=KNameX)GuidAMzaEventID'X) Qualifiers " Version dLevelE{Task ?Opcode$fjKeywordsAP; TimeCreated'j<{ SystemTime .F EventRecordID A Correlation\FF ActivityIDmz5RelatedActivityID Am ExecutionHFF ProcessID9ThreadID "aChannel<F;nComputer FILF-APP-RECAB.SecurityfLUserID ! 8P! b/PCtA ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational ff6!yƒ8D EventDataA;`oData= LogonType A'`=TaskName @AppReadinessNotifyLogonComplete& **Bb/ E'b& 8P[! b/PCtB ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f@AppReadinessNotifyLogonComplete**C74 E'b& 8PE! 74PCtH C ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*ARSFirstRunTelemetry**D74 E'b& 8PE! 74PCtH D ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*ARSFirstRunTelemetry**EM E'b& 8P9!nqm MضuWO:*It E ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational &&| p)c8**xF E'b& 8P!nrm ضuWO:*It F ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational &x**G E'b& 8Pk!mm ضuWO:*It G ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational :R%:R%&Gm3}8A1`#= ItemsExisting A+`= ItemsAdded A/`!= ItemsRemoved A/`!= ItemsUpdated A-`= ItemsCached XYc**0Hj E'b& 8P!%% jضuWO:*ItH ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational 3"E>28A%`=KeyName \Software\Microsoft\Windows\CurrentVersion\Run0**HIj E'b& 8P!%% jضuWO:*ItI ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational _,ں_,ں # >28A%`=Command z"C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusroH**xJ E'b& 8P!%% ضuWO:*ItJ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational m. m.C HXOagbV8A`=PID A%`=Command z"C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusrx**K E'b& 8Po!%% ضuWO:*ItK ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational \Software\Microsoft\Windows\CurrentVersion\Run8**L E'b& 8Po!%% ضuWO:*ItL ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational \Software\Microsoft\Windows\CurrentVersion\Run&**M E'b& 8P!%% ضuWO:*ItM ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational _,ںv"C:\galaxie\deploy\Tomcat6\bin\Tomcat6w.exe" //MS//Tomcat6-W**NKl E'b& 8P!%% KlضuWO:*ItN ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational m. v"C:\galaxie\deploy\Tomcat6\bin\Tomcat6w.exe" //MS//Tomcat6-S**OKl E'b& 8Po!%% KlضuWO:*ItO ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational \Software\Microsoft\Windows\CurrentVersion\Run**PG+l E'b& 8Pw!%% G+lضuWO:*ItP ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational dSoftware\Microsoft\Windows\CurrentVersion\RunOnce0an**QG+l E'b& 8Pw!%% G+lضuWO:*ItQ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational dSoftware\Microsoft\Windows\CurrentVersion\RunOncefK(**RD^ E'b& 8P7! D^P R ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAllLogonTasks**SD^ E'b& 8PG! D^P S ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreDesktopSwitchTasks**TD^ E'b& 8P/! D^P T ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellPrepona**UD^ E'b& 8P/! D^P U ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellPrepona**VD^ E'b& 8PO! D^P V ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f4AppReadinessPreShellGroup**WD^ E'b& 8P5! D^P W ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fSkydrivePrep**XD^ E'b& 8P5! D^P X ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fSkydrivePrep**YD^ E'b& 8P+! D^P Y ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fRunOnce**ZD^ E'b& 8P+! D^P Z ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fRunOncet**[D^ E'b& 8P3! D^P [ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fActiveSetupl**\TD^ E'b& 8P3! TD^P \ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fActiveSetupo**]TD^ E'b& 8PC! TD^P ] ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f(WaitForMSAConnectedo**^TD^ E'b& 8PC! TD^P ^ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f(WaitForMSAConnectedS**_TD^ E'b& 8PG! TD^P _ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreConfigLauncherSyncs-S**`TD^ E'b& 8PG! TD^P ` ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreConfigLauncherSyncCor**aTD^ E'b& 8PG! TD^P a ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreDesktopSwitchTasksrat**bTD^ E'b& 8P;! TD^P b ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f PerUserServicest**cTD^ E'b& 8P;! TD^P c ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f PerUserServicest**dTD^ E'b& 8P7! TD^P d ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreShellTaskss-S**eTD^ E'b& 8PE! TD^P e ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*RoamingPayloads0and1ft-W**fTD^ E'b& 8PE! TD^P f ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*RoamingPayloads0and1ft-W**gTD^ E'b& 8PO! TD^P g ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f4AppReadinessPreShellGroupndo**hTD^ E'b& 8P3! TD^P h ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAppResolverW**iTD^ E'b& 8P!mm TD^P i ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational EYiO EYM~q; g&h\8A'`=Scenario A!`=Flags  msE**jTD^ E'b& 8P3! TD^ P j ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAppResolver**kTD^ E'b& 8P7! TD^ P k ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreShellTasksn\R**liD^ E'b& 8P9! iD^ P l ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellInitTasks**miD^ E'b& 8P9! iD^ P m ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellInitTasksdo**nujD^ E'b& 8P7! ujD^P n ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreStartTasks**oujD^ E'b& 8P;! ujD^P o ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload2r**pujD^ E'b& 8PI! ujD^P p ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f.AppReadinessLogonGroup\M**qujD^ E'b& 8P=! ujD^P q ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f"UpdatePCSettingserat**rujD^ E'b& 8P=! ujD^P r ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f"UpdatePCSettings|DQR**sujD^ E'b& 8P;! ujD^P s ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload2**tujD^ E'b& 8PI! ujD^P t ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f.AppReadinessLogonGroup**uujD^ E'b& 8P7! ujD^P u ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreStartTasks**vcD^ E'b& 8P7! cD^P v ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAllLogonTasks**wcD^ E'b& 8P;! cD^P w ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload3**xcD^ E'b& 8P;! cD^P x ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload3Z**yq(D^ E'b& 8P[! q(D^P y ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f@AppReadinessNotifyLogonComplete**zq(D^ E'b& 8P[! q(D^P z ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f@AppReadinessNotifyLogonComplete**{ZD^ E'b& 8PE! ZD^P { ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*ARSFirstRunTelemetry**|yOD^ E'b& 8PE! yOD^P | ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*ARSFirstRunTelemetry**x}I^ E'b& 8P!nqm I^EO@i@[:T0Q H} ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational &x**x~I^ E'b& 8P!nrm I^EO@i@[:T0Q H~ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational &˳x**J^ E'b& 8P7!mm J^EO@i@[:T0Q H ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational :R%XY'b&**vJ^ E'b& 8Po!%% vJ^EO@i@[:T0Q @ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational \Software\Microsoft\Windows\CurrentVersion\Run8**vJ^ E'b& 8P!%% vJ^EO@i@[:T0Q @ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational _,ںz"C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusri 2**qxJ^ E'b& 8P!%% qxJ^EO@i@[:T0Q @ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational m. z "C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusrroso**qxJ^ E'b& 8Po!%% qxJ^EO@i@[:T0Q @ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational \Software\Microsoft\Windows\CurrentVersion\Run/Op**qxJ^ E'b& 8Po!%% qxJ^EO@i@[:T0Q @ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational \Software\Microsoft\Windows\CurrentVersion\Run,**qxJ^ E'b& 8P!%% qxJ^EO@i@[:T0Q @ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational _,ںv"C:\galaxie\deploy\Tomcat6\bin\Tomcat6w.exe" //MS//Tomcat6***J^ E'b& 8P!%% J^EO@i@[:T0Q @ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational m. v"C:\galaxie\deploy\Tomcat6\bin\Tomcat6w.exe" //MS//Tomcat6**J^ E'b& 8Po!%% J^EO@i@[:T0Q @ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational \Software\Microsoft\Windows\CurrentVersion\RunK**J^ E'b& 8Pw!%% J^EO@i@[:T0Q @ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational dSoftware\Microsoft\Windows\CurrentVersion\RunOnceoso**J^ E'b& 8Pw!%% J^EO@i@[:T0Q @ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational dSoftware\Microsoft\Windows\CurrentVersion\RunOncen30'**Pq( E'b& 8P7! Pq(ZPI(8 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAllLogonTasksell**Pq( E'b& 8PG! Pq(ZPI(8 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreDesktopSwitchTaskss-S**Pq( E'b& 8P/! Pq(ZPI(8 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellPreps-S**Pq( E'b& 8P/! Pq(ZPI(8 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellPrepCor**Pq( E'b& 8PO! Pq(ZPI(8 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f4AppReadinessPreShellGrouposo**Pq( E'b& 8P5! Pq(ZPI(8 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fSkydrivePreproso**Pq( E'b& 8P5! Pq(ZPI(8 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fSkydrivePreproso**Pq( E'b& 8P+! Pq(ZPI(8 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fRunOnceR**dq( E'b& 8P+! dq(ZPI(8 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fRunOncer**dq( E'b& 8P3! dq(ZPI(8 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fActiveSetupl**t( E'b& 8P3! t(( JIs(8 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fActiveSetupW**t( E'b& 8PC! t(( JIs(8 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f(WaitForMSAConnectedW**t( E'b& 8PC! t(( JIs(8 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f(WaitForMSAConnectedW**t( E'b& 8PG! t(( JIs(8 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreConfigLauncherSyncs-S**t( E'b& 8PG! t(( JIs(8 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreConfigLauncherSyncs-S**t( E'b& 8PG! t(( JIs(8 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreDesktopSwitchTasksCor**t( E'b& 8P;! t(( JIs(8 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f PerUserServicesr**t( E'b& 8P;! t(( JIs(8 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f PerUserServicesr**t( E'b& 8P7! t(( JIs(8 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreShellTasksCor**t( E'b& 8PE! t(( JIs(8 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*RoamingPayloads0and1ws-S**t( E'b& 8PE! t(( JIs(8 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*RoamingPayloads0and1ft-W**t( E'b& 8PO! t(( JIs(8 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f4AppReadinessPreShellGroupndo**t( E'b& 8P3! t(( JIs(8 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAppResolverc**`+v( E'b& 8P!mm `+v(( JIs(8 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational EYiO t-W**w( E'b& 8P3! w('PI(8 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAppResolverr**w( E'b& 8P7! w('PI(8 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreShellTasksCor**28A%`=KeyName \Software\Microsoft\Windows\CurrentVersion\Runi 20**H.` E'b& 8P!%% .`:KJ%H ;V  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational _,ںB_,ں # >28A%`=Command z"C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusraH**xy E'b& 8P!%% y:KJ%H ;V  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational m.9Eim.C HXOagbV8A`=PID A%`=Command zx "C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusrPx**y E'b& 8Po!%% y:KJ%H ;V  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational @\Software\Microsoft\Windows\CurrentVersion\RunMic**y E'b& 8Po!%% y:KJ%H ;V  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational @\Software\Microsoft\Windows\CurrentVersion\Runell**y E'b& 8P!%% y:KJ%H ;V  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational _,ںBv"C:\galaxie\deploy\Tomcat6\bin\Tomcat6w.exe" //MS//Tomcat6-S**H E'b& 8P!%% HaJ8CaG'  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational m.9Ev "C:\galaxie\deploy\Tomcat6\bin\Tomcat6w.exe" //MS//Tomcat6**H E'b& 8Po!%% HaJ8CaG'  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational @\Software\Microsoft\Windows\CurrentVersion\Runnar**H E'b& 8Pw!%% HaJ8CaG'  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational @dSoftware\Microsoft\Windows\CurrentVersion\RunOncelve**H E'b& 8Pw!%% HaJ8CaG'  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational @dSoftware\Microsoft\Windows\CurrentVersion\RunOnce**?ڰ6B E'b& 8P7! ?ڰ6BPnB <  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAllLogonTasks**?ڰ6B E'b& 8PG! ?ڰ6BPnB <  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreDesktopSwitchTasks**?ڰ6B E'b& 8P/! ?ڰ6BPnB <  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellPrep**?ڰ6B E'b& 8P/! ?ڰ6BPnB <  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellPrep**?ڰ6B E'b& 8PO! ?ڰ6BPnB <  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f4AppReadinessPreShellGroup**?ڰ6B E'b& 8P5! ?ڰ6BPnB <  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fSkydrivePrep**?ڰ6B E'b& 8P5! ?ڰ6BPnB <  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fSkydrivePrep**?ڰ6B E'b& 8P+! ?ڰ6BPnB <  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fRunOnce**?ڰ6B E'b& 8P+! ?ڰ6BPnB <  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fRunOnce**?ڰ6B E'b& 8P3! ?ڰ6BPnB <  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fActiveSetup**<6B E'b& 8P3! <6BPnB <  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fActiveSetupa**<6B E'b& 8PC! <6BPnB <  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f(WaitForMSAConnectedd** <6B E'b& 8PC! <6BPnB <  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f(WaitForMSAConnectedZ** <6B E'b& 8PG! <6BPnB <  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreConfigLauncherSyncCom** <6B E'b& 8PG! <6BPnB <  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreConfigLauncherSyncify** <6B E'b& 8PG! <6BPnB <  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreDesktopSwitchTaskstRu** <6B E'b& 8P;! <6BPnB <  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f PerUserServicesR**<6B E'b& 8P;! <6BPnB <  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f PerUserServices**<6B E'b& 8P7! <6BPnB <  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreShellTasks**<6B E'b& 8PE! <6BPnB <  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*RoamingPayloads0and1**<6B E'b& 8PE! <6BPnB <  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*RoamingPayloads0and1****<6B E'b& 8PO! <6BPnB <  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f4AppReadinessPreShellGroupls\**<6B E'b& 8P3! <6BPnB <  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAppResolvera**6B E'b& 8P!mm 6BPnB <  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational EYi ndo**6B E'b& 8P3! 6BPnB <  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAppResolver**6B E'b& 8P7! 6BPnB <  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreShellTasksP**6B E'b& 8P9! 6BPnB  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellInitTasks**6B E'b& 8P9! 6BPnB  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellInitTasksom**}7B E'b& 8P7! }7BPnB  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreStartTasks **}7B E'b& 8P;! }7BPnB  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload2o**}7B E'b& 8PI! }7BPnB  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f.AppReadinessLogonGroupor**}7B E'b& 8P=! }7BPnB  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f"UpdatePCSettingsi 2**}7B E'b& 8P=! }7BPnB  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f"UpdatePCSettingsMic**}7B E'b& 8P;! }7BPnB  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload2**}7B E'b& 8PI! }7BPnB  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f.AppReadinessLogonGroupso** }7B E'b& 8P7! }7BPnB  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreStartTaskst-W**!F7B E'b& 8P7! F7BPnB ! ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAllLogonTasks 2**"F7B E'b& 8P;! F7BPnB T" ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload3**#F7B E'b& 8P;! F7BPnB T# ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload3**$F7B E'b& 8P[! F7BPnB 0$ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f@AppReadinessNotifyLogonCompletel**%F7B E'b& 8P[! F7BPnB 0% ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f@AppReadinessNotifyLogonCompleteW**&F7B E'b& 8PE! F7BPnB & ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*ARSFirstRunTelemetryhell**'F7B E'b& 8PE! F7BPnB ' ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*ARSFirstRunTelemetryerat**x(vh \( ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational &:t-Wx**x) \) ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational &:ellx*** \* ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational :R%=XYndo**+:,=B E'b& 8Po!%% :,=BeLHNzre^ + ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational @\Software\Microsoft\Windows\CurrentVersion\RunQR**,:,=B E'b& 8P!%% :,=BeLHNzre^ , ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational _,ںBz"C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusrerat**-=B E'b& 8P!%% =BeLHNzre^ - ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational m.9Ez( "C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusrt**.=B E'b& 8Po!%% =BeLHNzre^ . ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational @\Software\Microsoft\Windows\CurrentVersion\Run**/=B E'b& 8Po!%% =BeLHNzre^ / ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational @\Software\Microsoft\Windows\CurrentVersion\Run!**0=B E'b& 8P!%% =BeLHNzre^ 0 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational _,ںBv"C:\galaxie\deploy\Tomcat6\bin\Tomcat6w.exe" //MS//Tomcat6**1( >B E'b& 8P!%% ( >BeLHNzre^ 1 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational m.9Ev"C:\galaxie\deploy\Tomcat6\bin\Tomcat6w.exe" //MS//Tomcat6ll**2( >B E'b& 8Po!%% ( >BeLHNzre^ 2 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational @\Software\Microsoft\Windows\CurrentVersion\Runs-S**3O >B E'b& 8Pw!%% O >BeLHNzre^ 3 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational @dSoftware\Microsoft\Windows\CurrentVersion\RunOncelve**4O >B E'b& 8Pw!%% O >BeLHNzre^ 4 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational @dSoftware\Microsoft\Windows\CurrentVersion\RunOnce**5gQ  E'b& 8P7! gQ oP8 ( 5 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAllLogonTasks**6gQ  E'b& 8PG! gQ oP8 ( 6 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreDesktopSwitchTasks**7gQ  E'b& 8P/! gQ oP8 ( 7 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellPrep**8gQ  E'b& 8P/! gQ oP8 ( 8 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellPrep**9gQ  E'b& 8PO! gQ oP8 ( 9 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f4AppReadinessPreShellGroup**:gQ  E'b& 8P5! gQ oP8 ( : ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fSkydrivePrep**;gQ  E'b& 8P5! gQ oP8 ( ; ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fSkydrivePrep**<gQ  E'b& 8P+! gQ oP8 ( < ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fRunOnce**={  E'b& 8P+! { oP8 ( = ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fRunOnce**>{  E'b& 8P3! { oP8 ( > ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fActiveSetup**?  E'b& 8P3!  ?` /K+8 ( ? ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fActiveSetupa**@  E'b& 8PC!  ?` /K+8 ( @ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f(WaitForMSAConnectedd**A  E'b& 8PC!  ?` /K+8 ( A ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f(WaitForMSAConnected**B  E'b& 8PG!  ?` /K+8 ( B ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreConfigLauncherSyncCom**C  E'b& 8PG!  ?` /K+8 ( C ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreConfigLauncherSyncify**D  E'b& 8PG!  ?` /K+8 ( D ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreDesktopSwitchTaskstRu**E  E'b& 8P;!  ?` /K+8 ( E ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f PerUserServicesR**F  E'b& 8P;!  ?` /K+8 ( F ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f PerUserServices**G  E'b& 8P7!  ?` /K+8 ( G ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreShellTasks**H  E'b& 8PE!  ?` /K+8 ( H ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*RoamingPayloads0and1**I  E'b& 8PE!  ?` /K+8 ( I ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*RoamingPayloads0and1****J  E'b& 8PO!  ?` /K+8 ( J ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f4AppReadinessPreShellGroupls\**K  E'b& 8P3!  ?` /K+8 ( K ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAppResolvera**L  E'b& 8P!mm  ?` /K+8 ( L ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational EYi ndo**M(x  E'b& 8P3! (x P8 ( M ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAppResolver**N(x  E'b& 8P7! (x P8 ( N ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreShellTasksP**O(x  E'b& 8P9! (x P8 PO ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellInitTasks**P(x  E'b& 8P9! (x P8 PP ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellInitTasksom**Q  E'b& 8P7! P8 PQ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreStartTasks **R  E'b& 8P;! P8 PR ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload2o**S  E'b& 8PI! P8 PS ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f.AppReadinessLogonGroupor**T  E'b& 8P=! P8 PT ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f"UpdatePCSettingsi 2**U  E'b& 8P=! P8 PU ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f"UpdatePCSettingshell**V  E'b& 8P;! P8 PV ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload2o**W  E'b& 8PI! P8 PW ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f.AppReadinessLogonGroupdo**X  E'b& 8P7! P8 PX ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreStartTasksndo**Y#Z  E'b& 8P7! #Z P8 PY ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAllLogonTasksoso**Z#Z  E'b& 8P;! #Z P8 lZ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload3W**[#Z  E'b& 8P;! #Z P8 l[ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload3o**\#Z  E'b& 8P[! #Z P8 \ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f@AppReadinessNotifyLogonCompleteS**]#Z  E'b& 8P[! #Z P8 ] ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f@AppReadinessNotifyLogonCompletet**^#Z  E'b& 8PE! #Z P8 ^ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*ARSFirstRunTelemetryl f**_#Z  E'b& 8PE! #Z P8 _ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*ARSFirstRunTelemetrynOnc**x` E'b& 8P!nqm 8f\NO+h-P8 ` ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational &:x**xa E'b& 8P!nrm 8f\NO+h-P8 a ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational &:/Opx**bo E'b& 8P7!mm o8f\NO+h-P8 b ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational :R%=XYrat**cَ E'b& 8Po!%% َCG'tAPJ-8 c ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational @\Software\Microsoft\Windows\CurrentVersion\RuntFoSAConnected E'b& 8P 8Ppational f E'b& 8PPreShellTasksffElfChnkdd0@TO1Pw8`=f?mMF@ &9bQe** d E'b&E'bUa4UxLIDwEAM Eventjxmlns5http://schemas.microsoft.com/win/2004/08/events/eventoTSystemAY{Provider6F=KNameX)GuidAMzaEventID'X) Qualifiers " Version dLevelE{Task ?Opcode$fjKeywordsAP; TimeCreated'j<{ SystemTime .F EventRecordID A Correlation\FF ActivityIDmz5RelatedActivityID Am ExecutionHFF ProcessID9ThreadID "aChannel<F;nComputer FILF-APP-RECAB.SecurityfLUserID ! 8P!%% CG'tAPJ-8 d ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational _,ں_,ں # l`8D EventDataA7`oData=Command z"C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusr **xew E'b& 8P!%% wCG'tAPJ-8 e ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational m. m.C HXOagbV8A`=PID A%`=Command z"C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusrosox**0fw E'b& 8P!%% wCG'tAPJ-8 f ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational  3"E>28A%`=KeyName \Software\Microsoft\Windows\CurrentVersion\Runerat0**gw E'b& 8Po!%% wCG'tAPJ-8 g ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational  \Software\Microsoft\Windows\CurrentVersion\RunSer**hw E'b& 8P!%% wCG'tAPJ-8 h ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational _,ںv"C:\galaxie\deploy\Tomcat6\bin\Tomcat6w.exe" //MS//Tomcat6**i; E'b& 8P!%% ;CG'tAPJ-8 i ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational m. v"C:\galaxie\deploy\Tomcat6\bin\Tomcat6w.exe" //MS//Tomcat6 L**j; E'b& 8Po!%% ;CG'tAPJ-8 j ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational  \Software\Microsoft\Windows\CurrentVersion\Run**k< E'b& 8Pw!%% <CG'tAPJ-8 k ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational  dSoftware\Microsoft\Windows\CurrentVersion\RunOnceoso**l< E'b& 8Pw!%% <CG'tAPJ-8 l ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational  dSoftware\Microsoft\Windows\CurrentVersion\RunOnceoso**(m]* E'b& 8P! ]*P1X m ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational ff6!yƒpd8A)`= LogonType A'`=TaskName AllLogonTasksell(**n]* E'b& 8PG! ]*P1X n ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreDesktopSwitchTasksrat**o]* E'b& 8P/! ]*P1X o ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellPrep/Op**p]* E'b& 8P/! ]*P1X p ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellPrepCor**q]* E'b& 8PO! ]*P1X q ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f4AppReadinessPreShellGroupona**r]* E'b& 8P5! ]*P1X r ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fSkydrivePrepiona**s]* E'b& 8P5! ]*P1X s ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fSkydrivePrepiona**t]* E'b& 8P+! ]*P1X t ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fRunOncel**u;* E'b& 8P+! ;*P1X u ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fRunOnceW**v;* E'b& 8P3! ;*P1X v ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fActiveSetupc**w1, E'b& 8P3! 