kmckean1
Contributor
Contributor

VMware UEM Error - FlexEngine.dll library file. Please check your installation.

Hi All,

I have installed different versions (8.7 & 9.3) of the UEM agent, and recomposed the pool in Horizon.

After logging onto the VDI I receive a UEM error (as below):

flexengine.dll.png

The same group policies are applied to a different pool's OU and all works normal.

Any ideas at all on this error, I am unable to find anything obvious online.

Thank you.

Kevin

Tags (1)
0 Kudos
28 Replies
DEMdev
VMware Employee
VMware Employee

Hi kmckean1,

I suggest to double-check the installation. Can you show a screenshot of the installation folder (typically C:\Program Files\Immidio\Flex Profiles), with the File version column added? Right-click on one of the column headers, pick More... from the context menu, select File version in the list, until you see something like:

pastedImage_4.png

BTW, what exactly do you mean by having installed different versions of the UEM agent? Are you running multiple versions concurrently in your environment? That's not necessarily a problem, but please make sure that the 8.7 agent does not encounter 9.3 configuration – it's backwards compatible, but not forwards compatible.

0 Kudos
kmckean1
Contributor
Contributor

Hi,

Apologies for the Flux daylight colouring on screenshot : ]

Only using UEM agent ver.9.3 in this gold image.


0 Kudos
kmckean1
Contributor
Contributor

pastedImage_0.png

0 Kudos
DEMdev
VMware Employee
VMware Employee

Hmmm, that looks OK indeed (even with the cool gold sheen to your screenshot of your gold image 🙂

Can you try running something simple like FlexEngine.exe -? with ProcMon running, to see what exactly is going on?

0 Kudos
kmckean1
Contributor
Contributor

: )

When I run that, it generates the same error only:

Also, ProcMon logs all look pretty OK, mainly reporting Success in FlexEngine processes:

pastedImage_0.png

Thanks!

0 Kudos
kmckean1
Contributor
Contributor

tracking the process:

pastedImage_0.png

0 Kudos
DEMdev
VMware Employee
VMware Employee

It would give us more insight if you filter on the FlexEngine.exe process, so we can see what exactly what's going on.

0 Kudos
kmckean1
Contributor
Contributor

"Time of Day","Process Name","PID","Operation","Path","Result","Detail"

"12:34:24.3154730","FlexEngine.exe","7980","Process Start","","SUCCESS","Parent PID: 4696, Command line: ""C:\Program Files\Immidio\Flex Profiles\FlexEngine.exe"" , Current directory: C:\Program Files\Immidio\Flex Profiles\, Environment:

; ALLUSERSPROFILE=C:\ProgramData

; APPDATA=C:\Users\\AppData\Roaming

; CommonProgramFiles=C:\Program Files\Common Files

; CommonProgramFiles(x86)=C:\Program Files (x86)\Common Files

; CommonProgramW6432=C:\Program Files\Common Files

; COMPUTERNAME=VDI-GEN-003

; ComSpec=C:\Windows\system32\cmd.exe

; FP_NO_HOST_CHECK=NO

; HOMEDRIVE=C:

; HOMEPATH=\Users\

; LOCALAPPDATA=C:\Users\\AppData\Local

; LOGONSERVER=\\DC-02

; NUMBER_OF_PROCESSORS=2

; OS=Windows_NT

; PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC

; PROCESSOR_ARCHITECTURE=AMD64

; PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 63 Stepping 2, GenuineIntel

; PROCESSOR_LEVEL=6

; PROCESSOR_REVISION=3f02

; ProgramData=C:\ProgramData

; ProgramFiles=C:\Program Files

; ProgramFiles(x86)=C:\Program Files (x86)

; ProgramW6432=C:\Program Files

; PSModulePath=C:\Windows\system32\WindowsPowerShell\v1.0\Modules\

; PUBLIC=C:\Users\Public

; READSOFTINVOICESLOCAL=C:\Users\Public\ReadSoft\INVOICES\

; SESSIONNAME=Console

; SVAgent=C:\Program Files (x86)\CloudVolumes\Agent\

; SystemDrive=C:

; SystemRoot=C:\Windows

; TEMP=C:\Users\\AppData\Local\Temp

; TMP=C:\Users\\AppData\Local\Temp

; USERDNSDOMAIN=

; USERDOMAIN=

; USERNAME=

; USERPROFILE=C:\Users\

; ViewClient_Broker_DNS_Name=CB-01.

; ViewClient_Broker_DomainName=

; ViewClient_Broker_GatewayLocation=Internal

; ViewClient_Broker_GatewayType=SG-cohosted

; ViewClient_Broker_Remote_IP_Address=10.150.14.56

; ViewClient_Broker_Tunneled=true

; ViewClient_Broker_Tunnel_URL=https://CB-01.:443

; ViewClient_Broker_URL=https://cb-01:443

; ViewClient_Broker_UserName=

; ViewClient_Client_ID=AgAAALMsH0RYGR3Gsmv8+C2U15E=

; ViewClient_Displays.Number=1

; ViewClient_Displays.SystemDpi=96

; ViewClient_Displays.Topology={1274,731,0,0,32,1}

; ViewClient_Displays.TopologyV2={1274,731,0,0,32,1,96}

; ViewClient_IP_Address=10.150.14.56

; ViewClient_Keyboard.KeyDelayToRepeat=1

; ViewClient_Keyboard.KeyRepeatRate=31

; ViewClient_Keyboard.Language=1033

; ViewClient_Keyboard.Layout=00000409

; ViewClient_Keyboard.NumFuncKeys=12

; ViewClient_Keyboard.NumIndicators=3

; ViewClient_Keyboard.NumKeys=101

; ViewClient_Keyboard.ScanCodeMode=1

; ViewClient_Keyboard.SubType=0

; ViewClient_Keyboard.Type=7

; ViewClient_Language=en-GB

; ViewClient_Launch_ID=VDI-General-Users

; ViewClient_Launch_SessionType=DESKTOP

; ViewClient_LoggedOn_Domainname=

; ViewClient_LoggedOn_FQDN=be.co.uk

; ViewClient_LoggedOn_Username=

; ViewClient_Machine_Domain=

; ViewClient_Machine_FQDN=

; ViewClient_Machine_Name=APV-01

; ViewClient_MAC_Address=00-50-56-A9-59-95

; ViewClient_Mouse.Identifier=2

; ViewClient_Mouse.NumButtons=2

; ViewClient_Mouse.SampleRate=60

; ViewClient_Protocol=PCOIP

; ViewClient_Type=Windows

; ViewClient_TZID=GMT

; ViewClient_Windows_Timezone=GMT Standard Time

; VS140COMNTOOLS=C:\Program Files (x86)\Microsoft Visual Studio 14.0\Common7\Tools\

; windir=C:\Windows

; windows_tracing_flags=3

; windows_tracing_logfile=C:\BVTBin\Tests\installpackage\csilogfile.log"

"12:34:24.3154919","FlexEngine.exe","7980","Thread Create","","SUCCESS","Thread ID: 7996"

"12:34:24.3311682","FlexEngine.exe","7980","Load Image","C:\Program Files\Immidio\Flex Profiles\FlexEngine.exe","SUCCESS","Image Base: 0x13f330000, Image Size: 0xd5000"

"12:34:24.3313115","FlexEngine.exe","7980","Load Image","C:\Windows\System32\ntdll.dll","SUCCESS","Image Base: 0x77550000, Image Size: 0x1aa000"

"12:34:24.3316830","FlexEngine.exe","7980","CreateFile","C:\Windows\Prefetch\FLEXENGINE.EXE-89F2CE32.pf","SUCCESS","Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Attributes: n/a, ShareMode: None, AllocationSize: n/a, OpenResult: Opened"

"12:34:24.3319931","FlexEngine.exe","7980","QueryStandardInformationFile","C:\Windows\Prefetch\FLEXENGINE.EXE-89F2CE32.pf","SUCCESS","AllocationSize: 24,576, EndOfFile: 22,034, NumberOfLinks: 1, DeletePending: False, Directory: False"

"12:34:24.3320241","FlexEngine.exe","7980","ReadFile","C:\Windows\Prefetch\FLEXENGINE.EXE-89F2CE32.pf","SUCCESS","Offset: 0, Length: 22,034, Priority: Normal"

"12:34:24.3320785","FlexEngine.exe","7980","ReadFile","C:\Windows\Prefetch\FLEXENGINE.EXE-89F2CE32.pf","SUCCESS","Offset: 0, Length: 22,034, I/O Flags: Non-cached, Paging I/O, Priority: Normal"

"12:34:24.3359188","FlexEngine.exe","7980","CloseFile","C:\Windows\Prefetch\FLEXENGINE.EXE-89F2CE32.pf","SUCCESS",""

"12:34:24.3360102","FlexEngine.exe","7980","RegOpenKey","HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options","SUCCESS","Desired Access: Query Value, Enumerate Sub Keys"

"12:34:24.3362658","FlexEngine.exe","7980","RegQueryKeySecurity","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options","SUCCESS",""

"12:34:24.3362855","FlexEngine.exe","7980","RegQueryValue","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DisableUserModeCallbackFilter","NAME NOT FOUND","Length: 1,024"

"12:34:24.3363223","FlexEngine.exe","7980","RegOpenKey","HKLM\System\CurrentControlSet\Control\Session Manager","SUCCESS","Desired Access: Read"

"12:34:24.3365561","FlexEngine.exe","7980","RegQueryKeySecurity","HKLM\System\CurrentControlSet\Control\SESSION MANAGER","SUCCESS",""

"12:34:24.3365684","FlexEngine.exe","7980","RegQueryValue","HKLM\System\CurrentControlSet\Control\SESSION MANAGER\CWDIllegalInDLLSearch","NAME NOT FOUND","Length: 1,024"

"12:34:24.3366994","FlexEngine.exe","7980","RegCloseKey","HKLM\System\CurrentControlSet\Control\SESSION MANAGER","SUCCESS",""

"12:34:24.3370869","FlexEngine.exe","7980","CreateFile","C:\Program Files\Immidio\Flex Profiles","SUCCESS","Desired Access: Execute/Traverse, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"

"12:34:24.3372618","FlexEngine.exe","7980","ReadFile","C:\Program Files\Immidio\Flex Profiles\FlexEngine.exe","SUCCESS","Offset: 434,176, Length: 4,608, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O, Priority: Normal"

"12:34:24.3390285","FlexEngine.exe","7980","Load Image","C:\Windows\System32\kernel32.dll","SUCCESS","Image Base: 0x77330000, Image Size: 0x11f000"

"12:34:24.3392080","FlexEngine.exe","7980","Load Image","C:\Windows\System32\KernelBase.dll","SUCCESS","Image Base: 0x7fefd4b0000, Image Size: 0x6a000"

"12:34:24.3407841","FlexEngine.exe","7980","RegOpenKey","HKLM\System\CurrentControlSet\Control\SafeBoot\Option","NAME NOT FOUND","Desired Access: Query Value, Set Value"

"12:34:24.3410028","FlexEngine.exe","7980","RegOpenKey","HKLM\System\CurrentControlSet\Control\Srp\GP\DLL","NAME NOT FOUND","Desired Access: Read"

"12:34:24.3411956","FlexEngine.exe","7980","RegOpenKey","HKLM\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers","SUCCESS","Desired Access: Query Value"

"12:34:24.3415525","FlexEngine.exe","7980","RegQueryValue","HKLM\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\TransparentEnabled","NAME NOT FOUND","Length: 80"

"12:34:24.3415840","FlexEngine.exe","7980","RegCloseKey","HKLM\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers","SUCCESS",""

"12:34:24.3416004","FlexEngine.exe","7980","RegOpenKey","HKCU\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers","NAME NOT FOUND","Desired Access: Query Value"

"12:34:24.3416948","FlexEngine.exe","7980","ReadFile","C:\Program Files\Immidio\Flex Profiles\FlexEngine.exe","SUCCESS","Offset: 417,792, Length: 16,384, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O, Priority: Normal"

"12:34:24.3417804","FlexEngine.exe","7980","ReadFile","C:\Program Files\Immidio\Flex Profiles\FlexEngine.exe","SUCCESS","Offset: 339,968, Length: 16,384, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O, Priority: Normal"

"12:34:24.3423495","FlexEngine.exe","7980","Load Image","C:\Windows\System32\user32.dll","SUCCESS","Image Base: 0x77450000, Image Size: 0xfa000"

"12:34:24.3425165","FlexEngine.exe","7980","Load Image","C:\Windows\System32\gdi32.dll","SUCCESS","Image Base: 0x7fefd610000, Image Size: 0x67000"

"12:34:24.3426814","FlexEngine.exe","7980","Load Image","C:\Windows\System32\lpk.dll","SUCCESS","Image Base: 0x7feff640000, Image Size: 0xe000"

"12:34:24.3428358","FlexEngine.exe","7980","Load Image","C:\Windows\System32\usp10.dll","SUCCESS","Image Base: 0x7fefdf60000, Image Size: 0xcb000"

"12:34:24.3429612","FlexEngine.exe","7980","Load Image","C:\Windows\System32\msvcrt.dll","SUCCESS","Image Base: 0x7fefdec0000, Image Size: 0x9f000"

"12:34:24.3433161","FlexEngine.exe","7980","Load Image","C:\Windows\System32\advapi32.dll","SUCCESS","Image Base: 0x7feff650000, Image Size: 0xdb000"

"12:34:24.3436185","FlexEngine.exe","7980","CreateFile","C:\Windows\System32\sechost.dll","SUCCESS","Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"

"12:34:24.3437550","FlexEngine.exe","7980","QueryBasicInformationFile","C:\Windows\System32\sechost.dll","SUCCESS","CreationTime: 06/11/2017 15:11:18, LastAccessTime: 06/11/2017 15:11:18, LastWriteTime: 25/05/2015 18:19:09, ChangeTime: 06/11/2017 17:10:26, FileAttributes: A"

"12:34:24.3437685","FlexEngine.exe","7980","CloseFile","C:\Windows\System32\sechost.dll","SUCCESS",""

"12:34:24.3439013","FlexEngine.exe","7980","CreateFile","C:\Windows\System32\sechost.dll","SUCCESS","Desired Access: Read Data/List Directory, Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened"

"12:34:24.3440380","FlexEngine.exe","7980","CreateFileMapping","C:\Windows\System32\sechost.dll","FILE LOCKED WITH ONLY READERS","SyncType: SyncTypeCreateSection, PageProtection: "

"12:34:24.3440643","FlexEngine.exe","7980","CreateFileMapping","C:\Windows\System32\sechost.dll","SUCCESS","SyncType: SyncTypeOther"

"12:34:24.3441666","FlexEngine.exe","7980","Load Image","C:\Windows\System32\sechost.dll","SUCCESS","Image Base: 0x7fefdc70000, Image Size: 0x1f000"

"12:34:24.3441851","FlexEngine.exe","7980","CloseFile","C:\Windows\System32\sechost.dll","SUCCESS",""

"12:34:24.3443726","FlexEngine.exe","7980","Load Image","C:\Windows\System32\rpcrt4.dll","SUCCESS","Image Base: 0x7feff730000, Image Size: 0x12d000"

"12:34:24.3446840","FlexEngine.exe","7980","Load Image","C:\Windows\System32\ole32.dll","SUCCESS","Image Base: 0x7fefd780000, Image Size: 0x1fc000"

"12:34:24.3449236","FlexEngine.exe","7980","Load Image","C:\Windows\System32\oleaut32.dll","SUCCESS","Image Base: 0x7feff1d0000, Image Size: 0xda000"

"12:34:24.3454481","FlexEngine.exe","7980","CreateFile","C:\Program Files\Immidio\Flex Profiles\WTSAPI32.dll","NAME NOT FOUND","Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"

"12:34:24.3458607","FlexEngine.exe","7980","CreateFile","C:\Windows\System32\wtsapi32.dll","SUCCESS","Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"

"12:34:24.3459965","FlexEngine.exe","7980","QueryBasicInformationFile","C:\Windows\System32\wtsapi32.dll","SUCCESS","CreationTime: 14/07/2009 00:17:14, LastAccessTime: 14/07/2009 00:17:14, LastWriteTime: 14/07/2009 01:41:58, ChangeTime: 06/11/2017 21:42:40, FileAttributes: A"

"12:34:24.3460093","FlexEngine.exe","7980","CloseFile","C:\Windows\System32\wtsapi32.dll","SUCCESS",""

"12:34:24.3465487","FlexEngine.exe","7980","CreateFile","C:\Windows\System32\wtsapi32.dll","SUCCESS","Desired Access: Read Data/List Directory, Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened"

"12:34:24.3468071","FlexEngine.exe","7980","CreateFileMapping","C:\Windows\System32\wtsapi32.dll","FILE LOCKED WITH ONLY READERS","SyncType: SyncTypeCreateSection, PageProtection: "

"12:34:24.3468656","FlexEngine.exe","7980","CreateFileMapping","C:\Windows\System32\wtsapi32.dll","SUCCESS","SyncType: SyncTypeOther"

"12:34:24.3469796","FlexEngine.exe","7980","Load Image","C:\Windows\System32\wtsapi32.dll","SUCCESS","Image Base: 0x7fefc4b0000, Image Size: 0x11000"

"12:34:24.3469961","FlexEngine.exe","7980","CloseFile","C:\Windows\System32\wtsapi32.dll","SUCCESS",""

"12:34:24.3471972","FlexEngine.exe","7980","Load Image","C:\Windows\System32\shlwapi.dll","SUCCESS","Image Base: 0x7fefd700000, Image Size: 0x71000"

"12:34:24.3473060","FlexEngine.exe","7980","RegOpenKey","HKLM\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots","NAME NOT FOUND","Desired Access: Enumerate Sub Keys"

"12:34:24.3481073","FlexEngine.exe","7980","CreateFile","C:\Program Files\Immidio\Flex Profiles\FlexEngine.exe.Local","NAME NOT FOUND","Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"

"12:34:24.3491577","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad878b7-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS","Desired Access: All Access"

"12:34:24.3492052","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD878B7-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WINSXS\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3492686","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD878B7-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WINSXS","SUCCESS",""

"12:34:24.3493079","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad878b1-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3493496","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad878ab-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS","Desired Access: All Access"

"12:34:24.3493816","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD878AB-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WinSxS\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3494337","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD878AB-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS",""

"12:34:24.3494652","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad878a5-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3495042","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad8789e-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS","Desired Access: All Access"

"12:34:24.3495506","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD8789E-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\WINDOWS\WinSxS\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3495994","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD8789E-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\WINDOWS\WinSxS","SUCCESS",""

"12:34:24.3496335","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad8788c-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS","Desired Access: All Access"

"12:34:24.3496763","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD8788C-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WINSXS\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3497326","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD8788C-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WINSXS","SUCCESS",""

