"Time of Day","Process Name","PID","Operation","Path","Result","Detail" "21:18:48,3690886","eso64.exe","12432","Process Start","","SUCCESS","Parent PID: 12172" "21:18:48,3691015","eso64.exe","12432","Thread Create","","SUCCESS","Thread ID: 1180" "21:18:48,3747882","eso64.exe","12432","Load Image","E:\Elder Scrolls Online\The Elder Scrolls Online PTS\game\client\eso64.exe","SUCCESS","Image Base: 0x7ff74e3c0000, Image Size: 0x3f28400" "21:18:48,3748352","eso64.exe","12432","QueryNameInformationFile","E:\Elder Scrolls Online\The Elder Scrolls Online PTS\game\client\eso64.exe","SUCCESS","Name: \Elder Scrolls Online\The Elder Scrolls Online PTS\game\client\eso64.exe" "21:18:48,3750721","eso64.exe","12432","Load Image","C:\Windows\System32\ntdll.dll","SUCCESS","Image Base: 0x7ffc84500000, Image Size: 0x1c1000" "21:18:48,3751371","eso64.exe","12432","QueryNameInformationFile","C:\Windows\System32\ntdll.dll","SUCCESS","Name: \Windows\System32\ntdll.dll" "21:18:48,3754143","eso64.exe","12432","RegOpenKey","HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Segment Heap","REPARSE","Desired Access: Query Value" "21:18:48,3754565","eso64.exe","12432","RegOpenKey","HKLM\System\CurrentControlSet\Control\Session Manager\Segment Heap","NAME NOT FOUND","Desired Access: Query Value" "21:18:48,3759694","eso64.exe","12432","CreateFile","E:\Elder Scrolls Online\The Elder Scrolls Online PTS\game\client","SUCCESS","Desired Access: Execute/Traverse, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened" "21:18:48,3762982","eso64.exe","12432","Load Image","C:\Windows\System32\kernel32.dll","SUCCESS","Image Base: 0x7ffc84160000, Image Size: 0xad000" "21:18:48,3763641","eso64.exe","12432","QueryNameInformationFile","C:\Windows\System32\kernel32.dll","SUCCESS","Name: \Windows\System32\kernel32.dll" "21:18:48,3767150","eso64.exe","12432","Load Image","C:\Windows\System32\KernelBase.dll","SUCCESS","Image Base: 0x7ffc80cd0000, Image Size: 0x1e8000" "21:18:48,3767776","eso64.exe","12432","QueryNameInformationFile","C:\Windows\System32\KernelBase.dll","SUCCESS","Name: \Windows\System32\KernelBase.dll" "21:18:48,3777760","eso64.exe","12432","RegQueryValue","HKLM\System\CurrentControlSet\Control\WMI\Security\05f95efe-7f75-49c7-a994-60a55cc09571","NAME NOT FOUND","Length: 524" "21:18:48,3780470","eso64.exe","12432","RegOpenKey","HKLM\System\CurrentControlSet\Control\SafeBoot\Option","REPARSE","Desired Access: Query Value, Set Value" "21:18:48,3780747","eso64.exe","12432","RegOpenKey","HKLM\System\CurrentControlSet\Control\SafeBoot\Option","NAME NOT FOUND","Desired Access: Query Value, Set Value" "21:18:48,3780959","eso64.exe","12432","RegOpenKey","HKLM\System\CurrentControlSet\Control\Srp\GP\DLL","REPARSE","Desired Access: Read" "21:18:48,3781183","eso64.exe","12432","RegOpenKey","HKLM\System\CurrentControlSet\Control\Srp\GP\DLL","NAME NOT FOUND","Desired Access: Read" "21:18:48,3781523","eso64.exe","12432","RegOpenKey","HKLM\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers","SUCCESS","Desired Access: Query Value" "21:18:48,3781895","eso64.exe","12432","RegQueryValue","HKLM\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\TransparentEnabled","NAME NOT FOUND","Length: 80" "21:18:48,3782199","eso64.exe","12432","RegCloseKey","HKLM\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers","SUCCESS","" "21:18:48,3783471","eso64.exe","12432","RegOpenKey","HKCU\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers","NAME NOT FOUND","Desired Access: Query Value" "21:18:48,3787722","eso64.exe","12432","Load Image","C:\Windows\System32\ws2_32.dll","SUCCESS","Image Base: 0x7ffc81e50000, Image Size: 0x6b000" "21:18:48,3788044","eso64.exe","12432","QueryNameInformationFile","C:\Windows\System32\ws2_32.dll","SUCCESS","Name: \Windows\System32\ws2_32.dll" "21:18:48,3791323","eso64.exe","12432","Load Image","C:\Windows\System32\sechost.dll","SUCCESS","Image Base: 0x7ffc82320000, Image Size: 0x5b000" "21:18:48,3791782","eso64.exe","12432","QueryNameInformationFile","C:\Windows\System32\sechost.dll","SUCCESS","Name: \Windows\System32\sechost.dll" "21:18:48,3794874","eso64.exe","12432","Load Image","C:\Windows\System32\rpcrt4.dll","SUCCESS","Image Base: 0x7ffc82380000, Image Size: 0x11c000" "21:18:48,3795260","eso64.exe","12432","QueryNameInformationFile","C:\Windows\System32\rpcrt4.dll","SUCCESS","Name: \Windows\System32\rpcrt4.dll" "21:18:48,3796791","eso64.exe","12432","Thread Create","","SUCCESS","Thread ID: 7160" "21:18:48,3797503","eso64.exe","12432","RegOpenKey","HKLM\SYSTEM\CurrentControlSet\Control\Session Manager","REPARSE","Desired Access: Query Value, Enumerate Sub Keys" "21:18:48,3797757","eso64.exe","12432","RegOpenKey","HKLM\System\CurrentControlSet\Control\Session Manager","SUCCESS","Desired Access: Query Value, Enumerate Sub Keys" "21:18:48,3797799","eso64.exe","12432","Thread Create","","SUCCESS","Thread ID: 11420" "21:18:48,3798182","eso64.exe","12432","RegQueryValue","HKLM\System\CurrentControlSet\Control\SESSION MANAGER\ResourcePolicies","NAME NOT FOUND","Length: 24" "21:18:48,3798537","eso64.exe","12432","RegCloseKey","HKLM\System\CurrentControlSet\Control\SESSION MANAGER","SUCCESS","" "21:18:48,3799526","eso64.exe","12432","Thread Create","","SUCCESS","Thread ID: 12476" "21:18:48,3800582","eso64.exe","12432","RegOpenKey","HKLM\System\CurrentControlSet\Control\Session Manager","REPARSE","Desired Access: Query Value" "21:18:48,3800917","eso64.exe","12432","RegOpenKey","HKLM\System\CurrentControlSet\Control\Session Manager","SUCCESS","Desired Access: Query Value" "21:18:48,3801417","eso64.exe","12432","RegQueryValue","HKLM\System\CurrentControlSet\Control\SESSION MANAGER\SafeDllSearchMode","NAME NOT FOUND","Length: 16" "21:18:48,3801721","eso64.exe","12432","Load Image","C:\Windows\System32\psapi.dll","SUCCESS","Image Base: 0x7ffc84150000, Image Size: 0x8000" "21:18:48,3802249","eso64.exe","12432","QueryNameInformationFile","C:\Windows\System32\psapi.dll","SUCCESS","Name: \Windows\System32\psapi.dll" "21:18:48,3805275","eso64.exe","12432","QueryOpen","E:\Elder Scrolls Online\The Elder Scrolls Online PTS\game\client\VERSION.dll","NAME NOT FOUND","" "21:18:48,3805431","eso64.exe","12432","QueryOpen","E:\Elder Scrolls Online\The Elder Scrolls Online PTS\game\client\XINPUT9_1_0.dll","NAME NOT FOUND","" "21:18:48,3805705","eso64.exe","12432","QueryOpen","E:\Elder Scrolls Online\The Elder Scrolls Online PTS\game\client\IPHLPAPI.DLL","NAME NOT FOUND","" "21:18:48,3805918","eso64.exe","12432","Load Image","C:\Windows\System32\imm32.dll","SUCCESS","Image Base: 0x7ffc818e0000, Image Size: 0x3b000" "21:18:48,3806420","eso64.exe","12432","QueryNameInformationFile","C:\Windows\System32\imm32.dll","SUCCESS","Name: \Windows\System32\imm32.dll" "21:18:48,3809993","eso64.exe","12432","QueryOpen","C:\Windows\System32\XInput9_1_0.dll","FAST IO DISALLOWED","" "21:18:48,3810069","eso64.exe","12432","Load Image","C:\Windows\System32\user32.dll","SUCCESS","Image Base: 0x7ffc81f20000, Image Size: 0x156000" "21:18:48,3810304","eso64.exe","12432","QueryOpen","C:\Windows\System32\version.dll","FAST IO DISALLOWED","" "21:18:48,3810449","eso64.exe","12432","QueryNameInformationFile","C:\Windows\System32\user32.dll","SUCCESS","Name: \Windows\System32\user32.dll" "21:18:48,3810784","eso64.exe","12432","QueryOpen","C:\Windows\System32\IPHLPAPI.DLL","FAST IO DISALLOWED","" "21:18:48,3813815","eso64.exe","12432","Load Image","C:\Windows\System32\gdi32.dll","SUCCESS","Image Base: 0x7ffc84210000, Image Size: 0x186000" "21:18:48,3814156","eso64.exe","12432","QueryNameInformationFile","C:\Windows\System32\gdi32.dll","SUCCESS","Name: \Windows\System32\gdi32.dll" "21:18:48,3815148","eso64.exe","12432","CreateFile","C:\Windows\System32\version.dll","SUCCESS","Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened" "21:18:48,3815234","eso64.exe","12432","CreateFile","C:\Windows\System32\XInput9_1_0.dll","SUCCESS","Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened" "21:18:48,3816195","eso64.exe","12432","CreateFile","C:\Windows\System32\IPHLPAPI.DLL","SUCCESS","Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened" "21:18:48,3816279","eso64.exe","12432","QueryBasicInformationFile","C:\Windows\System32\version.dll","SUCCESS","CreationTime: 30-10-2015 08:18:17, LastAccessTime: 30-10-2015 08:18:17, LastWriteTime: 30-10-2015 08:18:17, ChangeTime: 14-11-2015 21:15:26, FileAttributes: A" "21:18:48,3816450","eso64.exe","12432","QueryBasicInformationFile","C:\Windows\System32\XInput9_1_0.dll","SUCCESS","CreationTime: 30-10-2015 08:18:19, LastAccessTime: 30-10-2015 08:18:19, LastWriteTime: 30-10-2015 08:18:20, ChangeTime: 14-11-2015 21:16:23, FileAttributes: A" "21:18:48,3816606","eso64.exe","12432","CloseFile","C:\Windows\System32\version.dll","SUCCESS","" "21:18:48,3816707","eso64.exe","12432","CloseFile","C:\Windows\System32\XInput9_1_0.dll","SUCCESS","" "21:18:48,3817006","eso64.exe","12432","IRP_MJ_CLOSE","C:\Windows\System32\version.dll","SUCCESS","" "21:18:48,3817190","eso64.exe","12432","IRP_MJ_CLOSE","C:\Windows\System32\XInput9_1_0.dll","SUCCESS","" "21:18:48,3817743","eso64.exe","12432","Load Image","C:\Windows\System32\advapi32.dll","SUCCESS","Image Base: 0x7ffc83be0000, Image Size: 0xa7000" "21:18:48,3817813","eso64.exe","12432","QueryBasicInformationFile","C:\Windows\System32\IPHLPAPI.DLL","SUCCESS","CreationTime: 30-10-2015 08:18:03, LastAccessTime: 30-10-2015 08:18:03, LastWriteTime: 30-10-2015 08:18:03, ChangeTime: 14-11-2015 21:15:24, FileAttributes: A" "21:18:48,3818143","eso64.exe","12432","CloseFile","C:\Windows\System32\IPHLPAPI.DLL","SUCCESS","" "21:18:48,3818701","eso64.exe","12432","IRP_MJ_CLOSE","C:\Windows\System32\IPHLPAPI.DLL","SUCCESS","" "21:18:48,3818746","eso64.exe","12432","QueryNameInformationFile","C:\Windows\System32\advapi32.dll","SUCCESS","Name: \Windows\System32\advapi32.dll" "21:18:48,3822565","eso64.exe","12432","CreateFile","C:\Windows\System32\version.dll","SUCCESS","Desired Access: Read Data/List Directory, Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened" "21:18:48,3822719","eso64.exe","12432","CreateFile","C:\Windows\System32\XInput9_1_0.dll","SUCCESS","Desired Access: Read Data/List Directory, Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened" "21:18:48,3822984","eso64.exe","12432","Load Image","C:\Windows\System32\msvcrt.dll","SUCCESS","Image Base: 0x7ffc81920000, Image Size: 0x9d000" "21:18:48,3823456","eso64.exe","12432","QueryNameInformationFile","C:\Windows\System32\msvcrt.dll","SUCCESS","Name: \Windows\System32\msvcrt.dll" "21:18:48,3823995","eso64.exe","12432","CreateFile","C:\Windows\System32\IPHLPAPI.DLL","SUCCESS","Desired Access: Read Data/List Directory, Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened" "21:18:48,3824093","eso64.exe","12432","CreateFileMapping","C:\Windows\System32\XInput9_1_0.dll","FILE LOCKED WITH ONLY READERS","SyncType: SyncTypeCreateSection, PageProtection: " "21:18:48,3824378","eso64.exe","12432","FASTIO_RELEASE_FOR_SECTION_SYNCHRONIZATION","C:\Windows\System32\XInput9_1_0.dll","SUCCESS","" "21:18:48,3824420","eso64.exe","12432","CreateFileMapping","C:\Windows\System32\version.dll","FILE LOCKED WITH ONLY READERS","SyncType: SyncTypeCreateSection, PageProtection: " "21:18:48,3824716","eso64.exe","12432","FASTIO_RELEASE_FOR_SECTION_SYNCHRONIZATION","C:\Windows\System32\version.dll","SUCCESS","" "21:18:48,3824856","eso64.exe","12432","CreateFileMapping","C:\Windows\System32\XInput9_1_0.dll","SUCCESS","SyncType: SyncTypeOther" "21:18:48,3824934","eso64.exe","12432","CreateFileMapping","C:\Windows\System32\version.dll","SUCCESS","SyncType: SyncTypeOther" "21:18:48,3825258","eso64.exe","12432","FASTIO_RELEASE_FOR_SECTION_SYNCHRONIZATION","C:\Windows\System32\version.dll","SUCCESS","" "21:18:48,3825361","eso64.exe","12432","FASTIO_RELEASE_FOR_SECTION_SYNCHRONIZATION","C:\Windows\System32\XInput9_1_0.dll","SUCCESS","" "21:18:48,3825970","eso64.exe","12432","CreateFileMapping","C:\Windows\System32\IPHLPAPI.DLL","FILE LOCKED WITH ONLY READERS","SyncType: SyncTypeCreateSection, PageProtection: " "21:18:48,3826191","eso64.exe","12432","FASTIO_RELEASE_FOR_SECTION_SYNCHRONIZATION","C:\Windows\System32\IPHLPAPI.DLL","SUCCESS","" "21:18:48,3826409","eso64.exe","12432","CreateFileMapping","C:\Windows\System32\IPHLPAPI.DLL","SUCCESS","SyncType: SyncTypeOther" "21:18:48,3826954","eso64.exe","12432","Load Image","C:\Windows\System32\shell32.dll","SUCCESS","Image Base: 0x7ffc825b0000, Image Size: 0x155f000" "21:18:48,3827021","eso64.exe","12432","FASTIO_RELEASE_FOR_SECTION_SYNCHRONIZATION","C:\Windows\System32\IPHLPAPI.DLL","SUCCESS","" "21:18:48,3827529","eso64.exe","12432","QueryNameInformationFile","C:\Windows\System32\shell32.dll","SUCCESS","Name: \Windows\System32\shell32.dll" "21:18:48,3828289","eso64.exe","12432","Load Image","C:\Windows\System32\version.dll","SUCCESS","Image Base: 0x7ffc7c410000, Image Size: 0xa000" "21:18:48,3828834","eso64.exe","12432","QueryNameInformationFile","C:\Windows\System32\version.dll","SUCCESS","Name: \Windows\System32\version.dll" "21:18:48,3829901","eso64.exe","12432","Load Image","C:\Windows\System32\XInput9_1_0.dll","SUCCESS","Image Base: 0x7ffc7f1c0000, Image Size: 0x7000" "21:18:48,3830359","eso64.exe","12432","QueryNameInformationFile","C:\Windows\System32\XInput9_1_0.dll","SUCCESS","Name: \Windows\System32\XInput9_1_0.dll" "21:18:48,3831063","eso64.exe","12432","CloseFile","C:\Windows\System32\version.dll","SUCCESS","" "21:18:48,3831633","eso64.exe","12432","CloseFile","C:\Windows\System32\XInput9_1_0.dll","SUCCESS","" "21:18:48,3831756","eso64.exe","12432","IRP_MJ_CLOSE","C:\Windows\System32\version.dll","SUCCESS","" "21:18:48,3831979","eso64.exe","12432","Load Image","C:\Windows\System32\IPHLPAPI.DLL","SUCCESS","Image Base: 0x7ffc7d7c0000, Image Size: 0x38000" "21:18:48,3832097","eso64.exe","12432","IRP_MJ_CLOSE","C:\Windows\System32\XInput9_1_0.dll","SUCCESS","" "21:18:48,3832591","eso64.exe","12432","QueryNameInformationFile","C:\Windows\System32\IPHLPAPI.DLL","SUCCESS","Name: \Windows\System32\IPHLPAPI.DLL" "21:18:48,3834659","eso64.exe","12432","Load Image","C:\Windows\System32\cfgmgr32.dll","SUCCESS","Image Base: 0x7ffc80ee0000, Image Size: 0x43000" "21:18:48,3835055","eso64.exe","12432","QueryNameInformationFile","C:\Windows\System32\cfgmgr32.dll","SUCCESS","Name: \Windows\System32\cfgmgr32.dll" "21:18:48,3835231","eso64.exe","12432","CloseFile","C:\Windows\System32\IPHLPAPI.DLL","SUCCESS","" "21:18:48,3835340","eso64.exe","12432","QueryOpen","E:\Elder Scrolls Online\The Elder Scrolls Online PTS\game\client\msvcr100.dll","SUCCESS","CreationTime: 03-08-2014 00:06:03, LastAccessTime: 03-08-2014 00:06:03, LastWriteTime: 08-02-2016 22:54:12, ChangeTime: 09-02-2016 21:05:38, AllocationSize: 774.144, EndOfFile: 773.968, FileAttributes: A" "21:18:48,3835715","eso64.exe","12432","IRP_MJ_CLOSE","C:\Windows\System32\IPHLPAPI.DLL","SUCCESS","" "21:18:48,3835860","eso64.exe","12432","QueryOpen","E:\Elder Scrolls Online\The Elder Scrolls Online PTS\game\client\granny2_x64.dll","SUCCESS","CreationTime: 09-02-2016 21:05:41, LastAccessTime: 09-02-2016 21:05:41, LastWriteTime: 08-02-2016 22:54:16, ChangeTime: 09-02-2016 21:05:41, AllocationSize: 720.896, EndOfFile: 718.336, FileAttributes: A" "21:18:48,3838017","eso64.exe","12432","CreateFile","E:\Elder Scrolls Online\The Elder Scrolls Online PTS\game\client\granny2_x64.dll","SUCCESS","Desired Access: Read Data/List Directory, Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened" "21:18:48,3838860","eso64.exe","12432","Load Image","C:\Windows\System32\windows.storage.dll","SUCCESS","Image Base: 0x7ffc81100000, Image Size: 0x644000" "21:18:48,3838880","eso64.exe","12432","CreateFile","E:\Elder