1,P1X w ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fActiveSetupR**x1, E'b& 8PC! 1,P1X x ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f(WaitForMSAConnected'**y1, E'b& 8PC! 1,P1X y ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f(WaitForMSAConnectedR**z1, E'b& 8PG! 1,P1X z ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreConfigLauncherSyncoso**{1, E'b& 8PG! 1,P1X { ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreConfigLauncherSyncndo**|1, E'b& 8PG! 1,P1X | ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreDesktopSwitchTasksell**}1, E'b& 8P;! 1,P1X } ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f PerUserServiceso**~1, E'b& 8P;! 1,P1X ~ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f PerUserServicesr**1, E'b& 8P7! 1,P1X  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreShellTaskss-S**1, E'b& 8PE! 1,P1X  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*RoamingPayloads0and1ws-S**X, E'b& 8PE! X,P1X  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*RoamingPayloads0and1-Cor**X, E'b& 8PO! X,P1X  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f4AppReadinessPreShellGroupell**X, E'b& 8P3! X,P1X  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAppResolver**[C- E'b& 8P!mm [C-P1X  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational EY@ EYM~q; g&h\8A'`=Scenario A!`=Flags  ntV**K- E'b& 8P3! K- P1X  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAppResolverΘ**K- E'b& 8P7! K- P1X  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreShellTasksMic**[- E'b& 8P9! [- P1X  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellInitTasksr**[- E'b& 8P9! [- P1X  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellInitTasksft**  E'b& 8P7! P1X  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreStartTasksona**  E'b& 8P;! P1X  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload2W**  E'b& 8PI! P1X  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f.AppReadinessLogonGroupdo**  E'b& 8P=! P1X  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f"UpdatePCSettingsJ8Ca**  E'b& 8P=! P1X  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f"UpdatePCSettings8**  E'b& 8P;! P1X  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload2**  E'b& 8PI! P1X  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f.AppReadinessLogonGroupe**  E'b& 8P7! P1X  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreStartTasksks**)e E'b& 8P7! )eP1X  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAllLogonTaskswit**)e E'b& 8P;! )eP1X $  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload3P**)e E'b& 8P;! )eP1X $  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload3**9 E'b& 8P[! 9P1X  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f@AppReadinessNotifyLogonComplete**9 E'b& 8P[! 9P1X  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f@AppReadinessNotifyLogonComplete**9 E'b& 8PE! 9P1X  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*ARSFirstRunTelemetry**-a E'b& 8PE! -aP1X  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*ARSFirstRunTelemetry**%$ E'b& 8P9!nqm %$-a MGF@1\öX  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational &9b&| p)c8**x( E'b& 8P!nrm (-a MGF@1\öX  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational &9bx**~^. E'b& 8Pk!mm ~^.-a MGF@1\öX  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational :R%Qe:R%&Gm3}8A1`#= ItemsExisting A+`= ItemsAdded A/`!= ItemsRemoved A/`!= ItemsUpdated A-`= ItemsCached XY**襤 E'b& 8Po!%% 襤-a MGF@1\öX p ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational  \Software\Microsoft\Windows\CurrentVersion\RunZ**襤 E'b& 8P!%% 襤-a MGF@1\öX p ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational _,ںz"C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusr** E'b& 8P!%% -a MGF@1\öX p ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational m. z<"C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusrP** E'b& 8Po!%% -a MGF@1\öX p ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational  \Software\Microsoft\Windows\CurrentVersion\Run ذĤ** E'b& 8Po!%% -a MGF@1\öX p ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational  \Software\Microsoft\Windows\CurrentVersion\Runell** E'b& 8P!%% -a MGF@1\öX p ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational _,ںv"C:\galaxie\deploy\Tomcat6\bin\Tomcat6w.exe" //MS//Tomcat6or** E'b& 8P!%% @3otSKY}NX p ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational m. vD"C:\galaxie\deploy\Tomcat6\bin\Tomcat6w.exe" //MS//Tomcat6an** E'b& 8Po!%% @3otSKY}NX p ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational  \Software\Microsoft\Windows\CurrentVersion\Run<6**% E'b& 8Pw!%% %@3otSKY}NX p ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational  dSoftware\Microsoft\Windows\CurrentVersion\RunOnce**% E'b& 8Pw!%% %@3otSKY}NX p ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational  dSoftware\Microsoft\Windows\CurrentVersion\RunOnce **{| E'b& 8P7! {|PL  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAllLogonTasks **{| E'b& 8PG! {|PL  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreDesktopSwitchTasks**[~| E'b& 8P/! [~|PL  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellPrep**[~| E'b& 8P/! [~|PL  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellPrep **[~| E'b& 8PO! [~|PL  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f4AppReadinessPreShellGroup ذĤ**[~| E'b& 8P5! [~|PL  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fSkydrivePrep ذĤ**[~| E'b& 8P5! [~|PL  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fSkydrivePrep ذĤ**[~| E'b& 8P+! [~|PL  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fRunOnce **[~| E'b& 8P+! [~|PL  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fRunOnce**[~| E'b& 8P3! [~|PL  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fActiveSetup**~| E'b& 8P3! ~|PL  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fActiveSetup**~| E'b& 8PC! ~|PL  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f(WaitForMSAConnected**~| E'b& 8PC! ~|PL  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f(WaitForMSAConnected**~| E'b& 8PG! ~|PL  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreConfigLauncherSync**~| E'b& 8PG! ~|PL  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreConfigLauncherSync**~| E'b& 8PG! ~|PL  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreDesktopSwitchTasks **~| E'b& 8P;! ~|PL  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f PerUserServices**~| E'b& 8P;! ~|PL  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f PerUserServices**~| E'b& 8P7! ~|PL  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreShellTasks**~| E'b& 8PE! ~|PL  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*RoamingPayloads0and1**~| E'b& 8PE! ~|PL  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*RoamingPayloads0and1 **~| E'b& 8PO! ~|PL  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f4AppReadinessPreShellGroup 2**~| E'b& 8P3! ~|PL  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAppResolver**~| E'b& 8P!mm ~|PL  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational EY@ P**~| E'b& 8P3! ~|PL  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAppResolver**~| E'b& 8P7! ~|PL  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreShellTaskse\V**~| E'b& 8P9! ~|PL 0 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellInitTasksOp**~| E'b& 8P9! ~|PL 0 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellInitTasksic**| E'b& 8P7! | PL 0 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreStartTaskst-W**| E'b& 8P;! | PL 0 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload2**| E'b& 8PI! | PL 0 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f.AppReadinessLogonGroup**| E'b& 8P=! | PL 0 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f"UpdatePCSettingsO >**| E'b& 8P=! | PL 0 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f"UpdatePCSettingsVers**| E'b& 8P;! | PL 0 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload2a**| E'b& 8PI! | PL 0 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f.AppReadinessLogonGroupOp**| E'b& 8P7! | PL 0 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreStartTasks/Op**U| E'b& 8P7! U| PL 0 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAllLogonTasksell**U| E'b& 8P;! U| PL  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload3r**U| E'b& 8P;! U| PL  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload3p**<} E'b& 8P[! <} PL  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f@AppReadinessNotifyLogonCompletet**<} E'b& 8P[! <} PL  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f@AppReadinessNotifyLogonComplete**Y} E'b& 8PE! Y} PL  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*ARSFirstRunTelemetrynOnc**c} E'b& 8PE! c} PL  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*ARSFirstRunTelemetry{ **x_v E'b& 8P!nqm _v:oH.ZSL  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational &9betux**x{ E'b& 8P!nrm {:oH.ZSL  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational &9bx**K E'b& 8P7!mm K:oH.ZSL  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational :R%QeXY(**f E'b& 8Po!%% f:oH.ZSL `  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational  \Software\Microsoft\Windows\CurrentVersion\Run**f E'b& 8P!%% f:oH.ZSL `  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational _,ںz"C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusr** E'b& 8P!%% :oH.ZSL `  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational m. zD "C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusr/K** E'b& 8Po!%% :oH.ZSL `  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational  \Software\Microsoft\Windows\CurrentVersion\Run ذĤ** E'b& 8Po!%% :oH.ZSL `  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational  \Software\Microsoft\Windows\CurrentVersion\Runell** E'b& 8P!%% :oH.ZSL `  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational _,ںv"C:\galaxie\deploy\Tomcat6\bin\Tomcat6w.exe" //MS//Tomcat6or**X E'b& 8P!%% X&|L)`~L `  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational m. v"C:\galaxie\deploy\Tomcat6\bin\Tomcat6w.exe" //MS//Tomcat6an**X E'b& 8Po!%% X&|L)`~L `  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational  \Software\Microsoft\Windows\CurrentVersion\Run **/X E'b& 8Pw!%% /X&|L)`~L `  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational  dSoftware\Microsoft\Windows\CurrentVersion\RunOnce**/X E'b& 8Pw!%% /X&|L)`~L `  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational  dSoftware\Microsoft\Windows\CurrentVersion\RunOnce **~˪4 E'b& 8P7! ~˪4 L KV4\` ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAllLogonTasks8 **~˪4 E'b& 8PG! ~˪4 L KV4\` ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreDesktopSwitchTasks**~˪4 E'b& 8P/! ~˪4 L KV4\` ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellPrep**~˪4 E'b& 8P/! ~˪4 L KV4\` ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellPrepP**~˪4 E'b& 8PO! ~˪4 L KV4\` ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f4AppReadinessPreShellGroup ذĤ**~˪4 E'b& 8P5! ~˪4 L KV4\` ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fSkydrivePrep ذĤ**~˪4 E'b& 8P5! ~˪4 L KV4\` ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fSkydrivePrep ذĤ**~˪4 E'b& 8P+! ~˪4 L KV4\` ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fRunOnce **~˪4 E'b& 8P+! ~˪4 L KV4\` ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fRunOnce**~˪4 E'b& 8P3! ~˪4 L KV4\` ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fActiveSetup**4{4 E'b& 8P3! 4{4 L KV4\` ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fActiveSetup**4{4 E'b& 8PC! 4{4 L KV4\` ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f(WaitForMSAConnected**4{4 E'b& 8PC! 4{4 L KV4\` ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f(WaitForMSAConnected**4{4 E'b& 8PG! 4{4 L KV4\` ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreConfigLauncherSync**4{4 E'b& 8PG! 4{4 L KV4\` ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreConfigLauncherSync**4{4 E'b& 8PG! 4{4 L KV4\` ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreDesktopSwitchTasks8 **4{4 E'b& 8P;! 4{4 L KV4\` ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f PerUserServices**4{4 E'b& 8P;! 4{4 L KV4\` ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f PerUserServices**4{4 E'b& 8P7! 4{4 L KV4\` ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreShellTasks**4{4 E'b& 8PE! 4{4 L KV4\` ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*RoamingPayloads0and1**O4 E'b& 8PE! O4 L KV4\` ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*RoamingPayloads0and1 **O4 E'b& 8PO! O4 L KV4\` ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f4AppReadinessPreShellGroup 2**O4 E'b& 8P3! O4 L KV4\` ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAppResolver**cǬ4 E'b& 8P!mm cǬ4 L KV4\` ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational EY@ P 8 E'b& 8P 8PPreShellTasksffElfChnkPci絪8`=f?mMF d.I0&1(I+**cǬ4 E'b&E'bUa4UxLIDwEAM Eventjxmlns5http://schemas.microsoft.com/win/2004/08/events/eventoTSystemAY{Provider6F=KNameX)GuidAMzaEventID'X) Qualifiers " Version dLevelE{Task ?Opcode$fjKeywordsAP; TimeCreated'j<{ SystemTime .F EventRecordID A Correlation\FF ActivityIDmz5RelatedActivityID Am ExecutionHFF ProcessID9ThreadID "aChannel<F;nComputer FILF-APP-RECAB.SecurityfLUserID ! 8P! cǬ4 L KV4\` ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational ff6!yƒ8D EventDataA;`oData= LogonType A'`=TaskName AppResolverol**cǬ4 E'b& 8P7! cǬ4 L KV4\` ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreShellTasksm.C **w4 E'b& 8P9! w4 L KV4\ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellInitTasks8 **w4 E'b& 8P9! w4 L KV4\ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellInitTasks**a4 E'b& 8P7! a4 L KV4\ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreStartTasksCur**a4 E'b& 8P;! a4 L KV4\ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload2C**a4 E'b& 8PI! a4 L KV4\ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f.AppReadinessLogonGroup-S**a4 E'b& 8P=! a4 L KV4\ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f"UpdatePCSettingsindo**a4 E'b& 8P=! a4 L KV4\ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f"UpdatePCSettings**a4 E'b& 8P;! a4 L KV4\ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload2**a4 E'b& 8PI! a4 L KV4\ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f.AppReadinessLogonGroup**a4 E'b& 8P7! a4 L KV4\ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreStartTaskskNa**^5 E'b& 8P7! ^5 L KV4\ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAllLogonTasksona**^5 E'b& 8P;! ^5 L KV4\ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload3p**^5 E'b& 8P;! ^5 L KV4\ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload3t**5 E'b& 8P[! 5 L KV4\\ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f@AppReadinessNotifyLogonCompletep**5 E'b& 8P[! 5 L KV4\\ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f@AppReadinessNotifyLogonCompletei**5 E'b& 8PE! 5 L KV4\ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*ARSFirstRunTelemetryep**5 E'b& 8PE! 5 L KV4\ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*ARSFirstRunTelemetry;***3: E'b& 8P9!nqm 3: L KV4\x ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational &1(&| p)c8&**x ̥: E'b& 8P!nrm ̥: L KV4\x  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational &1(**x** Wh: E'b& 8Pk!mm Wh: L KV4\x  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational :R%I+:R%&Gm3}8A1`#= ItemsExisting A+`= ItemsAdded A/`!= ItemsRemoved A/`!= ItemsUpdated A-`= ItemsCached YYl**0 ,; E'b& 8P!%% ,; L KV4\  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational .3"E>28A%`=KeyName \Software\Microsoft\Windows\CurrentVersion\Run0**H ,; E'b& 8P!%% ,; L KV4\  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational _,ںI0_,ں # >28A%`=Command z"C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusrH**x ; E'b& 8P!%% ; L KV4\  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational m.2m.C HXOagbV8A`=PID A%`=Command z,"C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusrPrx**; E'b& 8Po!%% ; L KV4\ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational .\Software\Microsoft\Windows\CurrentVersion\Run****; E'b& 8Po!%% ; L KV4\ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational .\Software\Microsoft\Windows\CurrentVersion\Run**; E'b& 8Po!%% ; L KV4\ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational .\Software\Microsoft\Windows\CurrentVersion\Run!**F; E'b& 8Pw!%% F; L KV4\ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational .dSoftware\Microsoft\Windows\CurrentVersion\RunOnce **F; E'b& 8Pw!%% F; L KV4\ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational .dSoftware\Microsoft\Windows\CurrentVersion\RunOnceoso**Hٹ E'b& 8P7! Hٹ_P|k ` ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAllLogonTasks ذĤ**Hٹ E'b& 8PG! Hٹ_P|k ` ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreDesktopSwitchTasksoso**Hٹ E'b& 8P/! Hٹ_P|k ` ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellPrep8**Hٹ E'b& 8P/! Hٹ_P|k ` ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellPrep8**Hٹ E'b& 8PO! Hٹ_P|k ` ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f4AppReadinessPreShellGroup**Hٹ E'b& 8P5! Hٹ_P|k ` ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fSkydrivePrep**Hٹ E'b& 8P5! Hٹ_P|k ` ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fSkydrivePrep**Hٹ E'b& 8P+! Hٹ_P|k ` ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fRunOnce**Hٹ E'b& 8P+! Hٹ_P|k ` ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fRunOnce**Hٹ E'b& 8P3! Hٹ_P|k ` ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fActiveSetup**Hٹ E'b& 8P3! Hٹ_P|k ` ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fActiveSetup**Hٹ E'b& 8PC! Hٹ_P|k ` ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f(WaitForMSAConnected**Hٹ E'b& 8PC! Hٹ_P|k ` ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f(WaitForMSAConnected** Hٹ E'b& 8PG! Hٹ_P|k `  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreConfigLauncherSync**!Hٹ E'b& 8PG! Hٹ_P|k `! ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreConfigLauncherSync**"Hٹ E'b& 8PG! Hٹ_P|k `" ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreDesktopSwitchTasks**#Hٹ E'b& 8P;! Hٹ_P|k `# ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f PerUserServices**$Hٹ E'b& 8P;! Hٹ_P|k `$ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f PerUserServices**%Hٹ E'b& 8P7! Hٹ_P|k `% ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreShellTasks**&Hٹ E'b& 8PE! Hٹ_P|k `& ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*RoamingPayloads0and1**'۹ E'b& 8PE! ۹_P|k `' ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*RoamingPayloads0and1**(۹ E'b& 8PO! ۹_P|k `( ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f4AppReadinessPreShellGroup**)۹ E'b& 8P3! ۹_P|k `) ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAppResolver***۹ E'b& 8P!mm ۹_P|k `* ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational EY d2EYM~q; g&h\8A'`=Scenario A!`=Flags   ذĤ**+۹ E'b& 8P3! ۹ kP|k `+ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAppResolverU**,۹ E'b& 8P7! ۹ kP|k `, ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreShellTaskst-W**-۹ E'b& 8P9! ۹ kP|k L- ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellInitTasks-S**.۹ E'b& 8P9! ۹ kP|k L. ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellInitTasksF@**/|o E'b& 8P7! |o P|k L/ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreStartTasks**0|o E'b& 8P;! |o P|k L0 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload2**1|o E'b& 8PI! |o P|k L1 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f.AppReadinessLogonGroupur**2|o E'b& 8P=! |o P|k L2 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f"UpdatePCSettings:\ga**3|o E'b& 8P=! |o P|k L3 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f"UpdatePCSettingsws-S**4|o E'b& 8P;! |o P|k L4 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload2W**5|o E'b& 8PI! |o P|k L5 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f.AppReadinessLogonGroup**6|o E'b& 8P7! |o P|k L6 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreStartTasks!**7, E'b& 8P7! , P|k L7 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAllLogonTasks**8, E'b& 8P;! , P|k x8 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload3**9, E'b& 8P;! , P|k x9 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload3**:}ѿ E'b& 8P!nqm }ѿP|k > ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational &1(x**x?Qֿ E'b& 8P!nrm QֿP|k ? ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational &1(x**@ ߿ E'b& 8P7!mm ߿P|k @ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational :R%I+XY**A E'b& 8Po!%% H?CBWyb A ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational .\Software\Microsoft\Windows\CurrentVersion\Run**B E'b& 8P!%% H?CBWyb B ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational _,ںI0z"C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusrws-S**Cކ E'b& 8P!%% ކH?CBWyb C ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational m.2z"C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusr-Cor**Dކ E'b& 8Po!%% ކH?CBWyb D ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational .\Software\Microsoft\Windows\CurrentVersion\Run,**Eކ E'b& 8Po!%% ކH?CBWyb E ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational .\Software\Microsoft\Windows\CurrentVersion\RunerS**Fކ E'b& 8P!%% ކH?CBWyb F ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational _,ںI0v"C:\galaxie\deploy\Tomcat6\bin\Tomcat6w.exe" //MS//Tomcat6**GI_ E'b& 8P!%% I_H?CBWyb G ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational m.2vL "C:\galaxie\deploy\Tomcat6\bin\Tomcat6w.exe" //MS//Tomcat6 ~**HI_ E'b& 8Po!%% I_H?CBWyb H ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational .\Software\Microsoft\Windows\CurrentVersion\Run ذĤ**I` E'b& 8Pw!%% `H?CBWyb I ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational .dSoftware\Microsoft\Windows\CurrentVersion\RunOnceCor**J` E'b& 8Pw!%% `H?CBWyb J ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational .dSoftware\Microsoft\Windows\CurrentVersion\RunOncendo**K7 E'b& 8P7! 7P7L K ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAllLogonTasksoso**L7 E'b& 8PG! 7P7L L ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreDesktopSwitchTasksMic**M7 E'b& 8P/! 7P7L M ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellPrepMic**N7 E'b& 8P/! 7P7L N ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellPrept-W**O7 E'b& 8PO! 7P7L O ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f4AppReadinessPreShellGroupCor**P7 E'b& 8P5! 7P7L P ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fSkydrivePrep-Cor**Q7 E'b& 8P5! 7P7L Q ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fSkydrivePrep-Cor**R7 E'b& 8P+! 7P7L R ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fRunOnceS**S 7 E'b& 8P+! 7P7L S ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fRunOnceW**T 7 E'b& 8P3! 7P7L T ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fActiveSetupo**U7 E'b& 8P3! 7P7L U ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fActiveSetup'**V7 E'b& 8PC! 7P7L V ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f(WaitForMSAConnected'**W7 E'b& 8PC! 7P7L W ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f(WaitForMSAConnected'**X7 E'b& 8PG! 7P7L X ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreConfigLauncherSyncMic**Y7 E'b& 8PG! 7P7L Y ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreConfigLauncherSyncMic**Z7 E'b& 8PG! 7P7L Z ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreDesktopSwitchTaskst-W**[7 E'b& 8P;! 7P7L [ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f PerUserServicesW**\7 E'b& 8P;! 7P7L \ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f PerUserServicesW**]7 E'b& 8P7! 7P7L ] ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreShellTaskst-W**^7 E'b& 8PE! 7P7L ^ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*RoamingPayloads0and1aMic**_7 E'b& 8PE! 7P7L _ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*RoamingPayloads0and1en30'**`7 E'b& 8PO! 7P7L ` ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f4AppReadinessPreShellGroupQR**a7 E'b& 8P3! 7P7L a ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAppResolverl**b07 E'b& 8P!mm 07P7L b ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational EY d n30'**c@7 E'b& 8P3! @7P7L c ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAppResolverW**d@7 E'b& 8P7! @7P7L d ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreShellTaskst-W**eLH7 E'b& 8P9! LH7P7L x e ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellInitTasks-S**fPo7 E'b& 8P9! Po7P7L x f ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellInitTasksH**g~8 E'b& 8P7! ~8"P7L x g ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreStartTasks**h~8 E'b& 8P;! ~8"P7L x h ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload2**i~8 E'b& 8PI! ~8"P7L x i ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f.AppReadinessLogonGroupur**j~8 E'b& 8P=! ~8"P7L x j ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f"UpdatePCSettings:\ga**k~8 E'b& 8P=! ~8"P7L x k ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f"UpdatePCSettingsws-S**l~8 E'b& 8P;! ~8"P7L x l ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload2W**m~8 E'b& 8PI! ~8"P7L x m ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f.AppReadinessLogonGroup**n~8 E'b& 8P7! ~8"P7L x n ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreStartTasks!**o8 E'b& 8P7! 8"P7L x o ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAllLogonTasks**p8 E'b& 8P;! 8"P7L p ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload3**q8 E'b& 8P;! 8"P7L q ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload3**r8 E'b& 8P[! 8"P7L r ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f@AppReadinessNotifyLogonComplete**s8 E'b& 8P[! 8"P7L s ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f@AppReadinessNotifyLogonComplete**t8 E'b& 8PE! 8"P7L pt ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*ARSFirstRunTelemetryP**u#8 E'b& 8PE! #8"P7L pu ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*ARSFirstRunTelemetry**xv = E'b& 8P!nqm =28A%`=KeyName \Software\Microsoft\Windows\CurrentVersion\RunllGr0**H$ѱ E'b& 8P!