ElfFile lAElfChnkAA8Gu-8`=f?mMFiO&** Ab/ E'b&E'bUa4UxLIDwEAM Eventjxmlns5http://schemas.microsoft.com/win/2004/08/events/eventoTSystemAY{Provider6F=KNameX)GuidAMzaEventID'X) Qualifiers " Version dLevelE{Task ?Opcode$fjKeywordsAP; TimeCreated'j<{ SystemTime .F EventRecordID A Correlation\FF ActivityIDmz5RelatedActivityID Am ExecutionHFF ProcessID9ThreadID "aChannel<F;nComputer FILF-APP-RECAB.SecurityfLUserID ! 8P! b/PCtA ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational ff6!yƒ8D EventDataA;`oData= LogonType A'`=TaskName @AppReadinessNotifyLogonComplete& **Bb/ E'b& 8P[! b/PCtB ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f@AppReadinessNotifyLogonComplete**C74 E'b& 8PE! 74PCtH C ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*ARSFirstRunTelemetry**D74 E'b& 8PE! 74PCtH D ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*ARSFirstRunTelemetry**EM E'b& 8P9!nqm MضuWO:*It E ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational &&| p)c8**xF E'b& 8P!nrm ضuWO:*It F ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational &x**G E'b& 8Pk!mm ضuWO:*It G ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational :R%:R%&Gm3}8A1`#= ItemsExisting A+`= ItemsAdded A/`!= ItemsRemoved A/`!= ItemsUpdated A-`= ItemsCached XYc**0Hj E'b& 8P!%% jضuWO:*ItH ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational 3"E>28A%`=KeyName \Software\Microsoft\Windows\CurrentVersion\Run0**HIj E'b& 8P!%% jضuWO:*ItI ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational _,ں_,ں # >28A%`=Command z"C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusroH**xJ E'b& 8P!%% ضuWO:*ItJ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational m. m.C HXOagbV8A`=PID A%`=Command z"C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusrx**K E'b& 8Po!%% ضuWO:*ItK ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational \Software\Microsoft\Windows\CurrentVersion\Run8**L E'b& 8Po!%% ضuWO:*ItL ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational \Software\Microsoft\Windows\CurrentVersion\Run&**M E'b& 8P!%% ضuWO:*ItM ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational _,ںv"C:\galaxie\deploy\Tomcat6\bin\Tomcat6w.exe" //MS//Tomcat6-W**NKl E'b& 8P!%% KlضuWO:*ItN ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational m. v"C:\galaxie\deploy\Tomcat6\bin\Tomcat6w.exe" //MS//Tomcat6-S**OKl E'b& 8Po!%% KlضuWO:*ItO ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational \Software\Microsoft\Windows\CurrentVersion\Run**PG+l E'b& 8Pw!%% G+lضuWO:*ItP ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational dSoftware\Microsoft\Windows\CurrentVersion\RunOnce0an**QG+l E'b& 8Pw!%% G+lضuWO:*ItQ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational dSoftware\Microsoft\Windows\CurrentVersion\RunOncefK(**RD^ E'b& 8P7! D^P R ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAllLogonTasks**SD^ E'b& 8PG! D^P S ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreDesktopSwitchTasks**TD^ E'b& 8P/! D^P T ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellPrepona**UD^ E'b& 8P/! D^P U ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellPrepona**VD^ E'b& 8PO! D^P V ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f4AppReadinessPreShellGroup**WD^ E'b& 8P5! D^P W ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fSkydrivePrep**XD^ E'b& 8P5! D^P X ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fSkydrivePrep**YD^ E'b& 8P+! D^P Y ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fRunOnce**ZD^ E'b& 8P+! D^P Z ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fRunOncet**[D^ E'b& 8P3! D^P [ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fActiveSetupl**\TD^ E'b& 8P3! TD^P \ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fActiveSetupo**]TD^ E'b& 8PC! TD^P ] ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f(WaitForMSAConnectedo**^TD^ E'b& 8PC! TD^P ^ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f(WaitForMSAConnectedS**_TD^ E'b& 8PG! TD^P _ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreConfigLauncherSyncs-S**`TD^ E'b& 8PG! TD^P ` ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreConfigLauncherSyncCor**aTD^ E'b& 8PG! TD^P a ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreDesktopSwitchTasksrat**bTD^ E'b& 8P;! TD^P b ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f PerUserServicest**cTD^ E'b& 8P;! TD^P c ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f PerUserServicest**dTD^ E'b& 8P7! TD^P d ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreShellTaskss-S**eTD^ E'b& 8PE! TD^P e ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*RoamingPayloads0and1ft-W**fTD^ E'b& 8PE! TD^P f ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*RoamingPayloads0and1ft-W**gTD^ E'b& 8PO! TD^P g ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f4AppReadinessPreShellGroupndo**hTD^ E'b& 8P3! TD^P h ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAppResolverW**iTD^ E'b& 8P!mm TD^P i ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational EYiO EYM~q; g&h\8A'`=Scenario A!`=Flags  msE**jTD^ E'b& 8P3! TD^ P j ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAppResolver**kTD^ E'b& 8P7! TD^ P k ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreShellTasksn\R**liD^ E'b& 8P9! iD^ P l ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellInitTasks**miD^ E'b& 8P9! iD^ P m ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellInitTasksdo**nujD^ E'b& 8P7! ujD^P n ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreStartTasks**oujD^ E'b& 8P;! ujD^P o ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload2r**pujD^ E'b& 8PI! ujD^P p ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f.AppReadinessLogonGroup\M**qujD^ E'b& 8P=! ujD^P q ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f"UpdatePCSettingserat**rujD^ E'b& 8P=! ujD^P r ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f"UpdatePCSettings|DQR**sujD^ E'b& 8P;! ujD^P s ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload2**tujD^ E'b& 8PI! ujD^P t ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f.AppReadinessLogonGroup**uujD^ E'b& 8P7! ujD^P u ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreStartTasks**vcD^ E'b& 8P7! cD^P v ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAllLogonTasks**wcD^ E'b& 8P;! cD^P w ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload3**xcD^ E'b& 8P;! cD^P x ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload3Z**yq(D^ E'b& 8P[! q(D^P y ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f@AppReadinessNotifyLogonComplete**zq(D^ E'b& 8P[! q(D^P z ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f@AppReadinessNotifyLogonComplete**{ZD^ E'b& 8PE! ZD^P { ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*ARSFirstRunTelemetry**|yOD^ E'b& 8PE! yOD^P | ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*ARSFirstRunTelemetry**x}I^ E'b& 8P!nqm I^EO@i@[:T0Q H} ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational &x**x~I^ E'b& 8P!nrm I^EO@i@[:T0Q H~ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational &˳x**J^ E'b& 8P7!mm J^EO@i@[:T0Q H ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational :R%XY'b&**vJ^ E'b& 8Po!%% vJ^EO@i@[:T0Q @ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational \Software\Microsoft\Windows\CurrentVersion\Run8**vJ^ E'b& 8P!%% vJ^EO@i@[:T0Q @ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational _,ںz"C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusri 2**qxJ^ E'b& 8P!%% qxJ^EO@i@[:T0Q @ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational m. z "C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusrroso**qxJ^ E'b& 8Po!%% qxJ^EO@i@[:T0Q @ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational \Software\Microsoft\Windows\CurrentVersion\Run/Op**qxJ^ E'b& 8Po!%% qxJ^EO@i@[:T0Q @ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational \Software\Microsoft\Windows\CurrentVersion\Run,**qxJ^ E'b& 8P!%% qxJ^EO@i@[:T0Q @ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational _,ںv"C:\galaxie\deploy\Tomcat6\bin\Tomcat6w.exe" //MS//Tomcat6***J^ E'b& 8P!%% J^EO@i@[:T0Q @ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational m. v"C:\galaxie\deploy\Tomcat6\bin\Tomcat6w.exe" //MS//Tomcat6**J^ E'b& 8Po!%% J^EO@i@[:T0Q @ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational \Software\Microsoft\Windows\CurrentVersion\RunK**J^ E'b& 8Pw!%% J^EO@i@[:T0Q @ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational dSoftware\Microsoft\Windows\CurrentVersion\RunOnceoso**J^ E'b& 8Pw!%% J^EO@i@[:T0Q @ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational dSoftware\Microsoft\Windows\CurrentVersion\RunOncen30'**Pq( E'b& 8P7! Pq(ZPI(8 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAllLogonTasksell**Pq( E'b& 8PG! Pq(ZPI(8 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreDesktopSwitchTaskss-S**Pq( E'b& 8P/! Pq(ZPI(8 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellPreps-S**Pq( E'b& 8P/! Pq(ZPI(8 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellPrepCor**Pq( E'b& 8PO! Pq(ZPI(8 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f4AppReadinessPreShellGrouposo**Pq( E'b& 8P5! Pq(ZPI(8 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fSkydrivePreproso**Pq( E'b& 8P5! Pq(ZPI(8 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fSkydrivePreproso**Pq( E'b& 8P+! Pq(ZPI(8 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fRunOnceR**dq( E'b& 8P+! dq(ZPI(8 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fRunOncer**dq( E'b& 8P3! dq(ZPI(8 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fActiveSetupl**t( E'b& 8P3! t(( JIs(8 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fActiveSetupW**t( E'b& 8PC! t(( JIs(8 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f(WaitForMSAConnectedW**t( E'b& 8PC! t(( JIs(8 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f(WaitForMSAConnectedW**t( E'b& 8PG! t(( JIs(8 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreConfigLauncherSyncs-S**t( E'b& 8PG! t(( JIs(8 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreConfigLauncherSyncs-S**t( E'b& 8PG! t(( JIs(8 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreDesktopSwitchTasksCor**t( E'b& 8P;! t(( JIs(8 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f PerUserServicesr**t( E'b& 8P;! t(( JIs(8 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f PerUserServicesr**t( E'b& 8P7! t(( JIs(8 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreShellTasksCor**t( E'b& 8PE! t(( JIs(8 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*RoamingPayloads0and1ws-S**t( E'b& 8PE! t(( JIs(8 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*RoamingPayloads0and1ft-W**t( E'b& 8PO! t(( JIs(8 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f4AppReadinessPreShellGroupndo**t( E'b& 8P3! t(( JIs(8 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAppResolverc**`+v( E'b& 8P!mm `+v(( JIs(8 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational EYiO t-W**w( E'b& 8P3! w('PI(8 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAppResolverr**w( E'b& 8P7! w('PI(8 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreShellTasksCor**28A%`=KeyName \Software\Microsoft\Windows\CurrentVersion\Runi 20**H.` E'b& 8P!%% .`:KJ%H ;V  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational _,ںB_,ں # >28A%`=Command z"C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusraH**xy E'b& 8P!%% y:KJ%H ;V  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational m.9Eim.C HXOagbV8A`=PID A%`=Command zx "C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusrPx**y E'b& 8Po!%% y:KJ%H ;V  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational @\Software\Microsoft\Windows\CurrentVersion\RunMic**y E'b& 8Po!%% y:KJ%H ;V  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational @\Software\Microsoft\Windows\CurrentVersion\Runell**y E'b& 8P!%% y:KJ%H ;V  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational _,ںBv"C:\galaxie\deploy\Tomcat6\bin\Tomcat6w.exe" //MS//Tomcat6-S**H E'b& 8P!%% HaJ8CaG'  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational m.9Ev "C:\galaxie\deploy\Tomcat6\bin\Tomcat6w.exe" //MS//Tomcat6**H E'b& 8Po!%% HaJ8CaG'  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational @\Software\Microsoft\Windows\CurrentVersion\Runnar**H E'b& 8Pw!%% HaJ8CaG'  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational @dSoftware\Microsoft\Windows\CurrentVersion\RunOncelve**H E'b& 8Pw!%% HaJ8CaG'  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational @dSoftware\Microsoft\Windows\CurrentVersion\RunOnce**?ڰ6B E'b& 8P7! ?ڰ6BPnB <  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAllLogonTasks**?ڰ6B E'b& 8PG! ?ڰ6BPnB <  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreDesktopSwitchTasks**?ڰ6B E'b& 8P/! ?ڰ6BPnB <  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellPrep**?ڰ6B E'b& 8P/! ?ڰ6BPnB <  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellPrep**?ڰ6B E'b& 8PO! ?ڰ6BPnB <  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f4AppReadinessPreShellGroup**?ڰ6B E'b& 8P5! ?ڰ6BPnB <  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fSkydrivePrep**?ڰ6B E'b& 8P5! ?ڰ6BPnB <  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fSkydrivePrep**?ڰ6B E'b& 8P+! ?ڰ6BPnB <  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fRunOnce**?ڰ6B E'b& 8P+! ?ڰ6BPnB <  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fRunOnce**?ڰ6B E'b& 8P3! ?ڰ6BPnB <  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fActiveSetup**<6B E'b& 8P3! <6BPnB <  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fActiveSetupa**<6B E'b& 8PC! <6BPnB <  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f(WaitForMSAConnectedd** <6B E'b& 8PC! <6BPnB <  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f(WaitForMSAConnectedZ** <6B E'b& 8PG! <6BPnB <  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreConfigLauncherSyncCom** <6B E'b& 8PG! <6BPnB <  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreConfigLauncherSyncify** <6B E'b& 8PG! <6BPnB <  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreDesktopSwitchTaskstRu** <6B E'b& 8P;! <6BPnB <  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f PerUserServicesR**<6B E'b& 8P;! <6BPnB <  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f PerUserServices**<6B E'b& 8P7! <6BPnB <  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreShellTasks**<6B E'b& 8PE! <6BPnB <  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*RoamingPayloads0and1**<6B E'b& 8PE! <6BPnB <  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*RoamingPayloads0and1****<6B E'b& 8PO! <6BPnB <  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f4AppReadinessPreShellGroupls\**<6B E'b& 8P3! <6BPnB <  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAppResolvera**6B E'b& 8P!mm 6BPnB <  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational EYi ndo**6B E'b& 8P3! 6BPnB <  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAppResolver**6B E'b& 8P7! 6BPnB <  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreShellTasksP**6B E'b& 8P9! 6BPnB  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellInitTasks**6B E'b& 8P9! 6BPnB  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellInitTasksom**}7B E'b& 8P7! }7BPnB  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreStartTasks **}7B E'b& 8P;! }7BPnB  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload2o**}7B E'b& 8PI! }7BPnB  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f.AppReadinessLogonGroupor**}7B E'b& 8P=! }7BPnB  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f"UpdatePCSettingsi 2**}7B E'b& 8P=! }7BPnB  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f"UpdatePCSettingsMic**}7B E'b& 8P;! }7BPnB  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload2**}7B E'b& 8PI! }7BPnB  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f.AppReadinessLogonGroupso** }7B E'b& 8P7! }7BPnB  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreStartTaskst-W**!F7B E'b& 8P7! F7BPnB ! ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAllLogonTasks 2**"F7B E'b& 8P;! F7BPnB T" ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload3**#F7B E'b& 8P;! F7BPnB T# ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload3**$F7B E'b& 8P[! F7BPnB 0$ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f@AppReadinessNotifyLogonCompletel**%F7B E'b& 8P[! F7BPnB 0% ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f@AppReadinessNotifyLogonCompleteW**&F7B E'b& 8PE! F7BPnB & ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*ARSFirstRunTelemetryhell**'F7B E'b& 8PE! F7BPnB ' ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*ARSFirstRunTelemetryerat**x(vh \( ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational &:t-Wx**x) \) ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational &:ellx*** \* ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational :R%=XYndo**+:,=B E'b& 8Po!%% :,=BeLHNzre^ + ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational @\Software\Microsoft\Windows\CurrentVersion\RunQR**,:,=B E'b& 8P!%% :,=BeLHNzre^ , ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational _,ںBz"C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusrerat**-=B E'b& 8P!%% =BeLHNzre^ - ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational m.9Ez( "C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusrt**.=B E'b& 8Po!%% =BeLHNzre^ . ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational @\Software\Microsoft\Windows\CurrentVersion\Run**/=B E'b& 8Po!%% =BeLHNzre^ / ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational @\Software\Microsoft\Windows\CurrentVersion\Run!**0=B E'b& 8P!%% =BeLHNzre^ 0 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational _,ںBv"C:\galaxie\deploy\Tomcat6\bin\Tomcat6w.exe" //MS//Tomcat6**1( >B E'b& 8P!%% ( >BeLHNzre^ 1 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational m.9Ev"C:\galaxie\deploy\Tomcat6\bin\Tomcat6w.exe" //MS//Tomcat6ll**2( >B E'b& 8Po!%% ( >BeLHNzre^ 2 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational @\Software\Microsoft\Windows\CurrentVersion\Runs-S**3O >B E'b& 8Pw!%% O >BeLHNzre^ 3 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational @dSoftware\Microsoft\Windows\CurrentVersion\RunOncelve**4O >B E'b& 8Pw!%% O >BeLHNzre^ 4 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational @dSoftware\Microsoft\Windows\CurrentVersion\RunOnce**5gQ  E'b& 8P7! gQ oP8 ( 5 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAllLogonTasks**6gQ  E'b& 8PG! gQ oP8 ( 6 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreDesktopSwitchTasks**7gQ  E'b& 8P/! gQ oP8 ( 7 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellPrep**8gQ  E'b& 8P/! gQ oP8 ( 8 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellPrep**9gQ  E'b& 8PO! gQ oP8 ( 9 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f4AppReadinessPreShellGroup**:gQ  E'b& 8P5! gQ oP8 ( : ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fSkydrivePrep**;gQ  E'b& 8P5! gQ oP8 ( ; ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fSkydrivePrep**<gQ  E'b& 8P+! gQ oP8 ( < ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fRunOnce**={  E'b& 8P+! { oP8 ( = ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fRunOnce**>{  E'b& 8P3! { oP8 ( > ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fActiveSetup**?  E'b& 8P3!  ?` /K+8 ( ? ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fActiveSetupa**@  E'b& 8PC!  ?` /K+8 ( @ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f(WaitForMSAConnectedd**A  E'b& 8PC!  ?` /K+8 ( A ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f(WaitForMSAConnected**B  E'b& 8PG!  ?` /K+8 ( B ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreConfigLauncherSyncCom**C  E'b& 8PG!  ?` /K+8 ( C ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreConfigLauncherSyncify**D  E'b& 8PG!  ?` /K+8 ( D ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreDesktopSwitchTaskstRu**E  E'b& 8P;!  ?` /K+8 ( E ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f PerUserServicesR**F  E'b& 8P;!  ?` /K+8 ( F ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f PerUserServices**G  E'b& 8P7!  ?` /K+8 ( G ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreShellTasks**H  E'b& 8PE!  ?` /K+8 ( H ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*RoamingPayloads0and1**I  E'b& 8PE!  ?` /K+8 ( I ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*RoamingPayloads0and1****J  E'b& 8PO!  ?` /K+8 ( J ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f4AppReadinessPreShellGroupls\**K  E'b& 8P3!  ?` /K+8 ( K ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAppResolvera**L  E'b& 8P!mm  ?` /K+8 ( L ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational EYi ndo**M(x  E'b& 8P3! (x P8 ( M ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAppResolver**N(x  E'b& 8P7! (x P8 ( N ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreShellTasksP**O(x  E'b& 8P9! (x P8 PO ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellInitTasks**P(x  E'b& 8P9! (x P8 PP ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellInitTasksom**Q  E'b& 8P7! P8 PQ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreStartTasks **R  E'b& 8P;! P8 PR ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload2o**S  E'b& 8PI! P8 PS ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f.AppReadinessLogonGroupor**T  E'b& 8P=! P8 PT ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f"UpdatePCSettingsi 2**U  E'b& 8P=! P8 PU ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f"UpdatePCSettingshell**V  E'b& 8P;! P8 PV ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload2o**W  E'b& 8PI! P8 PW ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f.AppReadinessLogonGroupdo**X  E'b& 8P7! P8 PX ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreStartTasksndo**Y#Z  E'b& 8P7! #Z P8 PY ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAllLogonTasksoso**Z#Z  E'b& 8P;! #Z P8 lZ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload3W**[#Z  E'b& 8P;! #Z P8 l[ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload3o**\#Z  E'b& 8P[! #Z P8 \ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f@AppReadinessNotifyLogonCompleteS**]#Z  E'b& 8P[! #Z P8 ] ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f@AppReadinessNotifyLogonCompletet**^#Z  E'b& 8PE! #Z P8 ^ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*ARSFirstRunTelemetryl f**_#Z  E'b& 8PE! #Z P8 _ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*ARSFirstRunTelemetrynOnc**x` E'b& 8P!nqm 8f\NO+h-P8 ` ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational &:x**xa E'b& 8P!nrm 8f\NO+h-P8 a ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational &:/Opx**bo E'b& 8P7!mm o8f\NO+h-P8 b ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational :R%=XYrat**cَ E'b& 8Po!%% َCG'tAPJ-8 c ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational @\Software\Microsoft\Windows\CurrentVersion\RuntFoSAConnected E'b& 8P 8Ppational f E'b& 8PPreShellTasksffElfChnkdd0@TO1Pw8`=f?mMF@ &9bQe** d E'b&E'bUa4UxLIDwEAM Eventjxmlns5http://schemas.microsoft.com/win/2004/08/events/eventoTSystemAY{Provider6F=KNameX)GuidAMzaEventID'X) Qualifiers " Version dLevelE{Task ?Opcode$fjKeywordsAP; TimeCreated'j<{ SystemTime .F EventRecordID A Correlation\FF ActivityIDmz5RelatedActivityID Am ExecutionHFF ProcessID9ThreadID "aChannel<F;nComputer FILF-APP-RECAB.SecurityfLUserID ! 8P!%% CG'tAPJ-8 d ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational _,ں_,ں # l`8D EventDataA7`oData=Command z"C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusr **xew E'b& 8P!%% wCG'tAPJ-8 e ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational m. m.C HXOagbV8A`=PID A%`=Command z"C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusrosox**0fw E'b& 8P!%% wCG'tAPJ-8 f ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational  3"E>28A%`=KeyName \Software\Microsoft\Windows\CurrentVersion\Runerat0**gw E'b& 8Po!%% wCG'tAPJ-8 g ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational  \Software\Microsoft\Windows\CurrentVersion\RunSer**hw E'b& 8P!%% wCG'tAPJ-8 h ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational _,ںv"C:\galaxie\deploy\Tomcat6\bin\Tomcat6w.exe" //MS//Tomcat6**i; E'b& 8P!%% ;CG'tAPJ-8 i ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational m. v"C:\galaxie\deploy\Tomcat6\bin\Tomcat6w.exe" //MS//Tomcat6 L**j; E'b& 8Po!%% ;CG'tAPJ-8 j ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational  \Software\Microsoft\Windows\CurrentVersion\Run**k< E'b& 8Pw!%% <CG'tAPJ-8 k ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational  dSoftware\Microsoft\Windows\CurrentVersion\RunOnceoso**l< E'b& 8Pw!%% <CG'tAPJ-8 l ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational  dSoftware\Microsoft\Windows\CurrentVersion\RunOnceoso**(m]* E'b& 8P! ]*P1X m ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational ff6!yƒpd8A)`= LogonType A'`=TaskName AllLogonTasksell(**n]* E'b& 8PG! ]*P1X n ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreDesktopSwitchTasksrat**o]* E'b& 8P/! ]*P1X o ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellPrep/Op**p]* E'b& 8P/! ]*P1X p ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellPrepCor**q]* E'b& 8PO! ]*P1X q ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f4AppReadinessPreShellGroupona**r]* E'b& 8P5! ]*P1X r ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fSkydrivePrepiona**s]* E'b& 8P5! ]*P1X s ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fSkydrivePrepiona**t]* E'b& 8P+! ]*P1X t ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fRunOncel**u;* E'b& 8P+! ;*P1X u ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fRunOnceW**v;* E'b& 8P3! ;*P1X v ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fActiveSetupc**w1, E'b& 8P3! 1,P1X w ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fActiveSetupR**x1, E'b& 8PC! 1,P1X x ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f(WaitForMSAConnected'**y1, E'b& 8PC! 1,P1X y ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f(WaitForMSAConnectedR**z1, E'b& 8PG! 1,P1X z ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreConfigLauncherSyncoso**{1, E'b& 8PG! 1,P1X { ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreConfigLauncherSyncndo**|1, E'b& 8PG! 1,P1X | ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreDesktopSwitchTasksell**}1, E'b& 8P;! 