"12:34:24.3497669","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad8787f-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS","Desired Access: All Access"

"12:34:24.3498031","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD8787F-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WinSxS\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3498511","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD8787F-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS",""

"12:34:24.3498860","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87873-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS","Desired Access: All Access"

"12:34:24.3499215","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD87873-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WINSXS\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3499700","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD87873-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WINSXS","SUCCESS",""

"12:34:24.3500070","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87861-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS","Desired Access: All Access"

"12:34:24.3500454","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD87861-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WinSxS\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3500946","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD87861-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS",""

"12:34:24.3501303","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87839-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3501676","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87841-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS","Desired Access: All Access"

"12:34:24.3502003","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD87841-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WinSxS\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3502506","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD87841-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS",""

"12:34:24.3502855","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87818-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS","Desired Access: All Access"

"12:34:24.3503192","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD87818-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\WINDOWS\WinSxS\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3504362","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD87818-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\WINDOWS\WinSxS","SUCCESS",""

"12:34:24.3504680","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87826-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS","Desired Access: All Access"

"12:34:24.3504967","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD87826-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WinSxS\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3505425","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD87826-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS",""

"12:34:24.3505713","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87811-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS","Desired Access: All Access"

"12:34:24.3506004","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD87811-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WINSXS\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3506473","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD87811-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WINSXS","SUCCESS",""

"12:34:24.3507004","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad878b7-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS","Desired Access: All Access"

"12:34:24.3507314","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD878B7-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WINSXS\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3507805","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD878B7-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WINSXS","SUCCESS",""

"12:34:24.3508114","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad878b1-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3508485","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad878ab-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS","Desired Access: All Access"

"12:34:24.3508862","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD878AB-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WinSxS\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3509341","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD878AB-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS",""

"12:34:24.3509660","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad878a5-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3510023","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad8789e-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS","Desired Access: All Access"

"12:34:24.3510360","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD8789E-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\WINDOWS\WinSxS\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3510803","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD8789E-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\WINDOWS\WinSxS","SUCCESS",""

"12:34:24.3511121","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad8788c-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS","Desired Access: All Access"

"12:34:24.3511443","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD8788C-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WINSXS\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3511922","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD8788C-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WINSXS","SUCCESS",""

"12:34:24.3512200","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad8787f-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS","Desired Access: All Access"

"12:34:24.3512565","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD8787F-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WinSxS\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3513050","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD8787F-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS",""

"12:34:24.3513339","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87873-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS","Desired Access: All Access"

"12:34:24.3513601","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD87873-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WINSXS\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3514015","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD87873-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WINSXS","SUCCESS",""

"12:34:24.3514292","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87861-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS","Desired Access: All Access"

"12:34:24.3514548","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD87861-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WinSxS\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3514970","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD87861-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS",""

"12:34:24.3515246","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87839-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3515547","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87841-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS","Desired Access: All Access"

"12:34:24.3515799","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD87841-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WinSxS\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3516213","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD87841-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS",""

"12:34:24.3516491","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87818-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS","Desired Access: All Access"

"12:34:24.3516743","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD87818-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\WINDOWS\WinSxS\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3517157","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD87818-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\WINDOWS\WinSxS","SUCCESS",""

"12:34:24.3517429","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87826-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS","Desired Access: All Access"

"12:34:24.3517681","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD87826-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WinSxS\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3518091","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD87826-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS",""

"12:34:24.3518356","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87811-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS","Desired Access: All Access"

"12:34:24.3518629","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD87811-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WINSXS\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3519079","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD87811-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WINSXS","SUCCESS",""

"12:34:24.3521569","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad878b7-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS","Desired Access: All Access"

"12:34:24.3522061","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD878B7-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WINSXS\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3522521","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD878B7-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WINSXS","SUCCESS",""

"12:34:24.3522820","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad878b1-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3523134","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad878ab-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS","Desired Access: All Access"

"12:34:24.3523399","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD878AB-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WinSxS\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3523831","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD878AB-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS",""

"12:34:24.3524117","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad878a5-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3524426","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad8789e-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS","Desired Access: All Access"

"12:34:24.3524694","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD8789E-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\WINDOWS\WinSxS\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3525194","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD8789E-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\WINDOWS\WinSxS","SUCCESS",""

"12:34:24.3525486","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad8788c-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS","Desired Access: All Access"

"12:34:24.3525753","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD8788C-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WINSXS\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3526190","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD8788C-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WINSXS","SUCCESS",""

"12:34:24.3526472","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad8787f-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS","Desired Access: All Access"

"12:34:24.3526733","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD8787F-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WinSxS\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3527149","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD8787F-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS",""

"12:34:24.3527431","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87873-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS","Desired Access: All Access"

"12:34:24.3527721","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD87873-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WINSXS\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3528145","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD87873-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WINSXS","SUCCESS",""

"12:34:24.3528429","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87861-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS","Desired Access: All Access"

"12:34:24.3528687","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD87861-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WinSxS\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3529103","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD87861-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS",""

"12:34:24.3529384","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87839-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3529688","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87841-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS","Desired Access: All Access"

"12:34:24.3529953","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD87841-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WinSxS\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3530372","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD87841-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS",""

"12:34:24.3530655","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87818-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS","Desired Access: All Access"

"12:34:24.3530913","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD87818-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\WINDOWS\WinSxS\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3531332","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD87818-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\WINDOWS\WinSxS","SUCCESS",""

"12:34:24.3531614","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87826-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS","Desired Access: All Access"

"12:34:24.3531872","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD87826-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WinSxS\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3532286","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD87826-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS",""

"12:34:24.3532556","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87811-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS","Desired Access: All Access"

"12:34:24.3532821","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD87811-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WINSXS\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3533237","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD87811-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WINSXS","SUCCESS",""

"12:34:24.3533671","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad878b7-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS","Desired Access: All Access"

"12:34:24.3533927","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD878B7-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WINSXS\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3534353","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD878B7-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WINSXS","SUCCESS",""

"12:34:24.3534629","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad878b1-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3534923","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad878ab-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS","Desired Access: All Access"

"12:34:24.3535214","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD878AB-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WinSxS\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3535685","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD878AB-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS",""

"12:34:24.3535967","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad878a5-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3536326","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad8789e-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS","Desired Access: All Access"

"12:34:24.3536620","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD8789E-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\WINDOWS\WinSxS\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3537196","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD8789E-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\WINDOWS\WinSxS","SUCCESS",""

"12:34:24.3537515","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad8788c-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS","Desired Access: All Access"

"12:34:24.3537811","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD8788C-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WINSXS\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3538272","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD8788C-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WINSXS","SUCCESS",""

"12:34:24.3538550","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad8787f-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS","Desired Access: All Access"

"12:34:24.3538799","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD8787F-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WinSxS\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3539280","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD8787F-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS",""

"12:34:24.3539586","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87873-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS","Desired Access: All Access"

"12:34:24.3539876","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD87873-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WINSXS\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3540335","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD87873-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WINSXS","SUCCESS",""

"12:34:24.3540627","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87861-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS","Desired Access: All Access"

"12:34:24.3540946","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD87861-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WinSxS\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3541410","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD87861-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS",""

"12:34:24.3541808","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87839-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3542156","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87841-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS","Desired Access: All Access"

"12:34:24.3542467","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD87841-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WinSxS\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3542992","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD87841-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS",""

"12:34:24.3543314","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87818-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS","Desired Access: All Access"

"12:34:24.3543625","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD87818-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\WINDOWS\WinSxS\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3544088","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD87818-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\WINDOWS\WinSxS","SUCCESS",""

"12:34:24.3544385","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87826-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS","Desired Access: All Access"

"12:34:24.3544671","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD87826-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WinSxS\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3545125","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD87826-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS",""

"12:34:24.3545430","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87811-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS","Desired Access: All Access"

"12:34:24.3545741","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD87811-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WINSXS\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3546201","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD87811-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WINSXS","SUCCESS",""

"12:34:24.3546995","FlexEngine.exe","7980","CreateFile","C:\Windows\winsxs\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757","SUCCESS","Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"

"12:34:24.3547753","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad878b7-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3548127","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad878b1-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3548427","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad878ab-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3548704","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad878a5-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3548999","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad8789e-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3549279","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad8788c-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3549575","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad8787f-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3549852","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87873-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3550145","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87861-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3550439","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87839-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3550735","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87841-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3551032","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87818-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3551332","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87826-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3551607","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87811-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757","SUCCESS","Desired Access: All Access"

"12:34:24.3551911","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD87811-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WINSXS\AMD64_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_6.0.7601.18837_NONE_FA3B1E3D17594757\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3552364","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD87811-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WINSXS\AMD64_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_6.0.7601.18837_NONE_FA3B1E3D17594757","SUCCESS",""

"12:34:24.3552888","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad878b7-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3553153","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad878b1-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3553445","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad878ab-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3553767","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad878a5-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3554008","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad8789e-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3554249","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad8788c-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3554511","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad8787f-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3554837","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87873-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3555104","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87861-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3555395","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87839-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3555681","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87841-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3555970","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87818-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3556301","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87826-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3556553","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87811-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757","SUCCESS","Desired Access: All Access"

"12:34:24.3556780","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD87811-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WINSXS\AMD64_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_6.0.7601.18837_NONE_FA3B1E3D17594757\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3557210","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD87811-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WINSXS\AMD64_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_6.0.7601.18837_NONE_FA3B1E3D17594757","SUCCESS",""

"12:34:24.3557459","FlexEngine.exe","7980","QueryBasicInformationFile","C:\Windows\winsxs\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757","SUCCESS","CreationTime: 06/11/2017 15:41:13, LastAccessTime: 06/11/2017 15:41:13, LastWriteTime: 06/11/2017 15:41:13, ChangeTime: 06/11/2017 15:41:13, FileAttributes: D"

"12:34:24.3557644","FlexEngine.exe","7980","CloseFile","C:\Windows\winsxs\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757","SUCCESS",""

"12:34:24.3558746","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad878b7-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS","Desired Access: All Access"

"12:34:24.3559127","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD878B7-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WINSXS\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3559653","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD878B7-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WINSXS","SUCCESS",""

"12:34:24.3560018","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad878b1-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3560385","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad878ab-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS","Desired Access: All Access"

"12:34:24.3560709","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD878AB-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WinSxS\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3561225","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD878AB-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS",""

"12:34:24.3561574","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad878a5-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3561928","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad8789e-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS","Desired Access: All Access"

"12:34:24.3562233","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD8789E-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\WINDOWS\WinSxS\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3562725","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD8789E-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\WINDOWS\WinSxS","SUCCESS",""

"12:34:24.3563062","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad8788c-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS","Desired Access: All Access"

"12:34:24.3563375","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD8788C-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WINSXS\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3563854","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD8788C-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WINSXS","SUCCESS",""

"12:34:24.3564194","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad8787f-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS","Desired Access: All Access"

"12:34:24.3564512","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD8787F-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WinSxS\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3564994","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD8787F-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS",""

"12:34:24.3565336","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87873-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS","Desired Access: All Access"

"12:34:24.3565660","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD87873-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WINSXS\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3566137","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD87873-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WINSXS","SUCCESS",""

"12:34:24.3566477","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87861-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS","Desired Access: All Access"

"12:34:24.3566804","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD87861-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WinSxS\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3567275","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD87861-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS",""

"12:34:24.3567614","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87839-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3567974","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87841-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS","Desired Access: All Access"

"12:34:24.3568287","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD87841-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WinSxS\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3568777","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD87841-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS",""

"12:34:24.3569067","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87818-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS","Desired Access: All Access"

"12:34:24.3569330","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD87818-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\WINDOWS\WinSxS\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3569796","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD87818-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\WINDOWS\WinSxS","SUCCESS",""

"12:34:24.3570144","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87826-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS","Desired Access: All Access"

"12:34:24.3570420","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD87826-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WinSxS\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3570840","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD87826-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS",""

"12:34:24.3571116","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87811-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS","Desired Access: All Access"

"12:34:24.3571382","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD87811-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WINSXS\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3571802","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD87811-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WINSXS","SUCCESS",""

"12:34:24.3572249","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad878b7-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS","Desired Access: All Access"

"12:34:24.3572509","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD878B7-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WINSXS\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3572937","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD878B7-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WINSXS","SUCCESS",""

"12:34:24.3573211","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad878b1-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3573502","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad878ab-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS","Desired Access: All Access"

"12:34:24.3573783","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD878AB-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WinSxS\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3574287","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD878AB-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS",""

"12:34:24.3574562","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad878a5-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3574853","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad8789e-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS","Desired Access: All Access"

"12:34:24.3575104","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD8789E-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\WINDOWS\WinSxS\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3575601","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD8789E-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\WINDOWS\WinSxS","SUCCESS",""

"12:34:24.3575875","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad8788c-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS","Desired Access: All Access"

"12:34:24.3576128","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD8788C-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WINSXS\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3576718","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD8788C-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WINSXS","SUCCESS",""

"12:34:24.3577014","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad8787f-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS","Desired Access: All Access"

"12:34:24.3577276","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD8787F-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WinSxS\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3577697","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD8787F-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS",""

"12:34:24.3577970","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87873-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS","Desired Access: All Access"

"12:34:24.3578219","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD87873-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WINSXS\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3578627","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD87873-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WINSXS","SUCCESS",""

"12:34:24.3578900","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87861-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS","Desired Access: All Access"

"12:34:24.3579148","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD87861-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WinSxS\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3579550","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD87861-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS",""

"12:34:24.3579822","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87839-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3580114","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87841-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS","Desired Access: All Access"

"12:34:24.3580361","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD87841-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WinSxS\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3580768","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD87841-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS",""

"12:34:24.3581040","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87818-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS","Desired Access: All Access"

"12:34:24.3581287","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD87818-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\WINDOWS\WinSxS\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3581774","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD87818-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\WINDOWS\WinSxS","SUCCESS",""

"12:34:24.3582058","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87826-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS","Desired Access: All Access"

"12:34:24.3582316","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD87826-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WinSxS\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3582732","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD87826-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS",""

"12:34:24.3582994","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87811-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS","Desired Access: All Access"

"12:34:24.3583247","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD87811-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WINSXS\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3583651","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD87811-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WINSXS","SUCCESS",""

"12:34:24.3584496","FlexEngine.exe","7980","CreateFile","C:\Windows\winsxs\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757","SUCCESS","Desired Access: Execute/Traverse, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"

"12:34:24.3585105","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad878b7-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3585415","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad878b1-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3585709","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad878ab-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3586035","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad878a5-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3586366","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad8789e-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3586644","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad8788c-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3586941","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad8787f-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3587273","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87873-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3587589","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87861-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3587887","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87839-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3588148","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87841-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3588467","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87818-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3588775","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87826-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3589050","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87811-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757","SUCCESS","Desired Access: All Access"

"12:34:24.3589288","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD87811-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WINSXS\AMD64_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_6.0.7601.18837_NONE_FA3B1E3D17594757\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3589701","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD87811-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WINSXS\AMD64_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_6.0.7601.18837_NONE_FA3B1E3D17594757","SUCCESS",""

"12:34:24.3590198","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad878b7-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3590496","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad878b1-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3590756","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad878ab-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3591014","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad878a5-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3591315","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad8789e-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3591559","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad8788c-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3591800","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad8787f-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3592116","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87873-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3592416","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87861-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3592687","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87839-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3592942","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87841-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3593196","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87818-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3593494","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87826-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3593781","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87811-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757","SUCCESS","Desired Access: All Access"

"12:34:24.3594023","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD87811-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WINSXS\AMD64_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_6.0.7601.18837_NONE_FA3B1E3D17594757\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3594445","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD87811-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WINSXS\AMD64_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_6.0.7601.18837_NONE_FA3B1E3D17594757","SUCCESS",""

"12:34:24.3595663","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad878b7-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3596086","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad878b1-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3596468","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad878ab-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3596838","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad878a5-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3597210","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad8789e-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3597584","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad8788c-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3597957","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad8787f-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3598327","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87873-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3598689","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87861-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3599068","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87839-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3599455","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87841-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3599819","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87818-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3600185","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87826-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3600532","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87811-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757","SUCCESS","Desired Access: All Access"

"12:34:24.3600867","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD87811-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WINSXS\AMD64_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_6.0.7601.18837_NONE_FA3B1E3D17594757\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3601400","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD87811-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WINSXS\AMD64_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_6.0.7601.18837_NONE_FA3B1E3D17594757","SUCCESS",""

"12:34:24.3601934","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad878b7-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3602307","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad878b1-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3602628","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad878ab-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3602973","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad878a5-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3603299","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad8789e-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3603665","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad8788c-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3604033","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad8787f-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3604393","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87873-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3604747","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87861-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3605096","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87839-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3605443","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87841-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3605817","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87818-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3606194","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87826-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3606476","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87811-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757","SUCCESS","Desired Access: All Access"

"12:34:24.3606759","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD87811-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WINSXS\AMD64_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_6.0.7601.18837_NONE_FA3B1E3D17594757\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3607256","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD87811-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WINSXS\AMD64_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_6.0.7601.18837_NONE_FA3B1E3D17594757","SUCCESS",""

"12:34:24.3608996","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad878b7-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3609409","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad878b1-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3609784","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad878ab-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3610154","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad878a5-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3610475","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad8789e-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3610839","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad8788c-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3611212","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad8787f-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3611556","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87873-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3611911","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87861-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3612267","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87839-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3612646","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87841-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3613020","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87818-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3613380","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87826-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3613721","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87811-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757","SUCCESS","Desired Access: All Access"

"12:34:24.3614031","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD87811-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WINSXS\AMD64_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_6.0.7601.18837_NONE_FA3B1E3D17594757\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3614563","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD87811-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WINSXS\AMD64_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_6.0.7601.18837_NONE_FA3B1E3D17594757","SUCCESS",""

"12:34:24.3615026","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad878b7-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3615379","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad878b1-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3615734","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad878ab-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3616075","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad878a5-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3616495","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad8789e-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3616841","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad8788c-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3617246","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad8787f-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3617652","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87873-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3617999","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87861-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3618351","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87839-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3618695","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87841-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3619053","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87818-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3619393","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87826-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3619690","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87811-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757","SUCCESS","Desired Access: All Access"

"12:34:24.3619980","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD87811-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WINSXS\AMD64_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_6.0.7601.18837_NONE_FA3B1E3D17594757\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3620434","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD87811-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WINSXS\AMD64_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_6.0.7601.18837_NONE_FA3B1E3D17594757","SUCCESS",""

"12:34:24.3621166","FlexEngine.exe","7980","CreateFile","C:\Windows\winsxs\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757\comctl32.dll","SUCCESS","Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"