%% $ѱu%sAv0+w(  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational _,ںab_,ں # >28A%`=Command z"C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusr H**xN+ѱ E'b& 8P!%% N+ѱu%sAv0+w(  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational m.d1:m.C HXOagbV8A`=PID A%`=Command z"C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusrQRx**N+ѱ E'b& 8Po!%% N+ѱu%sAv0+w(  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational 1`\Software\Microsoft\Windows\CurrentVersion\Run/Op**N+ѱ E'b& 8Po!%% N+ѱu%sAv0+w(  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational 1`\Software\Microsoft\Windows\CurrentVersion\RunllI**N+ѱ E'b& 8P!%% N+ѱu%sAv0+w(  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational _,ںabv"C:\galaxie\deploy\Tomcat6\bin\Tomcat6w.exe" //MS//Tomcat6**qѱ E'b& 8P!%% qѱigYN*(  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational m.dv "C:\galaxie\deploy\Tomcat6\bin\Tomcat6w.exe" //MS//Tomcat6 **qѱ E'b& 8Po!%% qѱigYN*(  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational 1`\Software\Microsoft\Windows\CurrentVersion\Run 2**ѱ E'b& 8Pw!%% ѱigYN*(  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational 1`dSoftware\Microsoft\Windows\CurrentVersion\RunOnceell**ѱ E'b& 8Pw!%% ѱigYN*(  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational 1`dSoftware\Microsoft\Windows\CurrentVersion\RunOncendo**ñ&%  E'b& 8P7! ñ&% ZP$< ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAllLogonTaskst-W**ñ&%  E'b& 8PG! ñ&% ZP$< ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreDesktopSwitchTaskss-S**ñ&%  E'b& 8P/! ñ&% ZP$< ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellPreposo**ñ&%  E'b& 8P/! ñ&% ZP$< ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellPrepMic**ñ&%  E'b& 8PO! ñ&% ZP$< ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f4AppReadinessPreShellGroupndo**ñ&%  E'b& 8P5! ñ&% ZP$< ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fSkydrivePrepindo**ñ&%  E'b& 8P5! ñ&% ZP$< ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fSkydrivePrepindo**ñ&%  E'b& 8P+! ñ&% ZP$< ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fRunOncer**ñ&%  E'b& 8P+! ñ&% ZP$< ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fRunOncec**ñ&%  E'b& 8P3! ñ&% ZP$< ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fActiveSetup**)%  E'b& 8P3! )% ZP$< ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fActiveSetup **)%  E'b& 8PC! )% ZP$< ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f(WaitForMSAConnectedc**)%  E'b& 8PC! )% ZP$< ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f(WaitForMSAConnectedr**)%  E'b& 8PG! )% ZP$< ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreConfigLauncherSyncQR**)%  E'b& 8PG! )% ZP$< ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreConfigLauncherSyncndo**)%  E'b& 8PG! )% ZP$< ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreDesktopSwitchTasksb **)%  E'b& 8P;! )% ZP$< ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f PerUserServices**)%  E'b& 8P;! )% ZP$< ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f PerUserServices**)%  E'b& 8P7! )% ZP$< ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreShellTasksows**)%  E'b& 8PE! )% ZP$< ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*RoamingPayloads0and1:\ga**)%  E'b& 8PE! )% ZP$< ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*RoamingPayloads0and1hell**)%  E'b& 8PO! )% ZP$< ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f4AppReadinessPreShellGroupCor**)%  E'b& 8P3! )% ZP$< ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAppResolver**v+%  E'b& 8P!mm v+% ZP$< ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational EY1: 8**v+%  E'b& 8P3! v+% <P$< ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAppResolver**v+%  E'b& 8P7! v+% <P$< ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreShellTasks**v+%  E'b& 8P9! v+% <P$<l ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellInitTasks**v+%  E'b& 8P9! v+% <P$<l ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellInitTasks7** &  E'b& 8P7!  & P$<l ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreStartTasks** &  E'b& 8P;!  & P$<l ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload2** &  E'b& 8PI!  & P$<l ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f.AppReadinessLogonGroup7** &  E'b& 8P=!  & P$<l ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f"UpdatePCSettings** &  E'b& 8P=!  & P$<l ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f"UpdatePCSettings** &  E'b& 8P;!  & P$<l ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload2** &  E'b& 8PI!  & P$<l ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f.AppReadinessLogonGroup** &  E'b& 8P7!  & P$<l ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreStartTasks8**PX&  E'b& 8P7! PX& P$<l ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAllLogonTasks**PX&  E'b& 8P;! PX& P$<  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload3**PX&  E'b& 8P;! PX& P$<  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload3**&  E'b& 8P[! & P$<  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f@AppReadinessNotifyLogonComplete**&  E'b& 8P[! & P$<  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f@AppReadinessNotifyLogonComplete**&  E'b& 8PE! & P$<  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*ARSFirstRunTelemetry;!**%&  E'b& 8PE! %& P$<  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*ARSFirstRunTelemetry **xe"+  E'b& 8P!nqm e"+ !DLt0PSJ  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational & x**x׼'+  E'b& 8P!nrm ׼'+ !DLt0PSJ  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational & 'b&x**5^/+  E'b& 8P7!mm 5^/+ !DLt0PSJ  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational :R% YZ7**:,  E'b& 8Po!%% :, 2(3`L #U ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational 1`\Software\Microsoft\Windows\CurrentVersion\Run**:,  E'b& 8P!%% :, 2(3`L #U ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational _,ںabz"C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusrP** B,  E'b& 8P!%% B, 2(3`L #U ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational m.dz"C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusr|DQR** B,  E'b& 8Po!%% B, 2(3`L #U ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational 1`\Software\Microsoft\Windows\CurrentVersion\Run/Op** B,  E'b& 8Po!%% B, 2(3`L #U ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational 1`\Software\Microsoft\Windows\CurrentVersion\RunllI** B,  E'b& 8P!%% B, 2(3`L #U ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational _,ںabv"C:\galaxie\deploy\Tomcat6\bin\Tomcat6w.exe" //MS//Tomcat6**.C,  E'b& 8P!%% .C, 2(3`L #U ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational m.dv "C:\galaxie\deploy\Tomcat6\bin\Tomcat6w.exe" //MS//Tomcat6"**.C,  E'b& 8Po!%% .C, 2(3`L #U ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational 1`\Software\Microsoft\Windows\CurrentVersion\Run 2**j,  E'b& 8Pw!%% j, 2(3`L #U ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational 1`dSoftware\Microsoft\Windows\CurrentVersion\RunOnceell**j,  E'b& 8Pw!%% j, 2(3`L #U ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational 1`dSoftware\Microsoft\Windows\CurrentVersion\RunOncendo**C) E'b& 8P7! C)@P??@x ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAllLogonTaskst-W**C) E'b& 8PG! C)@P??@x ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreDesktopSwitchTaskss-S**C) E'b& 8P/! C)@P??@x ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellPreposo**C) E'b& 8P/! C)@P??@x ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellPrepMic**C) E'b& 8PO! C)@P??@x ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f4AppReadinessPreShellGroupndo**C) E'b& 8P5! C)@P??@x ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fSkydrivePrepindo**C) E'b& 8P5! C)@P??@x ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fSkydrivePrepindo**C) E'b& 8P+! C)@P??@x ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fRunOncer**C) E'b& 8P+! C)@P??@x ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fRunOncec**C) E'b& 8P3! C)@P??@x ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fActiveSetup**C) E'b& 8P3! C)@P??@x ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fActiveSetup **C) E'b& 8PC! C)@P??@x ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f(WaitForMSAConnectedc**C) E'b& 8PC! C)@P??@x ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f(WaitForMSAConnectedr**C) E'b& 8PG! C)@P??@x ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreConfigLauncherSyncQR** C) E'b& 8PG! C)@P??@x  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreConfigLauncherSyncndo** C) E'b& 8PG! C)@P??@x  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreDesktopSwitchTasks/î ** C) E'b& 8P;! C)@P??@x  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f PerUserServices** C) E'b& 8P;! C)@P??@x  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f PerUserServices** C) E'b& 8P7! C)@P??@x  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreShellTasksows**C) E'b& 8PE! C)@P??@x ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*RoamingPayloads0and1:\ga**C) E'b& 8PE! C)@P??@x ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*RoamingPayloads0and1hell**C) E'b& 8PO! C)@P??@x ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f4AppReadinessPreShellGroupCor**C) E'b& 8P3! C)@P??@x ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAppResolver**!C) E'b& 8P!mm !C)x MT|g@x ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational EY1: 8**!C) E'b& 8P3! !C)?P??@x ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAppResolver**!C) E'b& 8P7! !C)?P??@x ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreShellTasks**!C) E'b& 8P9! !C)?P??@ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellInitTasks!**!C) E'b& 8P9! !C)?P??@ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellInitTasksicsoft-Windows E'b& 8PCore/Operational 1c 8P 8PPreShellTasksffElfChnkhH/F+08`=f?mMFya')&!$**? C) E'b&E'bUa4UxLIDwEAM Eventjxmlns5http://schemas.microsoft.com/win/2004/08/events/eventoTSystemAY{Provider6F=KNameX)GuidAMzaEventID'X) Qualifiers " Version dLevelE{Task ?Opcode$fjKeywordsAP; TimeCreated'j<{ SystemTime .F EventRecordID A Correlation\FF ActivityIDmz5RelatedActivityID Am ExecutionHFF ProcessID9ThreadID "aChannel<F;nComputer FILF-APP-RECAB.SecurityfLUserID ! 8P! ? C)P??@ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational ff6!yƒ8D EventDataA;`oData= LogonType A'`=TaskName PreStartTasksSCP**? C) E'b& 8P;! ? C)P??@ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload2c**? C) E'b& 8PI! ? C)P??@ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f.AppReadinessLogonGroup-W**? C) E'b& 8P=! ? C)P??@ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f"UpdatePCSettingsZ**? C) E'b& 8P=! ? C)P??@ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f"UpdatePCSettings**? C) E'b& 8P;! ? C)P??@ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload2**? C) E'b& 8PI! ? C)P??@ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f.AppReadinessLogonGroup8**? C) E'b& 8P7! ? C)P??@ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreStartTasksAl**p C) E'b& 8P7! p C)P??@ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAllLogonTasksPr** p C) E'b& 8P;! p C)P??@  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload3**!p C) E'b& 8P;! p C)P??@! ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload3**"p C) E'b& 8P[! p C)P??@ " ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f@AppReadinessNotifyLogonCompletee**#p C) E'b& 8P[! p C)P??@ # ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f@AppReadinessNotifyLogonComplete**$p C) E'b& 8PE! p C)P??@$ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*ARSFirstRunTelemetry ʰ**%p C) E'b& 8PE! p C)P??@% ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*ARSFirstRunTelemetry**&1C) E'b& 8P9!nqm 1C)xi s@@'gW@$ & ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational &!&| p)c8**x'BsC) E'b& 8P!nrm BsC)xi s@@'gW@$ ' ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational &!'b&x**(&0C) E'b& 8Pk!mm &0C)xi s@@'gW@$ ( ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational :R%$:R%&Gm3}8A1`#= ItemsExisting A+`= ItemsAdded A/`!= ItemsRemoved A/`!= ItemsUpdated A-`= ItemsCached YZa**0)dD"C) E'b& 8P!%% dD"C)|kCT3HyVQ@ ) ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational '3"E>28A%`=KeyName \Software\Microsoft\Windows\CurrentVersion\Run0**H*dD"C) E'b& 8P!%% dD"C)|kCT3HyVQ@ * ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational _,ں)_,ں # >28A%`=Command z"C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusroH**x+'C) E'b& 8P!%% 'C)|kCT3HyVQ@ + ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational m.,m.C HXOagbV8A`=PID A%`=Command z"C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusrhTax**,'C) E'b& 8Po!%% 'C)|kCT3HyVQ@ , ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational '\Software\Microsoft\Windows\CurrentVersion\Run'b&**-'C) E'b& 8Po!%% 'C)|kCT3HyVQ@ - ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational '\Software\Microsoft\Windows\CurrentVersion\Run**.'C) E'b& 8P!%% 'C)|kCT3HyVQ@ . ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational _,ں)v"C:\galaxie\deploy\Tomcat6\bin\Tomcat6w.exe" //MS//Tomcat6**/B-lC) E'b& 8P!%% B-lC)|kCT3HyVQ@ / ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational m.,v "C:\galaxie\deploy\Tomcat6\bin\Tomcat6w.exe" //MS//Tomcat6ll**0B-lC) E'b& 8Po!%% B-lC)|kCT3HyVQ@ 0 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational '\Software\Microsoft\Windows\CurrentVersion\Runoso**1B-lC) E'b& 8Pw!%% B-lC)|kCT3HyVQ@ 1 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational 'dSoftware\Microsoft\Windows\CurrentVersion\RunOnceCor**2B-lC) E'b& 8Pw!%% B-lC)|kCT3HyVQ@ 2 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational 'dSoftware\Microsoft\Windows\CurrentVersion\RunOnce\**3)yB+ E'b& 8P7! )yB+6P1v|H3 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAllLogonTaskst-W**4)yB+ E'b& 8PG! )yB+6P1v|H4 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreDesktopSwitchTasksell**5)yB+ E'b& 8P/! )yB+6P1v|H5 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellPreps-S**6)yB+ E'b& 8P/! )yB+6P1v|H6 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellPrepndo**7)yB+ E'b& 8PO! )yB+6P1v|H7 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f4AppReadinessPreShellGroupCor**8)yB+ E'b& 8P5! )yB+6P1v|H8 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fSkydrivePrep-Cor**9)yB+ E'b& 8P5! )yB+6P1v|H9 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fSkydrivePrep-Cor**:)yB+ E'b& 8P+! )yB+6P1v|H: ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fRunOnceW**;QyB+ E'b& 8P+! QyB+6P1v|H; ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fRunOnceR**<QyB+ E'b& 8P3! QyB+6P1v|H< ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fActiveSetupr**=-B+ E'b& 8P3! -B+ <1CH= ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fActiveSetupl**>-B+ E'b& 8PC! -B+ <1CH> ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f(WaitForMSAConnectedS**?-B+ E'b& 8PC! -B+ <1CH? ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f(WaitForMSAConnectedl**@-B+ E'b& 8PG! -B+ <1CH@ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreConfigLauncherSyncn30'**A-B+ E'b& 8PG! -B+ <1CHA ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreConfigLauncherSyncell**B-B+ E'b& 8PG! -B+ <1CHB ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreDesktopSwitchTasksndo**C-B+ E'b& 8P;! -B+ <1CHC ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f PerUserServiceso**D-B+ E'b& 8P;! -B+ <1CHD ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f PerUserServiceso**E-B+ E'b& 8P7! -B+ <1CHE ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreShellTasksoso**F-B+ E'b& 8PE! -B+ <1CHF ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*RoamingPayloads0and1roso**GtB+ E'b& 8PE! tB+ <1CHG ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*RoamingPayloads0and1|DQR**HtB+ E'b& 8PO! tB+ <1CHH ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f4AppReadinessPreShellGroup/Op**ItB+ E'b& 8P3! tB+ <1CHI ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAppResolverr**J„B+ E'b& 8P!mm „B+ <1CHJ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational EYya,EYM~q; g&h\8A'`=Scenario A!`=Flags  oso**K8B+ E'b& 8P3! 8B+ |P1v|HK ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAppResolver**L8B+ E'b& 8P7! 8B+ |P1v|HL ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreShellTasksm F**MB+ E'b& 8P9! B+ |P1v|H M ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellInitTasks-S**NB+ E'b& 8P9! B+ |P1v|H N ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellInitTasksor**O;eC+ E'b& 8P7! ;eC+P1v|H O ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreStartTasks 2**P;eC+ E'b& 8P;! ;eC+P1v|H P ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload2**Q;eC+ E'b& 8PI! ;eC+P1v|H Q ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f.AppReadinessLogonGroup**R;eC+ E'b& 8P=! ;eC+P1v|H R ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f"UpdatePCSettings 2**S;eC+ E'b& 8P=! ;eC+P1v|H S ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f"UpdatePCSettingsdows**T;eC+ E'b& 8P;! ;eC+P1v|H T ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload2**U;eC+ E'b& 8PI! ;eC+P1v|H U ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f.AppReadinessLogonGroup-S**V;eC+ E'b& 8P7! ;eC+P1v|H V ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreStartTaskss-S**WrC+ E'b& 8P7! rC+P1v|H W ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAllLogonTaskst-W**XsC+ E'b& 8P[! sC+P1v|H0X ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f@AppReadinessNotifyLogonCompletep**YsC+ E'b& 8P[! sC+P1v|H0Y ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f@AppReadinessNotifyLogonComplete**ZsC+ E'b& 8P;! sC+P1v|HDZ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload3a**[sC+ E'b& 8P;! sC+P1v|HD[ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload3a**\sC+ E'b& 8PE! sC+P1v|HX\ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*ARSFirstRunTelemetry**] sC+ E'b& 8PE! sC+P1v|HX] ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*ARSFirstRunTelemetryec**x^@|H+ E'b& 8P!nqm @|H+ęN8t{ PHx^ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational &!x**x_= H+ E'b& 8P!nrm = H+ęN8t{ PHx_ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational &!ratx**`qH+ E'b& 8P7!mm qH+ęN8t{ PHx` ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational :R%$YZona**acwI+ E'b& 8Po!%% cwI+Nd׺KTHa ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational '\Software\Microsoft\Windows\CurrentVersion\RunMSA**bcwI+ E'b& 8P!%% cwI+Nd׺KTHb ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational _,ں)z"C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusr**c9}I+ E'b& 8P!%% 9}I+^,3WM9BGwHc ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational m.,z, "C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusr**d9}I+ E'b& 8Po!%% 9}I+^,3WM9BGwHd ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational '\Software\Microsoft\Windows\CurrentVersion\Run**e9}I+ E'b& 8Po!%% 9}I+^,3WM9BGwHe ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational '\Software\Microsoft\Windows\CurrentVersion\Runt-W**f9}I+ E'b& 8P!%% 9}I+^,3WM9BGwHf ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational _,ں)v"C:\galaxie\deploy\Tomcat6\bin\Tomcat6w.exe" //MS//Tomcat6do**gI+ E'b& 8P!%% I+k0HM| 7ۅdHg ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational m.,vP"C:\galaxie\deploy\Tomcat6\bin\Tomcat6w.exe" //MS//Tomcat6in**hI+ E'b& 8Po!%% I+k0HM| 7ۅdHh ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational '\Software\Microsoft\Windows\CurrentVersion\Runell**iI+ E'b& 8Pw!%% I+k0HM| 7ۅdHi ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational 'dSoftware\Microsoft\Windows\CurrentVersion\RunOnce'b&**jI+ E'b& 8Pw!%% I+k0HM| 7ۅdHj ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational 'dSoftware\Microsoft\Windows\CurrentVersion\RunOnceP**kq/ E'b& 8P7! q/fP_h0h k ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAllLogonTasks v**lq/ E'b& 8PG! q/fP_h0h l ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreDesktopSwitchTasks**mq/ E'b& 8P/! q/fP_h0h m ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellPrepP**nq/ E'b& 8P/! q/fP_h0h n ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellPrep **oq/ E'b& 8PO! q/fP_h0h o ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f4AppReadinessPreShellGroup**pq/ E'b& 8P5! q/fP_h0h p ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fSkydrivePrepl**qq/ E'b& 8P5! q/fP_h0h q ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fSkydrivePrepl**rq/ E'b& 8P+! q/fP_h0h r ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fRunOnce**sꗯq/ E'b& 8P+! ꗯq/fP_h0h s ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fRunOnce**tꗯq/ E'b& 8P3! ꗯq/fP_h0h t ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fActiveSetup**upq/ E'b& 8P3! pq/fP_h0h u ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fActiveSetup**vpq/ E'b& 8PC! pq/fP_h0h v ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f(WaitForMSAConnected**wpq/ E'b& 8PC! pq/fP_h0h w ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f(WaitForMSAConnected**xpq/ E'b& 8PG! pq/fP_h0h x ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreConfigLauncherSync8**ypq/ E'b& 8PG! pq/fP_h0h y ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreConfigLauncherSync!**zpq/ E'b& 8PG! pq/fP_h0h z ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreDesktopSwitchTasks **{pq/ E'b& 8P;! pq/fP_h0h { ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f PerUserServices**|pq/ E'b& 8P;! pq/fP_h0h | ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f PerUserServices**}pq/ E'b& 8P7! pq/fP_h0h } ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreShellTasks**~pq/ E'b& 8PE! pq/fP_h0h ~ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*RoamingPayloads0and1**噯q/ E'b& 8PE! 噯q/fP_h0h  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*RoamingPayloads0and1P**噯q/ E'b& 8PO! 噯q/fP_h0h  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f4AppReadinessPreShellGroup**噯q/ E'b& 8P3! 噯q/fP_h0h  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAppResolver**q/ E'b& 8P!mm q/fP_h0h  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational EYya **q/ E'b& 8P3! q/GP_h0h  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAppResolver**q/ E'b& 8P7! q/GP_h0h  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreShellTasks Fi**%lq/ E'b& 8P9! %lq/GP_h0  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellInitTasks-S**%lq/ E'b& 8P9! %lq/GP_h0  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellInitTasksor**wq/ E'b& 8P7! wq/P_h0  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreStartTasks 2**wq/ E'b& 8P;! wq/P_h0  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload2**wq/ E'b& 8PI! wq/P_h0  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f.AppReadinessLogonGroup**wq/ E'b& 8P=! wq/P_h0  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f"UpdatePCSettings 2**wq/ E'b& 8P=! wq/P_h0  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f"UpdatePCSettingsdows**wq/ E'b& 8P;! wq/P_h0  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload2**wq/ E'b& 8PI! wq/P_h0  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f.AppReadinessLogonGroup-S**wq/ E'b& 8P7! wq/P_h0  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreStartTaskss-S**5q/ E'b& 8P7! 5q/P_h0  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAllLogonTaskst-W**\q/ E'b& 8P;! \q/P_h0d  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload3o**\q/ E'b& 8P;! \q/P_h0d  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload3S**XUq/ E'b& 8P[! XUq/P_h0  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f@AppReadinessNotifyLogonCompletel**XUq/ E'b& 8P[! XUq/P_h0  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f@AppReadinessNotifyLogonCompletea**l鱰q/ E'b& 8PE! l鱰q/P_h0 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*ARSFirstRunTelemetry**{q/ E'b& 8PE! {q/P_h0 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*ARSFirstRunTelemetryec**xMq/ E'b& 8P!nqm Mq/`hOn0 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational &!x**xq/ E'b& 8P!nrm q/`hOn0 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational &!ratx**Yڣq/ E'b& 8P7!mm Yڣq/`hOn0 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational :R%$YZona**ɖq/ E'b& 8Po!%% ɖq/`hOn0  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational '\Software\Microsoft\Windows\CurrentVersion\RunMSA**ɖq/ E'b& 8P!%% ɖq/`hOn0  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational _,ں)z"C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusr** q/ E'b& 8P!%% q/`hOn0  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational m.,z"C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusr** q/ E'b& 8Po!%% q/`hOn0  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational '\Software\Microsoft\Windows\CurrentVersion\Run ** q/ E'b& 8Po!%% q/`hOn0  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational '\Software\Microsoft\Windows\CurrentVersion\Runt-W**Gq/ E'b& 8P!%% Gq/`hOn0  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational _,ں)v"C:\galaxie\deploy\Tomcat6\bin\Tomcat6w.exe" //MS//Tomcat6do**q/ E'b& 8P!%% q/`hOn0  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational m.,v"C:\galaxie\deploy\Tomcat6\bin\Tomcat6w.exe" //MS//Tomcat6in**q/ E'b& 8Po!%% q/`hOn0  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational '\Software\Microsoft\Windows\CurrentVersion\Runell**q/ E'b& 8Pw!%% q/`hOn0  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational 'dSoftware\Microsoft\Windows\CurrentVersion\RunOnce'b&**q/ E'b& 8Pw!