DonatShell
Server IP : 180.180.241.3  /  Your IP : 216.73.216.252
Web Server : Microsoft-IIS/7.5
System : Windows NT NETWORK-NHRC 6.1 build 7601 (Windows Server 2008 R2 Standard Edition Service Pack 1) i586
User : IUSR ( 0)
PHP Version : 5.3.28
Disable Function : NONE
MySQL : ON  |  cURL : ON  |  WGET : OFF  |  Perl : OFF  |  Python : OFF  |  Sudo : OFF  |  Pkexec : OFF
Directory :  /Windows/Panther/

Upload File :
current_dir [ Writeable ] document_root [ Writeable ]

 

Command :


[ HOME SHELL ]     

Current File : /Windows/Panther/setup.etl
	M(ßZbZ	@tzres.dll,-212@tzres.dll,-211TB6M(Microsoft-Windows-SetupC:\Windows\Panther\setup.etl((xY( @	(8`8@X<8Pf[Y(>uMOWd
SAM<8Pf[Y(>uMOWdProcessOnlineRegistryHivesProcessing system hive [\REGISTRY\MACHINE\SECURITY]...b<8Pf[Y(>uMOWdSECURITYƘD@ZPb<8Pf[Y(>uMOWd
SECURITYE<8Pf[Y(>uMOWdProcessOnlineRegistryHivesProcessing system hive [\REGISTRY\MACHINE\SOFTWARE]...`b<8Pf[Y(>uMOWdSOFTWAREk 	 xY(	 	8P0<8>Y(>uMOWdSclpSetNewShinyUiText failed<8VY(>uMOWdSclpExecuteRequestInternalSaw request: operation flags = 0x80007F07, progress callback presentK<8VY(>uMOWd(SclpExecuteRequestInternalRunning in [online] mode.q
ɼ<8VY(>uMOWd,SclpExecuteRequestInternalAcquiring needed privileges...h<8VY(>uMOWdG!7h<8VY(>uMOWddU°Д?hX<8VY(>uMOWdC:\X<8VY(>uMOWdC:\<8VY(>uMOWdpSclpRemoveContextNoOpsOld and new paths are identical ([C:\]); skipping path replacement...Pj{BP<8VY(>uMOWd<8VY(>uMOWdSclResetDiskGuidsDetected system firmware type = 0x1sr`P<8VY(>uMOWd	P<8VY(>uMOWdP<8VY(>uMOWd
<8VY(>uMOWdProcessOnlineRegistryHivesProcessing system hive [\REGISTRY\USER\.DEFAULT]...j`<8VY(>uMOWdDEFAULT`<8Pf[Y(>uMOWd
DEFAULT<8Pf[Y(>uMOWdProcessOnlineRegistryHivesProcessing system hive [\REGISTRY\MACHINE\SAM\SAM]...I$X<8Pf[Y(>uMOWdSAM/Z( p	8p8Pb<8mfZ(>uMOWd
^SOFTWARE<8mfZ(>uMOWd^ProcessOnlineRegistryHivesProcessing system hive [\REGISTRY\MACHINE\SYSTEM]...R^<8mfZ(>uMOWd^SYSTEM^<8Z(>uMOWd
nSYSTEMP<8Z(>uMOWdnP<8Z(>uMOWdn<8Z(>uMOWdnSclRegProcessUserProfileHivesOperating on user-specific profile hives...	<8Z(>uMOWdnSclpRegExpandProfileHivePathLocating user profile hive: %systemroot%\system32\config\systemprofile\NTUSER.DAT<8Z(>uMOWdnSclpRegExpandProfileHivePathExpanded profile hive path: NT path = [\??\C:\Windows\system32\config\systemprofile\NTUSER.DAT]n͡f/Z(	08`<8Z(>uMOWdn;SclRegProcessProfileHiveProcessing profile hive: [\??\C:\Windows\system32\config\systemprofile\NTUSER.DAT]<8Z(>uMOWdn\??\C:\Windows\system32\config\systemprofile\NTUSER.DATxp<Z(	x8`8@<8/Z(>uMOWd
y\??\C:\Windows\system32\config\systemprofile\NTUSER.DAT<8/Z(>uMOWdySclpRegExpandProfileHivePathLocating user profile hive: %systemroot%\system32\config\systemprofile\AppData\Local\Microsoft\Windows\UsrClass.dat<8/Z(>uMOWdySclpRegExpandProfileHivePathExpanded profile hive path: NT path = [\??\C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\UsrClass.dat]OWd<8/Z(>uMOWdySclRegProcessUserProfileHivesOptional profile hive does not exist, skipping: [\??\C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\UsrClass.dat].<8/Z(>uMOWdySclpRegExpandProfileHivePathLocating user profile hive: C:\Windows\ServiceProfiles\LocalService\NTUSER.DAT<8/Z(>uMOWdySclpRegExpandProfileHivePathExpanded profile hive path: NT path = [\??\C:\Windows\ServiceProfiles\LocalService\NTUSER.DAT]<8/Z(>uMOWdy;SclRegProcessProfileHiveProcessing profile hive: [\??\C:\Windows\ServiceProfiles\LocalService\NTUSER.DAT]<8/Z(>uMOWdy\??\C:\Windows\ServiceProfiles\LocalService\NTUSER.DAT<8⑫Z(>uMOWd
y\??\C:\Windows\ServiceProfiles\LocalService\NTUSER.DAT<8⑫Z(>uMOWdySclpRegExpandProfileHivePathLocating user profile hive: C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\UsrClass.dat<8⑫Z(>uMOWdySclpRegExpandProfileHivePathExpanded profile hive path: NT path = [\??\C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\UsrClass.dat]<8⑫Z(>uMOWdySclRegProcessUserProfileHivesOptional profile hive does not exist, skipping: [\??\C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\UsrClass.dat].<8⑫Z(>uMOWdySclpRegExpandProfileHivePathLocating user profile hive: C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT<8⑫Z(>uMOWdySclpRegExpandProfileHivePathExpanded profile hive path: NT path = [\??\C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT]<8⑫Z(>uMOWdy;SclRegProcessProfileHiveProcessing profile hive: [\??\C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT]<8⑫Z(>uMOWdy\??\C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT<8<Z(>uMOWd
y\??\C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT<8<Z(>uMOWdySclpRegExpandProfileHivePathLocating user profile hive: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\UsrClass.datp߹Z(	8P0<8<Z(>uMOWdySclpRegExpandProfileHivePathExpanded profile hive path: NT path = [\??\C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\UsrClass.dat]stIn<8<Z(>uMOWdySclRegProcessUserProfileHivesOptional profile hive does not exist, skipping: [\??\C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\UsrClass.dat].<8<Z(>uMOWdySclpRegExpandProfileHivePathLocating user profile hive: C:\Users\Administrator\NTUSER.DAT<8<Z(>uMOWdySclpRegExpandProfileHivePathExpanded profile hive path: NT path = [\??\C:\Users\Administrator\NTUSER.DAT]<8<Z(>uMOWdy;SclRegProcessProfileHiveProcessing profile hive: [\??\C:\Users\Administrator\NTUSER.DAT]<8<Z(>uMOWdy\??\C:\Users\Administrator\NTUSER.DAT(<8Z(>uMOWd
{\??\C:\Users\Administrator\NTUSER.DATsDe<8Z(>uMOWd{SclpRegExpandProfileHivePathLocating user profile hive: C:\Users\Administrator\AppData\Local\Microsoft\Windows\UsrClass.dat8<8Z(>uMOWd{SclpRegExpandProfileHivePathExpanded profile hive path: NT path = [\??\C:\Users\Administrator\AppData\Local\Microsoft\Windows\UsrClass.dat].j<8Z(>uMOWd{;SclRegProcessProfileHiveProcessing profile hive: [\??\C:\Users\Administrator\AppData\Local\Microsoft\Windows\UsrClass.dat]<8Z(>uMOWd{\??\C:\Users\Administrator\AppData\Local\Microsoft\Windows\UsrClass.dat<8JZ(>uMOWd
|\??\C:\Users\Administrator\AppData\Local\Microsoft\Windows\UsrClass.dat<8JZ(>uMOWd|SclpRegExpandProfileHivePathLocating user profile hive: %SystemDrive%\Users\Default\NTUSER.DAT<8JZ(>uMOWd|SclpRegExpandProfileHivePathExpanded profile hive path: NT path = [\??\C:\Users\Default\NTUSER.DAT]<8JZ(>uMOWd|;SclRegProcessProfileHiveProcessing profile hive: [\??\C:\Users\Default\NTUSER.DAT]<8JZ(>uMOWd|\??\C:\Users\Default\NTUSER.DAT<8}Z(>uMOWd
|\??\C:\Users\Default\NTUSER.DATP<8}Z(>uMOWd|P<8}Z(>uMOWd|P<8}Z(>uMOWd|<8}Z(>uMOWd|xSclFsProcessVolumeThe version of volume [\??\C:\] is NTFS [3.1]<8}Z(>uMOWd|SclFsProcessVolumeThe version of the current (host) OS is [6.1]<8}Z(>uMOWd|SclFsProcessVolumeProcessing volume [\??\C:]...@(Z(	@8p8P<8߹Z(>uMOWd|SclpFsProcessVolumeByHandleFSCTL_SD_GLOBAL_CHANGE succeededP<8߹Z(>uMOWd|<8Z(>uMOWdSclpStateRecordStatFieldSTAT: Number of registry keys processed = 134019<8Z(>uMOWdRegKeyProcessCountNumber of registry keys processed<8Z(>uMOWdSclpStateRecordStatFieldSTAT: Number of registry keys renamed = 5t<8Z(>uMOWdRegKeyRenameCountNumber of registry keys renamedroot<8Z(>uMOWdSclpStateRecordStatFieldSTAT: Number of registry values processed = 250271<8Z(>uMOWdRegValueProcessCountNumber of registry values processed<8Z(>uMOWdSclpStateRecordStatFieldSTAT: Number of registry values renamed = 0<8Z(>uMOWdRegValueRenameCountNumber of registry values renamed<8Z(>uMOWdSclpStateRecordStatFieldSTAT: Number of registry values updated = 94<8Z(>uMOWdRegDataUpdateCountNumber of registry values updated^<8Z(>uMOWdSclpStateRecordStatFieldSTAT: Number of registry security descriptors updated = 7391<8Z(>uMOWdSecObjectSDUpdateCountNumber of registry security descriptors updated<8Z(>uMOWdSclpStateRecordStatFieldSTAT: Number of registry security descriptors processed = 134019<8Z(>uMOWdSecObjectSDProcessCountNumber of registry security descriptors processed<8Z(>uMOWdSclpStateRecordStatFieldSTAT: Number of $Secure security descriptors updated = 26<8Z(>uMOWdFsSecureSDUpdateCountNumber of $Secure security descriptors updated<8Z(>uMOWdSclpStateRecordStatFieldSTAT: Number of $Secure security descriptors failed = 0<8Z(>uMOWdFsSecureSDFailedUpdateCountNumber of $Secure security descriptors failed<8Z(>uMOWdSclpStateRecordStatFieldSTAT: Number of $Secure security descriptors processed = 270\[(	08`<8Z(>uMOWdFsSecureSDProcessCountNumber of $Secure security descriptors processed<8Z(>uMOWdSclpStateRecordStatFieldSTAT: Number of $MFT security descriptors updated = 0<8Z(>uMOWdFsMftSDUpdateCountNumber of $MFT security descriptors updated<8Z(>uMOWdSclpStateRecordStatFieldSTAT: Number of $MFT security descriptors failed = 0<8Z(>uMOWdFsMftSDFailedUpdateCountNumber of $MFT security descriptors failed<8Z(>uMOWdSclpStateRecordStatFieldSTAT: Number of $MFT security descriptors processed = 0<8Z(>uMOWdFsMftSDProcessCountNumber of $MFT security descriptors processed<8Z(>uMOWdSclpStateRecordStatFieldSTAT: Number of reparse points processed = 0<8Z(>uMOWdReparsePointProcessCountNumber of reparse points processed<8Z(>uMOWdSclpStateRecordStatFieldSTAT: Number of reparse points updated = 0<8Z(>uMOWdReparsePointUpdateCountNumber of reparse points updated<8Z(>uMOWdSclpStateRecordStatFieldSTAT: Time spent processing registry (in ms) = 2312<8Z(>uMOWdRegProcessingTimeInMSTime spent processing registry (in ms)	<8Z(>uMOWdSclpStateRecordStatFieldSTAT: Time spent processing volumes (in ms) = 15<8Z(>uMOWdFsProcessingTimeInMSTime spent processing volumes (in ms)<8Z(>uMOWdSclpStateRecordStatFieldSTAT: Total time spent processing (in ms) = 2578<8Z(>uMOWdTotalProcessingTimeInMSTotal time spent processing (in ms)
P.'	](
	8P08^\([qc@)RobinieiPPlugPlayC:\Windows\system32\svchost.exe -k DcomLaunchLo8^\([qc@)RobinieiPPlugPlayC:\Windows\system32\svchost.exe -k DcomLaunch\C8^\([qc@)RobinieiPPlugPlayC:\Windows\system32\svchost.exe -k DcomLaunchin8^\([qc@)RobinieiPPlugPlayC:\Windows\system32\svchost.exe -k DcomLaunch [8^\([qc@)RobinieiPPlugPlayC:\Windows\system32\svchost.exe -k DcomLaunchER8^\([qc@)RobinieiPPlugPlayC:\Windows\system32\svchost.exe -k DcomLaunchd0v\([qc@)RobinieiPPlugPlayC:\Windows\system32\svchost.exe -k DcomLaunchlp0v\([qc@)RobinieiPPlugPlayC:\Windows\system32\svchost.exe -k DcomLaunch0v\([qc@)RobinieiPPlugPlayC:\Windows\system32\svchost.exe -k DcomLaunch0v\([qc@)RobinieiPPlugPlayC:\Windows\system32\svchost.exe -k DcomLaunch0v\([qc@)RobinieiPPlugPlayC:\Windows\system32\svchost.exe -k DcomLaunchd0\([qc@)RobinieiPPlugPlayC:\Windows\system32\svchost.exe -k DcomLaunchb\([qc@)RobinhgPlugPlayuser pb\([qc@)RobinggPlugPlayn\([qc@)RobinieiPower\U\([qc@)RobinieiPPowerC:\Windows\system32\svchost.exe -k DcomLaunch0Ɲ\([qc@)RobinieiPPowerC:\Windows\system32\svchost.exe -k DcomLaunch0]([qc@)RobinieiPPowerC:\Windows\system32\svchost.exe -k DcomLaunchb]([qc@)RobinhgPlugPlayv.'	]([qc@)RobinggCOM Infrastructuressx.'	]([qc@)RobinieiDcomLaunch.'	]([qc@)RobinieiPDcomLaunchC:\Windows\system32\svchost.exe -k DcomLaunch\??\C:pp ](	 `	p8`8@P(\([qc@)RobineeP(\([qc@)Robinjkb(\([qc@)RobinggPlugPlayt(\([qc@)RobinieiPlugPlayata\O\([qc@)RobinieiPPlugPlayC:\Windows\system32\svchost.exe -k DcomLaunch\s
]([qc@)RobinieiRpcEptMapperC:\Windows\system32\svchost.exe -k RPCSSrofi8<N]([qc@)RobinieiRpcEptMapperC:\Windows\system32\svchost.exe -k RPCSS8<N]([qc@)RobinieiRpcEptMapperC:\Windows\system32\svchost.exe -k RPCSSxpann<N]([qc@)RobinieiRpcSs]8<N]([qc@)RobinieiRpcSsC:\Windows\system32\svchost.exe -k RPCSS8]([qc@)RobinieiRpcSsC:\Windows\system32\svchost.exe -k RPCSSv]([qc@)RobinhgCOM Infrastructurei(( ](	(8p8P|.'	]([qc@)RobinieiRpcEptMapperBAL_0
]([qc@)RobinieiPDcomLaunchC:\Windows\system32\svchost.exe -k DcomLaunchldSTA8
]([qc@)RobinieiPDcomLaunchC:\Windows\system32\svchost.exe -k DcomLaunchs p<N]([qc@)RobinieiRpcSsC:\Windows\system32\svchost.exe -k RPCSSRf%](>uȓOh:SyRef%](>uȓOh:SC:\Windows\system32\oobe\setup.exe<^( 
	8
8`Tl](>uI]Se<^(
	08pPV](>uI]](>uwKtOJSOFTWARE\Microsoft\Windows\CurrentVersion\Setup\SysPrep\PHASE_SPECIALIZE](>uwKtOJC:\Windows\System32\spopk.dllSysprep_Specialize_OpkT](>uwKtOJ{](>uwKtOJsqmapi.dllSqmSysprepSpecializeT