"12:34:24.3624186","FlexEngine.exe","7980","QueryBasicInformationFile","C:\Windows\winsxs\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757\comctl32.dll","SUCCESS","CreationTime: 06/11/2017 15:08:32, LastAccessTime: 06/11/2017 15:08:32, LastWriteTime: 24/04/2015 18:12:05, ChangeTime: 06/11/2017 15:41:13, FileAttributes: A"

"12:34:24.3624326","FlexEngine.exe","7980","CloseFile","C:\Windows\winsxs\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757\comctl32.dll","SUCCESS",""

"12:34:24.3625582","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad878b7-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3626020","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad878b1-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3626386","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad878ab-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3626719","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad878a5-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3627034","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad8789e-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3627360","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad8788c-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3627678","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad8787f-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3627990","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87873-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3628307","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87861-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3628615","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87839-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3628924","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87841-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3629235","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87818-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3629544","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87826-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3629856","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87811-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757","SUCCESS","Desired Access: All Access"

"12:34:24.3630150","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD87811-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WINSXS\AMD64_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_6.0.7601.18837_NONE_FA3B1E3D17594757\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3630745","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD87811-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WINSXS\AMD64_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_6.0.7601.18837_NONE_FA3B1E3D17594757","SUCCESS",""

"12:34:24.3631508","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad878b7-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3631967","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad878b1-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3632429","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad878ab-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3632885","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad878a5-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3633347","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad8789e-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3633811","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad8788c-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3634244","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad8787f-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3634675","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87873-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3635136","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87861-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3635600","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87839-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3636024","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87841-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3636343","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87818-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3636647","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87826-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3636932","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87811-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757","SUCCESS","Desired Access: All Access"

"12:34:24.3637224","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD87811-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WINSXS\AMD64_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_6.0.7601.18837_NONE_FA3B1E3D17594757\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3637719","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD87811-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WINSXS\AMD64_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_6.0.7601.18837_NONE_FA3B1E3D17594757","SUCCESS",""

"12:34:24.3638582","FlexEngine.exe","7980","CreateFile","C:\Windows\winsxs\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757\comctl32.dll","SUCCESS","Desired Access: Read Data/List Directory, Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened"

"12:34:24.3639217","FlexEngine.exe","7980","CreateFileMapping","C:\Windows\winsxs\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757\comctl32.dll","FILE LOCKED WITH ONLY READERS","SyncType: SyncTypeCreateSection, PageProtection: "

"12:34:24.3639754","FlexEngine.exe","7980","CreateFileMapping","C:\Windows\winsxs\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757\comctl32.dll","SUCCESS","SyncType: SyncTypeOther"

"12:34:24.3640363","FlexEngine.exe","7980","Load Image","C:\Windows\winsxs\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757\comctl32.dll","SUCCESS","Image Base: 0x7fefba50000, Image Size: 0x1f4000"

"12:34:24.3640570","FlexEngine.exe","7980","CloseFile","C:\Windows\winsxs\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757\comctl32.dll","SUCCESS",""

"12:34:24.3650685","FlexEngine.exe","7980","RegOpenKey","HKLM\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots","NAME NOT FOUND","Desired Access: Enumerate Sub Keys"

"12:34:24.3657969","FlexEngine.exe","7980","CreateFile","C:\Program Files\Immidio\Flex Profiles\FlexEngine.exe.Local","NAME NOT FOUND","Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"

"12:34:24.3662445","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad878b7-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS","Desired Access: All Access"

"12:34:24.3663044","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD878B7-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WINSXS\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3663969","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD878B7-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WINSXS","SUCCESS",""

"12:34:24.3664361","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad878b1-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3664781","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad878ab-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS","Desired Access: All Access"

"12:34:24.3665159","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD878AB-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WinSxS\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3665707","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD878AB-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS",""

"12:34:24.3666026","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad878a5-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3666402","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad8789e-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS","Desired Access: All Access"

"12:34:24.3666768","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD8789E-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\WINDOWS\WinSxS\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3667287","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD8789E-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\WINDOWS\WinSxS","SUCCESS",""

"12:34:24.3667632","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad8788c-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS","Desired Access: All Access"

"12:34:24.3667975","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD8788C-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WINSXS\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3668482","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD8788C-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WINSXS","SUCCESS",""

"12:34:24.3668819","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad8787f-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS","Desired Access: All Access"

"12:34:24.3669174","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD8787F-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WinSxS\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3669771","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD8787F-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS",""

"12:34:24.3670135","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87873-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS","Desired Access: All Access"

"12:34:24.3670444","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD87873-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WINSXS\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3671115","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD87873-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WINSXS","SUCCESS",""

"12:34:24.3671469","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87861-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS","Desired Access: All Access"

"12:34:24.3671811","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD87861-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WinSxS\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3672303","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD87861-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS",""

"12:34:24.3672664","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87839-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3673042","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87841-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS","Desired Access: All Access"

"12:34:24.3673368","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD87841-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WinSxS\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3673856","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD87841-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS",""

"12:34:24.3674191","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87818-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS","Desired Access: All Access"

"12:34:24.3674525","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD87818-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\WINDOWS\WinSxS\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3674963","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD87818-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\WINDOWS\WinSxS","SUCCESS",""

"12:34:24.3675284","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87826-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS","Desired Access: All Access"

"12:34:24.3675595","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD87826-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WinSxS\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3676071","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD87826-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS",""

"12:34:24.3676414","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87811-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS","Desired Access: All Access"

"12:34:24.3676734","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD87811-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WINSXS\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3677221","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD87811-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WINSXS","SUCCESS",""

"12:34:24.3677799","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad878b7-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS","Desired Access: All Access"

"12:34:24.3678080","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD878B7-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WINSXS\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3678517","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD878B7-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WINSXS","SUCCESS",""

"12:34:24.3678796","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad878b1-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3679096","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad878ab-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS","Desired Access: All Access"

"12:34:24.3679355","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD878AB-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WinSxS\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3679777","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD878AB-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS",""

"12:34:24.3680052","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad878a5-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3680347","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad8789e-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS","Desired Access: All Access"

"12:34:24.3680607","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD8789E-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\WINDOWS\WinSxS\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3681024","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD8789E-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\WINDOWS\WinSxS","SUCCESS",""

"12:34:24.3681300","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad8788c-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS","Desired Access: All Access"

"12:34:24.3681555","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD8788C-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WINSXS\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3682060","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD8788C-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WINSXS","SUCCESS",""

"12:34:24.3682375","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad8787f-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS","Desired Access: All Access"

"12:34:24.3682701","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD8787F-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WinSxS\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3683115","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD8787F-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS",""

"12:34:24.3683396","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87873-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS","Desired Access: All Access"

"12:34:24.3683650","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD87873-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WINSXS\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3684061","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD87873-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WINSXS","SUCCESS",""

"12:34:24.3684337","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87861-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS","Desired Access: All Access"

"12:34:24.3684589","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD87861-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WinSxS\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3684996","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD87861-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS",""

"12:34:24.3685327","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87839-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3685640","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87841-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS","Desired Access: All Access"

"12:34:24.3685898","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD87841-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WinSxS\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3686326","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD87841-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS",""

"12:34:24.3686600","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87818-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS","Desired Access: All Access"

"12:34:24.3686855","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD87818-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\WINDOWS\WinSxS\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3687263","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD87818-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\WINDOWS\WinSxS","SUCCESS",""

"12:34:24.3687536","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87826-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS","Desired Access: All Access"

"12:34:24.3687794","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD87826-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WinSxS\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3688197","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD87826-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS",""

"12:34:24.3688462","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87811-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS","Desired Access: All Access"

"12:34:24.3688722","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD87811-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WINSXS\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3689128","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD87811-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WINSXS","SUCCESS",""

"12:34:24.3690912","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad878b7-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS","Desired Access: All Access"

"12:34:24.3691206","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD878B7-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WINSXS\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3691651","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD878B7-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WINSXS","SUCCESS",""

"12:34:24.3691942","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad878b1-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3692250","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad878ab-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS","Desired Access: All Access"

"12:34:24.3692517","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD878AB-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WinSxS\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3692942","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD878AB-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS",""

"12:34:24.3693271","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad878a5-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3693591","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad8789e-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS","Desired Access: All Access"

"12:34:24.3693883","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD8789E-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\WINDOWS\WinSxS\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3694358","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD8789E-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\WINDOWS\WinSxS","SUCCESS",""

"12:34:24.3694668","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad8788c-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS","Desired Access: All Access"

"12:34:24.3694969","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD8788C-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WINSXS\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3695511","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD8788C-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WINSXS","SUCCESS",""

"12:34:24.3695799","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad8787f-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS","Desired Access: All Access"

"12:34:24.3696534","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD8787F-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WinSxS\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3696983","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD8787F-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS",""

"12:34:24.3697295","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87873-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS","Desired Access: All Access"

"12:34:24.3697859","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD87873-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WINSXS\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3698436","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD87873-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WINSXS","SUCCESS",""

"12:34:24.3698734","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87861-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS","Desired Access: All Access"

"12:34:24.3699061","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD87861-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WinSxS\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3699531","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD87861-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS",""

"12:34:24.3699849","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87839-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3700170","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87841-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS","Desired Access: All Access"

"12:34:24.3700439","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD87841-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WinSxS\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3700865","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD87841-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS",""

"12:34:24.3701219","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87818-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS","Desired Access: All Access"

"12:34:24.3701564","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD87818-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\WINDOWS\WinSxS\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3702029","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD87818-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\WINDOWS\WinSxS","SUCCESS",""

"12:34:24.3702338","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87826-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS","Desired Access: All Access"

"12:34:24.3702647","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD87826-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WinSxS\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3703114","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD87826-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS",""

"12:34:24.3703403","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87811-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS","Desired Access: All Access"

"12:34:24.3703711","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD87811-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WINSXS\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3704205","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD87811-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WINSXS","SUCCESS",""

"12:34:24.3704726","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad878b7-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS","Desired Access: All Access"

"12:34:24.3705068","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD878B7-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WINSXS\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3705550","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD878B7-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WINSXS","SUCCESS",""

"12:34:24.3705861","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad878b1-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3706218","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad878ab-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS","Desired Access: All Access"

"12:34:24.3706544","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD878AB-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WinSxS\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3706983","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD878AB-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS",""

"12:34:24.3707299","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad878a5-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3707683","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad8789e-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS","Desired Access: All Access"

"12:34:24.3708003","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD8789E-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\WINDOWS\WinSxS\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3708471","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD8789E-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\WINDOWS\WinSxS","SUCCESS",""

"12:34:24.3708786","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad8788c-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS","Desired Access: All Access"

"12:34:24.3709130","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD8788C-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WINSXS\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3709610","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD8788C-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WINSXS","SUCCESS",""

"12:34:24.3709925","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad8787f-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS","Desired Access: All Access"

"12:34:24.3710224","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD8787F-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WinSxS\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3710706","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD8787F-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS",""

"12:34:24.3711022","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87873-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS","Desired Access: All Access"

"12:34:24.3711315","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD87873-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WINSXS\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3711786","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD87873-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WINSXS","SUCCESS",""

"12:34:24.3712135","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87861-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS","Desired Access: All Access"

"12:34:24.3712440","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD87861-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WinSxS\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3712879","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD87861-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS",""

"12:34:24.3713195","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87839-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3713556","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87841-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS","Desired Access: All Access"

"12:34:24.3713871","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD87841-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WinSxS\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3714333","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD87841-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS",""

"12:34:24.3714622","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87818-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS","Desired Access: All Access"

"12:34:24.3714915","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD87818-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\WINDOWS\WinSxS\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3715397","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD87818-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\WINDOWS\WinSxS","SUCCESS",""

"12:34:24.3715726","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87826-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS","Desired Access: All Access"

"12:34:24.3716016","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD87826-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WinSxS\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3716439","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD87826-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS",""

"12:34:24.3716703","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87811-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS","Desired Access: All Access"

"12:34:24.3716985","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD87811-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WINSXS\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3717442","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD87811-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WINSXS","SUCCESS",""

"12:34:24.3718362","FlexEngine.exe","7980","CreateFile","C:\Windows\winsxs\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","SUCCESS","Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"

"12:34:24.3719167","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad878b7-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3719523","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad878b1-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3719833","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad878ab-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3720156","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad878a5-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3720465","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad8789e-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3720786","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad8788c-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3721105","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad8787f-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3721400","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87873-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3721714","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87861-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3722021","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87839-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3722305","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87841-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3722579","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87818-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3722903","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87826-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3723186","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87811-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","SUCCESS","Desired Access: All Access"

"12:34:24.3723457","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD87811-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WINSXS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3723910","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD87811-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WINSXS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","SUCCESS",""

"12:34:24.3724415","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad878b7-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3724731","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad878b1-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3725055","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad878ab-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3725421","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad878a5-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3725775","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad8789e-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3726072","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad8788c-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3726359","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad8787f-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3726651","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87873-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3726973","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87861-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3727249","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87839-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3727494","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87841-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3727751","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87818-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3728000","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87826-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3728239","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87811-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","SUCCESS","Desired Access: All Access"

"12:34:24.3728463","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD87811-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WINSXS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3728898","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD87811-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WINSXS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","SUCCESS",""

"12:34:24.3729172","FlexEngine.exe","7980","QueryBasicInformationFile","C:\Windows\winsxs\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","SUCCESS","CreationTime: 06/11/2017 15:58:24, LastAccessTime: 06/11/2017 15:58:24, LastWriteTime: 06/11/2017 15:58:24, ChangeTime: 06/11/2017 15:58:24, FileAttributes: D"

"12:34:24.3729336","FlexEngine.exe","7980","CloseFile","C:\Windows\winsxs\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","SUCCESS",""

"12:34:24.3730447","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad878b7-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS","Desired Access: All Access"

"12:34:24.3730817","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD878B7-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WINSXS\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3731348","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD878B7-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WINSXS","SUCCESS",""

"12:34:24.3731647","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad878b1-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3731989","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad878ab-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS","Desired Access: All Access"

"12:34:24.3732281","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD878AB-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WinSxS\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3732731","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD878AB-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS",""

"12:34:24.3733016","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad878a5-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3733322","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad8789e-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS","Desired Access: All Access"

"12:34:24.3733589","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD8789E-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\WINDOWS\WinSxS\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3734023","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD8789E-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\WINDOWS\WinSxS","SUCCESS",""

"12:34:24.3734311","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad8788c-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS","Desired Access: All Access"

"12:34:24.3734577","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD8788C-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WINSXS\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3735004","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD8788C-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WINSXS","SUCCESS",""

"12:34:24.3735286","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad8787f-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS","Desired Access: All Access"

"12:34:24.3735549","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD8787F-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WinSxS\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3735972","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD8787F-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS",""

"12:34:24.3736256","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87873-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS","Desired Access: All Access"

"12:34:24.3736517","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD87873-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WINSXS\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3736976","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD87873-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WINSXS","SUCCESS",""

"12:34:24.3737301","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87861-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS","Desired Access: All Access"

"12:34:24.3737614","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD87861-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WinSxS\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3738049","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD87861-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS",""

"12:34:24.3738356","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87839-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3738661","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87841-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS","Desired Access: All Access"

"12:34:24.3738921","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD87841-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WinSxS\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3739516","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD87841-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS",""

"12:34:24.3740454","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87818-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS","Desired Access: All Access"

"12:34:24.3740936","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD87818-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\WINDOWS\WinSxS\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3741468","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD87818-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\WINDOWS\WinSxS","SUCCESS",""

"12:34:24.3741827","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87826-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS","Desired Access: All Access"

"12:34:24.3742121","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD87826-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WinSxS\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3742555","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD87826-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS",""

"12:34:24.3742835","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87811-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS","Desired Access: All Access"

"12:34:24.3743107","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD87811-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WINSXS\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3743522","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD87811-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WINSXS","SUCCESS",""

"12:34:24.3743992","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad878b7-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS","Desired Access: All Access"

"12:34:24.3744264","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD878B7-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WINSXS\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3744681","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD878B7-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WINSXS","SUCCESS",""

"12:34:24.3744951","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad878b1-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3745247","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad878ab-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS","Desired Access: All Access"

"12:34:24.3745497","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD878AB-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WinSxS\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3745899","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD878AB-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS",""

"12:34:24.3746161","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad878a5-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3746446","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad8789e-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS","Desired Access: All Access"

"12:34:24.3746706","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD8789E-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\WINDOWS\WinSxS\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3747104","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD8789E-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\WINDOWS\WinSxS","SUCCESS",""

"12:34:24.3747365","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad8788c-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS","Desired Access: All Access"

"12:34:24.3747611","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD8788C-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WINSXS\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3748003","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD8788C-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WINSXS","SUCCESS",""

"12:34:24.3748264","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad8787f-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS","Desired Access: All Access"

"12:34:24.3748514","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD8787F-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WinSxS\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3748904","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD8787F-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS",""

"12:34:24.3749164","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87873-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS","Desired Access: All Access"

"12:34:24.3749414","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD87873-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WINSXS\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3749800","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD87873-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WINSXS","SUCCESS",""

"12:34:24.3750058","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87861-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS","Desired Access: All Access"

"12:34:24.3750304","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD87861-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WinSxS\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3750688","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD87861-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS",""

"12:34:24.3750944","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87839-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3751227","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87841-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS","Desired Access: All Access"

"12:34:24.3751474","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD87841-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WinSxS\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3751863","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD87841-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS",""

"12:34:24.3752119","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87818-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS","Desired Access: All Access"

"12:34:24.3752348","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD87818-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\WINDOWS\WinSxS\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3752727","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD87818-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\WINDOWS\WinSxS","SUCCESS",""

"12:34:24.3752982","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87826-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS","Desired Access: All Access"

"12:34:24.3753211","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD87826-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WinSxS\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3753590","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD87826-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS",""

"12:34:24.3753835","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87811-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS","SUCCESS","Desired Access: All Access"

"12:34:24.3754067","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD87811-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WINSXS\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3754446","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD87811-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WINSXS","SUCCESS",""

"12:34:24.3755396","FlexEngine.exe","7980","CreateFile","C:\Windows\winsxs\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","SUCCESS","Desired Access: Execute/Traverse, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"

"12:34:24.3756019","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad878b7-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3756310","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad878b1-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3756557","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad878ab-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3756806","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad878a5-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3757047","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad8789e-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3757293","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad8788c-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3757537","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad8787f-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3757780","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87873-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3758022","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87861-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3758260","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87839-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3758490","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87841-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3759268","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87818-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3759508","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87826-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3759729","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87811-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","SUCCESS","Desired Access: All Access"