%% q/`hOn0  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational 'dSoftware\Microsoft\Windows\CurrentVersion\RunOnceP!mm !C)x MT|g@x ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational EY1: 8**!C) E'b& 8P3! !C)?P??@x ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAppResolver**!C) E'b& 8P7! !C)?P??@x ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreShellTasks**!C) E'b& 8P9! !C)?P??@ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellInitTasks!**!C) E'b& 8P9! !C)?P??@ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellInitTasksicsoft-Windows E'b& 8PCore/Operational 1c 8P 8PPreShellTasksffElfChnk  @%Nr%r"8| =f?mMFHQ"1a&I **huD! E'b&E'bUa4UxLIDwEAM Eventjxmlns5http://schemas.microsoft.com/win/2004/08/events/eventoTSystemAY{Provider6F=KNameX)GuidAMzaEventID'X) Qualifiers " Version dLevelE{Task ?Opcode$fjKeywordsAP; TimeCreated'j<{ SystemTime .F EventRecordID A Correlation\FF ActivityIDmz5RelatedActivityID Am ExecutionHFF ProcessID9ThreadID "aChannel<F;nComputer FILF-APP-RECAB.SecurityfLUserID ! 8PU!nqm uD! bC~%DU X` T ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational &&| p)c."8D EventDatah**xԂN! E'b& 8P!nrm ԂN! bC~%DU X` T ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational &ndox**c! E'b& 8P}!mm c! bC~%DU X` T ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational :R%I :R%&Gm3}."8AC| oData#= ItemsExisting A+| = ItemsAdded A/| != ItemsRemoved A/| != ItemsUpdated A-| = ItemsCached XYkϴ**0! E'b& 8P!%% ! bC~%DU X` t ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational 13"E>28A%| =KeyName \Software\Microsoft\Windows\CurrentVersion\RunaMic0**H! E'b& 8P!%% ! bC~%DU X` t ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational _,ںa_,ں # >28A%| =Command z"C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusraH**xh%! E'b& 8P!%% h%! bC~%DU X` t ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational m.m.C HXOagbV8A| =PID A%| =Command z| "C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusr 2x**h%! E'b& 8Po!%% h%! bC~%DU X` t ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational 1\Software\Microsoft\Windows\CurrentVersion\RunCor**h%! E'b& 8Po!%% h%! bC~%DU X` t ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational 1\Software\Microsoft\Windows\CurrentVersion\Runs-S**h%! E'b& 8P!%% h%! bC~%DU X` t ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational _,ںav"C:\galaxie\deploy\Tomcat6\bin\Tomcat6w.exe" //MS//Tomcat6in**}N}! E'b& 8P!%% }N}! bC~%DU X` t ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational m.v"C:\galaxie\deploy\Tomcat6\bin\Tomcat6w.exe" //MS//Tomcat6**}N}! E'b& 8Po!%% }N}! bC~%DU X` t ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational 1\Software\Microsoft\Windows\CurrentVersion\Run**}N}! E'b& 8Pw!%% }N}! bC~%DU X` t ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational 1dSoftware\Microsoft\Windows\CurrentVersion\RunOnce T**}N}! E'b& 8Pw!%% }N}! bC~%DU X` t ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational 1dSoftware\Microsoft\Windows\CurrentVersion\RunOnce**( E'b& 8P! 1Py/V ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fQ"f6!yƒpd8A)| = LogonType A'| =TaskName AllLogonTaskss-S(** E'b& 8PG! 1Py/V ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fQ",PreDesktopSwitchTasksCor** E'b& 8P/! 1Py/V ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fQ"ShellPrepell** E'b& 8P/! 1Py/V ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fQ"ShellPreps-S** E'b& 8PO! 1Py/V ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fQ"4AppReadinessPreShellGroupn30'** E'b& 8P5! 1Py/V ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fQ"SkydrivePrepen30'** E'b& 8P5! 1Py/V ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fQ"SkydrivePrephell** E'b& 8P+! 1Py/V ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fQ"RunOnceW**ڎ E'b& 8P+! ڎ1Py/V ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fQ"RunOnce**ڎ E'b& 8P3! ڎ1Py/V ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fQ"ActiveSetup**Ր E'b& 8P3! Ր1Py/V ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fQ"ActiveSetupݘ**Ր E'b& 8PC! Ր1Py/V ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fQ"(WaitForMSAConnected** E'b& 8PC! 1Py/V ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fQ"(WaitForMSAConnected** E'b& 8PG! 1Py/V ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fQ",PreConfigLauncherSync 2** E'b& 8PG! 1Py/V ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fQ",PreConfigLauncherSyncoso** E'b& 8PG! 1Py/V ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fQ",PreDesktopSwitchTasks 2** E'b& 8P;! 1Py/V ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fQ" PerUserServicesݠ** E'b& 8P;! 1Py/V ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fQ" PerUserServicesܠ** E'b& 8P7! 1Py/V ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fQ"PreShellTasks Ԑ** E'b& 8PE! 1Py/V ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fQ"*RoamingPayloads0and1bG**# E'b& 8PE! #1Py/V ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fQ"*RoamingPayloads0and1Mic**# E'b& 8PO! #1Py/V ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fQ"4AppReadinessPreShellGroupIte**# E'b& 8P3! #1Py/V ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fQ"AppResolverp**) E'b& 8P!mm )1Py/V ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational EYHEYM~q; g&h\8A'| =Scenario A!| =Flags  t-W**ђ E'b& 8P3! ђVPy/V ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fQ"AppResolver**ђ E'b& 8P7! ђVPy/V ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fQ"PreShellTasksles** E'b& 8P9! VPy/V0  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fQ"ShellInitTasksll**F E'b& 8P9! FVPy/V0  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fQ"ShellInitTasks30'**# E'b& 8P7! #ύoB M0  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fQ"PreStartTasksMic**# E'b& 8P;! #ύoB M0  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fQ" RoamingPayload2**,# E'b& 8PI! ,#ύoB M0  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fQ".AppReadinessLogonGroup**,# E'b& 8P=! ,#ύoB M0  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fQ""UpdatePCSettings****,# E'b& 8P=! ,#ύoB M0  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fQ""UpdatePCSettings\Cur**,# E'b& 8P;! ,#ύoB M0  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fQ" RoamingPayload2**,# E'b& 8PI! ,#ύoB M0  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fQ".AppReadinessLogonGroupll**,# E'b& 8P7! ,#ύoB M0  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fQ"PreStartTasksell**= E'b& 8P7! =ύoB M0  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fQ"AllLogonTasksndo**3V> E'b& 8P;! 3V>ύoB M ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fQ" RoamingPayload3S**3V> E'b& 8P;! 3V>ύoB M ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fQ" RoamingPayload3l**A E'b& 8P[! AύoB M  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fQ"@AppReadinessNotifyLogonCompleter**A E'b& 8P[! AύoB M  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fQ"@AppReadinessNotifyLogonComplete**J E'b& 8PE! JύoB M4 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fQ"*ARSFirstRunTelemetry**'K E'b& 8PE! 'KύoB M4 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fQ"*ARSFirstRunTelemetry****x# E'b& 8P!nqm #4 8Jf  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational &Acx**x]# E'b& 8P!nrm ]#4 8Jf  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational &onax**# E'b& 8P7!mm #4 8Jf  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational :R%I XY f**@$ E'b& 8Po!%% @$(.llJ~g   ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational 1\Software\Microsoft\Windows\CurrentVersion\Runonn**@$ E'b& 8P!%% @$(.llJ~g   ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational _,ںaz"C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusr**0J$ E'b& 8P!%% 0J$(.llJ~g   ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational m.z"C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusr u**0J$ E'b& 8Po!%% 0J$(.llJ~g   ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational 1\Software\Microsoft\Windows\CurrentVersion\Run**0J$ E'b& 8Po!%% 0J$(.llJ~g   ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational 1\Software\Microsoft\Windows\CurrentVersion\Runndo**0J$ E'b& 8P!%% 0J$(.llJ~g   ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational _,ںav"C:\galaxie\deploy\Tomcat6\bin\Tomcat6w.exe" //MS//Tomcat6-S**%$ E'b& 8P!%% %$ύoB M  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational m.v4"C:\galaxie\deploy\Tomcat6\bin\Tomcat6w.exe" //MS//Tomcat6ay**%$ E'b& 8Po!%% %$ύoB M  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational 1\Software\Microsoft\Windows\CurrentVersion\Run****⿝$ E'b& 8Pw!%% ⿝$ύoB M  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational 1dSoftware\Microsoft\Windows\CurrentVersion\RunOnce**⿝$ E'b& 8Pw!%% ⿝$ύoB M  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational 1dSoftware\Microsoft\Windows\CurrentVersion\RunOnce!**%  E'b& 8P7! %  Py/V, ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fQ"AllLogonTasks**%  E'b& 8PG! %  Py/V, ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fQ",PreDesktopSwitchTasks Fݰ**%  E'b& 8P/! %  Py/V, ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fQ"ShellPrep**%  E'b& 8P/! %  Py/V, ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fQ"ShellPrepP**%  E'b& 8PO! %  Py/V, ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fQ"4AppReadinessPreShellGroup**%  E'b& 8P5! %  Py/V, ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fQ"SkydrivePrep**%  E'b& 8P5! %  Py/V, ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fQ"SkydrivePrep**%  E'b& 8P+! %  Py/V, ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fQ"RunOnceL**%  E'b& 8P+! %  Py/V, ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fQ"RunOnce**%  E'b& 8P3! %  Py/V, ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fQ"ActiveSetup***  E'b& 8P3! *  Py/V, ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fQ"ActiveSetup***  E'b& 8PC! *  Py/V, ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fQ"(WaitForMSAConnected***  E'b& 8PC! *  Py/V, ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fQ"(WaitForMSAConnected***  E'b& 8PG! *  Py/V, ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fQ",PreConfigLauncherSyncP***  E'b& 8PG! *  Py/V, ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fQ",PreConfigLauncherSync***  E'b& 8PG! *  Py/V, ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fQ",PreDesktopSwitchTasksL***  E'b& 8P;! *  Py/V, ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fQ" PerUserServices***  E'b& 8P;! *  Py/V, ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fQ" PerUserServices***  E'b& 8P7! *  Py/V, ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fQ"PreShellTasks***  E'b& 8PE! *  Py/V, ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fQ"*RoamingPayloads0and1***  E'b& 8PE! *  Py/V, ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fQ"*RoamingPayloads0and1!***  E'b& 8PO! *  Py/V, ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fQ"4AppReadinessPreShellGroup***  E'b& 8P3! *  Py/V, ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fQ"AppResolver***  E'b& 8P!mm *  Py/V, ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational EYH ***  E'b& 8P3! * Py/V, ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fQ"AppResolvert***  E'b& 8P7! * Py/V, ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fQ"PreShellTaskses\***  E'b& 8P9! * Py/V, ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fQ"ShellInitTasksll***  E'b& 8P9! * Py/V, ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fQ"ShellInitTasks30'**Nf  E'b& 8P7! Nf Py/V, ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fQ"PreStartTasksMic**Nf  E'b& 8P;! Nf Py/V, ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fQ" RoamingPayload2**Nf  E'b& 8PI! Nf Py/V, ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fQ".AppReadinessLogonGroup**Nf  E'b& 8P=! Nf Py/V, ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fQ""UpdatePCSettings****Nf  E'b& 8P=! Nf Py/V, ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fQ""UpdatePCSettings\Cur**Nf  E'b& 8P;! Nf Py/V, ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fQ" RoamingPayload2**Nf  E'b& 8PI! Nf Py/V, ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fQ".AppReadinessLogonGroupll**Nf  E'b& 8P7! Nf Py/V, ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fQ"PreStartTasksell**Sk  E'b& 8P7! Sk Py/V, ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fQ"AllLogonTasksndo**Sk  E'b& 8P;! Sk Py/V,@ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fQ" RoamingPayload3S**Sk  E'b& 8P;! Sk Py/V,@ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fQ" RoamingPayload3l**Sk  E'b& 8P[! Sk Py/V, ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fQ"@AppReadinessNotifyLogonCompleter**Sk  E'b& 8P[! Sk Py/V, ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fQ"@AppReadinessNotifyLogonComplete**Sk  E'b& 8PE! Sk Py/V,  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fQ"*ARSFirstRunTelemetry**Sk  E'b& 8PE! Sk Py/V,  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fQ"*ARSFirstRunTelemetry****x'% E'b& 8P!nqm '%U|IJ28A%`=KeyName \Software\Microsoft\Windows\CurrentVersion\Run-Cor0**H;(] E'b& 8P!%% (]P(fL ; ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational _,ں5_,ں # >28A%`=Command z"C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusreH**x<0] E'b& 8P!%% 0]P(fL < ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational m.7 m.C HXOagbV8A`=PID A%`=Command z "C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusr ذĤx**=0] E'b& 8Po!%% 0]P(fL = ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational q3\Software\Microsoft\Windows\CurrentVersion\Runndo**>0] E'b& 8Po!%% 0]P(fL > ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational q3\Software\Microsoft\Windows\CurrentVersion\RunQR**?0] E'b& 8P!%% 0]P(fL ? ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational _,ں5v"C:\galaxie\deploy\Tomcat6\bin\Tomcat6w.exe" //MS//Tomcat6na**@<] E'b& 8P!%% <]P(fL @ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational m.7v"C:\galaxie\deploy\Tomcat6\bin\Tomcat6w.exe" //MS//Tomcat6**A<] E'b& 8Po!%% <]P(fL A ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational q3\Software\Microsoft\Windows\CurrentVersion\Run**Bp] E'b& 8Pw!%% p]P(fL B ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational q3dSoftware\Microsoft\Windows\CurrentVersion\RunOnceP**Cp] E'b& 8Pw!%% p]P(fL C ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational q3dSoftware\Microsoft\Windows\CurrentVersion\RunOnceP**xD:] E'b& 8P!nqm :]qv2GzܰsL$D ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational &-!x**Ej>] E'b& 8P9!mm j>]qv2GzܰsL$E ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational 1c I1cᆫ}Q4?A_|8A`=Name A!`=AppID A!`=Flags &Tgalaxie - ShortcutC:\galaxie\deploy\Tomcat6\webapps\galaxie QR**xF6>] E'b& 8P!nrm 6>]qv2GzܰsL$F ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational &-s-Sx**GaB] E'b& 8P7!mm aB]qv2GzܰsL$G ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational :R%0XYs-S**xHY] E'b& 8P!nqm Y]qv2GzܰsLH ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational &- 2x**I}A]] E'b& 8P!mm }A]]qv2GzܰsLI ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational 1c I2Tgalaxie WebApps- recetteC:\galaxie\deploy\Tomcat6\webapps\galaxie ws-S**xJ}A]] E'b& 8P!nrm }A]]qv2GzܰsLJ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational &-QRx**Kz^] E'b& 8P7!mm z^]qv2GzܰsLK ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational :R%0XYQR**L  E'b& 8P7! gP$$ L ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAllLogonTasksCor**M  E'b& 8PG! gP$$ M ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreDesktopSwitchTasksn30'**N  E'b& 8P/! gP$$ N ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellPrepell**O  E'b& 8P/! gP$$ O ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellPreps-S**P  E'b& 8PO! gP$$ P ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f4AppReadinessPreShellGroupell**Q  E'b& 8P5! gP$$ Q ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fSkydrivePrephell**R  E'b& 8P5! gP$$ R ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fSkydrivePrephell**S  E'b& 8P+! gP$$ S ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fRunOnceo**T  E'b& 8P+! gP$$ T ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fRunOnceo**U  E'b& 8P3! gP$$ U ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fActiveSetup**V E'b& 8P3! gP$$ V ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fActiveSetup٘**W E'b& 8PC! gP$$ W ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f(WaitForMSAConnected**X E'b& 8PC! gP$$ X ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f(WaitForMSAConnected**Y E'b& 8PG! gP$$ Y ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreConfigLauncherSync**Z E'b& 8PG! gP$$ Z ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreConfigLauncherSyncndo**[ E'b& 8PG! gP$$ [ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreDesktopSwitchTasksell**\ E'b& 8P;! gP$$ \ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f PerUserServices**] E'b& 8P;! gP$$ ] ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f PerUserServices**^ E'b& 8P7! gP$$ ^ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreShellTasks****_ E'b& 8PE! gP$$ _ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*RoamingPayloads0and1rent**` E'b& 8PE! gP$$ ` ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*RoamingPayloads0and1icro**a E'b& 8PO! gP$$ a ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f4AppReadinessPreShellGroup**b E'b& 8P3! gP$$ b ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAppResolverc**c0 E'b& 8P!mm 0gP$$ c ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational EY   ݈**d0 E'b& 8P3! 0hP$$ d ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAppResolver**e0 E'b& 8P7! 0hP$$ e ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreShellTasks'b&**f0 E'b& 8P9! 0hP$f ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellInitTasksn\**g0 E'b& 8P9! 0hP$g ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellInitTasksog**hgD E'b& 8P7! gDhP$h ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreStartTasksDes**igD E'b& 8P;! gDhP$i ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload2**jgD E'b& 8PI! gDhP$j ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f.AppReadinessLogonGroupp**kgD E'b& 8P=! gDhP$k ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f"UpdatePCSettingseShe**lgD E'b& 8P=! gDhP$l ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f"UpdatePCSettingsvePr**mgD E'b& 8P;! gDhP$m ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload2r**ngD E'b& 8PI! gDhP$n ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f.AppReadinessLogonGroup**ogD E'b& 8P7! gDhP$o ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreStartTasks**pY E'b& 8P7! YP$p ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAllLogonTasks'b&**qY E'b& 8P;! YP$q ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload3**rY E'b& 8P;! YP$r ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload3**sˡ^ E'b& 8P[! ˡ^P$s ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f@AppReadinessNotifyLogonComplete**tˡ^ E'b& 8P[! ˡ^P$t ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f@AppReadinessNotifyLogonComplete**uˡ^ E'b& 8PE! ˡ^P$u ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*ARSFirstRunTelemetry**v a E'b& 8PE! aP$v ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*ARSFirstRunTelemetry**xw E'b& 8P!nqm  @}[fM x$w ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational &-'b&x**pxL E'b& 8P!mm L @}[fM x$x ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational 1c Ih~dmarrer la journalisation de statistiques de la VMMicrosoft.AutoGenerated.{14A21382-6511-3324-B505-306A7D8FF83A}0hellp**xyL E'b& 8P!nrm L @}[fM x$y ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational &-Micx**z| E'b& 8P7!mm | @}[fM x$z ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational :R%0XY ذĤ**{eZ E'b& 8Po!%% eZ @}[fM x$({ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational q3\Software\Microsoft\Windows\CurrentVersion\Runndo**|eZ E'b& 8P!%% eZ @}[fM x$(| ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational _,ں5z"C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusrft-W**}x\ E'b& 8P!%% x\ @}[fM x$(} ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational m.7zl "C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusr****~x\ E'b& 8Po!%% x\ @}[fM x$(~ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational q3\Software\Microsoft\Windows\CurrentVersion\Run**x\ E'b& 8Po!%% x\ @}[fM x$( ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational q3\Software\Microsoft\Windows\CurrentVersion\Run**x\ E'b& 8P!%% x\ @}[fM x$( ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational _,ں5v"C:\galaxie\deploy\Tomcat6\bin\Tomcat6w.exe" //MS//Tomcat6ic**ě E'b& 8P!%% ě @}[fM x$( ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational m.7v`"C:\galaxie\deploy\Tomcat6\bin\Tomcat6w.exe" //MS//Tomcat6-W**ě E'b& 8Po!%% ě @}[fM x$( ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational q3\Software\Microsoft\Windows\CurrentVersion\Runona**ě E'b& 8Pw!%% ě @}[fM x$( ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational q3dSoftware\Microsoft\Windows\CurrentVersion\RunOnceonG**ě E'b& 8Pw!%% ě @}[fM x$( ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational q3dSoftware\Microsoft\Windows\CurrentVersion\RunOnce'b&**VLK E'b& 8P7! VLKXPz  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAllLogonTasks**VLK E'b& 8PG! VLKXPz  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreDesktopSwitchTasks**VLK E'b& 8P/! VLKXPz  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellPrepNf **VLK E'b& 8P/! VLKXPz  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellPrep**VLK E'b& 8PO! VLKXPz  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f4AppReadinessPreShellGroup'b&**VLK E'b& 8P5! VLKXPz  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fSkydrivePrepE'b&**VLK E'b& 8P5! VLKXPz  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fSkydrivePrepE'b&**VLK E'b& 8P+! VLKXPz  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fRunOncet**VLK E'b& 8P+! VLKXPz  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fRunOncea**VLK E'b& 8P3! VLKXPz  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fActiveSetupa**qЅK E'b& 8P3! qЅKXPz  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fActiveSetupr**qЅK E'b& 8PC! qЅKXPz  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f(WaitForMSAConnectedl**qЅK E'b& 8PC! qЅKXPz  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f(WaitForMSAConnected**qЅK E'b& 8PG! qЅKXPz  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreConfigLauncherSync**qЅK E'b& 8PG! qЅKXPz  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreConfigLauncherSync**qЅK E'b& 8PG! qЅKXPz  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreDesktopSwitchTasks**qЅK E'b& 8P;! qЅKXPz  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f PerUserServices**qЅK E'b& 8P;! qЅKXPz  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f PerUserServices\**qЅK E'b& 8P7! qЅKXPz  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreShellTasks m**qЅK E'b& 8PE! qЅKXPz  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*RoamingPayloads0and1aMic**$҅K E'b& 8PE! $҅KXPz  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*RoamingPayloads0and1ws-S**$҅K E'b& 8PO! $҅KXPz  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f4AppReadinessPreShellGroupMic**$҅K E'b& 8P3! $҅KXPz  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAppResolver**$҅K E'b& 8P!mm $҅KXPz  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational EY  **$҅K E'b& 8P3! $҅K zPz  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAppResolverO**$҅K E'b& 8P7! $҅K zPz  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreShellTasksnTa**$҅K E'b& 8P9! $҅K zPzP  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellInitTasksop**$҅K E'b& 8P9! $҅K zPzP  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellInitTasksSh**(K E'b& 8P7! (KPzP  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreStartTasksllP**(K E'b& 8P;! (KPzP  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload2e**(K E'b& 8PI! (KPzP  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f.AppReadinessLogonGroupri**(K E'b& 8P=! (KPzP  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f"UpdatePCSettingsvePr**(K E'b& 8P=! (KPzP  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f"UpdatePCSettings****(K E'b& 8P;! (KPzP  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload2**(K E'b& 8PI! (KPzP  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f.AppReadinessLogonGroup**(K E'b& 8P7! (KPzP  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreStartTasks**4K E'b& 8P7! 4KPzP  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAllLogonTasks**4K E'b& 8P;! 4KPz  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload3**4K E'b& 8P;! 4KPz  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload3**6K E'b& 8P[! 6KPzD ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f@AppReadinessNotifyLogonComplete**6K E'b& 8P[! 6KPzD ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f@AppReadinessNotifyLogonComplete**;K E'b& 8PE! ;KPz ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*ARSFirstRunTelemetry**>K E'b& 8PE! >KPz ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*ARSFirstRunTelemetry**xɋK E'b& 8P!nqm ɋKa`HAqN N3z  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational &-x**x,͋K E'b& 8P!nrm ,͋Ka`HAqN N3z  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational &-1x**8 ׋K E'b& 8P7!mm 8 ׋Ka`HAqN N3z  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational :R%0XYoadand1ionaffElfChnkCCXx]8`=f?mMFBYi & d!g**τNK E'b&E'bUa4UxLIDwEAM Eventjxmlns5http://schemas.microsoft.com/win/2004/08/events/eventoTSystemAY{Provider6F=KNameX)GuidAMzaEventID'X) Qualifiers " Version dLevelE{Task ?Opcode$fjKeywordsAP; TimeCreated'j<{ SystemTime .F EventRecordID A Correlation\FF ActivityIDmz5RelatedActivityID Am ExecutionHFF ProcessID9ThreadID "aChannel<F;nComputer FILF-APP-RECAB.SecurityfLUserID ! 