W](>uwKtOJd](>uwKtOJC:\Windows\System32\sppnp.dllSysprep_Specialize_Pnp ږ@_(	8P0Pp^(ڹ_>Ob<u$_^([qc@)Robiniei@eventlogC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted:\02^([qc@)Robiniei@eventlogC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestrictedvc8^([qc@)Robiniei@eventlogC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestrictedun@^([qc@)Robiniei`gpsvcC:\Windows\system32\svchost.exe -k netsvcscomr@^([qc@)RobinieiProfSvclug@^([qc@)Robiniei`ProfSvcC:\Windows\system32\svchost.exe -k netsvcs@^([qc@)RobinieiTrustedInstaller(K^([qc@)RobinieiTrustedInstallerC:\Windows\servicing\TrustedInstaller.exe@8^([qc@)Robiniei`gpsvcC:\Windows\system32\svchost.exe -k netsvcs\(8^([qc@)Robiniei`gpsvcC:\Windows\system32\svchost.exe -k netsvcs8^([qc@)Robiniei`gpsvcC:\Windows\system32\svchost.exe -k netsvcs8N^([qc@)Robiniei`gpsvcC:\Windows\system32\svchost.exe -k netsvcsh8N^([qc@)Robiniei`gpsvcC:\Windows\system32\svchost.exe -k netsvcslayzr^([qc@)RobinieiEventSystem^([qc@)RobinieiEventSystemC:\Windows\system32\svchost.exe -k LocalService8,J_([qc@)RobinieiEventSystemC:\Windows\system32\svchost.exe -k LocalServicel,J_([qc@)RobinieiSENSsv,J_([qc@)Robiniei`SENSC:\Windows\system32\svchost.exe -k netsvcs8,J_([qc@)Robiniei`SENSC:\Windows\system32\svchost.exe -k netsvcs8,J_([qc@)Robiniei`SENSC:\Windows\system32\svchost.exe -k netsvcsG_(	8`8@p^([qc@)RobinggFSFilter Virtualization$^([qc@)RobinhgFSFilter Virtualizationd$^([qc@)RobinggEvent Logt$^([qc@)RobinieieventlogPd^([qc@)RobinhgEvent Logunl^([qc@)RobinggProfSvc_GroupcEn^([qc@)Robinieigpsvc8^([qc@)Robiniei`ProfSvcC:\Windows\system32\svchost.exe -k netsvcs8^([qc@)Robiniei`gpsvcC:\Windows\system32\svchost.exe -k netsvcsPCS8N^([qc@)Robiniei`gpsvcC:\Windows\system32\svchost.exe -k netsvcs8r^([qc@)Robiniei`gpsvcC:\Windows\system32\svchost.exe -k netsvcs8r^([qc@)Robiniei`ProfSvcC:\Windows\system32\svchost.exe -k netsvcsr8\7_([qc@)RobinieiEventSystemC:\Windows\system32\svchost.exe -k LocalService8ږ@_([qc@)RobinieiTrustedInstallerC:\Windows\servicing\TrustedInstaller.exe84B_([qc@)RobinieiUxSmsC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted04B_([qc@)RobinieiUxSmsC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestrictedj[E_([qc@)Robinieinsi[E_([qc@)RobinieinsiC:\Windows\system32\svchost.exe -k LocalService0G_([qc@)RobinieinsiC:\Windows\system32\svchost.exe -k LocalServiceG_([qc@)Robiniei@DhcpC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted0G_([qc@)Robiniei@lmhostsC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted0G_([qc@)Robiniei@lmhostsC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted@.k_(	8p8Plږ@_([qc@)RobinhgProfSvc_GroupMaPږ@_([qc@)Robinkk`ږ@_([qc@)RobinggUIGroupnږ@_([qc@)RobinieiUxSms8ږ@_([qc@)RobinieiTrustedInstallerC:\Windows\servicing\TrustedInstaller.exe8ږ@_([qc@)RobinieiTrustedInstallerC:\Windows\servicing\TrustedInstaller.exe4B_([qc@)RobinieiUxSmsC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted`4B_([qc@)RobinhgUIGroupZ4B_([qc@)RobinggNDISZ[E_([qc@)RobinhgNDISX[E_([qc@)RobinggTDIr[E_([qc@)Robinieilmhosts[E_([qc@)Robiniei@lmhostsC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted0G_([qc@)RobinieinsiC:\Windows\system32\svchost.exe -k LocalServicelG_([qc@)RobinieiDhcptG_([qc@)RobinieiDnscacheB J_([qc@)RobinieiDnscacheC:\Windows\system32\svchost.exe -k NetworkService0L_([qc@)RobinieiDnscacheC:\Windows\system32\svchost.exe -k NetworkService0L_([qc@)RobinieiDnscacheC:\Windows\system32\svchost.exe -k NetworkServiceXN_([qc@)RobinhgTDIlN_([qc@)RobinggShellSvcGroupN_([qc@)RobinieiShellHWDetectionN_([qc@)Robiniei`ShellHWDetectionC:\Windows\system32\svchost.exe -k netsvcs0N_([qc@)Robiniei`ShellHWDetectionC:\Windows\system32\svchost.exe -k netsvcs8S_([qc@)Robiniei`ScheduleC:\Windows\system32\svchost.exe -k netsvcsn.k_([qc@)RobinhgSchedulerGroup_( p	08pm_([qc@)RobinieiHBFEC:\Windows\system32\svchost.exe -k LocalServiceNoNetworkrre0Ep_([qc@)RobinieiHBFEC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork.dlp~_([qc@)RobinieiMpsSvc~_([qc@)RobinieiHMpsSvcC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork0X_([qc@)Robiniei	HMpsSvcC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork_([qc@)RobinieiLanmanWorkstation_([qc@)RobinieiLanmanWorkstationC:\Windows\system32\svchost.exe -k NetworkServiceP8_( @	P8
8`0G_([qc@)Robiniei@DhcpC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted0B J_([qc@)Robiniei@DhcpC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted0B J_([qc@)Robiniei@DhcpC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted0B J_([qc@)RobinieiDnscacheC:\Windows\system32\svchost.exe -k NetworkService0L_([qc@)RobinieiDnscacheC:\Windows\system32\svchost.exe -k NetworkService0L_([qc@)RobinieiDnscacheC:\Windows\system32\svchost.exe -k NetworkService0L_([qc@)RobinieiDnscacheC:\Windows\system32\svchost.exe -k NetworkService0L_([qc@)RobinieiDnscacheC:\Windows\system32\svchost.exe -k NetworkService0N_([qc@)RobinieiDnscacheC:\Windows\system32\svchost.exe -k NetworkService0N_([qc@)Robiniei`ShellHWDetectionC:\Windows\system32\svchost.exe -k netsvcslN_([qc@)RobinhgShellSvcGroupnN_([qc@)RobinggSchedulerGrouptN_([qc@)RobinieiScheduleN_([qc@)Robiniei`ScheduleC:\Windows\system32\svchost.exe -k netsvcs8.k_([qc@)Robiniei`ScheduleC:\Windows\system32\svchost.exe -k netsvcs8.k_([qc@)Robiniei`ScheduleC:\Windows\system32\svchost.exe -k netsvcsp.k_([qc@)RobinggNetworkProviderj.k_([qc@)RobinieiBFE01|_([qc@)Robiniei	HBFEC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork0_([qc@)Robiniei	HMpsSvcC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork00_(	08P08_([qc@)Robiniei	LanmanWorkstationC:\Windows\system32\svchost.exe -k NetworkService8R~_(	8p8P8f_([qc@)Robiniei	LanmanWorkstationC:\Windows\system32\svchost.exe -k NetworkServicepf_([qc@)RobinhgNetworkProviderf_([qc@)RobinggMS_WindowsLocalValidationnf_([qc@)RobinieiSamSssf_([qc@)RobinieiSamSsC:\Windows\system32\lsass.exef_([qc@)RobinhgMS_WindowsLocalValidationjf_([qc@)RobinggSpoolerGroup -kr_([qc@)RobinieiSpoolerΦ_([qc@)Robiniei(SpoolerC:\Windows\System32\spoolsv.exe0Φ_([qc@)Robiniei	(SpoolerC:\Windows\System32\spoolsv.exejΦ_([qc@)RobinhgSpoolerGroupE_(tΦ_([qc@)RobinieiCryptSvcteΦ_([qc@)RobinieiCryptSvcC:\Windows\system32\svchost.exe -k NetworkServiceWpΦ_([qc@)RobinieiNlaSvcΦ_([qc@)RobinieiNlaSvcC:\Windows\system32\svchost.exe -k NetworkServicek_([qc@)RobinieiRemoteRegistry͘_([qc@)RobinieiRemoteRegistryC:\Windows\system32\svchost.exe -k regsvcws\p60_([qc@)RobinieiTrkWks60_([qc@)RobinieiTrkWksC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestrictedr60_([qc@)RobinieiWinmgmthel60_([qc@)Robiniei`WinmgmtC:\Windows\system32\svchost.exe -k netsvcsinl_([qc@)RobinieiWLMSs\_([qc@)Robiniei<WLMSC:\Windows\system32\wlms\wlms.exeD4R~_([qc@)Robiniei`WinmgmtC:\Windows\system32\svchost.exe -k netsvcspR~_([qc@)Robiniei`WinmgmtC:\Windows\system32\svchost.exe -k netsvcseHA_(	8`8@0f_([qc@)Robiniei	LanmanWorkstationC:\Windows\system32\svchost.exe -k NetworkService0f_([qc@)Robiniei	LanmanWorkstationC:\Windows\system32\svchost.exe -k NetworkService0f_([qc@)Robiniei	LanmanWorkstationC:\Windows\system32\svchost.exe -k NetworkService0f_([qc@)Robiniei	SamSsC:\Windows\system32\lsass.exe0Φ_([qc@)Robiniei	(SpoolerC:\Windows\System32\spoolsv.exe0Φ_([qc@)Robiniei	(SpoolerC:\Windows\System32\spoolsv.exe0͘_([qc@)Robiniei	CryptSvcC:\Windows\system32\svchost.exe -k NetworkService0͘_([qc@)Robiniei	NlaSvcC:\Windows\system32\svchost.exe -k NetworkServiceRobin0͘_([qc@)Robiniei	CryptSvcC:\Windows\system32\svchost.exe -k NetworkService0_([qc@)Robiniei	RemoteRegistryC:\Windows\system32\svchost.exe -k regsvc0_([qc@)Robiniei	TrkWksC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted0_([qc@)Robiniei	TrkWksC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted0_([qc@)Robiniei	RemoteRegistryC:\Windows\system32\svchost.exe -k regsvc8_([qc@)Robiniei	<WLMSC:\Windows\system32\wlms\wlms.exeo0_([qc@)Robiniei	<WLMSC:\Windows\system32\wlms\wlms.exe8DW_([qc@)Robiniei	NlaSvcC:\Windows\system32\svchost.exe -k NetworkServiceC:\p_([qc@)Robiniei`iphlpsvcC:\Windows\system32\svchost.exe -k netsvcsp_([qc@)Robiniei`LanmanServerC:\Windows\system32\svchost.exe -k netsvcspA_([qc@)Robiniei`LanmanServerC:\Windows\system32\svchost.exe -k netsvcspp`( p	p08ptR~_([qc@)RobinieiiphlpsvcdoR~_([qc@)Robiniei`iphlpsvcC:\Windows\system32\svchost.exe -k netsvcs|R~_([qc@)RobinieiLanmanServerdlR~_([qc@)Robiniei`LanmanServerC:\Windows\system32\svchost.exe -k netsvcsp_([qc@)Robiniei`iphlpsvcC:\Windows\system32\svchost.exe -k netsvcsp_([qc@)Robiniei`LanmanServerC:\Windows\system32\svchost.exe -k netsvcsPA_([qc@)RobinfeTA_(ڹ_>Ob<u$p0A_([qc@)Robiniei	sppsvct4_([qc@)Robinieinetprofmxp_([qc@)RobinieiWPDBusEnump_([qc@)RobinieiWPDBusEnumC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestrictedXX`(	X8
8`A_([qc@)RobinieiShellHWDetectionst0_([qc@)Robiniei	$sppsvcC:\Windows\system32\sppsvc.exe0_([qc@)Robiniei	$sppsvcC:\Windows\system32\sppsvc.exe4_([qc@)RobinieinetprofmC:\Windows\system32\svchost.exe -k LocalServicestrz8_([qc@)Robiniei	AeLookupSvcche8_([qc@)Robiniei	`AeLookupSvcC:\Windows\system32\svchost.exe -k netsvcscp_([qc@)RobinieinetprofmC:\Windows\system32\svchost.exe -k LocalServicenscpZ-_([qc@)RobinieiWPDBusEnumC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted\pZ-_([qc@)Robiniei$sppsvcC:\Windows\system32\sppsvc.exe8Z-_([qc@)Robiniei	`AeLookupSvcC:\Windows\system32\svchost.exe -k netsvcs8Z-_([qc@)Robiniei	`AeLookupSvcC:\Windows\system32\svchost.exe -k netsvcs8Z-_([qc@)Robiniei	`AeLookupSvcC:\Windows\system32\svchost.exe -k netsvcs8Z-_([qc@)Robiniei	`AeLookupSvcC:\Windows\system32\svchost.exe -k netsvcs8Z-_([qc@)Robiniei	`AeLookupSvcC:\Windows\system32\svchost.exe -k netsvcst8Z-_([qc@)Robiniei	`AeLookupSvcC:\Windows\system32\svchost.exe -k netsvcs28Z-_([qc@)Robiniei	`AeLookupSvcC:\Windows\system32\svchost.exe -k netsvcscp_([qc@)RobinieiWPDBusEnumC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted8_([qc@)Robiniei	netprofmC:\Windows\system32\svchost.exe -k LocalServiceceN(	8p8P|([qc@)RobinieiWinHttpAutoProxySvcWin|([qc@)RobinieiWinHttpAutoProxySvcC:\Windows\system32\svchost.exe -k LocalService|([qc@)RobinieiWinHttpAutoProxySvcC:\Windows\system32\svchost.exe -k LocalService|([qc@)RobinieiWinHttpAutoProxySvcC:\Windows\system32\svchost.exe -k LocalService( P	08p>y(>uwKtOJEC:\Windows\System32\setup\tssysprep.dllRCMSysPrepRestoreT>y(>uwKtOJE32>y(>uwKtOJEC:\Windows\System32\setup\tssysprep.dllLSMSysPrepRestoreT>y(>uwKtOJE`I|(>uwKtOJEC:\Windows\System32\oobe\winsetup.dllSpSetupOnlineSettingsSpecializeT~(>uwKtOJEst~(>uwKtOJEC:\Windows\System32\setup\tssysprep.dllRdpSysPrepRestoreystT~(>uwKtOJE@L(>uwKtOJEC:\Windows\System32\shsetup.dllSysprep_Specialize_Shell)RobinTL(>uwKtOJEuL(>uwKtOJEwer.dllWerSysprepSpecializeTL(>uwKtOJEDBp(>uwKtOJEC:\Windows\system32\catsrvut.dllSysprepComplustemTp(>uwKtOJEctp(>uwKtOJEC:\Windows\system32\capisp.dllCryptoSysPrep_Specialize(	8`0T"k(>uwKtOJE"k(>uwKtOJEC:\Windows\System32\scecli.dllSceSysPrepT>y(>uwKtOJEnm  N(	 8
8`T:(>uwKtOJJ(>uwKtOJJC:\Windows\System32\spbcd.dllSysprep_Specialize_BcdWiT(>uwKtOJJ@j(>uwKtOJJC:\Windows\system32\msdtcprx.dllSysPrepDtcSpecializeTrB(>uwKtOJQfm}̤(>uwKtOJQRacEngn.dllRacSysprepSpecializeT (>uwKtOJRup (>uwKtOJRC:\Windows\System32\aecache.dllSysprep_Clean_AECacheeT (>uwKtOJR@ (>uwKtOJRC:\Windows\System32\iesysprep.dllSysprep_Specialize_IEiceT4.#(>uwKtOJST4.#(>uwKtOJSho4.#(>uwKtOJSSOFTWARE\Microsoft\Windows\CurrentVersion\Setup\SysPrepExternal\PHASE_SPECIALIZEexT4.#(>uwKtOJST4.#(>uI]SchP4.#(>uIى"*SP4.#(>uIى"*SHH( `	H08p,O([qc@)Robiniei+clr_optimization_v2.0.50727_32C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe|䱨([qc@)Robinieiclr_optimization_v2.0.50727_64,䱨([qc@)Robiniei+clr_optimization_v2.0.50727_32C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exeting|L;([qc@)Robinieixclr_optimization_v2.0.50727_64C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe([qc@)Robinieixclr_optimization_v2.0.50727_64C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe(	8p8P,([qc@)Robiniei+clr_optimization_v2.0.50727_32,䱨([qc@)Robiniei+clr_optimization_v2.0.50727_32C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe|([qc@)Robinieixclr_optimization_v2.0.50727_64C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exeh([qc@)RobinieiPPlugPlayC:\Windows\system32\svchost.exe -k DcomLaunch(	8`0TT(>uIى"*&oTT(>uIى"*&o\W6z(  
	8
8`&(>uI] ,pWindows (TM) Code Name "Longhorn" Preinstallation EnvironmentService Pack 1&(>uI] ,pWindows Server 2008 R2 StandardServerStandardService Pack 1T&(>uI],p6z(!	08pT&)(>uȓOh:STv7[(>uȓOh:S