"12:34:24.3759940","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD87811-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WINSXS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3760331","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD87811-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WINSXS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","SUCCESS",""

"12:34:24.3760786","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad878b7-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3761024","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad878b1-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3761247","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad878ab-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3761471","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad878a5-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3761693","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad8789e-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3761919","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad8788c-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3762145","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad8787f-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3762369","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87873-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3762590","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87861-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3762814","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87839-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3763033","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87841-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3763258","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87818-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3763480","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87826-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3763684","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87811-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","SUCCESS","Desired Access: All Access"

"12:34:24.3763869","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD87811-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WINSXS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3764231","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD87811-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WINSXS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","SUCCESS",""

"12:34:24.3765276","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad878b7-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3765602","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad878b1-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3765899","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad878ab-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3766194","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad878a5-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3766483","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad8789e-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3766774","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad8788c-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3767065","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad8787f-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3767351","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87873-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3767636","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87861-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3767921","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87839-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3768202","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87841-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3768487","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87818-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3768775","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87826-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3769041","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87811-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","SUCCESS","Desired Access: All Access"

"12:34:24.3769294","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD87811-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WINSXS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3769725","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD87811-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WINSXS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","SUCCESS",""

"12:34:24.3770149","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad878b7-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3770435","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad878b1-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3770707","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad878ab-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3770983","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad878a5-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3771255","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad8789e-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3771531","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad8788c-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3771806","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad8787f-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3772078","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87873-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3772350","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87861-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3772624","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87839-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3772891","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87841-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3773164","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87818-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3773436","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87826-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3773692","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87811-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","SUCCESS","Desired Access: All Access"

"12:34:24.3773929","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD87811-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WINSXS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3774345","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD87811-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WINSXS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","SUCCESS",""

"12:34:24.3775934","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad878b7-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3776249","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad878b1-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3776531","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad878ab-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3776814","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad878a5-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3777092","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad8789e-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3777375","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad8788c-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3777657","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad8787f-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3777935","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87873-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3778212","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87861-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3778489","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87839-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3778766","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87841-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3779046","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87818-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3779325","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87826-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3779585","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87811-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","SUCCESS","Desired Access: All Access"

"12:34:24.3779836","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD87811-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WINSXS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3780363","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD87811-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WINSXS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","SUCCESS",""

"12:34:24.3780774","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad878b7-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3781057","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad878b1-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3781325","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad878ab-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3781595","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad878a5-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3781862","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad8789e-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3782133","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad8788c-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3782405","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad8787f-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3782672","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87873-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3783919","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87861-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3784193","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87839-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3784461","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87841-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3784738","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87818-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3785008","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87826-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3785265","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87811-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","SUCCESS","Desired Access: All Access"

"12:34:24.3785511","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD87811-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WINSXS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3785945","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD87811-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WINSXS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","SUCCESS",""

"12:34:24.3786608","FlexEngine.exe","7980","CreateFile","C:\Windows\winsxs\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928\GdiPlus.dll","SUCCESS","Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"

"12:34:24.3787383","FlexEngine.exe","7980","QueryBasicInformationFile","C:\Windows\winsxs\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928\GdiPlus.dll","SUCCESS","CreationTime: 06/11/2017 15:11:44, LastAccessTime: 06/11/2017 15:11:44, LastWriteTime: 16/08/2017 15:29:12, ChangeTime: 06/11/2017 15:58:24, FileAttributes: A"

"12:34:24.3787558","FlexEngine.exe","7980","CloseFile","C:\Windows\winsxs\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928\GdiPlus.dll","SUCCESS",""

"12:34:24.3789099","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad878b7-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3789599","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad878b1-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3790063","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad878ab-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3790497","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad878a5-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3790946","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad8789e-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3791468","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad8788c-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3791929","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad8787f-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3792379","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87873-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3792694","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87861-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3792985","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87839-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3793278","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87841-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3793575","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87818-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3793860","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87826-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3794129","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87811-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","SUCCESS","Desired Access: All Access"

"12:34:24.3794409","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD87811-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WINSXS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3794897","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD87811-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WINSXS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","SUCCESS",""

"12:34:24.3795555","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad878b7-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3795841","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad878b1-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3796110","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad878ab-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3796374","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad878a5-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3796639","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad8789e-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3796905","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad8788c-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3797171","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad8787f-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3797437","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87873-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3797698","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87861-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3797960","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87839-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3798219","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87841-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3798485","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87818-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3798746","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87826-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.3798993","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87811-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","SUCCESS","Desired Access: All Access"

"12:34:24.3799226","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD87811-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WINSXS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.3799646","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD87811-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\WINSXS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928","SUCCESS",""

"12:34:24.3800340","FlexEngine.exe","7980","CreateFile","C:\Windows\winsxs\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928\GdiPlus.dll","SUCCESS","Desired Access: Read Data/List Directory, Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened"

"12:34:24.3801028","FlexEngine.exe","7980","CreateFileMapping","C:\Windows\winsxs\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928\GdiPlus.dll","FILE LOCKED WITH ONLY READERS","SyncType: SyncTypeCreateSection, PageProtection: "

"12:34:24.3801542","FlexEngine.exe","7980","CreateFileMapping","C:\Windows\winsxs\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928\GdiPlus.dll","SUCCESS","SyncType: SyncTypeOther"

"12:34:24.3802076","FlexEngine.exe","7980","Load Image","C:\Windows\winsxs\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928\GdiPlus.dll","SUCCESS","Image Base: 0x7fefb7d0000, Image Size: 0x217000"

"12:34:24.3802241","FlexEngine.exe","7980","CloseFile","C:\Windows\winsxs\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928\GdiPlus.dll","SUCCESS",""

"12:34:24.3805773","FlexEngine.exe","7980","RegOpenKey","HKLM\System\CurrentControlSet\Control\Nls\Sorting\Versions","REPARSE","Desired Access: Read"

"12:34:24.3808435","FlexEngine.exe","7980","RegOpenKey","HKLM\System\CurrentControlSet\Control\Nls\Sorting\Versions","SUCCESS","Desired Access: Read"

"12:34:24.3809466","FlexEngine.exe","7980","RegQueryValue","HKLM\System\CurrentControlSet\Control\Nls\Sorting\Versions\CompatDll","SUCCESS","Type: REG_SZ, Length: 36, Data: 00060101.00060101"

"12:34:24.3809762","FlexEngine.exe","7980","RegQueryValue","HKLM\System\CurrentControlSet\Control\Nls\Sorting\Versions\00060101.00060101","NAME NOT FOUND","Length: 260"

"12:34:24.3809999","FlexEngine.exe","7980","RegQueryValue","HKLM\System\CurrentControlSet\Control\Nls\Sorting\Versions\(Default)","SUCCESS","Type: REG_SZ, Length: 36, Data: 00060101.00060101"

"12:34:24.3811025","FlexEngine.exe","7980","RegOpenKey","HKLM\System\CurrentControlSet\Control\Session Manager","SUCCESS","Desired Access: Query Value"

"12:34:24.3813696","FlexEngine.exe","7980","RegQueryKeySecurity","HKLM\System\CurrentControlSet\Control\SESSION MANAGER","SUCCESS",""

"12:34:24.3813840","FlexEngine.exe","7980","RegQueryValue","HKLM\System\CurrentControlSet\Control\SESSION MANAGER\SafeDllSearchMode","NAME NOT FOUND","Length: 16"

"12:34:24.3820565","FlexEngine.exe","7980","CreateFile","C:\Windows\System32\imm32.dll","SUCCESS","Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"

"12:34:24.3821920","FlexEngine.exe","7980","QueryBasicInformationFile","C:\Windows\System32\imm32.dll","SUCCESS","CreationTime: 13/07/2009 23:38:08, LastAccessTime: 13/07/2009 23:38:08, LastWriteTime: 14/07/2009 01:41:09, ChangeTime: 06/11/2017 21:42:27, FileAttributes: A"

"12:34:24.3822059","FlexEngine.exe","7980","CloseFile","C:\Windows\System32\imm32.dll","SUCCESS",""

"12:34:24.3823254","FlexEngine.exe","7980","CreateFile","C:\Windows\System32\imm32.dll","SUCCESS","Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened"

"12:34:24.3824532","FlexEngine.exe","7980","CreateFileMapping","C:\Windows\System32\imm32.dll","FILE LOCKED WITH ONLY READERS","SyncType: SyncTypeCreateSection, PageProtection: "

"12:34:24.3824651","FlexEngine.exe","7980","QueryStandardInformationFile","C:\Windows\System32\imm32.dll","SUCCESS","AllocationSize: 167,936, EndOfFile: 167,424, NumberOfLinks: 2, DeletePending: False, Directory: False"

"12:34:24.3824896","FlexEngine.exe","7980","CreateFileMapping","C:\Windows\System32\imm32.dll","SUCCESS","SyncType: SyncTypeOther"

"12:34:24.3825289","FlexEngine.exe","7980","CloseFile","C:\Windows\System32\imm32.dll","SUCCESS",""

"12:34:24.3827752","FlexEngine.exe","7980","CreateFile","C:\Windows\System32\imm32.dll","SUCCESS","Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"

"12:34:24.3828983","FlexEngine.exe","7980","QueryBasicInformationFile","C:\Windows\System32\imm32.dll","SUCCESS","CreationTime: 13/07/2009 23:38:08, LastAccessTime: 13/07/2009 23:38:08, LastWriteTime: 14/07/2009 01:41:09, ChangeTime: 06/11/2017 21:42:27, FileAttributes: A"

"12:34:24.3829106","FlexEngine.exe","7980","CloseFile","C:\Windows\System32\imm32.dll","SUCCESS",""

"12:34:24.3830222","FlexEngine.exe","7980","CreateFile","C:\Windows\System32\imm32.dll","SUCCESS","Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened"

"12:34:24.3831460","FlexEngine.exe","7980","CreateFileMapping","C:\Windows\System32\imm32.dll","FILE LOCKED WITH ONLY READERS","SyncType: SyncTypeCreateSection, PageProtection: "

"12:34:24.3831566","FlexEngine.exe","7980","QueryStandardInformationFile","C:\Windows\System32\imm32.dll","SUCCESS","AllocationSize: 167,936, EndOfFile: 167,424, NumberOfLinks: 2, DeletePending: False, Directory: False"

"12:34:24.3831787","FlexEngine.exe","7980","CreateFileMapping","C:\Windows\System32\imm32.dll","SUCCESS","SyncType: SyncTypeOther"

"12:34:24.3832139","FlexEngine.exe","7980","CloseFile","C:\Windows\System32\imm32.dll","SUCCESS",""

"12:34:24.3834582","FlexEngine.exe","7980","CreateFile","C:\Windows\System32\imm32.dll","SUCCESS","Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"

"12:34:24.3835800","FlexEngine.exe","7980","QueryBasicInformationFile","C:\Windows\System32\imm32.dll","SUCCESS","CreationTime: 13/07/2009 23:38:08, LastAccessTime: 13/07/2009 23:38:08, LastWriteTime: 14/07/2009 01:41:09, ChangeTime: 06/11/2017 21:42:27, FileAttributes: A"

"12:34:24.3835921","FlexEngine.exe","7980","CloseFile","C:\Windows\System32\imm32.dll","SUCCESS",""

"12:34:24.3837040","FlexEngine.exe","7980","CreateFile","C:\Windows\System32\imm32.dll","SUCCESS","Desired Access: Read Data/List Directory, Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened"

"12:34:24.3838272","FlexEngine.exe","7980","CreateFileMapping","C:\Windows\System32\imm32.dll","FILE LOCKED WITH ONLY READERS","SyncType: SyncTypeCreateSection, PageProtection: "

"12:34:24.3838761","FlexEngine.exe","7980","CreateFileMapping","C:\Windows\System32\imm32.dll","SUCCESS","SyncType: SyncTypeOther"

"12:34:24.3839886","FlexEngine.exe","7980","Load Image","C:\Windows\System32\imm32.dll","SUCCESS","Image Base: 0x7fefd680000, Image Size: 0x2e000"

"12:34:24.3840046","FlexEngine.exe","7980","CloseFile","C:\Windows\System32\imm32.dll","SUCCESS",""

"12:34:24.3842082","FlexEngine.exe","7980","Load Image","C:\Windows\System32\msctf.dll","SUCCESS","Image Base: 0x7fefd980000, Image Size: 0x109000"

"12:34:24.3843650","FlexEngine.exe","7980","RegOpenKey","HKLM\System\CurrentControlSet\Control\Error Message Instrument\","NAME NOT FOUND","Desired Access: Read"

"12:34:24.3846249","FlexEngine.exe","7980","RegOpenKey","HKLM\Software\Microsoft\Windows NT\CurrentVersion\GRE_Initialize","SUCCESS","Desired Access: Read"

"12:34:24.3849942","FlexEngine.exe","7980","RegQueryKeySecurity","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize","SUCCESS",""

"12:34:24.3850082","FlexEngine.exe","7980","RegQueryValue","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles","NAME NOT FOUND","Length: 20"

"12:34:24.3850302","FlexEngine.exe","7980","RegCloseKey","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize","SUCCESS",""

"12:34:24.3851276","FlexEngine.exe","7980","RegOpenKey","HKLM\Software\Microsoft\Windows NT\CurrentVersion\Compatibility32","SUCCESS","Desired Access: Read"

"12:34:24.3852826","FlexEngine.exe","7980","RegQueryKeySecurity","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Compatibility32","SUCCESS",""

"12:34:24.3852979","FlexEngine.exe","7980","RegQueryValue","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Compatibility32\FlexEngine","NAME NOT FOUND","Length: 172"

"12:34:24.3853246","FlexEngine.exe","7980","RegCloseKey","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Compatibility32","SUCCESS",""

"12:34:24.3853575","FlexEngine.exe","7980","RegOpenKey","HKLM\Software\Microsoft\Windows NT\CurrentVersion\IME Compatibility","NAME NOT FOUND","Desired Access: Read"

"12:34:24.3856762","FlexEngine.exe","7980","RegOpenKey","HKCU","SUCCESS","Desired Access: Maximum Allowed, Granted Access: All Access"

"12:34:24.3857847","FlexEngine.exe","7980","RegOpenKey","HKCU\Control Panel\Desktop\MuiCached\MachineLanguageConfiguration","NAME NOT FOUND","Desired Access: Read"

"12:34:24.3858836","FlexEngine.exe","7980","RegCloseKey","HKCU","SUCCESS",""

"12:34:24.3858996","FlexEngine.exe","7980","RegOpenKey","HKLM\Software\Policies\Microsoft\MUI\Settings","NAME NOT FOUND","Desired Access: Read"

"12:34:24.3861510","FlexEngine.exe","7980","RegOpenKey","HKCU","SUCCESS","Desired Access: Maximum Allowed, Granted Access: All Access"

"12:34:24.3862035","FlexEngine.exe","7980","RegOpenKey","HKCU\Software\Policies\Microsoft\Control Panel\Desktop","NAME NOT FOUND","Desired Access: Read"

"12:34:24.3862878","FlexEngine.exe","7980","RegOpenKey","HKCU\Control Panel\Desktop\LanguageConfiguration","SUCCESS","Desired Access: Read"

"12:34:24.3863709","FlexEngine.exe","7980","RegEnumValue","HKCU\Control Panel\Desktop\LanguageConfiguration","NO MORE ENTRIES","Index: 0, Length: 512"

"12:34:24.3863966","FlexEngine.exe","7980","RegCloseKey","HKCU\Control Panel\Desktop\LanguageConfiguration","SUCCESS",""

"12:34:24.3864100","FlexEngine.exe","7980","RegCloseKey","HKCU","SUCCESS",""

"12:34:24.3864252","FlexEngine.exe","7980","RegOpenKey","HKLM\Software\Policies\Microsoft\MUI\Settings","NAME NOT FOUND","Desired Access: Read"

"12:34:24.3865640","FlexEngine.exe","7980","RegOpenKey","HKCU","SUCCESS","Desired Access: Maximum Allowed, Granted Access: All Access"

"12:34:24.3866179","FlexEngine.exe","7980","RegOpenKey","HKCU\Software\Policies\Microsoft\Control Panel\Desktop","NAME NOT FOUND","Desired Access: Read"

"12:34:24.3866759","FlexEngine.exe","7980","RegOpenKey","HKCU\Control Panel\Desktop","SUCCESS","Desired Access: Read"

"12:34:24.3867472","FlexEngine.exe","7980","RegQueryValue","HKCU\Control Panel\Desktop\PreferredUILanguages","NAME NOT FOUND","Length: 12"

"12:34:24.3867850","FlexEngine.exe","7980","RegCloseKey","HKCU\Control Panel\Desktop","SUCCESS",""

"12:34:24.3867981","FlexEngine.exe","7980","RegCloseKey","HKCU","SUCCESS",""

"12:34:24.3868125","FlexEngine.exe","7980","RegOpenKey","HKLM\Software\Policies\Microsoft\MUI\Settings","NAME NOT FOUND","Desired Access: Read"

"12:34:24.3869492","FlexEngine.exe","7980","RegOpenKey","HKCU","SUCCESS","Desired Access: Maximum Allowed, Granted Access: All Access"

"12:34:24.3870022","FlexEngine.exe","7980","RegOpenKey","HKCU\Control Panel\Desktop\MuiCached","SUCCESS","Desired Access: Read"

"12:34:24.3870810","FlexEngine.exe","7980","RegQueryValue","HKCU\Control Panel\Desktop\MuiCached\MachinePreferredUILanguages","BUFFER OVERFLOW","Length: 12"

"12:34:24.3871139","FlexEngine.exe","7980","RegQueryValue","HKCU\Control Panel\Desktop\MuiCached\MachinePreferredUILanguages","SUCCESS","Type: REG_MULTI_SZ, Length: 12, Data: en-US"

"12:34:24.3871513","FlexEngine.exe","7980","RegCloseKey","HKCU\Control Panel\Desktop\MuiCached","SUCCESS",""

"12:34:24.3871643","FlexEngine.exe","7980","RegCloseKey","HKCU","SUCCESS",""

"12:34:24.3872868","FlexEngine.exe","7980","RegOpenKey","HKLM","SUCCESS","Desired Access: Maximum Allowed, Granted Access: All Access"

"12:34:24.3873570","FlexEngine.exe","7980","RegQueryKey","HKLM","SUCCESS","Query: HandleTags, HandleTags: 0x0"

"12:34:24.3873710","FlexEngine.exe","7980","RegOpenKey","HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows","SUCCESS","Desired Access: Read"

"12:34:24.3875571","FlexEngine.exe","7980","RegQueryKeySecurity","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows","SUCCESS",""

"12:34:24.3875730","FlexEngine.exe","7980","RegQueryValue","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\LoadAppInit_DLLs","SUCCESS","Type: REG_DWORD, Length: 4, Data: 1"