8P!%% τNKhŦEF]$͔ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational 3"El`8D EventDataA7`oData=KeyName \Software\Microsoft\Windows\CurrentVersion\Runl**HτNK E'b& 8P!%% τNKhŦEF]$͔ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational _,ںi _,ں # >28A%`=Command z"C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusrH**xcK E'b& 8P!%% cKhŦEF]$͔ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational m. m.C HXOagbV8A`=PID A%`=Command z"C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusrn30'x**cK E'b& 8Po!%% cKhŦEF]$͔ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational \Software\Microsoft\Windows\CurrentVersion\RunCor**cK E'b& 8Po!%% cKhŦEF]$͔ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational \Software\Microsoft\Windows\CurrentVersion\RunSh**cK E'b& 8P!%% cKhŦEF]$͔ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational _,ںi v"C:\galaxie\deploy\Tomcat6\bin\Tomcat6w.exe" //MS//Tomcat6**K E'b& 8P!%% KhŦEF]$͔ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational m. v "C:\galaxie\deploy\Tomcat6\bin\Tomcat6w.exe" //MS//Tomcat6 ,**K E'b& 8Po!%% KhŦEF]$͔ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational \Software\Microsoft\Windows\CurrentVersion\Run ذĤ** K E'b& 8Pw!%%  KhŦEF]$͔ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational dSoftware\Microsoft\Windows\CurrentVersion\RunOnces-S** K E'b& 8Pw!%%  KhŦEF]$͔ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational dSoftware\Microsoft\Windows\CurrentVersion\RunOncet-W**(#p$ E'b& 8P! #p$cP9 ( ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fYf6!yƒpd8A)`= LogonType A'`=TaskName AllLogonTasks**(**#p$ E'b& 8PG! #p$cP9 ( ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fY,PreDesktopSwitchTasks****#p$ E'b& 8P/! #p$cP9 ( ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fYShellPreprat**#p$ E'b& 8P/! #p$cP9 ( ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fYShellPrepks**#p$ E'b& 8PO! #p$cP9 ( ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fY4AppReadinessPreShellGroup2**#p$ E'b& 8P5! #p$cP9 ( ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fYSkydrivePrep3**#p$ E'b& 8P5! #p$cP9 ( ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fYSkydrivePrepnCom**#p$ E'b& 8P+! #p$cP9 ( ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fYRunOncep**hr$ E'b& 8P+! hr$cP9 ( ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fYRunOncep**hr$ E'b& 8P3! hr$cP9 ( ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fYActiveSetupS**hr$ E'b& 8P3! hr$cP9 ( ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fYActiveSetupo**hr$ E'b& 8PC! hr$cP9 ( ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fY(WaitForMSAConnectedW**hr$ E'b& 8PC! hr$cP9 ( ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fY(WaitForMSAConnectedt**hr$ E'b& 8PG! hr$cP9 ( ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fY,PreConfigLauncherSync**hr$ E'b& 8PG! hr$cP9 ( ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fY,PreConfigLauncherSyncros**hr$ E'b& 8PG! hr$cP9 ( ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fY,PreDesktopSwitchTasks _,ڰ**hr$ E'b& 8P;! hr$cP9 ( ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fY PerUserServices**hr$ E'b& 8P;! hr$cP9 ( ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fY PerUserServices-**hr$ E'b& 8P7! hr$cP9 ( ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fYPreShellTaskse\M**hr$ E'b& 8PE! hr$cP9 ( ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fY*RoamingPayloads0and1iona**hr$ E'b& 8PE! hr$cP9 ( ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fY*RoamingPayloads0and1ws-S**hr$ E'b& 8PO! hr$cP9 ( ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fY4AppReadinessPreShellGroupCor**hr$ E'b& 8P3! hr$cP9 ( ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fYAppResolver**t$ E'b& 8P!mm t$cP9 ( ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational EYB EYM~q; g&h\8A'`=Scenario A!`=Flags  Mic**t$ E'b& 8P3! t$ 9P9 ( ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fYAppResolver**t$ E'b& 8P7! t$ 9P9 ( ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fYPreShellTasks**t$ E'b& 8P9! t$ 9P9 @ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fYShellInitTasksP**t$ E'b& 8P9! t$ 9P9 @ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fYShellInitTasks**F $ E'b& 8P7! F $AP9 @ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fYPreStartTasksQR**F $ E'b& 8P;! F $AP9 @ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fY RoamingPayload2S**F $ E'b& 8PI! F $AP9 @ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fY.AppReadinessLogonGroupor**F $ E'b& 8P=! F $AP9 @ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fY"UpdatePCSettings2T**F $ E'b& 8P=! F $AP9 @ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fY"UpdatePCSettings|DQR**F $ E'b& 8P;! F $AP9 @ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fY RoamingPayload2S**F $ E'b& 8PI! F $AP9 @ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fY.AppReadinessLogonGroupor**F $ E'b& 8P7! F $AP9 @ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fYPreStartTasksCor**F $ E'b& 8P7! F $AP9 @ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fYAllLogonTaskss-S**F $ E'b& 8P;! F $AP9  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fY RoamingPayload3l**F $ E'b& 8P;! F $AP9  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fY RoamingPayload3r**m$ E'b& 8P[! m$AP9  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fY@AppReadinessNotifyLogonCompletep**m$ E'b& 8P[! m$AP9  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fY@AppReadinessNotifyLogonComplete**m$ E'b& 8PE! m$AP9 T ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fY*ARSFirstRunTelemetryRu**m$ E'b& 8PE! m$AP9 T ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fY*ARSFirstRunTelemetryU**dk$ E'b& 8P9!nqm dk$9 R-YCg@y  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational & d&| p)c8齠**x%r$ E'b& 8P!nrm %r$9 R-YCg@y  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational & detux**=y$ E'b& 8Pk!mm =y$9 R-YCg@y  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational :R%!g:R%&Gm3}8A1`#= ItemsExisting A+`= ItemsAdded A/`!= ItemsRemoved A/`!= ItemsUpdated A-`= ItemsCached XYo** $ E'b& 8Po!%% $9 R-YCg@y  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational \Software\Microsoft\Windows\CurrentVersion\Run/Op** $ E'b& 8P!%% $9 R-YCg@y  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational _,ںi z"C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusraunc**7$ E'b& 8P!%% 7$9 R-YCg@y  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational m. z`"C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusr**7$ E'b& 8Po!%% 7$9 R-YCg@y  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational \Software\Microsoft\Windows\CurrentVersion\RunP**7$ E'b& 8Po!%% 7$9 R-YCg@y  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational \Software\Microsoft\Windows\CurrentVersion\Run ^**7$ E'b& 8P!%% 7$9 R-YCg@y  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational _,ںi v"C:\galaxie\deploy\Tomcat6\bin\Tomcat6w.exe" //MS//Tomcat6ll**0$ E'b& 8P!%% 0$9 R-YCg@y  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational m. v "C:\galaxie\deploy\Tomcat6\bin\Tomcat6w.exe" //MS//Tomcat6ll**0$ E'b& 8Po!%% 0$9 R-YCg@y  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational \Software\Microsoft\Windows\CurrentVersion\Run f**0$ E'b& 8Pw!%% 0$9 R-YCg@y  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational dSoftware\Microsoft\Windows\CurrentVersion\RunOncelve**0$ E'b& 8Pw!%% 0$9 R-YCg@y  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational dSoftware\Microsoft\Windows\CurrentVersion\RunOnce** E'b& 8P7! /Py9h  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fYAllLogonTasks** E'b& 8PG! /Py9h  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fY,PreDesktopSwitchTasks8** E'b& 8P/! /Py9h  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fYShellPrep** E'b& 8P/! /Py9h  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fYShellPrep** E'b& 8PO! /Py9h  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fY4AppReadinessPreShellGroupP** E'b& 8P5! /Py9h  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fYSkydrivePrepP** E'b& 8P5! /Py9h  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fYSkydrivePrep** E'b& 8P+! /Py9h  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fYRunOnce** E'b& 8P+! /Py9h  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fYRunOnce** E'b& 8P3! /Py9h  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fYActiveSetup** E'b& 8P3! /Py9h  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fYActiveSetup** E'b& 8PC! /Py9h  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fY(WaitForMSAConnected** E'b& 8PC! /Py9h  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fY(WaitForMSAConnected** E'b& 8PG! /Py9h  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fY,PreConfigLauncherSync** E'b& 8PG! /Py9h  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fY,PreConfigLauncherSync** E'b& 8PG! /Py9h  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fY,PreDesktopSwitchTasks** E'b& 8P;! /Py9h  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fY PerUserServices** E'b& 8P;! /Py9h  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fY PerUserServices** E'b& 8P7! /Py9h  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fYPreShellTasksmet** E'b& 8PE! /Py9h  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fY*RoamingPayloads0and1E'b&**  E'b& 8PE! /Py9h   ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fY*RoamingPayloads0and1 de **  E'b& 8PO! /Py9h   ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fY4AppReadinessPreShellGrouposo**  E'b& 8P3! /Py9h   ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fYAppResolverl** Y E'b& 8P!mm Y/Py9h   ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational EYB t-W** Y E'b& 8P3! Y9Py9h   ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fYAppResolvero**Y E'b& 8P7! Y9Py9h  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fYPreShellTasks @**Y E'b& 8P9! Y9Py9h  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fYShellInitTasks**Y E'b& 8P9! Y9Py9h  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fYShellInitTasksn**UA E'b& 8P7! UAPy9h  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fYPreStartTasksoft**UA E'b& 8P;! UAPy9h  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fY RoamingPayload2a**UA E'b& 8PI! UAPy9h  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fY.AppReadinessLogonGroupso**UA E'b& 8P=! UAPy9h  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fY"UpdatePCSettingsMic**UA E'b& 8P=! UAPy9h  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fY"UpdatePCSettings x$**UA E'b& 8P;! UAPy9h  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fY RoamingPayload2**UA E'b& 8PI! UAPy9h  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fY.AppReadinessLogonGroup**UA E'b& 8P7! UAPy9h  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fYPreStartTasks**UA E'b& 8P7! UAPy9h  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fYAllLogonTasks**UA E'b& 8P;! UAPy9h  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fY RoamingPayload3**UA E'b& 8P;! UAPy9h  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fY RoamingPayload3**C E'b& 8P[! CPy9h 8 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fY@AppReadinessNotifyLogonComplete**C E'b& 8P[! CPy9h 8 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fY@AppReadinessNotifyLogonComplete**C E'b& 8PE! CPy9h  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fY*ARSFirstRunTelemetry8**C E'b& 8PE! CPy9h  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fY*ARSFirstRunTelemetry VL**x 2/ E'b& 8P!nqm 2/N)KWDh  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational & dPx**x! E'b& 8P!nrm N)KWDh ! ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational & dx**"}d E'b& 8P7!mm }dN)KWDh " ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational :R%!gXY**#CV E'b& 8Po!%% CVcﯰZK\aah # ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational \Software\Microsoft\Windows\CurrentVersion\Run q**$CV E'b& 8P!%% CVcﯰZK\aah $ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational _,ںi z"C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusrroso**%Z E'b& 8P!%% ZcﯰZK\aah % ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational m. z"C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusrft-W**&Z E'b& 8Po!%% ZcﯰZK\aah & ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational \Software\Microsoft\Windows\CurrentVersion\Run/Op**'Z E'b& 8Po!%% ZcﯰZK\aah ' ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational \Software\Microsoft\Windows\CurrentVersion\Run **(Z E'b& 8P!%% ZcﯰZK\aah ( ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational _,ںi v"C:\galaxie\deploy\Tomcat6\bin\Tomcat6w.exe" //MS//Tomcat6&**)c E'b& 8P!%% ccﯰZK\aah ) ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational m. v"C:\galaxie\deploy\Tomcat6\bin\Tomcat6w.exe" //MS//Tomcat6***c E'b& 8Po!%% ccﯰZK\aah * ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational \Software\Microsoft\Windows\CurrentVersion\Run **+c E'b& 8Pw!%% ccﯰZK\aah + ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational dSoftware\Microsoft\Windows\CurrentVersion\RunOnceoso**,c E'b& 8Pw!%% ccﯰZK\aah , ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational dSoftware\Microsoft\Windows\CurrentVersion\RunOnceCor**x-  E'b& 8P!nqm 9Py9h - ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational & dt-Wx**.  E'b& 8P;!mm 9Py9h . ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational 1c1cᆫ}Q4?A_|8A`=Name A!`=AppID A!`=Flags ^Command Prompt{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\cmd.exe**x/  E'b& 8P!nrm 9Py9h / ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational & dx**0k E'b& 8P7!mm k9Py9h 0 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational :R%!gXY**1V9 E'b& 8P7! V9]Pj7 1 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fYAllLogonTasks**2V9 E'b& 8PG! V9]Pj7 2 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fY,PreDesktopSwitchTasks**3V9 E'b& 8P/! V9]Pj7 3 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fYShellPrep**4V9 E'b& 8P/! V9]Pj7 4 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fYShellPrep'b&**5V9 E'b& 8PO! V9]Pj7 5 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fY4AppReadinessPreShellGroup**6V9 E'b& 8P5! V9]Pj7 6 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fYSkydrivePrep**7V9 E'b& 8P5! V9]Pj7 7 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fYSkydrivePrep**8V9 E'b& 8P+! V9]Pj7 8 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fYRunOnce**9V9 E'b& 8P+! V9]Pj7 9 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fYRunOnce**:V9 E'b& 8P3! V9]Pj7 : ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fYActiveSetup**;كV9 E'b& 8P3! كV9]Pj7 ; ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fYActiveSetupy**<كV9 E'b& 8PC! كV9]Pj7 < ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fY(WaitForMSAConnectedd**=كV9 E'b& 8PC! كV9]Pj7 = ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fY(WaitForMSAConnectedy**>كV9 E'b& 8PG! كV9]Pj7 > ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fY,PreConfigLauncherSyncine**?كV9 E'b& 8PG! كV9]Pj7 ? ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fY,PreConfigLauncherSyncAR**@كV9 E'b& 8PG! كV9]Pj7 @ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fY,PreDesktopSwitchTasksAR**AكV9 E'b& 8P;! كV9]Pj7 A ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fY PerUserServices**BكV9 E'b& 8P;! كV9]Pj7 B ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fY PerUserServices**CكV9 E'b& 8P7! كV9]Pj7 C ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fYPreShellTasksffElfChnkDDiE8`=f?mMF A;68&03**DكV9 E'b&E'bUa4UxLIDwEAM Eventjxmlns5http://schemas.microsoft.com/win/2004/08/events/eventoTSystemAY{Provider6F=KNameX)GuidAMzaEventID'X) Qualifiers " Version dLevelE{Task ?Opcode$fjKeywordsAP; TimeCreated'j<{ SystemTime .F EventRecordID A Correlation\FF ActivityIDmz5RelatedActivityID Am ExecutionHFF ProcessID9ThreadID "aChannel<F;nComputer FILF-APP-RECAB.SecurityfLUserID ! 8P! كV9]Pj7 D ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational ff6!yƒ8D EventDataA;`oData= LogonType A'`=TaskName *RoamingPayloads0and1**EكV9 E'b& 8PE! كV9]Pj7 E ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*RoamingPayloads0and1mman**FكV9 E'b& 8PO! كV9]Pj7 F ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f4AppReadinessPreShellGroupt-W**GكV9 E'b& 8P3! كV9]Pj7 G ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAppResolver**H28A%`=KeyName \Software\Microsoft\Windows\CurrentVersion\Run0**H`(\9 E'b& 8P!%% (\9M)kN@6?Y` ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational _,ں8_,ں # >28A%`=Command z"C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusrlH**xa<\9 E'b& 8P!%% <\9M)kN@6?Ya ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational m.A;qm.C HXOagbV8A`=PID A%`=Command zX"C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusrx**b<\9 E'b& 8Po!%% <\9M)kN@6?Yb ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational 6\Software\Microsoft\Windows\CurrentVersion\Run**c<\9 E'b& 8Po!%% <\9M)kN@6?Yc ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational 6\Software\Microsoft\Windows\CurrentVersion\Run8**d<\9 E'b& 8P!%% <\9M)kN@6?Yd ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational _,ں8v"C:\galaxie\deploy\Tomcat6\bin\Tomcat6w.exe" //MS//Tomcat6Ĥ**edN+]9 E'b& 8P!%% dN+]9M)kN@6?Ye ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational m.A;v|"C:\galaxie\deploy\Tomcat6\bin\Tomcat6w.exe" //MS//Tomcat6**fdN+]9 E'b& 8Po!%% dN+]9M)kN@6?Yf ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational 6\Software\Microsoft\Windows\CurrentVersion\Runs-S**gt+]9 E'b& 8Pw!%% t+]9M)kN@6?Yg ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational 6dSoftware\Microsoft\Windows\CurrentVersion\RunOncendo**ht+]9 E'b& 8Pw!%% t+]9M)kN@6?Yh ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational 6dSoftware\Microsoft\Windows\CurrentVersion\RunOnce**iV E'b& 8P7! VP^` i ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAllLogonTasks**jV E'b& 8PG! VP^` j ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreDesktopSwitchTasksRo**kV E'b& 8P/! VP^` k ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellPrep.**lV E'b& 8P/! VP^` l ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellPrepona**mV E'b& 8PO! VP^` m ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f4AppReadinessPreShellGroup**nV E'b& 8P5! VP^` n ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fSkydrivePrepl f**oV E'b& 8P5! VP^` o ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fSkydrivePrepl f**pV E'b& 8P+! VP^` p ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fRunOncer**q E'b& 8P+! P^` q ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fRunOnceS**r E'b& 8P3! P^` r ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fActiveSetupo**sY E'b& 8P3! YP^` s ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fActiveSetupW**tY E'b& 8PC! YP^` t ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f(WaitForMSAConnectedo**u&F E'b& 8PC! &FP^` u ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f(WaitForMSAConnectedc**v&F E'b& 8PG! &FP^` v ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreConfigLauncherSyncn30'**w&F E'b& 8PG! &FP^` w ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreConfigLauncherSyncn30'**x&F E'b& 8PG! &FP^` x ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreDesktopSwitchTasksn30'**y&F E'b& 8P;! &FP^` y ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f PerUserServices'**z&F E'b& 8P;! &FP^` z ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f PerUserServiceso**{&F E'b& 8P7! &FP^` { ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreShellTaskso**|&F E'b& 8PE! &FP^` | ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*RoamingPayloads0and1\Cur**}&F E'b& 8PE! &FP^` } ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*RoamingPayloads0and1ogra**~&F E'b& 8PO! &FP^` ~ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f4AppReadinessPreShellGroupCor**&F E'b& 8P3! &FP^`  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAppResolverW**0 E'b& 8P!mm 0P^`  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational EYq 9 **  E'b& 8P3! P^`  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAppResolver**  E'b& 8P7! P^`  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreShellTasksll**=B E'b& 8P9! =BP^`  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellInitTasksoy**i E'b& 8P9! iP^`  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellInitTasksor**C E'b& 8P7! C1P^`  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreStartTasksQR**C E'b& 8P;! C1P^`  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload2c**C E'b& 8PI! C1P^`  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f.AppReadinessLogonGrouph **C E'b& 8P=! C1P^`  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f"UpdatePCSettingsި**C E'b& 8P=! C1P^`  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f"UpdatePCSettingsy9h **C E'b& 8P;! C1P^`  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload2ޠ**C E'b& 8PI! C1P^`  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f.AppReadinessLogonGroupĤ**C E'b& 8P7! C1P^`  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreStartTasksޠ**mpE E'b& 8P7! mpE1P^`  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAllLogonTasksޠ**E E'b& 8P;! E1P^`T ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload3ޠ**E E'b& 8P;! E1P^`T ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload3** F E'b& 8P[! F1P^`  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f@AppReadinessNotifyLogonCompleteo** F E'b& 8P[! F1P^`  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f@AppReadinessNotifyLogonCompleteR**3F E'b& 8PE! 3F1P^`  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*ARSFirstRunTelemetryft-W**ZF E'b& 8PE! ZF1P^`  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*ARSFirstRunTelemetryindo**x E'b& 8P!nqm sQzmB}:I`l  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational &0Corx**6M E'b& 8P!mm 6MsQzmB}:I`l  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational 1c 1cᆫ}Q4?A_|8A`=Name A!`=AppID A!`=Flags h~dmarrer la journalisation de statistiques de la VMMicrosoft.AutoGenerated.{14A21382-6511-3324-B505-306A7D8FF83A}0**x2p E'b& 8P!nrm 2psQzmB}:I`l  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational &0!x**v! E'b& 8P7!mm v!sQzmB}:I`l  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational :R%3XY!**RV E'b& 8Po!%% RVsQzmB}:I`  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational 6\Software\Microsoft\Windows\CurrentVersion\Run**RV E'b& 8P!%% RVsQzmB}:I`  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational _,ں8z"C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusren30'**n E'b& 8P!%% nsQzmB}:I`  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational m.A;z"C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusrerat**n E'b& 8Po!%% nsQzmB}:I`  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational 6\Software\Microsoft\Windows\CurrentVersion\RunAp**n E'b& 8Po!%% nsQzmB}:I`  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational 6\Software\Microsoft\Windows\CurrentVersion\Run****n E'b& 8P!%% nsQzmB}:I`  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational _,ں8v"C:\galaxie\deploy\Tomcat6\bin\Tomcat6w.exe" //MS//Tomcat6P**8 E'b& 8P!%% 8E5FXg4`  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational m.A;vx "C:\galaxie\deploy\Tomcat6\bin\Tomcat6w.exe" //MS//Tomcat6ic**8 E'b& 8Po!%% 8E5FXg4`  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational 6\Software\Microsoft\Windows\CurrentVersion\Runn30'**0 E'b& 8Pw!%% 0E5FXg4`  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational 6dSoftware\Microsoft\Windows\CurrentVersion\RunOnceCor**0 E'b& 8Pw!%% 0E5FXg4`  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational 6dSoftware\Microsoft\Windows\CurrentVersion\RunOnceSta**{e/ E'b& 8P7! {e//PJ  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAllLogonTasksmin**{e/ E'b& 8PG! {e//PJ  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreDesktopSwitchTaskssLo**{e/ E'b& 8P/! {e//PJ  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellPrepUp**{e/ E'b& 8P/! {e//PJ  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellPrep**{e/ E'b& 8PO! {e//PJ  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f4AppReadinessPreShellGroupRo**{e/ E'b& 8P5! {e//PJ  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fSkydrivePrepAp**{e/ E'b& 8P5! {e//PJ  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fSkydrivePrepY**{e/ E'b& 8P+! {e//PJ  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fRunOncea**{e/ E'b& 8P+! {e//PJ  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fRunOncep**{e/ E'b& 8P3! {e//PJ  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fActiveSetupr**}e/ E'b& 8P3! }e//PJ  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fActiveSetupl**}e/ E'b& 8PC! }e//PJ  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f(WaitForMSAConnectedW**}e/ E'b& 8PC! }e//PJ  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f(WaitForMSAConnectedR**}e/ E'b& 8PG! }e//PJ  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreConfigLauncherSyncQR**}e/ E'b& 8PG! }e//PJ  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreConfigLauncherSyncQR**}e/ E'b& 8PG! }e//PJ  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreDesktopSwitchTasksCor**}e/ E'b& 8P;! }e//PJ  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f PerUserServices**}e/ E'b& 8P;! }e//PJ  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f PerUserServices**}e/ E'b& 8P7! }e//PJ  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreShellTaskss-S**}e/ E'b& 8PE! }e//PJ  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*RoamingPayloads0and1ws-S**!