Scrolls Online\The Elder Scrolls Online PTS\game\client\msvcr100.dll","SUCCESS","Desired Access: Read Data/List Directory, Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened" "21:18:48,3839271","eso64.exe","12432","CreateFileMapping","E:\Elder Scrolls Online\The Elder Scrolls Online PTS\game\client\granny2_x64.dll","FILE LOCKED WITH ONLY READERS","SyncType: SyncTypeCreateSection, PageProtection: " "21:18:48,3839763","eso64.exe","12432","QueryNameInformationFile","C:\Windows\System32\windows.storage.dll","SUCCESS","Name: \Windows\System32\windows.storage.dll" "21:18:48,3839855","eso64.exe","12432","CreateFileMapping","E:\Elder Scrolls Online\The Elder Scrolls Online PTS\game\client\msvcr100.dll","FILE LOCKED WITH ONLY READERS","SyncType: SyncTypeCreateSection, PageProtection: " "21:18:48,3840143","eso64.exe","12432","FASTIO_RELEASE_FOR_SECTION_SYNCHRONIZATION","E:\Elder Scrolls Online\The Elder Scrolls Online PTS\game\client\msvcr100.dll","SUCCESS","" "21:18:48,3840162","eso64.exe","12432","FASTIO_RELEASE_FOR_SECTION_SYNCHRONIZATION","E:\Elder Scrolls Online\The Elder Scrolls Online PTS\game\client\granny2_x64.dll","SUCCESS","" "21:18:48,3840732","eso64.exe","12432","QueryOpen","E:\Elder Scrolls Online\The Elder Scrolls Online PTS\game\client\bink2w64.dll","SUCCESS","CreationTime: 09-02-2016 21:05:40, LastAccessTime: 09-02-2016 21:05:40, LastWriteTime: 08-02-2016 22:54:12, ChangeTime: 09-02-2016 21:05:40, AllocationSize: 376.832, EndOfFile: 374.272, FileAttributes: A" "21:18:48,3840866","eso64.exe","12432","CreateFileMapping","E:\Elder Scrolls Online\The Elder Scrolls Online PTS\game\client\granny2_x64.dll","SUCCESS","SyncType: SyncTypeOther" "21:18:48,3840947","eso64.exe","12432","CreateFileMapping","E:\Elder Scrolls Online\The Elder Scrolls Online PTS\game\client\msvcr100.dll","SUCCESS","SyncType: SyncTypeOther" "21:18:48,3841165","eso64.exe","12432","FASTIO_RELEASE_FOR_SECTION_SYNCHRONIZATION","E:\Elder Scrolls Online\The Elder Scrolls Online PTS\game\client\granny2_x64.dll","SUCCESS","" "21:18:48,3841936","eso64.exe","12432","FASTIO_RELEASE_FOR_SECTION_SYNCHRONIZATION","E:\Elder Scrolls Online\The Elder Scrolls Online PTS\game\client\msvcr100.dll","SUCCESS","" "21:18:48,3842710","eso64.exe","12432","CreateFile","E:\Elder Scrolls Online\The Elder Scrolls Online PTS\game\client\bink2w64.dll","SUCCESS","Desired Access: Read Data/List Directory, Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened" "21:18:48,3843263","eso64.exe","12432","CloseFile","E:\Elder Scrolls Online\The Elder Scrolls Online PTS\game\client\msvcr100.dll","SUCCESS","" "21:18:48,3843679","eso64.exe","12432","CreateFileMapping","E:\Elder Scrolls Online\The Elder Scrolls Online PTS\game\client\bink2w64.dll","FILE LOCKED WITH ONLY READERS","SyncType: SyncTypeCreateSection, PageProtection: " "21:18:48,3843908","eso64.exe","12432","Load Image","E:\Elder Scrolls Online\The Elder Scrolls Online PTS\game\client\granny2_x64.dll","SUCCESS","Image Base: 0x7ffc67500000, Image Size: 0xb8000" "21:18:48,3844191","eso64.exe","12432","IRP_MJ_CLOSE","E:\Elder Scrolls Online\The Elder Scrolls Online PTS\game\client\msvcr100.dll","SUCCESS","" "21:18:48,3844389","eso64.exe","12432","FASTIO_RELEASE_FOR_SECTION_SYNCHRONIZATION","E:\Elder Scrolls Online\The Elder Scrolls Online PTS\game\client\bink2w64.dll","SUCCESS","" "21:18:48,3844459","eso64.exe","12432","QueryNameInformationFile","E:\Elder Scrolls Online\The Elder Scrolls Online PTS\game\client\granny2_x64.dll","SUCCESS","Name: \Elder Scrolls Online\The Elder Scrolls Online PTS\game\client\granny2_x64.dll" "21:18:48,3845353","eso64.exe","12432","Load Image","C:\Windows\System32\combase.dll","SUCCESS","Image Base: 0x7ffc83cf0000, Image Size: 0x27d000" "21:18:48,3846761","eso64.exe","12432","CreateFileMapping","E:\Elder Scrolls Online\The Elder Scrolls Online PTS\game\client\bink2w64.dll","SUCCESS","SyncType: SyncTypeOther" "21:18:48,3846844","eso64.exe","12432","QueryNameInformationFile","C:\Windows\System32\combase.dll","SUCCESS","Name: \Windows\System32\combase.dll" "21:18:48,3847057","eso64.exe","12432","FASTIO_RELEASE_FOR_SECTION_SYNCHRONIZATION","E:\Elder Scrolls Online\The Elder Scrolls Online PTS\game\client\bink2w64.dll","SUCCESS","" "21:18:48,3847842","eso64.exe","12432","QueryOpen","C:\Windows\System32\msvcr100.dll","FAST IO DISALLOWED","" "21:18:48,3848057","eso64.exe","12432","RegOpenKey","HKCU","SUCCESS","Desired Access: Maximum Allowed, Granted Access: All Access" "21:18:48,3848892","eso64.exe","12432","RegOpenKey","HKCU\Control Panel\Desktop\MuiCached\MachineLanguageConfiguration","NAME NOT FOUND","Desired Access: Read" "21:18:48,3849437","eso64.exe","12432","Load Image","E:\Elder Scrolls Online\The Elder Scrolls Online PTS\game\client\bink2w64.dll","SUCCESS","Image Base: 0x7ffc67490000, Image Size: 0x64000" "21:18:48,3849571","eso64.exe","12432","RegCloseKey","HKCU","SUCCESS","" "21:18:48,3849842","eso64.exe","12432","QueryNameInformationFile","E:\Elder Scrolls Online\The Elder Scrolls Online PTS\game\client\bink2w64.dll","SUCCESS","Name: \Elder Scrolls Online\The Elder Scrolls Online PTS\game\client\bink2w64.dll" "21:18:48,3849862","eso64.exe","12432","RegOpenKey","HKLM\Software\Policies\Microsoft\MUI\Settings","NAME NOT FOUND","Desired Access: Read" "21:18:48,3850314","eso64.exe","12432","RegOpenKey","HKCU","SUCCESS","Desired Access: Maximum Allowed, Granted Access: All Access" "21:18:48,3850811","eso64.exe","12432","RegOpenKey","HKCU\Software\Policies\Microsoft\Control Panel\Desktop","NAME NOT FOUND","Desired Access: Read" "21:18:48,3851359","eso64.exe","12432","RegOpenKey","HKCU\Control Panel\Desktop\LanguageConfiguration","SUCCESS","Desired Access: Read" "21:18:48,3851641","eso64.exe","12432","Load Image","C:\Windows\System32\bcryptprimitives.dll","SUCCESS","Image Base: 0x7ffc81810000, Image Size: 0x6a000" "21:18:48,3852130","eso64.exe","12432","CreateFile","C:\Windows\System32\msvcr100.dll","SUCCESS","Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened" "21:18:48,3852641","eso64.exe","12432","QueryNameInformationFile","C:\Windows\System32\bcryptprimitives.dll","SUCCESS","Name: \Windows\System32\bcryptprimitives.dll" "21:18:48,3852918","eso64.exe","12432","RegEnumValue","HKCU\Control Panel\Desktop\LanguageConfiguration","SUCCESS","Index: 0, Name: da-DK, Type: REG_MULTI_SZ, Length: 14, Data: en-US" "21:18:48,3853538","eso64.exe","12432","QueryBasicInformationFile","C:\Windows\System32\msvcr100.dll","SUCCESS","CreationTime: 11-07-2011 10:14:40, LastAccessTime: 24-12-2015 04:22:39, LastWriteTime: 11-07-2011 10:14:40, ChangeTime: 24-12-2015 04:22:39, FileAttributes: A" "21:18:48,3853767","eso64.exe","12432","Load Image","C:\Windows\System32\ole32.dll","SUCCESS","Image Base: 0x7ffc843b0000, Image Size: 0x143000" "21:18:48,3853876","eso64.exe","12432","CloseFile","C:\Windows\System32\msvcr100.dll","SUCCESS","" "21:18:48,3853946","eso64.exe","12432","RegEnumValue","HKCU\Control Panel\Desktop\LanguageConfiguration","NO MORE ENTRIES","Index: 1, Length: 512" "21:18:48,3854150","eso64.exe","12432","QueryNameInformationFile","C:\Windows\System32\ole32.dll","SUCCESS","Name: \Windows\System32\ole32.dll" "21:18:48,3854220","eso64.exe","12432","IRP_MJ_CLOSE","C:\Windows\System32\msvcr100.dll","SUCCESS","" "21:18:48,3854345","eso64.exe","12432","RegCloseKey","HKCU\Control Panel\Desktop\LanguageConfiguration","SUCCESS","" "21:18:48,3854670","eso64.exe","12432","RegCloseKey","HKCU","SUCCESS","" "21:18:48,3854974","eso64.exe","12432","RegOpenKey","HKLM\Software\Policies\Microsoft\MUI\Settings","NAME NOT FOUND","Desired Access: Read" "21:18:48,3855326","eso64.exe","12432","RegOpenKey","HKCU","SUCCESS","Desired Access: Maximum Allowed, Granted Access: All Access" "21:18:48,3855714","eso64.exe","12432","RegOpenKey","HKCU\Software\Policies\Microsoft\Control Panel\Desktop","NAME