"12:34:24.3876179","FlexEngine.exe","7980","RegQueryValue","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\RequireSignedAppInit_DLLs","NAME NOT FOUND","Length: 144"

"12:34:24.3876429","FlexEngine.exe","7980","RegQueryValue","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs","SUCCESS","Type: REG_SZ, Length: 62, Data: C:\Windows\system32\vmwsci.dll"

"12:34:24.3879963","FlexEngine.exe","7980","CreateFile","C:\Windows\System32\vmwsci.dll","SUCCESS","Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"

"12:34:24.3880849","FlexEngine.exe","7980","QueryBasicInformationFile","C:\Windows\System32\vmwsci.dll","SUCCESS","CreationTime: 06/11/2017 17:45:52, LastAccessTime: 06/11/2017 17:45:52, LastWriteTime: 07/03/2016 18:40:44, ChangeTime: 06/11/2017 17:45:43, FileAttributes: RA"

"12:34:24.3881012","FlexEngine.exe","7980","CloseFile","C:\Windows\System32\vmwsci.dll","SUCCESS",""

"12:34:24.3882318","FlexEngine.exe","7980","CreateFile","C:\Windows\System32\vmwsci.dll","SUCCESS","Desired Access: Read Data/List Directory, Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened"

"12:34:24.3882886","FlexEngine.exe","7980","CreateFileMapping","C:\Windows\System32\vmwsci.dll","FILE LOCKED WITH ONLY READERS","SyncType: SyncTypeCreateSection, PageProtection: "

"12:34:24.3883172","FlexEngine.exe","7980","CreateFileMapping","C:\Windows\System32\vmwsci.dll","SUCCESS","SyncType: SyncTypeOther"

"12:34:24.3883648","FlexEngine.exe","7980","Load Image","C:\Windows\System32\vmwsci.dll","SUCCESS","Image Base: 0x7fefd180000, Image Size: 0x25000"

"12:34:24.3883849","FlexEngine.exe","7980","CloseFile","C:\Windows\System32\vmwsci.dll","SUCCESS",""

"12:34:24.3884527","FlexEngine.exe","7980","RegOpenKey","HKLM\Software\Microsoft\Windows\CurrentVersion\SideBySide","SUCCESS","Desired Access: Read"

"12:34:24.3886656","FlexEngine.exe","7980","RegQueryKeySecurity","HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide","SUCCESS",""

"12:34:24.3886827","FlexEngine.exe","7980","RegQueryValue","HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest","NAME NOT FOUND","Length: 20"

"12:34:24.3887176","FlexEngine.exe","7980","RegCloseKey","HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide","SUCCESS",""

"12:34:24.3888761","FlexEngine.exe","7980","CreateFile","C:\Windows\System32\vmwsci.dll","SUCCESS","Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened"

"12:34:24.3889374","FlexEngine.exe","7980","QueryBasicInformationFile","C:\Windows\System32\vmwsci.dll","SUCCESS","CreationTime: 06/11/2017 17:45:52, LastAccessTime: 06/11/2017 17:45:52, LastWriteTime: 07/03/2016 18:40:44, ChangeTime: 06/11/2017 17:45:43, FileAttributes: RA"

"12:34:24.3890913","FlexEngine.exe","7980","CloseFile","C:\Windows\System32\vmwsci.dll","SUCCESS",""

"12:34:24.3893178","FlexEngine.exe","7980","Load Image","C:\Windows\System32\psapi.dll","SUCCESS","Image Base: 0x77720000, Image Size: 0x7000"

"12:34:24.3897462","FlexEngine.exe","7980","RegOpenKey","HKLM\Software\VMware, Inc.\VMware VDM\RdpVcBridge","SUCCESS","Desired Access: Read"

"12:34:24.3905587","FlexEngine.exe","7980","RegQueryValue","HKLM\SOFTWARE\VMware, Inc.\VMware VDM\RdpVcBridge\InterceptEnabled","SUCCESS","Type: REG_SZ, Length: 10, Data: true"

"12:34:24.3906107","FlexEngine.exe","7980","RegCloseKey","HKLM\SOFTWARE\VMware, Inc.\VMware VDM\RdpVcBridge","SUCCESS",""

"12:34:24.3906342","FlexEngine.exe","7980","RegOpenKey","HKLM\Software\VMware, Inc.\VMware VDM\RdpVcBridge","SUCCESS","Desired Access: Read"

"12:34:24.3907992","FlexEngine.exe","7980","RegQueryValue","HKLM\SOFTWARE\VMware, Inc.\VMware VDM\RdpVcBridge\Intercept-flexengine","NAME NOT FOUND","Length: 31"

"12:34:24.3908357","FlexEngine.exe","7980","RegCloseKey","HKLM\SOFTWARE\VMware, Inc.\VMware VDM\RdpVcBridge","SUCCESS",""

"12:34:24.3908558","FlexEngine.exe","7980","RegOpenKey","HKLM\Software\VMware, Inc.\VMware VDM\TSMMR","SUCCESS","Desired Access: Read"

"12:34:24.3910561","FlexEngine.exe","7980","RegQueryValue","HKLM\SOFTWARE\VMware, Inc.\VMware VDM\TSMMR\InterceptEnabled","SUCCESS","Type: REG_SZ, Length: 10, Data: true"

"12:34:24.3910999","FlexEngine.exe","7980","RegCloseKey","HKLM\SOFTWARE\VMware, Inc.\VMware VDM\TSMMR","SUCCESS",""

"12:34:24.3911201","FlexEngine.exe","7980","RegOpenKey","HKLM\Software\VMware, Inc.\VMware VDM\TSMMR","SUCCESS","Desired Access: Read"

"12:34:24.3912892","FlexEngine.exe","7980","RegQueryValue","HKLM\SOFTWARE\VMware, Inc.\VMware VDM\TSMMR\InterceptWhiteList","SUCCESS","Type: REG_SZ, Length: 52, Data: wmplayer.exe;iexplore.exe"

"12:34:24.3913334","FlexEngine.exe","7980","RegCloseKey","HKLM\SOFTWARE\VMware, Inc.\VMware VDM\TSMMR","SUCCESS",""

"12:34:24.3913841","FlexEngine.exe","7980","RegCloseKey","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows","SUCCESS",""

"12:34:24.3916177","FlexEngine.exe","7980","ReadFile","C:\Windows\System32\advapi32.dll","SUCCESS","Offset: 692,736, Length: 6,144, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O, Priority: Normal"

"12:34:24.3918210","FlexEngine.exe","7980","RegQueryKey","HKLM","SUCCESS","Query: HandleTags, HandleTags: 0x0"

"12:34:24.3918385","FlexEngine.exe","7980","RegOpenKey","HKLM\Software\Microsoft\Windows NT\CurrentVersion\Diagnostics","NAME NOT FOUND","Desired Access: Read"

"12:34:24.3921525","FlexEngine.exe","7980","RegQueryKey","HKLM","SUCCESS","Query: HandleTags, HandleTags: 0x0"

"12:34:24.3921668","FlexEngine.exe","7980","RegOpenKey","HKLM\SOFTWARE\Microsoft\OLE","SUCCESS","Desired Access: Read"

"12:34:24.3923270","FlexEngine.exe","7980","RegQueryKeySecurity","HKLM\SOFTWARE\Microsoft\OLE","SUCCESS",""

"12:34:24.3923428","FlexEngine.exe","7980","RegQueryValue","HKLM\SOFTWARE\Microsoft\OLE\PageAllocatorUseSystemHeap","NAME NOT FOUND","Length: 144"

"12:34:24.3923697","FlexEngine.exe","7980","RegCloseKey","HKLM\SOFTWARE\Microsoft\OLE","SUCCESS",""

"12:34:24.3924006","FlexEngine.exe","7980","RegQueryKey","HKLM","SUCCESS","Query: HandleTags, HandleTags: 0x0"

"12:34:24.3924127","FlexEngine.exe","7980","RegOpenKey","HKLM\SOFTWARE\Microsoft\OLE","SUCCESS","Desired Access: Read"

"12:34:24.3925278","FlexEngine.exe","7980","RegQueryKeySecurity","HKLM\SOFTWARE\Microsoft\OLE","SUCCESS",""

"12:34:24.3925402","FlexEngine.exe","7980","RegQueryValue","HKLM\SOFTWARE\Microsoft\OLE\PageAllocatorSystemHeapIsPrivate","NAME NOT FOUND","Length: 144"

"12:34:24.3925620","FlexEngine.exe","7980","RegCloseKey","HKLM\SOFTWARE\Microsoft\OLE","SUCCESS",""

"12:34:24.3926268","FlexEngine.exe","7980","RegQueryKey","HKLM","SUCCESS","Query: HandleTags, HandleTags: 0x0"

"12:34:24.3926394","FlexEngine.exe","7980","RegOpenKey","HKLM\Software\Microsoft\OLE\Tracing","NAME NOT FOUND","Desired Access: Read"

"12:34:24.3929433","FlexEngine.exe","7980","RegQueryKey","HKLM","SUCCESS","Query: HandleTags, HandleTags: 0x0"

"12:34:24.3929570","FlexEngine.exe","7980","RegOpenKey","HKLM\SOFTWARE\Microsoft\OLEAUT","NAME NOT FOUND","Desired Access: Query Value"

"12:34:24.3931531","FlexEngine.exe","7980","RegQueryKey","HKLM","SUCCESS","Query: HandleTags, HandleTags: 0x0"

"12:34:24.3931642","FlexEngine.exe","7980","RegOpenKey","HKLM\SOFTWARE\Microsoft\OLEAUT","NAME NOT FOUND","Desired Access: Query Value"

"12:34:24.3933924","FlexEngine.exe","7980","ReadFile","C:\Windows\winsxs\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757\comctl32.dll","SUCCESS","Offset: 1,684,480, Length: 5,632, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O, Priority: Normal"

"12:34:24.3947794","FlexEngine.exe","7980","CreateFile","C:\Windows\WindowsShell.Manifest","SUCCESS","Desired Access: Generic Read/Execute, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened"

"12:34:24.3949270","FlexEngine.exe","7980","CreateFileMapping","C:\Windows\WindowsShell.Manifest","FILE LOCKED WITH ONLY READERS","SyncType: SyncTypeCreateSection, PageProtection: "

"12:34:24.3949438","FlexEngine.exe","7980","QueryStandardInformationFile","C:\Windows\WindowsShell.Manifest","SUCCESS","AllocationSize: 4,096, EndOfFile: 749, NumberOfLinks: 1, DeletePending: False, Directory: False"

"12:34:24.3949755","FlexEngine.exe","7980","CreateFileMapping","C:\Windows\WindowsShell.Manifest","SUCCESS","SyncType: SyncTypeOther"

"12:34:24.3950178","FlexEngine.exe","7980","ReadFile","C:\Windows\WindowsShell.Manifest","SUCCESS","Offset: 0, Length: 749, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O, Priority: Normal"

"12:34:24.3951178","FlexEngine.exe","7980","RegOpenKey","HKLM\Software\Microsoft\Windows\CurrentVersion\SideBySide","SUCCESS","Desired Access: Read"

"12:34:24.3953470","FlexEngine.exe","7980","RegQueryKeySecurity","HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide","SUCCESS",""

"12:34:24.3953645","FlexEngine.exe","7980","RegQueryValue","HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest","NAME NOT FOUND","Length: 20"

"12:34:24.3953996","FlexEngine.exe","7980","RegCloseKey","HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide","SUCCESS",""

"12:34:24.3954422","FlexEngine.exe","7980","QueryStandardInformationFile","C:\Windows\WindowsShell.Manifest","SUCCESS","AllocationSize: 4,096, EndOfFile: 749, NumberOfLinks: 1, DeletePending: False, Directory: False"

"12:34:24.3954558","FlexEngine.exe","7980","QueryBasicInformationFile","C:\Windows\WindowsShell.Manifest","SUCCESS","CreationTime: 14/07/2009 04:54:24, LastAccessTime: 14/07/2009 04:54:24, LastWriteTime: 14/07/2009 04:54:24, ChangeTime: 06/11/2017 21:41:47, FileAttributes: RHA"

"12:34:24.3955576","FlexEngine.exe","7980","CloseFile","C:\Windows\WindowsShell.Manifest","SUCCESS",""

"12:34:24.3956573","FlexEngine.exe","7980","ReadFile","C:\Windows\winsxs\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928\GdiPlus.dll","SUCCESS","Offset: 2,068,992, Length: 10,240, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O, Priority: Normal"

"12:34:24.3957622","FlexEngine.exe","7980","ReadFile","C:\Windows\winsxs\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928\GdiPlus.dll","SUCCESS","Offset: 1,997,824, Length: 16,384, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O, Priority: Normal"

"12:34:24.3958725","FlexEngine.exe","7980","ReadFile","C:\Windows\winsxs\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928\GdiPlus.dll","SUCCESS","Offset: 2,018,304, Length: 13,824, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O, Priority: Normal"

"12:34:24.3959940","FlexEngine.exe","7980","ReadFile","C:\Program Files\Immidio\Flex Profiles\FlexEngine.exe","SUCCESS","Offset: 446,976, Length: 13,312, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O, Priority: Normal"

"12:34:24.3960534","FlexEngine.exe","7980","ReadFile","C:\Program Files\Immidio\Flex Profiles\FlexEngine.exe","SUCCESS","Offset: 438,784, Length: 8,192, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O, Priority: Normal"

"12:34:24.3960936","FlexEngine.exe","7980","ReadFile","C:\Program Files\Immidio\Flex Profiles\FlexEngine.exe","SUCCESS","Offset: 405,504, Length: 12,288, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O, Priority: Normal"

"12:34:24.3961360","FlexEngine.exe","7980","ReadFile","C:\Program Files\Immidio\Flex Profiles\FlexEngine.exe","SUCCESS","Offset: 54,272, Length: 4,096, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O, Priority: Normal"

"12:34:24.3961679","FlexEngine.exe","7980","ReadFile","C:\Program Files\Immidio\Flex Profiles\FlexEngine.exe","SUCCESS","Offset: 54,272, Length: 32,768, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O, Priority: Normal"

"12:34:24.3962510","FlexEngine.exe","7980","ReadFile","C:\Program Files\Immidio\Flex Profiles\FlexEngine.exe","SUCCESS","Offset: 50,176, Length: 4,096, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O, Priority: Normal"

"12:34:24.3962833","FlexEngine.exe","7980","ReadFile","C:\Program Files\Immidio\Flex Profiles\FlexEngine.exe","SUCCESS","Offset: 21,504, Length: 32,768, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O, Priority: Normal"

"12:34:24.3966910","FlexEngine.exe","7980","CreateFile","C:\Windows\System32\api-ms-win-core-synch-l1-2-0.dll","SUCCESS","Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"

"12:34:24.3967566","FlexEngine.exe","7980","QueryBasicInformationFile","C:\Windows\System32\api-ms-win-core-synch-l1-2-0.dll","SUCCESS","CreationTime: 02/02/2018 12:42:50, LastAccessTime: 02/02/2018 12:42:50, LastWriteTime: 07/09/2017 13:05:27, ChangeTime: 02/02/2018 12:47:03, FileAttributes: A"

"12:34:24.3967722","FlexEngine.exe","7980","CloseFile","C:\Windows\System32\api-ms-win-core-synch-l1-2-0.dll","SUCCESS",""

"12:34:24.3969908","FlexEngine.exe","7980","CreateFile","C:\Windows\System32\api-ms-win-core-synch-l1-2-0.dll","SUCCESS","Desired Access: Read Data/List Directory, Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened"

"12:34:24.3970445","FlexEngine.exe","7980","CreateFileMapping","C:\Windows\System32\api-ms-win-core-synch-l1-2-0.dll","FILE LOCKED WITH ONLY READERS","SyncType: SyncTypeCreateSection, PageProtection: "

"12:34:24.3971036","FlexEngine.exe","7980","CreateFileMapping","C:\Windows\System32\api-ms-win-core-synch-l1-2-0.dll","SUCCESS","SyncType: SyncTypeOther"

"12:34:24.3971987","FlexEngine.exe","7980","Load Image","C:\Windows\System32\api-ms-win-core-synch-l1-2-0.dll","SUCCESS","Image Base: 0x7fef8610000, Image Size: 0x3000"

"12:34:24.3976374","FlexEngine.exe","7980","CloseFile","C:\Windows\System32\api-ms-win-core-synch-l1-2-0.dll","SUCCESS",""

"12:34:24.3979475","FlexEngine.exe","7980","CreateFile","C:\Windows\System32\api-ms-win-core-fibers-l1-1-1.DLL","NAME NOT FOUND","Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"

"12:34:24.3990004","FlexEngine.exe","7980","ReadFile","C:\Program Files\Immidio\Flex Profiles\FlexEngine.exe","SUCCESS","Offset: 222,208, Length: 32,768, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O, Priority: Normal"

"12:34:24.3991327","FlexEngine.exe","7980","ReadFile","C:\Program Files\Immidio\Flex Profiles\FlexEngine.exe","SUCCESS","Offset: 271,360, Length: 4,096, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O, Priority: Normal"

"12:34:24.3991702","FlexEngine.exe","7980","ReadFile","C:\Program Files\Immidio\Flex Profiles\FlexEngine.exe","SUCCESS","Offset: 271,360, Length: 32,768, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O, Priority: Normal"

"12:34:24.3992413","FlexEngine.exe","7980","ReadFile","C:\Program Files\Immidio\Flex Profiles\FlexEngine.exe","SUCCESS","Offset: 356,352, Length: 16,384, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O, Priority: Normal"

"12:34:24.3993088","FlexEngine.exe","7980","ReadFile","C:\Program Files\Immidio\Flex Profiles\FlexEngine.exe","SUCCESS","Offset: 103,424, Length: 32,768, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O, Priority: Normal"

"12:34:24.3993825","FlexEngine.exe","7980","ReadFile","C:\Program Files\Immidio\Flex Profiles\FlexEngine.exe","SUCCESS","Offset: 189,440, Length: 32,768, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O, Priority: Normal"

"12:34:24.3994584","FlexEngine.exe","7980","ReadFile","C:\Program Files\Immidio\Flex Profiles\FlexEngine.exe","SUCCESS","Offset: 259,072, Length: 4,096, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O, Priority: Normal"

"12:34:24.3994879","FlexEngine.exe","7980","ReadFile","C:\Program Files\Immidio\Flex Profiles\FlexEngine.exe","SUCCESS","Offset: 254,976, Length: 16,384, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O, Priority: Normal"

"12:34:24.3998167","FlexEngine.exe","7980","CreateFile","C:\Windows\System32\api-ms-win-core-fibers-l1-1-1.DLL","NAME NOT FOUND","Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"