ow`("	8p8P,$([qc@)Robiniei,`gpsvcC:\Windows\system32\svchost.exe -k netsvcsRobin|$([qc@)Robiniei`gpsvcC:\Windows\system32\svchost.exe -k netsvcs0.5,$([qc@)Robiniei,`gpsvcC:\Windows\system32\svchost.exe -k netsvcs4C,$([qc@)Robiniei,`gpsvcC:\Windows\system32\svchost.exe -k netsvcs,$([qc@)Robiniei,`gpsvcC:\Windows\system32\svchost.exe -k netsvcs,$([qc@)Robiniei,`gpsvcC:\Windows\system32\svchost.exe -k netsvcs,$([qc@)Robiniei,`gpsvcC:\Windows\system32\svchost.exe -k netsvcs,$([qc@)Robiniei,`gpsvcC:\Windows\system32\svchost.exe -k netsvcs,$([qc@)Robiniei,`gpsvcC:\Windows\system32\svchost.exe -k netsvcs,$([qc@)Robiniei,`gpsvcC:\Windows\system32\svchost.exe -k netsvcs,$([qc@)Robiniei,`gpsvcC:\Windows\system32\svchost.exe -k netsvcs,$([qc@)Robiniei,`gpsvcC:\Windows\system32\svchost.exe -k netsvcsn(~抔([qc@)Robinieigpsvc,4([qc@)Robiniei,clr_optimization_v2.0.50727_32C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe8([qc@)RobinieiCryptSvcC:\Windows\system32\svchost.exe -k NetworkService,([qc@)Robiniei,CryptSvcC:\Windows\system32\svchost.exe -k NetworkService8([qc@)Robiniei@DhcpC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted8([qc@)Robiniei@eventlogC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted8([qc@)RobinieiPPlugPlayC:\Windows\system32\svchost.exe -k DcomLaunch@[(#	@8`04([qc@)Robinieixclr_optimization_v2.0.50727_64C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe([qc@)Robiniei@DhcpC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted([qc@)Robiniei@eventlogC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted([qc@)RobinieiPPlugPlayC:\Windows\system32\svchost.exe -k DcomLaunch([qc@)RobinieiPPlugPlayC:\Windows\system32\svchost.exe -k DcomLaunch([qc@)RobinieiPPlugPlayC:\Windows\system32\svchost.exe -k DcomLaunch([qc@)RobinieiPPlugPlayC:\Windows\system32\svchost.exe -k DcomLaunch([qc@)RobinieiPPlugPlayC:\Windows\system32\svchost.exe -k DcomLaunch([qc@)RobinieiPPowerC:\Windows\system32\svchost.exe -k DcomLaunchn,([qc@)RobinieiPower([qc@)Robiniei`ProfSvcC:\Windows\system32\svchost.exe -k netsvcsN([qc@)RobinieiTrkWksC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestrictedN([qc@)Robinieiclr_optimization_v2.0.50727_64N([qc@)RobinieiTrustedInstallerC:\Windows\servicing\TrustedInstaller.exeN([qc@)RobinieiTrustedInstallerC:\Windows\servicing\TrustedInstaller.exeN([qc@)RobinieiUxSmsC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted8N([qc@)Robiniei`WinmgmtC:\Windows\system32\svchost.exe -k netsvcsN([qc@)Robiniei@DhcpC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestrictedh4($	8
8`8([qc@)RobinieiPPowerC:\Windows\system32\svchost.exe -k DcomLaunch8([qc@)Robiniei`ProfSvcC:\Windows\system32\svchost.exe -k netsvcsd,([qc@)Robiniei,@eventlogC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted8([qc@)Robiniei$sppsvcC:\Windows\system32\sppsvc.exe,([qc@)Robiniei,$sppsvcC:\Windows\system32\sppsvc.exe8([qc@)RobinieiTrkWksC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestrictedr([qc@)RobinieiProfSvc8N([qc@)RobinieiTrustedInstallerC:\Windows\servicing\TrustedInstaller.exe8N([qc@)RobinieiUxSmsC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestrictedn[([qc@)RobinieiUxSms,([qc@)Robiniei,<WLMSC:\Windows\system32\wlms\wlms.exel([qc@)RobinieiWLMSlT([qc@)RobinieiDhcptLjG([qc@)RobinieiCryptSvcpd([qc@)RobinieiTrkWkspd([qc@)Robinieisppsvc4([qc@)RobinieiPPlugPlayC:\Windows\system32\svchost.exe -k DcomLaunch4([qc@)RobinieiPPlugPlayC:\Windows\system32\svchost.exe -k DcomLaunch4([qc@)RobinieiPPlugPlayC:\Windows\system32\svchost.exe -k DcomLaunch4([qc@)RobinieiPPlugPlayC:\Windows\system32\svchost.exe -k DcomLaunch4([qc@)RobinieiPPlugPlayC:\Windows\system32\svchost.exe -k DcomLaunch4([qc@)RobinieiPPlugPlayC:\Windows\system32\svchost.exe -k DcomLaunch*(& 
	08
4([qc@)RobinieiPPlugPlayC:\Windows\system32\svchost.exe -k DcomLauncht44([qc@)RobinieiPlugPlay*(%	8p,8p,[([qc@)Robiniei,`WinmgmtC:\Windows\system32\svchost.exe -k netsvcs[([qc@)RobinieiTrustedInstallerC:\Windows\servicing\TrustedInstaller.exe8[([qc@)Robiniei<WLMSC:\Windows\system32\wlms\wlms.exer([qc@)RobinieiWinmgmt婔([qc@)RobinieiTrustedInstaller([qc@)Robinieiclr_optimization_v2.0.50727_32t([qc@)Robinieieventlog((Jz
( 	(8PAѠ([qc@)RobineePAѠ([qc@)RobinjkbAѠ([qc@)RobinggPlugPlaytAѠ([qc@)RobinieiPlugPlay4Ӡ([qc@)RobinieiXPlugPlayC:\Windows\system32\svchost.exe -k DcomLaunchLP([qc@)RobinieiXPlugPlayC:\Windows\system32\svchost.exe -k DcomLaunch4P([qc@)RobinieiXPlugPlayC:\Windows\system32\svchost.exe -k DcomLaunch4T([qc@)RobinieiXPlugPlayC:\Windows\system32\svchost.exe -k DcomLaunchLl@([qc@)RobinieiXPlugPlayC:\Windows\system32\svchost.exe -k DcomLaunchbl@([qc@)RobinhgPlugPlaybl@([qc@)RobinggPlugPlaynl@([qc@)RobinieiPowerl@([qc@)RobinieiXPowerC:\Windows\system32\svchost.exe -k DcomLaunchL ([qc@)RobinieiXPowerC:\Windows\system32\svchost.exe -k DcomLaunchL.,([qc@)RobinieiXPowerC:\Windows\system32\svchost.exe -k DcomLaunchb.,([qc@)RobinhgPlugPlayL([qc@)RobinieiRpcEptMapperC:\Windows\system32\svchost.exe -k RPCSSL<S([qc@)RobinieiRpcEptMapperC:\Windows\system32\svchost.exe -k RPCSSn<S([qc@)RobinieiRpcSs<S([qc@)RobinieiRpcSsC:\Windows\system32\svchost.exe -k RPCSSL<S([qc@)RobinieiRpcSsC:\Windows\system32\svchost.exe -k RPCSSL([qc@)RobinieiRpcSsC:\Windows\system32\svchost.exe -k RPCSSJz
(	88LP([qc@)RobinieiXPlugPlayC:\Windows\system32\svchost.exe -k DcomLaunchLP([qc@)RobinieiXPlugPlayC:\Windows\system32\svchost.exe -k DcomLaunchLP([qc@)RobinieiXPlugPlayC:\Windows\system32\svchost.exe -k DcomLaunchLP([qc@)RobinieiXPlugPlayC:\Windows\system32\svchost.exe -k DcomLaunch4T([qc@)RobinieiXPlugPlayC:\Windows\system32\svchost.exe -k DcomLaunch4([qc@)RobinieiXPlugPlayC:\Windows\system32\svchost.exe -k DcomLaunch4{([qc@)RobinieiXPlugPlayC:\Windows\system32\svchost.exe -k DcomLaunchLl@([qc@)RobinieiXPlugPlayC:\Windows\system32\svchost.exe -k DcomLaunchv([qc@)RobinggCOM Infrastructurex([qc@)RobinieiDcomLaunch([qc@)RobinieiXDcomLaunchC:\Windows\system32\svchost.exe -k DcomLaunch|([qc@)RobinieiRpcEptMapper4([qc@)RobinieiXDcomLaunchC:\Windows\system32\svchost.exe -k DcomLaunch([qc@)RobinieiRpcEptMapperC:\Windows\system32\svchost.exe -k RPCSSL([qc@)RobinieiXDcomLaunchC:\Windows\system32\svchost.exe -k DcomLaunchv([qc@)RobinhgCOM Infrastructure(	88R(>uȓOh:SJ;( 	8P,"ա(>uȓOh:STס(>uȓOh:STס(>uȓOh:SC:\Windows\system32\oobe\oobeldr.exe /system`١(>upN5;k"/systemf١(>upN5;k"oobeSystemTr(>upN5;k"Pr(>upN5;k"p4&([qc@)RobinieisppsvcXXJ;(	X843([qc@)RobinieisppsvcC:\Windows\system32\sppsvc.exeL3([qc@)RobinieisppsvcC:\Windows\system32\sppsvc.exe4	([qc@)RobinieisppsvcC:\Windows\system32\sppsvc.exestJl( 	88LI([qc@)Robiniei@nsiC:\Windows\system32\svchost.exe -k LocalService4I([qc@)Robiniei@nsiC:\Windows\system32\svchost.exe -k LocalService4I([qc@)Robiniei@nsiC:\Windows\system32\svchost.exe -k LocalServicepLI([qc@)RobinieiNlaSvcL^sK([qc@)RobinieiXNlaSvcC:\Windows\System32\svchost.exe -k NetworkService48P([qc@)RobinieiXNlaSvcC:\Windows\System32\svchost.exe -k NetworkService0 _W([qc@)RobinieiXNlaSvcC:\Windows\System32\svchost.exe -k NetworkServicetL _W([qc@)RobinieinetprofmL _W([qc@)Robiniei@netprofmC:\Windows\system32\svchost.exe -k LocalServiceLzY([qc@)Robiniei@netprofmC:\Windows\system32\svchost.exe -k LocalServiceJl(	88jLPLD([qc@)RobinieinsilayL`([qc@)Robiniei@netprofmC:\Windows\system32\svchost.exe -k LocalServiceC:\j( 	8([qc@)RobinggFSFilter VirtualizationT([qc@)RobinieieventlogC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestrictedpNL([qc@)RobinieieventlogC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricteddb([qc@)RobinhgEvent Loglb([qc@)RobinggProfSvc_Groupnb([qc@)RobinieigpsvcC([qc@)RobinieigpsvcC:\Windows\system32\svchost.exe -k netsvcsrC([qc@)RobinieiProfSvcC([qc@)RobinieiProfSvcC:\Windows\system32\svchost.exe -k netsvcsC([qc@)RobinieiTrustedInstaller([qc@)RobinieiTrustedInstallerC:\Windows\servicing\TrustedInstaller.exe0([qc@)RobinieiProfSvcC:\Windows\system32\svchost.exe -k netsvcsL([qc@)RobinieigpsvcC:\Windows\system32\svchost.exe -k netsvcsL([qc@)RobinieigpsvcC:\Windows\system32\svchost.exe -k netsvcsLp([qc@)RobinieigpsvcC:\Windows\system32\svchost.exe -k netsvcsLp([qc@)RobinieigpsvcC:\Windows\system32\svchost.exe -k netsvcsLp([qc@)RobinieigpsvcC:\Windows\system32\svchost.exe -k netsvcsLp([qc@)RobinieigpsvcC:\Windows\system32\svchost.exe -k netsvcshhj(		h8W([qc@)RobinhgFSFilter VirtualizationdW([qc@)RobinggEvent LogtW([qc@)RobinieieventlogLb([qc@)RobinieieventlogC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestrictedLp([qc@)RobinieigpsvcC:\Windows\system32\svchost.exe -k netsvcspHX(	p88zj([qc@)RobinieiEventSystemj([qc@)Robiniei@EventSystemC:\Windows\system32\svchost.exe -k LocalServicel$([qc@)RobinieiSENS$([qc@)RobinieiSENSC:\Windows\system32\svchost.exe -k netsvcslSO([qc@)RobinhgProfSvc_GroupPSO([qc@)Robinkk`SO([qc@)RobinggUIGroupnSO([qc@)RobinieiUxSms
Q([qc@)Robiniei8UxSmsC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted0
Q([qc@)RobinieiTrustedInstallerC:\Windows\servicing\TrustedInstaller.exe0
Q([qc@)Robiniei8UxSmsC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted`
Q([qc@)RobinhgUIGroupZ
Q([qc@)RobinggNDISZdT([qc@)RobinhgNDISXdT([qc@)RobinggTDIldT([qc@)RobinieiDhcpdT([qc@)RobinieiDhcpC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestrictedtdT([qc@)RobinieiDnscachedT([qc@)RobinieiXDnscacheC:\Windows\System32\svchost.exe -k NetworkServicerdT([qc@)RobinieilmhostsdT([qc@)RobinieilmhostsC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestrictedLzV([qc@)RobinieiDhcpC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted0zV([qc@)RobinieiXDnscacheC:\Windows\System32\svchost.exe -k NetworkService0zV([qc@)RobinieilmhostsC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestrictedHtv( 	8
8LX([qc@)RobinieiXDnscacheC:\Windows\System32\svchost.exe -k NetworkServiceLX([qc@)RobinieiXDnscacheC:\Windows\System32\svchost.exe -k NetworkServiceLX([qc@)RobinieiXDnscacheC:\Windows\System32\svchost.exe -k NetworkServiceLX([qc@)RobinieiXDnscacheC:\Windows\System32\svchost.exe -k NetworkServiceLX([qc@)RobinieiXDnscacheC:\Windows\System32\svchost.exe -k NetworkServicesLX([qc@)RobinieiDhcpC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestrictedeiXX([qc@)RobinhgTDIlX([qc@)RobinggShellSvcGroupeiX([qc@)RobinieiShellHWDetectioneiX([qc@)RobinieiShellHWDetectionC:\Windows\system32\svchost.exe -k netsvcslr?[([qc@)RobinhgShellSvcGroupchnr?[([qc@)RobinggSchedulerGrouptr?[([qc@)RobinieiSchedulecsr?[([qc@)RobinieiScheduleC:\Windows\system32\svchost.exe -k netsvcsL̡]([qc@)RobinieiScheduleC:\Windows\system32\svchost.exe -k netsvcsn.([qc@)RobinhgSchedulerGroupvp.([qc@)RobinggNetworkProviderj.([qc@)RobinieiBFEows([qc@)RobinieiTBFEC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork\sv0𞛤([qc@)RobinieiTBFEC:\Windows\system32\svchost.exe -k LocalServiceNoNetworkp([qc@)RobinieiMpsSvc([qc@)RobinieiTMpsSvcC:\Windows\system32\svchost.exe -k LocalServiceNoNetworktv([qc@)RobinieiTMpsSvcC:\Windows\system32\svchost.exe -k LocalServiceNoNetworkhhtv(
	h88Lj([qc@)RobinieigpsvcC:\Windows\system32\svchost.exe -k netsvcsceLj([qc@)RobinieiProfSvcC:\Windows\system32\svchost.exe -k netsvcs0$([qc@)Robiniei@EventSystemC:\Windows\system32\svchost.exe -k LocalService0$([qc@)Robiniei@EventSystemC:\Windows\system32\svchost.exe -k LocalService0~/
([qc@)RobinieiSENSC:\Windows\system32\svchost.exe -k netsvcs0~/
([qc@)RobinieiSENSC:\Windows\system32\svchost.exe -k netsvcs0SO([qc@)RobinieiTrustedInstallerC:\Windows\servicing\TrustedInstaller.exe0