1,P1X } ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f PerUserServiceso**~1, E'b& 8P;! 1,P1X ~ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f PerUserServicesr**1, E'b& 8P7! 1,P1X  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreShellTaskss-S**1, E'b& 8PE! 1,P1X  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*RoamingPayloads0and1ws-S**X, E'b& 8PE! X,P1X  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*RoamingPayloads0and1-Cor**X, E'b& 8PO! X,P1X  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f4AppReadinessPreShellGroupell**X, E'b& 8P3! X,P1X  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAppResolver**[C- E'b& 8P!mm [C-P1X  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational EY@ EYM~q; g&h\8A'`=Scenario A!`=Flags  ntV**K- E'b& 8P3! K- P1X  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAppResolverΘ**K- E'b& 8P7! K- P1X  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreShellTasksMic**[- E'b& 8P9! [- P1X  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellInitTasksr**[- E'b& 8P9! [- P1X  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellInitTasksft**  E'b& 8P7! P1X  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreStartTasksona**  E'b& 8P;! P1X  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload2W**  E'b& 8PI! P1X  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f.AppReadinessLogonGroupdo**  E'b& 8P=! P1X  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f"UpdatePCSettingsJ8Ca**  E'b& 8P=! P1X  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f"UpdatePCSettings8**  E'b& 8P;! P1X  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload2**  E'b& 8PI! P1X  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f.AppReadinessLogonGroupe**  E'b& 8P7! P1X  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreStartTasksks**)e E'b& 8P7! )eP1X  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAllLogonTaskswit**)e E'b& 8P;! )eP1X $  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload3P**)e E'b& 8P;! )eP1X $  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload3**9 E'b& 8P[! 9P1X  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f@AppReadinessNotifyLogonComplete**9 E'b& 8P[! 9P1X  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f@AppReadinessNotifyLogonComplete**9 E'b& 8PE! 9P1X  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*ARSFirstRunTelemetry**-a E'b& 8PE! -aP1X  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*ARSFirstRunTelemetry**%$ E'b& 8P9!nqm %$-a MGF@1\öX  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational &9b&| p)c8**x( E'b& 8P!nrm (-a MGF@1\öX  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational &9bx**~^. E'b& 8Pk!mm ~^.-a MGF@1\öX  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational :R%Qe:R%&Gm3}8A1`#= ItemsExisting A+`= ItemsAdded A/`!= ItemsRemoved A/`!= ItemsUpdated A-`= ItemsCached XY**襤 E'b& 8Po!%% 襤-a MGF@1\öX p ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational  \Software\Microsoft\Windows\CurrentVersion\RunZ**襤 E'b& 8P!%% 襤-a MGF@1\öX p ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational _,ںz"C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusr** E'b& 8P!%% -a MGF@1\öX p ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational m. z<"C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusrP** E'b& 8Po!%% -a MGF@1\öX p ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational  \Software\Microsoft\Windows\CurrentVersion\Run ذĤ** E'b& 8Po!%% -a MGF@1\öX p ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational  \Software\Microsoft\Windows\CurrentVersion\Runell** E'b& 8P!%% -a MGF@1\öX p ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational _,ںv"C:\galaxie\deploy\Tomcat6\bin\Tomcat6w.exe" //MS//Tomcat6or** E'b& 8P!%% @3otSKY}NX p ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational m. vD"C:\galaxie\deploy\Tomcat6\bin\Tomcat6w.exe" //MS//Tomcat6an** E'b& 8Po!%% @3otSKY}NX p ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational  \Software\Microsoft\Windows\CurrentVersion\Run<6**% E'b& 8Pw!%% %@3otSKY}NX p ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational  dSoftware\Microsoft\Windows\CurrentVersion\RunOnce**% E'b& 8Pw!%% %@3otSKY}NX p ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational  dSoftware\Microsoft\Windows\CurrentVersion\RunOnce **{| E'b& 8P7! {|PL  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAllLogonTasks **{| E'b& 8PG! {|PL  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreDesktopSwitchTasks**[~| E'b& 8P/! [~|PL  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellPrep**[~| E'b& 8P/! [~|PL  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellPrep **[~| E'b& 8PO! [~|PL  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f4AppReadinessPreShellGroup ذĤ**[~| E'b& 8P5! [~|PL  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fSkydrivePrep ذĤ**[~| E'b& 8P5! [~|PL  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fSkydrivePrep ذĤ**[~| E'b& 8P+! [~|PL  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fRunOnce **[~| E'b& 8P+! [~|PL  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fRunOnce**[~| E'b& 8P3! [~|PL  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fActiveSetup**~| E'b& 8P3! ~|PL  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fActiveSetup**~| E'b& 8PC! ~|PL  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f(WaitForMSAConnected**~| E'b& 8PC! ~|PL  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f(WaitForMSAConnected**~| E'b& 8PG! ~|PL  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreConfigLauncherSync**~| E'b& 8PG! ~|PL  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreConfigLauncherSync**~| E'b& 8PG! ~|PL  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreDesktopSwitchTasks **~| E'b& 8P;! ~|PL  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f PerUserServices**~| E'b& 8P;! ~|PL  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f PerUserServices**~| E'b& 8P7! ~|PL  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreShellTasks**~| E'b& 8PE! ~|PL  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*RoamingPayloads0and1**~| E'b& 8PE! ~|PL  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*RoamingPayloads0and1 **~| E'b& 8PO! ~|PL  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f4AppReadinessPreShellGroup 2**~| E'b& 8P3! ~|PL  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAppResolver**~| E'b& 8P!mm ~|PL  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational EY@ P**~| E'b& 8P3! ~|PL  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAppResolver**~| E'b& 8P7! ~|PL  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreShellTaskse\V**~| E'b& 8P9! ~|PL 0 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellInitTasksOp**~| E'b& 8P9! ~|PL 0 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellInitTasksic**| E'b& 8P7! | PL 0 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreStartTaskst-W**| E'b& 8P;! | PL 0 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload2**| E'b& 8PI! | PL 0 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f.AppReadinessLogonGroup**| E'b& 8P=! | PL 0 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f"UpdatePCSettingsO >**| E'b& 8P=! | PL 0 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f"UpdatePCSettingsVers**| E'b& 8P;! | PL 0 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload2a**| E'b& 8PI! | PL 0 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f.AppReadinessLogonGroupOp**| E'b& 8P7! | PL 0 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreStartTasks/Op**U| E'b& 8P7! U| PL 0 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAllLogonTasksell**U| E'b& 8P;! U| PL  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload3r**U| E'b& 8P;! U| PL  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload3p**<} E'b& 8P[! <} PL  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f@AppReadinessNotifyLogonCompletet**<} E'b& 8P[! <} PL  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f@AppReadinessNotifyLogonComplete**Y} E'b& 8PE! Y} PL  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*ARSFirstRunTelemetrynOnc**c} E'b& 8PE! c} PL  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*ARSFirstRunTelemetry{ **x_v E'b& 8P!nqm _v:oH.ZSL  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational &9betux**x{ E'b& 8P!nrm {:oH.ZSL  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational &9bx**K E'b& 8P7!mm K:oH.ZSL  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational :R%QeXY(**f E'b& 8Po!%% f:oH.ZSL `  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational  \Software\Microsoft\Windows\CurrentVersion\Run**f E'b& 8P!%% f:oH.ZSL `  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational _,ںz"C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusr** E'b& 8P!%% :oH.ZSL `  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational m. zD "C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusr/K** E'b& 8Po!%% :oH.ZSL `  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational  \Software\Microsoft\Windows\CurrentVersion\Run ذĤ** E'b& 8Po!%% :oH.ZSL `  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational  \Software\Microsoft\Windows\CurrentVersion\Runell** E'b& 8P!%% :oH.ZSL `  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational _,ںv"C:\galaxie\deploy\Tomcat6\bin\Tomcat6w.exe" //MS//Tomcat6or**X E'b& 8P!%% X&|L)`~L `  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational m. v"C:\galaxie\deploy\Tomcat6\bin\Tomcat6w.exe" //MS//Tomcat6an**X E'b& 8Po!%% X&|L)`~L `  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational  \Software\Microsoft\Windows\CurrentVersion\Run **/X E'b& 8Pw!%% /X&|L)`~L `  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational  dSoftware\Microsoft\Windows\CurrentVersion\RunOnce**/X E'b& 8Pw!%% /X&|L)`~L `  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational  dSoftware\Microsoft\Windows\CurrentVersion\RunOnce **~˪4 E'b& 8P7! ~˪4 L KV4\` ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAllLogonTasks8 **~˪4 E'b& 8PG! ~˪4 L KV4\` ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreDesktopSwitchTasks**~˪4 E'b& 8P/! ~˪4 L KV4\` ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellPrep**~˪4 E'b& 8P/! ~˪4 L KV4\` ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellPrepP**~˪4 E'b& 8PO! ~˪4 L KV4\` ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f4AppReadinessPreShellGroup ذĤ**~˪4 E'b& 8P5! ~˪4 L KV4\` ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fSkydrivePrep ذĤ**~˪4 E'b& 8P5! ~˪4 L KV4\` ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fSkydrivePrep ذĤ**~˪4 E'b& 8P+! ~˪4 L KV4\` ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fRunOnce **~˪4 E'b& 8P+! ~˪4 L KV4\` ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fRunOnce**~˪4 E'b& 8P3! ~˪4 L KV4\` ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fActiveSetup**4{4 E'b& 8P3! 4{4 L KV4\` ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fActiveSetup**4{4 E'b& 8PC! 4{4 L KV4\` ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f(WaitForMSAConnected**4{4 E'b& 8PC! 4{4 L KV4\` ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f(WaitForMSAConnected**4{4 E'b& 8PG! 4{4 L KV4\` ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreConfigLauncherSync**4{4 E'b& 8PG! 4{4 L KV4\` ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreConfigLauncherSync**4{4 E'b& 8PG! 4{4 L KV4\` ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreDesktopSwitchTasks8 **4{4 E'b& 8P;! 4{4 L KV4\` ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f PerUserServices**4{4 E'b& 8P;! 4{4 L KV4\` ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f PerUserServices**4{4 E'b& 8P7! 4{4 L KV4\` ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreShellTasks**4{4 E'b& 8PE! 4{4 L KV4\` ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*RoamingPayloads0and1**O4 E'b& 8PE! O4 L KV4\` ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*RoamingPayloads0and1 **O4 E'b& 8PO! O4 L KV4\` ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f4AppReadinessPreShellGroup 2**O4 E'b& 8P3! O4 L KV4\` ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAppResolver**cǬ4 E'b& 8P!mm cǬ4 L KV4\` ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational EY@ P 8 E'b& 8P 8PPreShellTasksffElfChnkPci絪8`=f?mMF d.I0&1(I+**cǬ4 E'b&E'bUa4UxLIDwEAM Eventjxmlns5http://schemas.microsoft.com/win/2004/08/events/eventoTSystemAY{Provider6F=KNameX)GuidAMzaEventID'X) Qualifiers " Version dLevelE{Task ?Opcode$fjKeywordsAP; TimeCreated'j<{ SystemTime .F EventRecordID A Correlation\FF ActivityIDmz5RelatedActivityID Am ExecutionHFF ProcessID9ThreadID "aChannel<F;nComputer FILF-APP-RECAB.SecurityfLUserID ! 8P! cǬ4 L KV4\` ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational ff6!yƒ8D EventDataA;`oData= LogonType A'`=TaskName AppResolverol**cǬ4 E'b& 8P7! cǬ4 L KV4\` ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreShellTasksm.C **w4 E'b& 8P9! w4 L KV4\ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellInitTasks8 **w4 E'b& 8P9! w4 L KV4\ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellInitTasks**a4 E'b& 8P7! a4 L KV4\ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreStartTasksCur**a4 E'b& 8P;! a4 L KV4\ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload2C**a4 E'b& 8PI! a4 L KV4\ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f.AppReadinessLogonGroup-S**a4 E'b& 8P=! a4 L KV4\ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f"UpdatePCSettingsindo**a4 E'b& 8P=! a4 L KV4\ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f"UpdatePCSettings**a4 E'b& 8P;! a4 L KV4\ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload2**a4 E'b& 8PI! a4 L KV4\ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f.AppReadinessLogonGroup**a4 E'b& 8P7! a4 L KV4\ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreStartTaskskNa**^5 E'b& 8P7! ^5 L KV4\ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAllLogonTasksona**^5 E'b& 8P;! ^5 L KV4\ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload3p**^5 E'b& 8P;! ^5 L KV4\ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload3t**5 E'b& 8P[! 5 L KV4\\ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f@AppReadinessNotifyLogonCompletep**5 E'b& 8P[! 5 L KV4\\ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f@AppReadinessNotifyLogonCompletei**5 E'b& 8PE! 5 L KV4\ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*ARSFirstRunTelemetryep**5 E'b& 8PE! 5 L KV4\ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*ARSFirstRunTelemetry;***3: E'b& 8P9!nqm 3: L KV4\x ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational &1(&| p)c8&**x ̥: E'b& 8P!nrm ̥: L KV4\x  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational &1(**x** Wh: E'b& 8Pk!mm Wh: L KV4\x  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational :R%I+:R%&Gm3}8A1`#= ItemsExisting A+`= ItemsAdded A/`!= ItemsRemoved A/`!= ItemsUpdated A-`= ItemsCached YYl**0 ,; E'b& 8P!%% ,; L KV4\  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational .3"E>28A%`=KeyName \Software\Microsoft\Windows\CurrentVersion\Run0**H ,; E'b& 8P!%% ,; L KV4\  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational _,ںI0_,ں # >28A%`=Command z"C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusrH**x ; E'b& 8P!%% ; L KV4\  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational m.2m.C HXOagbV8A`=PID A%`=Command z,"C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusrPrx**; E'b& 8Po!%% ; L KV4\ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational .\Software\Microsoft\Windows\CurrentVersion\Run****; E'b& 8Po!%% ; L KV4\ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational .\Software\Microsoft\Windows\CurrentVersion\Run**; E'b& 8Po!%% ; L KV4\ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational .\Software\Microsoft\Windows\CurrentVersion\Run!**F; E'b& 8Pw!%% F; L KV4\ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational .dSoftware\Microsoft\Windows\CurrentVersion\RunOnce **F; E'b& 8Pw!%% F; L KV4\ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational .dSoftware\Microsoft\Windows\CurrentVersion\RunOnceoso**Hٹ E'b& 8P7! Hٹ_P|k ` ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAllLogonTasks ذĤ**Hٹ E'b& 8PG! Hٹ_P|k ` ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreDesktopSwitchTasksoso**Hٹ E'b& 8P/! Hٹ_P|k ` ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellPrep8**Hٹ E'b& 8P/! Hٹ_P|k ` ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellPrep8**Hٹ E'b& 8PO! Hٹ_P|k ` ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f4AppReadinessPreShellGroup**Hٹ E'b& 8P5! Hٹ_P|k ` ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fSkydrivePrep**Hٹ E'b& 8P5! Hٹ_P|k ` ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fSkydrivePrep**Hٹ E'b& 8P+! Hٹ_P|k ` ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fRunOnce**Hٹ E'b& 8P+! Hٹ_P|k ` ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fRunOnce**Hٹ E'b& 8P3! Hٹ_P|k ` ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fActiveSetup**Hٹ E'b& 8P3! Hٹ_P|k ` ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fActiveSetup**Hٹ E'b& 8PC! Hٹ_P|k ` ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f(WaitForMSAConnected**Hٹ E'b& 8PC! Hٹ_P|k ` ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f(WaitForMSAConnected** Hٹ E'b& 8PG! Hٹ_P|k `  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreConfigLauncherSync**!Hٹ E'b& 8PG! Hٹ_P|k `! ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreConfigLauncherSync**"Hٹ E'b& 8PG! Hٹ_P|k `" ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreDesktopSwitchTasks**#Hٹ E'b& 8P;! Hٹ_P|k `# ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f PerUserServices**$Hٹ E'b& 8P;! Hٹ_P|k `$ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f PerUserServices**%Hٹ E'b& 8P7! Hٹ_P|k `% ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreShellTasks**&Hٹ E'b& 8PE! Hٹ_P|k `& ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*RoamingPayloads0and1**'۹ E'b& 8PE! ۹_P|k `' ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*RoamingPayloads0and1**(۹ E'b& 8PO! ۹_P|k `( ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f4AppReadinessPreShellGroup**)۹ E'b& 8P3! ۹_P|k `) ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAppResolver***۹ E'b& 8P!mm ۹_P|k `* ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational EY d2EYM~q; g&h\8A'`=Scenario A!`=Flags   ذĤ**+۹ E'b& 8P3! ۹ kP|k `+ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAppResolverU**,۹ E'b& 8P7! ۹ kP|k `, ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreShellTaskst-W**-۹ E'b& 8P9! ۹ kP|k L- ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellInitTasks-S**.۹ E'b& 8P9! ۹ kP|k L. ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellInitTasksF@**/|o E'b& 8P7! |o P|k L/ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreStartTasks**0|o E'b& 8P;! |o P|k L0 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload2**1|o E'b& 8PI! |o P|k L1 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f.AppReadinessLogonGroupur**2|o E'b& 8P=! |o P|k L2 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f"UpdatePCSettings:\ga**3|o E'b& 8P=! |o P|k L3 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f"UpdatePCSettingsws-S**4|o E'b& 8P;! |o P|k L4 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload2W**5|o E'b& 8PI! |o P|k L5 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f.AppReadinessLogonGroup**6|o E'b& 8P7! |o P|k L6 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreStartTasks!**7, E'b& 8P7! , P|k L7 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAllLogonTasks**8, E'b& 8P;! , P|k x8 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload3**9, E'b& 8P;! , P|k x9 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload3**:}ѿ E'b& 8P!nqm }ѿP|k > ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational &1(x**x?Qֿ E'b& 8P!nrm QֿP|k ? ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational &1(x**@ ߿ E'b& 8P7!mm ߿P|k @ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational :R%I+XY**A E'b& 8Po!%% H?CBWyb A ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational .\Software\Microsoft\Windows\CurrentVersion\Run**B E'b& 8P!%% H?CBWyb B ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational _,ںI0z"C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusrws-S**Cކ E'b& 8P!%% ކH?CBWyb C ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational m.2z"C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusr-Cor**Dކ E'b& 8Po!%% ކH?CBWyb D ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational .\Software\Microsoft\Windows\CurrentVersion\Run,**Eކ E'b& 8Po!%% ކH?CBWyb E ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational .\Software\Microsoft\Windows\CurrentVersion\RunerS**Fކ E'b& 8P!%% ކH?CBWyb F ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational _,ںI0v"C:\galaxie\deploy\Tomcat6\bin\Tomcat6w.exe" //MS//Tomcat6**GI_ E'b& 8P!%% I_H?CBWyb G ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational m.2vL "C:\galaxie\deploy\Tomcat6\bin\Tomcat6w.exe" //MS//Tomcat6 ~**HI_ E'b& 8Po!%% I_H?CBWyb H ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational .\Software\Microsoft\Windows\CurrentVersion\Run ذĤ**I` E'b& 8Pw!%% `H?CBWyb I ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational .dSoftware\Microsoft\Windows\CurrentVersion\RunOnceCor**J` E'b& 8Pw!%% `H?CBWyb J ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational .dSoftware\Microsoft\Windows\CurrentVersion\RunOncendo**K7 E'b& 8P7! 7P7L K ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAllLogonTasksoso**L7 E'b& 8PG! 7P7L L ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreDesktopSwitchTasksMic**M7 E'b& 8P/! 7P7L M ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellPrepMic**N7 E'b& 8P/! 7P7L N ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellPrept-W**O7 E'b& 8PO! 7P7L O ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f4AppReadinessPreShellGroupCor**P7 E'b& 8P5! 7P7L P ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fSkydrivePrep-Cor**Q7 E'b& 8P5! 7P7L Q ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fSkydrivePrep-Cor**R7 E'b& 8P+! 7P7L R ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fRunOnceS**S 7 E'b& 8P+! 7P7L S ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fRunOnceW**T 7 E'b& 8P3! 7P7L T ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fActiveSetupo**U7 E'b& 8P3! 7P7L U ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fActiveSetup'**V7 E'b& 8PC! 7P7L V ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f(WaitForMSAConnected'**W7 E'b& 8PC! 7P7L W ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f(WaitForMSAConnected'**X7 E'b& 8PG! 7P7L X ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreConfigLauncherSyncMic**Y7 E'b& 8PG! 7P7L Y ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreConfigLauncherSyncMic**Z7 E'b& 8PG! 7P7L Z ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreDesktopSwitchTaskst-W**[7 E'b& 8P;! 7P7L [ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f PerUserServicesW**\7 E'b& 8P;! 7P7L \ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f PerUserServicesW**]7 E'b& 8P7! 7P7L ] ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreShellTaskst-W**^7 E'b& 8PE! 7P7L ^ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*RoamingPayloads0and1aMic**_7 E'b& 8PE! 7P7L _ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*RoamingPayloads0and1en30'**`7 E'b& 8PO! 7P7L ` ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f4AppReadinessPreShellGroupQR**a7 E'b& 8P3! 7P7L a ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAppResolverl**b07 E'b& 8P!mm 07P7L b ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational EY d n30'**c@7 E'b& 8P3! @7P7L c ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAppResolverW**d@7 E'b& 8P7! @7P7L d ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreShellTaskst-W**eLH7 E'b& 8P9! LH7P7L x e ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellInitTasks-S**fPo7 E'b& 8P9! Po7P7L x f ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellInitTasksH**g~8 E'b& 8P7! ~8"P7L x g ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreStartTasks**h~8 E'b& 8P;! ~8"P7L x h ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload2**i~8 E'b& 8PI! ~8"P7L x i ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f.AppReadinessLogonGroupur**j~8 E'b& 8P=! ~8"P7L x j ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f"UpdatePCSettings:\ga**k~8 E'b& 8P=! ~8"P7L x k ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f"UpdatePCSettingsws-S**l~8 E'b& 8P;! ~8"P7L x l ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload2W**m~8 E'b& 8PI! ~8"P7L x m ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f.AppReadinessLogonGroup**n~8 E'b& 8P7! ~8"P7L x n ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreStartTasks!**o8 E'b& 8P7! 8"P7L x o ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAllLogonTasks**p8 E'b& 8P;! 8"P7L p ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload3**q8 E'b& 8P;! 8"P7L q ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload3**r8 E'b& 8P[! 8"P7L r ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f@AppReadinessNotifyLogonComplete**s8 E'b& 8P[! 8"P7L s ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f@AppReadinessNotifyLogonComplete**t8 E'b& 8PE! 8"P7L pt ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*ARSFirstRunTelemetryP**u#8 E'b& 8PE! #8"P7L pu ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*ARSFirstRunTelemetry**xv = E'b& 8P!nqm =28A%`=KeyName \Software\Microsoft\Windows\CurrentVersion\RunllGr0**H$ѱ E'b& 8P!%% $ѱu%sAv0+w(  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational _,ںab_,ں # >28A%`=Command z"C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusr H**xN+ѱ E'b& 8P!