"12:34:24.4004870","FlexEngine.exe","7980","ReadFile","C:\Program Files\Immidio\Flex Profiles\FlexEngine.exe","SUCCESS","Offset: 308,224, Length: 31,744, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O, Priority: Normal"

"12:34:24.4008465","FlexEngine.exe","7980","CreateFile","C:\Windows\System32\api-ms-win-core-localization-l1-2-1.DLL","NAME NOT FOUND","Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"

"12:34:24.4018751","FlexEngine.exe","7980","QueryNameInformationFile","C:\Program Files\Immidio\Flex Profiles\FlexEngine.exe","SUCCESS","Name: \Program Files\Immidio\Flex Profiles\FlexEngine.exe"

"12:34:24.4022252","FlexEngine.exe","7980","CreateFile","C:\Windows\System32\rpcss.dll","SUCCESS","Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"

"12:34:24.4023650","FlexEngine.exe","7980","QueryBasicInformationFile","C:\Windows\System32\rpcss.dll","SUCCESS","CreationTime: 06/11/2017 15:11:42, LastAccessTime: 06/11/2017 15:11:42, LastWriteTime: 11/08/2017 06:35:02, ChangeTime: 06/11/2017 17:10:15, FileAttributes: A"

"12:34:24.4023823","FlexEngine.exe","7980","CloseFile","C:\Windows\System32\rpcss.dll","SUCCESS",""

"12:34:24.4025060","FlexEngine.exe","7980","CreateFile","C:\Windows\System32\rpcss.dll","SUCCESS","Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened"

"12:34:24.4026402","FlexEngine.exe","7980","CreateFileMapping","C:\Windows\System32\rpcss.dll","FILE LOCKED WITH ONLY READERS","SyncType: SyncTypeCreateSection, PageProtection: "

"12:34:24.4026552","FlexEngine.exe","7980","QueryStandardInformationFile","C:\Windows\System32\rpcss.dll","SUCCESS","AllocationSize: 512,000, EndOfFile: 512,000, NumberOfLinks: 2, DeletePending: False, Directory: False"

"12:34:24.4026847","FlexEngine.exe","7980","CreateFileMapping","C:\Windows\System32\rpcss.dll","SUCCESS","SyncType: SyncTypeOther"

"12:34:24.4027323","FlexEngine.exe","7980","CloseFile","C:\Windows\System32\rpcss.dll","SUCCESS",""

"12:34:24.4029981","FlexEngine.exe","7980","CreateFile","C:\Windows\System32\rpcss.dll","SUCCESS","Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"

"12:34:24.4031243","FlexEngine.exe","7980","QueryBasicInformationFile","C:\Windows\System32\rpcss.dll","SUCCESS","CreationTime: 06/11/2017 15:11:42, LastAccessTime: 06/11/2017 15:11:42, LastWriteTime: 11/08/2017 06:35:02, ChangeTime: 06/11/2017 17:10:15, FileAttributes: A"

"12:34:24.4031379","FlexEngine.exe","7980","CloseFile","C:\Windows\System32\rpcss.dll","SUCCESS",""

"12:34:24.4032586","FlexEngine.exe","7980","CreateFile","C:\Windows\System32\rpcss.dll","SUCCESS","Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened"

"12:34:24.4033935","FlexEngine.exe","7980","CreateFileMapping","C:\Windows\System32\rpcss.dll","FILE LOCKED WITH ONLY READERS","SyncType: SyncTypeCreateSection, PageProtection: "

"12:34:24.4034054","FlexEngine.exe","7980","QueryStandardInformationFile","C:\Windows\System32\rpcss.dll","SUCCESS","AllocationSize: 512,000, EndOfFile: 512,000, NumberOfLinks: 2, DeletePending: False, Directory: False"

"12:34:24.4034285","FlexEngine.exe","7980","CreateFileMapping","C:\Windows\System32\rpcss.dll","SUCCESS","SyncType: SyncTypeOther"

"12:34:24.4035719","FlexEngine.exe","7980","CloseFile","C:\Windows\System32\rpcss.dll","SUCCESS",""

"12:34:24.4042562","FlexEngine.exe","7980","CreateFile","C:\Program Files\Immidio\Flex Profiles\CRYPTBASE.dll","NAME NOT FOUND","Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"

"12:34:24.4048651","FlexEngine.exe","7980","CreateFile","C:\Windows\System32\cryptbase.dll","SUCCESS","Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"

"12:34:24.4049250","FlexEngine.exe","7980","QueryBasicInformationFile","C:\Windows\System32\cryptbase.dll","SUCCESS","CreationTime: 06/11/2017 15:11:39, LastAccessTime: 06/11/2017 15:11:39, LastWriteTime: 13/09/2017 15:27:56, ChangeTime: 06/11/2017 17:10:17, FileAttributes: A"

"12:34:24.4049391","FlexEngine.exe","7980","CloseFile","C:\Windows\System32\cryptbase.dll","SUCCESS",""

"12:34:24.4052985","FlexEngine.exe","7980","CreateFile","C:\Windows\System32\cryptbase.dll","SUCCESS","Desired Access: Read Data/List Directory, Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened"

"12:34:24.4053521","FlexEngine.exe","7980","CreateFileMapping","C:\Windows\System32\cryptbase.dll","FILE LOCKED WITH ONLY READERS","SyncType: SyncTypeCreateSection, PageProtection: "

"12:34:24.4054075","FlexEngine.exe","7980","CreateFileMapping","C:\Windows\System32\cryptbase.dll","SUCCESS","SyncType: SyncTypeOther"

"12:34:24.4056505","FlexEngine.exe","7980","Load Image","C:\Windows\System32\cryptbase.dll","SUCCESS","Image Base: 0x7fefd070000, Image Size: 0xf000"

"12:34:24.4056693","FlexEngine.exe","7980","CloseFile","C:\Windows\System32\cryptbase.dll","SUCCESS",""

"12:34:24.4062843","FlexEngine.exe","7980","Thread Create","","SUCCESS","Thread ID: 7988"

"12:34:24.4066702","FlexEngine.exe","7980","CreateFile","C:\Windows\System32\api-ms-win-appmodel-runtime-l1-1-1.DLL","NAME NOT FOUND","Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"

"12:34:24.4076490","FlexEngine.exe","7980","CreateFile","C:\Windows\System32\ext-ms-win-kernel32-package-current-l1-1-0.DLL","NAME NOT FOUND","Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"

"12:34:24.4083994","FlexEngine.exe","7980","RegQueryKey","HKLM","SUCCESS","Query: HandleTags, HandleTags: 0x0"

"12:34:24.4084181","FlexEngine.exe","7980","RegOpenKey","HKCR\CLSID\{168D5BA5-56AB-455D-8D93-ABF40EAEB95A}\InprocServer32","NAME NOT FOUND","Desired Access: Query Value"

"12:34:24.4090753","FlexEngine.exe","7980","ReadFile","C:\Windows\System32\user32.dll","SUCCESS","Offset: 459,776, Length: 4,096, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O, Priority: Normal"

"12:34:24.4091992","FlexEngine.exe","7980","ReadFile","C:\Windows\System32\user32.dll","SUCCESS","Offset: 459,776, Length: 32,768, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O, Priority: Normal"

"12:34:24.4094671","FlexEngine.exe","7980","ReadFile","C:\Windows\System32\user32.dll","SUCCESS","Offset: 164,864, Length: 4,096, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O, Priority: Normal"

"12:34:24.4096660","FlexEngine.exe","7980","ReadFile","C:\Windows\System32\user32.dll","SUCCESS","Offset: 164,864, Length: 4,096, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O, Priority: Normal"

"12:34:24.4097444","FlexEngine.exe","7980","RegOpenKey","HKLM\Software\Microsoft\Windows\Windows Error Reporting\WMR","SUCCESS","Desired Access: Query Value"

"12:34:24.4099416","FlexEngine.exe","7980","RegQueryKeySecurity","HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting\WMR","SUCCESS",""

"12:34:24.4099688","FlexEngine.exe","7980","RegQueryValue","HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting\WMR\Disable","SUCCESS","Type: REG_DWORD, Length: 4, Data: 1"

"12:34:24.4100123","FlexEngine.exe","7980","RegCloseKey","HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting\WMR","SUCCESS",""

"12:34:24.4101882","FlexEngine.exe","7980","RegOpenKey","HKLM\System\CurrentControlSet\Control\Nls\CustomLocale","REPARSE","Desired Access: Read"

"12:34:24.4104267","FlexEngine.exe","7980","RegOpenKey","HKLM\System\CurrentControlSet\Control\Nls\CustomLocale","SUCCESS","Desired Access: Read"

"12:34:24.4105413","FlexEngine.exe","7980","RegQueryValue","HKLM\System\CurrentControlSet\Control\Nls\CustomLocale\en-GB","NAME NOT FOUND","Length: 532"

"12:34:24.4105754","FlexEngine.exe","7980","RegCloseKey","HKLM\System\CurrentControlSet\Control\Nls\CustomLocale","SUCCESS",""

"12:34:24.4105896","FlexEngine.exe","7980","RegOpenKey","HKLM\System\CurrentControlSet\Control\Nls\ExtendedLocale","REPARSE","Desired Access: Read"

"12:34:24.4107247","FlexEngine.exe","7980","RegOpenKey","HKLM\System\CurrentControlSet\Control\Nls\ExtendedLocale","SUCCESS","Desired Access: Read"

"12:34:24.4108282","FlexEngine.exe","7980","RegQueryValue","HKLM\System\CurrentControlSet\Control\Nls\ExtendedLocale\en-GB","NAME NOT FOUND","Length: 532"

"12:34:24.4108596","FlexEngine.exe","7980","RegCloseKey","HKLM\System\CurrentControlSet\Control\Nls\ExtendedLocale","SUCCESS",""

"12:34:24.4109229","FlexEngine.exe","7980","RegOpenKey","HKLM\System\CurrentControlSet\Control\Nls\Locale","REPARSE","Desired Access: Read"

"12:34:24.4110301","FlexEngine.exe","7980","RegOpenKey","HKLM\System\CurrentControlSet\Control\Nls\Locale","SUCCESS","Desired Access: Read"

"12:34:24.4111305","FlexEngine.exe","7980","RegOpenKey","HKLM\System\CurrentControlSet\Control\Nls\Locale\Alternate Sorts","REPARSE","Desired Access: Read"

"12:34:24.4112715","FlexEngine.exe","7980","RegOpenKey","HKLM\System\CurrentControlSet\Control\Nls\Locale\Alternate Sorts","SUCCESS","Desired Access: Read"

"12:34:24.4113751","FlexEngine.exe","7980","RegOpenKey","HKLM\System\CurrentControlSet\Control\Nls\Language Groups","REPARSE","Desired Access: Read"

"12:34:24.4115202","FlexEngine.exe","7980","RegOpenKey","HKLM\System\CurrentControlSet\Control\Nls\Language Groups","SUCCESS","Desired Access: Read"

"12:34:24.4116262","FlexEngine.exe","7980","RegQueryValue","HKLM\System\CurrentControlSet\Control\Nls\Locale\00000809","SUCCESS","Type: REG_SZ, Length: 4, Data: 1"

"12:34:24.4116629","FlexEngine.exe","7980","RegQueryValue","HKLM\System\CurrentControlSet\Control\Nls\Language Groups\1","SUCCESS","Type: REG_SZ, Length: 4, Data: 1"

"12:34:24.4118763","FlexEngine.exe","7980","RegQueryKey","HKLM","SUCCESS","Query: HandleTags, HandleTags: 0x0"

"12:34:24.4118960","FlexEngine.exe","7980","RegOpenKey","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink","SUCCESS","Desired Access: Query Value, Enumerate Sub Keys"

"12:34:24.4121046","FlexEngine.exe","7980","RegQueryKeySecurity","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink","SUCCESS",""

"12:34:24.4121256","FlexEngine.exe","7980","RegSetInfoKey","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink","SUCCESS","KeySetInformationClass: KeySetHandleTagsInformation, Length: 0"

"12:34:24.4121439","FlexEngine.exe","7980","RegQueryKey","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink","SUCCESS","Query: Cached, SubKeys: 0, Values: 36"

"12:34:24.4122066","FlexEngine.exe","7980","RegEnumValue","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink","BUFFER OVERFLOW","Index: 0, Length: 220"

"12:34:24.4122543","FlexEngine.exe","7980","RegEnumValue","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink","SUCCESS","Index: 0, Name: Lucida Sans Unicode, Type: REG_MULTI_SZ, Length: 164, Data: MSGOTHIC.TTC,MS UI Gothic, MINGLIU.TTC,PMingLiU, SIMSUN.TTC,SimSun, GULIM.TTC,Gulim"

"12:34:24.4123057","FlexEngine.exe","7980","RegEnumValue","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink","BUFFER OVERFLOW","Index: 1, Length: 220"

"12:34:24.4123399","FlexEngine.exe","7980","RegEnumValue","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink","SUCCESS","Index: 1, Name: Microsoft Sans Serif, Type: REG_MULTI_SZ, Length: 164, Data: MSGOTHIC.TTC,MS UI Gothic, MINGLIU.TTC,PMingLiU, SIMSUN.TTC,SimSun, GULIM.TTC,Gulim"

"12:34:24.4123792","FlexEngine.exe","7980","RegEnumValue","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink","SUCCESS","Index: 2, Name: Tahoma, Type: REG_MULTI_SZ, Length: 164, Data: MSGOTHIC.TTC,MS UI Gothic, MINGLIU.TTC,PMingLiU, SIMSUN.TTC,SimSun, GULIM.TTC,Gulim"

"12:34:24.4124201","FlexEngine.exe","7980","RegEnumValue","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink","BUFFER OVERFLOW","Index: 3, Length: 220"

"12:34:24.4124499","FlexEngine.exe","7980","RegEnumValue","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink","SUCCESS","Index: 3, Name: Segoe UI, Type: REG_MULTI_SZ, Length: 430, Data: TAHOMA.TTF, MEIRYO.TTC,Meiryo,128,85, MEIRYO.TTC,Meiryo, MSGOTHIC.TTC,MS UI Gothic, MSJH.TTF,128,96, MSJH.TTF, MSYH.TTF,128,96, MSYH.TTF, MALGUN.TTF,128,96, MALGUN.TTF, MINGLIU.TTC,PMingLiU, SIMSUN.TTC,SimSun, GULIM.TTC,Gulim"

"12:34:24.4124911","FlexEngine.exe","7980","RegEnumValue","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink","BUFFER OVERFLOW","Index: 4, Length: 220"

"12:34:24.4125498","FlexEngine.exe","7980","RegEnumValue","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink","SUCCESS","Index: 4, Name: MingLiU, Type: REG_MULTI_SZ, Length: 186, Data: MICROSS.TTF,40,48, MICROSS.TTF, SIMSUN.TTC,SimSun, MSMINCHO.TTC,MS Mincho, BATANG.TTC,BatangChe"

"12:34:24.4125950","FlexEngine.exe","7980","RegEnumValue","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink","BUFFER OVERFLOW","Index: 5, Length: 220"

"12:34:24.4126243","FlexEngine.exe","7980","RegEnumValue","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink","SUCCESS","Index: 5, Name: PMingLiU, Type: REG_MULTI_SZ, Length: 182, Data: MICROSS.TTF,40,48, MICROSS.TTF, SIMSUN.TTC,SimSun, MSMINCHO.TTC,MS PMincho, BATANG.TTC,Batang"

"12:34:24.4126769","FlexEngine.exe","7980","RegEnumValue","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink","BUFFER OVERFLOW","Index: 6, Length: 220"

"12:34:24.4127185","FlexEngine.exe","7980","RegEnumValue","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink","SUCCESS","Index: 6, Name: MingLiU_HKSCS, Type: REG_MULTI_SZ, Length: 226, Data: MICROSS.TTF,40,48, MICROSS.TTF, MINGLIU.TTC,MingLiU, SIMSUN.TTC,SimSun, MSMINCHO.TTC,MS Mincho, BATANG.TTC,BatangChe"

"12:34:24.4127649","FlexEngine.exe","7980","RegEnumValue","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink","BUFFER OVERFLOW","Index: 7, Length: 220"

"12:34:24.4128050","FlexEngine.exe","7980","RegEnumValue","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink","SUCCESS","Index: 7, Name: MingLiU-ExtB, Type: REG_MULTI_SZ, Length: 226, Data: MICROSS.TTF,40,48, MICROSS.TTF, MINGLIU.TTC,MingLiU, SIMSUN.TTC,SimSun, MSMINCHO.TTC,MS Mincho, BATANG.TTC,BatangChe"

"12:34:24.4133743","FlexEngine.exe","7980","RegEnumValue","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink","BUFFER OVERFLOW","Index: 8, Length: 220"

"12:34:24.4134203","FlexEngine.exe","7980","RegEnumValue","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink","SUCCESS","Index: 8, Name: PMingLiU-ExtB, Type: REG_MULTI_SZ, Length: 224, Data: MICROSS.TTF,40,48, MICROSS.TTF, MINGLIU.TTC,PMingLiU, SIMSUN.TTC,SimSun, MSMINCHO.TTC,MS PMincho, BATANG.TTC,Batang"

"12:34:24.4134688","FlexEngine.exe","7980","RegEnumValue","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink","BUFFER OVERFLOW","Index: 9, Length: 220"

"12:34:24.4135072","FlexEngine.exe","7980","RegEnumValue","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink","SUCCESS","Index: 9, Name: MingLiU_HKSCS-ExtB, Type: REG_MULTI_SZ, Length: 278, Data: MICROSS.TTF,40,48, MICROSS.TTF, MINGLIU.TTC,MingLiU_HKSCS, MINGLIU.TTC,MingLiU, SIMSUN.TTC,SimSun, MSMINCHO.TTC,MS Mincho, BATANG.TTC,BatangChe"

"12:34:24.4135558","FlexEngine.exe","7980","RegEnumValue","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink","BUFFER OVERFLOW","Index: 10, Length: 220"

"12:34:24.4135959","FlexEngine.exe","7980","RegEnumValue","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink","SUCCESS","Index: 10, Name: Microsoft JhengHei, Type: REG_MULTI_SZ, Length: 298, Data: SEGOEUI.TTF,114,78, SEGOEUI.TTF, MINGLIU.TTC,MingLiU, MSYH.TTF,128,96, MSYH.TTF, MEIRYO.TTC,Meiryo,128,85, MEIRYO.TTC,Meiryo, MALGUN.TTF,128,96, MALGUN.TTF"

"12:34:24.4136545","FlexEngine.exe","7980","RegEnumValue","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink","BUFFER OVERFLOW","Index: 11, Length: 220"