Q([qc@)Robiniei8UxSmsC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestrictedca0zV([qc@)RobinieiXDnscacheC:\Windows\System32\svchost.exe -k NetworkServicea0zV([qc@)RobinieilmhostsC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted0X([qc@)RobinieiDhcpC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestrictedLX([qc@)RobinieiXDnscacheC:\Windows\System32\svchost.exe -k NetworkServiceLr?[([qc@)RobinieiShellHWDetectionC:\Windows\system32\svchost.exe -k netsvcsLr?[([qc@)RobinieiShellHWDetectionC:\Windows\system32\svchost.exe -k netsvcsL.([qc@)RobinieiScheduleC:\Windows\system32\svchost.exe -k netsvcs4.([qc@)RobinieiScheduleC:\Windows\system32\svchost.exe -k netsvcs([qc@)RobinieiTBFEC:\Windows\system32\svchost.exe -k LocalServiceNoNetworkfO([qc@)RobinieiTMpsSvcC:\Windows\system32\svchost.exe -k LocalServiceNoNetworkxФ(	8tv([qc@)RobinieiLanmanWorkstationtv([qc@)RobinieiXLanmanWorkstationC:\Windows\System32\svchost.exe -k NetworkServicepص([qc@)RobinhgNetworkProviderص([qc@)RobinggMS_WindowsLocalValidationnص([qc@)RobinieiSamSsص([qc@)RobinieiSamSsC:\Windows\system32\lsass.exeص([qc@)RobinhgMS_WindowsLocalValidationjص([qc@)RobinggSpoolerGroupr([qc@)RobinieiSpooler([qc@)RobinieiPSpoolerC:\Windows\System32\spoolsv.exe0([qc@)RobinieiPSpoolerC:\Windows\System32\spoolsv.exej([qc@)RobinhgSpoolerGroupt([qc@)RobinieiCryptSvc6b([qc@)RobinieiXCryptSvcC:\Windows\System32\svchost.exe -k NetworkService06b([qc@)RobinieiXCryptSvcC:\Windows\System32\svchost.exe -k NetworkService([qc@)RobinieiRemoteRegistry([qc@)Robiniei|RemoteRegistryC:\Windows\system32\svchost.exe -k regsvcp&Ĥ([qc@)RobinieiTrkWks&Ĥ([qc@)Robiniei8TrkWksC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestrictedrDƤ([qc@)RobinieiWinmgmtDƤ([qc@)RobinieiWinmgmtC:\Windows\system32\svchost.exe -k netsvcslDƤ([qc@)RobinieiWLMSȤ([qc@)RobinieiWLMSC:\Windows\system32\wlms\wlms.exeLȤ([qc@)Robiniei|RemoteRegistryC:\Windows\system32\svchost.exe -k regsvcLRͤ([qc@)Robiniei|RemoteRegistryC:\Windows\system32\svchost.exe -k regsvch(	88tv([qc@)RobinieiXLanmanWorkstationC:\Windows\System32\svchost.exe -k NetworkServicetv([qc@)RobinieiXLanmanWorkstationC:\Windows\System32\svchost.exe -k NetworkServicetv([qc@)RobinieiXLanmanWorkstationC:\Windows\System32\svchost.exe -k NetworkServicetv([qc@)RobinieiXLanmanWorkstationC:\Windows\System32\svchost.exe -k NetworkServiceص([qc@)RobinieiXLanmanWorkstationC:\Windows\System32\svchost.exe -k NetworkServiceص([qc@)RobinieiSamSsC:\Windows\system32\lsass.exe0([qc@)RobinieiPSpoolerC:\Windows\System32\spoolsv.exe0([qc@)RobinieiPSpoolerC:\Windows\System32\spoolsv.exe06b([qc@)RobinieiXCryptSvcC:\Windows\System32\svchost.exe -k NetworkServiceDƤ([qc@)Robiniei8TrkWksC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestrictedȤ([qc@)Robiniei8TrkWksC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted2Mˤ([qc@)RobinieiWLMSC:\Windows\system32\wlms\wlms.exeRͤ([qc@)RobinieiWLMSC:\Windows\system32\wlms\wlms.exe\٤([qc@)RobinieiWinmgmtC:\Windows\system32\svchost.exe -k netsvcs0([qc@)RobinieiAeLookupSvcC:\Windows\system32\svchost.exe -k netsvcsNx0([qc@)RobinieiWPDBusEnum0([qc@)Robiniei8WPDBusEnumC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted([qc@)RobinieiAeLookupSvcC:\Windows\system32\svchost.exe -k netsvcs([qc@)RobinieiAeLookupSvcC:\Windows\system32\svchost.exe -k netsvcsJ.ϥ( 	8|Ф([qc@)RobinieiLanmanServernФ([qc@)RobinieiLanmanServerC:\Windows\system32\svchost.exe -k netsvcsL٤([qc@)RobinieiWinmgmtC:\Windows\system32\svchost.exe -k netsvcs t٤([qc@)Robinieiiphlpsvc٤([qc@)RobinieiiphlpsvcC:\Windows\system32\svchost.exe -k netsvcsL٤([qc@)RobinieiLanmanServerC:\Windows\system32\svchost.exe -k netsvcsLnۤ([qc@)RobinieiiphlpsvcC:\Windows\system32\svchost.exe -k netsvcsLnۤ([qc@)RobinieiiphlpsvcC:\Windows\system32\svchost.exe -k netsvcsLnۤ([qc@)RobinieiLanmanServerC:\Windows\system32\svchost.exe -k netsvcs([qc@)RobinieiLanmanServerC:\Windows\system32\svchost.exe -k netsvcsP([qc@)RobinfezL([qc@)RobinieiAeLookupSvcL([qc@)RobinieiAeLookupSvcC:\Windows\system32\svchost.exe -k netsvcs0([qc@)RobinieiAeLookupSvcC:\Windows\system32\svchost.exe -k netsvcs4K	([qc@)Robiniei8WPDBusEnumC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestrictedJ.ϥ(	8
8([qc@)RobinieiAeLookupSvcC:\Windows\system32\svchost.exe -k netsvcsi([qc@)RobinieiAeLookupSvcC:\Windows\system32\svchost.exe -k netsvcsS$([qc@)RobinieiAeLookupSvcC:\Windows\system32\svchost.exe -k netsvcsw0v([qc@)RobinieiTrustedInstallerC:\Windows\servicing\TrustedInstaller.exewv([qc@)Robiniei8WPDBusEnumC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestrictedg(	884pbe([qc@)RobinieiWinHttpAutoProxySvcem34pbe([qc@)Robiniei@WinHttpAutoProxySvcC:\Windows\system32\svchost.exe -k LocalService00J[( 	084g([qc@)Robiniei@WinHttpAutoProxySvcC:\Windows\system32\svchost.exe -k LocalService00J[(	0884g([qc@)Robiniei@WinHttpAutoProxySvcC:\Windows\system32\svchost.exe -k LocalServicePPtF( 	P8
8TD(>upN5;k"TD(>upN5;k"t.TtF(>uȓOh:StF(	88TtF(>uȓOh:S  )㭿 8 ̔ ][qc@)RobinieiVMTools"C:\Program Files\VMware\VMware Tools\vmtoolsd.exe"PP}P808ﭿ
+/E=C:\Windows\panther\actionqueue\generalize.uaqTﭿ
+/E=ʰv8@8 >*/>uwKtOJ
SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\SysPrepExternal\PHASE_CLEANUPT>*/>uwKtOJ
J(̔80>uwKtOJ
SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\SysPrepExternal\PHASE_GENERALIZET>uwKtOJ
JU6  8 ̔;>uwKtOJ
SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\SysPrep\PHASE_CLEANUPt>uwKtOJ
C:\Windows\System32\spopk.dllSysprep_Clean_OpkTt>uwKtOJ
xt>uwKtOJ
sqmapi.dllSqmSysprepCleanupT(b>uwKtOJ
(b>uwKtOJ
C:\Windows\System32\wevtapi.dllEvtIntSysprepCleanupp >8V[qc@)RobinieiNetman >8V[qc@)RobinieiNetmanC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestrictedL_]>uwKtOJ
C:\Windows\System32\LangCleanupSysprepAction.dllSysprep_Generalize_MUILangCleanup_[qc@)RobinieiNetmanC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestrictedT~>uwKtOJ
88JU68808TZ>uwKtOJ
\WZd[qc@)RobinieiNetmanC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted>uwKtOJ
C:\Windows\System32\shsetup.dllSysprep_Cleanup_ShellJg8@8 T9ݹ>uwKtOJFTrN湿>uwKtOJwer.dllWerSysprepCleanupal\Ts>uwKtOJ >uwKtOJ C:\Windows\System32\spnet.dllSysprep_Clean_NetT>uwKtOJ _>uwKtOJ C:\Windows\system32\capisp.dllCryptoSysPrep_CleanT_>uwKtOJ _>uwKtOJ C:\Windows\system32\msdtcprx.dllSysPrepDtcCleanup_[qc@)RobinieiMSDTCC:\Windows\System32\msdtc.exe_[qc@)RobinieiMSDTCC:\Windows\System32\msdtc.exen	:$[qc@)RobinieiMSDTCJ̔80T>uwKtOJ FTb>uwKtOJ C:\Windows\System32\iesysprep.dllSysprep_Cleanup_IET%>uwKtOJ %>uwKtOJ C:\Windows\System32\tapisysprepTapiSysPrepCleanT%>uwKtOJ T%>uwKtOJ Jɼ	8 ̔>uwKtOJ SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\SysPrep\PHASE_GENERALIZE>uwKtOJ C:\Windows\System32\spopk.dllSysprep_Generalize_OpkT>uwKtOJ >uwKtOJ C:\Windows\System32\reagent.dllWinRE_Generalize  rb
 808Tw>uwKtOJ \W>uwKtOJ C:\Windows\System32\wuaueng.dllGeneralizeForImagingeTA>uwKtOJ {L>uwKtOJ sqmapi.dllSqmSysprepGeneralizelTL>uwKtOJ bX>uwKtOJ C:\Windows\System32\sppnp.dllSysprep_Generalize_PnpJ"ſ8@8 pTĿ[qc@)RobinieiWerSvcTĿ[qc@)Robiniei(
WerSvcC:\Windows\System32\svchost.exe -k WerSvcGroupJDSƿ̔80	wſ[qc@)Robiniei(
WerSvcC:\Windows\System32\svchost.exe -k WerSvcGroup2\ο
8 ̔	NͿ[qc@)Robiniei(
WerSvcC:\Windows\System32\svchost.exe -k WerSvcGroup_GxxP׿x808l S^׿[qc@)RobinieiBITS S^׿[qc@)RobinieiBITSC:\Windows\system32\svchost.exe -k netsvcsJfٿ8@8 ,ű׿[qc@)RobinieiWPDBusEnumC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestrictedyx|
8ؿ[qc@)RobinieiWPDBusEnumJܿ̔80,~eܿ[qc@)RobinieiBITSC:\Windows\system32\svchost.exe -k netsvcs @qܿ[qc@)Robinieiclr_optimization_v2.0.50727_32 ܿ[qc@)Robiniei
clr_optimization_v2.0.50727_32C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
ܿ[qc@)Robiniei
clr_optimization_v2.0.50727_32C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe``J*޿`8 ̔
ݿ[qc@)Robiniei
clr_optimization_v2.0.50727_32C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exeʋ߿ 0808 i߿[qc@)Robinieiclr_optimization_v2.0.50727_64 0ޥ߿[qc@)Robiniei
clr_optimization_v2.0.50727_64C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe``ʋ߿`8@8 ,0ޥ߿[qc@)Robiniei
clr_optimization_v2.0.50727_64C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe``ʙ翿`̔80
濿[qc@)Robiniei
clr_optimization_v2.0.50727_64C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exeL迿8 ̔j |T翿[qc@)RobinieiDPSpti ֶ翿[qc@)RobinieiDPSC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork((J꿿(808,2}鿿[qc@)RobinieiDPSC:\Windows\system32\svchost.exe -k LocalServiceNoNetworkJG뿿 0̔80~,J꿿[qc@)RobinieiWdiSystemHostn,J꿿[qc@)RobinieiWdiSystemHostC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted f$꿿[qc@)RobinieiDFontCacheC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonationJG뿿8@8 ,J꿿[qc@)RobinieiDPSC:\Windows\system32\svchost.exe -k LocalServiceNoNetworkwor,J꿿[qc@)RobinieiDPSC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork,N꿿[qc@)RobinieiWdiSystemHostC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestrictedv f$꿿[qc@)RobinieiFontCacheJx쿿8 ̔뿿[qc@)RobinieiDFontCacheC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonationze쿿[qc@)RobinieiDFontCacheC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonationn t쿿[qc@)RobinieiMSDTC t쿿[qc@)RobinieiMSDTCC:\Windows\System32\msdtc.exet쿿[qc@)RobinieiMSDTCC:\Windows\System32\msdtc.exeʈ8  ̔80n [qc@)RobinieiWinRMe [qc@)RobinieiWinRMC:\Windows\system32\svchost.exe -k NetworkServiceʈ8808hw[qc@)RobinieiMSDTCC:\Windows\System32\msdtc.exeʵi8@8 [qc@)RobinieiWinRMC:\Windows\system32\svchost.exe -k NetworkServiceXXX8 ̔,|[qc@)RobinieiWinRMC:\Windows\system32\svchost.exe -k NetworkServicet V[qc@)Robinieiwuauserv V[qc@)RobinieiwuauservC:\Windows\system32\svchost.exe -k netsvcs̔80,6{[qc@)RobinieiwuauservC:\Windows\system32\svchost.exe -k netsvcstJ~[qc@)RobinieiwuauserveJ
808n`L[qc@)Robinieivmvss:``Gh `8@8 ,*[qc@)RobinieiVSSC:\Windows\system32\vssvc.exeexjL
N[qc@)RobinieiVSS!8 ̔r,pl[qc@)RobinieiW32TimeWin,pl[qc@)RobinieiXW32TimeC:\Windows\system32\svchost.exe -k LocalService,"̔80 [qc@)RobinieiXW32TimeC:\Windows\system32\svchost.exe -k LocalService [qc@)RobinieiXW32TimeC:\Windows\system32\svchost.exe -k LocalService [qc@)RobinieiXW32TimeC:\Windows\system32\svchost.exe -k LocalService [qc@)RobinieiXW32TimeC:\Windows\system32\svchost.exe -k LocalServicePPJ #P808T& >uwKtOJ4& >uwKtOJ4C:\Windows\System32\iphlpsvc.dllIphlpsvcSysprepGeneralizeJ(% 08 ̔<(>uwKtOJ4C:\Windows\System32\setup\tssysprep.dllLSMSysPrepBackupJ($8@8 T'>uwKtOJ4  JD)& ̔80TJ(>uwKtOJ4(>uwKtOJ4C:\Windows\System32\setup\tssysprep.dllRdpSysPrepGeneralizeT(>uwKtOJ42\(>uwKtOJ4C:\Windows\System32\shsetup.dllSysprep_Generalize_Shell:\WT(>uwKtOJ4eu(>uwKtOJ4wer.dllWerSysprepGeneralizeWT(>uwKtOJ4e(>uwKtOJ4C:\Windows\System32\dhcpcsvc.dllDhcpClient_GeneralizeT(>uwKtOJ4(>uwKtOJ4C:\Windows\System32\spnet.dllSysprep_Generalize_NetT(>uwKtOJ4(>uwKtOJ4C:\Windows\System32\slc.dllSLReArmWindows5'808Tb5>uwKtOJ5b5>uwKtOJ5C:\Windows\system32\capisp.dllCAPISysPrep_GeneralizeralT#x5>uwKtOJ5J5>uwKtOJ5C:\Windows\System32\spbcd.dllSysprep_Generalize_BcdTJ5>uwKtOJ5>5>uwKtOJ5C:\Windows\System32\nlmsprep.dllNetworkListManager_GeneralizeT>5>uwKtOJ5>5>uwKtOJ5C:\Windows\system32\msdtcprx.dllSysPrepDtcGeneralizeT5>uwKtOJ5}„5>uwKtOJ5RacEngn.dllRacSysprepGeneralizeTp5>uwKtOJ5z855>uwKtOJ5msmmsp.dllMountMgr_GeneralizeT855>uwKtOJ5855>uwKtOJ5C:\Windows\System32\iesysprep.dllSysprep_Generalize_IET855>uwKtOJ5T855>uwKtOJ5'ن	80 PLn܅>uMOWdSclpSetNewShinyUiText failedppʮl	p88 PL">uMOWdSclpExecuteRequestInternalSaw request: operation flags = 0x80007F0F, progress callback presentPL">uMOWd(SclpExecuteRequestInternalRunning in [online] mode.PL">uMOWd,SclpExecuteRequestInternalAcquiring needed privileges...hPL">uMOWddU°Д?hhPL">uMOWd}K1.AXPL">uMOWdC:\XPL">uMOWdC:\PL">uMOWdpSclpRemoveContextNoOpsOld and new paths are identical ([C:\]); skipping path replacement...PPL">uMOWdPL">uMOWdSclResetDiskGuidsDetected system firmware type = 0x1PPL">uMOWd	PPL">uMOWdPPL">uMOWd
PL">uMOWdProcessOnlineRegistryHivesProcessing system hive [\REGISTRY\USER\.DEFAULT]...`PL">uMOWdDEFAULT`PL">uMOWd
DEFAULTPL">uMOWdProcessOnlineRegistryHivesProcessing system hive [\REGISTRY\MACHINE\SAM\SAM]...XPL">uMOWdSAMXPL'>uMOWd
SAMPL'>uMOWdProcessOnlineRegistryHivesProcessing system hive [\REGISTRY\MACHINE\SECURITY]...bPL'>uMOWdSECURITYbPL'>uMOWd
SECURITYPL'>uMOWdProcessOnlineRegistryHivesProcessing system hive [\REGISTRY\MACHINE\SOFTWARE]...bPL'>uMOWdSOFTWAREd,
ե۝ 	880bPL>uMOWd
>SOFTWAREPL>uMOWd>ProcessOnlineRegistryHivesProcessing system hive [\REGISTRY\MACHINE\SYSTEM]...i^PL>uMOWd>SYSTEMPL>uMOWdJ;SclRegProcessProfileHiveProcessing profile hive: [\??\C:\Windows\system32\config\systemprofile\NTUSER.DAT]PL>uMOWdJ\??\C:\Windows\system32\config\systemprofile\NTUSER.DATPLS>uMOWdKSclRegProcessUserProfileHivesOptional profile hive does not exist, skipping: [\??\C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\UsrClass.dat].PLS>uMOWdKSclpRegExpandProfileHivePathLocating user profile hive: C:\Windows\ServiceProfiles\LocalService\NTUSER.DATPLS>uMOWdKSclpRegExpandProfileHivePathExpanded profile hive path: NT path = [\??\C:\Windows\ServiceProfiles\LocalService\NTUSER.DAT]PLX>uMOWdK;SclRegProcessProfileHiveProcessing profile hive: [\??\C:\Windows\ServiceProfiles\LocalService\NTUSER.DAT]PLX>uMOWdK\??\C:\Windows\ServiceProfiles\LocalService\NTUSER.DATPL졃>uMOWd