%% N+ѱu%sAv0+w(  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational m.d1:m.C HXOagbV8A`=PID A%`=Command z"C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusrQRx**N+ѱ E'b& 8Po!%% N+ѱu%sAv0+w(  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational 1`\Software\Microsoft\Windows\CurrentVersion\Run/Op**N+ѱ E'b& 8Po!%% N+ѱu%sAv0+w(  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational 1`\Software\Microsoft\Windows\CurrentVersion\RunllI**N+ѱ E'b& 8P!%% N+ѱu%sAv0+w(  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational _,ںabv"C:\galaxie\deploy\Tomcat6\bin\Tomcat6w.exe" //MS//Tomcat6**qѱ E'b& 8P!%% qѱigYN*(  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational m.dv "C:\galaxie\deploy\Tomcat6\bin\Tomcat6w.exe" //MS//Tomcat6 **qѱ E'b& 8Po!%% qѱigYN*(  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational 1`\Software\Microsoft\Windows\CurrentVersion\Run 2**ѱ E'b& 8Pw!%% ѱigYN*(  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational 1`dSoftware\Microsoft\Windows\CurrentVersion\RunOnceell**ѱ E'b& 8Pw!%% ѱigYN*(  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational 1`dSoftware\Microsoft\Windows\CurrentVersion\RunOncendo**ñ&%  E'b& 8P7! ñ&% ZP$< ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAllLogonTaskst-W**ñ&%  E'b& 8PG! ñ&% ZP$< ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreDesktopSwitchTaskss-S**ñ&%  E'b& 8P/! ñ&% ZP$< ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellPreposo**ñ&%  E'b& 8P/! ñ&% ZP$< ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellPrepMic**ñ&%  E'b& 8PO! ñ&% ZP$< ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f4AppReadinessPreShellGroupndo**ñ&%  E'b& 8P5! ñ&% ZP$< ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fSkydrivePrepindo**ñ&%  E'b& 8P5! ñ&% ZP$< ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fSkydrivePrepindo**ñ&%  E'b& 8P+! ñ&% ZP$< ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fRunOncer**ñ&%  E'b& 8P+! ñ&% ZP$< ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fRunOncec**ñ&%  E'b& 8P3! ñ&% ZP$< ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fActiveSetup**)%  E'b& 8P3! )% ZP$< ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fActiveSetup **)%  E'b& 8PC! )% ZP$< ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f(WaitForMSAConnectedc**)%  E'b& 8PC! )% ZP$< ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f(WaitForMSAConnectedr**)%  E'b& 8PG! )% ZP$< ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreConfigLauncherSyncQR**)%  E'b& 8PG! )% ZP$< ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreConfigLauncherSyncndo**)%  E'b& 8PG! )% ZP$< ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreDesktopSwitchTasksb **)%  E'b& 8P;! )% ZP$< ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f PerUserServices**)%  E'b& 8P;! )% ZP$< ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f PerUserServices**)%  E'b& 8P7! )% ZP$< ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreShellTasksows**)%  E'b& 8PE! )% ZP$< ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*RoamingPayloads0and1:\ga**)%  E'b& 8PE! )% ZP$< ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*RoamingPayloads0and1hell**)%  E'b& 8PO! )% ZP$< ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f4AppReadinessPreShellGroupCor**)%  E'b& 8P3! )% ZP$< ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAppResolver**v+%  E'b& 8P!mm v+% ZP$< ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational EY1: 8**v+%  E'b& 8P3! v+% <P$< ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAppResolver**v+%  E'b& 8P7! v+% <P$< ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreShellTasks**v+%  E'b& 8P9! v+% <P$<l ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellInitTasks**v+%  E'b& 8P9! v+% <P$<l ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellInitTasks7** &  E'b& 8P7!  & P$<l ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreStartTasks** &  E'b& 8P;!  & P$<l ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload2** &  E'b& 8PI!  & P$<l ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f.AppReadinessLogonGroup7** &  E'b& 8P=!  & P$<l ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f"UpdatePCSettings** &  E'b& 8P=!  & P$<l ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f"UpdatePCSettings** &  E'b& 8P;!  & P$<l ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload2** &  E'b& 8PI!  & P$<l ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f.AppReadinessLogonGroup** &  E'b& 8P7!  & P$<l ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreStartTasks8**PX&  E'b& 8P7! PX& P$<l ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAllLogonTasks**PX&  E'b& 8P;! PX& P$<  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload3**PX&  E'b& 8P;! PX& P$<  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload3**&  E'b& 8P[! & P$<  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f@AppReadinessNotifyLogonComplete**&  E'b& 8P[! & P$<  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f@AppReadinessNotifyLogonComplete**&  E'b& 8PE! & P$<  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*ARSFirstRunTelemetry;!**%&  E'b& 8PE! %& P$<  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*ARSFirstRunTelemetry **xe"+  E'b& 8P!nqm e"+ !DLt0PSJ  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational & x**x׼'+  E'b& 8P!nrm ׼'+ !DLt0PSJ  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational & 'b&x**5^/+  E'b& 8P7!mm 5^/+ !DLt0PSJ  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational :R% YZ7**:,  E'b& 8Po!%% :, 2(3`L #U ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational 1`\Software\Microsoft\Windows\CurrentVersion\Run**:,  E'b& 8P!%% :, 2(3`L #U ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational _,ںabz"C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusrP** B,  E'b& 8P!%% B, 2(3`L #U ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational m.dz"C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusr|DQR** B,  E'b& 8Po!%% B, 2(3`L #U ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational 1`\Software\Microsoft\Windows\CurrentVersion\Run/Op** B,  E'b& 8Po!%% B, 2(3`L #U ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational 1`\Software\Microsoft\Windows\CurrentVersion\RunllI** B,  E'b& 8P!%% B, 2(3`L #U ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational _,ںabv"C:\galaxie\deploy\Tomcat6\bin\Tomcat6w.exe" //MS//Tomcat6**.C,  E'b& 8P!%% .C, 2(3`L #U ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational m.dv "C:\galaxie\deploy\Tomcat6\bin\Tomcat6w.exe" //MS//Tomcat6"**.C,  E'b& 8Po!%% .C, 2(3`L #U ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational 1`\Software\Microsoft\Windows\CurrentVersion\Run 2**j,  E'b& 8Pw!%% j, 2(3`L #U ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational 1`dSoftware\Microsoft\Windows\CurrentVersion\RunOnceell**j,  E'b& 8Pw!%% j, 2(3`L #U ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational 1`dSoftware\Microsoft\Windows\CurrentVersion\RunOncendo**C) E'b& 8P7! C)@P??@x ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAllLogonTaskst-W**C) E'b& 8PG! C)@P??@x ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreDesktopSwitchTaskss-S**C) E'b& 8P/! C)@P??@x ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellPreposo**C) E'b& 8P/! C)@P??@x ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellPrepMic**C) E'b& 8PO! C)@P??@x ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f4AppReadinessPreShellGroupndo**C) E'b& 8P5! C)@P??@x ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fSkydrivePrepindo**C) E'b& 8P5! C)@P??@x ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fSkydrivePrepindo**C) E'b& 8P+! C)@P??@x ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fRunOncer**C) E'b& 8P+! C)@P??@x ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fRunOncec**C) E'b& 8P3! C)@P??@x ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fActiveSetup**C) E'b& 8P3! C)@P??@x ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fActiveSetup **C) E'b& 8PC! C)@P??@x ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f(WaitForMSAConnectedc**C) E'b& 8PC! C)@P??@x ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f(WaitForMSAConnectedr**C) E'b& 8PG! C)@P??@x ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreConfigLauncherSyncQR** C) E'b& 8PG! C)@P??@x  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreConfigLauncherSyncndo** C) E'b& 8PG! C)@P??@x  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreDesktopSwitchTasks/î ** C) E'b& 8P;! C)@P??@x  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f PerUserServices** C) E'b& 8P;! C)@P??@x  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f PerUserServices** C) E'b& 8P7! C)@P??@x  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreShellTasksows**C) E'b& 8PE! C)@P??@x ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*RoamingPayloads0and1:\ga**C) E'b& 8PE! C)@P??@x ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*RoamingPayloads0and1hell**C) E'b& 8PO! C)@P??@x ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f4AppReadinessPreShellGroupCor**C) E'b& 8P3! C)@P??@x ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAppResolver**!C) E'b& 8P!mm !C)x MT|g@x ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational EY1: 8**!C) E'b& 8P3! !C)?P??@x ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAppResolver**!C) E'b& 8P7! !C)?P??@x ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreShellTasks**!C) E'b& 8P9! !C)?P??@ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellInitTasks!**!C) E'b& 8P9! !C)?P??@ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellInitTasksicsoft-Windows E'b& 8PCore/Operational 1c 8P 8PPreShellTasksffElfChnk6x,|| 8`=f?mMFya')&!$**? C) E'b&E'bUa4UxLIDwEAM Eventjxmlns5http://schemas.microsoft.com/win/2004/08/events/eventoTSystemAY{Provider6F=KNameX)GuidAMzaEventID'X) Qualifiers " Version dLevelE{Task ?Opcode$fjKeywordsAP; TimeCreated'j<{ SystemTime .F EventRecordID A Correlation\FF ActivityIDmz5RelatedActivityID Am ExecutionHFF ProcessID9ThreadID "aChannel<F;nComputer FILF-APP-RECAB.SecurityfLUserID ! 8P! ? C)P??@ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational ff6!yƒ8D EventDataA;`oData= LogonType A'`=TaskName PreStartTasksSCP**? C) E'b& 8P;! ? C)P??@ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload2c**? C) E'b& 8PI! ? C)P??@ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f.AppReadinessLogonGroup-W**? C) E'b& 8P=! ? C)P??@ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f"UpdatePCSettingsZ**? C) E'b& 8P=! ? C)P??@ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f"UpdatePCSettings**? C) E'b& 8P;! ? C)P??@ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload2**? C) E'b& 8PI! ? C)P??@ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f.AppReadinessLogonGroup8**? C) E'b& 8P7! ? C)P??@ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreStartTasksAl**p C) E'b& 8P7! p C)P??@ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAllLogonTasksPr** p C) E'b& 8P;! p C)P??@  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload3**!p C) E'b& 8P;! p C)P??@! ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload3**"p C) E'b& 8P[! p C)P??@ " ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f@AppReadinessNotifyLogonCompletee**#p C) E'b& 8P[! p C)P??@ # ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f@AppReadinessNotifyLogonComplete**$p C) E'b& 8PE! p C)P??@$ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*ARSFirstRunTelemetry ʰ**%p C) E'b& 8PE! p C)P??@% ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*ARSFirstRunTelemetry**&1C) E'b& 8P9!nqm 1C)xi s@@'gW@$ & ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational &!&| p)c8**x'BsC) E'b& 8P!nrm BsC)xi s@@'gW@$ ' ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational &!'b&x**(&0C) E'b& 8Pk!mm &0C)xi s@@'gW@$ ( ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational :R%$:R%&Gm3}8A1`#= ItemsExisting A+`= ItemsAdded A/`!= ItemsRemoved A/`!= ItemsUpdated A-`= ItemsCached YZa**0)dD"C) E'b& 8P!%% dD"C)|kCT3HyVQ@ ) ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational '3"E>28A%`=KeyName \Software\Microsoft\Windows\CurrentVersion\Run0**H*dD"C) E'b& 8P!%% dD"C)|kCT3HyVQ@ * ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational _,ں)_,ں # >28A%`=Command z"C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusroH**x+'C) E'b& 8P!%% 'C)|kCT3HyVQ@ + ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational m.,m.C HXOagbV8A`=PID A%`=Command z"C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusrhTax**,'C) E'b& 8Po!%% 'C)|kCT3HyVQ@ , ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational '\Software\Microsoft\Windows\CurrentVersion\Run'b&**-'C) E'b& 8Po!%% 'C)|kCT3HyVQ@ - ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational '\Software\Microsoft\Windows\CurrentVersion\Run**.'C) E'b& 8P!%% 'C)|kCT3HyVQ@ . ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational _,ں)v"C:\galaxie\deploy\Tomcat6\bin\Tomcat6w.exe" //MS//Tomcat6**/B-lC) E'b& 8P!%% B-lC)|kCT3HyVQ@ / ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational m.,v "C:\galaxie\deploy\Tomcat6\bin\Tomcat6w.exe" //MS//Tomcat6ll**0B-lC) E'b& 8Po!%% B-lC)|kCT3HyVQ@ 0 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational '\Software\Microsoft\Windows\CurrentVersion\Runoso**1B-lC) E'b& 8Pw!%% B-lC)|kCT3HyVQ@ 1 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational 'dSoftware\Microsoft\Windows\CurrentVersion\RunOnceCor**2B-lC) E'b& 8Pw!%% B-lC)|kCT3HyVQ@ 2 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational 'dSoftware\Microsoft\Windows\CurrentVersion\RunOnce\**3)yB+ E'b& 8P7! )yB+6P1v|H3 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAllLogonTaskst-W**4)yB+ E'b& 8PG! )yB+6P1v|H4 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreDesktopSwitchTasksell**5)yB+ E'b& 8P/! )yB+6P1v|H5 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellPreps-S**6)yB+ E'b& 8P/! )yB+6P1v|H6 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellPrepndo**7)yB+ E'b& 8PO! )yB+6P1v|H7 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f4AppReadinessPreShellGroupCor**8)yB+ E'b& 8P5! )yB+6P1v|H8 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fSkydrivePrep-Cor**9)yB+ E'b& 8P5! )yB+6P1v|H9 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fSkydrivePrep-Cor**:)yB+ E'b& 8P+! )yB+6P1v|H: ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fRunOnceW**;QyB+ E'b& 8P+! QyB+6P1v|H; ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fRunOnceR**<QyB+ E'b& 8P3! QyB+6P1v|H< ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fActiveSetupr**=-B+ E'b& 8P3! -B+ <1CH= ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fActiveSetupl**>-B+ E'b& 8PC! -B+ <1CH> ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f(WaitForMSAConnectedS**?-B+ E'b& 8PC! -B+ <1CH? ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f(WaitForMSAConnectedl**@-B+ E'b& 8PG! -B+ <1CH@ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreConfigLauncherSyncn30'**A-B+ E'b& 8PG! -B+ <1CHA ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreConfigLauncherSyncell**B-B+ E'b& 8PG! -B+ <1CHB ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreDesktopSwitchTasksndo**C-B+ E'b& 8P;! -B+ <1CHC ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f PerUserServiceso**D-B+ E'b& 8P;! -B+ <1CHD ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f PerUserServiceso**E-B+ E'b& 8P7! -B+ <1CHE ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreShellTasksoso**F-B+ E'b& 8PE! -B+ <1CHF ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*RoamingPayloads0and1roso**GtB+ E'b& 8PE! tB+ <1CHG ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*RoamingPayloads0and1|DQR**HtB+ E'b& 8PO! tB+ <1CHH ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f4AppReadinessPreShellGroup/Op**ItB+ E'b& 8P3! tB+ <1CHI ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAppResolverr**J„B+ E'b& 8P!mm „B+ <1CHJ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational EYya,EYM~q; g&h\8A'`=Scenario A!`=Flags  oso**K8B+ E'b& 8P3! 8B+ |P1v|HK ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAppResolver**L8B+ E'b& 8P7! 8B+ |P1v|HL ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreShellTasksm F**MB+ E'b& 8P9! B+ |P1v|H M ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellInitTasks-S**NB+ E'b& 8P9! B+ |P1v|H N ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellInitTasksor**O;eC+ E'b& 8P7! ;eC+P1v|H O ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreStartTasks 2**P;eC+ E'b& 8P;! ;eC+P1v|H P ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload2**Q;eC+ E'b& 8PI! ;eC+P1v|H Q ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f.AppReadinessLogonGroup**R;eC+ E'b& 8P=! ;eC+P1v|H R ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f"UpdatePCSettings 2**S;eC+ E'b& 8P=! ;eC+P1v|H S ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f"UpdatePCSettingsdows**T;eC+ E'b& 8P;! ;eC+P1v|H T ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload2**U;eC+ E'b& 8PI! ;eC+P1v|H U ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f.AppReadinessLogonGroup-S**V;eC+ E'b& 8P7! ;eC+P1v|H V ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreStartTaskss-S**WrC+ E'b& 8P7! rC+P1v|H W ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAllLogonTaskst-W**XsC+ E'b& 8P[! sC+P1v|H0X ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f@AppReadinessNotifyLogonCompletep**YsC+ E'b& 8P[! sC+P1v|H0Y ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f@AppReadinessNotifyLogonComplete**ZsC+ E'b& 8P;! sC+P1v|HDZ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload3a**[sC+ E'b& 8P;! sC+P1v|HD[ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload3a**\sC+ E'b& 8PE! sC+P1v|HX\ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*ARSFirstRunTelemetry**] sC+ E'b& 8PE! sC+P1v|HX] ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*ARSFirstRunTelemetryec**x^@|H+ E'b& 8P!nqm @|H+ęN8t{ PHx^ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational &!x**x_= H+ E'b& 8P!nrm = H+ęN8t{ PHx_ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational &!ratx**`qH+ E'b& 8P7!mm qH+ęN8t{ PHx` ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational :R%$YZona**acwI+ E'b& 8Po!%% cwI+Nd׺KTHa ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational '\Software\Microsoft\Windows\CurrentVersion\RunMSA**bcwI+ E'b& 8P!%% cwI+Nd׺KTHb ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational _,ں)z"C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusr**c9}I+ E'b& 8P!%% 9}I+^,3WM9BGwHc ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational m.,z, "C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusr**d9}I+ E'b& 8Po!%% 9}I+^,3WM9BGwHd ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational '\Software\Microsoft\Windows\CurrentVersion\Run**e9}I+ E'b& 8Po!%% 9}I+^,3WM9BGwHe ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational '\Software\Microsoft\Windows\CurrentVersion\Runt-W**f9}I+ E'b& 8P!%% 9}I+^,3WM9BGwHf ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational _,ں)v"C:\galaxie\deploy\Tomcat6\bin\Tomcat6w.exe" //MS//Tomcat6do**gI+ E'b& 8P!%% I+k0HM| 7ۅdHg ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational m.,vP"C:\galaxie\deploy\Tomcat6\bin\Tomcat6w.exe" //MS//Tomcat6in**hI+ E'b& 8Po!%% I+k0HM| 7ۅdHh ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational '\Software\Microsoft\Windows\CurrentVersion\Runell**iI+ E'b& 8Pw!%% I+k0HM| 7ۅdHi ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational 'dSoftware\Microsoft\Windows\CurrentVersion\RunOnce'b&**jI+ E'b& 8Pw!%% I+k0HM| 7ۅdHj ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational 'dSoftware\Microsoft\Windows\CurrentVersion\RunOnceP**kq/ E'b& 8P7! q/fP_h0h k ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAllLogonTasks v**lq/ E'b& 8PG! q/fP_h0h l ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreDesktopSwitchTasks**mq/ E'b& 8P/! q/fP_h0h m ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellPrepP**nq/ E'b& 8P/! q/fP_h0h n ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellPrep **oq/ E'b& 8PO! q/fP_h0h o ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f4AppReadinessPreShellGroup**pq/ E'b& 8P5! q/fP_h0h p ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fSkydrivePrepl**qq/ E'b& 8P5! q/fP_h0h q ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fSkydrivePrepl**rq/ E'b& 8P+! q/fP_h0h r ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fRunOnce**sꗯq/ E'b& 8P+! ꗯq/fP_h0h s ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fRunOnce**tꗯq/ E'b& 8P3! ꗯq/fP_h0h t ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fActiveSetup**upq/ E'b& 8P3! pq/fP_h0h u ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fActiveSetup**vpq/ E'b& 8PC! pq/fP_h0h v ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f(WaitForMSAConnected**wpq/ E'b& 8PC! pq/fP_h0h w ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f(WaitForMSAConnected**xpq/ E'b& 8PG! pq/fP_h0h x ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreConfigLauncherSync8**ypq/ E'b& 8PG! pq/fP_h0h y ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreConfigLauncherSync!**zpq/ E'b& 8PG! pq/fP_h0h z ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreDesktopSwitchTasks **{pq/ E'b& 8P;! pq/fP_h0h { ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f PerUserServices**|pq/ E'b& 8P;! pq/fP_h0h | ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f PerUserServices**}pq/ E'b& 8P7! pq/fP_h0h } ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreShellTasks**~pq/ E'b& 8PE! pq/fP_h0h ~ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*RoamingPayloads0and1**噯q/ E'b& 8PE! 噯q/fP_h0h  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*RoamingPayloads0and1P**噯q/ E'b& 8PO! 噯q/fP_h0h  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f4AppReadinessPreShellGroup**噯q/ E'b& 8P3! 噯q/fP_h0h  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAppResolver**q/ E'b& 8P!mm q/fP_h0h  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational EYya **q/ E'b& 8P3! q/GP_h0h  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAppResolver**q/ E'b& 8P7! q/GP_h0h  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreShellTasks Fi**%lq/ E'b& 8P9! %lq/GP_h0  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellInitTasks-S**%lq/ E'b& 8P9! %lq/GP_h0  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellInitTasksor**wq/ E'b& 8P7! wq/P_h0  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreStartTasks 2**wq/ E'b& 8P;! wq/P_h0  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload2**wq/ E'b& 8PI! wq/P_h0  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f.AppReadinessLogonGroup**wq/ E'b& 8P=! wq/P_h0  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f"UpdatePCSettings 2**wq/ E'b& 8P=! wq/P_h0  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f"UpdatePCSettingsdows**wq/ E'b& 8P;! wq/P_h0  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload2**wq/ E'b& 8PI! wq/P_h0  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f.AppReadinessLogonGroup-S**wq/ E'b& 8P7! wq/P_h0  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreStartTaskss-S**5q/ E'b& 8P7! 5q/P_h0  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAllLogonTaskst-W**\q/ E'b& 8P;! \q/P_h0d  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload3o**\q/ E'b& 8P;! \q/P_h0d  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload3S**XUq/ E'b& 8P[! XUq/P_h0  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f@AppReadinessNotifyLogonCompletel**XUq/ E'b& 8P[! XUq/P_h0  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f@AppReadinessNotifyLogonCompletea**l鱰q/ E'b& 8PE! l鱰q/P_h0 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*ARSFirstRunTelemetry**{q/ E'b& 8PE! {q/P_h0 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*ARSFirstRunTelemetryec**xMq/ E'b& 8P!nqm Mq/`hOn0 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational &!x**xq/ E'b& 8P!nrm q/`hOn0 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational &!ratx**Yڣq/ E'b& 8P7!mm Yڣq/`hOn0 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational :R%$YZona**ɖq/ E'b& 8Po!%% ɖq/`hOn0  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational '\Software\Microsoft\Windows\CurrentVersion\RunMSA**ɖq/ E'b& 8P!%% ɖq/`hOn0  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational _,ں)z"C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusr** q/ E'b& 8P!%% q/`hOn0  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational m.,z"C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusr** q/ E'b& 8Po!%% q/`hOn0  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational '\Software\Microsoft\Windows\CurrentVersion\Run ** q/ E'b& 8Po!%% q/`hOn0  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational '\Software\Microsoft\Windows\CurrentVersion\Runt-W**Gq/ E'b& 8P!%% Gq/`hOn0  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational _,ں)v"C:\galaxie\deploy\Tomcat6\bin\Tomcat6w.exe" //MS//Tomcat6do**q/ E'b& 8P!%% q/`hOn0  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational m.,v"C:\galaxie\deploy\Tomcat6\bin\Tomcat6w.exe" //MS//Tomcat6in**q/ E'b& 8Po!%% q/`hOn0  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational '\Software\Microsoft\Windows\CurrentVersion\Runell**q/ E'b& 8Pw!%% q/`hOn0  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational 'dSoftware\Microsoft\Windows\CurrentVersion\RunOnce'b&**q/ E'b& 8Pw!%% q/`hOn0  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational 'dSoftware\Microsoft\Windows\CurrentVersion\RunOnceP**eV<7 E'b& 8P7! eV<7PRm  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAllLogonTasks **eV<7 E'b& 8PG! eV<7PRm  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreDesktopSwitchTasks@**eV<7 E'b& 8P/! eV<7PRm  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellPrepP**eV<7 E'b& 8P/! eV<7PRm  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellPrep)**eV<7 E'b& 8PO! eV<7PRm  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f4AppReadinessPreShellGroup 8P 8PPreShellTasksffElfChnk::0<zgU8`=f?mMFRMO&GJ**eV<7 E'b&E'bUa4UxLIDwEAM Eventjxmlns5http://schemas.microsoft.com/win/2004/08/events/eventoTSystemAY{Provider6F=KNameX)GuidAMzaEventID'X) Qualifiers " Version dLevelE{Task ?Opcode$fjKeywordsAP; TimeCreated'j<{ SystemTime .F EventRecordID A Correlation\FF ActivityIDmz5RelatedActivityID Am ExecutionHFF ProcessID9ThreadID "aChannel<F;nComputer FILF-APP-RECAB.SecurityfLUserID ! 