~e/ E'b& 8PE! !~e//PJ  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*RoamingPayloads0and1\aah **!~e/ E'b& 8PO! !~e//PJ  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f4AppReadinessPreShellGroup%**!~e/ E'b& 8P3! !~e//PJ  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAppResolver**+e/ E'b& 8P!mm +e//PJ  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational EYq .ex**ڠe/ E'b& 8P3! ڠe/PJ  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAppResolver**ڠe/ E'b& 8P7! ڠe/PJ  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreShellTasksMic**e/ E'b& 8P9! e/PJ X  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellInitTasks-W**e/ E'b& 8P9! e/PJ X  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellInitTasksah **Fe/ E'b& 8P7! Fe/WPJ X  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreStartTasks**Fe/ E'b& 8P;! Fe/WPJ X  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload2 **Fe/ E'b& 8PI! Fe/WPJ X  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f.AppReadinessLogonGrouppt**Fe/ E'b& 8P=! Fe/WPJ X  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f"UpdatePCSettingshell**Fe/ E'b& 8P=! Fe/WPJ X  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f"UpdatePCSettings!g**Fe/ E'b& 8P;! Fe/WPJ X  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload2**Fe/ E'b& 8PI! Fe/WPJ X  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f.AppReadinessLogonGroupPr**Fe/ E'b& 8P7! Fe/WPJ X  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreStartTasks**mue/ E'b& 8P7! mue/WPJ X  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAllLogonTasks**ye/ E'b& 8P;! ye/WPJ ,  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload3p**ye/ E'b& 8P;! ye/WPJ ,  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload3**e/ E'b& 8P[! e/WPJ  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f@AppReadinessNotifyLogonCompletei**e/ E'b& 8P[! e/WPJ  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f@AppReadinessNotifyLogonCompleteV**Ee/ E'b& 8PE! Ee/WPJ l ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*ARSFirstRunTelemetry**Nme/ E'b& 8PE! Nme/WPJ l ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*ARSFirstRunTelemetry**x)we/ E'b& 8P!nqm )we/ny+G& x  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational &0x**x@e/ E'b& 8P!nrm @e/ny+G& x  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational &0dx** ,e/ E'b& 8P7!mm ,e/ny+G& x  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational :R%3XYcte**e/ E'b& 8Po!%% e/'BMRN  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational 6\Software\Microsoft\Windows\CurrentVersion\Run**e/ E'b& 8P!%% e/'BMRN  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational _,ں8z"C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusr8**+e/ E'b& 8P!%% +e/'BMRN  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational m.A;zd "C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusr**+e/ E'b& 8Po!%% +e/'BMRN  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational 6\Software\Microsoft\Windows\CurrentVersion\Runs-S**+e/ E'b& 8Po!%% +e/'BMRN  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational 6\Software\Microsoft\Windows\CurrentVersion\Runt-Wdows-Shell-Core/Operational fYPreShellTasksffElfChnkffNs/8`=f?mMF)9 &Z]** +e/ E'b&E'bUa4UxLIDwEAM Eventjxmlns5http://schemas.microsoft.com/win/2004/08/events/eventoTSystemAY{Provider6F=KNameX)GuidAMzaEventID'X) Qualifiers " Version dLevelE{Task ?Opcode$fjKeywordsAP; TimeCreated'j<{ SystemTime .F EventRecordID A Correlation\FF ActivityIDmz5RelatedActivityID Am ExecutionHFF ProcessID9ThreadID "aChannel<F;nComputer FILF-APP-RECAB.SecurityfLUserID ! 8P !%% +e/'BMRN  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational _,ں_,ں # l`8D EventDataA7`oData=Command v"C:\galaxie\deploy\Tomcat6\bin\Tomcat6w.exe" //MS//Tomcat6كV **p:Be/ E'b& 8P !%% :Be/'BMRN  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational m. m.C HXOagbV8A`=PID A%`=Command v( "C:\galaxie\deploy\Tomcat6\bin\Tomcat6w.exe" //MS//Tomcat6op**0:Be/ E'b& 8P!%% :Be/'BMRN  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational  3"E>28A%`=KeyName \Software\Microsoft\Windows\CurrentVersion\Rune/Op0** aBe/ E'b& 8Pw!%% aBe/'BMRN  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational  dSoftware\Microsoft\Windows\CurrentVersion\RunOnceA** aBe/ E'b& 8Pw!%% aBe/'BMRN  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational  dSoftware\Microsoft\Windows\CurrentVersion\RunOnce**(sLN2 E'b& 8P! sLN2(P=9a ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational ff6!yƒpd8A)`= LogonType A'`=TaskName AllLogonTasks(**sLN2 E'b& 8PG! sLN2(P=9a ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreDesktopSwitchTasksP**sLN2 E'b& 8P/! sLN2(P=9a ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellPrep8**sLN2 E'b& 8P/! sLN2(P=9a ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellPrep**sLN2 E'b& 8PO! sLN2(P=9a ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f4AppReadinessPreShellGroup!**sLN2 E'b& 8P5! sLN2(P=9a ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fSkydrivePrep8**sLN2 E'b& 8P5! sLN2(P=9a ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fSkydrivePrep**sLN2 E'b& 8P+! sLN2(P=9a ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fRunOnce**?sLN2 E'b& 8P+! ?sLN2(P=9a ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fRunOnce**?sLN2 E'b& 8P3! ?sLN2(P=9a ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fActiveSetup**itLN2 E'b& 8P3! itLN2(P=9a ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fActiveSetupV**itLN2 E'b& 8PC! itLN2(P=9a ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f(WaitForMSAConnected**itLN2 E'b& 8PC! itLN2(P=9a ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f(WaitForMSAConnected**itLN2 E'b& 8PG! itLN2(P=9a ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreConfigLauncherSync**itLN2 E'b& 8PG! itLN2(P=9a ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreConfigLauncherSync'b&**uLN2 E'b& 8PG! uLN2(P=9a ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreDesktopSwitchTasks"V**uLN2 E'b& 8P;! uLN2(P=9a ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f PerUserServices**uLN2 E'b& 8P;! uLN2(P=9a ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f PerUserServices**uLN2 E'b& 8P7! uLN2(P=9a ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreShellTasks**uLN2 E'b& 8PE! uLN2(P=9a ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*RoamingPayloads0and1**uLN2 E'b& 8PE! uLN2(P=9a ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*RoamingPayloads0and1=**uLN2 E'b& 8PO! uLN2(P=9a ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f4AppReadinessPreShellGroup 2**uLN2 E'b& 8P3! uLN2(P=9a ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAppResolver**%vLN2 E'b& 8P!mm %vLN2(P=9a ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational EY)9 EYM~q; g&h\8A'`=Scenario A!`=Flags  -n ***vLN2 E'b& 8P3! *vLN2 P=9a ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAppResolver***vLN2 E'b& 8P7! *vLN2 P=9a ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreShellTasks**>vLN2 E'b& 8P9! >vLN2 P=9a|  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellInitTasks**>vLN2 E'b& 8P9! >vLN2 P=9a|  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellInitTasks**LN2 E'b& 8P7! LN2P=9a|  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreStartTasksTom**LN2 E'b& 8P;! LN2P=9a|  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload2i**LN2 E'b& 8PI! LN2P=9a|  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f.AppReadinessLogonGroupor**LN2 E'b& 8P=! LN2P=9a|  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f"UpdatePCSettingsaMic**LN2 E'b& 8P=! LN2P=9a|  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f"UpdatePCSettingsft-W**LN2 E'b& 8P;! LN2P=9a|  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload2**LN2 E'b& 8PI! LN2P=9a|  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f.AppReadinessLogonGroup**LN2 E'b& 8P7! LN2P=9a|  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreStartTasks`**bLN2 E'b& 8P7! bLN2P=9a|  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAllLogonTasks lߠ**bLN2 E'b& 8P;! bLN2P=9a  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload3**bLN2 E'b& 8P;! bLN2P=9a  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload3**vLN2 E'b& 8P[! vLN2P=9a ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f@AppReadinessNotifyLogonComplete**vLN2 E'b& 8P[! vLN2P=9a ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f@AppReadinessNotifyLogonCompleteo**LN2 E'b& 8PE! LN2P=9a  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*ARSFirstRunTelemetryhell**&LN2 E'b& 8PE! &LN2P=9a  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*ARSFirstRunTelemetryaMic**lRN2 E'b& 8P9!nqm lRN2 B ]F~r T ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational &Z&| p)c8so**xY"sRN2 E'b& 8P!nrm Y"sRN2 B ]F~r T ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational &ZCorx**8{RN2 E'b& 8Pk!mm 8{RN2 B ]F~r T ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational :R%]:R%&Gm3}8A1`#= ItemsExisting A+`= ItemsAdded A/`!= ItemsRemoved A/`!= ItemsUpdated A-`= ItemsCached XY**SN2 E'b& 8Po!%% SN2 B ]F~r  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational  \Software\Microsoft\Windows\CurrentVersion\Run w** SN2 E'b& 8P!%% SN2 B ]F~r   ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational _,ںz"C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusrws-S** w%$SN2 E'b& 8P!%% w%$SN2 B ]F~r   ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational m. z"C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusrhell** w%$SN2 E'b& 8Po!%% w%$SN2 B ]F~r   ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational  \Software\Microsoft\Windows\CurrentVersion\Run ** w%$SN2 E'b& 8Po!%% w%$SN2 B ]F~r   ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational  \Software\Microsoft\Windows\CurrentVersion\Run|** L$SN2 E'b& 8P!%% L$SN2 B ]F~r   ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational _,ںv"C:\galaxie\deploy\Tomcat6\bin\Tomcat6w.exe" //MS//Tomcat6**psSN2 E'b& 8P!%% psSN2 B ]F~r  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational m. v "C:\galaxie\deploy\Tomcat6\bin\Tomcat6w.exe" //MS//Tomcat6P**psSN2 E'b& 8Po!%% psSN2 B ]F~r  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational  \Software\Microsoft\Windows\CurrentVersion\Run**dtSN2 E'b& 8Pw!%% dtSN2 B ]F~r  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational  dSoftware\Microsoft\Windows\CurrentVersion\RunOnceCor**dtSN2 E'b& 8Pw!%% dtSN2 B ]F~r  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational  dSoftware\Microsoft\Windows\CurrentVersion\RunOncerat**s3 X E'b& 8P7! s3 XP~[Z  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAllLogonTasksona**s3 X E'b& 8PG! s3 XP~[Z  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreDesktopSwitchTasks**s3 X E'b& 8P/! s3 XP~[Z  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellPrep f**s3 X E'b& 8P/! s3 XP~[Z  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellPrepona**s3 X E'b& 8PO! s3 XP~[Z  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f4AppReadinessPreShellGroup **s3 X E'b& 8P5! s3 XP~[Z  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fSkydrivePrep.**s3 X E'b& 8P5! s3 XP~[Z  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fSkydrivePrepl f**s3 X E'b& 8P+! s3 XP~[Z  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fRunOncep**t64 X E'b& 8P+! t64 XP~[Z  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fRunOnceS**t64 X E'b& 8P3! t64 XP~[Z  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fActiveSetupo**7= X E'b& 8P3! 7= XP~[Z  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fActiveSetupc**7= X E'b& 8PC! 7= XP~[Z  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f(WaitForMSAConnectedo**7= X E'b& 8PC! 7= XP~[Z  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f(WaitForMSAConnectedW**7= X E'b& 8PG! 7= XP~[Z  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreConfigLauncherSyncs-S** 7= X E'b& 8PG! 7= XP~[Z   ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreConfigLauncherSyncCor**!7= X E'b& 8PG! 7= XP~[Z ! ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreDesktopSwitchTaskss-S**"7= X E'b& 8P;! 7= XP~[Z " ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f PerUserServicesc**#7= X E'b& 8P;! 7= XP~[Z # ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f PerUserServices'**$7= X E'b& 8P7! 7= XP~[Z $ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreShellTasksell**%7= X E'b& 8PE! 7= XP~[Z % ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*RoamingPayloads0and1indo**&5^= X E'b& 8PE! 5^= XP~[Z & ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*RoamingPayloads0and14-B5**'5^= X E'b& 8PO! 5^= XP~[Z ' ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f4AppReadinessPreShellGroup**(5^= X E'b& 8P3! 5^= XP~[Z ( ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAppResolver**)9B X E'b& 8P!mm 9B XP~[Z ) ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational EY)9 cro***dB X E'b& 8P3! dB X ZP~[Z * ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAppResolverp**+dB X E'b& 8P7! dB X ZP~[Z + ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreShellTasksell**,lB X E'b& 8P9! lB X ZP~[Z  , ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellInitTasksB**-lB X E'b& 8P9! lB X ZP~[Z  - ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellInitTasks**., X E'b& 8P7! , XP~[Z  . ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreStartTasks'b&**/, X E'b& 8P;! , XP~[Z  / ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload2x**0, X E'b& 8PI! , XP~[Z  0 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f.AppReadinessLogonGroupga**1, X E'b& 8P=! , XP~[Z  1 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f"UpdatePCSettingsws-S**2, X E'b& 8P=! , XP~[Z  2 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f"UpdatePCSettingsen30'**3, X E'b& 8P;! , XP~[Z  3 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload2**4, X E'b& 8PI! , XP~[Z  4 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f.AppReadinessLogonGroupP**5, X E'b& 8P7! , XP~[Z  5 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreStartTasksP**6ݻ X E'b& 8P7! ݻ XP~[Z  6 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAllLogonTasks Р**7[ X E'b& 8P;! [ XP~[Z 7 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload3**8[ X E'b& 8P;! [ XP~[Z 8 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload3**9G  X E'b& 8P[! G  XP~[Z 9 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f@AppReadinessNotifyLogonComplete **:G  X E'b& 8P[! G  XP~[Z : ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f@AppReadinessNotifyLogonComplete**;& X E'b& 8PE! & XP~[Z p; ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*ARSFirstRunTelemetryMic**<& X E'b& 8PE! & XP~[Z p< ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*ARSFirstRunTelemetryws-S**x=78 X E'b& 8P!nqm 78 XuH&wْ = ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational &Zosox**x>@= X E'b& 8P!nrm @= XuH&wْ > ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational &Zx**?U~E X E'b& 8P7!mm U~E XuH&wْ ? ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational :R%]XY ذĤ**@[) X E'b& 8Po!%% [) XuH&wْ @ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational  \Software\Microsoft\Windows\CurrentVersion\Runs-S**A[) X E'b& 8P!%% [) XuH&wْ A ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational _,ںz"C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusrhell**B( X E'b& 8P!%% ( XuH&wْ B ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational m. z "C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusrfigL**C( X E'b& 8Po!%% ( XuH&wْ C ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational  \Software\Microsoft\Windows\CurrentVersion\Run****D( X E'b& 8Po!%% ( XuH&wْ D ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational  \Software\Microsoft\Windows\CurrentVersion\Run**E( X E'b& 8P!%% ( XuH&wْ E ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational _,ںv"C:\galaxie\deploy\Tomcat6\bin\Tomcat6w.exe" //MS//Tomcat6/**FZ X E'b& 8P!%% Z XuH&wْ F ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational m. vX "C:\galaxie\deploy\Tomcat6\bin\Tomcat6w.exe" //MS//Tomcat6do**GZ X E'b& 8Po!%% Z XuH&wْ G ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational  \Software\Microsoft\Windows\CurrentVersion\RunQR**HZ X E'b& 8Pw!%% Z XuH&wْ H ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational  dSoftware\Microsoft\Windows\CurrentVersion\RunOnceell**IZ X E'b& 8Pw!%% Z XuH&wْ I ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational  dSoftware\Microsoft\Windows\CurrentVersion\RunOnce f**JZ뗐x[ E'b& 8P7! Z뗐x[P~" J ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAllLogonTasks**KZ뗐x[ E'b& 8PG! Z뗐x[P~" K ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreDesktopSwitchTasks**LZ뗐x[ E'b& 8P/! Z뗐x[P~" L ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellPrepks**MZ뗐x[ E'b& 8P/! Z뗐x[P~" M ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellPrepitT**NZ뗐x[ E'b& 8PO! Z뗐x[P~" N ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f4AppReadinessPreShellGroup****OZ뗐x[ E'b& 8P5! Z뗐x[P~" O ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fSkydrivePrep****PZ뗐x[ E'b& 8P5! Z뗐x[P~" P ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fSkydrivePrep****QZ뗐x[ E'b& 8P+! Z뗐x[P~" Q ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fRunOnceo**RMx[ E'b& 8P+! Mx[P~" R ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fRunOnce**SMx[ E'b& 8P3! Mx[P~" S ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fActiveSetup**T쯜x[ E'b& 8P3! 쯜x[P~" T ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fActiveSetupt**U쯜x[ E'b& 8PC! 쯜x[P~" U ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f(WaitForMSAConnecteda**V쯜x[ E'b& 8PC! 쯜x[P~" V ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f(WaitForMSAConnectedt**W쯜x[ E'b& 8PG! 쯜x[P~" W ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreConfigLauncherSync f**X쯜x[ E'b& 8PG! 쯜x[P~" X ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreConfigLauncherSync **Y쯜x[ E'b& 8PG! 쯜x[P~" Y ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreDesktopSwitchTasksmin**Z쯜x[ E'b& 8P;! 쯜x[P~" Z ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f PerUserServicesa**[쯜x[ E'b& 8P;! 쯜x[P~" [ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f PerUserServices**\쯜x[ E'b& 8P7! 쯜x[P~" \ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreShellTasksCor**]쯜x[ E'b& 8PE! 쯜x[P~" ] ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*RoamingPayloads0and1-Cor**^쯜x[ E'b& 8PE! 쯜x[P~" ^ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*RoamingPayloads0and1-Cor**_쯜x[ E'b& 8PO! 쯜x[P~" _ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f4AppReadinessPreShellGroup**`쯜x[ E'b& 8P3! 쯜x[P~" ` ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAppResolver**ax[ E'b& 8P!mm x[P~" a ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational EY)9 cro**bx[ E'b& 8P3! x["P~" b ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAppResolverp**cx[ E'b& 8P7! x["P~" c ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreShellTasksell**dx[ E'b& 8P9! x["P~" d ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellInitTasksM**ex[ E'b& 8P9! x["P~" e ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellInitTasks**f˛x[ E'b& 8P7! ˛x[P~" f ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreStartTasks/Opational fYPreShellTasksffElfChnkgg 6 Gv8`=f?mMFq)mYo&AgYj**g˛x[ E'b&E'bUa4UxLIDwEAM Eventjxmlns5http://schemas.microsoft.com/win/2004/08/events/eventoTSystemAY{Provider6F=KNameX)GuidAMzaEventID'X) Qualifiers " Version dLevelE{Task ?Opcode$fjKeywordsAP; TimeCreated'j<{ SystemTime .F EventRecordID A Correlation\FF ActivityIDmz5RelatedActivityID Am ExecutionHFF ProcessID9ThreadID "aChannel<F;nComputer FILF-APP-RECAB.SecurityfLUserID ! 8P! ˛x[P~" g ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational ff6!yƒ8D EventDataA;`oData= LogonType A'`=TaskName  RoamingPayload2/M**h˛x[ E'b& 8PI! ˛x[P~" h ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f.AppReadinessLogonGroup**i˛x[ E'b& 8P=! ˛x[P~" i ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f"UpdatePCSettingsi 2**j˛x[ E'b& 8P=! ˛x[P~" j ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f"UpdatePCSettings**k˛x[ E'b& 8P;! ˛x[P~" k ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload2**l˛x[ E'b& 8PI! ˛x[P~" l ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f.AppReadinessLogonGroupur**m˛x[ E'b& 8P7! ˛x[P~" m ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreStartTasks**n-x[ E'b& 8P7! -x[P~" n ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAllLogonTasksndo**o:x[ E'b& 8P;! :x[P~" o ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload3o**p:x[ E'b& 8P;! :x[P~" p ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload3W**q:x[ E'b& 8P[! :x[P~" q ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f@AppReadinessNotifyLogonComplete'**r:x[ E'b& 8P[! :x[P~" r ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f@AppReadinessNotifyLogonCompleteR**s:x[ E'b& 8PE! :x[P~" Ls ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*ARSFirstRunTelemetryroso**t:x[ E'b& 8PE! :x[P~" Lt ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*ARSFirstRunTelemetryindo**u| Ct E'b& 8P7! | CtP8  u ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAllLogonTasksell**v| Ct E'b& 8PG! | CtP8  v ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreDesktopSwitchTasksona**w| Ct E'b& 8P/! | CtP8  w ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellPrepona**x| Ct E'b& 8P/! | CtP8  x ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellPrepona**y| Ct E'b& 8PO! | CtP8  y ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f4AppReadinessPreShellGroup**z| Ct E'b& 8P5! | CtP8  z ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fSkydrivePrepl f**{| Ct E'b& 8P5! | CtP8  { ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fSkydrivePreperat**|| Ct E'b& 8P+! | CtP8  | ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fRunOnceS**}| Ct E'b& 8P+! | CtP8  } ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fRunOncec**~| Ct E'b& 8P3! | CtP8  ~ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fActiveSetupR**$ Ct E'b& 8P3! $ CtbS[7^@|8"8   ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fActiveSetup'**$ Ct E'b& 8PC! $ CtbS[7^@|8"8   ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f(WaitForMSAConnectedR**$ Ct E'b& 8PC! $ CtbS[7^@|8"8   ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f(WaitForMSAConnected'**$ Ct E'b& 8PG! $ CtbS[7^@|8"8   ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreConfigLauncherSyncn30'**$ Ct E'b& 8PG! $ CtbS[7^@|8"8   ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreConfigLauncherSyncCor**$ Ct E'b& 8PG! $ CtbS[7^@|8"8   ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreDesktopSwitchTasksMic**$ Ct E'b& 8P;! $ CtbS[7^@|8"8   ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f PerUserServices**$ Ct E'b& 8P;! $ CtbS[7^@|8"8   ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f PerUserServices**$ Ct E'b& 8P7! $ CtbS[7^@|8"8   ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreShellTasks**$ Ct E'b& 8PE! $ CtbS[7^@|8"8   ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*RoamingPayloads0and1i 2**$ Ct E'b& 8PE! $ CtbS[7^@|8"8   ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*RoamingPayloads0and1roso**$ Ct E'b& 8PO! $ CtbS[7^@|8"8   ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f4AppReadinessPreShellGroups-S**$ Ct E'b& 8P3! $ CtbS[7^@|8"8   ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAppResolvero**kCt E'b& 8P!mm kCtbS[7^@|8"8   ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational EYEEYM~q; g&h\8A'`=Scenario A!`=Flags  ell**&Ct E'b& 8P3! &CtP8   ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAppResolvero**&Ct E'b& 8P7! &CtP8   ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreShellTaskst-W**tCt E'b& 8P9! tCtP8  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellInitTasks-W**tCt E'b& 8P9! tCtP8  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellInitTasksic**7Ct E'b& 8P7! 7CtP8  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreStartTasksMic**7Ct E'b& 8P;! 7CtP8  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload2c**7Ct E'b& 8PI! 7CtP8  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f.AppReadinessLogonGroup-W**7Ct E'b& 8P=! 7CtP8  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f"UpdatePCSettingsindo**7Ct E'b& 8P=! 7CtP8  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f"UpdatePCSettingsaMic**7Ct E'b& 8P;! 7CtP8  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload2l**7Ct E'b& 8PI! 7CtP8  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f.AppReadinessLogonGroupll**7Ct E'b& 8P7! 7CtP8  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreStartTasksndo**8Dt E'b& 8P7! 8DtP8  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAllLogonTasksndo**_Dt E'b& 8P;! _DtP8 P  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload3R**_Dt E'b& 8P;! _DtP8 P  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload3**h Dt E'b& 8P[! h DtP8  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f@AppReadinessNotifyLogonCompleten**h Dt E'b& 8P[! h DtP8  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f@AppReadinessNotifyLogonCompletea**#Dt E'b& 8PE! #DtP8  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*ARSFirstRunTelemetryhell**qDt E'b& 8PE! qDtP8  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*ARSFirstRunTelemetryws-S**It E'b& 8P9!nqm ItЬa&O{8  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational &Ag&| p)c8**x It E'b& 8P!nrm ItЬa&O{8  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational &Agx**?It E'b& 8Pk!mm ?ItЬa&O{8  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational :R%Yj:R%&Gm3}8A1`#= ItemsExisting A+`= ItemsAdded A/`!