K\??\C:\Windows\ServiceProfiles\LocalService\NTUSER.DATPL졃>uMOWdKSclpRegExpandProfileHivePathLocating user profile hive: C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\UsrClass.datPL졃>uMOWdKSclpRegExpandProfileHivePathExpanded profile hive path: NT path = [\??\C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\UsrClass.dat]PL졃>uMOWdKSclRegProcessUserProfileHivesOptional profile hive does not exist, skipping: [\??\C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\UsrClass.dat].PL졃>uMOWdKSclpRegExpandProfileHivePathLocating user profile hive: C:\Windows\ServiceProfiles\NetworkService\NTUSER.DATPL졃>uMOWdKSclpRegExpandProfileHivePathExpanded profile hive path: NT path = [\??\C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT]PLF>uMOWdK;SclRegProcessProfileHiveProcessing profile hive: [\??\C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT]PLF>uMOWdK\??\C:\Windows\ServiceProfiles\NetworkService\NTUSER.DATm((۝	( 8^PL1>uMOWd
JSYSTEMPPL1>uMOWdJPPL1>uMOWdJPL1>uMOWdJSclRegProcessUserProfileHivesOperating on user-specific profile hives...PL1>uMOWdJSclpRegExpandProfileHivePathLocating user profile hive: %systemroot%\system32\config\systemprofile\NTUSER.DATPL1>uMOWdJSclpRegExpandProfileHivePathExpanded profile hive path: NT path = [\??\C:\Windows\system32\config\systemprofile\NTUSER.DAT]PLS>uMOWd
K\??\C:\Windows\system32\config\systemprofile\NTUSER.DATPLS>uMOWdKSclpRegExpandProfileHivePathLocating user profile hive: %systemroot%\system32\config\systemprofile\AppData\Local\Microsoft\Windows\UsrClass.datPLS>uMOWdKSclpRegExpandProfileHivePathExpanded profile hive path: NT path = [\??\C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\UsrClass.dat]PPό	P80 PL2e>uMOWd
L\??\C:\Windows\ServiceProfiles\NetworkService\NTUSER.DATPL2e>uMOWdLSclpRegExpandProfileHivePathLocating user profile hive: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\UsrClass.datPL2e>uMOWdLSclpRegExpandProfileHivePathExpanded profile hive path: NT path = [\??\C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\UsrClass.dat]PL2e>uMOWdLSclRegProcessUserProfileHivesOptional profile hive does not exist, skipping: [\??\C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\UsrClass.dat].PL2e>uMOWdLSclpRegExpandProfileHivePathLocating user profile hive: C:\Users\Administrator\NTUSER.DATPL2e>uMOWdLSclpRegExpandProfileHivePathExpanded profile hive path: NT path = [\??\C:\Users\Administrator\NTUSER.DAT]PL)>uMOWdL;SclRegProcessProfileHiveProcessing profile hive: [\??\C:\Users\Administrator\NTUSER.DAT]PL)>uMOWdL\??\C:\Users\Administrator\NTUSER.DATPLS>uMOWd
M\??\C:\Users\Administrator\NTUSER.DATPLS>uMOWdMSclpRegExpandProfileHivePathLocating user profile hive: C:\Users\Administrator\AppData\Local\Microsoft\Windows\UsrClass.datPLS>uMOWdMSclpRegExpandProfileHivePathExpanded profile hive path: NT path = [\??\C:\Users\Administrator\AppData\Local\Microsoft\Windows\UsrClass.dat]PL6W>uMOWdM;SclRegProcessProfileHiveProcessing profile hive: [\??\C:\Users\Administrator\AppData\Local\Microsoft\Windows\UsrClass.dat]PL6W>uMOWdM\??\C:\Users\Administrator\AppData\Local\Microsoft\Windows\UsrClass.datPL>uMOWd
M\??\C:\Users\Administrator\AppData\Local\Microsoft\Windows\UsrClass.datPL>uMOWdMSclpRegExpandProfileHivePathLocating user profile hive: %SystemDrive%\Users\Default\NTUSER.DATPL>uMOWdMSclpRegExpandProfileHivePathExpanded profile hive path: NT path = [\??\C:\Users\Default\NTUSER.DAT]PLTX>uMOWdM;SclRegProcessProfileHiveProcessing profile hive: [\??\C:\Users\Default\NTUSER.DAT]PLTX>uMOWdM\??\C:\Users\Default\NTUSER.DATH(,	H88 PL>uMOWd
N\??\C:\Users\Default\NTUSER.DATPPL>uMOWdNPPL>uMOWdNPPL>uMOWdNPL>uMOWdNxSclFsProcessVolumeThe version of volume [\??\C:\] is NTFS [3.1]PL>uMOWdNSclFsProcessVolumeThe version of the current (host) OS is [6.1]PL>uMOWdNSclFsProcessVolumeProcessing volume [\??\C:]...PL,>uMOWdOSclpFsProcessVolumeByHandleFSCTL_SD_GLOBAL_CHANGE succeededd new pPPL,>uMOWdOPPL,>uMOWdOPL,>uMOWdOCSclLinkProcessVolumeProcessing links on volume [\??\C:\]: old base = [C:\]; new base = [C:\]PL,>uMOWdOSclpLinkProcessReparsePointSuccessfully processed reparse point [\Device\HarddiskVolume2\Users\Administrator\My Documents]; update performedPL,>uMOWdOSclpLinkProcessReparsePointSuccessfully processed reparse point [\Device\HarddiskVolume2\Users\Administrator\Documents\My Music]; update performedPL,>uMOWdOSclpLinkProcessReparsePointSuccessfully processed reparse point [\Device\HarddiskVolume2\Users\Administrator\Documents\My Pictures]; update performedM\SAMPL,>uMOWdOSclpLinkProcessReparsePointSuccessfully processed reparse point [\Device\HarddiskVolume2\Users\Administrator\Documents\My Videos]; update performedPL,>uMOWdOSclpLinkProcessReparsePointSuccessfully processed reparse point [\Device\HarddiskVolume2\Users\Administrator\Application Data]; update performedPL,>uMOWdOSclpLinkProcessReparsePointSuccessfully processed reparse point [\Device\HarddiskVolume2\Users\Administrator\Cookies]; update performed [\PL,>uMOWdOSclpLinkProcessReparsePointSuccessfully processed reparse point [\Device\HarddiskVolume2\Users\Administrator\NetHood]; update performedPL,>uMOWdOSclpLinkProcessReparsePointSuccessfully processed reparse point [\Device\HarddiskVolume2\Users\Administrator\PrintHood]; update performedPL,>uMOWdOSclpLinkProcessReparsePointSuccessfully processed reparse point [\Device\HarddiskVolume2\Users\Administrator\Recent]; update performedPL,>uMOWdOSclpLinkProcessReparsePointSuccessfully processed reparse point [\Device\HarddiskVolume2\Users\Administrator\SendTo]; update performedPL,>uMOWdOSclpLinkProcessReparsePointSuccessfully processed reparse point [\Device\HarddiskVolume2\Users\Administrator\Start Menu]; update performedH V	H880PL,>uMOWdOSclpLinkProcessReparsePointSuccessfully processed reparse point [\Device\HarddiskVolume2\Users\Administrator\Templates]; update performednPL,>uMOWdOSclpLinkProcessReparsePointSuccessfully processed reparse point [\Device\HarddiskVolume2\Users\Administrator\Local Settings]; update performedSclRPL,>uMOWdOSclpLinkProcessReparsePointSuccessfully processed reparse point [\Device\HarddiskVolume2\Users\Administrator\AppData\Local\Application Data]; update performed\sPL,>uMOWdOSclpLinkProcessReparsePointSuccessfully processed reparse point [\Device\HarddiskVolume2\Users\Administrator\AppData\Local\History]; update performedconfiPL,>uMOWdOSclpLinkProcessReparsePointSuccessfully processed reparse point [\Device\HarddiskVolume2\Users\Administrator\AppData\Local\Temporary Internet Files]; update performedDATPL,>uMOWdOSclpLinkProcessReparsePointSuccessfully processed reparse point [\Device\HarddiskVolume2\Documents and Settings]; update performedPL,>uMOWdOSclpLinkProcessReparsePointSuccessfully processed reparse point [\Device\HarddiskVolume2\ProgramData\Favorites]; update performedMPL,>uMOWdOSclpLinkProcessReparsePointSuccessfully processed reparse point [\Device\HarddiskVolume2\ProgramData\Start Menu]; update performedPL,>uMOWdOSclpLinkProcessReparsePointSuccessfully processed reparse point [\Device\HarddiskVolume2\ProgramData\Templates]; update performedPL,>uMOWdOSclpLinkProcessReparsePointSuccessfully processed reparse point [\Device\HarddiskVolume2\ProgramData\Application Data]; update performedPL,>uMOWdOSclpLinkProcessReparsePointSuccessfully processed reparse point [\Device\HarddiskVolume2\ProgramData\Desktop]; update performedWdPL,>uMOWdOSclpLinkProcessReparsePointSuccessfully processed reparse point [\Device\HarddiskVolume2\ProgramData\Documents]; update performedPL,>uMOWdOSclpLinkProcessReparsePointSuccessfully processed reparse point [\Device\HarddiskVolume2\Users\Default\Cookies]; update performedPL,>uMOWdOSclpLinkProcessReparsePointSuccessfully processed reparse point [\Device\HarddiskVolume2\Users\Default\AppData\Local\Application Data]; update performeddPLV>uMOWdOSclpLinkProcessReparsePointSuccessfully processed reparse point [\Device\HarddiskVolume2\Users\Default\Local Settings]; update performedPLV>uMOWdOSclpLinkProcessReparsePointSuccessfully processed reparse point [\Device\HarddiskVolume2\Users\Default\My Documents]; update performedPLV>uMOWdOSclpLinkProcessReparsePointSuccessfully processed reparse point [\Device\HarddiskVolume2\Users\Default\NetHood]; update performed5	 8PLV>uMOWdOSclpLinkProcessReparsePointSuccessfully processed reparse point [\Device\HarddiskVolume2\Users\Default\SendTo]; update performeddPLV>uMOWdOSclpLinkProcessReparsePointSuccessfully processed reparse point [\Device\HarddiskVolume2\Users\Default\Start Menu]; update performedPLV>uMOWdOSclpLinkProcessReparsePointSuccessfully processed reparse point [\Device\HarddiskVolume2\Users\Default\Templates]; update performedPLV>uMOWdOSclpLinkProcessReparsePointSuccessfully processed reparse point [\Device\HarddiskVolume2\Users\Default\AppData\Local\Temporary Internet Files]; update performedPLV>uMOWdOSclpLinkProcessReparsePointSuccessfully processed reparse point [\Device\HarddiskVolume2\Users\Default\Documents\My Music]; update performedocatinPL>uMOWdOSclpLinkProcessReparsePointSuccessfully processed reparse point [\Device\HarddiskVolume2\Users\Default\Documents\My Pictures]; update performedndePL>uMOWdOSclpLinkProcessReparsePointSuccessfully processed reparse point [\Device\HarddiskVolume2\Users\Default\Documents\My Videos]; update performedPL>uMOWdOSclpLinkProcessReparsePointSuccessfully processed reparse point [\Device\HarddiskVolume2\Users\Default User]; update performedPL>uMOWdOSclpLinkProcessReparsePointSuccessfully processed reparse point [\Device\HarddiskVolume2\Users\Default\Application Data]; update performedPL>uMOWdOSclpLinkProcessReparsePointSuccessfully processed reparse point [\Device\HarddiskVolume2\Users\Default\PrintHood]; update performedPL>uMOWdOSclpLinkProcessReparsePointSuccessfully processed reparse point [\Device\HarddiskVolume2\Users\Default\Recent]; update performedPL>uMOWdOSclpLinkProcessReparsePointSuccessfully processed reparse point [\Device\HarddiskVolume2\Users\Default\AppData\Local\History]; update performedPL>uMOWdOSclpLinkProcessReparsePointSuccessfully processed reparse point [\Device\HarddiskVolume2\Users\Public\Documents\My Music]; update performedPL>uMOWdOSclpLinkProcessReparsePointSuccessfully processed reparse point [\Device\HarddiskVolume2\Users\Public\Documents\My Pictures]; update performedPL>uMOWdOSclpLinkProcessReparsePointSuccessfully processed reparse point [\Device\HarddiskVolume2\Users\Public\Documents\My Videos]; update performedPL>uMOWdOSclpLinkProcessReparsePointSuccessfully processed reparse point [\Device\HarddiskVolume2\Users\All Users]; update performedPPL>uMOWdO$		80 PL$>uMOWdQSclpStateRecordStatFieldSTAT: Number of registry keys processed = 141220ePL$>uMOWdQRegKeyProcessCountNumber of registry keys processed'rvicePPL$>uMOWdQSclpStateRecordStatFieldSTAT: Number of registry keys renamed = 5PL$>uMOWdQRegKeyRenameCountNumber of registry keys renamedPL$>uMOWdQSclpStateRecordStatFieldSTAT: Number of registry values processed = 239238PL$>uMOWdQRegValueProcessCountNumber of registry values processedfile hPL$>uMOWdQSclpStateRecordStatFieldSTAT: Number of registry values renamed = 0ExpandePL$>uMOWdQRegValueRenameCountNumber of registry values renamedile PL$>uMOWdQSclpStateRecordStatFieldSTAT: Number of registry values updated = 91AdmPL$>uMOWdQRegDataUpdateCountNumber of registry values updated[.DAPL$>uMOWdQSclpStateRecordStatFieldSTAT: Number of registry security descriptors updated = 5155r\AppDPL$>uMOWdQSecObjectSDUpdateCountNumber of registry security descriptors updated#DaPL$>uMOWdQSclpStateRecordStatFieldSTAT: Number of registry security descriptors processed = 141220e PL$>uMOWdQSecObjectSDProcessCountNumber of registry security descriptors processed'alPL$>uMOWdQSclpStateRecordStatFieldSTAT: Number of $Secure security descriptors updated = 49PL$>uMOWdQFsSecureSDUpdateCountNumber of $Secure security descriptors updated1vePathPL$>uMOWdQSclpStateRecordStatFieldSTAT: Number of $Secure security descriptors failed = 0panPL$>uMOWdQFsSecureSDFailedUpdateCountNumber of $Secure security descriptors failed:\UsPL$>uMOWdQSclpStateRecordStatFieldSTAT: Number of $Secure security descriptors processed = 346PL$>uMOWdQFsSecureSDProcessCountNumber of $Secure security descriptors processedZPL$>uMOWdQSclpStateRecordStatFieldSTAT: Number of $MFT security descriptors updated = 0ppJ&