8P! eV<7PRm  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational ff6!yƒ8D EventDataA;`oData= LogonType A'`=TaskName SkydrivePrep**eV<7 E'b& 8P5! eV<7PRm  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fSkydrivePrepload**eV<7 E'b& 8P+! eV<7PRm  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fRunOncea**eV<7 E'b& 8P+! eV<7PRm  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fRunOnce**eV<7 E'b& 8P3! eV<7PRm  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fActiveSetupt**.YY<7 E'b& 8P3! .YY<7 :kL?  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fActiveSetupr**.YY<7 E'b& 8PC! .YY<7 :kL?  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f(WaitForMSAConnectedp**.YY<7 E'b& 8PC! .YY<7 :kL?  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f(WaitForMSAConnectedr**.YY<7 E'b& 8PG! .YY<7 :kL?  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreConfigLauncherSyncrat**.YY<7 E'b& 8PG! .YY<7 :kL?  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreConfigLauncherSync f**.YY<7 E'b& 8PG! .YY<7 :kL?  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreDesktopSwitchTasks **.YY<7 E'b& 8P;! .YY<7 :kL?  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f PerUserServices**.YY<7 E'b& 8P;! .YY<7 :kL?  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f PerUserServicest**.YY<7 E'b& 8P7! .YY<7 :kL?  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreShellTaskss-S**.YY<7 E'b& 8PE! .YY<7 :kL?  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*RoamingPayloads0and1ws-S**[<7 E'b& 8PE! [<7 :kL?  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*RoamingPayloads0and1ws-S**[<7 E'b& 8PO! [<7 :kL?  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f4AppReadinessPreShellGroup/Op**[<7 E'b& 8P3! [<7 :kL?  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAppResolver**[<7 E'b& 8P!mm [<7 :kL?  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational EYA&EYM~q; g&h\8A'`=Scenario A!`=Flags   )**Y^<7 E'b& 8P3! Y^<70PRm  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAppResolver**Y^<7 E'b& 8P7! Y^<70PRm  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreShellTasksCo**Y^<7 E'b& 8P9! Y^<70PRm  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellInitTasks30'**Y^<7 E'b& 8P9! Y^<70PRm  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellInitTasks**-S<7 E'b& 8P7! -S<7 :kL?  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreStartTasksun**-S<7 E'b& 8P;! -S<7 :kL?  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload2t**-S<7 E'b& 8PI! -S<7 :kL?  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f.AppReadinessLogonGroup**-S<7 E'b& 8P=! -S<7 :kL?  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f"UpdatePCSettingsft-W**-S<7 E'b& 8P=! -S<7 :kL?  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f"UpdatePCSettingsroso**-S<7 E'b& 8P;! -S<7 :kL?  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload2**-S<7 E'b& 8PI! -S<7 :kL?  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f.AppReadinessLogonGroupP**-S<7 E'b& 8P7! -S<7 :kL?  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreStartTasks**9]<7 E'b& 8P7! 9]<7 :kL?  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAllLogonTasks**`d<7 E'b& 8P;! `d<7 :kL?8  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload3**`d<7 E'b& 8P;! `d<7 :kL?8  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload3**x%i<7 E'b& 8P[! x%i<7 :kL?d ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f@AppReadinessNotifyLogonComplete**x%i<7 E'b& 8P[! x%i<7 :kL?d ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f@AppReadinessNotifyLogonComplete**m<7 E'b& 8PE! m<7 :kL?H ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*ARSFirstRunTelemetry8**m<7 E'b& 8PE! m<7 :kL?H ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*ARSFirstRunTelemetry+!**$S<7 E'b& 8P9!nqm $S<7cMJW  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational &G&| p)c8 Q**x:k`<7 E'b& 8P!nrm :k`<7cMJW  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational &GPx**n<7 E'b& 8Pk!mm n<7cMJW  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational :R%J:R%&Gm3}8A1`#= ItemsExisting A+`= ItemsAdded A/`!= ItemsRemoved A/`!= ItemsUpdated A-`= ItemsCached YZ**0Urm<7 E'b& 8P!%% Urm<7cMJW ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational M3"E>28A%`=KeyName \Software\Microsoft\Windows\CurrentVersion\Run<1C0**HUrm<7 E'b& 8P!%% Urm<7cMJW ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational _,ںO_,ں # >28A%`=Command z"C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusrSH**xxt<7 E'b& 8P!%% xt<7cMJW ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational m.RA&m.C HXOagbV8A`=PID A%`=Command z"C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusrx**xt<7 E'b& 8Po!%% xt<7cMJW ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational M\Software\Microsoft\Windows\CurrentVersion\Run!**xt<7 E'b& 8Po!%% xt<7cMJW ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational M\Software\Microsoft\Windows\CurrentVersion\Run**t<7 E'b& 8P!%% t<7cMJW ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational _,ںOv"C:\galaxie\deploy\Tomcat6\bin\Tomcat6w.exe" //MS//Tomcat6or**x<7 E'b& 8P!%% x<7cMJW ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational m.Rv "C:\galaxie\deploy\Tomcat6\bin\Tomcat6w.exe" //MS//Tomcat6at**x<7 E'b& 8Po!%% x<7cMJW ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational M\Software\Microsoft\Windows\CurrentVersion\RunRo**<7 E'b& 8Pw!%% <7cMJW ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational MdSoftware\Microsoft\Windows\CurrentVersion\RunOnceup**<7 E'b& 8Pw!%% <7cMJW ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational MdSoftware\Microsoft\Windows\CurrentVersion\RunOnce**x &|B7 E'b& 8P!nqm  &|B7PRm ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational &Gnarx**xL~&|B7 E'b& 8P!nrm L~&|B7PRm ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational &Gt-Wx**,(|B7 E'b& 8P7!mm ,(|B7PRm ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational :R%JYZndo**xB7 E'b& 8P!nqm B7PRm  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational &Gn30'x**xَB7 E'b& 8P!nrm َB7PRm  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational &Gt-Wx** B7 E'b& 8P7!mm B7PRm  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational :R%JYZt-W**xƨC7 E'b& 8P!nqm ƨC7PRm  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational &Gx**xC7 E'b& 8P!nrm C7PRm  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational &G+x**kC7 E'b& 8P7!mm kC7PRm  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational :R%JYZ**k9 E'b& 8P7! k9Pl89< ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAllLogonTasks!**k9 E'b& 8PG! k9Pl89< ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreDesktopSwitchTasks**k9 E'b& 8P/! k9Pl89< ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellPrep!**k9 E'b& 8P/! k9Pl89< ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellPrep**k9 E'b& 8PO! k9Pl89< ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f4AppReadinessPreShellGroup!**k9 E'b& 8P5! k9Pl89< ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fSkydrivePrep[!**k9 E'b& 8P5! k9Pl89< ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fSkydrivePrep**k9 E'b& 8P+! k9Pl89< ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fRunOnce**k9 E'b& 8P+! k9Pl89< ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fRunOnceC**k9 E'b& 8P3! k9Pl89< ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fActiveSetup**<9 E'b& 8P3! <9Pl89< ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fActiveSetup**<9 E'b& 8PC! <9Pl89< ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f(WaitForMSAConnectedt**<9 E'b& 8PC! <9Pl89< ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f(WaitForMSAConnected**<9 E'b& 8PG! <9Pl89< ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreConfigLauncherSync**<9 E'b& 8PG! <9Pl89< ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreConfigLauncherSync8**<9 E'b& 8PG! <9Pl89< ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreDesktopSwitchTasks**<9 E'b& 8P;! <9Pl89< ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f PerUserServicesn**<9 E'b& 8P;! <9Pl89< ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f PerUserServicesr**<9 E'b& 8P7! <9Pl89< ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreShellTaskst-W**<9 E'b& 8PE! <9Pl89< ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*RoamingPayloads0and1-Cor**<9 E'b& 8PE! <9Pl89< ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*RoamingPayloads0and1roso**<9 E'b& 8PO! <9Pl89< ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f4AppReadinessPreShellGroupۅdH**<9 E'b& 8P3! <9Pl89< ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAppResolver**x9 E'b& 8P!mm x9Pl89< ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational EYA& on\**x9 E'b& 8P3! x9Pl89< ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAppResolverM**x9 E'b& 8P7! x9Pl89< ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreShellTasksCor**x9 E'b& 8P9! x9Pl89D ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellInitTasks30'**x9 E'b& 8P9! x9Pl89D ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellInitTasks30'**3-9 E'b& 8P7! 3-9Pl89D ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreStartTasksell**3-9 E'b& 8P;! 3-9Pl89D ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload2r**3-9 E'b& 8PI! 3-9Pl89D ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f.AppReadinessLogonGroupic**3-9 E'b& 8P=! 3-9Pl89D ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f"UpdatePCSettingsen30'**3-9 E'b& 8P=! 3-9Pl89D ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f"UpdatePCSettings|DQR**3-9 E'b& 8P;! 3-9Pl89D ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload2R**3-9 E'b& 8PI! 3-9Pl89D ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f.AppReadinessLogonGroupdo**3-9 E'b& 8P7! 3-9Pl89D ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreStartTasksell**v79 E'b& 8P7! v79Pl89D ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAllLogonTasksCor** v79 E'b& 8P;! v79Pl89  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload3p** v79 E'b& 8P;! v79Pl89  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload3r** v79 E'b& 8P[! v79Pl89  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f@AppReadinessNotifyLogonCompletea** v79 E'b& 8P[! v79Pl89  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f@AppReadinessNotifyLogonComplete** v79 E'b& 8PE! v79Pl89  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*ARSFirstRunTelemetry**v79 E'b& 8PE! v79Pl89 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*ARSFirstRunTelemetry**x- 9 E'b& 8P!nqm - 9oaH|`0 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational &GCorx**xd9 E'b& 8P!nrm d9oaH|`0 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational &Gosox**)9 E'b& 8P7!mm )9oaH|`0 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational :R%JYZoso**B9 E'b& 8Po!%% B9oaH|` ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational M\Software\Microsoft\Windows\CurrentVersion\RunCor**B9 E'b& 8P!%% B9oaH|` ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational _,ںOz"C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusrdine**HG9 E'b& 8P!%% HG9oaH|` ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational m.Rz "C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusr**HG9 E'b& 8Po!%% HG9oaH|` ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational M\Software\Microsoft\Windows\CurrentVersion\Run/G**HG9 E'b& 8Po!%% HG9oaH|` ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational M\Software\Microsoft\Windows\CurrentVersion\RunMic**HG9 E'b& 8P!%% HG9oaH|` ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational _,ںOv"C:\galaxie\deploy\Tomcat6\bin\Tomcat6w.exe" //MS//Tomcat6so**09 E'b& 8P!%% 09oaH|` ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational m.Rv\ "C:\galaxie\deploy\Tomcat6\bin\Tomcat6w.exe" //MS//Tomcat6**09 E'b& 8Po!%% 09oaH|` ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational M\Software\Microsoft\Windows\CurrentVersion\Run**-9 E'b& 8Pw!%% -9oaH|` ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational MdSoftware\Microsoft\Windows\CurrentVersion\RunOnce**-9 E'b& 8Pw!%% -9oaH|` ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational MdSoftware\Microsoft\Windows\CurrentVersion\RunOnce**gTF E'b& 8P7! gTFhP[P ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAllLogonTasks!**gTF E'b& 8PG! gTFhP[P ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreDesktopSwitchTasks**gTF E'b& 8P/! gTFhP[P ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellPrep!**gTF E'b& 8P/! gTFhP[P ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellPrep** gTF E'b& 8PO! gTFhP[P  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f4AppReadinessPreShellGroup!**!gTF E'b& 8P5! gTFhP[P! ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fSkydrivePrep;!**"gTF E'b& 8P5! gTFhP[P" ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fSkydrivePrep;!**#gTF E'b& 8P+! gTFhP[P# ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fRunOnce**$kgTF E'b& 8P+! kgTFhP[P$ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fRunOnce**%kgTF E'b& 8P3! kgTFhP[P% ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fActiveSetup**&MgTF E'b& 8P3! MgTFhP[P& ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fActiveSetup**'MgTF E'b& 8PC! MgTFhP[P' ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f(WaitForMSAConnectedt**(MgTF E'b& 8PC! MgTFhP[P( ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f(WaitForMSAConnected**)MgTF E'b& 8PG! MgTFhP[P) ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreConfigLauncherSync***MgTF E'b& 8PG! MgTFhP[P* ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreConfigLauncherSync8**+MgTF E'b& 8PG! MgTFhP[P+ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreDesktopSwitchTasks**,MgTF E'b& 8P;! MgTFhP[P, ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f PerUserServicesn**-MgTF E'b& 8P;! MgTFhP[P- ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f PerUserServicesr**.MgTF E'b& 8P7! MgTFhP[P. ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreShellTaskst-W**/MgTF E'b& 8PE! MgTFhP[P/ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*RoamingPayloads0and1-Cor**0MgTF E'b& 8PE! MgTFhP[P0 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*RoamingPayloads0and1roso**1MgTF E'b& 8PO! MgTFhP[P1 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f4AppReadinessPreShellGroupn0**2MgTF E'b& 8P3! MgTFhP[P2 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAppResolver**3MgTF E'b& 8P!mm MgTFhP[P3 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational EYA& on\**4/gTF E'b& 8P3! /gTFP[P4 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAppResolverM**5/gTF E'b& 8P7! /gTFP[P5 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreShellTasksCor**6/gTF E'b& 8P9! /gTFP[P6 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellInitTasks30'**7/gTF E'b& 8P9! /gTFP[P7 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellInitTasks30'**8ıhTF E'b& 8P7! ıhTFP[P8 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreStartTasksell**9ıhTF E'b& 8P;! ıhTFP[P9 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload2r**:ıhTF E'b& 8PI! ıhTFP[P: ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f.AppReadinessLogonGroupicsoft-Windows E'b& 8PinessPreShellGroup 8P 8PPreShellTasksffElfChnk;;d('rp 48`=f?mMF\"$&**;ıhTF E'b&E'bUa4UxLIDwEAM Eventjxmlns5http://schemas.microsoft.com/win/2004/08/events/eventoTSystemAY{Provider6F=KNameX)GuidAMzaEventID'X) Qualifiers " Version dLevelE{Task ?Opcode$fjKeywordsAP; TimeCreated'j<{ SystemTime .F EventRecordID A Correlation\FF ActivityIDmz5RelatedActivityID Am ExecutionHFF ProcessID9ThreadID "aChannel<F;nComputer FILF-APP-RECAB.SecurityfLUserID ! 8P! ıhTFP[P; ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational ff6!yƒ8D EventDataA;`oData= LogonType A'`=TaskName "UpdatePCSettings**<ıhTF E'b& 8P=! ıhTFP[P< ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f"UpdatePCSettings**=ıhTF E'b& 8P;! ıhTFP[P= ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload2**>ıhTF E'b& 8PI! ıhTFP[P> ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f.AppReadinessLogonGroup**?ıhTF E'b& 8P7! ıhTFP[P? ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreStartTasks**@hTF E'b& 8P7! hTFP[P@ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAllLogonTasks**AhTF E'b& 8P;! hTFP[Pd A ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload3**BhTF E'b& 8P;! hTFP[Pd B ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload3**ChTF E'b& 8P[! hTFP[P C ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f@AppReadinessNotifyLogonComplete**DhTF E'b& 8P[! hTFP[P D ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f@AppReadinessNotifyLogonComplete**EhTF E'b& 8PE! hTFP[P E ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*ARSFirstRunTelemetry**FhTF E'b& 8PE! hTFP[P F ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*ARSFirstRunTelemetryP**GMmTF E'b& 8P9!nqm MmTFoB*vٜPG ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational &&| p)c8P**xHAmTF E'b& 8P!nrm AmTFoB*vٜPH ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational &x**IEmTF E'b& 8Pk!mm EmTFoB*vٜPI ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational :R%:R%&Gm3}8A1`#= ItemsExisting A+`= ItemsAdded A/`!= ItemsRemoved A/`!= ItemsUpdated A-`= ItemsCached YZ**0J_mnTF E'b& 8P!%% _mnTFoB*vٜPJ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational "3"E>28A%`=KeyName \Software\Microsoft\Windows\CurrentVersion\Run0**HK_mnTF E'b& 8P!%% _mnTFoB*vٜPK ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational _,ں$_,ں # >28A%`=Command z"C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusrWH**xLonTF E'b& 8P!%% onTFoB*vٜPL ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational m.!'m.C HXOagbV8A`=PID A%`=Command z"C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusr/Opx**MonTF E'b& 8Po!%% onTFoB*vٜPM ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational "\Software\Microsoft\Windows\CurrentVersion\RunlTa**NonTF E'b& 8Po!%% onTFoB*vٜPN ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational "\Software\Microsoft\Windows\CurrentVersion\Run'b&**OonTF E'b& 8P!%% onTFoB*vٜPO ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational _,ں$v"C:\galaxie\deploy\Tomcat6\bin\Tomcat6w.exe" //MS//Tomcat6**P oTF E'b& 8P!%%  oTFoB*vٜPP ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational m.!'v<"C:\galaxie\deploy\Tomcat6\bin\Tomcat6w.exe" //MS//Tomcat6ic**Q oTF E'b& 8Po!%%  oTFoB*vٜPQ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational "\Software\Microsoft\Windows\CurrentVersion\Runn30'**R oTF E'b& 8Pw!%% oTFoB*vٜPR ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational "dSoftware\Microsoft\Windows\CurrentVersion\RunOnces-S**S oTF E'b& 8Pw!%% oTFoB*vٜPS ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational "dSoftware\Microsoft\Windows\CurrentVersion\RunOnce**T >R E'b& 8P7! >R>PGkh T ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAllLogonTasks f**U >R E'b& 8PG! >R>PGkh U ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreDesktopSwitchTasks.**V >R E'b& 8P/! >R>PGkh V ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellPrepona**W >R E'b& 8P/! >R>PGkh W ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellPreprat**X >R E'b& 8PO! >R>PGkh X ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f4AppReadinessPreShellGroup**Y >R E'b& 8P5! >R>PGkh Y ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fSkydrivePrep**Z >R E'b& 8P5! >R>PGkh Z ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fSkydrivePrep**[ >R E'b& 8P+! >R>PGkh [ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fRunOncel**\ >R E'b& 8P+! >R>PGkh \ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fRunOnceR**] >R E'b& 8P3! >R>PGkh ] ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fActiveSetupl**^1LR E'b& 8P3! 1LR>PGkh ^ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fActiveSetupW**_1LR E'b& 8PC! 1LR>PGkh _ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f(WaitForMSAConnectedo**`1LR E'b& 8PC! 1LR>PGkh ` ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f(WaitForMSAConnectedc**a1LR E'b& 8PG! 1LR>PGkh a ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreConfigLauncherSync**b1LR E'b& 8PG! 1LR>PGkh b ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreConfigLauncherSync=**c1LR E'b& 8PG! 1LR>PGkh c ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreDesktopSwitchTaskst-W**d1LR E'b& 8P;! 1LR>PGkh d ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f PerUserServices**e1LR E'b& 8P;! 1LR>PGkh e ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f PerUserServicesw**f1LR E'b& 8P7! 1LR>PGkh f ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreShellTasksCor**g1LR E'b& 8PE! 1LR>PGkh g ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*RoamingPayloads0and1roso**h1LR E'b& 8PE! 1LR>PGkh h ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*RoamingPayloads0and1hell**i1LR E'b& 8PO! 1LR>PGkh i ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f4AppReadinessPreShellGroup ذĤ**j1LR E'b& 8P3! 1LR>PGkh j ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAppResolver**k1LR E'b& 8P!mm 1LR>PGkh k ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational EY\!'EYM~q; g&h\8A'`=Scenario A!`=Flags  7**lEOR E'b& 8P3! EORPGkh l ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAppResolver**mEOR E'b& 8P7! EORPGkh m ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreShellTasks****nEOR E'b& 8P9! EORPGk@n ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellInitTasks**oEOR E'b& 8P9! EORPGk@o ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellInitTasks**pĞR E'b& 8P7! ĞRPGk@p ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreStartTasks**qĞR E'b& 8P;! ĞRPGk@q ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload2**rĞR E'b& 8PI! ĞRPGk@r ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f.AppReadinessLogonGroup**sĞR E'b& 8P=! ĞRPGk@s ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f"UpdatePCSettings ذĤ**tĞR E'b& 8P=! ĞRPGk@t ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f"UpdatePCSettingsws-S**uĞR E'b& 8P;! ĞRPGk@u ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload2c**vĞR E'b& 8PI! ĞRPGk@v ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f.AppReadinessLogonGroup-W**wĞR E'b& 8P7! ĞRPGk@w ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreStartTaskst-W**xĞR E'b& 8P7! ĞRPGk@x ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAllLogonTasksMic**yĞR E'b& 8P;! ĞRPGk y ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload3o**zĞR E'b& 8P;! ĞRPGk z ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload3W**{ĞR E'b& 8P[! ĞRPGk { ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f@AppReadinessNotifyLogonCompleteo**|ĞR E'b& 8P[! ĞRPGk | ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f@AppReadinessNotifyLogonCompletep**}ĞR E'b& 8PE! ĞRPGk} ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*ARSFirstRunTelemetryiona**~ĞR E'b& 8PE! ĞRPGk~ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*ARSFirstRunTelemetryRu**x52FR E'b& 8P!nqm 52FRe @  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational & fx**xLLR E'b& 8P!nrm LLRe @  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational &Corx**ڠ\R E'b& 8P7!mm ڠ\Re @  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational :R%YY/Op**ŮR E'b& 8Po!%% ŮR~ؽ_6A 23  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational "\Software\Microsoft\Windows\CurrentVersion\RunWa**ŮR E'b& 8P!%% ŮR~ؽ_6A 23  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational _,ں$z"C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusr9**CR E'b& 8P!%% CR~ؽ_6A 23  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational m.!'z"C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusrP**CR E'b& 8Po!%% CR~ؽ_6A 23  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational "\Software\Microsoft\Windows\CurrentVersion\RunP**CR E'b& 8Po!%% CR~ؽ_6A 23  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational "\Software\Microsoft\Windows\CurrentVersion\RunMic**CR E'b& 8Po!%% CR~ؽ_6A 23  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational "\Software\Microsoft\Windows\CurrentVersion\Runn30'**nR E'b& 8Pw!%% nR~ؽ_6A 23  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational "dSoftware\Microsoft\Windows\CurrentVersion\RunOnceCor**R E'b& 8P/!%% R~ؽ_6A 23  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational _,ں$ctfmon.exe /nndo**'R E'b& 8P7!%% 'R~ؽ_6A 23  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational m.!'h ctfmon.exe /noso**'R E'b& 8Pw!