= ItemsRemoved A/`!= ItemsUpdated A-`= ItemsCached XYS**0~8Jt E'b& 8P!%% ~8JtЬa&O{8 ( ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational )m3"E>28A%`=KeyName \Software\Microsoft\Windows\CurrentVersion\Run 0**H~8Jt E'b& 8P!%% ~8JtЬa&O{8 ( ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational _,ںYo_,ں # >28A%`=Command z"C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusrrH**x>Jt E'b& 8P!%% >JtЬa&O{8 ( ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational m.qEm.C HXOagbV8A`=PID A%`=Command z "C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusrPx**>Jt E'b& 8Po!%% >JtЬa&O{8 ( ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational )m\Software\Microsoft\Windows\CurrentVersion\RunMic**>Jt E'b& 8Po!%% >JtЬa&O{8 ( ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational )m\Software\Microsoft\Windows\CurrentVersion\Runell**>Jt E'b& 8P!%% >JtЬa&O{8 ( ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational _,ںYov"C:\galaxie\deploy\Tomcat6\bin\Tomcat6w.exe" //MS//Tomcat6Op**[Jt E'b& 8P!%% [Jt0H?MweLQ8 ( ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational m.qv "C:\galaxie\deploy\Tomcat6\bin\Tomcat6w.exe" //MS//Tomcat6p**[Jt E'b& 8Po!%% [Jt0H?MweLQ8 ( ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational )m\Software\Microsoft\Windows\CurrentVersion\Run**ނJt E'b& 8Pw!%% ނJt0H?MweLQ8 ( ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational )mdSoftware\Microsoft\Windows\CurrentVersion\RunOnceP**ނJt E'b& 8Pw!%% ނJt0H?MweLQ8 ( ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational )mdSoftware\Microsoft\Windows\CurrentVersion\RunOnce ذĤ**} E'b& 8P7! }PhSt  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAllLogonTasksMic**} E'b& 8PG! }PhSt  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreDesktopSwitchTasksndo**} E'b& 8P/! }PhSt  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellPrepndo**} E'b& 8P/! }PhSt  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellPreposo**} E'b& 8PO! }PhSt  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f4AppReadinessPreShellGroupndo**} E'b& 8P5! }PhSt  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fSkydrivePreproso**} E'b& 8P5! }PhSt  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fSkydrivePrepi 2**} E'b& 8P+! }PhSt  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fRunOnce**} E'b& 8P+! }PhSt  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fRunOnce**} E'b& 8P3! }PhSt  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fActiveSetup**f E'b& 8P3! fPhSt  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fActiveSetup7**f E'b& 8PC! fPhSt  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f(WaitForMSAConnected**f E'b& 8PC! fPhSt  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f(WaitForMSAConnected**f E'b& 8PG! fPhSt  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreConfigLauncherSyncP**f E'b& 8PG! fPhSt  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreConfigLauncherSync 9**f E'b& 8PG! fPhSt  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreDesktopSwitchTasks**f E'b& 8P;! fPhSt  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f PerUserServices**f E'b& 8P;! fPhSt  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f PerUserServices**f E'b& 8P7! fPhSt  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreShellTasks**f E'b& 8PE! fPhSt  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*RoamingPayloads0and1i 2**3 E'b& 8PE! 3PhSt  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*RoamingPayloads0and1roso**3 E'b& 8PO! 3PhSt  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f4AppReadinessPreShellGroups-S**3 E'b& 8P3! 3PhSt  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAppResolvero**3 E'b& 8P!mm 3PhSt  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational EYE **3 E'b& 8P3! 3 PhSt  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAppResolver**3 E'b& 8P7! 3 PhSt  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreShellTasks 4**3 E'b& 8P9! 3 PhS  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellInitTasksP**3 E'b& 8P9! 3 PhS  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellInitTasksP**G E'b& 8P7! GKPhS  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreStartTasksP**G E'b& 8P;! GKPhS  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload2**G E'b& 8PI! GKPhS  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f.AppReadinessLogonGroup9**G E'b& 8P=! GKPhS  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f"UpdatePCSettings X**G E'b& 8P=! GKPhS  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f"UpdatePCSettingsE!**G E'b& 8P;! GKPhS  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload2**G E'b& 8PI! GKPhS  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f.AppReadinessLogonGroup8**G E'b& 8P7! GKPhS  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreStartTasksX** E'b& 8P7! KPhS  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAllLogonTasks** E'b& 8P;! KPhS ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload3** E'b& 8P;! KPhS ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload3**  E'b& 8P[! KPhS ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f@AppReadinessNotifyLogonComplete**  E'b& 8P[! KPhS ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f@AppReadinessNotifyLogonComplete**  E'b& 8PE! KPhS ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*ARSFirstRunTelemetryrent**  E'b& 8PE! KPhS ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*ARSFirstRunTelemetryicro**x{ E'b& 8P!nqm {O'8D^#ŒH ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational &Agndox**x E'b& 8P!nrm O'8D^#ŒH ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational &Agx**N E'b& 8P7!mm NO'8D^#ŒH ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational :R%YjXY** E'b& 8Po!%% O'8D^#Œ  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational )m\Software\Microsoft\Windows\CurrentVersion\Run** E'b& 8P!%% O'8D^#Œ  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational _,ںYoz"C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusrw!**`x E'b& 8P!%% `xO'8D^#Œ  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational m.qzh "C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusrP**`x E'b& 8Po!%% `xO'8D^#Œ  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational )m\Software\Microsoft\Windows\CurrentVersion\RunMic**`x E'b& 8Po!%% `xO'8D^#Œ  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational )m\Software\Microsoft\Windows\CurrentVersion\Runell**`x E'b& 8P!%% `xO'8D^#Œ  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational _,ںYov"C:\galaxie\deploy\Tomcat6\bin\Tomcat6w.exe" //MS//Tomcat6Op**V E'b& 8P!%% VaqSMշ!ep  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational m.qvH"C:\galaxie\deploy\Tomcat6\bin\Tomcat6w.exe" //MS//Tomcat6p**V E'b& 8Po!%% VaqSMշ!ep  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational )m\Software\Microsoft\Windows\CurrentVersion\Run**YV E'b& 8Pw!%% YVaqSMշ!ep  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational )mdSoftware\Microsoft\Windows\CurrentVersion\RunOnceP**YV E'b& 8Pw!%% YVaqSMշ!ep  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational )mdSoftware\Microsoft\Windows\CurrentVersion\RunOnce ذĤ**Gk E'b& 8P7! Gk*PQ[t  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAllLogonTasksMic**Gk E'b& 8PG! Gk*PQ[t  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreDesktopSwitchTasksndo**Gk E'b& 8P/! Gk*PQ[t  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellPrepndo**Gk E'b& 8P/! Gk*PQ[t  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellPreposo**Gk E'b& 8PO! Gk*PQ[t  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f4AppReadinessPreShellGroupndo**Gk E'b& 8P5! Gk*PQ[t  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fSkydrivePreproso**Gk E'b& 8P5! Gk*PQ[t  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fSkydrivePrepi 2**Gk E'b& 8P+! Gk*PQ[t  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fRunOnce**Gk E'b& 8P+! Gk*PQ[t  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fRunOnce**Gk E'b& 8P3! Gk*PQ[t  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fActiveSetup**k E'b& 8P3! k*PQ[t  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fActiveSetup**k E'b& 8PC! k*PQ[t  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f(WaitForMSAConnected**k E'b& 8PC! k*PQ[t  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f(WaitForMSAConnected**k E'b& 8PG! k*PQ[t  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreConfigLauncherSyncP**k E'b& 8PG! k*PQ[t  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreConfigLauncherSync **k E'b& 8PG! k*PQ[t  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreDesktopSwitchTasks**k E'b& 8P;! k*PQ[t  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f PerUserServices**k E'b& 8P;! k*PQ[t  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f PerUserServices**k E'b& 8P7! k*PQ[t  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreShellTasks**k E'b& 8PE! k*PQ[t  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*RoamingPayloads0and1i 2icrosoft-Win E'b& 8Pell-Core/Operational fPreStartTasks/Opational fYPreShellTasksffElfChnk   r>8`=f?mMFY95I7&1/I2**k E'b&E'bUa4UxLIDwEAM Eventjxmlns5http://schemas.microsoft.com/win/2004/08/events/eventoTSystemAY{Provider6F=KNameX)GuidAMzaEventID'X) Qualifiers " Version dLevelE{Task ?Opcode$fjKeywordsAP; TimeCreated'j<{ SystemTime .F EventRecordID A Correlation\FF ActivityIDmz5RelatedActivityID Am ExecutionHFF ProcessID9ThreadID "aChannel<F;nComputer FILF-APP-RECAB.SecurityfLUserID ! 8P! k*PQ[t  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational ff6!yƒ8D EventDataA;`oData= LogonType A'`=TaskName *RoamingPayloads0and1**k E'b& 8PO! k*PQ[t  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f4AppReadinessPreShellGroupi**k E'b& 8P3! k*PQ[t  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAppResolver**k E'b& 8P!mm k*PQ[t  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational EY EYM~q; g&h\8A'`=Scenario A!`=Flags  **k E'b& 8P3! k[PQ[t  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAppResolver**k E'b& 8P7! k[PQ[t  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreShellTasks**k E'b& 8P9! k[PQ[t D ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellInitTasks**k E'b& 8P9! k[PQ[t D ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellInitTasks**V{k E'b& 8P7! V{kPQ[t D ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreStartTasks**V{k E'b& 8P;! V{kPQ[t D ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload2**V{k E'b& 8PI! V{kPQ[t D ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f.AppReadinessLogonGroup**V{k E'b& 8P=! V{kPQ[t D ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f"UpdatePCSettings[**V{k E'b& 8P=! V{kPQ[t D ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f"UpdatePCSettings:**V{k E'b& 8P;! V{kPQ[t D ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload2**V{k E'b& 8PI! V{kPQ[t D ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f.AppReadinessLogonGroup| C**V{k E'b& 8P7! V{kPQ[t D ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreStartTasks**** .~k E'b& 8P7! .~kPQ[t D  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAllLogonTasksx** .~k E'b& 8P;! .~kPQ[t X  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload3C** .~k E'b& 8P;! .~kPQ[t X  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload3** .~k E'b& 8P[! .~kPQ[t H  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f@AppReadinessNotifyLogonComplete** .~k E'b& 8P[! .~kPQ[t H  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f@AppReadinessNotifyLogonComplete**쏀k E'b& 8PE! 쏀kPQ[t  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*ARSFirstRunTelemetry**쏀k E'b& 8PE! 쏀kPQ[t  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*ARSFirstRunTelemetry**ٕk E'b& 8P9!nqm ٕkөgRS2MTOD4t , ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational &1/&| p)c8 $Ǡ**x,k E'b& 8P!nrm ,kөgRS2MTOD4t , ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational &1/8x**0k E'b& 8Pk!mm 0kөgRS2MTOD4t , ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational :R%I2:R%&Gm3}8A1`#= ItemsExisting A+`= ItemsAdded A/`!= ItemsRemoved A/`!= ItemsUpdated A-`= ItemsCached XYA**0`k E'b& 8P!%% `kөgRS2MTOD4t  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational 53"E>28A%`=KeyName \Software\Microsoft\Windows\CurrentVersion\Run80**H`k E'b& 8P!%% `kөgRS2MTOD4t  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational _,ںI7_,ں # >28A%`=Command z"C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusrrH**xk E'b& 8P!%% kөgRS2MTOD4t  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational m.9 m.C HXOagbV8A`=PID A%`=Command z<"C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusr'b&x**k E'b& 8Po!%% kөgRS2MTOD4t  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational 5\Software\Microsoft\Windows\CurrentVersion\Run**k E'b& 8Po!%% kөgRS2MTOD4t  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational 5\Software\Microsoft\Windows\CurrentVersion\Run7^@**k E'b& 8P!%% kөgRS2MTOD4t  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational _,ںI7v"C:\galaxie\deploy\Tomcat6\bin\Tomcat6w.exe" //MS//Tomcat6so**@ԏk E'b& 8P!%% @ԏkөgRS2MTOD4t  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational m.9v0"C:\galaxie\deploy\Tomcat6\bin\Tomcat6w.exe" //MS//Tomcat6so**@ԏk E'b& 8Po!%% @ԏkөgRS2MTOD4t  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational 5\Software\Microsoft\Windows\CurrentVersion\Runell**\ԏk E'b& 8Pw!%% \ԏkөgRS2MTOD4t  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational 5dSoftware\Microsoft\Windows\CurrentVersion\RunOnce**\ԏk E'b& 8Pw!%% \ԏkөgRS2MTOD4t  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational 5dSoftware\Microsoft\Windows\CurrentVersion\RunOnceona**>m E'b& 8P7! >mPQ[ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAllLogonTasks f**>m E'b& 8PG! >mPQ[ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreDesktopSwitchTasks**>m E'b& 8P/! >mPQ[ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellPrep** >m E'b& 8P/! >mPQ[  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellPrep f**!>m E'b& 8PO! >mPQ[! ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f4AppReadinessPreShellGroupRo**">m E'b& 8P5! >mPQ[" ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fSkydrivePrepAp**#>m E'b& 8P5! >mPQ[# ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fSkydrivePrep**$>m E'b& 8P+! >mPQ[$ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fRunOncet**%>m E'b& 8P+! >mPQ[% ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fRunOncel**&>m E'b& 8P3! >mPQ[& ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fActiveSetupS**'5m E'b& 8P3! 5mPQ[' ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fActiveSetupo**(5m E'b& 8PC! 5mPQ[( ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f(WaitForMSAConnectedW**)5m E'b& 8PC! 5mPQ[) ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f(WaitForMSAConnectedo***5m E'b& 8PG! 5mPQ[* ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreConfigLauncherSyncell**+5m E'b& 8PG! 5mPQ[+ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreConfigLauncherSync/Op**,5m E'b& 8PG! 5mPQ[, ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreDesktopSwitchTasksell**-5m E'b& 8P;! 5mPQ[- ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f PerUserServiceso**.5m E'b& 8P;! 5mPQ[. ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f PerUserServicesR**/5m E'b& 8P7! 5mPQ[/ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreShellTasksCor**05m E'b& 8PE! 5mPQ[0 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*RoamingPayloads0and1|DQR**1\m E'b& 8PE! \mPQ[1 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*RoamingPayloads0and1-Cor**2\m E'b& 8PO! \mPQ[2 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f4AppReadinessPreShellGroup**3\m E'b& 8P3! \mPQ[3 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAppResolver\**4m E'b& 8P!mm mPQ[4 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational EY  oso**5m E'b& 8P3! mPQ[5 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAppResolver**6m E'b& 8P7! mPQ[6 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreShellTasksm F**7m E'b& 8P9! mPQ[7 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellInitTasks-S**8m E'b& 8P9! mPQ[8 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellInitTasksor**9om E'b& 8P7! om*PQ[9 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreStartTasks 2**:om E'b& 8P;! om*PQ[: ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload2**;om E'b& 8PI! om*PQ[; ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f.AppReadinessLogonGroup**<om E'b& 8P=! om*PQ[< ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f"UpdatePCSettings**=om E'b& 8P=! om*PQ[= ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f"UpdatePCSettingsdows**>om E'b& 8P;! om*PQ[> ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload2**?om E'b& 8PI! om*PQ[? ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f.AppReadinessLogonGroup-S**@om E'b& 8P7! om*PQ[@ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreStartTaskss-S**Am E'b& 8P7! m*PQ[A ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAllLogonTaskst-W**Bm E'b& 8P;! m*PQ[B ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload3o**Cm E'b& 8P;! m*PQ[C ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload3S**D?m E'b& 8P[! ?m*PQ[D ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f@AppReadinessNotifyLogonCompletel**E?m E'b& 8P[! ?m*PQ[E ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f@AppReadinessNotifyLogonCompletea**F/m E'b& 8PE! /m*PQ[F ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*ARSFirstRunTelemetry**G/m E'b& 8PE! /m*PQ[G ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*ARSFirstRunTelemetrye**xHm E'b& 8P!nqm m r~Ky 3H ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational &1/x**Inm E'b& 8P!mm nm r~Ky 3I ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational 1cY1cᆫ}Q4?A_|8A`=Name A!`=AppID A!`=Flags h~dmarrer la journalisation de statistiques de la VMMicrosoft.AutoGenerated.{14A21382-6511-3324-B505-306A7D8FF83A}0erat**xJm E'b& 8P!nrm m r~Ky 3J ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational &1/t-Wx**K2|m E'b& 8P7!mm 2|m r~Ky 3K ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational :R%I2YYoso**L(m E'b& 8Po!%% (m r~Ky 3,L ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational 5\Software\Microsoft\Windows\CurrentVersion\RunCor**M(m E'b& 8P!%% (m r~Ky 3,M ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational _,ںI7z"C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusrktop**Nm E'b& 8P!%% m r~Ky 3,N ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational m.9z"C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusr**Om E'b& 8Po!%% m r~Ky 3,O ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational 5\Software\Microsoft\Windows\CurrentVersion\Run!**Pm E'b& 8Po!%% m r~Ky 3,P ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational 5\Software\Microsoft\Windows\CurrentVersion\Run**Qm E'b& 8Po!%% m r~Ky 3,Q ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational 5\Software\Microsoft\Windows\CurrentVersion\Runoso**R)m E'b& 8Pw!%% )m r~Ky 3,R ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational 5dSoftware\Microsoft\Windows\CurrentVersion\RunOncen30'**S8Qm E'b& 8P/!%% 8Qm r~Ky 3,S ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational _,ںI7ctfmon.exe /nndo**Tgm E'b& 8P7!%% gm r~Ky 3,T ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational m.9ctfmon.exe /ns-S**Ugm E'b& 8Pw!%% gm r~Ky 3,U ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational 5dSoftware\Microsoft\Windows\CurrentVersion\RunOnceCor**VO E'b& 8P7! ONP 8V ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAllLogonTasks/Op**WO E'b& 8PG! ONP 8W ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreDesktopSwitchTasksona**XO E'b& 8P/! ONP 8X ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellPreprat**YO E'b& 8P/! ONP 8Y ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellPrep/Op**ZO E'b& 8PO! ONP 8Z ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f4AppReadinessPreShellGroup f**[O E'b& 8P5! ONP 8[ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fSkydrivePrepl f**\O E'b& 8P5! ONP 8\ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fSkydrivePreperat**]O E'b& 8P+! ONP 8] ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fRunOncel**^O E'b& 8P+! ONP 8^ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fRunOnceW**_O E'b& 8P3! ONP 8_ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fActiveSetupo**` E'b& 8P3! NP 8` ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fActiveSetup'**a E'b& 8PC! NP 8a ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f(WaitForMSAConnectedR**b E'b& 8PC! NP 8b ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f(WaitForMSAConnectedc**c E'b& 8PG! NP 8c ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreConfigLauncherSynct-W**d E'b& 8PG! NP 8d ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreConfigLauncherSyncs-S**e E'b& 8PG! NP 8e ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreDesktopSwitchTaskst-W**f E'b& 8P;! NP 8f ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f PerUserServices'**g E'b& 8P;! NP 8g ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f PerUserServicesl**h E'b& 8P7! NP 8h ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreShellTasksndo**i E'b& 8PE! NP 8i ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*RoamingPayloads0and1roso**j E'b& 8PE! NP 8j ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*RoamingPayloads0and1erat**k E'b& 8PO! NP 8k ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f4AppReadinessPreShellGroup**l E'b& 8P3! NP 8l ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAppResolvero**m E'b& 8P!mm NP 8m ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational EY   ذĤ**n E'b& 8P3! kP 8n ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAppResolver**o E'b& 8P7! kP 8o ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreShellTasks**p E'b& 8P9! kP T p ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellInitTasksrs**q E'b& 8P9! kP T q ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellInitTasksxi**r8k E'b& 8P7! 8k P T r ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreStartTaskss-S**s8k E'b& 8P;! 8k P T s ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload2W**t8k E'b& 8PI! 8k P T t ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f.AppReadinessLogonGroup**u8k E'b& 8P=! 8k P T u ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f"UpdatePCSettings%%**v8k E'b& 8P=! 8k P T v ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f"UpdatePCSettings**w8k E'b& 8P;! 8k P T w ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload2**x8k E'b& 8PI! 8k P T x ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f.AppReadinessLogonGroup**y8k E'b& 8P7! 8k P T y ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreStartTasks**z~ E'b& 8P7! ~ P T z ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAllLogonTasks**{~ E'b& 8P;! ~ P { ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload3**|~ E'b& 8P;! ~ P | ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload3**}k E'b& 8P[! k P @ } ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f@AppReadinessNotifyLogonComplete**~k E'b& 8P[! k P @ ~ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f@AppReadinessNotifyLogonComplete**0 E'b& 8PE! 0 P | ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*ARSFirstRunTelemetry**Β E'b& 8PE! Β P | ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*ARSFirstRunTelemetryi 2**x E'b& 8P!nqm ZR76BN5)Ǖ  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational &1/ x**xp E'b& 8P!nrm pZR76BN5)Ǖ  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational &1/!x**` E'b& 8P7!mm `ZR76BN5)Ǖ  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational :R%I2XYP**{ E'b& 8Po!%% {ZR76BN5)Ǖ  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational 5\Software\Microsoft\Windows\CurrentVersion\RunP**{ E'b& 8P!%% {ZR76BN5)Ǖ  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational _,ںI7z"C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusrft-W**PO E'b& 8P!%% POZR76BN5)Ǖ  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational m.9z"C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusrindo**PO E'b& 8Po!%% POZR76BN5)Ǖ  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational 5\Software\Microsoft\Windows\CurrentVersion\Run f**PO E'b& 8Po!%% POZR76BN5)Ǖ  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational 5\Software\Microsoft\Windows\CurrentVersion\Run**PO E'b& 8P!%% POZR76BN5)Ǖ  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational _,ںI7v"C:\galaxie\deploy\Tomcat6\bin\Tomcat6w.exe" //MS//Tomcat6  E'b& 8PPreStartTasks/Opational fYPreShellTasksffElfChnk>{8`=f?mMF6 `&QXi[**H E'b&E'bUa4UxLIDwEAM Eventjxmlns5http://schemas.microsoft.com/win/2004/08/events/eventoTSystemAY{Provider6F=KNameX)GuidAMzaEventID'X) Qualifiers " Version dLevelE{Task ?Opcode$fjKeywordsAP; TimeCreated'j<{ SystemTime .F EventRecordID A Correlation\FF ActivityIDmz5RelatedActivityID Am ExecutionHFF ProcessID9ThreadID "aChannel<F;nComputer FILF-APP-RECAB.SecurityfLUserID ! 8P9!%% ];NQۘ  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational m.m.C HXOag8D EventDataA/`oData=PID A%`=Command vx "C:\galaxie\deploy\Tomcat6\bin\Tomcat6w.exe" //MS//Tomcat6H**0 E'b& 8P!%% ];NQۘ  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational  3"E>28A%`=KeyName \Software\Microsoft\Windows\CurrentVersion\Run0**1 E'b& 8Pw!