	p88 PL$>uMOWdQFsMftSDUpdateCountNumber of $MFT security descriptors updatedPL$>uMOWdQSclpStateRecordStatFieldSTAT: Number of $MFT security descriptors failed = 0PL$>uMOWdQFsMftSDFailedUpdateCountNumber of $MFT security descriptors failedPL$>uMOWdQSclpStateRecordStatFieldSTAT: Number of $MFT security descriptors processed = 0clFPL$>uMOWdQFsMftSDProcessCountNumber of $MFT security descriptors processedPL$>uMOWdQSclpStateRecordStatFieldSTAT: Number of reparse points processed = 44PL$>uMOWdQReparsePointProcessCountNumber of reparse points processed,PL$>uMOWdQSclpStateRecordStatFieldSTAT: Number of reparse points updated = 44ments];PL$>uMOWdQReparsePointUpdateCountNumber of reparse points updated,s\AdmiPL$>uMOWdQSclpStateRecordStatFieldSTAT: Time spent processing registry (in ms) = 4609uccessfPL$>uMOWdQRegProcessingTimeInMSTime spent processing registry (in ms)nkProcPL$>uMOWdQSclpStateRecordStatFieldSTAT: Time spent processing volumes (in ms) = 328PL$>uMOWdQFsProcessingTimeInMSTime spent processing volumes (in ms)HrfPL$>uMOWdQSclpStateRecordStatFieldSTAT: Total time spent processing (in ms) = 10078DPL$>uMOWdQTotalProcessingTimeInMSTotal time spent processing (in ms)^'XXJܢ 	X 8h<բ[qc@)RobinieitPlugPlayC:\Windows\system32\svchost.exe -k DcomLaunchrfh<բ[qc@)RobinieitPlugPlayC:\Windows\system32\svchost.exe -k DcomLaunch];h<բ[qc@)RobinieitPlugPlayC:\Windows\system32\svchost.exe -k DcomLaunchfah<բ[qc@)RobinieitPlugPlayC:\Windows\system32\svchost.exe -k DcomLaunchVoh<բ[qc@)RobinieitPlugPlayC:\Windows\system32\svchost.exe -k DcomLaunchrohhJܢ	h880Pr[qc@)RobineePr[qc@)Robinjkbr[qc@)RobinggPlugPlayOWdtr[qc@)RobinieiPlugPlaye\Haޱ[qc@)RobinieitPlugPlayC:\Windows\system32\svchost.exe -k DcomLaunch rh?Ӣ[qc@)RobinieitPlugPlayC:\Windows\system32\svchost.exe -k DcomLaunchocJ

 0	80 h[qc@)RobinieitPlugPlayC:\Windows\system32\svchost.exe -k DcomLaunchHX[qc@)RobinieitPlugPlayC:\Windows\system32\svchost.exe -k DcomLaunchH9[qc@)RobinieitPowerC:\Windows\system32\svchost.exe -k DcomLaunchv9[qc@)RobinggCOM InfrastructureMx9[qc@)RobinieiDcomLaunch9[qc@)RobinieitDcomLaunchC:\Windows\system32\svchost.exe -k DcomLaunchfile h|Z'<[qc@)RobinieiRpcEptMapper regHvuJ[qc@)RobinieitDcomLaunchC:\Windows\system32\svchost.exe -k DcomLaunchamevTd[qc@)RobinhgCOM InfrastructuretFh[qc@)RobinieiTermServiceC:\Windows\System32\svchost.exe -k termsvcsHx[qc@)RobinieiTermServiceC:\Windows\System32\svchost.exe -k termsvcsRڽԣ>uȓOh:Sڽԣ>uȓOh:SC:\Windows\system32\oobe\setup.exe#|H[qc@)RobinieiUmRdpServiceumbeH[qc@)RobinieiPUmRdpServiceC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestrictediptzHz[qc@)RobinieiCertPropSvcSclpHE[qc@)RobinieitCertPropSvcC:\Windows\system32\svchost.exe -k netsvcsupHE[qc@)RobinggNetworkProviderjHE[qc@)Robinieinsi Numbehl[qc@)RobinieiPUmRdpServiceC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestrictedptoH1	[qc@)RobinieinsiC:\Windows\system32\svchost.exe -k LocalServiceD[qc@)RobinieinsiC:\Windows\system32\svchost.exe -k LocalService8
8J
	8
88 hX[qc@)RobinieitPlugPlayC:\Windows\system32\svchost.exe -k DcomLaunchhX[qc@)RobinieitPlugPlayC:\Windows\system32\svchost.exe -k DcomLaunchMHX[qc@)RobinieitPlugPlayC:\Windows\system32\svchost.exe -k DcomLaunchHX[qc@)RobinieitPlugPlayC:\Windows\system32\svchost.exe -k DcomLaunchbX[qc@)RobinhgPlugPlaycurbX[qc@)RobinggPlugPlayOWdnX[qc@)RobinieiPower= X[qc@)RobinieitPowerC:\Windows\system32\svchost.exe -k DcomLaunchH>-[qc@)RobinieitPowerC:\Windows\system32\svchost.exe -k DcomLaunchb9[qc@)RobinhgPlugPlaynt°E[qc@)RobinieiRpcEptMapperC:\Windows\system32\svchost.exe -k RPCSSt prHH[qc@)RobinieitDcomLaunchC:\Windows\system32\svchost.exe -k DcomLaunchegiHvuJ[qc@)RobinieiRpcEptMapperC:\Windows\system32\svchost.exe -k RPCSSHvuJ[qc@)RobinieiRpcEptMapperC:\Windows\system32\svchost.exe -k RPCSSnvuJ[qc@)RobinieiRpcSsalvuJ[qc@)RobinieiRpcSsC:\Windows\system32\svchost.exe -k RPCSSsHvuJ[qc@)RobinieiRpcSsC:\Windows\system32\svchost.exe -k RPCSSHTd[qc@)RobinieiRpcSsC:\Windows\system32\svchost.exe -k RPCSSzh[qc@)RobinieiTermServiceJ#?	 8DJ
[qc@)RobinieinsiC:\Windows\system32\svchost.exe -k LocalServiceDX[qc@)RobinieitCertPropSvcC:\Windows\system32\svchost.exe -k netsvcsnD[qc@)RobinieitCertPropSvcC:\Windows\system32\svchost.exe -k netsvcsnH1[qc@)RobinieiLanmanWorkstationdH1[qc@)RobinieiLanmanWorkstationC:\Windows\System32\svchost.exe -k NetworkServiceD`D[qc@)RobinieiLanmanWorkstationC:\Windows\System32\svchost.exe -k NetworkServiceD.G[qc@)RobinieiLanmanWorkstationC:\Windows\System32\svchost.exe -k NetworkServiceh.G[qc@)RobinieiLanmanWorkstationC:\Windows\System32\svchost.exe -k NetworkServiceD.G[qc@)RobinieiLanmanWorkstationC:\Windows\System32\svchost.exe -k NetworkServicehI[qc@)RobinieiLanmanWorkstationC:\Windows\System32\svchost.exe -k NetworkServicepHI[qc@)RobinhgNetworkProviderxHI[qc@)RobinieiSessionEnvHI[qc@)RobinieitSessionEnvC:\Windows\system32\svchost.exe -k netsvcsH|U[qc@)RobinieitSessionEnvC:\Windows\system32\svchost.exe -k netsvcsHha[qc@)RobinieitSessionEnvC:\Windows\system32\svchost.exe -k netsvcsʚͫ	880TLHv>uI]	80 PLH޴>uI]LH޴>uwKtOJSOFTWARE\Microsoft\Windows\CurrentVersion\Setup\SysPrep\PHASE_SPECIALIZEugLH>uwKtOJC:\Windows\System32\spopk.dllSysprep_Specialize_OpkTLH>uwKtOJsv{LHZŬ>uwKtOJsqmapi.dllSqmSysprepSpecializeTLHϬ>uwKtOJeiLH8߬>uwKtOJC:\Windows\System32\sppnp.dllSysprep_Specialize_PnptJd	88 PLHXڹ_>Ob<u
X[qc@)RobinggFSFilter Virtualization	88h2[qc@)RobinieiPUmRdpServiceC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted2[qc@)RobinhgFSFilter Virtualizationd2[qc@)RobinggEvent Logt2[qc@)Robinieieventlogsv@5[qc@)Robiniei8eventlogC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestrictednmhdb[qc@)Robiniei8eventlogC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestrictedstHVk[qc@)Robiniei8eventlogC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestrictedC:dVk[qc@)RobinhgEvent LoglVk[qc@)RobinggProfSvc_GroupstnVk[qc@)RobinieigpsvcVk[qc@)RobinieitgpsvcC:\Windows\system32\svchost.exe -k netsvcs -kh[qc@)RobinieitProfSvcC:\Windows\system32\svchost.exe -k netsvcs3D[qc@)RobinieitgpsvcC:\Windows\system32\svchost.exe -k netsvcsID[qc@)RobinieitgpsvcC:\Windows\system32\svchost.exe -k netsvcsessD[qc@)RobinieitgpsvcC:\Windows\system32\svchost.exe -k netsvcstD[qc@)RobinieitgpsvcC:\Windows\system32\svchost.exe -k netsvcsD[qc@)RobinieitgpsvcC:\Windows\system32\svchost.exe -k netsvcsD[qc@)RobinieitProfSvcC:\Windows\system32\svchost.exe -k netsvcsz[qc@)RobinieiEventSystemh[qc@)RobinieitgpsvcC:\Windows\system32\svchost.exe -k netsvcsh[qc@)RobinieitgpsvcC:\Windows\system32\svchost.exe -k netsvcs[qc@)RobinieiEventSystemC:\Windows\system32\svchost.exe -k LocalServicehXfL 	h80 h[qc@)RobinieitgpsvcC:\Windows\system32\svchost.exe -k netsvcst\Whؖ[qc@)RobinieiEventSystemC:\Windows\system32\svchost.exe -k LocalServiceh&[qc@)RobinieiEventSystemC:\Windows\system32\svchost.exe -k LocalServicel&[qc@)RobinieiSENS&[qc@)RobinieitSENSC:\Windows\system32\svchost.exe -k netsvcshM[qc@)RobinieitSENSC:\Windows\system32\svchost.exe -k netsvcshM[qc@)RobinieitSENSC:\Windows\system32\svchost.exe -k netsvcslM[qc@)RobinhgProfSvc_GroupPM[qc@)Robinkk`M[qc@)RobinggUIGroupnM[qc@)RobinieiUxSmsM[qc@)RobinieiPUxSmsC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestrictedh.[qc@)RobinieiPUxSmsC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestrictedh.[qc@)RobinieiPUxSmsC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted`.[qc@)RobinhgUIGroupZ.[qc@)RobinggNDISZ`[qc@)RobinhgNDISX`[qc@)RobinggTDIl`[qc@)RobinieiDhcp`[qc@)Robiniei8DhcpC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestrictedt`[qc@)RobinieiDnscache`[qc@)RobinieiDnscacheC:\Windows\System32\svchost.exe -k NetworkServicer`[qc@)Robinieilmhosts`[qc@)Robiniei8lmhostsC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestrictedfL	880rPn[qc@)RobinieiProfSvcPn[qc@)RobinieitProfSvcC:\Windows\system32\svchost.exe -k netsvcsD	 8DfL[qc@)Robiniei8DhcpC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestrictedhfL[qc@)Robiniei8lmhostsC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestrictedW-^hfL[qc@)Robiniei8lmhostsC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestrictedw>h[qc@)RobinieiDnscacheC:\Windows\System32\svchost.exe -k NetworkService?h[qc@)Robiniei8DhcpC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted/Lwh[qc@)RobinieiDnscacheC:\Windows\System32\svchost.exe -k NetworkService.Zh[qc@)Robiniei8DhcpC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestrictedhPDh(8[qc@)RobinieiDnscacheC:\Windows\System32\svchost.exe -k NetworkServiceh(8[qc@)RobinieiDnscacheC:\Windows\System32\svchost.exe -k NetworkServiceh(8[qc@)RobinieiDnscacheC:\Windows\System32\svchost.exe -k NetworkService&h(8[qc@)RobinieiDnscacheC:\Windows\System32\svchost.exe -k NetworkService1h[qc@)RobinieiDnscacheC:\Windows\System32\svchost.exe -k NetworkServiceh[qc@)RobinieiDnscacheC:\Windows\System32\svchost.exe -k NetworkServiceX[qc@)RobinhgTDIl[qc@)RobinggShellSvcGroupX[qc@)RobinieiShellHWDetection	G2[qc@)RobinieitShellHWDetectionC:\Windows\system32\svchost.exe -k netsvcshD[qc@)RobinieitShellHWDetectionC:\Windows\system32\svchost.exe -k netsvcshD[qc@)RobinieitShellHWDetectionC:\Windows\system32\svchost.exe -k netsvcsppJ+ 0	p88lD[qc@)RobinhgShellSvcGroupernD[qc@)RobinggSchedulerGroupotD[qc@)RobinieiScheduleFiD[qc@)RobinieitScheduleC:\Windows\system32\svchost.exe -k netsvcsDL5[qc@)RobinieitScheduleC:\Windows\system32\svchost.exe -k netsvcsn˭[qc@)RobinhgSchedulerGroupmp˭[qc@)RobinggNetworkProviderj˭[qc@)RobinieiBFErkRDB|[qc@)Robiniei4BFEC:\Windows\system32\svchost.exe -k LocalServiceNoNetworkSerD,[qc@)Robiniei4BFEC:\Windows\system32\svchost.exe -k LocalServiceNoNetworkpl[qc@)RobinieiMpsSvcl[qc@)Robiniei4MpsSvcC:\Windows\system32\svchost.exe -k LocalServiceNoNetworkH<[qc@)Robiniei4MpsSvcC:\Windows\system32\svchost.exe -k LocalServiceNoNetworkJ+	88 h˭[qc@)RobinieitScheduleC:\Windows\system32\svchost.exe -k netsvcsh˭[qc@)RobinieitScheduleC:\Windows\system32\svchost.exe -k netsvcs˭[qc@)Robiniei4BFEC:\Windows\system32\svchost.exe -k LocalServiceNoNetworkJX	80 HXR[qc@)Robiniei4MpsSvcC:\Windows\system32\svchost.exe -k LocalServiceNoNetworkpXR[qc@)RobinhgNetworkProviderXR[qc@)RobinggMS_WindowsLocalValidationnXR[qc@)RobinieiSamSshXR[qc@)RobinieiSamSsC:\Windows\system32\lsass.exeHXR[qc@)RobinieiSamSsC:\Windows\system32\lsass.exeXR[qc@)RobinhgMS_WindowsLocalValidationndjXR[qc@)RobinggSpoolerGroupRobinr[qc@)RobinieiSpoolerost"[qc@)RobinieiSpoolerC:\Windows\System32\spoolsv.exeH`%[qc@)RobinieiSpoolerC:\Windows\System32\spoolsv.exeHc'[qc@)RobinieiSpoolerC:\Windows\System32\spoolsv.exeHc'[qc@)RobinieiSpoolerC:\Windows\System32\spoolsv.exejc'[qc@)RobinhgSpoolerGroupem3lc'[qc@)RobinggExtended BaselȊ.[qc@)RobinhgExtended BasewstȊ.[qc@)RobinieiCryptSvcȊ.[qc@)RobinieiCryptSvcC:\Windows\System32\svchost.exe -k NetworkService@pȊ.[qc@)RobinieiNlaSvcȊ.[qc@)RobinieiNlaSvcC:\Windows\System32\svchost.exe -k NetworkServiceA[qc@)RobinieiRemoteRegistryA[qc@)Robiniei8RemoteRegistryC:\Windows\system32\svchost.exe -k regsvceiDLbF[qc@)Robiniei8RemoteRegistryC:\Windows\system32\svchost.exe -k regsvceiDLbF[qc@)Robiniei8RemoteRegistryC:\Windows\system32\svchost.exe -k regsvcste
J9 	
880prw[qc@)RobinieiTrkWksrw[qc@)RobinieiPTrkWksC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestrictedrrw[qc@)RobinieiWinmgmtrw[qc@)RobinieitWinmgmtC:\Windows\system32\svchost.exe -k netsvcsl[qc@)RobinieiWLMSPB[qc@)RobinieiCryptSvcC:\Windows\System32\svchost.exe -k NetworkServicePB[qc@)RobinieiCryptSvcC:\Windows\System32\svchost.exe -k NetworkServicePP[qc@)RobinieiNlaSvcC:\Windows\System32\svchost.exe -k NetworkServiceP[qc@)RobinieiPTrkWksC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestrictedD[qc@)RobinieiPTrkWksC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestrictedDv[qc@)RobinieiNlaSvcC:\Windows\System32\svchost.exe -k NetworkServicer [qc@)RobinieiVMToolsHM	[qc@)RobinieitiphlpsvcC:\Windows\system32\svchost.exe -k netsvcsHM	[qc@)RobinieitiphlpsvcC:\Windows\system32\svchost.exe -k netsvcs((J9	( 8:[qc@)Robiniei`WLMSC:\Windows\system32\wlms\wlms.exe D:[qc@)RobinieitWinmgmtC:\Windows\system32\svchost.exe -k netsvcsSD:[qc@)RobinieitWinmgmtC:\Windows\system32\svchost.exe -k netsvcst:[qc@)RobinieiiphlpsvceN:[qc@)RobinieitiphlpsvcC:\Windows\system32\svchost.exe -k netsvcsD:[qc@)Robiniei`WLMSC:\Windows\system32\wlms\wlms.exedD:[qc@)Robiniei`WLMSC:\Windows\system32\wlms\wlms.exePPJfF 0	P88앓[qc@)RobinieiVMTools"C:\Program Files\VMware\VMware Tools\vmtoolsd.exe"h앓[qc@)RobinieiVMTools"C:\Program Files\VMware\VMware Tools\vmtoolsd.exe"H앓[qc@)RobinieiVMTools"C:\Program Files\VMware\VMware Tools\vmtoolsd.exe"|[qc@)RobinieiLanmanServer@[qc@)RobinieitLanmanServerC:\Windows\system32\svchost.exe -k netsvcsh[qc@)RobinieitLanmanServerC:\Windows\system32\svchost.exe -k netsvcsh[qc@)RobinieitLanmanServerC:\Windows\system32\svchost.exe -k netsvcsh[qc@)RobinieitLanmanServerC:\Windows\system32\svchost.exe -k netsvcsP[qc@)RobinfeTLHڹ_>Ob<u