%% 'R~ؽ_6A 23  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational "dSoftware\Microsoft\Windows\CurrentVersion\RunOnceCor**#/R E'b& 8P7! #/RPGk  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAllLogonTasks/Op**#/R E'b& 8PG! #/RPGk  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreDesktopSwitchTasks**#/R E'b& 8P/! #/RPGk  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellPrep**#/R E'b& 8P/! #/RPGk  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellPrep**#/R E'b& 8PO! #/RPGk  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f4AppReadinessPreShellGroupllI**#/R E'b& 8P5! #/RPGk  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fSkydrivePrepeSta**#/R E'b& 8P5! #/RPGk  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fSkydrivePrepamin**#/R E'b& 8P+! #/RPGk  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fRunOnce**#/R E'b& 8P+! #/RPGk  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fRunOncet**#/R E'b& 8P3! #/RPGk  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fActiveSetupr**[1R E'b& 8P3! [1RPGk  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fActiveSetupS**[1R E'b& 8PC! [1RPGk  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f(WaitForMSAConnectedl**[1R E'b& 8PC! [1RPGk  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f(WaitForMSAConnectedS**[1R E'b& 8PG! [1RPGk  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreConfigLauncherSyncCor**[1R E'b& 8PG! [1RPGk  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreConfigLauncherSyncrat**[1R E'b& 8PG! [1RPGk  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreDesktopSwitchTasks f**[1R E'b& 8P;! [1RPGk  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f PerUserServices**[1R E'b& 8P;! [1RPGk  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f PerUserServicesr**[1R E'b& 8P7! [1RPGk  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreShellTaskst-W**[1R E'b& 8PE! [1RPGk  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*RoamingPayloads0and1ft-W**[1R E'b& 8PE! [1RPGk  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*RoamingPayloads0and1ft-W**[1R E'b& 8PO! [1RPGk  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f4AppReadinessPreShellGroup &θ**[1R E'b& 8P3! [1RPGk  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAppResolver**[1R E'b& 8P!mm [1R cBwϧV  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational EY\ **[1R E'b& 8P3! [1R PGk  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAppResolvero**[1R E'b& 8P7! [1R PGk  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreShellTasksoso**[1R E'b& 8P9! [1R PGk8  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellInitTasks**[1R E'b& 8P9! [1R PGk8  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellInitTasks**E mR E'b& 8P7! E mRPGk8  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreStartTasks****E mR E'b& 8P;! E mRPGk8  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload26**E mR E'b& 8PI! E mRPGk8  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f.AppReadinessLogonGroupm**E mR E'b& 8P=! E mRPGk8  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f"UpdatePCSettingsaMic**E mR E'b& 8P=! E mRPGk8  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f"UpdatePCSettingsindo**E mR E'b& 8P;! E mRPGk8  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload2**E mR E'b& 8PI! E mRPGk8  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f.AppReadinessLogonGroup**E mR E'b& 8P7! E mRPGk8  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreStartTasks!**vR E'b& 8P7! vRPGk8  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAllLogonTasks8**vR E'b& 8P;! vRPGk ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload3**vR E'b& 8P;! vRPGk ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload3**vR E'b& 8P[! vRPGk  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f@AppReadinessNotifyLogonComplete**vR E'b& 8P[! vRPGk  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f@AppReadinessNotifyLogonComplete**vR E'b& 8PE! vRPGk`  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*ARSFirstRunTelemetry**vR E'b& 8PE! vRPGk`  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*ARSFirstRunTelemetryMic**x) R E'b& 8P!nqm ) RQ28A%`=KeyName \Software\Microsoft\Windows\CurrentVersion\Runi 20**Hzxe E'b& 8P!%% zxe(aMDç2h p  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational _,ںK_,ں # >28A%`=Command z"C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusrH**x"}e E'b& 8P!%% "}ezJj@j,h p  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational m.IMy!m.C HXOagbV8A`=PID A%`=Command z "C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusrx**"}e E'b& 8Po!%% "}ezJj@j,h p  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational H\Software\Microsoft\Windows\CurrentVersion\Run d**"}e E'b& 8Po!%% "}ezJj@j,h p  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational H\Software\Microsoft\Windows\CurrentVersion\Runt-W**"}e E'b& 8Po!%% "}ezJj@j,h p  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational H\Software\Microsoft\Windows\CurrentVersion\RunMic**Uׄe E'b& 8Pw!%% UׄezJj@j,h p  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational HdSoftware\Microsoft\Windows\CurrentVersion\RunOncerat**Uׄe E'b& 8P/!%% UׄezJj@j,h p  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational _,ںKctfmon.exe /nell**e E'b& 8P7!%% ezJj@j,h p  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational m.IM ctfmon.exe /nndo**e E'b& 8Pw!%% ezJj@j,h p  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational HdSoftware\Microsoft\Windows\CurrentVersion\RunOncerat**8sv E'b& 8P7! 8svPXt  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAllLogonTasksona**8sv E'b& 8PG! 8svPXt  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreDesktopSwitchTasksn30'**8sv E'b& 8P/! 8svPXt  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellPrepn30'**8sv E'b& 8P/! 8svPXt  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellPrepCor**8sv E'b& 8PO! 8svPXt  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f4AppReadinessPreShellGroupMic**8sv E'b& 8P5! 8svPXt  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fSkydrivePrepaMic**8sv E'b& 8P5! 8svPXt  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fSkydrivePrepaMic**8sv E'b& 8P+! 8svPXt  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fRunOnce'**8sv E'b& 8P+! 8svPXt  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fRunOnceo**8sv E'b& 8P3! 8svPXt  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fActiveSetupo**c~sv E'b& 8P3! c~svPXt  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fActiveSetup**c~sv E'b& 8PC! c~svPXt  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f(WaitForMSAConnectedc**c~sv E'b& 8PC! c~svPXt  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f(WaitForMSAConnected** c~sv E'b& 8PG! c~svPXt  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreConfigLauncherSyncoso** c~sv E'b& 8PG! c~svPXt  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreConfigLauncherSyncndo** c~sv E'b& 8PG! c~svPXt  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreDesktopSwitchTasksell** c~sv E'b& 8P;! c~svPXt  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f PerUserServicesl** c~sv E'b& 8P;! c~svPXt  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f PerUserServiceso**c~sv E'b& 8P7! c~svPXt  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreShellTasks**c~sv E'b& 8PE! c~svPXt  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*RoamingPayloads0and1**c~sv E'b& 8PE! c~svPXt  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*RoamingPayloads0and1**c~sv E'b& 8PO! c~svPXt  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f4AppReadinessPreShellGroupell**c~sv E'b& 8P3! c~svPXt  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAppResolverc**c~sv E'b& 8P!mm c~svPXt  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational EYy! Cor**sv E'b& 8P3! sv SFR9t  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAppResolver**sv E'b& 8P7! sv SFR9t  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreShellTasks8**sv E'b& 8P9! sv SFR9t ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellInitTasks***sv E'b& 8P9! sv SFR9t ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellInitTasksws**tv E'b& 8P7! tvPXt ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreStartTasks**tv E'b& 8P;! tvPXt ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload2S**tv E'b& 8PI! tvPXt ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f.AppReadinessLogonGroupQR**tv E'b& 8P=! tvPXt ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f"UpdatePCSettingsroso**tv E'b& 8P=! tvPXt ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f"UpdatePCSettingsindo**tv E'b& 8P;! tvPXt ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload2o**tv E'b& 8PI! tvPXt ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f.AppReadinessLogonGroup**tv E'b& 8P7! tvPXt ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreStartTasks** 8tv E'b& 8P7! 8tv SFR9t  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAllLogonTasks **! Atv E'b& 8P;! Atv SFR9tp ! ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload3**" Atv E'b& 8P;! Atv SFR9tp " ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload3**# Atv E'b& 8P[! Atv SFR9t # ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f@AppReadinessNotifyLogonComplete**$ Atv E'b& 8P[! Atv SFR9t $ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f@AppReadinessNotifyLogonCompleteW**% Atv E'b& 8PE! Atv SFR9t% ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*ARSFirstRunTelemetryws-S**& Atv E'b& 8PE! Atv SFR9t& ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*ARSFirstRunTelemetry|DQR**x'>yv E'b& 8P!nqm >yv| %l.F+0‡St ' ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational &Bellx**x(T yv E'b& 8P!nrm T yv| %l.F+0‡St ( ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational &Bosox**)hyv E'b& 8P7!mm hyv| %l.F+0‡St ) ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational :R%FYZt-W***=zv E'b& 8Po!%% =zvc>L.w@tD * ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational H\Software\Microsoft\Windows\CurrentVersion\RunQR**+=zv E'b& 8P!%% =zvc>L.w@tD + ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational _,ںKz"C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusriona**,QqAzv E'b& 8P!%% QqAzvc>L.w@tD , ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational m.IMzx"C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusrrat**-QqAzv E'b& 8Po!%% QqAzvc>L.w@tD - ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational H\Software\Microsoft\Windows\CurrentVersion\Run'b&**.QqAzv E'b& 8Po!%% QqAzvc>L.w@tD . ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational H\Software\Microsoft\Windows\CurrentVersion\Run**/YAzv E'b& 8P!%% YAzvc>L.w@tD / ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational _,ںKv"C:\galaxie\deploy\Tomcat6\bin\Tomcat6w.exe" //MS//Tomcat6**0JUzv E'b& 8P!%% JUzvc>L.w@tD 0 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational m.IMv"C:\galaxie\deploy\Tomcat6\bin\Tomcat6w.exe" //MS//Tomcat630'**1JUzv E'b& 8Po!%% JUzvc>L.w@tD 1 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational H\Software\Microsoft\Windows\CurrentVersion\Runndo**2JUzv E'b& 8Pw!%% JUzvc>L.w@tD 2 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational HdSoftware\Microsoft\Windows\CurrentVersion\RunOnceona**3JUzv E'b& 8Pw!%% JUzvc>L.w@tD 3 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational HdSoftware\Microsoft\Windows\CurrentVersion\RunOnceRes**4Cb߂ E'b& 8P7! Cb߂P4 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAllLogonTasks****5Cb߂ E'b& 8PG! Cb߂P5 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreDesktopSwitchTasks**6Cb߂ E'b& 8P/! Cb߂P6 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellPrep[1**7Cb߂ E'b& 8P/! Cb߂P7 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellPrep**8Cb߂ E'b& 8PO! Cb߂P8 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f4AppReadinessPreShellGroup'b&**9Cb߂ E'b& 8P5! Cb߂P9 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fSkydrivePrepE'b&**:Cb߂ E'b& 8P5! Cb߂P: ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fSkydrivePrepE'b&**;Cb߂ E'b& 8P+! Cb߂P; ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fRunOnce**<Cb߂ E'b& 8P+! Cb߂P< ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fRunOncen**=Cb߂ E'b& 8P3! Cb߂P= ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fActiveSetupe**>iYb߂ E'b& 8P3! iYb߂P> ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fActiveSetup**?iYb߂ E'b& 8PC! iYb߂P? ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f(WaitForMSAConnectedp**@iYb߂ E'b& 8PC! iYb߂P@ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f(WaitForMSAConnected**AiYb߂ E'b& 8PG! iYb߂PA ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreConfigLauncherSyncLog**BiYb߂ E'b& 8PG! iYb߂PB ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreConfigLauncherSyncoad**CiYb߂ E'b& 8PG! iYb߂PC ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreDesktopSwitchTasks****DiYb߂ E'b& 8P;! iYb߂PD ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f PerUserServiceso**EiYb߂ E'b& 8P;! iYb߂PE ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f PerUserServicesa**FiYb߂ E'b& 8P7! iYb߂PF ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreShellTasks f**GiYb߂ E'b& 8PE! iYb߂PG ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*RoamingPayloads0and1l f**HiYb߂ E'b& 8PE! iYb߂PH ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*RoamingPayloads0and1l &ΰ**IiYb߂ E'b& 8PO! iYb߂PI ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f4AppReadinessPreShellGroup**JiYb߂ E'b& 8P3! iYb߂PJ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAppResolver**Ke[b߂ E'b& 8P!mm e[b߂PK ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational EYy! Cur**L-^b߂ E'b& 8P3! -^b߂ PL ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAppResolver**M-^b߂ E'b& 8P7! -^b߂ PM ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreShellTasksMic**N-^b߂ E'b& 8P9! -^b߂ P N ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellInitTasks**O-^b߂ E'b& 8P9! -^b߂ P O ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellInitTasks**P8$c߂ E'b& 8P7! 8$c߂FP P ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreStartTasks**Q8$c߂ E'b& 8P;! 8$c߂FP Q ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload26**R8$c߂ E'b& 8PI! 8$c߂FP R ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f.AppReadinessLogonGroupom**S8$c߂ E'b& 8P=! 8$c߂FP S ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f"UpdatePCSettingserat**T8$c߂ E'b& 8P=! 8$c߂FP T ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f"UpdatePCSettingsft-W**U8$c߂ E'b& 8P;! 8$c߂FP U ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload2o**V8$c߂ E'b& 8PI! 8$c߂FP V ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f.AppReadinessLogonGroup**W8$c߂ E'b& 8P7! 8$c߂FP W ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreStartTasks**X4c߂ E'b& 8P7! 4c߂FP X ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAllLogonTasks**Y=9c߂ E'b& 8P;! =9c߂FPY ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload3**Z=9c߂ E'b& 8P;! =9c߂FPZ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload3**[%K>c߂ E'b& 8P[! %K>c߂FP$[ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f@AppReadinessNotifyLogonComplete**\%K>c߂ E'b& 8P[! %K>c߂FP$\ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f@AppReadinessNotifyLogonCompleteW**]Cc߂ E'b& 8PE! Cc߂FP4 ] ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*ARSFirstRunTelemetryws-S**^Cc߂ E'b& 8PE! Cc߂FP4 ^ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*ARSFirstRunTelemetry8PPreShellTasksffElfChnk_k_k 0l)[8| =f?mMF1a&I **h_Uh߂ E'b&E'bUa4UxLIDwEAM Eventjxmlns5http://schemas.microsoft.com/win/2004/08/events/eventoTSystemAY{Provider6F=KNameX)GuidAMzaEventID'X) Qualifiers " Version dLevelE{Task ?Opcode$fjKeywordsAP; TimeCreated'j<{ SystemTime .F EventRecordID A Correlation\FF ActivityIDmz5RelatedActivityID Am ExecutionHFF ProcessID9ThreadID "aChannel<F;nComputer FILF-APP-RECAB.SecurityfLUserID ! 8PU!nqm Uh߂g?Ceg7@_ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational &&| p)c."8D EventDatah**x`Zh߂ E'b& 8P!nrm Zh߂g?Ceg7@` ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational &s-Sx**abh߂ E'b& 8P}!mm bh߂g?Ceg7@a ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational :R%I :R%&Gm3}."8AC| oData#= ItemsExisting A+| = ItemsAdded A/| != ItemsRemoved A/| != ItemsUpdated A-| = ItemsCached YZ$**0b6i߂ E'b& 8P!%% 6i߂FcEI4.b ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational 13"E>28A%| =KeyName \Software\Microsoft\Windows\CurrentVersion\Runindo0**Hc6i߂ E'b& 8P!%% 6i߂FcEI4.c ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational _,ںa_,ں # >28A%| =Command z"C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusrH**xd:i߂ E'b& 8P!%% :i߂FcEI4.d ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational m.m.C HXOagbV8A| =PID A%| =Command z"C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusrndox**e:i߂ E'b& 8Po!%% :i߂FcEI4.e ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational 1\Software\Microsoft\Windows\CurrentVersion\RunQR**f:i߂ E'b& 8Po!%% :i߂FcEI4.f ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational 1\Software\Microsoft\Windows\CurrentVersion\RunCor**g:i߂ E'b& 8P!%% :i߂FcEI4.g ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational _,ںav"C:\galaxie\deploy\Tomcat6\bin\Tomcat6w.exe" //MS//Tomcat6s**hmi߂ E'b& 8P!%% mi߂FcEI4.h ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational m.v "C:\galaxie\deploy\Tomcat6\bin\Tomcat6w.exe" //MS//Tomcat6**imi߂ E'b& 8Po!%% mi߂FcEI4.i ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational 1\Software\Microsoft\Windows\CurrentVersion\Run8**jmi߂ E'b& 8Pw!%% mi߂FcEI4.j ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational 1dSoftware\Microsoft\Windows\CurrentVersion\RunOncee**kmi߂ E'b& 8Pw!%% mi߂FcEI4.k ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational 1dSoftware\Microsoft\Windows\CurrentVersion\RunOnceoso-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational EYy!EYM~q; g&h\8A'`=Scenario A!`=Flags  oso**We E'b& 8P3! WePh $ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAppResolver**We E'b& 8P7! WePh $ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreShellTasksram**We E'b& 8P9! WePh p ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellInitTasks-S**We E'b& 8P9! WePh p ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellInitTasks**_]e E'b& 8P7! _]ePh p ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreStartTasks'b&**_]e E'b& 8P;! _]ePh p ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload2\**_]e E'b& 8PI! _]ePh p ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f.AppReadinessLogonGroupom**_]e E'b& 8P=! _]ePh p ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f"UpdatePCSettingserat**_]e E'b& 8P=! _]ePh p ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f"UpdatePCSettingsen30'**_]e E'b& 8P;! _]ePh p ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload2c**_]e E'b& 8PI! _]ePh p ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f.AppReadinessLogonGroupP**_]e E'b& 8P7! _]ePh p ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreStartTasks**_]e E'b& 8P7! _]ePh p ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAllLogonTasks**_]e E'b& 8P;! _]ePh   ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload3**_]e E'b& 8P;! _]ePh   ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload3**_e E'b& 8P[! _ePh   ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f@AppReadinessNotifyLogonComplete**_e E'b& 8P[! _ePh   ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f@AppReadinessNotifyLogonComplete**_e E'b& 8PE! _ePh   ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*ARSFirstRunTelemetryP**_e E'b& 8PE! _ePh   ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*ARSFirstRunTelemetryh [**Se E'b& 8P9!nqm SȇB~c|Ay{r28A%`=KeyName \Software\Microsoft\Windows\CurrentVersion\Runi 20**Hzxe E'b& 8P!%% zxe(aMDç2h p  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational _,ںK_,ں # >28A%`=Command z"C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusrH**x"}e E'b& 8P!%% "}ezJj@j,h p  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational m.IMy!m.C HXOagbV8A`=PID A%`=Command z "C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusrx**"}e E'b& 8Po!%% "}ezJj@j,h p  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational H\Software\Microsoft\Windows\CurrentVersion\Run d**"}e E'b& 8Po!%% "}ezJj@j,h p  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational H\Software\Microsoft\Windows\CurrentVersion\Runt-W**"}e E'b& 8Po!%% "}ezJj@j,h p  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational H\Software\Microsoft\Windows\CurrentVersion\RunMic**Uׄe E'b& 8Pw!%% UׄezJj@j,h p  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational HdSoftware\Microsoft\Windows\CurrentVersion\RunOncerat**Uׄe E'b& 8P/!%% UׄezJj@j,h p  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational _,ںKctfmon.exe /nell**e E'b& 8P7!%% ezJj@j,h p  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational m.IM ctfmon.exe /nndo**e E'b& 8Pw!%% ezJj@j,h p  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational HdSoftware\Microsoft\Windows\CurrentVersion\RunOncerat**8sv E'b& 8P7! 8svPXt  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAllLogonTasksona**8sv E'b& 8PG! 8svPXt  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreDesktopSwitchTasksn30'**8sv E'b& 8P/! 8svPXt  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellPrepn30'**8sv E'b& 8P/! 8svPXt  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellPrepCor**8sv E'b& 8PO! 8svPXt  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f4AppReadinessPreShellGroupMic**8sv E'b& 8P5! 8svPXt  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fSkydrivePrepaMic**8sv E'b& 8P5! 8svPXt  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fSkydrivePrepaMic**8sv E'b& 8P+! 8svPXt  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fRunOnce'**8sv E'b& 8P+! 8svPXt  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fRunOnceo**8sv E'b& 8P3! 8svPXt  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fActiveSetupo**c~sv E'b& 8P3! c~svPXt  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fActiveSetup**c~sv E'b& 8PC! c~svPXt  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f(WaitForMSAConnectedc**c~sv E'b& 8PC! c~svPXt  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f(WaitForMSAConnected** c~sv E'b& 8PG! c~svPXt  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreConfigLauncherSyncoso** c~sv E'b& 8PG! c~svPXt  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreConfigLauncherSyncndo** c~sv E'b& 8PG! c~svPXt  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreDesktopSwitchTasksell** c~sv E'b& 8P;! c~svPXt  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f PerUserServicesl** c~sv E'b& 8P;! c~svPXt  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f PerUserServiceso**c~sv E'b& 8P7! c~svPXt  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreShellTasks**c~sv E'b& 8PE! c~svPXt  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*RoamingPayloads0and1**c~sv E'b& 8PE! c~svPXt  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*RoamingPayloads0and1**c~sv E'b& 8PO! c~svPXt  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f4AppReadinessPreShellGroupell**c~sv E'b& 8P3! c~svPXt  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAppResolverc**c~sv E'b& 8P!mm c~svPXt  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational EYy! Cor**sv E'b& 8P3! sv SFR9t  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAppResolver**sv E'b& 8P7! sv SFR9t  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreShellTasks8**sv E'b& 8P9! sv SFR9t ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellInitTasks***sv E'b& 8P9! sv SFR9t ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellInitTasksws**tv E'b& 8P7! tvPXt ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreStartTasks**tv E'b& 8P;! tvPXt ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload2S**tv E'b& 8PI! tvPXt ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f.AppReadinessLogonGroupQR**tv E'b& 8P=! tvPXt ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f"UpdatePCSettingsroso**tv E'b& 8P=! tvPXt ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f"UpdatePCSettingsindo**tv E'b& 8P;! tvPXt ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload2o**tv E'b& 8PI! tvPXt ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f.AppReadinessLogonGroup**tv E'b& 8P7! tvPXt ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreStartTasks** 8tv E'b& 8P7! 8tv SFR9t  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAllLogonTasks **! Atv E'b& 8P;! Atv SFR9tp ! ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload3**" Atv E'b& 8P;! Atv SFR9tp " ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload3**# Atv E'b& 8P[! Atv SFR9t # ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f@AppReadinessNotifyLogonComplete**$ Atv E'b& 8P[! Atv SFR9t $ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f@AppReadinessNotifyLogonCompleteW**% Atv E'b& 8PE! Atv SFR9t% ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*ARSFirstRunTelemetryws-S**& Atv E'b& 8PE! Atv SFR9t& ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*ARSFirstRunTelemetry|DQR**x'>yv E'b& 8P!nqm >yv| %l.F+0‡St ' ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational &Bellx**x(T yv E'b& 8P!nrm T yv| %l.F+0‡St ( ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational &Bosox**)hyv E'b& 8P7!mm hyv| %l.F+0‡St ) ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational :R%FYZt-W***=zv E'b& 8Po!%% =zvc>L.w@tD * ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational H\Software\Microsoft\Windows\CurrentVersion\RunQR**+=zv E'b& 8P!%% =zvc>L.w@tD + ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational _,ںKz"C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusriona**,QqAzv E'b& 8P!%% QqAzvc>L.w@tD , ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational m.IMzx"C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusrrat**-QqAzv E'b& 8Po!%% QqAzvc>L.w@tD - ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational H\Software\Microsoft\Windows\CurrentVersion\Run'b&**.QqAzv E'b& 8Po!%% QqAzvc>L.w@tD . ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational H\Software\Microsoft\Windows\CurrentVersion\Run**/YAzv E'b& 8P!%% YAzvc>L.w@tD / ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational _,ںKv"C:\galaxie\deploy\Tomcat6\bin\Tomcat6w.exe" //MS//Tomcat6**0JUzv E'b& 8P!%% JUzvc>L.w@tD 0 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational m.IMv"C:\galaxie\deploy\Tomcat6\bin\Tomcat6w.exe" //MS//Tomcat630'**1JUzv E'b& 8Po!%% JUzvc>L.w@tD 1 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational H\Software\Microsoft\Windows\CurrentVersion\Runndo**2JUzv E'b& 8Pw!%% JUzvc>L.w@tD 2 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational HdSoftware\Microsoft\Windows\CurrentVersion\RunOnceona**3JUzv E'b& 8Pw!