%% 1];NQۘ  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational  dSoftware\Microsoft\Windows\CurrentVersion\RunOnceCor**1 E'b& 8Pw!%% 1];NQۘ  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational  dSoftware\Microsoft\Windows\CurrentVersion\RunOnceoso**(0 T E'b& 8P! 0 TP$  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational ff6!yƒpd8A)`= LogonType A'`=TaskName AllLogonTasks f(**0 T E'b& 8PG! 0 TP$  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreDesktopSwitchTasks**0 T E'b& 8P/! 0 TP$  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellPrep**0 T E'b& 8P/! 0 TP$  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellPrep f**0 T E'b& 8PO! 0 TP$  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f4AppReadinessPreShellGroupRo**0 T E'b& 8P5! 0 TP$  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fSkydrivePrepAp**0 T E'b& 8P5! 0 TP$  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fSkydrivePrep**0 T E'b& 8P+! 0 TP$  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fRunOncet**0 T E'b& 8P+! 0 TP$  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fRunOncel**0 T E'b& 8P3! 0 TP$  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fActiveSetupS**Ԓ T E'b& 8P3! Ԓ Tb 228A%`=Command z"C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusrH**dWmZ E'b& 8P!%% dWmZb 2` E'b& 8P!mm $>`P.  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational EY6 ndo**a E'b& 8P3! aP.  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAppResolverOpational fYPreShellTasksffElfChnkV{M+8`=f?mMFYf,.&&)**a E'b&E'bUa4UxLIDwEAM Eventjxmlns5http://schemas.microsoft.com/win/2004/08/events/eventoTSystemAY{Provider6F=KNameX)GuidAMzaEventID'X) Qualifiers " Version dLevelE{Task ?Opcode$fjKeywordsAP; TimeCreated'j<{ SystemTime .F EventRecordID A Correlation\FF ActivityIDmz5RelatedActivityID Am ExecutionHFF ProcessID9ThreadID "aChannel<F;nComputer FILF-APP-RECAB.SecurityfLUserID ! 8P! aP.  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational ff6!yƒ8D EventDataA;`oData= LogonType A'`=TaskName PreShellTaskscat6** b E'b& 8P9! bP.   ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellInitTasksat** b E'b& 8P9! bP.   ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellInitTasks** U\ E'b& 8P7! U\ P.   ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreStartTasks 1**!U\ E'b& 8P;! U\ P.  ! ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload2**"U\ E'b& 8PI! U\ P.  " ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f.AppReadinessLogonGroup**#U\ E'b& 8P=! U\ P.  # ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f"UpdatePCSettings,**$U\ E'b& 8P=! U\ P.  $ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f"UpdatePCSettings**%U\ E'b& 8P;! U\ P.  % ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload2**&U\ E'b& 8PI! U\ P.  & ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f.AppReadinessLogonGroupne**'U\ E'b& 8P7! U\ P.  ' ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreStartTasks**(m E'b& 8P7! m P.  ( ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAllLogonTasks**)y E'b& 8P;! y P. d ) ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload3***y E'b& 8P;! y P. d * ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload3c**+ E'b& 8P[!  P. L+ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f@AppReadinessNotifyLogonComplete**, E'b& 8P[!  P. L, ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f@AppReadinessNotifyLogonComplete**-ڃ E'b& 8PE! ڃ P. \- ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*ARSFirstRunTelemetry**. E'b& 8PE!  P. \. ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*ARSFirstRunTelemetry**/Y E'b& 8P9!nqm YsGVRO p/ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational &&&| p)c8**x04_ E'b& 8P!nrm 4_sGVRO p0 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational &&x**1Th E'b& 8Pk!mm ThsGVRO p1 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational :R%):R%&Gm3}8A1`#= ItemsExisting A+`= ItemsAdded A/`!= ItemsRemoved A/`!= ItemsUpdated A-`= ItemsCached XYo**02(o E'b& 8P!%% (osGVRO 2 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational ,3"E>28A%`=KeyName \Software\Microsoft\Windows\CurrentVersion\Run0**H3(o E'b& 8P!%% (osGVRO 3 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational _,ں._,ں # >28A%`=Command z"C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusrH**x4(v E'b& 8P!%% (vsGVRO 4 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational m.0m.C HXOagbV8A`=PID A%`=Command z"C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusrPayx**5(v E'b& 8Po!%% (vsGVRO 5 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational ,\Software\Microsoft\Windows\CurrentVersion\Run**6(v E'b& 8Po!%% (vsGVRO 6 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational ,\Software\Microsoft\Windows\CurrentVersion\Run**7(v E'b& 8P!%% (vsGVRO 7 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational _,ں.v"C:\galaxie\deploy\Tomcat6\bin\Tomcat6w.exe" //MS//Tomcat6&**8 E'b& 8P!%% sGVRO 8 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational m.0v"C:\galaxie\deploy\Tomcat6\bin\Tomcat6w.exe" //MS//Tomcat6 Ԓ**9 E'b& 8Po!%% sGVRO 9 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational ,\Software\Microsoft\Windows\CurrentVersion\Run ذĤ**:x E'b& 8Pw!%% xsGVRO : ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational ,dSoftware\Microsoft\Windows\CurrentVersion\RunOnceCor**;x E'b& 8Pw!%% xsGVRO ; ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational ,dSoftware\Microsoft\Windows\CurrentVersion\RunOnceell**<d;6 E'b& 8P7! d;6PnP< ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAllLogonTasksell**=d;6 E'b& 8PG! d;6PnP= ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreDesktopSwitchTasks/Op**>d;6 E'b& 8P/! d;6PnP> ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellPreps-S**?d;6 E'b& 8P/! d;6PnP? ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellPrept-W**@d;6 E'b& 8PO! d;6PnP@ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f4AppReadinessPreShellGroups-S**Ad;6 E'b& 8P5! d;6PnPA ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fSkydrivePrepws-S**Bd;6 E'b& 8P5! d;6PnPB ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fSkydrivePrepft-W**Cd;6 E'b& 8P+! d;6PnPC ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fRunOncec**De;6 E'b& 8P+! e;6PnPD ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fRunOnce'**Ee;6 E'b& 8P3! e;6PnPE ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fActiveSetupr**Fyf;6 E'b& 8P3! yf;6PnPF ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fActiveSetupl**Gyf;6 E'b& 8PC! yf;6PnPG ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f(WaitForMSAConnectedW**Hyf;6 E'b& 8PC! yf;6PnPH ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f(WaitForMSAConnected**Iyf;6 E'b& 8PG! yf;6PnPI ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreConfigLauncherSync 2**Jyf;6 E'b& 8PG! yf;6PnPJ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreConfigLauncherSync 2**Kyf;6 E'b& 8PG! yf;6PnPK ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreDesktopSwitchTasksoso**Lyf;6 E'b& 8P;! yf;6PnPL ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f PerUserServicesr**Myf;6 E'b& 8P;! yf;6PnPM ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f PerUserServices**Nyf;6 E'b& 8P7! yf;6PnPN ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreShellTasks**Oyf;6 E'b& 8PE! yf;6PnPO ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*RoamingPayloads0and1-Cor**Pyf;6 E'b& 8PE! yf;6PnPP ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*RoamingPayloads0and1**Qyf;6 E'b& 8PO! yf;6PnPQ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f4AppReadinessPreShellGroup8**Ryf;6 E'b& 8P3! yf;6PnPR ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAppResolver**Sg;6 E'b& 8P!mm g;6PnPS ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational EYYf0EYM~q; g&h\8A'`=Scenario A!`=Flags  **T h;6 E'b& 8P3! h;6PnPT ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAppResolverZ**U h;6 E'b& 8P7! h;6PnPU ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreShellTasksent**V.kh;6 E'b& 8P9! .kh;6PnPV ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellInitTasksct**W.kh;6 E'b& 8P9! .kh;6PnPW ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellInitTasksct**X8<6 E'b& 8P7! 8<6PnPX ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreStartTaskstwa**Y8<6 E'b& 8P;! 8<6PnPY ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload2l**Z8<6 E'b& 8PI! 8<6PnPZ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f.AppReadinessLogonGroupOp**[8<6 E'b& 8P=! 8<6PnP[ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f"UpdatePCSettings-Cor**\8<6 E'b& 8P=! 8<6PnP\ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f"UpdatePCSettingserat**]8<6 E'b& 8P;! 8<6PnP] ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload2a**^8<6 E'b& 8PI! 8<6PnP^ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f.AppReadinessLogonGroupat**_8<6 E'b& 8P7! 8<6PnP_ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreStartTasksrat**`dK<6 E'b& 8P7! dK<6PnP` ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAllLogonTasksrat**a!S<6 E'b& 8P;! !S<6PnP,a ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload3**b!S<6 E'b& 8P;! !S<6PnP,b ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload3**cY<6 E'b& 8P[! Y<6PnP4 c ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f@AppReadinessNotifyLogonComplete**dY<6 E'b& 8P[! Y<6PnP4 d ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f@AppReadinessNotifyLogonComplete**e!Z<6 E'b& 8PE! !Z<6PnP e ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*ARSFirstRunTelemetryE'b&**fIZ<6 E'b& 8PE! IZ<6PnP f ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*ARSFirstRunTelemetryE'b&**xg^A6 E'b& 8P!nqm ^A6g#NmP, g ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational &&erSx**xh:}dA6 E'b& 8P!nrm :}dA6g#NmP, h ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational && fx**iqA6 E'b& 8P7!mm qA6g#NmP, i ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational :R%)XYrat**j *HB6 E'b& 8Po!%% *HB6g#NmP< j ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational ,\Software\Microsoft\Windows\CurrentVersion\RunSer**k *HB6 E'b& 8P!%% *HB6g#NmP< k ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational _,ں.z"C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusr**lLB6 E'b& 8P!%% LB6g#NmP< l ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational m.0zl"C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusrP**mLB6 E'b& 8Po!%% LB6g#NmP< m ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational ,\Software\Microsoft\Windows\CurrentVersion\Run ذĤ**nLB6 E'b& 8Po!%% LB6g#NmP< n ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational ,\Software\Microsoft\Windows\CurrentVersion\Runt-W**o˽LB6 E'b& 8P!%% ˽LB6g#NmP< o ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational _,ں.v"C:\galaxie\deploy\Tomcat6\bin\Tomcat6w.exe" //MS//Tomcat6-S**pBB6 E'b& 8P!%% BB6g#NmP< p ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational m.0v "C:\galaxie\deploy\Tomcat6\bin\Tomcat6w.exe" //MS//Tomcat6**qBB6 E'b& 8Po!%% BB6g#NmP< q ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational ,\Software\Microsoft\Windows\CurrentVersion\Run**rYB6 E'b& 8Pw!%% YB6g#NmP< r ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational ,dSoftware\Microsoft\Windows\CurrentVersion\RunOnce ]**sYB6 E'b& 8Pw!%% YB6g#NmP< s ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational ,dSoftware\Microsoft\Windows\CurrentVersion\RunOnce 2**t?0 E'b& 8P7! ?0kP t ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAllLogonTasks 2**u?0 E'b& 8PG! ?0kP u ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreDesktopSwitchTasksoso**v?0 E'b& 8P/! ?0kP v ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellPrep ذĤ**w?0 E'b& 8P/! ?0kP w ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellPrep**x?0 E'b& 8PO! ?0kP x ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f4AppReadinessPreShellGroup ذĤ**y?0 E'b& 8P5! ?0kP y ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fSkydrivePrep ذĤ**z?0 E'b& 8P5! ?0kP z ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fSkydrivePrep**{?0 E'b& 8P+! ?0kP { ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fRunOnce **|?0 E'b& 8P+! ?0kP | ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fRunOnceې**}?0 E'b& 8P3! ?0kP } ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fActiveSetup**~?0 E'b& 8P3! ?0kP ~ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fActiveSetup**?0 E'b& 8PC! ?0kP  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f(WaitForMSAConnected**?0 E'b& 8PC! ?0kP  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f(WaitForMSAConnected**?0 E'b& 8PG! ?0kP  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreConfigLauncherSync**?0 E'b& 8PG! ?0kP  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreConfigLauncherSync**?0 E'b& 8PG! ?0kP  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreDesktopSwitchTasks a**?0 E'b& 8P;! ?0kP  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f PerUserServices**?0 E'b& 8P;! ?0kP  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f PerUserServices**?0 E'b& 8P7! ?0kP  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreShellTasks!**?0 E'b& 8PE! ?0kP  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*RoamingPayloads0and1**?0 E'b& 8PE! ?0kP  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*RoamingPayloads0and1.exe**?0 E'b& 8PO! ?0kP  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f4AppReadinessPreShellGroupoft**?0 E'b& 8P3! ?0kP  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAppResolvert**f"?0 E'b& 8P!mm f"?0kP  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational EYYf n30'**p?0 E'b& 8P3! p?0NP  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAppResolver**p?0 E'b& 8P7! p?0NP  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreShellTasks**v?0 E'b& 8P9! v?0NP   ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellInitTasks**v?0 E'b& 8P9! v?0NP   ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellInitTasksrs**'@0 E'b& 8P7! '@0P   ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreStartTaskstwa**'@0 E'b& 8P;! '@0P   ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload2l**'@0 E'b& 8PI! '@0P   ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f.AppReadinessLogonGroup-S**'@0 E'b& 8P=! '@0P   ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f"UpdatePCSettings****$(@0 E'b& 8P=! $(@0P   ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f"UpdatePCSettings**$(@0 E'b& 8P;! $(@0P   ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload2**$(@0 E'b& 8PI! $(@0P   ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f.AppReadinessLogonGroupP**$(@0 E'b& 8P7! $(@0P   ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreStartTasksP**ޞ/@0 E'b& 8P7! ޞ/@0P   ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAllLogonTasks**62@0 E'b& 8P;! 62@0P   ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload3**62@0 E'b& 8P;! 62@0P   ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload3**2@0 E'b& 8P[! 2@0P T ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f@AppReadinessNotifyLogonComplete**2@0 E'b& 8P[! 2@0P T ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f@AppReadinessNotifyLogonComplete**p3@0 E'b& 8PE! p3@0P  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*ARSFirstRunTelemetry **p3@0 E'b& 8PE! p3@0P  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*ARSFirstRunTelemetryi 2**x28A%`=KeyName \Software\Microsoft\Windows\CurrentVersion\RunH0**H^/F E'b& 8P!%% ^/FQFeADZA ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational _,ںT_,ں # >28A%`=Command z"C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusrrH**xY//F E'b& 8P!%% Y//FQFeADZA ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational m.W1+m.C HXOagbV8A`=PID A%`=Command z "C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusrx**Y//F E'b& 8Po!%% Y//FQFeADZA ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational R\Software\Microsoft\Windows\CurrentVersion\Run y**Y//F E'b& 8Po!%% Y//FQFeADZA ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational R\Software\Microsoft\Windows\CurrentVersion\Run ذĤ**Y//F E'b& 8P!%% Y//FQFeADZA ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational _,ںTv"C:\galaxie\deploy\Tomcat6\bin\Tomcat6w.exe" //MS//Tomcat6QR**-0F E'b& 8P!%% -0FQFeADZA ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational m.WvD"C:\galaxie\deploy\Tomcat6\bin\Tomcat6w.exe" //MS//Tomcat6f**-0F E'b& 8Po!%% -0FQFeADZA ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational R\Software\Microsoft\Windows\CurrentVersion\RunPay**-0F E'b& 8Pw!%% -0FQFeADZA ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational RdSoftware\Microsoft\Windows\CurrentVersion\RunOnce****-0F E'b& 8Pw!%% -0FQFeADZA ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational RdSoftware\Microsoft\Windows\CurrentVersion\RunOnce**˳F E'b& 8P7! ˳F ,KWd ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAllLogonTasks**˳F E'b& 8PG! ˳F ,KWd ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreDesktopSwitchTasksZ**˳F E'b& 8P/! ˳F ,KWd ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellPrepks**˳F E'b& 8P/! ˳F ,KWd ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellPrepitT**˳F E'b& 8PO! ˳F ,KWd ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f4AppReadinessPreShellGroup****˳F E'b& 8P5! ˳F ,KWd ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fSkydrivePrep****˳F E'b& 8P5! ˳F ,KWd ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fSkydrivePrep****˳F E'b& 8P+! ˳F ,KWd ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fRunOnceo**˳F E'b& 8P+! ˳F ,KWd ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fRunOnce**˳F E'b& 8P3! ˳F ,KWd ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fActiveSetup**e:F E'b& 8P3! e:F ,KWd ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fActiveSetupt**e:F E'b& 8PC! e:F ,KWd ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f(WaitForMSAConnecteda**e:F E'b& 8PC! e:F ,KWd ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f(WaitForMSAConnectedt**e:F E'b& 8PG! e:F ,KWd ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreConfigLauncherSync f**e:F E'b& 8PG! e:F ,KWd ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreConfigLauncherSync **e:F E'b& 8PG! e:F ,KWd ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreDesktopSwitchTasksmin**e:F E'b& 8P;! e:F ,KWd ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f PerUserServicesa**e:F E'b& 8P;! e:F ,KWd ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f PerUserServices**e:F E'b& 8P7! e:F ,KWd ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreShellTasksCor**e:F E'b& 8PE! e:F ,KWd ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*RoamingPayloads0and1-Cor**e:F E'b& 8PE! e:F ,KWd ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*RoamingPayloads0and1-Cor**e:F E'b& 8PO! e:F ,KWd ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f4AppReadinessPreShellGroupi**e:F E'b& 8P3! e:F ,KWd ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAppResolver**yaF E'b& 8P!mm yaF ,KWd ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational EY1+ cro**yaF E'b& 8P3! yaF ,KWd ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAppResolverp**yaF E'b& 8P7! yaF ,KWd ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreShellTasksell**F E'b& 8P9! F ,KWd  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellInitTasksN**F E'b& 8P9! F ,KWd  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellInitTasks**ՊF E'b& 8P7! ՊF ,KWd  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreStartTasks'b&**ՊF E'b& 8P;! ՊF ,KWd  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload2x**ՊF E'b& 8PI! ՊF ,KWd  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f.AppReadinessLogonGroupga**ՊF E'b& 8P=! ՊF ,KWd  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f"UpdatePCSettingsws-S**ՊF E'b& 8P=! ՊF ,KWd  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f"UpdatePCSettingsen30'**ՊF E'b& 8P;! ՊF ,KWd  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload2**ՊF E'b& 8PI! ՊF ,KWd  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f.AppReadinessLogonGroupP**ՊF E'b& 8P7! ՊF ,KWd  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreStartTasksP**F E'b& 8P7! F ,KWd  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAllLogonTasks ** KF E'b& 8P;! KF ,KWd  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload3** KF E'b& 8P;! KF ,KWd  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload3** rF E'b& 8P[! rF ,KWd  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f@AppReadinessNotifyLogonComplete** rF E'b& 8P[! rF ,KWd  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f@AppReadinessNotifyLogonComplete** rF E'b& 8PE! rF ,KWd  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*ARSFirstRunTelemetryMic**rF E'b& 8PE! rF ,KWd  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*ARSFirstRunTelemetryws-S**x2{F E'b& 8P!nqm 2{F ,KWd ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational &Losox**x-|F E'b& 8P!nrm -|F ,KWd ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational &Lx**Ӣ|F E'b& 8P7!mm Ӣ|F ,KWd ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational :R%OYY ذĤ**2F E'b& 8Po!%% 2F ,KWd ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational R\Software\Microsoft\Windows\CurrentVersion\Runs-S**2F E'b& 8P!%% 2F ,KWd ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational _,ںTz"C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusrhell**F E'b& 8P!%% F ,KWd ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational m.Wz"C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusrfigL**F E'b& 8Po!%% F ,KWd ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational R\Software\Microsoft\Windows\CurrentVersion\Run****F E'b& 8Po!%% F ,KWd ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational R\Software\Microsoft\Windows\CurrentVersion\Run**F E'b& 8Po!%% F ,KWd ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational R\Software\Microsoft\Windows\CurrentVersion\Run!**F E'b& 8Pw!%% F ,KWd ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational RdSoftware\Microsoft\Windows\CurrentVersion\RunOnce**F E'b& 8Pw!%% F ,KWd ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational RdSoftware\Microsoft\Windows\CurrentVersion\RunOncendo**^ E'b& 8P7! ^PCt ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAllLogonTasksoso**^ E'b& 8PG! ^PCt ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreDesktopSwitchTasksMic**^ E'b& 8P/! ^PCt ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellPrepMic**^ E'b& 8P/! ^PCt ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellPrept-W**^ E'b& 8PO! ^PCt ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f4AppReadinessPreShellGroupCor**^ E'b& 8P5! ^PCt ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fSkydrivePrep-Cor** ^ E'b& 8P5! ^PCt  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fSkydrivePrep-Cor**!^ E'b& 8P+! ^PCt! ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fRunOnceS**"^ E'b& 8P+! ^PCt" ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fRunOnceW**#^ E'b& 8P3! ^PCt# ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fActiveSetupo**$^ E'b& 8P3! ^PCt$ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fActiveSetup**%^ E'b& 8PC! ^PCt% ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f(WaitForMSAConnected**&^ E'b& 8PC! ^PCt& ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f(WaitForMSAConnected**'^ E'b& 8PG! ^PCt' ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreConfigLauncherSyncMic**(^ E'b& 8PG! ^PCt( ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreConfigLauncherSyncMic**)^ E'b& 8PG! ^PCt) ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreDesktopSwitchTaskst-W***^ E'b& 8P;! ^PCt* ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f PerUserServicesW**+^ E'b& 8P;! ^PCt+ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f PerUserServicesW**,^ E'b& 8P7! ^PCt, ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreShellTaskst-W**-^ E'b& 8PE! ^PCt- ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*RoamingPayloads0and1Mic**.^ E'b& 8PE! ^PCt. ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*RoamingPayloads0and1 ذĤ**/^ E'b& 8PO! ^PCt/ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f4AppReadinessPreShellGroup 2**0^ E'b& 8P3! ^PCt0 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAppResolver**1 E'b& 8P!mm PCt1 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational EY1+  ذĤ**2 E'b& 8P3! PCt2 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAppResolverW**3 E'b& 8P7! PCt3 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreShellTaskst-W**4 E'b& 8P9! PCt4 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellInitTasks**5 E'b& 8P9! PCt5 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellInitTasks**6.u E'b& 8P7! .uPCt6 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreStartTasksvmu**7.u E'b& 8P;! .uPCt7 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload2o**8.u E'b& 8PI! .uPCt8 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f.AppReadinessLogonGroup**9.u E'b& 8P=! .uPCt9 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f"UpdatePCSettingsws-S**:.u E'b& 8P=! .uPCt: ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f"UpdatePCSettingsen30'**;.u E'b& 8P;! .uPCt; ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload2**<.u E'b& 8PI! .uPCt< ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f.AppReadinessLogonGroup-W**=.u E'b& 8P7! .uPCt= ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreStartTaskst-W**>L E'b& 8P7! LPCt> ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAllLogonTasks**?b/ E'b& 8P;! b/PCth? ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload3**@b/ E'b& 8P;! b/PCth@ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload3pational f E'b& 8PPreShellTasksff