syD[qc@)RobinieinetprofmC:\Windows\system32\svchost.exe -k LocalServicedowD[qc@)RobinieinetprofmC:\Windows\system32\svchost.exe -k LocalServicex[qc@)RobinieiWPDBusEnum[qc@)RobinieiPWPDBusEnumC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted[qc@)RobinieiPWPDBusEnumC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestrictedJfF	88 tD[qc@)Robinieinetprofm:\pP:[qc@)RobinieisppsvcD:[qc@)RobinieinetprofmC:\Windows\system32\svchost.exe -k LocalServiceeiP[qc@)RobinieiLsppsvcC:\Windows\system32\sppsvc.exeP[qc@)RobinieiLsppsvcC:\Windows\system32\sppsvc.exe[qc@)RobinieiLsppsvcC:\Windows\system32\sppsvc.exe[qc@)RobinieiPWPDBusEnumC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted@@}! 	@ 8D2]![qc@)RobinieivmvssC:\Windows\system32\dllhost.exe /Processid:{95CD2B70-6CAD-44D7-9F77-0C461667D121}vD49[qc@)RobinieiCOMSysAppjD[qc@)RobinieiVSSndo  } 	 880nDK[qc@)RobinieivmvssD[qc@)RobinieivmvssC:\Windows\system32\dllhost.exe /Processid:{95CD2B70-6CAD-44D7-9F77-0C461667D121}Dr[qc@)RobinieivmvssC:\Windows\system32\dllhost.exe /Processid:{95CD2B70-6CAD-44D7-9F77-0C461667D121}D;[qc@)Robiniei<COMSysAppC:\Windows\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235};[qc@)Robiniei<COMSysAppC:\Windows\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}Dj=[qc@)Robiniei<COMSysAppC:\Windows\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}" 0	88D-[qc@)RobinieiVSSC:\Windows\system32\vssvc.exeMwH[qc@)Robiniei	VSSC:\Windows\system32\vssvc.exe:\HD[qc@)Robiniei	VSSC:\Windows\system32\vssvc.exeLHV>uwKtOJC:\Windows\System32\scecli.dllSceSysPrep#	8 TLHV>uwKtOJhh%$	h 8TLHȵ>uwKtOJLHQ>uwKtOJC:\Windows\System32\setup\tssysprep.dllRCMSysPrepRestore1}TLHQ>uwKtOJLHQ>uwKtOJC:\Windows\System32\setup\tssysprep.dllLSMSysPrepRestoreTLHQ>uwKtOJLHQ>uwKtOJC:\Windows\System32\oobe\winsetup.dllSpSetupOnlineSettingsSpecializeTLHr>uwKtOJLHr>uwKtOJC:\Windows\System32\setup\tssysprep.dllRdpSysPrepRestoreTLHr>uwKtOJLH>uwKtOJC:\Windows\System32\shsetup.dllSysprep_Specialize_ShellTLH>uwKtOJuLH>uwKtOJwer.dllWerSysprepSpecializeTLH>uwKtOJLH>uwKtOJC:\Windows\system32\catsrvut.dllSysprepComplus\%	880nH\[qc@)Robiniei
MSDTCH|t[qc@)Robiniei
(MSDTCC:\Windows\System32\msdtc.exeD9w[qc@)Robiniei(MSDTCC:\Windows\System32\msdtc.exes&	88D[qc@)Robiniei(MSDTCC:\Windows\System32\msdtc.exeHHj'	H8 TLHD>uwKtOJ
LH>uwKtOJ
C:\Windows\system32\capisp.dllCryptoSysPrep_Specialize((i$	(	( 8TLHD>uwKtOJ
LHk>uwKtOJ
C:\Windows\System32\spbcd.dllSysprep_Specialize_BcdSysPrTLHk>uwKtOJ
LHk>uwKtOJ
C:\Windows\system32\msdtcprx.dllSysPrepDtcSpecializeTLHk>uwKtOJ
}LH.	>uwKtOJ
RacEngn.dllRacSysprepSpecializeoTLHJV	>uwKtOJcialLH	>uwKtOJC:\Windows\System32\aecache.dllSysprep_Clean_AECacheTLH	>uwKtOJlLHf	>uwKtOJC:\Windows\System32\iesysprep.dllSysprep_Specialize_IE@@U
)	@880TLHt&	>uwKtOJTLHt&	>uwKtOJLHt&	>uwKtOJSOFTWARE\Microsoft\Windows\CurrentVersion\Setup\SysPrepExternal\PHASE_SPECIALIZEm3TLHt&	>uwKtOJTLHT0	>uI]PLHT0	>uIى"*PLHT0	>uIى"*Æ*	88TLHf>uIى"*1TLHf>uIى"*100+	08 LHN,K
+/E=8,C:\Windows\panther\actionqueue\specialize.uaq\W4LHN,K
+/E=8,C:\WINDOWS\SYSTEM32\RUNDLL32.EXEshsetup.dll,SHUnattendedSetupMicrosoft-Windows-Shell-Setup, Culture=neutral, Version=6.1.7601.17514, PublicKeyToken=31bf3856ad364e35, ProcessorArchitecture=amd64, versionScope=NonSxSspecialize+- 	880Ht`[qc@)Robiniei
tAeLookupSvcC:\Windows\system32\svchost.exe -k netsvcsKHt`[qc@)Robiniei
tAeLookupSvcC:\Windows\system32\svchost.exe -k netsvcsZHt`[qc@)Robiniei
tAeLookupSvcC:\Windows\system32\svchost.exe -k netsvcsHt`[qc@)Robiniei
tAeLookupSvcC:\Windows\system32\svchost.exe -k netsvcsHt`[qc@)Robiniei
tAeLookupSvcC:\Windows\system32\svchost.exe -k netsvcsHt`[qc@)Robiniei
tAeLookupSvcC:\Windows\system32\svchost.exe -k netsvcsTLH(%
+/E=8,LH(%
+/E=8,C:\WINDOWS\SYSTEM32\DJOIN.EXEMicrosoft-Windows-UnattendedJoin, Culture=neutral, Version=6.1.7601.17514, PublicKeyToken=31bf3856ad364e35, ProcessorArchitecture=amd64, versionScope=NonSxSspecializehh+,	h 8zH[qc@)Robiniei
AeLookupSvcOJH[qc@)Robiniei
tAeLookupSvcC:\Windows\system32\svchost.exe -k netsvcsHt`[qc@)Robiniei
tAeLookupSvcC:\Windows\system32\svchost.exe -k netsvcsK. 0	88TLH
+/E=8,LH
+/E=8,C:\WINDOWS\SYSTEM32\SETUPUGC.EXEMicrosoft-Windows-Deployment, Culture=neutral, Version=6.1.7600.16385, PublicKeyToken=31bf3856ad364e35, ProcessorArchitecture=amd64, versionScope=NonSxSspecializef,H6>upIΝp('specializef,H6>upIΝp('specializen,H6>upIΝp('RunSynchronous/	8 ,H^8GaC:\sysprep\guestcustutil.exe cleanBootExecute\W970	880T,Hx8Ga,Hx8GaC:\sysprep\guestcustutil.exe flagCompleteeiT,H&)8Gado,H8GaC:\sysprep\guestcustutil.exe deleteContainingFolderT,Hc8GasvT,Hu>upIΝp('p,Hu>upIΝp('RunAsynchronousT,HXM+>upIΝp('t,HXM+>upIΝp('ExtendOSPartition nT,HXM+>upIΝp('T,HXM+>upIΝp('2\T,H4>upIΝp('TLH4
+/E=8,TLH4
+/E=8,dows1	 8LH>c>uI] :-Windows Server 2008 R2 StandardServerStandardService Pack 1TLH>c>uI]:-e T8>uȓOh:S)22	88TC>uȓOh:S3 	8 4׀[qc@)RobinieitgpsvcC:\Windows\system32\svchost.exe -k netsvcsD9[qc@)RobinieitgpsvcC:\Windows\system32\svchost.exe -k netsvcsD9[qc@)RobinieitgpsvcC:\Windows\system32\svchost.exe -k netsvcsD9[qc@)RobinieitgpsvcC:\Windows\system32\svchost.exe -k netsvcsD9[qc@)RobinieitgpsvcC:\Windows\system32\svchost.exe -k netsvcsD9[qc@)RobinieitgpsvcC:\Windows\system32\svchost.exe -k netsvcsD9[qc@)RobinieitgpsvcC:\Windows\system32\svchost.exe -k netsvcsD9[qc@)RobinieitgpsvcC:\Windows\system32\svchost.exe -k netsvcsD9[qc@)RobinieitgpsvcC:\Windows\system32\svchost.exe -k netsvcsD9[qc@)RobinieitgpsvcC:\Windows\system32\svchost.exe -k netsvcsHH4	H880D9[qc@)RobinieitgpsvcC:\Windows\system32\svchost.exe -k netsvcsestD9[qc@)RobinieitgpsvcC:\Windows\system32\svchost.exe -k netsvcsn@蛅[qc@)Robinieigpsvcn`0ܫ5	` 8Dt"[qc@)RobinieiVMTools"C:\Program Files\VMware\VMware Tools\vmtoolsd.exe"r$t"[qc@)RobinieiVMTools`ܫ[qc@)RobinieitCertPropSvcC:\Windows\system32\svchost.exe -k netsvcs`ܫ[qc@)RobinieiCryptSvcC:\Windows\System32\svchost.exe -k NetworkServiceܫ[qc@)RobinieiCryptSvcC:\Windows\System32\svchost.exe -k NetworkService`ܫ[qc@)Robiniei8DhcpC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestrictedܫ[qc@)Robiniei8DhcpC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted`ܫ[qc@)Robiniei8eventlogC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestrictedܫ[qc@)Robiniei8eventlogC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted`ܫ[qc@)Robiniei(MSDTCC:\Windows\System32\msdtc.exeܫ[qc@)Robiniei8eventlogC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestrictedܫ[qc@)Robiniei(MSDTCC:\Windows\System32\msdtc.exe`ܫ[qc@)RobinieitPlugPlayC:\Windows\system32\svchost.exe -k DcomLaunchzܫ[qc@)RobinieiCertPropSvcܫ[qc@)Robiniei(MSDTCC:\Windows\System32\msdtc.exeܫ[qc@)RobinieitPlugPlayC:\Windows\system32\svchost.exe -k DcomLaunch`ܫ[qc@)RobinieitPowerC:\Windows\system32\svchost.exe -k DcomLaunchܫ[qc@)RobinieitPlugPlayC:\Windows\system32\svchost.exe -k DcomLaunchܫ[qc@)RobinieitPlugPlayC:\Windows\system32\svchost.exe -k DcomLaunch" 6	88ܫ[qc@)RobinieitPlugPlayC:\Windows\system32\svchost.exe -k DcomLaunchܫ[qc@)RobinieitPlugPlayC:\Windows\system32\svchost.exe -k DcomLaunchܫ[qc@)RobinieitPowerC:\Windows\system32\svchost.exe -k DcomLaunch`ܫ[qc@)RobinieitProfSvcC:\Windows\system32\svchost.exe -k netsvcsnܫ[qc@)RobinieiPower6[qc@)RobinieitProfSvcC:\Windows\system32\svchost.exe -k netsvcs`6[qc@)RobinieiLsppsvcC:\Windows\system32\sppsvc.exe6[qc@)RobinieiLsppsvcC:\Windows\system32\sppsvc.exe`6[qc@)RobinieiTermServiceC:\Windows\System32\svchost.exe -k termsvcsp[qc@)RobinieiTermServiceC:\Windows\System32\svchost.exe -k termsvcsp[qc@)RobinieiPTrkWksC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted`p[qc@)RobinieiPUmRdpServiceC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestrictednhp[qc@)RobinieiMSDTCp[qc@)RobinieiVSSC:\Windows\system32\vssvc.exe`p[qc@)RobinieitWinmgmtC:\Windows\system32\svchost.exe -k netsvcsp[qc@)RobinieitWinmgmtC:\Windows\system32\svchost.exe -k netsvcslxp[qc@)RobinieiDhcp`p[qc@)Robiniei`WLMSC:\Windows\system32\wlms\wlms.exep[qc@)Robiniei`WLMSC:\Windows\system32\wlms\wlms.exevH[qc@)Robiniei
COMSysAppp
 [qc@)Robinieisppsvc" [qc@)RobinieitPlugPlayC:\Windows\system32\svchost.exe -k DcomLaunch&8 0	880" [qc@)RobinieitPlugPlayC:\Windows\system32\svchost.exe -k DcomLaunch" [qc@)RobinieitPlugPlayC:\Windows\system32\svchost.exe -k DcomLaunch" [qc@)RobinieitPlugPlayC:\Windows\system32\svchost.exe -k DcomLaunch" [qc@)RobinieitPlugPlayC:\Windows\system32\svchost.exe -k DcomLaunch" [qc@)RobinieitPlugPlayC:\Windows\system32\svchost.exe -k DcomLaunch" [qc@)RobinieitPlugPlayC:\Windows\system32\svchost.exe -k DcomLauncht" [qc@)RobinieiPlugPlay f$[qc@)RobinieiPWPDBusEnumC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestrictedx f$[qc@)RobinieiWPDBusEnum
&7	
8 p[qc@)RobinieiTermServiceC:\Windows\System32\svchost.exe -k termsvcs`p[qc@)RobinieiPTrkWksC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestrictediHp[qc@)Robiniei
8DhcpC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted`p[qc@)RobinieiPUxSmsC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestrictedwsp[qc@)RobinieiPUxSmsC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestrictedex`p[qc@)RobinieiVSSC:\Windows\system32\vssvc.exeys|p[qc@)RobinieiUmRdpServicenXp[qc@)RobinieiUxSmskpp[qc@)RobinieiTrkWkslp[qc@)RobinieiWLMSt0p[qc@)RobinieiCryptSvcinr[qc@)RobinieiProfSvcH[qc@)Robiniei
VSSC:\Windows\system32\vssvc.exerD5[qc@)RobinieiWinmgmtj[qc@)RobinieiVSStR\[qc@)Robinieieventlogz,n[qc@)RobinieiTermServiceʬbc	8`PZt)c[qc@)RobineePZt)c[qc@)RobinjkbZt)c[qc@)RobinggPlugPlaytZt)c[qc@)RobinieiPlugPlay
ٓd 	
884\c[qc@)RobinieiLPlugPlayC:\Windows\system32\svchost.exe -k DcomLaunch4\c[qc@)RobinieiLPlugPlayC:\Windows\system32\svchost.exe -k DcomLaunch4
c[qc@)RobinieiLPlugPlayC:\Windows\system32\svchost.exe -k DcomLaunch4
c[qc@)RobinieiLPlugPlayC:\Windows\system32\svchost.exe -k DcomLaunch4
c[qc@)RobinieiLPlugPlayC:\Windows\system32\svchost.exe -k DcomLaunch4