%% JUzvc>L.w@tD 3 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational HdSoftware\Microsoft\Windows\CurrentVersion\RunOnceRes**4Cb߂ E'b& 8P7! Cb߂P4 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAllLogonTasks****5Cb߂ E'b& 8PG! Cb߂P5 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreDesktopSwitchTasks**6Cb߂ E'b& 8P/! Cb߂P6 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellPrep[1**7Cb߂ E'b& 8P/! Cb߂P7 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellPrep**8Cb߂ E'b& 8PO! Cb߂P8 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f4AppReadinessPreShellGroup'b&**9Cb߂ E'b& 8P5! Cb߂P9 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fSkydrivePrepE'b&**:Cb߂ E'b& 8P5! Cb߂P: ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fSkydrivePrepE'b&**;Cb߂ E'b& 8P+! Cb߂P; ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fRunOnce**<Cb߂ E'b& 8P+! Cb߂P< ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fRunOncen**=Cb߂ E'b& 8P3! Cb߂P= ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fActiveSetupe**>iYb߂ E'b& 8P3! iYb߂P> ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fActiveSetup**?iYb߂ E'b& 8PC! iYb߂P? ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f(WaitForMSAConnectedp**@iYb߂ E'b& 8PC! iYb߂P@ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f(WaitForMSAConnected**AiYb߂ E'b& 8PG! iYb߂PA ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreConfigLauncherSyncLog**BiYb߂ E'b& 8PG! iYb߂PB ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreConfigLauncherSyncoad**CiYb߂ E'b& 8PG! iYb߂PC ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreDesktopSwitchTasks****DiYb߂ E'b& 8P;! iYb߂PD ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f PerUserServiceso**EiYb߂ E'b& 8P;! iYb߂PE ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f PerUserServicesa**FiYb߂ E'b& 8P7! iYb߂PF ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreShellTasks f**GiYb߂ E'b& 8PE! iYb߂PG ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*RoamingPayloads0and1l f**HiYb߂ E'b& 8PE! iYb߂PH ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*RoamingPayloads0and1l &ΰ**IiYb߂ E'b& 8PO! iYb߂PI ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f4AppReadinessPreShellGroup**JiYb߂ E'b& 8P3! iYb߂PJ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAppResolver**Ke[b߂ E'b& 8P!mm e[b߂PK ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational EYy! Cur**L-^b߂ E'b& 8P3! -^b߂ PL ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAppResolver**M-^b߂ E'b& 8P7! -^b߂ PM ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreShellTasksMic**N-^b߂ E'b& 8P9! -^b߂ P N ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellInitTasks**O-^b߂ E'b& 8P9! -^b߂ P O ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellInitTasks**P8$c߂ E'b& 8P7! 8$c߂FP P ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreStartTasks**Q8$c߂ E'b& 8P;! 8$c߂FP Q ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload26**R8$c߂ E'b& 8PI! 8$c߂FP R ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f.AppReadinessLogonGroupom**S8$c߂ E'b& 8P=! 8$c߂FP S ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f"UpdatePCSettingserat**T8$c߂ E'b& 8P=! 8$c߂FP T ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f"UpdatePCSettingsft-W**U8$c߂ E'b& 8P;! 8$c߂FP U ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload2o**V8$c߂ E'b& 8PI! 8$c߂FP V ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f.AppReadinessLogonGroup**W8$c߂ E'b& 8P7! 8$c߂FP W ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreStartTasks**X4c߂ E'b& 8P7! 4c߂FP X ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAllLogonTasks**Y=9c߂ E'b& 8P;! =9c߂FPY ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload3**Z=9c߂ E'b& 8P;! =9c߂FPZ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload3**[%K>c߂ E'b& 8P[! %K>c߂FP$[ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f@AppReadinessNotifyLogonComplete**\%K>c߂ E'b& 8P[! %K>c߂FP$\ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f@AppReadinessNotifyLogonCompleteW**]Cc߂ E'b& 8PE! Cc߂FP4 ] ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*ARSFirstRunTelemetryws-S**^Cc߂ E'b& 8PE! Cc߂FP4 ^ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*ARSFirstRunTelemetry8PPreShellTasksffElfChnkffNs/8`=f?mMF)9 &Z]** +e/ E'b&E'bUa4UxLIDwEAM Eventjxmlns5http://schemas.microsoft.com/win/2004/08/events/eventoTSystemAY{Provider6F=KNameX)GuidAMzaEventID'X) Qualifiers " Version dLevelE{Task ?Opcode$fjKeywordsAP; TimeCreated'j<{ SystemTime .F EventRecordID A Correlation\FF ActivityIDmz5RelatedActivityID Am ExecutionHFF ProcessID9ThreadID "aChannel<F;nComputer FILF-APP-RECAB.SecurityfLUserID ! 8P !%% +e/'BMRN  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational _,ں_,ں # l`8D EventDataA7`oData=Command v"C:\galaxie\deploy\Tomcat6\bin\Tomcat6w.exe" //MS//Tomcat6كV **p:Be/ E'b& 8P !%% :Be/'BMRN  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational m. m.C HXOagbV8A`=PID A%`=Command v( "C:\galaxie\deploy\Tomcat6\bin\Tomcat6w.exe" //MS//Tomcat6op**0:Be/ E'b& 8P!%% :Be/'BMRN  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational  3"E>28A%`=KeyName \Software\Microsoft\Windows\CurrentVersion\Rune/Op0** aBe/ E'b& 8Pw!%% aBe/'BMRN  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational  dSoftware\Microsoft\Windows\CurrentVersion\RunOnceA** aBe/ E'b& 8Pw!%% aBe/'BMRN  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational  dSoftware\Microsoft\Windows\CurrentVersion\RunOnce**(sLN2 E'b& 8P! sLN2(P=9a ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational ff6!yƒpd8A)`= LogonType A'`=TaskName AllLogonTasks(**sLN2 E'b& 8PG! sLN2(P=9a ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreDesktopSwitchTasksP**sLN2 E'b& 8P/! sLN2(P=9a ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellPrep8**sLN2 E'b& 8P/! sLN2(P=9a ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellPrep**sLN2 E'b& 8PO! sLN2(P=9a ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f4AppReadinessPreShellGroup!**sLN2 E'b& 8P5! sLN2(P=9a ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fSkydrivePrep8**sLN2 E'b& 8P5! sLN2(P=9a ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fSkydrivePrep**sLN2 E'b& 8P+! sLN2(P=9a ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fRunOnce**?sLN2 E'b& 8P+! ?sLN2(P=9a ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fRunOnce**?sLN2 E'b& 8P3! ?sLN2(P=9a ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fActiveSetup**itLN2 E'b& 8P3! itLN2(P=9a ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fActiveSetupV**itLN2 E'b& 8PC! itLN2(P=9a ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f(WaitForMSAConnected**itLN2 E'b& 8PC! itLN2(P=9a ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f(WaitForMSAConnected**itLN2 E'b& 8PG! itLN2(P=9a ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreConfigLauncherSync**itLN2 E'b& 8PG! itLN2(P=9a ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreConfigLauncherSync'b&**uLN2 E'b& 8PG! uLN2(P=9a ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreDesktopSwitchTasks"V**uLN2 E'b& 8P;! uLN2(P=9a ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f PerUserServices**uLN2 E'b& 8P;! uLN2(P=9a ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f PerUserServices**uLN2 E'b& 8P7! uLN2(P=9a ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreShellTasks**uLN2 E'b& 8PE! uLN2(P=9a ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*RoamingPayloads0and1**uLN2 E'b& 8PE! uLN2(P=9a ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*RoamingPayloads0and1=**uLN2 E'b& 8PO! uLN2(P=9a ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f4AppReadinessPreShellGroup 2**uLN2 E'b& 8P3! uLN2(P=9a ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAppResolver**%vLN2 E'b& 8P!mm %vLN2(P=9a ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational EY)9 EYM~q; g&h\8A'`=Scenario A!`=Flags  -n ***vLN2 E'b& 8P3! *vLN2 P=9a ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAppResolver***vLN2 E'b& 8P7! *vLN2 P=9a ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreShellTasks**>vLN2 E'b& 8P9! >vLN2 P=9a|  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellInitTasks**>vLN2 E'b& 8P9! >vLN2 P=9a|  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellInitTasks**LN2 E'b& 8P7! LN2P=9a|  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreStartTasksTom**LN2 E'b& 8P;! LN2P=9a|  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload2i**LN2 E'b& 8PI! LN2P=9a|  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f.AppReadinessLogonGroupor**LN2 E'b& 8P=! LN2P=9a|  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f"UpdatePCSettingsaMic**LN2 E'b& 8P=! LN2P=9a|  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f"UpdatePCSettingsft-W**LN2 E'b& 8P;! LN2P=9a|  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload2**LN2 E'b& 8PI! LN2P=9a|  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f.AppReadinessLogonGroup**LN2 E'b& 8P7! LN2P=9a|  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreStartTasks`**bLN2 E'b& 8P7! bLN2P=9a|  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAllLogonTasks lߠ**bLN2 E'b& 8P;! bLN2P=9a  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload3**bLN2 E'b& 8P;! bLN2P=9a  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload3**vLN2 E'b& 8P[! vLN2P=9a ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f@AppReadinessNotifyLogonComplete**vLN2 E'b& 8P[! vLN2P=9a ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f@AppReadinessNotifyLogonCompleteo**LN2 E'b& 8PE! LN2P=9a  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*ARSFirstRunTelemetryhell**&LN2 E'b& 8PE! &LN2P=9a  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*ARSFirstRunTelemetryaMic**lRN2 E'b& 8P9!nqm lRN2 B ]F~r T ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational &Z&| p)c8so**xY"sRN2 E'b& 8P!nrm Y"sRN2 B ]F~r T ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational &ZCorx**8{RN2 E'b& 8Pk!mm 8{RN2 B ]F~r T ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational :R%]:R%&Gm3}8A1`#= ItemsExisting A+`= ItemsAdded A/`!= ItemsRemoved A/`!= ItemsUpdated A-`= ItemsCached XY**SN2 E'b& 8Po!%% SN2 B ]F~r  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational  \Software\Microsoft\Windows\CurrentVersion\Run w** SN2 E'b& 8P!%% SN2 B ]F~r   ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational _,ںz"C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusrws-S** w%$SN2 E'b& 8P!%% w%$SN2 B ]F~r   ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational m. z"C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusrhell** w%$SN2 E'b& 8Po!%% w%$SN2 B ]F~r   ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational  \Software\Microsoft\Windows\CurrentVersion\Run ** w%$SN2 E'b& 8Po!%% w%$SN2 B ]F~r   ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational  \Software\Microsoft\Windows\CurrentVersion\Run|** L$SN2 E'b& 8P!%% L$SN2 B ]F~r   ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational _,ںv"C:\galaxie\deploy\Tomcat6\bin\Tomcat6w.exe" //MS//Tomcat6**psSN2 E'b& 8P!%% psSN2 B ]F~r  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational m. v "C:\galaxie\deploy\Tomcat6\bin\Tomcat6w.exe" //MS//Tomcat6P**psSN2 E'b& 8Po!%% psSN2 B ]F~r  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational  \Software\Microsoft\Windows\CurrentVersion\Run**dtSN2 E'b& 8Pw!%% dtSN2 B ]F~r  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational  dSoftware\Microsoft\Windows\CurrentVersion\RunOnceCor**dtSN2 E'b& 8Pw!%% dtSN2 B ]F~r  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational  dSoftware\Microsoft\Windows\CurrentVersion\RunOncerat**s3 X E'b& 8P7! s3 XP~[Z  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAllLogonTasksona**s3 X E'b& 8PG! s3 XP~[Z  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreDesktopSwitchTasks**s3 X E'b& 8P/! s3 XP~[Z  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellPrep f**s3 X E'b& 8P/! s3 XP~[Z  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellPrepona**s3 X E'b& 8PO! s3 XP~[Z  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f4AppReadinessPreShellGroup **s3 X E'b& 8P5! s3 XP~[Z  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fSkydrivePrep.**s3 X E'b& 8P5! s3 XP~[Z  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fSkydrivePrepl f**s3 X E'b& 8P+! s3 XP~[Z  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fRunOncep**t64 X E'b& 8P+! t64 XP~[Z  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fRunOnceS**t64 X E'b& 8P3! t64 XP~[Z  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fActiveSetupo**7= X E'b& 8P3! 7= XP~[Z  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fActiveSetupc**7= X E'b& 8PC! 7= XP~[Z  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f(WaitForMSAConnectedo**7= X E'b& 8PC! 7= XP~[Z  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f(WaitForMSAConnectedW**7= X E'b& 8PG! 7= XP~[Z  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreConfigLauncherSyncs-S** 7= X E'b& 8PG! 7= XP~[Z   ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreConfigLauncherSyncCor**!7= X E'b& 8PG! 7= XP~[Z ! ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreDesktopSwitchTaskss-S**"7= X E'b& 8P;! 7= XP~[Z " ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f PerUserServicesc**#7= X E'b& 8P;! 7= XP~[Z # ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f PerUserServices'**$7= X E'b& 8P7! 7= XP~[Z $ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreShellTasksell**%7= X E'b& 8PE! 7= XP~[Z % ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*RoamingPayloads0and1indo**&5^= X E'b& 8PE! 5^= XP~[Z & ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*RoamingPayloads0and14-B5**'5^= X E'b& 8PO! 5^= XP~[Z ' ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f4AppReadinessPreShellGroup**(5^= X E'b& 8P3! 5^= XP~[Z ( ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAppResolver**)9B X E'b& 8P!mm 9B XP~[Z ) ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational EY)9 cro***dB X E'b& 8P3! dB X ZP~[Z * ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAppResolverp**+dB X E'b& 8P7! dB X ZP~[Z + ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreShellTasksell**,lB X E'b& 8P9! lB X ZP~[Z  , ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellInitTasksB**-lB X E'b& 8P9! lB X ZP~[Z  - ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellInitTasks**., X E'b& 8P7! , XP~[Z  . ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreStartTasks'b&**/, X E'b& 8P;! , XP~[Z  / ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload2x**0, X E'b& 8PI! , XP~[Z  0 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f.AppReadinessLogonGroupga**1, X E'b& 8P=! , XP~[Z  1 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f"UpdatePCSettingsws-S**2, X E'b& 8P=! , XP~[Z  2 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f"UpdatePCSettingsen30'**3, X E'b& 8P;! , XP~[Z  3 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload2**4, X E'b& 8PI! , XP~[Z  4 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f.AppReadinessLogonGroupP**5, X E'b& 8P7! , XP~[Z  5 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreStartTasksP**6ݻ X E'b& 8P7! ݻ XP~[Z  6 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAllLogonTasks Р**7[ X E'b& 8P;! [ XP~[Z 7 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload3**8[ X E'b& 8P;! [ XP~[Z 8 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload3**9G  X E'b& 8P[! G  XP~[Z 9 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f@AppReadinessNotifyLogonComplete **:G  X E'b& 8P[! G  XP~[Z : ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f@AppReadinessNotifyLogonComplete**;& X E'b& 8PE! & XP~[Z p; ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*ARSFirstRunTelemetryMic**<& X E'b& 8PE! & XP~[Z p< ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*ARSFirstRunTelemetryws-S**x=78 X E'b& 8P!nqm 78 XuH&wْ = ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational &Zosox**x>@= X E'b& 8P!nrm @= XuH&wْ > ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational &Zx**?U~E X E'b& 8P7!mm U~E XuH&wْ ? ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational :R%]XY ذĤ**@[) X E'b& 8Po!%% [) XuH&wْ @ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational  \Software\Microsoft\Windows\CurrentVersion\Runs-S**A[) X E'b& 8P!%% [) XuH&wْ A ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational _,ںz"C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusrhell**B( X E'b& 8P!%% ( XuH&wْ B ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational m. z "C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusrfigL**C( X E'b& 8Po!%% ( XuH&wْ C ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational  \Software\Microsoft\Windows\CurrentVersion\Run****D( X E'b& 8Po!%% ( XuH&wْ D ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational  \Software\Microsoft\Windows\CurrentVersion\Run**E( X E'b& 8P!%% ( XuH&wْ E ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational _,ںv"C:\galaxie\deploy\Tomcat6\bin\Tomcat6w.exe" //MS//Tomcat6/**FZ X E'b& 8P!%% Z XuH&wْ F ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational m. vX "C:\galaxie\deploy\Tomcat6\bin\Tomcat6w.exe" //MS//Tomcat6do**GZ X E'b& 8Po!%% Z XuH&wْ G ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational  \Software\Microsoft\Windows\CurrentVersion\RunQR**HZ X E'b& 8Pw!%% Z XuH&wْ H ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational  dSoftware\Microsoft\Windows\CurrentVersion\RunOnceell**IZ X E'b& 8Pw!%% Z XuH&wْ I ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational  dSoftware\Microsoft\Windows\CurrentVersion\RunOnce f**JZ뗐x[ E'b& 8P7! Z뗐x[P~" J ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAllLogonTasks**KZ뗐x[ E'b& 8PG! Z뗐x[P~" K ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreDesktopSwitchTasks**LZ뗐x[ E'b& 8P/! Z뗐x[P~" L ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellPrepks**MZ뗐x[ E'b& 8P/! Z뗐x[P~" M ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellPrepitT**NZ뗐x[ E'b& 8PO! Z뗐x[P~" N ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f4AppReadinessPreShellGroup****OZ뗐x[ E'b& 8P5! Z뗐x[P~" O ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fSkydrivePrep****PZ뗐x[ E'b& 8P5! Z뗐x[P~" P ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fSkydrivePrep****QZ뗐x[ E'b& 8P+! Z뗐x[P~" Q ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fRunOnceo**RMx[ E'b& 8P+! Mx[P~" R ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fRunOnce**SMx[ E'b& 8P3! Mx[P~" S ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fActiveSetup**T쯜x[ E'b& 8P3! 쯜x[P~" T ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fActiveSetupt**U쯜x[ E'b& 8PC! 쯜x[P~" U ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f(WaitForMSAConnecteda**V쯜x[ E'b& 8PC! 쯜x[P~" V ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f(WaitForMSAConnectedt**W쯜x[ E'b& 8PG! 쯜x[P~" W ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreConfigLauncherSync f**X쯜x[ E'b& 8PG! 쯜x[P~" X ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreConfigLauncherSync **Y쯜x[ E'b& 8PG! 쯜x[P~" Y ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreDesktopSwitchTasksmin**Z쯜x[ E'b& 8P;! 쯜x[P~" Z ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f PerUserServicesa**[쯜x[ E'b& 8P;! 쯜x[P~" [ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f PerUserServices**\쯜x[ E'b& 8P7! 쯜x[P~" \ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreShellTasksCor**]쯜x[ E'b& 8PE! 쯜x[P~" ] ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*RoamingPayloads0and1-Cor**^쯜x[ E'b& 8PE! 쯜x[P~" ^ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*RoamingPayloads0and1-Cor**_쯜x[ E'b& 8PO! 쯜x[P~" _ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f4AppReadinessPreShellGroup**`쯜x[ E'b& 8P3! 쯜x[P~" ` ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAppResolver**ax[ E'b& 8P!mm x[P~" a ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational EY)9 cro**bx[ E'b& 8P3! x["P~" b ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAppResolverp**cx[ E'b& 8P7! x["P~" c ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreShellTasksell**dx[ E'b& 8P9! x["P~" d ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellInitTasksM**ex[ E'b& 8P9! x["P~" e ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellInitTasks**f˛x[ E'b& 8P7! ˛x[P~" f ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreStartTasks/Opational fYPreShellTasksffElfChnkgg 6 Gv8`=f?mMFq)mYo&AgYj**g˛x[ E'b&E'bUa4UxLIDwEAM Eventjxmlns5http://schemas.microsoft.com/win/2004/08/events/eventoTSystemAY{Provider6F=KNameX)GuidAMzaEventID'X) Qualifiers " Version dLevelE{Task ?Opcode$fjKeywordsAP; TimeCreated'j<{ SystemTime .F EventRecordID A Correlation\FF ActivityIDmz5RelatedActivityID Am ExecutionHFF ProcessID9ThreadID "aChannel<F;nComputer FILF-APP-RECAB.SecurityfLUserID ! 8P! ˛x[P~" g ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational ff6!yƒ8D EventDataA;`oData= LogonType A'`=TaskName  RoamingPayload2/M**h˛x[ E'b& 8PI! ˛x[P~" h ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f.AppReadinessLogonGroup**i˛x[ E'b& 8P=! ˛x[P~" i ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f"UpdatePCSettingsi 2**j˛x[ E'b& 8P=! ˛x[P~" j ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f"UpdatePCSettings**k˛x[ E'b& 8P;! ˛x[P~" k ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload2**l˛x[ E'b& 8PI! ˛x[P~" l ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f.AppReadinessLogonGroupur**m˛x[ E'b& 8P7! ˛x[P~" m ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreStartTasks**n-x[ E'b& 8P7! -x[P~" n ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAllLogonTasksndo**o:x[ E'b& 8P;! :x[P~" o ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload3o**p:x[ E'b& 8P;! :x[P~" p ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload3W**q:x[ E'b& 8P[! :x[P~" q ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f@AppReadinessNotifyLogonComplete'**r:x[ E'b& 8P[! :x[P~" r ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f@AppReadinessNotifyLogonCompleteR**s:x[ E'b& 8PE! :x[P~" Ls ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*ARSFirstRunTelemetryroso**t:x[ E'b& 8PE! :x[P~" Lt ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*ARSFirstRunTelemetryindo**u| Ct E'b& 8P7! | CtP8  u ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAllLogonTasksell**v| Ct E'b& 8PG! | CtP8  v ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreDesktopSwitchTasksona**w| Ct E'b& 8P/! | CtP8  w ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellPrepona**x| Ct E'b& 8P/! | CtP8  x ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellPrepona**y| Ct E'b& 8PO! | CtP8  y ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f4AppReadinessPreShellGroup**z| Ct E'b& 8P5! | CtP8  z ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fSkydrivePrepl f**{| Ct E'b& 8P5! | CtP8  { ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fSkydrivePreperat**|| Ct E'b& 8P+! | CtP8  | ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fRunOnceS**}| Ct E'b& 8P+! | CtP8  } ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fRunOncec**~| Ct E'b& 8P3! | CtP8  ~ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fActiveSetupR**$ Ct E'b& 8P3! $ CtbS[7^@|8"8   ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fActiveSetup'**$ Ct E'b& 8PC! $ CtbS[7^@|8"8   ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f(WaitForMSAConnectedR**$ Ct E'b& 8PC! $ CtbS[7^@|8"8   ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f(WaitForMSAConnected'**$ Ct E'b& 8PG! $ CtbS[7^@|8"8   ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreConfigLauncherSyncn30'**$ Ct E'b& 8PG! $ CtbS[7^@|8"8   ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreConfigLauncherSyncCor**$ Ct E'b& 8PG! $ CtbS[7^@|8"8   ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreDesktopSwitchTasksMic**$ Ct E'b& 8P;! $ CtbS[7^@|8"8   ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f PerUserServices**$ Ct E'b& 8P;! $ CtbS[7^@|8"8   ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f PerUserServices**$ Ct E'b& 8P7! $ CtbS[7^@|8"8   ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreShellTasks**$ Ct E'b& 8PE! $ CtbS[7^@|8"8   ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*RoamingPayloads0and1i 2**$ Ct E'b& 8PE! $ CtbS[7^@|8"8   ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*RoamingPayloads0and1roso**$ Ct E'b& 8PO! $ CtbS[7^@|8"8   ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f4AppReadinessPreShellGroups-S**$ Ct E'b& 8P3! $ CtbS[7^@|8"8   ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAppResolvero**kCt E'b& 8P!mm kCtbS[7^@|8"8   ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational EYEEYM~q; g&h\8A'`=Scenario A!`=Flags  ell**&Ct E'b& 8P3! &CtP8   ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAppResolvero**&Ct E'b& 8P7! &CtP8   ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreShellTaskst-W**tCt E'b& 8P9! tCtP8  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellInitTasks-W**tCt E'b& 8P9! tCtP8  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellInitTasksic**7Ct E'b& 8P7! 7CtP8  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreStartTasksMic**7Ct E'b& 8P;! 7CtP8  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload2c**7Ct E'b& 8PI! 7CtP8  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f.AppReadinessLogonGroup-W**7Ct E'b& 8P=! 7CtP8  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f"UpdatePCSettingsindo**7Ct E'b& 8P=! 7CtP8  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f"UpdatePCSettingsaMic**7Ct E'b& 8P;! 7CtP8  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload2l**7Ct E'b& 8PI! 7CtP8  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f.AppReadinessLogonGroupll**7Ct E'b& 8P7! 7CtP8  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreStartTasksndo**8Dt E'b& 8P7! 