NOT FOUND","Desired Access: Read" "21:18:48,3855932","eso64.exe","12432","RegOpenKey","HKCU\Control Panel\Desktop","SUCCESS","Desired Access: Read" "21:18:48,3856167","eso64.exe","12432","CloseFile","E:\Elder Scrolls Online\The Elder Scrolls Online PTS\game\client\bink2w64.dll","SUCCESS","" "21:18:48,3856511","eso64.exe","12432","Load Image","C:\Windows\System32\shlwapi.dll","SUCCESS","Image Base: 0x7ffc81df0000, Image Size: 0x52000" "21:18:48,3856592","eso64.exe","12432","RegQueryValue","HKCU\Control Panel\Desktop\PreferredUILanguages","BUFFER OVERFLOW","Length: 12" "21:18:48,3856684","eso64.exe","12432","IRP_MJ_CLOSE","E:\Elder Scrolls Online\The Elder Scrolls Online PTS\game\client\bink2w64.dll","SUCCESS","" "21:18:48,3856918","eso64.exe","12432","RegQueryValue","HKCU\Control Panel\Desktop\PreferredUILanguages","SUCCESS","Type: REG_MULTI_SZ, Length: 12, Data: en-US" "21:18:48,3857125","eso64.exe","12432","QueryNameInformationFile","C:\Windows\System32\shlwapi.dll","SUCCESS","Name: \Windows\System32\shlwapi.dll" "21:18:48,3857377","eso64.exe","12432","RegCloseKey","HKCU\Control Panel\Desktop","SUCCESS","" "21:18:48,3857759","eso64.exe","12432","RegCloseKey","HKCU","SUCCESS","" "21:18:48,3858016","eso64.exe","12432","RegOpenKey","HKLM\Software\Policies\Microsoft\MUI\Settings","NAME NOT FOUND","Desired Access: Read" "21:18:48,3858416","eso64.exe","12432","CreateFile","C:\Windows\System32\msvcr100.dll","SUCCESS","Desired Access: Read Data/List Directory, Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened" "21:18:48,3858592","eso64.exe","12432","RegOpenKey","HKCU","SUCCESS","Desired Access: Maximum Allowed, Granted Access: All Access" "21:18:48,3859167","eso64.exe","12432","RegOpenKey","HKCU\Control Panel\Desktop\MuiCached","SUCCESS","Desired Access: Read" "21:18:48,3859606","eso64.exe","12432","CreateFileMapping","C:\Windows\System32\msvcr100.dll","FILE LOCKED WITH ONLY READERS","SyncType: SyncTypeCreateSection, PageProtection: " "21:18:48,3859648","eso64.exe","12432","RegQueryValue","HKCU\Control Panel\Desktop\MuiCached\MachinePreferredUILanguages","BUFFER OVERFLOW","Length: 12" "21:18:48,3859933","eso64.exe","12432","RegQueryValue","HKCU\Control Panel\Desktop\MuiCached\MachinePreferredUILanguages","SUCCESS","Type: REG_MULTI_SZ, Length: 12, Data: en-US" "21:18:48,3859986","eso64.exe","12432","FASTIO_RELEASE_FOR_SECTION_SYNCHRONIZATION","C:\Windows\System32\msvcr100.dll","SUCCESS","" "21:18:48,3860282","eso64.exe","12432","RegCloseKey","HKCU\Control Panel\Desktop\MuiCached","SUCCESS","" "21:18:48,3860559","eso64.exe","12432","RegCloseKey","HKCU","SUCCESS","" "21:18:48,3860776","eso64.exe","12432","CreateFileMapping","C:\Windows\System32\msvcr100.dll","SUCCESS","SyncType: SyncTypeOther" "21:18:48,3861056","eso64.exe","12432","FASTIO_RELEASE_FOR_SECTION_SYNCHRONIZATION","C:\Windows\System32\msvcr100.dll","SUCCESS","" "21:18:48,3861469","eso64.exe","12432","RegOpenKey","HKLM\Software\Microsoft\Windows\CurrentVersion\SideBySide","SUCCESS","Desired Access: Read" "21:18:48,3861581","eso64.exe","12432","Load Image","C:\Windows\System32\kernel.appcore.dll","SUCCESS","Image Base: 0x7ffc80b60000, Image Size: 0xf000" "21:18:48,3861863","eso64.exe","12432","RegQueryValue","HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest","NAME NOT FOUND","Length: 20" "21:18:48,3862112","eso64.exe","12432","QueryNameInformationFile","C:\Windows\System32\kernel.appcore.dll","SUCCESS","Name: \Windows\System32\kernel.appcore.dll" "21:18:48,3862251","eso64.exe","12432","RegCloseKey","HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide","SUCCESS","" "21:18:48,3862467","eso64.exe","12432","QueryOpen","E:\Elder Scrolls Online\The Elder Scrolls Online PTS\game\client\WINMM.dll","NAME NOT FOUND","" "21:18:48,3864350","eso64.exe","12432","CreateFile","E:\Elder Scrolls Online\The Elder Scrolls Online PTS\game\client\granny2_x64.dll","SUCCESS","Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened" "21:18:48,3864911","eso64.exe","12432","Load Image","C:\Windows\System32\msvcr100.dll","SUCCESS","Image Base: 0x60ef0000, Image Size: 0xd2000" "21:18:48,3865386","eso64.exe","12432","QueryNameInformationFile","C:\Windows\System32\msvcr100.dll","SUCCESS","Name: \Windows\System32\msvcr100.dll" "21:18:48,3866087","eso64.exe","12432","QueryOpen","C:\Windows\System32\winmm.dll","FAST IO DISALLOWED","" "21:18:48,3867084","eso64.exe","12432","QueryBasicInformationFile","E:\Elder Scrolls Online\The Elder Scrolls Online PTS\game\client\granny2_x64.dll","SUCCESS","CreationTime: 09-02-2016 21:05:41, LastAccessTime: 09-02-2016 21:05:41, LastWriteTime: 08-02-2016 22:54:16, ChangeTime: 09-02-2016 21:05:41, FileAttributes: A" "21:18:48,3867738","eso64.exe","12432","Load Image","C:\Windows\System32\SHCore.dll","SUCCESS","Image Base: 0x7ffc81750000, Image Size: 0xb5000" "21:18:48,3868330","eso64.exe","12432","QueryNameInformationFile","C:\Windows\System32\SHCore.dll","SUCCESS","Name: \Windows\System32\SHCore.dll" "21:18:48,3868884","eso64.exe","12432","CloseFile","C:\Windows\System32\msvcr100.dll","SUCCESS","" "21:18:48,3868951","eso64.exe","12432","CloseFile","E:\Elder Scrolls Online\The Elder Scrolls Online PTS\game\client\granny2_x64.dll","SUCCESS","" "21:18:48,3869400","eso64.exe","12432","IRP_MJ_CLOSE","C:\Windows\System32\msvcr100.dll","SUCCESS","" "21:18:48,3869532","eso64.exe","12432","IRP_MJ_CLOSE","E:\Elder Scrolls Online\The Elder Scrolls Online PTS\game\client\granny2_x64.dll","SUCCESS","" "21:18:48,3870610","eso64.exe","12432","CloseFile","E:\Elder Scrolls Online\The Elder Scrolls Online PTS\game\client\granny2_x64.dll","SUCCESS","" "21:18:48,3870632","eso64.exe","12432","CreateFile","C:\Windows\System32\winmm.dll","SUCCESS","Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened" "21:18:48,3871032","eso64.exe","12432","IRP_MJ_CLOSE","E:\Elder Scrolls Online\The Elder Scrolls Online PTS\game\client\granny2_x64.dll","SUCCESS","" "21:18:48,3871873","eso64.exe","12432","QueryBasicInformationFile","C:\Windows\System32\winmm.dll","SUCCESS","CreationTime: 30-10-2015 08:17:57, LastAccessTime: 30-10-2015 08:17:57, LastWriteTime: 30-10-2015 08:17:57, ChangeTime: 14-11-2015 21:15:26, FileAttributes: A" "21:18:48,3872378","eso64.exe","12432","CloseFile","C:\Windows\System32\winmm.dll","SUCCESS","" "21:18:48,3872946","eso64.exe","12432","IRP_MJ_CLOSE","C:\Windows\System32\winmm.dll","SUCCESS","" "21:18:48,3873387","eso64.exe","12432","Load Image","C:\Windows\System32\powrprof.dll","SUCCESS","Image Base: 0x7ffc80b10000, Image Size: 0x4b000" "21:18:48,3873887","eso64.exe","12432","QueryNameInformationFile","C:\Windows\System32\powrprof.dll","SUCCESS","Name: \Windows\System32\powrprof.dll" "21:18:48,3875329","eso64.exe","12432","CreateFile","C:\Windows\System32\winmm.dll","SUCCESS","Desired Access: Read Data/List Directory, Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened" "21:18:48,3876460","eso64.exe","12432","CreateFileMapping","C:\Windows\System32\winmm.dll","FILE LOCKED WITH ONLY READERS","SyncType: SyncTypeCreateSection, PageProtection: " "21:18:48,3876927","eso64.exe","12432","FASTIO_RELEASE_FOR_SECTION_SYNCHRONIZATION","C:\Windows\System32\winmm.dll","SUCCESS","" "21:18:48,3877198","eso64.exe","12432","Load Image","C:\Windows\System32\profapi.dll","SUCCESS","Image Base: 0x7ffc80b70000, Image Size: 0x14000" "21:18:48,3877379","eso64.exe","12432","CreateFileMapping","C:\Windows\System32\winmm.dll","SUCCESS","SyncType: SyncTypeOther" "21:18:48,3877586","eso64.exe","12432","QueryNameInformationFile","C:\Windows\System32\profapi.dll","SUCCESS","Name: \Windows\System32\profapi.dll" "21:18:48,3877703","eso64.exe","12432","FASTIO_RELEASE_FOR_SECTION_SYNCHRONIZATION","C:\Windows\System32\winmm.dll","SUCCESS","" "21:18:48,3880667","eso64.exe","12432","Load Image","C:\Windows\System32\winmm.dll","SUCCESS","Image Base: 0x7ffc7eb90000, Image