There are some keys in HKLM\System\CurrentControlSet\Control\Session Manager, including
BootExecute and PendingFileRenameOperations.
Which starts first ? BootExecute or PendingFileRenameOperations ???
2 Answers
According to a Sysinternals Process Monitor bootlog (and unsurprisingly...) BootExecute start first then PendingFileRenameOperations...
In my log
BootExecute start at 18:43:45, 4660048
PendingFileRenameOperations start at 18:43:45, 4861988
BootExecute will start first (most likely because it can be used to do jobs to bring the file system in order, e.g. do a checkdisk, complete partition management, etc.), without which there would be no renaming because no file system.