8DtP8  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAllLogonTasksndo**_Dt E'b& 8P;! _DtP8 P  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload3R**_Dt E'b& 8P;! _DtP8 P  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload3**h Dt E'b& 8P[! h DtP8  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f@AppReadinessNotifyLogonCompleten**h Dt E'b& 8P[! h DtP8  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f@AppReadinessNotifyLogonCompletea**#Dt E'b& 8PE! #DtP8  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*ARSFirstRunTelemetryhell**qDt E'b& 8PE! qDtP8  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*ARSFirstRunTelemetryws-S**It E'b& 8P9!nqm ItЬa&O{8  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational &Ag&| p)c8**x It E'b& 8P!nrm ItЬa&O{8  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational &Agx**?It E'b& 8Pk!mm ?ItЬa&O{8  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational :R%Yj:R%&Gm3}8A1`#= ItemsExisting A+`= ItemsAdded A/`!= ItemsRemoved A/`!= ItemsUpdated A-`= ItemsCached XYS**0~8Jt E'b& 8P!%% ~8JtЬa&O{8 ( ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational )m3"E>28A%`=KeyName \Software\Microsoft\Windows\CurrentVersion\Run 0**H~8Jt E'b& 8P!%% ~8JtЬa&O{8 ( ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational _,ںYo_,ں # >28A%`=Command z"C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusrrH**x>Jt E'b& 8P!%% >JtЬa&O{8 ( ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational m.qEm.C HXOagbV8A`=PID A%`=Command z "C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusrPx**>Jt E'b& 8Po!%% >JtЬa&O{8 ( ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational )m\Software\Microsoft\Windows\CurrentVersion\RunMic**>Jt E'b& 8Po!%% >JtЬa&O{8 ( ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational )m\Software\Microsoft\Windows\CurrentVersion\Runell**>Jt E'b& 8P!%% >JtЬa&O{8 ( ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational _,ںYov"C:\galaxie\deploy\Tomcat6\bin\Tomcat6w.exe" //MS//Tomcat6Op**[Jt E'b& 8P!%% [Jt0H?MweLQ8 ( ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational m.qv "C:\galaxie\deploy\Tomcat6\bin\Tomcat6w.exe" //MS//Tomcat6p**[Jt E'b& 8Po!%% [Jt0H?MweLQ8 ( ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational )m\Software\Microsoft\Windows\CurrentVersion\Run**ނJt E'b& 8Pw!%% ނJt0H?MweLQ8 ( ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational )mdSoftware\Microsoft\Windows\CurrentVersion\RunOnceP**ނJt E'b& 8Pw!%% ނJt0H?MweLQ8 ( ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational )mdSoftware\Microsoft\Windows\CurrentVersion\RunOnce ذĤ**} E'b& 8P7! }PhSt  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAllLogonTasksMic**} E'b& 8PG! }PhSt  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreDesktopSwitchTasksndo**} E'b& 8P/! }PhSt  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellPrepndo**} E'b& 8P/! }PhSt  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellPreposo**} E'b& 8PO! }PhSt  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f4AppReadinessPreShellGroupndo**} E'b& 8P5! }PhSt  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fSkydrivePreproso**} E'b& 8P5! }PhSt  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fSkydrivePrepi 2**} E'b& 8P+! }PhSt  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fRunOnce**} E'b& 8P+! }PhSt  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fRunOnce**} E'b& 8P3! }PhSt  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fActiveSetup**f E'b& 8P3! fPhSt  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fActiveSetup7**f E'b& 8PC! fPhSt  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f(WaitForMSAConnected**f E'b& 8PC! fPhSt  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f(WaitForMSAConnected**f E'b& 8PG! fPhSt  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreConfigLauncherSyncP**f E'b& 8PG! fPhSt  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreConfigLauncherSync 9**f E'b& 8PG! fPhSt  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreDesktopSwitchTasks**f E'b& 8P;! fPhSt  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f PerUserServices**f E'b& 8P;! fPhSt  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f PerUserServices**f E'b& 8P7! fPhSt  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreShellTasks**f E'b& 8PE! fPhSt  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*RoamingPayloads0and1i 2**3 E'b& 8PE! 3PhSt  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*RoamingPayloads0and1roso**3 E'b& 8PO! 3PhSt  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f4AppReadinessPreShellGroups-S**3 E'b& 8P3! 3PhSt  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAppResolvero**3 E'b& 8P!mm 3PhSt  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational EYE **3 E'b& 8P3! 3 PhSt  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAppResolver**3 E'b& 8P7! 3 PhSt  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreShellTasks 4**3 E'b& 8P9! 3 PhS  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellInitTasksP**3 E'b& 8P9! 3 PhS  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellInitTasksP**G E'b& 8P7! GKPhS  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreStartTasksP**G E'b& 8P;! GKPhS  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload2**G E'b& 8PI! GKPhS  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f.AppReadinessLogonGroup9**G E'b& 8P=! GKPhS  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f"UpdatePCSettings X**G E'b& 8P=! GKPhS  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f"UpdatePCSettingsE!**G E'b& 8P;! GKPhS  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload2**G E'b& 8PI! GKPhS  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f.AppReadinessLogonGroup8**G E'b& 8P7! GKPhS  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreStartTasksX** E'b& 8P7! KPhS  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAllLogonTasks** E'b& 8P;! KPhS ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload3** E'b& 8P;! KPhS ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload3**  E'b& 8P[! KPhS ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f@AppReadinessNotifyLogonComplete**  E'b& 8P[! KPhS ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f@AppReadinessNotifyLogonComplete**  E'b& 8PE! KPhS ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*ARSFirstRunTelemetryrent**  E'b& 8PE! KPhS ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*ARSFirstRunTelemetryicro**x{ E'b& 8P!nqm {O'8D^#ŒH ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational &Agndox**x E'b& 8P!nrm O'8D^#ŒH ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational &Agx**N E'b& 8P7!mm NO'8D^#ŒH ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational :R%YjXY** E'b& 8Po!%% O'8D^#Œ  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational )m\Software\Microsoft\Windows\CurrentVersion\Run** E'b& 8P!%% O'8D^#Œ  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational _,ںYoz"C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusrw!**`x E'b& 8P!%% `xO'8D^#Œ  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational m.qzh "C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusrP**`x E'b& 8Po!%% `xO'8D^#Œ  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational )m\Software\Microsoft\Windows\CurrentVersion\RunMic**`x E'b& 8Po!%% `xO'8D^#Œ  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational )m\Software\Microsoft\Windows\CurrentVersion\Runell**`x E'b& 8P!%% `xO'8D^#Œ  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational _,ںYov"C:\galaxie\deploy\Tomcat6\bin\Tomcat6w.exe" //MS//Tomcat6Op**V E'b& 8P!%% VaqSMշ!ep  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational m.qvH"C:\galaxie\deploy\Tomcat6\bin\Tomcat6w.exe" //MS//Tomcat6p**V E'b& 8Po!%% VaqSMշ!ep  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational )m\Software\Microsoft\Windows\CurrentVersion\Run**YV E'b& 8Pw!%% YVaqSMշ!ep  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational )mdSoftware\Microsoft\Windows\CurrentVersion\RunOnceP**YV E'b& 8Pw!%% YVaqSMշ!ep  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational )mdSoftware\Microsoft\Windows\CurrentVersion\RunOnce ذĤ**Gk E'b& 8P7! Gk*PQ[t  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAllLogonTasksMic**Gk E'b& 8PG! Gk*PQ[t  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreDesktopSwitchTasksndo**Gk E'b& 8P/! Gk*PQ[t  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellPrepndo**Gk E'b& 8P/! Gk*PQ[t  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellPreposo**Gk E'b& 8PO! Gk*PQ[t  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f4AppReadinessPreShellGroupndo**Gk E'b& 8P5! Gk*PQ[t  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fSkydrivePreproso**Gk E'b& 8P5! Gk*PQ[t  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fSkydrivePrepi 2**Gk E'b& 8P+! Gk*PQ[t  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fRunOnce**Gk E'b& 8P+! Gk*PQ[t  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fRunOnce**Gk E'b& 8P3! Gk*PQ[t  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fActiveSetup**k E'b& 8P3! k*PQ[t  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fActiveSetup**k E'b& 8PC! k*PQ[t  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f(WaitForMSAConnected**k E'b& 8PC! k*PQ[t  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f(WaitForMSAConnected**k E'b& 8PG! k*PQ[t  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreConfigLauncherSyncP**k E'b& 8PG! k*PQ[t  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreConfigLauncherSync **k E'b& 8PG! k*PQ[t  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreDesktopSwitchTasks**k E'b& 8P;! k*PQ[t  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f PerUserServices**k E'b& 8P;! k*PQ[t  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f PerUserServices**k E'b& 8P7! k*PQ[t  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreShellTasks**k E'b& 8PE! k*PQ[t  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*RoamingPayloads0and1i 2icrosoft-Win E'b& 8Pell-Core/Operational fPreStartTasks/Opational fYPreShellTasksffElfChnk   r>8`=f?mMFY95I7&1/I2**k E'b&E'bUa4UxLIDwEAM Eventjxmlns5http://schemas.microsoft.com/win/2004/08/events/eventoTSystemAY{Provider6F=KNameX)GuidAMzaEventID'X) Qualifiers " Version dLevelE{Task ?Opcode$fjKeywordsAP; TimeCreated'j<{ SystemTime .F EventRecordID A Correlation\FF ActivityIDmz5RelatedActivityID Am ExecutionHFF ProcessID9ThreadID "aChannel<F;nComputer FILF-APP-RECAB.SecurityfLUserID ! 8P! k*PQ[t  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational ff6!yƒ8D EventDataA;`oData= LogonType A'`=TaskName *RoamingPayloads0and1**k E'b& 8PO! k*PQ[t  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f4AppReadinessPreShellGroupi**k E'b& 8P3! k*PQ[t  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAppResolver**k E'b& 8P!mm k*PQ[t  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational EY EYM~q; g&h\8A'`=Scenario A!`=Flags  **k E'b& 8P3! k[PQ[t  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAppResolver**k E'b& 8P7! k[PQ[t  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreShellTasks**k E'b& 8P9! k[PQ[t D ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellInitTasks**k E'b& 8P9! k[PQ[t D ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellInitTasks**V{k E'b& 8P7! V{kPQ[t D ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreStartTasks**V{k E'b& 8P;! V{kPQ[t D ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload2**V{k E'b& 8PI! V{kPQ[t D ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f.AppReadinessLogonGroup**V{k E'b& 8P=! V{kPQ[t D ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f"UpdatePCSettings[**V{k E'b& 8P=! V{kPQ[t D ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f"UpdatePCSettings:**V{k E'b& 8P;! V{kPQ[t D ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload2**V{k E'b& 8PI! V{kPQ[t D ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f.AppReadinessLogonGroup| C**V{k E'b& 8P7! V{kPQ[t D ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreStartTasks**** .~k E'b& 8P7! .~kPQ[t D  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAllLogonTasksx** .~k E'b& 8P;! .~kPQ[t X  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload3C** .~k E'b& 8P;! .~kPQ[t X  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload3** .~k E'b& 8P[! .~kPQ[t H  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f@AppReadinessNotifyLogonComplete** .~k E'b& 8P[! .~kPQ[t H  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f@AppReadinessNotifyLogonComplete**쏀k E'b& 8PE! 쏀kPQ[t  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*ARSFirstRunTelemetry**쏀k E'b& 8PE! 쏀kPQ[t  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*ARSFirstRunTelemetry**ٕk E'b& 8P9!nqm ٕkөgRS2MTOD4t , ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational &1/&| p)c8 $Ǡ**x,k E'b& 8P!nrm ,kөgRS2MTOD4t , ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational &1/8x**0k E'b& 8Pk!mm 0kөgRS2MTOD4t , ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational :R%I2:R%&Gm3}8A1`#= ItemsExisting A+`= ItemsAdded A/`!= ItemsRemoved A/`!= ItemsUpdated A-`= ItemsCached XYA**0`k E'b& 8P!%% `kөgRS2MTOD4t  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational 53"E>28A%`=KeyName \Software\Microsoft\Windows\CurrentVersion\Run80**H`k E'b& 8P!%% `kөgRS2MTOD4t  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational _,ںI7_,ں # >28A%`=Command z"C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusrrH**xk E'b& 8P!%% kөgRS2MTOD4t  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational m.9 m.C HXOagbV8A`=PID A%`=Command z<"C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusr'b&x**k E'b& 8Po!%% kөgRS2MTOD4t  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational 5\Software\Microsoft\Windows\CurrentVersion\Run**k E'b& 8Po!%% kөgRS2MTOD4t  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational 5\Software\Microsoft\Windows\CurrentVersion\Run7^@**k E'b& 8P!%% kөgRS2MTOD4t  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational _,ںI7v"C:\galaxie\deploy\Tomcat6\bin\Tomcat6w.exe" //MS//Tomcat6so**@ԏk E'b& 8P!%% @ԏkөgRS2MTOD4t  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational m.9v0"C:\galaxie\deploy\Tomcat6\bin\Tomcat6w.exe" //MS//Tomcat6so**@ԏk E'b& 8Po!%% @ԏkөgRS2MTOD4t  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational 5\Software\Microsoft\Windows\CurrentVersion\Runell**\ԏk E'b& 8Pw!%% \ԏkөgRS2MTOD4t  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational 5dSoftware\Microsoft\Windows\CurrentVersion\RunOnce**\ԏk E'b& 8Pw!%% \ԏkөgRS2MTOD4t  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational 5dSoftware\Microsoft\Windows\CurrentVersion\RunOnceona**>m E'b& 8P7! >mPQ[ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAllLogonTasks f**>m E'b& 8PG! >mPQ[ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreDesktopSwitchTasks**>m E'b& 8P/! >mPQ[ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellPrep** >m E'b& 8P/! >mPQ[  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellPrep f**!>m E'b& 8PO! >mPQ[! ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f4AppReadinessPreShellGroupRo**">m E'b& 8P5! >mPQ[" ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fSkydrivePrepAp**#>m E'b& 8P5! >mPQ[# ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fSkydrivePrep**$>m E'b& 8P+! >mPQ[$ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fRunOncet**%>m E'b& 8P+! >mPQ[% ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fRunOncel**&>m E'b& 8P3! >mPQ[& ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fActiveSetupS**'5m E'b& 8P3! 5mPQ[' ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fActiveSetupo**(5m E'b& 8PC! 5mPQ[( ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f(WaitForMSAConnectedW**)5m E'b& 8PC! 5mPQ[) ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f(WaitForMSAConnectedo***5m E'b& 8PG! 5mPQ[* ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreConfigLauncherSyncell**+5m E'b& 8PG! 5mPQ[+ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreConfigLauncherSync/Op**,5m E'b& 8PG! 5mPQ[, ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreDesktopSwitchTasksell**-5m E'b& 8P;! 5mPQ[- ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f PerUserServiceso**.5m E'b& 8P;! 5mPQ[. ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f PerUserServicesR**/5m E'b& 8P7! 5mPQ[/ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreShellTasksCor**05m E'b& 8PE! 5mPQ[0 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*RoamingPayloads0and1|DQR**1\m E'b& 8PE! \mPQ[1 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*RoamingPayloads0and1-Cor**2\m E'b& 8PO! \mPQ[2 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f4AppReadinessPreShellGroup**3\m E'b& 8P3! \mPQ[3 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAppResolver\**4m E'b& 8P!mm mPQ[4 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational EY  oso**5m E'b& 8P3! mPQ[5 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAppResolver**6m E'b& 8P7! mPQ[6 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreShellTasksm F**7m E'b& 8P9! mPQ[7 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellInitTasks-S**8m E'b& 8P9! mPQ[8 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellInitTasksor**9om E'b& 8P7! om*PQ[9 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreStartTasks 2**:om E'b& 8P;! om*PQ[: ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload2**;om E'b& 8PI! om*PQ[; ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f.AppReadinessLogonGroup**<om E'b& 8P=! om*PQ[< ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f"UpdatePCSettings**=om E'b& 8P=! om*PQ[= ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f"UpdatePCSettingsdows**>om E'b& 8P;! om*PQ[> ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload2**?om E'b& 8PI! om*PQ[? ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f.AppReadinessLogonGroup-S**@om E'b& 8P7! om*PQ[@ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreStartTaskss-S**Am E'b& 8P7! m*PQ[A ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAllLogonTaskst-W**Bm E'b& 8P;! m*PQ[B ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload3o**Cm E'b& 8P;! m*PQ[C ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload3S**D?m E'b& 8P[! ?m*PQ[D ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f@AppReadinessNotifyLogonCompletel**E?m E'b& 8P[! ?m*PQ[E ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f@AppReadinessNotifyLogonCompletea**F/m E'b& 8PE! /m*PQ[F ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*ARSFirstRunTelemetry**G/m E'b& 8PE! /m*PQ[G ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*ARSFirstRunTelemetrye**xHm E'b& 8P!nqm m r~Ky 3H ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational &1/x**Inm E'b& 8P!mm nm r~Ky 3I ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational 1cY1cᆫ}Q4?A_|8A`=Name A!`=AppID A!`=Flags h~dmarrer la journalisation de statistiques de la VMMicrosoft.AutoGenerated.{14A21382-6511-3324-B505-306A7D8FF83A}0erat**xJm E'b& 8P!nrm m r~Ky 3J ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational &1/t-Wx**K2|m E'b& 8P7!mm 2|m r~Ky 3K ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational :R%I2YYoso**L(m E'b& 8Po!%% (m r~Ky 3,L ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational 5\Software\Microsoft\Windows\CurrentVersion\RunCor**M(m E'b& 8P!%% (m r~Ky 3,M ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational _,ںI7z"C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusrktop**Nm E'b& 8P!%% m r~Ky 3,N ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational m.9z"C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusr**Om E'b& 8Po!%% m r~Ky 3,O ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational 5\Software\Microsoft\Windows\CurrentVersion\Run!**Pm E'b& 8Po!%% m r~Ky 3,P ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational 5\Software\Microsoft\Windows\CurrentVersion\Run**Qm E'b& 8Po!%% m r~Ky 3,Q ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational 5\Software\Microsoft\Windows\CurrentVersion\Runoso**R)m E'b& 8Pw!%% )m r~Ky 3,R ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational 5dSoftware\Microsoft\Windows\CurrentVersion\RunOncen30'**S8Qm E'b& 8P/!%% 8Qm r~Ky 3,S ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational _,ںI7ctfmon.exe /nndo**Tgm E'b& 8P7!%% gm r~Ky 3,T ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational m.9ctfmon.exe /ns-S**Ugm E'b& 8Pw!%% gm r~Ky 3,U ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational 5dSoftware\Microsoft\Windows\CurrentVersion\RunOnceCor**VO E'b& 8P7! ONP 8V ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAllLogonTasks/Op**WO E'b& 8PG! ONP 8W ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreDesktopSwitchTasksona**XO E'b& 8P/! ONP 8X ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellPreprat**YO E'b& 8P/! ONP 8Y ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellPrep/Op**ZO E'b& 8PO! ONP 8Z ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f4AppReadinessPreShellGroup f**[O E'b& 8P5! ONP 8[ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fSkydrivePrepl f**\O E'b& 8P5! ONP 8\ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fSkydrivePreperat**]O E'b& 8P+! ONP 8] ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fRunOncel**^O E'b& 8P+! ONP 8^ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fRunOnceW**_O E'b& 8P3! ONP 8_ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fActiveSetupo**` E'b& 8P3! NP 8` ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fActiveSetup'**a E'b& 8PC! NP 8a ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f(WaitForMSAConnectedR**b E'b& 8PC! NP 8b ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f(WaitForMSAConnectedc**c E'b& 8PG! NP 8c ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreConfigLauncherSynct-W**d E'b& 8PG! NP 8d ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreConfigLauncherSyncs-S**e E'b& 8PG! NP 8e ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreDesktopSwitchTaskst-W**f E'b& 8P;! NP 8f ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f PerUserServices'**g E'b& 8P;! NP 8g ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f PerUserServicesl**h E'b& 8P7! NP 8h ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreShellTasksndo**i E'b& 8PE! NP 8i ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*RoamingPayloads0and1roso**j E'b& 8PE! NP 8j ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*RoamingPayloads0and1erat**k E'b& 8PO! NP 8k ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f4AppReadinessPreShellGroup**l E'b& 8P3! NP 8l ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAppResolvero**m E'b& 8P!mm NP 8m ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational EY   ذĤ**n E'b& 8P3! kP 8n ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAppResolver**o E'b& 8P7! kP 8o ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreShellTasks**p E'b& 8P9! kP T p ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellInitTasksrs**q E'b& 8P9! kP T q ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellInitTasksxi**r8k E'b& 8P7! 8k P T r ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreStartTaskss-S**s8k E'b& 8P;! 8k P T s ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload2W**t8k E'b& 8PI! 8k P T t ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f.AppReadinessLogonGroup**u8k E'b& 8P=! 8k P T u ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f"UpdatePCSettings%%**v8k E'b& 8P=! 8k P T v ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f"UpdatePCSettings**w8k E'b& 8P;! 8k P T w ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload2**x8k E'b& 8PI! 8k P T x ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f.AppReadinessLogonGroup**y8k E'b& 8P7! 8k P T y ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreStartTasks**z~ E'b& 8P7! ~ P T z ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAllLogonTasks**{~ E'b& 8P;! ~ P { ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload3**|~ E'b& 8P;! ~ P | ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload3**}k E'b& 8P[! k P @ } ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f@AppReadinessNotifyLogonComplete**~k E'b& 8P[! k P @ ~ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f@AppReadinessNotifyLogonComplete**0 E'b& 8PE! 0 P | ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*ARSFirstRunTelemetry**Β E'b& 8PE! Β P | ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*ARSFirstRunTelemetryi 2**x E'b& 8P!nqm ZR76BN5)Ǖ  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational &1/ x**xp E'b& 8P!nrm pZR76BN5)Ǖ  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational &1/!x**` E'b& 8P7!mm `ZR76BN5)Ǖ  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational :R%I2XYP**{ E'b& 8Po!%% {ZR76BN5)Ǖ  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational 5\Software\Microsoft\Windows\CurrentVersion\RunP**{ E'b& 8P!%% {ZR76BN5)Ǖ  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational _,ںI7z"C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusrft-W**PO E'b& 8P!%% POZR76BN5)Ǖ  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational m.9z"C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusrindo**PO E'b& 8Po!%% POZR76BN5)Ǖ  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational 5\Software\Microsoft\Windows\CurrentVersion\Run f**PO E'b& 8Po!%% POZR76BN5)Ǖ  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational 5\Software\Microsoft\Windows\CurrentVersion\Run**PO E'b& 8P!%% POZR76BN5)Ǖ  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational _,ںI7v"C:\galaxie\deploy\Tomcat6\bin\Tomcat6w.exe" //MS//Tomcat6  E'b& 8PPreStartTasks/Opational fYPreShellTasksffElfChnk>{8`=f?mMF6 `&QXi[**H E'b&E'bUa4UxLIDwEAM Eventjxmlns5http://schemas.microsoft.com/win/2004/08/events/eventoTSystemAY{Provider6F=KNameX)GuidAMzaEventID'X) Qualifiers " Version dLevelE{Task ?Opcode$fjKeywordsAP; TimeCreated'j<{ SystemTime .F EventRecordID A Correlation\FF ActivityIDmz5RelatedActivityID Am ExecutionHFF ProcessID9ThreadID "aChannel<F;nComputer FILF-APP-RECAB.SecurityfLUserID ! 8P9!%% ];NQۘ  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational m.m.C HXOag8D EventDataA/`oData=PID A%`=Command vx "C:\galaxie\deploy\Tomcat6\bin\Tomcat6w.exe" //MS//Tomcat6H**0 E'b& 8P!