"12:34:24.4136957","FlexEngine.exe","7980","RegEnumValue","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink","SUCCESS","Index: 11, Name: Microsoft JhengHei Bold, Type: REG_MULTI_SZ, Length: 342, Data: SEGOEUIB.TTF,114,78, SEGOEUIB.TTF, MINGLIU.TTC,MingLiU, MSYHBD.TTF,128,96, MSYHBD.TTF, MEIRYOB.TTC,Meiryo Bold,128,85, MEIRYOB.TTC,Meiryo Bold, MALGUNBD.TTF,128,96, MALGUNBD.TTF"

"12:34:24.4137449","FlexEngine.exe","7980","RegEnumValue","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink","BUFFER OVERFLOW","Index: 12, Length: 220"

"12:34:24.4137767","FlexEngine.exe","7980","RegEnumValue","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink","SUCCESS","Index: 12, Name: SimSun, Type: REG_MULTI_SZ, Length: 192, Data: MICROSS.TTF,108,122, MICROSS.TTF, MINGLIU.TTC,PMingLiU, MSMINCHO.TTC,MS PMincho, BATANG.TTC,Batang"

"12:34:24.4138182","FlexEngine.exe","7980","RegEnumValue","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink","BUFFER OVERFLOW","Index: 13, Length: 220"

"12:34:24.4138484","FlexEngine.exe","7980","RegEnumValue","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink","SUCCESS","Index: 13, Name: SimSun-ExtB, Type: REG_MULTI_SZ, Length: 228, Data: MICROSS.TTF,108,122, MICROSS.TTF, SIMSUN.TTC,SimSun, MINGLIU.TTC,PMingLiU, MSMINCHO.TTC,MS PMincho, BATANG.TTC,Batang"

"12:34:24.4138971","FlexEngine.exe","7980","RegEnumValue","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink","SUCCESS","Index: 14, Name: NSimSun, Type: REG_MULTI_SZ, Length: 132, Data: MINGLIU.TTC,PMingLiU, MSMINCHO.TTC,MS Mincho, BATANG.TTC,BatangChe"

"12:34:24.4139348","FlexEngine.exe","7980","RegEnumValue","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink","BUFFER OVERFLOW","Index: 15, Length: 220"

"12:34:24.4139644","FlexEngine.exe","7980","RegEnumValue","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink","SUCCESS","Index: 15, Name: Microsoft YaHei, Type: REG_MULTI_SZ, Length: 294, Data: SEGOEUI.TTF,120,80, SEGOEUI.TTF, SIMSUN.TTC,SimSun, MSJH.TTF,128,96, MSJH.TTF, MEIRYO.TTC,Meiryo,128,85, MEIRYO.TTC,Meiryo, MALGUN.TTF,128,96, MALGUN.TTF"

"12:34:24.4140099","FlexEngine.exe","7980","RegEnumValue","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink","BUFFER OVERFLOW","Index: 16, Length: 220"

"12:34:24.4140422","FlexEngine.exe","7980","RegEnumValue","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink","SUCCESS","Index: 16, Name: Microsoft YaHei Bold, Type: REG_MULTI_SZ, Length: 338, Data: SEGOEUIB.TTF,120,80, SEGOEUIB.TTF, SIMSUN.TTC,SimSun, MSJHBD.TTF,128,96, MSJHBD.TTF, MEIRYOB.TTC,Meiryo Bold,128,85, MEIRYOB.TTC,Meiryo Bold, MALGUNBD.TTF,128,96, MALGUNBD.TTF"

"12:34:24.4140879","FlexEngine.exe","7980","RegEnumValue","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink","BUFFER OVERFLOW","Index: 17, Length: 220"

"12:34:24.4141200","FlexEngine.exe","7980","RegEnumValue","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink","SUCCESS","Index: 17, Name: Meiryo, Type: REG_MULTI_SZ, Length: 274, Data: SEGOEUI.TTF,133,83, SEGOEUI.TTF, MSGOTHIC.TTC,MS UI Gothic, MSJH.TTF,128,96, MSJH.TTF, MSYH.TTF,128,96, MSYH.TTF, MALGUN.TTF,128,96, MALGUN.TTF"

"12:34:24.4141653","FlexEngine.exe","7980","RegEnumValue","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink","BUFFER OVERFLOW","Index: 18, Length: 220"

"12:34:24.4141949","FlexEngine.exe","7980","RegEnumValue","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink","SUCCESS","Index: 18, Name: Meiryo Bold, Type: REG_MULTI_SZ, Length: 302, Data: SEGOEUIB.TTF,133,83, SEGOEUIB.TTF, MSGOTHIC.TTC,MS UI Gothic, MSJHBD.TTF,128,96, MSJHBD.TTF, MSYHBD.TTF,128,96, MSYHBD.TTF, MALGUNBD.TTF,128,96, MALGUNBD.TTF"

"12:34:24.4142472","FlexEngine.exe","7980","RegEnumValue","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink","BUFFER OVERFLOW","Index: 19, Length: 220"

"12:34:24.4142765","FlexEngine.exe","7980","RegEnumValue","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink","SUCCESS","Index: 19, Name: Meiryo UI, Type: REG_MULTI_SZ, Length: 274, Data: SEGOEUI.TTF,133,83, SEGOEUI.TTF, MSGOTHIC.TTC,MS UI Gothic, MSJH.TTF,128,96, MSJH.TTF, MSYH.TTF,128,96, MSYH.TTF, MALGUN.TTF,128,96, MALGUN.TTF"

"12:34:24.4143267","FlexEngine.exe","7980","RegEnumValue","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink","BUFFER OVERFLOW","Index: 20, Length: 220"

"12:34:24.4144221","FlexEngine.exe","7980","RegEnumValue","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink","SUCCESS","Index: 20, Name: Meiryo UI Bold, Type: REG_MULTI_SZ, Length: 302, Data: SEGOEUIB.TTF,133,83, SEGOEUIB.TTF, MSGOTHIC.TTC,MS UI Gothic, MSJHBD.TTF,128,96, MSJHBD.TTF, MSYHBD.TTF,128,96, MSYHBD.TTF, MALGUNBD.TTF,128,96, MALGUNBD.TTF"

"12:34:24.4144716","FlexEngine.exe","7980","RegEnumValue","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink","SUCCESS","Index: 21, Name: MS Gothic, Type: REG_MULTI_SZ, Length: 116, Data: MINGLIU.TTC,MingLiU, SIMSUN.TTC,SimSun, GULIM.TTC,GulimChe"

"12:34:24.4145220","FlexEngine.exe","7980","RegEnumValue","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink","SUCCESS","Index: 22, Name: MS PGothic, Type: REG_MULTI_SZ, Length: 112, Data: MINGLIU.TTC,PMingLiU, SIMSUN.TTC,SimSun, GULIM.TTC,Gulim"

"12:34:24.4145629","FlexEngine.exe","7980","RegEnumValue","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink","BUFFER OVERFLOW","Index: 23, Length: 220"

"12:34:24.4145953","FlexEngine.exe","7980","RegEnumValue","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink","SUCCESS","Index: 23, Name: MS UI Gothic, Type: REG_MULTI_SZ, Length: 176, Data: MICROSS.TTF,128,142, MICROSS.TTF, MINGLIU.TTC,PMingLiU, SIMSUN.TTC,SimSun, GULIM.TTC,Gulim"

"12:34:24.4146460","FlexEngine.exe","7980","RegEnumValue","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink","SUCCESS","Index: 24, Name: MS Mincho, Type: REG_MULTI_SZ, Length: 114, Data: MINGLIU.TTC,MingLiU, SIMSUN.TTC,SimSun, BATANG.TTC,Batang"

"12:34:24.4146881","FlexEngine.exe","7980","RegEnumValue","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink","SUCCESS","Index: 25, Name: MS PMincho, Type: REG_MULTI_SZ, Length: 116, Data: MINGLIU.TTC,PMingLiU, SIMSUN.TTC,SimSun, BATANG.TTC,Batang"

"12:34:24.4147310","FlexEngine.exe","7980","RegEnumValue","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink","SUCCESS","Index: 26, Name: Batang, Type: REG_MULTI_SZ, Length: 128, Data: MSMINCHO.TTC,MS PMincho, MINGLIU.TTC,PMingLiU, SIMSUN.TTC,SimSun"

"12:34:24.4147715","FlexEngine.exe","7980","RegEnumValue","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink","SUCCESS","Index: 27, Name: BatangChe, Type: REG_MULTI_SZ, Length: 124, Data: MSMINCHO.TTC,MS Mincho, MINGLIU.TTC,MingLiU, SIMSUN.TTC,SimSun"

"12:34:24.4148215","FlexEngine.exe","7980","RegEnumValue","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink","SUCCESS","Index: 28, Name: Dotum, Type: REG_MULTI_SZ, Length: 132, Data: MSGOTHIC.TTC,MS UI Gothic, MINGLIU.TTC,PMingLiU, SIMSUN.TTC,SimSun"

"12:34:24.4148641","FlexEngine.exe","7980","RegEnumValue","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink","SUCCESS","Index: 29, Name: DotumChe, Type: REG_MULTI_SZ, Length: 124, Data: MSGOTHIC.TTC,MS Gothic, MINGLIU.TTC,MingLiU, SIMSUN.TTC,SimSun"

"12:34:24.4149059","FlexEngine.exe","7980","RegEnumValue","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink","BUFFER OVERFLOW","Index: 30, Length: 220"

"12:34:24.4149475","FlexEngine.exe","7980","RegEnumValue","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink","SUCCESS","Index: 30, Name: Gulim, Type: REG_MULTI_SZ, Length: 196, Data: MICROSS.TTF,128,140, MICROSS.TTF, MSGOTHIC.TTC,MS UI Gothic, MINGLIU.TTC,PMingLiU, SIMSUN.TTC,SimSun"

"12:34:24.4149999","FlexEngine.exe","7980","RegEnumValue","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink","SUCCESS","Index: 31, Name: GulimChe, Type: REG_MULTI_SZ, Length: 124, Data: MSGOTHIC.TTC,MS Gothic, MINGLIU.TTC,MingLiU, SIMSUN.TTC,SimSun"

"12:34:24.4151038","FlexEngine.exe","7980","RegEnumValue","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink","SUCCESS","Index: 32, Name: Gungsuh, Type: REG_MULTI_SZ, Length: 128, Data: MSMINCHO.TTC,MS PMincho, MINGLIU.TTC,PMingLiU, SIMSUN.TTC,SimSun"

"12:34:24.4151490","FlexEngine.exe","7980","RegEnumValue","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink","SUCCESS","Index: 33, Name: GungsuhChe, Type: REG_MULTI_SZ, Length: 124, Data: MSMINCHO.TTC,MS Mincho, MINGLIU.TTC,MingLiU, SIMSUN.TTC,SimSun"

"12:34:24.4151986","FlexEngine.exe","7980","RegEnumValue","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink","BUFFER OVERFLOW","Index: 34, Length: 220"

"12:34:24.4152418","FlexEngine.exe","7980","RegEnumValue","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink","SUCCESS","Index: 34, Name: Malgun Gothic, Type: REG_MULTI_SZ, Length: 282, Data: SEGOEUI.TTF,130,81, SEGOEUI.TTF, GULIM.TTC,Gulim, MEIRYO.TTC,Meiryo,128,85, MEIRYO.TTC,Meiryo, MSJH.TTF,128,96, MSJH.TTF, MSYH.TTF,128,96, MSYH.TTF"

"12:34:24.4153010","FlexEngine.exe","7980","RegEnumValue","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink","BUFFER OVERFLOW","Index: 35, Length: 220"

"12:34:24.4153460","FlexEngine.exe","7980","RegEnumValue","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink","SUCCESS","Index: 35, Name: Malgun Gothic Bold, Type: REG_MULTI_SZ, Length: 326, Data: SEGOEUIB.TTF,130,81, SEGOEUIB.TTF, GULIM.TTC,Gulim, MEIRYOB.TTC,Meiryo Bold,128,85, MEIRYOB.TTC,Meiryo Bold, MSJHBD.TTF,128,96, MSJHBD.TTF, MSYHBD.TTF,128,96, MSYHBD.TTF"

"12:34:24.4154080","FlexEngine.exe","7980","RegEnumValue","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink","NO MORE ENTRIES","Index: 36, Length: 220"

"12:34:24.4154499","FlexEngine.exe","7980","RegCloseKey","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink","SUCCESS",""

"12:34:24.4155702","FlexEngine.exe","7980","RegQueryKey","HKLM","SUCCESS","Query: HandleTags, HandleTags: 0x0"

"12:34:24.4155903","FlexEngine.exe","7980","RegOpenKey","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\DataStore_V1.0","SUCCESS","Desired Access: Query Value"

"12:34:24.4157940","FlexEngine.exe","7980","RegQueryKeySecurity","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\DataStore_V1.0","SUCCESS",""

"12:34:24.4158131","FlexEngine.exe","7980","RegSetInfoKey","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\DataStore_V1.0","SUCCESS","KeySetInformationClass: KeySetHandleTagsInformation, Length: 0"

"12:34:24.4158303","FlexEngine.exe","7980","RegQueryValue","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\DataStore_V1.0\Disable","NAME NOT FOUND","Length: 144"

"12:34:24.4158617","FlexEngine.exe","7980","RegQueryValue","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\DataStore_V1.0\DataFilePath","SUCCESS","Type: REG_SZ, Length: 66, Data: C:\Windows\Fonts\staticcache.dat"

"12:34:24.4158873","FlexEngine.exe","7980","RegCloseKey","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\DataStore_V1.0","SUCCESS",""

"12:34:24.4162628","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad878b7-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\Fonts","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.4163084","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad878b1-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\Fonts","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.4163441","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad878ab-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\Fonts","SUCCESS","Desired Access: All Access"

"12:34:24.4163841","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD878AB-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\FONTS\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.4164370","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD878AB-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\FONTS","SUCCESS",""

"12:34:24.4164686","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad878a5-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\Fonts","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.4165020","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad8789e-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\Fonts","SUCCESS","Desired Access: All Access"

"12:34:24.4165365","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD8789E-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\WINDOWS\FONTS\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.4165847","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD8789E-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\WINDOWS\FONTS","SUCCESS",""

"12:34:24.4166148","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad8788c-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\Fonts","SUCCESS","Desired Access: All Access"

"12:34:24.4166493","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD8788C-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\FONTS\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.4166958","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD8788C-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\FONTS","SUCCESS",""

"12:34:24.4167261","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad8787f-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\Fonts","SUCCESS","Desired Access: All Access"

"12:34:24.4167633","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD8787F-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\FONTS\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.4168100","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD8787F-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\FONTS","SUCCESS",""

"12:34:24.4168401","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87873-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\Fonts","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.4168730","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87861-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\Fonts","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.4169046","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87839-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\Fonts","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.4169364","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87841-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\Fonts","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.4169669","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87818-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\Fonts","SUCCESS","Desired Access: All Access"

"12:34:24.4169986","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD87818-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\WINDOWS\FONTS\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.4170451","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD87818-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\WINDOWS\FONTS","SUCCESS",""

"12:34:24.4170746","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87826-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\Fonts","SUCCESS","Desired Access: All Access"

"12:34:24.4171078","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD87826-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\FONTS\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.4171537","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD87826-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\FONTS","SUCCESS",""

"12:34:24.4171817","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87811-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\Fonts","SUCCESS","Desired Access: All Access"

"12:34:24.4172140","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD87811-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\FONTS\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.4172589","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD87811-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\FONTS","SUCCESS",""

"12:34:24.4173095","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad878b7-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\Fonts","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.4173404","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad878b1-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\Fonts","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.4173699","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad878ab-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\Fonts","SUCCESS","Desired Access: All Access"

"12:34:24.4173969","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD878AB-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\FONTS\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.4174421","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD878AB-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\FONTS","SUCCESS",""

"12:34:24.4174704","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad878a5-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\Fonts","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.4175000","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad8789e-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\Fonts","SUCCESS","Desired Access: All Access"

"12:34:24.4175258","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD8789E-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\WINDOWS\FONTS\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.4175701","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD8789E-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\WINDOWS\FONTS","SUCCESS",""

"12:34:24.4175986","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad8788c-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\Fonts","SUCCESS","Desired Access: All Access"

"12:34:24.4176247","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD8788C-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\FONTS\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.4176680","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD8788C-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\FONTS","SUCCESS",""

"12:34:24.4176959","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad8787f-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\Fonts","SUCCESS","Desired Access: All Access"

"12:34:24.4177223","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD8787F-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\FONTS\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.4177648","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD8787F-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\FONTS","SUCCESS",""

"12:34:24.4177929","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87873-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\Fonts","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.4178227","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87861-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\Fonts","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.4178519","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87839-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\Fonts","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.4178820","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87841-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\Fonts","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.4179116","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87818-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\Fonts","SUCCESS","Desired Access: All Access"

"12:34:24.4179372","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD87818-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\WINDOWS\FONTS\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.4179808","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD87818-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\WINDOWS\FONTS","SUCCESS",""

"12:34:24.4180159","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87826-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\Fonts","SUCCESS","Desired Access: All Access"

"12:34:24.4180426","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD87826-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\FONTS\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.4180877","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD87826-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\FONTS","SUCCESS",""

"12:34:24.4181200","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87811-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\Fonts","SUCCESS","Desired Access: All Access"

"12:34:24.4181507","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD87811-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\FONTS\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.4182007","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD87811-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\FONTS","SUCCESS",""

"12:34:24.4182894","FlexEngine.exe","7980","CreateFile","C:\Windows\Fonts\StaticCache.dat","SUCCESS","Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened"

"12:34:24.4185891","FlexEngine.exe","7980","QueryStandardInformationFile","C:\Windows\Fonts\StaticCache.dat","SUCCESS","AllocationSize: 9,633,792, EndOfFile: 9,633,792, NumberOfLinks: 1, DeletePending: False, Directory: False"

"12:34:24.4186082","FlexEngine.exe","7980","ReadFile","C:\Windows\Fonts\StaticCache.dat","SUCCESS","Offset: 0, Length: 60, Priority: Normal"

"12:34:24.4186513","FlexEngine.exe","7980","CreateFileMapping","C:\Windows\Fonts\StaticCache.dat","FILE LOCKED WITH ONLY READERS","SyncType: SyncTypeCreateSection, PageProtection: "

"12:34:24.4186659","FlexEngine.exe","7980","QueryStandardInformationFile","C:\Windows\Fonts\StaticCache.dat","SUCCESS","AllocationSize: 9,633,792, EndOfFile: 9,633,792, NumberOfLinks: 1, DeletePending: False, Directory: False"

"12:34:24.4186981","FlexEngine.exe","7980","CreateFileMapping","C:\Windows\Fonts\StaticCache.dat","SUCCESS","SyncType: SyncTypeOther"