c[qc@)RobinieiLPlugPlayC:\Windows\system32\svchost.exe -k DcomLaunch4 c[qc@)RobinieiLPlugPlayC:\Windows\system32\svchost.exe -k DcomLaunchbc[qc@)RobinggPlugPlaync[qc@)RobinieiPowerc[qc@)RobinieiLPowerC:\Windows\system32\svchost.exe -k DcomLaunch4c[qc@)RobinieiLPowerC:\Windows\system32\svchost.exe -k DcomLaunchbc[qc@)RobinhgPlugPlayvc[qc@)RobinggCOM Infrastructurexc[qc@)RobinieiDcomLaunchc[qc@)RobinieiLDcomLaunchC:\Windows\system32\svchost.exe -k DcomLaunch|c[qc@)RobinieiRpcEptMapper$c[qc@)RobinieiLDcomLaunchC:\Windows\system32\svchost.exe -k DcomLaunch$c[qc@)RobinieiLDcomLaunchC:\Windows\system32\svchost.exe -k DcomLaunch$z0c[qc@)RobinieiRpcEptMapperC:\Windows\system32\svchost.exe -k RPCSS	ٓd		88~qgc[qc@)RobinieiLPlugPlayC:\Windows\system32\svchost.exe -k DcomLaunch4,c[qc@)RobinieiLPlugPlayC:\Windows\system32\svchost.exe -k DcomLaunch4 c[qc@)RobinieiLPlugPlayC:\Windows\system32\svchost.exe -k DcomLaunch$ c[qc@)RobinieiLPlugPlayC:\Windows\system32\svchost.exe -k DcomLaunch4 c[qc@)RobinieiLPlugPlayC:\Windows\system32\svchost.exe -k DcomLaunch4 c[qc@)RobinieiLPlugPlayC:\Windows\system32\svchost.exe -k DcomLaunchb c[qc@)RobinhgPlugPlay$c[qc@)RobinieiLPowerC:\Windows\system32\svchost.exe -k DcomLaunchc[qc@)RobinieiRpcEptMapperC:\Windows\system32\svchost.exe -k RPCSS$z0c[qc@)RobinieiRpcEptMapperC:\Windows\system32\svchost.exe -k RPCSSEInz0c[qc@)RobinieiRpcSsz0c[qc@)RobinieiRpcSsC:\Windows\system32\svchost.exe -k RPCSS$z0c[qc@)RobinieiRpcSsC:\Windows\system32\svchost.exe -k RPCSSJQ"k	`8$ej[qc@)RobinieiRpcSsC:\Windows\system32\svchost.exe -k RPCSSvej[qc@)RobinhgCOM Infrastructurez$,̻j[qc@)RobinieiTermService$.j[qc@)RobinieiTermServiceC:\Windows\System32\svchost.exe -k termsvcs$VAj[qc@)RobinieiTermServiceC:\Windows\System32\svchost.exe -k termsvcsRj>uȓOh:ST7k	8`|$$k[qc@)RobinieiUmRdpServicek$$k[qc@)Robiniei,UmRdpServiceC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestrictedz$bTk[qc@)RobinieiCertPropSvc$Vk[qc@)RobinieiTCertPropSvcC:\Windows\system32\svchost.exe -k netsvcsp$Vk[qc@)RobinggNetworkProviderj$Vk[qc@)Robinieinsi$Ȱbk[qc@)RobinieipnsiC:\Windows\system32\svchost.exe -k LocalService4"ek[qc@)RobinieipnsiC:\Windows\system32\svchost.exe -k LocalService40:lk[qc@)RobinieiTCertPropSvcC:\Windows\system32\svchost.exe -k netsvcs4uk[qc@)RobinieiTCertPropSvcC:\Windows\system32\svchost.exe -k netsvcs$tk[qc@)RobinieiLanmanWorkstation$hֈk[qc@)RobinieiLanmanWorkstationC:\Windows\System32\svchost.exe -k NetworkService4_k[qc@)RobinieiLanmanWorkstationC:\Windows\System32\svchost.exe -k NetworkService4_k[qc@)RobinieiLanmanWorkstationC:\Windows\System32\svchost.exe -k NetworkService_k[qc@)RobinieiLanmanWorkstationC:\Windows\System32\svchost.exe -k NetworkService4_k[qc@)RobinieiLanmanWorkstationC:\Windows\System32\svchost.exe -k NetworkService*”k[qc@)RobinieiLanmanWorkstationC:\Windows\System32\svchost.exe -k NetworkServicep$*”k[qc@)RobinhgNetworkProviderx$*”k[qc@)RobinieiSessionEnv$*”k[qc@)RobinieiTSessionEnvC:\Windows\system32\svchost.exe -k netsvcs$Kk[qc@)RobinieiTSessionEnvC:\Windows\system32\svchost.exe -k netsvcsPrk>uȓOh:S  J~Sl 	 88$T7k[qc@)RobinieiTSessionEnvC:\Windows\system32\svchost.exe -k netsvcsTT7k>uȓOh:STT7k>uȓOh:SC:\Windows\system32\oobe\oobeldr.exe /systemJ~Sl	884t7k[qc@)Robiniei,UmRdpServiceC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestrictedei4"ek[qc@)RobinieipnsiC:\Windows\system32\svchost.exe -k LocalService`~k>upN5;k"/systemfk>upN5;k"oobeSystem@Җk>upN5;k"oobeSystemC:\Windows\Panther\unattend.xmln00RC	088BJs
+/E=C:\Windows\panther\actionqueue\oobeSystem.uaq-k4BJs
+/E=C:\WINDOWS\SYSTEM32\RUNDLL32.EXEshsetup.dll,SHUnattendedSetupMicrosoft-Windows-Shell-Setup, Culture=neutral, Version=6.1.7601.17514, PublicKeyToken=31bf3856ad364e35, ProcessorArchitecture=amd64, versionScope=NonSxSoobeSystemei萹C		`8TjC
+/E=TjC
+/E=UC	8`TC>upN5;k"
PC>upN5;k"
C	88p$YC[qc@)Robinieisppsvc$RyC[qc@)RobinieisppsvcC:\Windows\system32\sppsvc.exe@4RyC[qc@)RobinieisppsvcC:\Windows\system32\sppsvc.exe۪C[qc@)RobinieisppsvcC:\Windows\system32\sppsvc.exebeHHC
	H8848pC[qc@)Robiniei,UmRdpServiceC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestrictedC 	8`$h7C[qc@)RobinieiNlaSvcC:\Windows\System32\svchost.exe -k NetworkService$8JC[qc@)RobinieiNlaSvcC:\Windows\System32\svchost.exe -k NetworkServicet48JC[qc@)Robinieinetprofm48JC[qc@)RobinieipnetprofmC:\Windows\system32\svchost.exe -k LocalService4VC[qc@)RobinieipnetprofmC:\Windows\system32\svchost.exe -k LocalService4wC[qc@)RobinieipnetprofmC:\Windows\system32\svchost.exe -k LocalServiceC	`8p4C[qc@)RobinieiNlaSvc4C[qc@)RobinieiNlaSvcC:\Windows\System32\svchost.exe -k NetworkService"DC	883C[qc@)RobinggFSFilter VirtualizationC[qc@)RobinhgFSFilter VirtualizationdC[qc@)RobinggEvent LogtC[qc@)Robinieieventlog4(lC[qc@)RobinieieventlogC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted-C[qc@)RobinieieventlogC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestrictedd-C[qc@)RobinhgEvent Logl-C[qc@)RobinggProfSvc_Groupn-C[qc@)Robinieigpsvc-C[qc@)RobinieiTgpsvcC:\Windows\system32\svchost.exe -k netsvcsr-C[qc@)RobinieiProfSvc-C[qc@)RobinieiTProfSvcC:\Windows\system32\svchost.exe -k netsvcs4n/@C[qc@)RobinieiTProfSvcC:\Windows\system32\svchost.exe -k netsvcs\n/@C[qc@)RobinieiTgpsvcC:\Windows\system32\svchost.exe -k netsvcs\n/@C[qc@)RobinieiTgpsvcC:\Windows\system32\svchost.exe -k netsvcs\ȑBC[qc@)RobinieiTProfSvcC:\Windows\system32\svchost.exe -k netsvcszȑBC[qc@)RobinieiEventSystemȑBC[qc@)RobinieipEventSystemC:\Windows\system32\svchost.exe -k LocalService\ȑBC[qc@)RobinieiTgpsvcC:\Windows\system32\svchost.exe -k netsvcs\ȑBC[qc@)RobinieiTgpsvcC:\Windows\system32\svchost.exe -k netsvcs\ȑBC[qc@)RobinieiTgpsvcC:\Windows\system32\svchost.exe -k netsvcs\ȑBC[qc@)RobinieiTgpsvcC:\Windows\system32\svchost.exe -k netsvcs\ȑBC[qc@)RobinieiTgpsvcC:\Windows\system32\svchost.exe -k netsvcshX,~C 	h8`\"DC[qc@)RobinieiTgpsvcC:\Windows\system32\svchost.exe -k netsvcsSer4}NC[qc@)RobinieipEventSystemC:\Windows\system32\svchost.exe -k LocalService4UC[qc@)RobinieipEventSystemC:\Windows\system32\svchost.exe -k LocalServicelUC[qc@)RobinieiSENScaUC[qc@)RobinieiTSENSC:\Windows\system32\svchost.exe -k netsvcs4._C[qc@)RobinieiTSENSC:\Windows\system32\svchost.exe -k netsvcs4._C[qc@)RobinieiTSENSC:\Windows\system32\svchost.exe -k netsvcsl._C[qc@)RobinhgProfSvc_GroupP._C[qc@)Robinkk`._C[qc@)RobinggUIGroupn._C[qc@)RobinieiUxSms._C[qc@)Robiniei,UxSmsC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted4cC[qc@)Robiniei,UxSmsC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted\cC[qc@)Robiniei,UxSmsC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted`cC[qc@)RobinhgUIGroupZcC[qc@)RobinggNDISZ*tC[qc@)RobinhgNDISX*tC[qc@)RobinggTDIl*tC[qc@)RobinieiDhcp*tC[qc@)RobinieiDhcpC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestrictedt*tC[qc@)RobinieiDnscache*tC[qc@)RobinieiDnscacheC:\Windows\System32\svchost.exe -k NetworkServicer*tC[qc@)Robinieilmhosts*tC[qc@)RobinieilmhostsC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted@@,~C	@88C[qc@)RobinieieventlogC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestrictededC	`84,~C[qc@)RobinieiDhcpC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted\,~C[qc@)RobinieilmhostsC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted\,~C[qc@)RobinieilmhostsC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted\FC[qc@)RobinieiDnscacheC:\Windows\System32\svchost.exe -k NetworkService4FC[qc@)RobinieiDnscacheC:\Windows\System32\svchost.exe -k NetworkService\SC[qc@)RobinieiDnscacheC:\Windows\System32\svchost.exe -k NetworkService4SC[qc@)RobinieiDnscacheC:\Windows\System32\svchost.exe -k NetworkService\SC[qc@)RobinieiDnscacheC:\Windows\System32\svchost.exe -k NetworkService4SC[qc@)RobinieiDnscacheC:\Windows\System32\svchost.exe -k NetworkService4SC[qc@)RobinieiDnscacheC:\Windows\System32\svchost.exe -k NetworkService\SC[qc@)RobinieiDnscacheC:\Windows\System32\svchost.exe -k NetworkService\SC[qc@)RobinieiDhcpC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted\C[qc@)RobinieiDhcpC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestrictedXC[qc@)RobinhgTDIlC[qc@)RobinggShellSvcGroupC[qc@)RobinieiShellHWDetectionC[qc@)RobinieiTShellHWDetectionC:\Windows\system32\svchost.exe -k netsvcs\C[qc@)RobinieiTShellHWDetectionC:\Windows\system32\svchost.exe -k netsvcs\C[qc@)RobinieiTShellHWDetectionC:\Windows\system32\svchost.exe -k netsvcs 	 C 	 	88lC[qc@)RobinhgShellSvcGroupalnC[qc@)RobinggSchedulerGrouprtC[qc@)RobinieiScheduleenC[qc@)RobinieiTScheduleC:\Windows\system32\svchost.exe -k netsvcs4NC[qc@)RobinieiTScheduleC:\Windows\system32\svchost.exe -k netsvcs46TC[qc@)RobinieiTScheduleC:\Windows\system32\svchost.exe -k netsvcsn6TC[qc@)RobinhgSchedulerGroupp6TC[qc@)RobinggNetworkProviderj6TC[qc@)RobinieiBFE46TC[qc@)RobinieiTScheduleC:\Windows\system32\svchost.exe -k netsvcs4peC[qc@)RobinieiBFEC:\Windows\system32\svchost.exe -k LocalServiceNoNetworkpC[qc@)RobinieiMpsSvcC[qc@)RobinieiMpsSvcC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork\[C[qc@)RobinieiMpsSvcC:\Windows\system32\svchost.exe -k LocalServiceNoNetworkC	88"WC[qc@)RobinieiBFEC:\Windows\system32\svchost.exe -k LocalServiceNoNetworkcC\zC[qc@)RobinieiBFEC:\Windows\system32\svchost.exe -k LocalServiceNoNetworkp /C	p8`\vC[qc@)RobinieiMpsSvcC:\Windows\system32\svchost.exe -k LocalServiceNoNetworkpvC[qc@)RobinhgNetworkProvidervC[qc@)RobinggMS_WindowsLocalValidationnvC[qc@)RobinieiSamSshvC[qc@)RobinieiSamSsC:\Windows\system32\lsass.exe\vC[qc@)RobinieiSamSsC:\Windows\system32\lsass.exevC[qc@)RobinhgMS_WindowsLocalValidationndjvC[qc@)RobinggSpoolerGroupRobinrޔC[qc@)RobinieiSpoolerostC[qc@)RobinieixSpoolerC:\Windows\System32\spoolsv.exeC[qc@)RobinieixSpoolerC:\Windows\System32\spoolsv.exe
C[qc@)RobinieixSpoolerC:\Windows\System32\spoolsv.exe\
C[qc@)RobinieixSpoolerC:\Windows\System32\spoolsv.exej
C[qc@)RobinhgSpoolerGroupem3l
C[qc@)RobinggExtended Base\$XC[qc@)RobinieiCryptSvcC:\Windows\System32\svchost.exe -k NetworkServicee\$XC[qc@)RobinieiCryptSvcC:\Windows\System32\svchost.exe -k NetworkServiceC[qc@)RobinieiRemoteRegistryC:\Windows\system32\svchost.exe -k regsvcei$C[qc@)RobinieiRemoteRegistryC:\Windows\system32\svchost.exe -k regsvcsvcrC[qc@)RobinieiWinmgmtc@C[qc@)RobinieiTWinmgmtC:\Windows\system32\svchost.exe -k netsvcse$/C[qc@)Robiniei,TrkWksC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted$/C[qc@)Robiniei,TrkWksC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestrictedC 	`8/C[qc@)RobinieiWLMSC:\Windows\system32\wlms\wlms.exe C[qc@)RobinieiWLMSC:\Windows\system32\wlms\wlms.exeC[qc@)RobinieiWLMSC:\Windows\system32\wlms\wlms.exeinr!C[qc@)RobinieiTiphlpsvcC:\Windows\system32\svchost.exe -k netsvcsr!C[qc@)RobinieiTiphlpsvcC:\Windows\system32\svchost.exe -k netsvcsr!C[qc@)RobinieiTLanmanServerC:\Windows\system32\svchost.exe -k netsvcs OC[qc@)RobinieiTLanmanServerC:\Windows\system32\svchost.exe -k netsvcsOC[qc@)RobinieiTLanmanServerC:\Windows\system32\svchost.exe -k netsvcs걊C[qc@)RobinieiVMTools"C:\Program Files\VMware\VMware Tools\vmtoolsd.exe"걊C[qc@)RobinieiVMTools"C:\Program Files\VMware\VMware Tools\vmtoolsd.exe"걊C[qc@)RobinieiVMTools"C:\Program Files\VMware\VMware Tools\vmtoolsd.exe"P걊C[qc@)RobinfexDC[qc@)RobinieiWPDBusEnumDC[qc@)Robiniei,WPDBusEnumC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricteda\ؑC[qc@)RobinieiTAeLookupSvcC:\Windows\system32\svchost.exe -k netsvcscؑC[qc@)RobinieiTAeLookupSvcC:\Windows\system32\svchost.exe -k netsvcs@ؑC[qc@)RobinieiTAeLookupSvcC:\Windows\system32\svchost.exe -k netsvcsnؑC[qc@)RobinieiTAeLookupSvcC:\Windows\system32\svchost.exe -k netsvcs ؑC[qc@)RobinieiTAeLookupSvcC:\Windows\system32\svchost.exe -k netsvcseؑC[qc@)RobinieiTAeLookupSvcC:\Windows\system32\svchost.exe -k netsvcst
C	
88l1C[qc@)RobinhgExtended Baseogt1C[qc@)RobinieiCryptSvctr1C[qc@)RobinieiCryptSvcC:\Windows\System32\svchost.exe -k NetworkServiceC[qc@)RobinieiRemoteRegistryC[qc@)RobinieiRemoteRegistryC:\Windows\system32\svchost.exe -k regsvcpC[qc@)RobinieiTrkWksC[qc@)Robiniei,TrkWksC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestrictedlC[qc@)RobinieiWLMSҤC[qc@)RobinieiTWinmgmtC:\Windows\system32\svchost.exe -k netsvcsҤC[qc@)RobinieiTWinmgmtC:\Windows\system32\svchost.exe -k netsvcstҤC[qc@)RobinieiiphlpsvcҤC[qc@)RobinieiTiphlpsvcC:\Windows\system32\svchost.exe -k netsvcs|ҤC[qc@)RobinieiLanmanServerҤC[qc@)RobinieiTLanmanServerC:\Windows\system32\svchost.exe -k netsvcsrҤC[qc@)RobinieiVMToolsz$DC[qc@)RobinieiAeLookupSvc$DC[qc@)RobinieiTAeLookupSvcC:\Windows\system32\svchost.exe -k netsvcsؑC[qc@)RobinieiTAeLookupSvcC:\Windows\system32\svchost.exe -k netsvcs4ؑC[qc@)Robiniei,WPDBusEnumC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted4R;C[qc@)Robiniei,WPDBusEnumC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestrictedXX*9 	X8`4[qc@)Robiniei<vmvssC:\Windows\system32\dllhost.exe /Processid:{95CD2B70-6CAD-44D7-9F77-0C461667D121}*9	88n(C[qc@)RobinieivmvssW[qc@)Robiniei<vmvssC:\Windows\system32\dllhost.exe /Processid:{95CD2B70-6CAD-44D7-9F77-0C461667D121}4[qc@)Robiniei<vmvssC:\Windows\system32\dllhost.exe /Processid:{95CD2B70-6CAD-44D7-9F77-0C461667D121}v4c+[qc@)RobinieiCOMSysApp4h-[qc@)RobinieiLCOMSysAppC:\Windows\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}4h-[qc@)RobinieiLCOMSysAppC:\Windows\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}4'0[qc@)RobinieiLCOMSysAppC:\Windows\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}``*j 	``8n4f[qc@)RobinieiMSDTC\0[qc@)RobinieiMSDTCC:\Windows\System32\msdtc.exe*j	884^[qc@)RobinieiMSDTCC:\Windows\System32\msdtc.exe^[qc@)RobinieiMSDTCC:\Windows\System32\msdtc.exe*쑔 	8`j0>C[qc@)RobinieiVSSC:0[[qc@)RobinieiVSSC:\Windows\system32\vssvc.exe4[[qc@)RobinieiVSSC:\Windows\system32\vssvc.exe*쑔 	884nx][qc@)RobinieiVSSC:\Windows\system32\vssvc.exePP곞!	P`8T>upN5;k"
T>upN5;k"
TrN>uȓOh:SmsdT"	88TdT>uȓOh:S

Anon7 - 2022
AnonSec Team