%% ];NQۘ  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational  3"E>28A%`=KeyName \Software\Microsoft\Windows\CurrentVersion\Run0**1 E'b& 8Pw!%% 1];NQۘ  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational  dSoftware\Microsoft\Windows\CurrentVersion\RunOnceCor**1 E'b& 8Pw!%% 1];NQۘ  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational  dSoftware\Microsoft\Windows\CurrentVersion\RunOnceoso**(0 T E'b& 8P! 0 TP$  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational ff6!yƒpd8A)`= LogonType A'`=TaskName AllLogonTasks f(**0 T E'b& 8PG! 0 TP$  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreDesktopSwitchTasks**0 T E'b& 8P/! 0 TP$  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellPrep**0 T E'b& 8P/! 0 TP$  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellPrep f**0 T E'b& 8PO! 0 TP$  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f4AppReadinessPreShellGroupRo**0 T E'b& 8P5! 0 TP$  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fSkydrivePrepAp**0 T E'b& 8P5! 0 TP$  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fSkydrivePrep**0 T E'b& 8P+! 0 TP$  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fRunOncet**0 T E'b& 8P+! 0 TP$  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fRunOncel**0 T E'b& 8P3! 0 TP$  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fActiveSetupS**Ԓ T E'b& 8P3! Ԓ Tb 228A%`=Command z"C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusrH**dWmZ E'b& 8P!%% dWmZb 2` E'b& 8P!mm $>`P.  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational EY6 ndo**a E'b& 8P3! aP.  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAppResolverOpational fYPreShellTasksffElfChnkV{M+8`=f?mMFYf,.&&)**a E'b&E'bUa4UxLIDwEAM Eventjxmlns5http://schemas.microsoft.com/win/2004/08/events/eventoTSystemAY{Provider6F=KNameX)GuidAMzaEventID'X) Qualifiers " Version dLevelE{Task ?Opcode$fjKeywordsAP; TimeCreated'j<{ SystemTime .F EventRecordID A Correlation\FF ActivityIDmz5RelatedActivityID Am ExecutionHFF ProcessID9ThreadID "aChannel<F;nComputer FILF-APP-RECAB.SecurityfLUserID ! 8P! aP.  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational ff6!yƒ8D EventDataA;`oData= LogonType A'`=TaskName PreShellTaskscat6** b E'b& 8P9! bP.   ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellInitTasksat** b E'b& 8P9! bP.   ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellInitTasks** U\ E'b& 8P7! U\ P.   ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreStartTasks 1**!U\ E'b& 8P;! U\ P.  ! ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload2**"U\ E'b& 8PI! U\ P.  " ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f.AppReadinessLogonGroup**#U\ E'b& 8P=! U\ P.  # ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f"UpdatePCSettings,**$U\ E'b& 8P=! U\ P.  $ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f"UpdatePCSettings**%U\ E'b& 8P;! U\ P.  % ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload2**&U\ E'b& 8PI! U\ P.  & ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f.AppReadinessLogonGroupne**'U\ E'b& 8P7! U\ P.  ' ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreStartTasks**(m E'b& 8P7! m P.  ( ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAllLogonTasks**)y E'b& 8P;! y P. d ) ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload3***y E'b& 8P;! y P. d * ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload3c**+ E'b& 8P[!  P. L+ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f@AppReadinessNotifyLogonComplete**, E'b& 8P[!  P. L, ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f@AppReadinessNotifyLogonComplete**-ڃ E'b& 8PE! ڃ P. \- ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*ARSFirstRunTelemetry**. E'b& 8PE!  P. \. ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*ARSFirstRunTelemetry**/Y E'b& 8P9!nqm YsGVRO p/ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational &&&| p)c8**x04_ E'b& 8P!nrm 4_sGVRO p0 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational &&x**1Th E'b& 8Pk!mm ThsGVRO p1 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational :R%):R%&Gm3}8A1`#= ItemsExisting A+`= ItemsAdded A/`!= ItemsRemoved A/`!= ItemsUpdated A-`= ItemsCached XYo**02(o E'b& 8P!%% (osGVRO 2 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational ,3"E>28A%`=KeyName \Software\Microsoft\Windows\CurrentVersion\Run0**H3(o E'b& 8P!%% (osGVRO 3 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational _,ں._,ں # >28A%`=Command z"C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusrH**x4(v E'b& 8P!%% (vsGVRO 4 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational m.0m.C HXOagbV8A`=PID A%`=Command z"C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusrPayx**5(v E'b& 8Po!%% (vsGVRO 5 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational ,\Software\Microsoft\Windows\CurrentVersion\Run**6(v E'b& 8Po!%% (vsGVRO 6 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational ,\Software\Microsoft\Windows\CurrentVersion\Run**7(v E'b& 8P!%% (vsGVRO 7 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational _,ں.v"C:\galaxie\deploy\Tomcat6\bin\Tomcat6w.exe" //MS//Tomcat6&**8 E'b& 8P!%% sGVRO 8 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational m.0v"C:\galaxie\deploy\Tomcat6\bin\Tomcat6w.exe" //MS//Tomcat6 Ԓ**9 E'b& 8Po!%% sGVRO 9 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational ,\Software\Microsoft\Windows\CurrentVersion\Run ذĤ**:x E'b& 8Pw!%% xsGVRO : ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational ,dSoftware\Microsoft\Windows\CurrentVersion\RunOnceCor**;x E'b& 8Pw!%% xsGVRO ; ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational ,dSoftware\Microsoft\Windows\CurrentVersion\RunOnceell**<d;6 E'b& 8P7! d;6PnP< ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAllLogonTasksell**=d;6 E'b& 8PG! d;6PnP= ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreDesktopSwitchTasks/Op**>d;6 E'b& 8P/! d;6PnP> ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellPreps-S**?d;6 E'b& 8P/! d;6PnP? ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellPrept-W**@d;6 E'b& 8PO! d;6PnP@ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f4AppReadinessPreShellGroups-S**Ad;6 E'b& 8P5! d;6PnPA ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fSkydrivePrepws-S**Bd;6 E'b& 8P5! d;6PnPB ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fSkydrivePrepft-W**Cd;6 E'b& 8P+! d;6PnPC ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fRunOncec**De;6 E'b& 8P+! e;6PnPD ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fRunOnce'**Ee;6 E'b& 8P3! e;6PnPE ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fActiveSetupr**Fyf;6 E'b& 8P3! yf;6PnPF ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fActiveSetupl**Gyf;6 E'b& 8PC! yf;6PnPG ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f(WaitForMSAConnectedW**Hyf;6 E'b& 8PC! yf;6PnPH ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f(WaitForMSAConnected**Iyf;6 E'b& 8PG! yf;6PnPI ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreConfigLauncherSync 2**Jyf;6 E'b& 8PG! yf;6PnPJ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreConfigLauncherSync 2**Kyf;6 E'b& 8PG! yf;6PnPK ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreDesktopSwitchTasksoso**Lyf;6 E'b& 8P;! yf;6PnPL ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f PerUserServicesr**Myf;6 E'b& 8P;! yf;6PnPM ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f PerUserServices**Nyf;6 E'b& 8P7! yf;6PnPN ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreShellTasks**Oyf;6 E'b& 8PE! yf;6PnPO ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*RoamingPayloads0and1-Cor**Pyf;6 E'b& 8PE! yf;6PnPP ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*RoamingPayloads0and1**Qyf;6 E'b& 8PO! yf;6PnPQ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f4AppReadinessPreShellGroup8**Ryf;6 E'b& 8P3! yf;6PnPR ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAppResolver**Sg;6 E'b& 8P!mm g;6PnPS ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational EYYf0EYM~q; g&h\8A'`=Scenario A!`=Flags  **T h;6 E'b& 8P3! h;6PnPT ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAppResolverZ**U h;6 E'b& 8P7! h;6PnPU ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreShellTasksent**V.kh;6 E'b& 8P9! .kh;6PnPV ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellInitTasksct**W.kh;6 E'b& 8P9! .kh;6PnPW ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellInitTasksct**X8<6 E'b& 8P7! 8<6PnPX ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreStartTaskstwa**Y8<6 E'b& 8P;! 8<6PnPY ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload2l**Z8<6 E'b& 8PI! 8<6PnPZ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f.AppReadinessLogonGroupOp**[8<6 E'b& 8P=! 8<6PnP[ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f"UpdatePCSettings-Cor**\8<6 E'b& 8P=! 8<6PnP\ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f"UpdatePCSettingserat**]8<6 E'b& 8P;! 8<6PnP] ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload2a**^8<6 E'b& 8PI! 8<6PnP^ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f.AppReadinessLogonGroupat**_8<6 E'b& 8P7! 8<6PnP_ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreStartTasksrat**`dK<6 E'b& 8P7! dK<6PnP` ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAllLogonTasksrat**a!S<6 E'b& 8P;! !S<6PnP,a ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload3**b!S<6 E'b& 8P;! !S<6PnP,b ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload3**cY<6 E'b& 8P[! Y<6PnP4 c ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f@AppReadinessNotifyLogonComplete**dY<6 E'b& 8P[! Y<6PnP4 d ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f@AppReadinessNotifyLogonComplete**e!Z<6 E'b& 8PE! !Z<6PnP e ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*ARSFirstRunTelemetryE'b&**fIZ<6 E'b& 8PE! IZ<6PnP f ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*ARSFirstRunTelemetryE'b&**xg^A6 E'b& 8P!nqm ^A6g#NmP, g ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational &&erSx**xh:}dA6 E'b& 8P!nrm :}dA6g#NmP, h ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational && fx**iqA6 E'b& 8P7!mm qA6g#NmP, i ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational :R%)XYrat**j *HB6 E'b& 8Po!%% *HB6g#NmP< j ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational ,\Software\Microsoft\Windows\CurrentVersion\RunSer**k *HB6 E'b& 8P!%% *HB6g#NmP< k ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational _,ں.z"C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusr**lLB6 E'b& 8P!%% LB6g#NmP< l ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational m.0zl"C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusrP**mLB6 E'b& 8Po!%% LB6g#NmP< m ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational ,\Software\Microsoft\Windows\CurrentVersion\Run ذĤ**nLB6 E'b& 8Po!%% LB6g#NmP< n ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational ,\Software\Microsoft\Windows\CurrentVersion\Runt-W**o˽LB6 E'b& 8P!%% ˽LB6g#NmP< o ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational _,ں.v"C:\galaxie\deploy\Tomcat6\bin\Tomcat6w.exe" //MS//Tomcat6-S**pBB6 E'b& 8P!%% BB6g#NmP< p ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational m.0v "C:\galaxie\deploy\Tomcat6\bin\Tomcat6w.exe" //MS//Tomcat6**qBB6 E'b& 8Po!%% BB6g#NmP< q ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational ,\Software\Microsoft\Windows\CurrentVersion\Run**rYB6 E'b& 8Pw!%% YB6g#NmP< r ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational ,dSoftware\Microsoft\Windows\CurrentVersion\RunOnce ]**sYB6 E'b& 8Pw!%% YB6g#NmP< s ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational ,dSoftware\Microsoft\Windows\CurrentVersion\RunOnce 2**t?0 E'b& 8P7! ?0kP t ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAllLogonTasks 2**u?0 E'b& 8PG! ?0kP u ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreDesktopSwitchTasksoso**v?0 E'b& 8P/! ?0kP v ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellPrep ذĤ**w?0 E'b& 8P/! ?0kP w ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellPrep**x?0 E'b& 8PO! ?0kP x ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f4AppReadinessPreShellGroup ذĤ**y?0 E'b& 8P5! ?0kP y ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fSkydrivePrep ذĤ**z?0 E'b& 8P5! ?0kP z ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fSkydrivePrep**{?0 E'b& 8P+! ?0kP { ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fRunOnce **|?0 E'b& 8P+! ?0kP | ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fRunOnceې**}?0 E'b& 8P3! ?0kP } ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fActiveSetup**~?0 E'b& 8P3! ?0kP ~ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fActiveSetup**?0 E'b& 8PC! ?0kP  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f(WaitForMSAConnected**?0 E'b& 8PC! ?0kP  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f(WaitForMSAConnected**?0 E'b& 8PG! ?0kP  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreConfigLauncherSync**?0 E'b& 8PG! ?0kP  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreConfigLauncherSync**?0 E'b& 8PG! ?0kP  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreDesktopSwitchTasks a**?0 E'b& 8P;! ?0kP  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f PerUserServices**?0 E'b& 8P;! ?0kP  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f PerUserServices**?0 E'b& 8P7! ?0kP  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreShellTasks!**?0 E'b& 8PE! ?0kP  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*RoamingPayloads0and1**?0 E'b& 8PE! ?0kP  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*RoamingPayloads0and1.exe**?0 E'b& 8PO! ?0kP  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f4AppReadinessPreShellGroupoft**?0 E'b& 8P3! ?0kP  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAppResolvert**f"?0 E'b& 8P!mm f"?0kP  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational EYYf n30'**p?0 E'b& 8P3! p?0NP  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAppResolver**p?0 E'b& 8P7! p?0NP  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreShellTasks**v?0 E'b& 8P9! v?0NP   ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellInitTasks**v?0 E'b& 8P9! v?0NP   ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellInitTasksrs**'@0 E'b& 8P7! '@0P   ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreStartTaskstwa**'@0 E'b& 8P;! '@0P   ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload2l**'@0 E'b& 8PI! '@0P   ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f.AppReadinessLogonGroup-S**'@0 E'b& 8P=! '@0P   ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f"UpdatePCSettings****$(@0 E'b& 8P=! $(@0P   ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f"UpdatePCSettings**$(@0 E'b& 8P;! $(@0P   ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload2**$(@0 E'b& 8PI! $(@0P   ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f.AppReadinessLogonGroupP**$(@0 E'b& 8P7! $(@0P   ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreStartTasksP**ޞ/@0 E'b& 8P7! ޞ/@0P   ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAllLogonTasks**62@0 E'b& 8P;! 62@0P   ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload3**62@0 E'b& 8P;! 62@0P   ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload3**2@0 E'b& 8P[! 2@0P T ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f@AppReadinessNotifyLogonComplete**2@0 E'b& 8P[! 2@0P T ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f@AppReadinessNotifyLogonComplete**p3@0 E'b& 8PE! p3@0P  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*ARSFirstRunTelemetry **p3@0 E'b& 8PE! p3@0P  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*ARSFirstRunTelemetryi 2**x28A%`=KeyName \Software\Microsoft\Windows\CurrentVersion\RunH0**H^/F E'b& 8P!%% ^/FQFeADZA ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational _,ںT_,ں # >28A%`=Command z"C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusrrH**xY//F E'b& 8P!%% Y//FQFeADZA ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational m.W1+m.C HXOagbV8A`=PID A%`=Command z "C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusrx**Y//F E'b& 8Po!%% Y//FQFeADZA ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational R\Software\Microsoft\Windows\CurrentVersion\Run y**Y//F E'b& 8Po!%% Y//FQFeADZA ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational R\Software\Microsoft\Windows\CurrentVersion\Run ذĤ**Y//F E'b& 8P!%% Y//FQFeADZA ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational _,ںTv"C:\galaxie\deploy\Tomcat6\bin\Tomcat6w.exe" //MS//Tomcat6QR**-0F E'b& 8P!%% -0FQFeADZA ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational m.WvD"C:\galaxie\deploy\Tomcat6\bin\Tomcat6w.exe" //MS//Tomcat6f**-0F E'b& 8Po!%% -0FQFeADZA ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational R\Software\Microsoft\Windows\CurrentVersion\RunPay**-0F E'b& 8Pw!%% -0FQFeADZA ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational RdSoftware\Microsoft\Windows\CurrentVersion\RunOnce****-0F E'b& 8Pw!%% -0FQFeADZA ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational RdSoftware\Microsoft\Windows\CurrentVersion\RunOnce**˳F E'b& 8P7! ˳F ,KWd ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAllLogonTasks**˳F E'b& 8PG! ˳F ,KWd ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreDesktopSwitchTasksZ**˳F E'b& 8P/! ˳F ,KWd ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellPrepks**˳F E'b& 8P/! ˳F ,KWd ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellPrepitT**˳F E'b& 8PO! ˳F ,KWd ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f4AppReadinessPreShellGroup****˳F E'b& 8P5! ˳F ,KWd ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fSkydrivePrep****˳F E'b& 8P5! ˳F ,KWd ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fSkydrivePrep****˳F E'b& 8P+! ˳F ,KWd ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fRunOnceo**˳F E'b& 8P+! ˳F ,KWd ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fRunOnce**˳F E'b& 8P3! ˳F ,KWd ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fActiveSetup**e:F E'b& 8P3! e:F ,KWd ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fActiveSetupt**e:F E'b& 8PC! e:F ,KWd ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f(WaitForMSAConnecteda**e:F E'b& 8PC! e:F ,KWd ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f(WaitForMSAConnectedt**e:F E'b& 8PG! e:F ,KWd ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreConfigLauncherSync f**e:F E'b& 8PG! e:F ,KWd ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreConfigLauncherSync **e:F E'b& 8PG! e:F ,KWd ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreDesktopSwitchTasksmin**e:F E'b& 8P;! e:F ,KWd ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f PerUserServicesa**e:F E'b& 8P;! e:F ,KWd ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f PerUserServices**e:F E'b& 8P7! e:F ,KWd ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreShellTasksCor**e:F E'b& 8PE! e:F ,KWd ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*RoamingPayloads0and1-Cor**e:F E'b& 8PE! e:F ,KWd ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*RoamingPayloads0and1-Cor**e:F E'b& 8PO! e:F ,KWd ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f4AppReadinessPreShellGroupi**e:F E'b& 8P3! e:F ,KWd ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAppResolver**yaF E'b& 8P!mm yaF ,KWd ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational EY1+ cro**yaF E'b& 8P3! yaF ,KWd ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAppResolverp**yaF E'b& 8P7! yaF ,KWd ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreShellTasksell**F E'b& 8P9! F ,KWd  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellInitTasksN**F E'b& 8P9! F ,KWd  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellInitTasks**ՊF E'b& 8P7! ՊF ,KWd  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreStartTasks'b&**ՊF E'b& 8P;! ՊF ,KWd  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload2x**ՊF E'b& 8PI! ՊF ,KWd  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f.AppReadinessLogonGroupga**ՊF E'b& 8P=! ՊF ,KWd  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f"UpdatePCSettingsws-S**ՊF E'b& 8P=! ՊF ,KWd  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f"UpdatePCSettingsen30'**ՊF E'b& 8P;! ՊF ,KWd  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload2**ՊF E'b& 8PI! ՊF ,KWd  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f.AppReadinessLogonGroupP**ՊF E'b& 8P7! ՊF ,KWd  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreStartTasksP**F E'b& 8P7! F ,KWd  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAllLogonTasks ** KF E'b& 8P;! KF ,KWd  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload3** KF E'b& 8P;! KF ,KWd  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload3** rF E'b& 8P[! rF ,KWd  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f@AppReadinessNotifyLogonComplete** rF E'b& 8P[! rF ,KWd  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f@AppReadinessNotifyLogonComplete** rF E'b& 8PE! rF ,KWd  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*ARSFirstRunTelemetryMic**rF E'b& 8PE! rF ,KWd  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*ARSFirstRunTelemetryws-S**x2{F E'b& 8P!nqm 2{F ,KWd ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational &Losox**x-|F E'b& 8P!nrm -|F ,KWd ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational &Lx**Ӣ|F E'b& 8P7!mm Ӣ|F ,KWd ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational :R%OYY ذĤ**2F E'b& 8Po!%% 2F ,KWd ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational R\Software\Microsoft\Windows\CurrentVersion\Runs-S**2F E'b& 8P!%% 2F ,KWd ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational _,ںTz"C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusrhell**F E'b& 8P!%% F ,KWd ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational m.Wz"C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusrfigL**F E'b& 8Po!%% F ,KWd ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational R\Software\Microsoft\Windows\CurrentVersion\Run****F E'b& 8Po!%% F ,KWd ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational R\Software\Microsoft\Windows\CurrentVersion\Run**F E'b& 8Po!%% F ,KWd ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational R\Software\Microsoft\Windows\CurrentVersion\Run!**F E'b& 8Pw!%% F ,KWd ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational RdSoftware\Microsoft\Windows\CurrentVersion\RunOnce**F E'b& 8Pw!%% F ,KWd ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational RdSoftware\Microsoft\Windows\CurrentVersion\RunOncendo**^ E'b& 8P7! ^PCt ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAllLogonTasksoso**^ E'b& 8PG! ^PCt ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreDesktopSwitchTasksMic**^ E'b& 8P/! ^PCt ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellPrepMic**^ E'b& 8P/! ^PCt ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellPrept-W**^ E'b& 8PO! ^PCt ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f4AppReadinessPreShellGroupCor**^ E'b& 8P5! ^PCt ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fSkydrivePrep-Cor** ^ E'b& 8P5! ^PCt  ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fSkydrivePrep-Cor**!^ E'b& 8P+! ^PCt! ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fRunOnceS**"^ E'b& 8P+! ^PCt" ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fRunOnceW**#^ E'b& 8P3! ^PCt# ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fActiveSetupo**$^ E'b& 8P3! ^PCt$ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fActiveSetup**%^ E'b& 8PC! ^PCt% ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f(WaitForMSAConnected**&^ E'b& 8PC! ^PCt& ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f(WaitForMSAConnected**'^ E'b& 8PG! ^PCt' ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreConfigLauncherSyncMic**(^ E'b& 8PG! ^PCt( ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreConfigLauncherSyncMic**)^ E'b& 8PG! ^PCt) ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f,PreDesktopSwitchTaskst-W***^ E'b& 8P;! ^PCt* ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f PerUserServicesW**+^ E'b& 8P;! ^PCt+ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f PerUserServicesW**,^ E'b& 8P7! ^PCt, ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreShellTaskst-W**-^ E'b& 8PE! ^PCt- ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*RoamingPayloads0and1Mic**.^ E'b& 8PE! ^PCt. ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f*RoamingPayloads0and1 ذĤ**/^ E'b& 8PO! ^PCt/ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f4AppReadinessPreShellGroup 2**0^ E'b& 8P3! ^PCt0 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAppResolver**1 E'b& 8P!mm PCt1 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational EY1+  ذĤ**2 E'b& 8P3! PCt2 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAppResolverW**3 E'b& 8P7! PCt3 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreShellTaskst-W**4 E'b& 8P9! PCt4 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellInitTasks**5 E'b& 8P9! PCt5 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fShellInitTasks**6.u E'b& 8P7! .uPCt6 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreStartTasksvmu**7.u E'b& 8P;! .uPCt7 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload2o**8.u E'b& 8PI! .uPCt8 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f.AppReadinessLogonGroup**9.u E'b& 8P=! .uPCt9 ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f"UpdatePCSettingsws-S**:.u E'b& 8P=! .uPCt: ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f"UpdatePCSettingsen30'**;.u E'b& 8P;! .uPCt; ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload2**<.u E'b& 8PI! .uPCt< ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f.AppReadinessLogonGroup-W**=.u E'b& 8P7! .uPCt= ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fPreStartTaskst-W**>L E'b& 8P7! LPCt> ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational fAllLogonTasks**?b/ E'b& 8P;! b/PCth? ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload3**@b/ E'b& 8P;! b/PCth@ ذĤi 2Microsoft-Windows-Shell-Coren30'|DQRaMicrosoft-Windows-Shell-Core/Operational f RoamingPayload3pational f E'b& 8PPreShellTasksff