"12:34:24.4193166","FlexEngine.exe","7980","RegQueryKey","HKLM","SUCCESS","Query: HandleTags, HandleTags: 0x0"

"12:34:24.4193442","FlexEngine.exe","7980","RegOpenKey","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback","SUCCESS","Desired Access: Query Value"

"12:34:24.4195874","FlexEngine.exe","7980","RegQueryKeySecurity","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback","SUCCESS",""

"12:34:24.4196069","FlexEngine.exe","7980","RegSetInfoKey","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback","SUCCESS","KeySetInformationClass: KeySetHandleTagsInformation, Length: 0"

"12:34:24.4196353","FlexEngine.exe","7980","RegQueryValue","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane1","NAME NOT FOUND","Length: 144"

"12:34:24.4196709","FlexEngine.exe","7980","RegQueryValue","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane2","SUCCESS","Type: REG_SZ, Length: 24, Data: SimSun-ExtB"

"12:34:24.4196950","FlexEngine.exe","7980","RegQueryValue","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane2","SUCCESS","Type: REG_SZ, Length: 24, Data: SimSun-ExtB"

"12:34:24.4197187","FlexEngine.exe","7980","RegQueryValue","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane3","NAME NOT FOUND","Length: 144"

"12:34:24.4197419","FlexEngine.exe","7980","RegQueryValue","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane4","NAME NOT FOUND","Length: 144"

"12:34:24.4197656","FlexEngine.exe","7980","RegQueryValue","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane5","NAME NOT FOUND","Length: 144"

"12:34:24.4198000","FlexEngine.exe","7980","RegQueryValue","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane6","NAME NOT FOUND","Length: 144"

"12:34:24.4198216","FlexEngine.exe","7980","RegQueryValue","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane7","NAME NOT FOUND","Length: 144"

"12:34:24.4198442","FlexEngine.exe","7980","RegQueryValue","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane8","NAME NOT FOUND","Length: 144"

"12:34:24.4198670","FlexEngine.exe","7980","RegQueryValue","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane9","NAME NOT FOUND","Length: 144"

"12:34:24.4198906","FlexEngine.exe","7980","RegQueryValue","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane10","NAME NOT FOUND","Length: 144"

"12:34:24.4199202","FlexEngine.exe","7980","RegQueryValue","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane11","NAME NOT FOUND","Length: 144"

"12:34:24.4199418","FlexEngine.exe","7980","RegQueryValue","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane12","NAME NOT FOUND","Length: 144"

"12:34:24.4199623","FlexEngine.exe","7980","RegQueryValue","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane13","NAME NOT FOUND","Length: 144"

"12:34:24.4199844","FlexEngine.exe","7980","RegQueryValue","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane14","NAME NOT FOUND","Length: 144"

"12:34:24.4200080","FlexEngine.exe","7980","RegQueryValue","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane15","NAME NOT FOUND","Length: 144"

"12:34:24.4200288","FlexEngine.exe","7980","RegQueryValue","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane16","NAME NOT FOUND","Length: 144"

"12:34:24.4200536","FlexEngine.exe","7980","RegCloseKey","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback","SUCCESS",""

"12:34:24.4201029","FlexEngine.exe","7980","RegQueryKey","HKLM","SUCCESS","Query: HandleTags, HandleTags: 0x0"

"12:34:24.4201207","FlexEngine.exe","7980","RegOpenKey","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback","SUCCESS","Desired Access: Query Value, Enumerate Sub Keys"

"12:34:24.4202705","FlexEngine.exe","7980","RegQueryKeySecurity","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback","SUCCESS",""

"12:34:24.4202871","FlexEngine.exe","7980","RegSetInfoKey","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback","SUCCESS","KeySetInformationClass: KeySetHandleTagsInformation, Length: 0"

"12:34:24.4203078","FlexEngine.exe","7980","RegQueryKey","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback","SUCCESS","Query: Cached, SubKeys: 4, Values: 1"

"12:34:24.4203483","FlexEngine.exe","7980","RegEnumKey","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback","SUCCESS","Index: 0, Name: MingLiU"

"12:34:24.4204043","FlexEngine.exe","7980","RegEnumKey","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback","SUCCESS","Index: 1, Name: MingLiU_HKSCS"

"12:34:24.4204454","FlexEngine.exe","7980","RegEnumKey","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback","SUCCESS","Index: 2, Name: PMingLiU"

"12:34:24.4204778","FlexEngine.exe","7980","RegEnumKey","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback","SUCCESS","Index: 3, Name: SimSun"

"12:34:24.4205699","FlexEngine.exe","7980","RegQueryKey","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback","SUCCESS","Query: HandleTags, HandleTags: 0x100"

"12:34:24.4205883","FlexEngine.exe","7980","RegOpenKey","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Tahoma","NAME NOT FOUND","Desired Access: Query Value"

"12:34:24.4207999","FlexEngine.exe","7980","RegCloseKey","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback","SUCCESS",""

"12:34:24.4226284","FlexEngine.exe","7980","RegQueryValue","HKLM\System\CurrentControlSet\Control\Nls\Sorting\Versions\00060101.00060101","NAME NOT FOUND","Length: 532"

"12:34:24.4227831","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad878b7-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\Globalization\Sorting","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.4228287","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad878b1-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\Globalization\Sorting","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.4228665","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad878ab-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\Globalization\Sorting","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.4229026","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad878a5-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\Globalization\Sorting","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.4229376","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad8789e-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\Globalization\Sorting","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.4229710","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad8788c-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\Globalization\Sorting","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.4230041","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad8787f-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\Globalization\Sorting","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.4230369","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87873-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\Globalization\Sorting","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.4230803","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87861-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\Globalization\Sorting","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.4231129","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87839-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\Globalization\Sorting","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.4231449","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87841-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\Globalization\Sorting","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.4231774","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87818-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\Globalization\Sorting","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.4232086","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87826-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\Globalization\Sorting","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.4232408","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87811-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\Globalization\Sorting","SUCCESS","Desired Access: All Access"

"12:34:24.4232763","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD87811-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\GLOBALIZATION\SORTING\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.4233298","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD87811-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\GLOBALIZATION\SORTING","SUCCESS",""

"12:34:24.4233826","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad878b7-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\Globalization\Sorting","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.4234159","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad878b1-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\Globalization\Sorting","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.4234481","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad878ab-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\Globalization\Sorting","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.4234822","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad878a5-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\Globalization\Sorting","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.4235191","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad8789e-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\Globalization\Sorting","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.4235500","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad8788c-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\Globalization\Sorting","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.4235814","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad8787f-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\Globalization\Sorting","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.4236140","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87873-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\Globalization\Sorting","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.4236511","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87861-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\Globalization\Sorting","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.4236878","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87839-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\Globalization\Sorting","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.4237183","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87841-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\Globalization\Sorting","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.4237495","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87818-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\Globalization\Sorting","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.4237821","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87826-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\Globalization\Sorting","NAME NOT FOUND","Desired Access: All Access"

"12:34:24.4238164","FlexEngine.exe","7980","RegOpenKey","HKLM\SnapVolumes-{aad87811-0a8c-11e8-abbf-005056992aec}\METADATA\FS\SVROOT\Windows\Globalization\Sorting","SUCCESS","Desired Access: All Access"

"12:34:24.4238520","FlexEngine.exe","7980","RegQueryValue","HKLM\SNAPVOLUMES-{AAD87811-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\GLOBALIZATION\SORTING\#DELETED#","NAME NOT FOUND","Length: 0"

"12:34:24.4239076","FlexEngine.exe","7980","RegCloseKey","HKLM\SNAPVOLUMES-{AAD87811-0A8C-11E8-ABBF-005056992AEC}\METADATA\FS\SVROOT\Windows\GLOBALIZATION\SORTING","SUCCESS",""

"12:34:24.4239861","FlexEngine.exe","7980","CreateFile","C:\Windows\Globalization\Sorting\SortDefault.nls","SUCCESS","Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened"

"12:34:24.4240724","FlexEngine.exe","7980","CreateFileMapping","C:\Windows\Globalization\Sorting\SortDefault.nls","FILE LOCKED WITH ONLY READERS","SyncType: SyncTypeCreateSection, PageProtection: "

"12:34:24.4240891","FlexEngine.exe","7980","QueryStandardInformationFile","C:\Windows\Globalization\Sorting\SortDefault.nls","SUCCESS","AllocationSize: 2,945,024, EndOfFile: 2,944,004, NumberOfLinks: 2, DeletePending: False, Directory: False"

"12:34:24.4241215","FlexEngine.exe","7980","CreateFileMapping","C:\Windows\Globalization\Sorting\SortDefault.nls","SUCCESS","SyncType: SyncTypeOther"

"12:34:24.4241581","FlexEngine.exe","7980","CloseFile","C:\Windows\Globalization\Sorting\SortDefault.nls","SUCCESS",""

"12:34:24.4249804","FlexEngine.exe","7980","CreateFile","C:\Program Files\Immidio\Flex Profiles\UxTheme.dll","NAME NOT FOUND","Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"

"12:34:24.4254060","FlexEngine.exe","7980","CreateFile","C:\Windows\System32\uxtheme.dll","SUCCESS","Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"

"12:34:24.4255640","FlexEngine.exe","7980","QueryBasicInformationFile","C:\Windows\System32\uxtheme.dll","SUCCESS","CreationTime: 13/07/2009 23:55:29, LastAccessTime: 13/07/2009 23:55:29, LastWriteTime: 14/07/2009 01:41:56, ChangeTime: 06/11/2017 21:42:38, FileAttributes: A"

"12:34:24.4255965","FlexEngine.exe","7980","CloseFile","C:\Windows\System32\uxtheme.dll","SUCCESS",""

"12:34:24.4258044","FlexEngine.exe","7980","CreateFile","C:\Windows\System32\uxtheme.dll","SUCCESS","Desired Access: Read Data/List Directory, Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened"

"12:34:24.4260148","FlexEngine.exe","7980","CreateFileMapping","C:\Windows\System32\uxtheme.dll","FILE LOCKED WITH ONLY READERS","SyncType: SyncTypeCreateSection, PageProtection: "

"12:34:24.4261377","FlexEngine.exe","7980","CreateFileMapping","C:\Windows\System32\uxtheme.dll","SUCCESS","SyncType: SyncTypeOther"

"12:34:24.4263447","FlexEngine.exe","7980","Load Image","C:\Windows\System32\uxtheme.dll","SUCCESS","Image Base: 0x7fefb9f0000, Image Size: 0x56000"

"12:34:24.4263805","FlexEngine.exe","7980","CloseFile","C:\Windows\System32\uxtheme.dll","SUCCESS",""

"12:34:24.4274730","FlexEngine.exe","7980","CreateFile","C:\Program Files\Immidio\Flex Profiles\imageres.dll","NAME NOT FOUND","Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"

"12:34:24.4280861","FlexEngine.exe","7980","CreateFile","C:\Windows\System32\imageres.dll","SUCCESS","Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"

"12:34:24.4283360","FlexEngine.exe","7980","QueryBasicInformationFile","C:\Windows\System32\imageres.dll","SUCCESS","CreationTime: 13/07/2009 23:57:48, LastAccessTime: 13/07/2009 23:57:48, LastWriteTime: 14/07/2009 01:28:10, ChangeTime: 06/11/2017 21:42:27, FileAttributes: A"

"12:34:24.4283554","FlexEngine.exe","7980","CloseFile","C:\Windows\System32\imageres.dll","SUCCESS",""

"12:34:24.4290607","FlexEngine.exe","7980","CreateFile","C:\Windows\System32\imageres.dll","SUCCESS","Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened"

"12:34:24.4292235","FlexEngine.exe","7980","CreateFileMapping","C:\Windows\System32\imageres.dll","FILE LOCKED WITH ONLY READERS","SyncType: SyncTypeCreateSection, PageProtection: "

"12:34:24.4292409","FlexEngine.exe","7980","QueryStandardInformationFile","C:\Windows\System32\imageres.dll","SUCCESS","AllocationSize: 20,271,104, EndOfFile: 20,268,032, NumberOfLinks: 2, DeletePending: False, Directory: False"

"12:34:24.4292791","FlexEngine.exe","7980","CreateFileMapping","C:\Windows\System32\imageres.dll","SUCCESS","SyncType: SyncTypeOther"

"12:34:24.4293240","FlexEngine.exe","7980","CloseFile","C:\Windows\System32\imageres.dll","SUCCESS",""

"12:34:24.4299621","FlexEngine.exe","7980","RegQueryKey","HKLM","SUCCESS","Query: HandleTags, HandleTags: 0x0"

"12:34:24.4299936","FlexEngine.exe","7980","RegOpenKey","HKLM\SOFTWARE\Microsoft\CTF\Compatibility\FlexEngine.exe","NAME NOT FOUND","Desired Access: Read"

"12:34:24.4304050","FlexEngine.exe","7980","RegQueryKey","HKLM","SUCCESS","Query: HandleTags, HandleTags: 0x0"

"12:34:24.4304302","FlexEngine.exe","7980","RegOpenKey","HKLM\Software\Microsoft\CTF\TIP\{0000897b-83df-4b96-be07-0fb58b01c4a4}\LanguageProfile\0x00000000\{0001bea3-ed56-483d-a2e2-aeae25577436}","SUCCESS","Desired Access: Read"

"12:34:24.4306454","FlexEngine.exe","7980","RegQueryKeySecurity","HKLM\SOFTWARE\Microsoft\CTF\TIP\{0000897b-83df-4b96-be07-0fb58b01c4a4}\LanguageProfile\0x00000000\{0001bea3-ed56-483d-a2e2-aeae25577436}","SUCCESS",""

"12:34:24.4306847","FlexEngine.exe","7980","RegQueryValue","HKLM\SOFTWARE\Microsoft\CTF\TIP\{0000897b-83df-4b96-be07-0fb58b01c4a4}\LanguageProfile\0x00000000\{0001bea3-ed56-483d-a2e2-aeae25577436}\Enable","SUCCESS","Type: REG_DWORD, Length: 4, Data: 1"

"12:34:24.4307254","FlexEngine.exe","7980","RegCloseKey","HKLM\SOFTWARE\Microsoft\CTF\TIP\{0000897b-83df-4b96-be07-0fb58b01c4a4}\LanguageProfile\0x00000000\{0001bea3-ed56-483d-a2e2-aeae25577436}","SUCCESS",""

"12:34:24.4308911","FlexEngine.exe","7980","RegQueryKey","HKLM","SUCCESS","Query: HandleTags, HandleTags: 0x0"

"12:34:24.4309145","FlexEngine.exe","7980","RegOpenKey","HKLM\SOFTWARE\Microsoft\CTF\","SUCCESS","Desired Access: Read"

"12:34:24.4310677","FlexEngine.exe","7980","RegQueryKeySecurity","HKLM\SOFTWARE\Microsoft\CTF","SUCCESS",""

"12:34:24.4310888","FlexEngine.exe","7980","RegQueryValue","HKLM\SOFTWARE\Microsoft\CTF\EnableAnchorContext","NAME NOT FOUND","Length: 144"

"12:34:24.4311225","FlexEngine.exe","7980","RegCloseKey","HKLM\SOFTWARE\Microsoft\CTF","SUCCESS",""

0 Kudos
kmckean1
Contributor
Contributor

Appreciate any further assistance with this issue, thanks very much.

0 Kudos
DEMdev
VMware Employee
VMware Employee

Hi kmckean1,

Thank you for the ProcMon log. I'm wondering whether App Volumes plays a role in this – can you check without AppStacks or writable volumes attached?

0 Kudos
kmckean1
Contributor
Contributor

Thanks, I just used a user with no app volumes memberships, no flexengine errors, folder redirection clearly working Smiley Happy 

Still need app volumes to work concurrently though, is there an obvious reason app volumes would be clashing?

Thanks!

0 Kudos
DEMdev
VMware Employee
VMware Employee

Hi kmckean1,

OK, so we're at least a little bit further 🙂

In general, UEM and App Volumes work fine together (there are some small quirks here and there, but nothing like what you're experiencing). I think something must have gone wrong somewhere in the UEM/App Volumes installation, but I don't know enough about App Volumes.

Pim_van_de_Vis, any idea how App Volumes could interfere in FlexEngine finding its dependent components?

0 Kudos
kmckean1
Contributor
Contributor

Would really appreciate any further insight on this issue, thank you.

0 Kudos
PaulH76
Contributor
Contributor

I have the same problem randomly when i close App-V Applications. FlexEngine Process tracking causes the problem to stop occurring. Has anyone run into the same problem too?

0 Kudos
DEMdev
VMware Employee
VMware Employee

Hi PaulH76,

Can you provide a bit more information about your setup? UEM version, App-V version, whether you're using App Volumes, etc? Does this happen for specific App-V packages, or is it completely random?

Also, what do you mean by "FlexEngine Process tracking"?

0 Kudos
PaulH76
Contributor
Contributor

Hi UEMdev,

Environment:

VMware User Environment Manager 9.6

App-V 5 SP3

Windows 2016 Server (Client & File server)

It happens completely random. When i use Process Monitor to track the processes the problem cannot be reproduced. If I stop the monitor the problem is back.

0 Kudos
DEMdev
VMware Employee
VMware Employee

Hi PaulH76,

FlexEngine.exe tries to load FlexEngine.dll from the location specified in the default value of registry key HKLM\SOFTWARE\Classes\CLSID\{168D5BA5-56AB-455D-8D93-ABF40EAEB95A}\InprocServer32. I don't know much about App-V, but are there maybe package settings that affect registry access, or more specifically, access to COM-related registry locations? The fact that this occurs randomly means that it's probably not related to package settings, but I'm trying my best to come up with things that might be relevant... Smiley Happy

When the problem occurs, could you try launching cmd.exe inside that application's virtual environment, and from that command prompt launch regedit.exe to see if that registry value exists? If it does, can you check (from that "virtual" cmd.exe) whether FlexEngine.dll does indeed exist at the location stated in the registry value?

To launch the command prompt inside the application's VE, run cmd.exe /appvve:PackageGUID_VersionGUID, with the package and version GUIDs of that particular App-V package. You might be able to pick them up from the UEM log file, where we log something like Launching FlexEngine.exe for App-V 5 import ('... /appvve:...', ...), but the log file is probably locked while this is going on Smiley Sad

0 Kudos
PaulH76
Contributor
Contributor

Hi UEMdev,

the registry value and flexengine.dll exists. If i leave the cmd window open i cannot reproduce the error anymore. when i close it, the error is back.

0 Kudos
DEMdev
VMware Employee
VMware Employee

Hi PaulH76,

I haven't forgotten about this issue... It's just that I don't really have a clue on how to proceed. Would it be possible for you to perform some tests with a special build of FlexEngine.exe, so that we at least might learn a bit more about where exactly the DLL name lookup or load is failing?

0 Kudos