Size: 0x23000" "21:18:48,3881083","eso64.exe","12432","QueryNameInformationFile","C:\Windows\System32\winmm.dll","SUCCESS","Name: \Windows\System32\winmm.dll" "21:18:48,3882637","eso64.exe","12432","Load Image","C:\Windows\System32\oleaut32.dll","SUCCESS","Image Base: 0x7ffc83b10000, Image Size: 0xc1000" "21:18:48,3883039","eso64.exe","12432","CloseFile","C:\Windows\System32\winmm.dll","SUCCESS","" "21:18:48,3883061","eso64.exe","12432","QueryNameInformationFile","C:\Windows\System32\oleaut32.dll","SUCCESS","Name: \Windows\System32\oleaut32.dll" "21:18:48,3884615","eso64.exe","12432","IRP_MJ_CLOSE","C:\Windows\System32\winmm.dll","SUCCESS","" "21:18:48,3886095","eso64.exe","12432","QueryOpen","E:\Elder Scrolls Online\The Elder Scrolls Online PTS\game\client\WINMMBASE.dll","NAME NOT FOUND","" "21:18:48,3890981","eso64.exe","12432","QueryOpen","C:\Windows\System32\winmmbase.dll","FAST IO DISALLOWED","" "21:18:48,3891744","eso64.exe","12432","QueryOpen","C:\Windows\System32\winmmbase.dll","FAST IO DISALLOWED","" "21:18:48,3893364","eso64.exe","12432","QueryOpen","C:\Windows\System32\winmmbase.dll","FAST IO DISALLOWED","" "21:18:48,3894314","eso64.exe","12432","QueryOpen","C:\Windows\System32\winmmbase.dll","FAST IO DISALLOWED","" "21:18:48,3898547","eso64.exe","12432","CreateFile","C:\Windows\System32\winmmbase.dll","SUCCESS","Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened" "21:18:48,3899049","eso64.exe","12432","CreateFile","C:\Windows\System32\winmmbase.dll","SUCCESS","Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened" "21:18:48,3899793","eso64.exe","12432","QueryBasicInformationFile","C:\Windows\System32\winmmbase.dll","SUCCESS","CreationTime: 30-10-2015 08:17:57, LastAccessTime: 30-10-2015 08:17:57, LastWriteTime: 30-10-2015 08:17:57, ChangeTime: 14-11-2015 21:15:26, FileAttributes: A" "21:18:48,3900072","eso64.exe","12432","CloseFile","C:\Windows\System32\winmmbase.dll","SUCCESS","" "21:18:48,3900195","eso64.exe","12432","CreateFile","C:\Windows\System32\winmmbase.dll","SUCCESS","Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened" "21:18:48,3900242","eso64.exe","12432","CreateFile","C:\Windows\System32\winmmbase.dll","SUCCESS","Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened" "21:18:48,3900569","eso64.exe","12432","IRP_MJ_CLOSE","C:\Windows\System32\winmmbase.dll","SUCCESS","" "21:18:48,3900717","eso64.exe","12432","QueryBasicInformationFile","C:\Windows\System32\winmmbase.dll","SUCCESS","CreationTime: 30-10-2015 08:17:57, LastAccessTime: 30-10-2015 08:17:57, LastWriteTime: 30-10-2015 08:17:57, ChangeTime: 14-11-2015 21:15:26, FileAttributes: A" "21:18:48,3901069","eso64.exe","12432","CloseFile","C:\Windows\System32\winmmbase.dll","SUCCESS","" "21:18:48,3901614","eso64.exe","12432","IRP_MJ_CLOSE","C:\Windows\System32\winmmbase.dll","SUCCESS","" "21:18:48,3901793","eso64.exe","12432","QueryBasicInformationFile","C:\Windows\System32\winmmbase.dll","SUCCESS","CreationTime: 30-10-2015 08:17:57, LastAccessTime: 30-10-2015 08:17:57, LastWriteTime: 30-10-2015 08:17:57, ChangeTime: 14-11-2015 21:15:26, FileAttributes: A" "21:18:48,3901896","eso64.exe","12432","QueryBasicInformationFile","C:\Windows\System32\winmmbase.dll","SUCCESS","CreationTime: 30-10-2015 08:17:57, LastAccessTime: 30-10-2015 08:17:57, LastWriteTime: 30-10-2015 08:17:57, ChangeTime: 14-11-2015 21:15:26, FileAttributes: A" "21:18:48,3902050","eso64.exe","12432","CloseFile","C:\Windows\System32\winmmbase.dll","SUCCESS","" "21:18:48,3902117","eso64.exe","12432","CloseFile","C:\Windows\System32\winmmbase.dll","SUCCESS","" "21:18:48,3902402","eso64.exe","12432","IRP_MJ_CLOSE","C:\Windows\System32\winmmbase.dll","SUCCESS","" "21:18:48,3902435","eso64.exe","12432","IRP_MJ_CLOSE","C:\Windows\System32\winmmbase.dll","SUCCESS","" "21:18:48,3904911","eso64.exe","12432","CreateFile","C:\Windows\System32\winmmbase.dll","SUCCESS","Desired Access: Read Data/List Directory, Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened" "21:18:48,3905838","eso64.exe","12432","CreateFileMapping","C:\Windows\System32\winmmbase.dll","FILE LOCKED WITH ONLY READERS","SyncType: SyncTypeCreateSection, PageProtection: " "21:18:48,3906048","eso64.exe","12432","FASTIO_RELEASE_FOR_SECTION_SYNCHRONIZATION","C:\Windows\System32\winmmbase.dll","SUCCESS","" "21:18:48,3906251","eso64.exe","12432","CreateFileMapping","C:\Windows\System32\winmmbase.dll","SUCCESS","SyncType: SyncTypeOther" "21:18:48,3906436","eso64.exe","12432","FASTIO_RELEASE_FOR_SECTION_SYNCHRONIZATION","C:\Windows\System32\winmmbase.dll","SUCCESS","" "21:18:48,3908668","eso64.exe","12432","Load Image","C:\Windows\System32\winmmbase.dll","SUCCESS","Image Base: 0x7ffc7eb60000, Image Size: 0x2c000" "21:18:48,3908715","eso64.exe","12432","CreateFile","C:\Windows\System32\winmmbase.dll","SUCCESS","Desired Access: Read Data/List Directory, Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened" "21:18:48,3909132","eso64.exe","12432","CreateFile","C:\Windows\System32\winmmbase.dll","SUCCESS","Desired Access: Read Data/List Directory, Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened" "21:18:48,3909210","eso64.exe","12432","QueryNameInformationFile","C:\Windows\System32\winmmbase.dll","SUCCESS","Name: \Windows\System32\winmmbase.dll" "21:18:48,3909727","eso64.exe","12432","CreateFile","C:\Windows\System32\winmmbase.dll","SUCCESS","Desired Access: Read Data/List Directory, Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened" "21:18:48,3909992","eso64.exe","12432","CloseFile","C:\Windows\System32\winmmbase.dll","SUCCESS","" "21:18:48,3910224","eso64.exe","12432","CreateFileMapping","C:\Windows\System32\winmmbase.dll","FILE LOCKED WITH ONLY READERS","SyncType: SyncTypeCreateSection, PageProtection: " "21:18:48,3910635","eso64.exe","12432","IRP_MJ_CLOSE","C:\Windows\System32\winmmbase.dll","SUCCESS","" "21:18:48,3910895","eso64.exe","12432","FASTIO_RELEASE_FOR_SECTION_SYNCHRONIZATION","C:\Windows\System32\winmmbase.dll","SUCCESS","" "21:18:48,3911121","eso64.exe","12432","CreateFileMapping","C:\Windows\System32\winmmbase.dll","SUCCESS","SyncType: SyncTypeOther" "21:18:48,3911361","eso64.exe","12432","FASTIO_RELEASE_FOR_SECTION_SYNCHRONIZATION","C:\Windows\System32\winmmbase.dll","SUCCESS","" "21:18:48,3911464","eso64.exe","12432","CreateFileMapping","C:\Windows\System32\winmmbase.dll","FILE LOCKED WITH ONLY READERS","SyncType: SyncTypeCreateSection, PageProtection: " "21:18:48,3911805","eso64.exe","12432","FASTIO_RELEASE_FOR_SECTION_SYNCHRONIZATION","C:\Windows\System32\winmmbase.dll","SUCCESS","" "21:18:48,3912079","eso64.exe","12432","CreateFileMapping","C:\Windows\System32\winmmbase.dll","SUCCESS","SyncType: SyncTypeOther" "21:18:48,3912143","eso64.exe","12432","CreateFileMapping","C:\Windows\System32\winmmbase.dll","FILE LOCKED WITH ONLY READERS","SyncType: SyncTypeCreateSection, PageProtection: " "21:18:48,3912546","eso64.exe","12432","FASTIO_RELEASE_FOR_SECTION_SYNCHRONIZATION","C:\Windows\System32\winmmbase.dll","SUCCESS","" "21:18:48,3913283","eso64.exe","12432","FASTIO_RELEASE_FOR_SECTION_SYNCHRONIZATION","C:\Windows\System32\winmmbase.dll","SUCCESS","" "21:18:48,3913479","eso64.exe","12432","CreateFileMapping","C:\Windows\System32\winmmbase.dll","SUCCESS","SyncType: SyncTypeOther" "21:18:48,3913926","eso64.exe","12432","QueryOpen","E:\Elder Scrolls Online\The Elder Scrolls Online PTS\game\client\MSVCP100.dll","NAME NOT FOUND","" "21:18:48,3914166","eso64.exe","12432","Load Image","C:\Windows\System32\winmmbase.dll","SUCCESS","Image Base: 0xfd0000, Image Size: 0x2c000" "21:18:48,3914549","eso64.exe","12432","QueryNameInformationFile","C:\Windows\System32\winmmbase.dll","SUCCESS","Name: \Windows\System32\winmmbase.dll" "21:18:48,3915202","eso64.exe","12432","FASTIO_RELEASE_FOR_SECTION_SYNCHRONIZATION","C:\Windows\System32\winmmbase.dll","SUCCESS","" "21:18:48,3916007","eso64.exe","12432","CloseFile","C:\Windows\System32\winmmbase.dll","SUCCESS","" "21:18:48,3916482","eso64.exe","12432","IRP_MJ_CLOSE","C:\Windows\System32\winmmbase.dll","SUCCESS","" "21:18:48,3916627","eso64.exe","12432","QueryOpen","C:\Windows\System32\msvcp100.dll","FAST IO DISALLOWED","" "21:18:48,3917074","eso64.exe","12432","Load Image","C:\Windows\System32\winmmbase.dll","SUCCESS","Image Base: 0x1000000, Image Size: 0x2c000" "21:18:48,3917795","eso64.exe","12432","QueryNameInformationFile","C:\Windows\System32\winmmbase.dll","SUCCESS","Name: \Windows\System32\winmmbase.dll" "21:18:48,3918097","eso64.exe","12432","Load Image","C:\Windows\System32\winmmbase.dll","SUCCESS","Image Base: 0x1030000, Image Size: 0x2c000" "21:18:48,3918580","eso64.exe","12432","QueryNameInformationFile","C:\Windows\System32\winmmbase.dll","SUCCESS","Name: \Windows\System32\winmmbase.dll" "21:18:48,3919259","eso64.exe","12432","CloseFile","C:\Windows\System32\winmmbase.dll","SUCCESS","" "21:18:48,3919390","eso64.exe","12432","QueryOpen","E:\Elder Scrolls Online\The Elder Scrolls Online PTS\game\client\WSOCK32.dll","NAME NOT FOUND","" "21:18:48,3919412","eso64.exe","12432","CloseFile","C:\Windows\System32\winmmbase.dll","SUCCESS","" "21:18:48,3919619","eso64.exe","12432","IRP_MJ_CLOSE","C:\Windows\System32\winmmbase.dll","SUCCESS","" "21:18:48,3919748","eso64.exe","12432","IRP_MJ_CLOSE","C:\Windows\System32\winmmbase.dll","SUCCESS","" "21:18:48,3919924","eso64.exe","12432","CreateFile","C:\Windows\System32\msvcp100.dll","SUCCESS","Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened" "21:18:48,3920689","eso64.exe","12432","QueryBasicInformationFile","C:\Windows\System32\msvcp100.dll","SUCCESS","CreationTime: 11-07-2011 10:14:40, LastAccessTime: 24-12-2015 04:22:39, LastWriteTime: 11-07-2011 10:14:40, ChangeTime: 24-12-2015 04:22:39, FileAttributes: A" "21:18:48,3920921","eso64.exe","12432","CloseFile","C:\Windows\System32\msvcp100.dll","SUCCESS","" "21:18:48,3921248","eso64.exe","12432","IRP_MJ_CLOSE","C:\Windows\System32\msvcp100.dll","SUCCESS","" "21:18:48,3921829","eso64.exe","12432","QueryOpen","C:\Windows\System32\wsock32.dll","FAST IO DISALLOWED","" "21:18:48,3921927","eso64.exe","12432","QueryOpen","E:\Elder Scrolls Online\The Elder Scrolls Online PTS\game\client\icuin55_x64.dll","SUCCESS","CreationTime: 09-02-2016 21:05:41, LastAccessTime: 09-02-2016 21:05:41, LastWriteTime: 08-02-2016 22:54:12, ChangeTime: 09-02-2016 21:05:41, AllocationSize: 2.002.944, EndOfFile: 1.999.360, FileAttributes: A" "21:18:48,3922457","eso64.exe","12432","QueryOpen","E:\Elder Scrolls Online\The Elder Scrolls Online PTS\game\client\icuuc55_x64.dll","SUCCESS","CreationTime: 09-02-2016 21:05:41, LastAccessTime: 09-02-2016 21:05:41, LastWriteTime: 08-02-2016 22:54:16, ChangeTime: 09-02-2016 21:05:41, AllocationSize: 1.388.544, EndOfFile: 1.384.960, FileAttributes: A" "21:18:48,3924480","eso64.exe","12432","CreateFile","E:\Elder Scrolls Online\The Elder Scrolls Online PTS\game\client\icuin55_x64.dll","SUCCESS","Desired Access: Read Data/List Directory, Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened" "21:18:48,3924938","eso64.exe","12432","CreateFile","E:\Elder Scrolls Online\The Elder Scrolls Online PTS\game\client\icuuc55_x64.dll","SUCCESS","Desired Access: Read Data/List Directory, Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened" "21:18:48,3925494","eso64.exe","12432","CreateFileMapping","E:\Elder Scrolls Online\The Elder Scrolls Online PTS\game\client\icuin55_x64.dll","FILE LOCKED WITH ONLY READERS","SyncType: SyncTypeCreateSection, PageProtection: " "21:18:48,3925801","eso64.exe","12432","FASTIO_RELEASE_FOR_SECTION_SYNCHRONIZATION","E:\Elder Scrolls Online\The Elder Scrolls Online PTS\game\client\icuin55_x64.dll","SUCCESS","" "21:18:48,3925927","eso64.exe","12432","CreateFile","C:\Windows\System32\wsock32.dll","SUCCESS","Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened" "21:18:48,3926058","eso64.exe","12432","CreateFile","C:\Windows\System32\msvcp100.dll","SUCCESS","Desired Access: Read Data/List Directory, Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened" "21:18:48,3926089","eso64.exe","12432","CreateFileMapping","E:\Elder Scrolls Online\The Elder Scrolls Online PTS\game\client\icuuc55_x64.dll","FILE LOCKED WITH ONLY READERS","SyncType: SyncTypeCreateSection, PageProtection: " "21:18:48,3926559","eso64.exe","12432","FASTIO_RELEASE_FOR_SECTION_SYNCHRONIZATION","E:\Elder Scrolls Online\The Elder Scrolls Online PTS\game\client\icuuc55_x64.dll","SUCCESS","" "21:18:48,3927385","eso64.exe","12432","CreateFileMapping","C:\Windows\System32\msvcp100.dll","FILE LOCKED WITH ONLY READERS","SyncType: SyncTypeCreateSection, PageProtection: " "21:18:48,3927455","eso64.exe","12432","QueryBasicInformationFile","C:\Windows\System32\wsock32.dll","SUCCESS","CreationTime: 30-10-2015 08:17:42, LastAccessTime: 30-10-2015 08:17:42, LastWriteTime: 30-10-2015 08:17:42, ChangeTime: 14-11-2015 21:15:26, FileAttributes: A" "21:18:48,3927737","eso64.exe","12432","CloseFile","C:\Windows\System32\wsock32.dll","SUCCESS","" "21:18:48,3927818","eso64.exe","12432","FASTIO_RELEASE_FOR_SECTION_SYNCHRONIZATION","C:\Windows\System32\msvcp100.dll","SUCCESS","" "21:18:48,3928243","eso64.exe","12432","IRP_MJ_CLOSE","C:\Windows\System32\wsock32.dll","SUCCESS","" "21:18:48,3928307","eso64.exe","12432","CreateFileMapping","E:\Elder Scrolls Online\The Elder Scrolls Online PTS\game\client\icuin55_x64.dll","SUCCESS","SyncType: SyncTypeOther" "21:18:48,3928433","eso64.exe","12432","CreateFileMapping","C:\Windows\System32\msvcp100.dll","SUCCESS","SyncType: SyncTypeOther" "21:18:48,3928629","eso64.exe","12432","FASTIO_RELEASE_FOR_SECTION_SYNCHRONIZATION","E:\Elder Scrolls Online\The Elder Scrolls Online PTS\game\client\icuin55_x64.dll","SUCCESS","" "21:18:48,3928651","eso64.exe","12432","CreateFileMapping","E:\Elder Scrolls Online\The Elder Scrolls Online PTS\game\client\icuuc55_x64.dll","SUCCESS","SyncType: SyncTypeOther" "21:18:48,3928813","eso64.exe","12432","FASTIO_RELEASE_FOR_SECTION_SYNCHRONIZATION","C:\Windows\System32\msvcp100.dll","SUCCESS","" "21:18:48,3928900","eso64.exe","12432","FASTIO_RELEASE_FOR_SECTION_SYNCHRONIZATION","E:\Elder Scrolls Online\The Elder Scrolls Online PTS\game\client\icuuc55_x64.dll","SUCCESS","" "21:18:48,3930704","eso64.exe","12432","Load Image","E:\Elder Scrolls Online\The Elder Scrolls Online PTS\game\client\icuin55_x64.dll","SUCCESS","Image Base: 0x604c0000, Image Size: 0x1ec000" "21:18:48,3931056","eso64.exe","12432","CreateFile","C:\Windows\System32\wsock32.dll","SUCCESS","Desired Access: Read Data/List Directory, Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened" "21:18:48,3931123","eso64.exe","12432","QueryNameInformationFile","E:\Elder Scrolls Online\The Elder Scrolls Online PTS\game\client\icuin55_x64.dll","SUCCESS","Name: \Elder Scrolls Online\The Elder Scrolls Online PTS\game\client\icuin55_x64.dll" "21:18:48,3932031","eso64.exe","12432","CreateFileMapping","C:\Windows\System32\wsock32.dll","FILE LOCKED WITH ONLY READERS","SyncType: SyncTypeCreateSection, PageProtection: " "21:18:48,3932115","eso64.exe","12432","RegOpenKey","HKLM\Software\Microsoft\Windows\CurrentVersion\SideBySide","SUCCESS","Desired Access: Read" "21:18:48,3932221","eso64.exe","12432","Load Image","C:\Windows\System32\msvcp100.dll","SUCCESS","Image Base: 0x60e50000, Image Size: 0x98000" "21:18:48,3932274","eso64.exe","12432","FASTIO_RELEASE_FOR_SECTION_SYNCHRONIZATION","C:\Windows\System32\wsock32.dll","SUCCESS","" "21:18:48,3932529","eso64.exe","12432","CreateFileMapping","C:\Windows\System32\wsock32.dll","SUCCESS","SyncType: SyncTypeOther" "21:18:48,3932593","eso64.exe","12432","QueryNameInformationFile","C:\Windows\System32\msvcp100.dll","SUCCESS","Name: \Windows\System32\msvcp100.dll" "21:18:48,3932621","eso64.exe","12432","RegQueryValue","HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest","NAME NOT FOUND","Length: 20" "21:18:48,3933023","eso64.exe","12432","RegCloseKey","HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide","SUCCESS","" "21:18:48,3933068","eso64.exe","12432","FASTIO_RELEASE_FOR_SECTION_SYNCHRONIZATION","C:\Windows\System32\wsock32.dll","SUCCESS","" "21:18:48,3933615","eso64.exe","12432","CloseFile","C:\Windows\System32\msvcp100.dll","SUCCESS","" "21:18:48,3933663","eso64.exe","12432","Load Image","E:\Elder Scrolls Online\The Elder Scrolls Online PTS\game\client\icuuc55_x64.dll","SUCCESS","Image Base: 0x60360000, Image Size: 0x159000" "21:18:48,3933942","eso64.exe","12432","IRP_MJ_CLOSE","C:\Windows\System32\msvcp100.dll","SUCCESS","" "21:18:48,3934012","eso64.exe","12432","QueryNameInformationFile","E:\Elder Scrolls Online\The Elder Scrolls Online PTS\game\client\icuuc55_x64.dll","SUCCESS","Name: \Elder Scrolls Online\The Elder Scrolls Online PTS\game\client\icuuc55_x64.dll" "21:18:48,3934763","eso64.exe","12432","RegOpenKey","HKLM\Software\Microsoft\Windows\CurrentVersion\SideBySide","SUCCESS","Desired Access: Read" "21:18:48,3935465","eso64.exe","12432","Load Image","C:\Windows\System32\wsock32.dll","SUCCESS","Image Base: 0x7ffc78250000, Image Size: 0x9000" "21:18:48,3935490","eso64.exe","12432","RegQueryValue","HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest","NAME NOT FOUND","Length: 20" "21:18:48,3935819","eso64.exe","12432","RegCloseKey","HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide","SUCCESS","" "21:18:48,3935875","eso64.exe","12432","CreateFile","E:\Elder Scrolls Online\The Elder Scrolls Online PTS\game\client\icuin55_x64.dll","SUCCESS","Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened" "21:18:48,3935984","eso64.exe","12432","QueryOpen","E:\Elder Scrolls Online\The Elder Scrolls Online PTS\game\client\OPENGL32.dll","NAME NOT FOUND","" "21:18:48,3936082","eso64.exe","12432","QueryNameInformationFile","C:\Windows\System32\wsock32.dll","SUCCESS","Name: \Windows\System32\wsock32.dll" "21:18:48,3937887","eso64.exe","12432","CloseFile","C:\Windows\System32\wsock32.dll","SUCCESS","" "21:18:48,3938415","eso64.exe","12432","IRP_MJ_CLOSE","C:\Windows\System32\wsock32.dll","SUCCESS","" "21:18:48,3938594","eso64.exe","12432","QueryOpen","C:\Windows\System32\opengl32.dll","FAST IO DISALLOWED","" "21:18:48,3939001","eso64.exe","12432","CreateFile","E:\Elder Scrolls Online\The Elder Scrolls Online PTS\game\client\icuuc55_x64.dll","SUCCESS","Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened" "21:18:48,3939666","eso64.exe","12432","QueryBasicInformationFile","E:\Elder Scrolls Online\The Elder Scrolls Online PTS\game\client\icuin55_x64.dll","SUCCESS","CreationTime: 09-02-2016 21:05:41, LastAccessTime: 09-02-2016 21:05:41, LastWriteTime: 08-02-2016 22:54:12, ChangeTime: 09-02-2016 21:05:41, FileAttributes: A" "21:18:48,3941007","eso64.exe","12432","QueryOpen","E:\Elder Scrolls Online\The Elder Scrolls Online PTS\game\client\d3dx11_43.dll","NAME NOT FOUND","" "21:18:48,3941063","eso64.exe","12432","CreateFile","C:\Windows\System32\opengl32.dll","SUCCESS","Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened" "21:18:48,3941370","eso64.exe","12432","CloseFile","E:\Elder Scrolls Online\The Elder Scrolls Online PTS\game\client\icuin55_x64.dll","SUCCESS","" "21:18:48,3941454","eso64.exe","12432","QueryBasicInformationFile","E:\Elder Scrolls Online\The Elder Scrolls Online PTS\game\client\icuuc55_x64.dll","SUCCESS","CreationTime: 09-02-2016 21:05:41, LastAccessTime: 09-02-2016 21:05:41, LastWriteTime: 08-02-2016 22:54:16, ChangeTime: 09-02-2016 21:05:41, FileAttributes: A" "21:18:48,3941748","eso64.exe","12432","IRP_MJ_CLOSE","E:\Elder Scrolls Online\The Elder Scrolls Online PTS\game\client\icuin55_x64.dll","SUCCESS","" "21:18:48,3942315","eso64.exe","12432","QueryBasicInformationFile","C:\Windows\System32\opengl32.dll","SUCCESS","CreationTime: 30-10-2015 08:18:18, LastAccessTime: 30-10-2015 08:18:18, LastWriteTime: 30-10-2015 08:18:18, ChangeTime: 14-11-2015 21:16:06, FileAttributes: A" "21:18:48,3942561","eso64.exe","12432","CloseFile","C:\Windows\System32\opengl32.dll","SUCCESS","" "21:18:48,3942639","eso64.exe","12432","CloseFile","E:\Elder Scrolls Online\The Elder Scrolls Online PTS\game\client\icuuc55_x64.dll","SUCCESS","" "21:18:48,3942728","eso64.exe","12432","CloseFile","E:\Elder Scrolls Online\The Elder Scrolls Online PTS\game\client\icuin55_x64.dll","SUCCESS","" "21:18:48,3943005","eso64.exe","12432","IRP_MJ_CLOSE","C:\Windows\System32\opengl32.dll","SUCCESS","" "21:18:48,3943049","eso64.exe","12432","IRP_MJ_CLOSE","E:\Elder Scrolls Online\The Elder Scrolls Online PTS\game\client\icuuc55_x64.dll","SUCCESS","" "21:18:48,3943089","eso64.exe","12432","IRP_MJ_CLOSE","E:\Elder Scrolls Online\The Elder Scrolls Online PTS\game\client\icuin55_x64.dll","SUCCESS","" "21:18:48,3943739","eso64.exe","12432","QueryOpen","C:\Windows\System32\d3dx11_43.dll","FAST IO DISALLOWED","" "21:18:48,3943910","eso64.exe","12432","CloseFile","E:\Elder Scrolls Online\The Elder Scrolls Online PTS\game\client\icuuc55_x64.dll","SUCCESS","" "21:18:48,3944161","eso64.exe","12432","IRP_MJ_CLOSE","E:\Elder Scrolls Online\The Elder Scrolls Online PTS\game\client\icuuc55_x64.dll","SUCCESS","" "21:18:48,3945050","eso64.exe","12432","QueryOpen","E:\Elder Scrolls Online\The Elder Scrolls Online PTS\game\client\D3DCOMPILER_43.dll","NAME NOT FOUND","" "21:18:48,3948218","eso64.exe","12432","CreateFile","C:\Windows\System32\opengl32.dll","SUCCESS","Desired Access: Read Data/List Directory, Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened" "21:18:48,3949458","eso64.exe","12432","CreateFile","C:\Windows\System32\d3dx11_43.dll","SUCCESS","Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened" "21:18:48,3949930","eso64.exe","12432","CreateFileMapping","C:\Windows\System32\opengl32.dll","FILE LOCKED WITH ONLY READERS","SyncType: SyncTypeCreateSection, PageProtection: " "21:18:48,3950143","eso64.exe","12432","FASTIO_RELEASE_FOR_SECTION_SYNCHRONIZATION","C:\Windows\System32\opengl32.dll","SUCCESS","" "21:18:48,3950394","eso64.exe","12432","QueryBasicInformationFile","C:\Windows\System32\d3dx11_43.dll","SUCCESS","CreationTime: 17-11-2014 01:39:57, LastAccessTime: 17-11-2014 01:39:57, LastWriteTime: 26-05-2010 11:41:02, ChangeTime: 14-11-2015 12:31:01, FileAttributes: A" "21:18:48,3950584","eso64.exe","12432","QueryOpen","C:\Windows\System32\D3DCompiler_43.dll","FAST IO DISALLOWED","" "21:18:48,3950701","eso64.exe","12432","CloseFile","C:\Windows\System32\d3dx11_43.dll","SUCCESS","" "21:18:48,3951363","eso64.exe","12432","IRP_MJ_CLOSE","C:\Windows\System32\d3dx11_43.dll","SUCCESS","" "21:18:48,3951648","eso64.exe","12432","QueryOpen","E:\Elder Scrolls Online\The Elder Scrolls Online PTS\game\client\icudt55_x64.dll","SUCCESS","CreationTime: 09-02-2016 21:05:41, LastAccessTime: 09-02-2016 21:05:41, LastWriteTime: 08-02-2016 22:54:10, ChangeTime: 09-02-2016 21:05:41, AllocationSize: 25.911.296, EndOfFile: 25.911.296, FileAttributes: A" "21:18:48,3952048","eso64.exe","12432","CreateFileMapping","C:\Windows\System32\opengl32.dll","SUCCESS","SyncType: SyncTypeOther" "21:18:48,3952361","eso64.exe","12432","FASTIO_RELEASE_FOR_SECTION_SYNCHRONIZATION","C:\Windows\System32\opengl32.dll","SUCCESS","" "21:18:48,3953811","eso64.exe","12432","CreateFile","C:\Windows\System32\D3DCompiler_43.dll","SUCCESS","Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened" "21:18:48,3954048","eso64.exe","12432","CreateFile","E:\Elder Scrolls Online\The Elder Scrolls Online PTS\game\client\icudt55_x64.dll","SUCCESS","Desired Access: Read Data/List Directory, Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened" "21:18:48,3954177","eso64.exe","12432","Load Image","C:\Windows\System32\opengl32.dll","SUCCESS","Image Base: 0x7ffc66b30000, Image Size: 0x129000" "21:18:48,3954509","eso64.exe","12432","QueryBasicInformationFile","C:\Windows\System32\D3DCompiler_43.dll","SUCCESS","CreationTime: 17-11-2014 01:39:59, LastAccessTime: 17-11-2014 01:39:59, LastWriteTime: 26-05-2010 11:41:02, ChangeTime: 14-11-2015 12:31:01, FileAttributes: A" "21:18:48,3954554","eso64.exe","12432","QueryNameInformationFile","C:\Windows\System32\opengl32.dll","SUCCESS","Name: \Windows\System32\opengl32.dll" "21:18:48,3954752","eso64.exe","12432","CloseFile","C:\Windows\System32\D3DCompiler_43.dll","SUCCESS","" "21:18:48,3954791","eso64.exe","12432","CreateFile","C:\Windows\System32\d3dx11_43.dll","SUCCESS","Desired Access: Read Data/List Directory, Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened" "21:18:48,3954903","eso64.exe","12432","CreateFileMapping","E:\Elder Scrolls Online\The Elder Scrolls Online PTS\game\client\icudt55_x64.dll","FILE LOCKED WITH ONLY READERS","SyncType: SyncTypeCreateSection, PageProtection: " "21:18:48,3955090","eso64.exe","12432","IRP_MJ_CLOSE","C:\Windows\System32\D3DCompiler_43.dll","SUCCESS","" "21:18:48,3955182","eso64.exe","12432","FASTIO_RELEASE_FOR_SECTION_SYNCHRONIZATION","E:\Elder Scrolls Online\The Elder Scrolls Online PTS\game\client\icudt55_x64.dll","SUCCESS","" "21:18:48,3955420","eso64.exe","12432","CreateFileMapping","E:\Elder Scrolls Online\The Elder Scrolls Online PTS\game\client\icudt55_x64.dll","SUCCESS","SyncType: SyncTypeOther" "21:18:48,3955640","eso64.exe","12432","FASTIO_RELEASE_FOR_SECTION_SYNCHRONIZATION","E:\Elder Scrolls Online\The Elder Scrolls Online PTS\game\client\icudt55_x64.dll","SUCCESS","" "21:18:48,3955816","eso64.exe","12432","CreateFileMapping","C:\Windows\System32\d3dx11_43.dll","FILE LOCKED WITH ONLY READERS","SyncType: SyncTypeCreateSection, PageProtection: " "21:18:48,3955844","eso64.exe","12432","CloseFile","C:\Windows\System32\opengl32.dll","SUCCESS","" "21:18:48,3956062","eso64.exe","12432","FASTIO_RELEASE_FOR_SECTION_SYNCHRONIZATION","C:\Windows\System32\d3dx11_43.dll","SUCCESS","" "21:18:48,3956196","eso64.exe","12432","IRP_MJ_CLOSE","C:\Windows\System32\opengl32.dll","SUCCESS","" "21:18:48,3956571","eso64.exe","12432","CreateFileMapping","C:\Windows\System32\d3dx11_43.dll","SUCCESS","SyncType: SyncTypeOther" "21:18:48,3956800","eso64.exe","12432","FASTIO_RELEASE_FOR_SECTION_SYNCHRONIZATION","C:\Windows\System32\d3dx11_43.dll","SUCCESS","" "21:18:48,3957582","eso64.exe","12432","Load Image","E:\Elder Scrolls Online\The Elder Scrolls Online PTS\game\client\icudt55_x64.dll","SUCCESS","Image Base: 0x1030000, Image Size: 0x18b8000" "21:18:48,3957973","eso64.exe","12432","QueryNameInformationFile","E:\Elder Scrolls Online\The Elder Scrolls Online PTS\game\client\icudt55_x64.dll","SUCCESS","Name: \Elder Scrolls Online\The Elder Scrolls Online PTS\game\client\icudt55_x64.dll" "21:18:48,3958012","eso64.exe","12432","QueryOpen","E:\Elder Scrolls Online\The Elder Scrolls Online PTS\game\client\GLU32.dll","NAME NOT FOUND","" "21:18:48,3958205","eso64.exe","12432","CreateFile","C:\Windows\System32\D3DCompiler_43.dll","SUCCESS","Desired Access: Read Data/List Directory, Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened" "21:18:48,3958660","eso64.exe","12432","CloseFile","E:\Elder Scrolls Online\The Elder Scrolls Online PTS\game\client\icudt55_x64.dll","SUCCESS","" "21:18:48,3958898","eso64.exe","12432","Load Image","C:\Windows\System32\d3dx11_43.dll","SUCCESS","Image Base: 0x7ffc67440000, Image Size: 0x46000" "21:18:48,3958954","eso64.exe","12432","IRP_MJ_CLOSE","E:\Elder Scrolls Online\The Elder Scrolls Online PTS\game\client\icudt55_x64.dll","SUCCESS","" "21:18:48,3959102","eso64.exe","12432","CreateFileMapping","C:\Windows\System32\D3DCompiler_43.dll","FILE LOCKED WITH ONLY READERS","SyncType: SyncTypeCreateSection, PageProtection: " "21:18:48,3959258","eso64.exe","12432","QueryNameInformationFile","C:\Windows\System32\d3dx11_43.dll","SUCCESS","Name: \Windows\System32\d3dx11_43.dll" "21:18:48,3959331","eso64.exe","12432","FASTIO_RELEASE_FOR_SECTION_SYNCHRONIZATION","C:\Windows\System32\D3DCompiler_43.dll","SUCCESS","" "21:18:48,3960236","eso64.exe","12432","CreateFileMapping","C:\Windows\System32\D3DCompiler_43.dll","SUCCESS","SyncType: SyncTypeOther" "21:18:48,3960342","eso64.exe","12432","CloseFile","C:\Windows\System32\d3dx11_43.dll","SUCCESS","" "21:18:48,3960510","eso64.exe","12432","FASTIO_RELEASE_FOR_SECTION_SYNCHRONIZATION","C:\Windows\System32\D3DCompiler_43.dll","SUCCESS","" "21:18:48,3960568","eso64.exe","12432","QueryOpen","E:\Elder Scrolls Online\The Elder Scrolls Online PTS\game\client\DDRAW.dll","NAME NOT FOUND","" "21:18:48,3960649","eso64.exe","12432","IRP_MJ_CLOSE","C:\Windows\System32\d3dx11_43.dll","SUCCESS","" "21:18:48,3960744","eso64.exe","12432","QueryOpen","C:\Windows\System32\glu32.dll","FAST IO DISALLOWED","" "21:18:48,3962742","eso64.exe","12432","Load Image","C:\Windows\System32\D3DCompiler_43.dll","SUCCESS","Image Base: 0x7ffc5b2a0000, Image Size: 0x26f000" "21:18:48,3963113","eso64.exe","12432","QueryOpen","C:\Windows\System32\ddraw.dll","FAST IO DISALLOWED","" "21:18:48,3963175","eso64.exe","12432","QueryNameInformationFile","C:\Windows\System32\D3DCompiler_43.dll","SUCCESS","Name: \Windows\System32\D3DCompiler_43.dll" "21:18:48,3964410","eso64.exe","12432","CloseFile","C:\Windows\System32\D3DCompiler_43.dll","SUCCESS","" "21:18:48,3964823","eso64.exe","12432","IRP_MJ_CLOSE","C:\Windows\System32\D3DCompiler_43.dll","SUCCESS","" "21:18:48,3964949","eso64.exe","12432","CreateFile","C:\Windows\System32\glu32.dll","SUCCESS","Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened" "21:18:48,3965460","eso64.exe","12432","CreateFile","C:\Windows\System32\ddraw.dll","SUCCESS","Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened" "21:18:48,3965882","eso64.exe","12432","QueryBasicInformationFile","C:\Windows\System32\glu32.dll","SUCCESS","CreationTime: 30-10-2015 08:18:18, LastAccessTime: 30-10-2015 08:18:18, LastWriteTime: 30-10-2015 08:18:18, ChangeTime: 14-11-2015 21:15:51, FileAttributes: A" "21:18:48,3966108","eso64.exe","12432","CloseFile","C:\Windows\System32\glu32.dll","SUCCESS","" "21:18:48,3966480","eso64.exe","12432","IRP_MJ_CLOSE","C:\Windows\System32\glu32.dll","SUCCESS","" "21:18:48,3966723","eso64.exe","12432","QueryBasicInformationFile","C:\Windows\System32\ddraw.dll","SUCCESS","CreationTime: 30-10-2015 08:18:18, LastAccessTime: 30-10-2015 08:18:18, LastWriteTime: 30-10-2015 08:18:18, ChangeTime: 14-11-2015 21:15:46, FileAttributes: A" "21:18:48,3966910","eso64.exe","12432","CloseFile","C:\Windows\System32\ddraw.dll","SUCCESS","" "21:18:48,3967167","eso64.exe","12432","IRP_MJ_CLOSE","C:\Windows\System32\ddraw.dll","SUCCESS","" "21:18:48,3968561","eso64.exe","12432","CreateFile","C:\Windows\System32\glu32.dll","SUCCESS","Desired Access: Read Data/List Directory, Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened" "21:18:48,3970480","eso64.exe","12432","CreateFile","C:\Windows\System32\ddraw.dll","SUCCESS","Desired Access: Read Data/List Directory, Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened" "21:18:48,3970517","eso64.exe","12432","CreateFileMapping","C:\Windows\System32\glu32.dll","FILE LOCKED WITH ONLY READERS","SyncType: SyncTypeCreateSection, PageProtection: " "21:18:48,3970802","eso64.exe","12432","FASTIO_RELEASE_FOR_SECTION_SYNCHRONIZATION","C:\Windows\System32\glu32.dll","SUCCESS","" "21:18:48,3971344","eso64.exe","12432","CreateFileMapping","C:\Windows\System32\glu32.dll","SUCCESS","SyncType: SyncTypeOther" "21:18:48,3971749","eso64.exe","12432","CreateFileMapping","C:\Windows\System32\ddraw.dll","FILE LOCKED WITH ONLY READERS","SyncType: SyncTypeCreateSection, PageProtection: " "21:18:48,3971796","eso64.exe","12432","FASTIO_RELEASE_FOR_SECTION_SYNCHRONIZATION","C:\Windows\System32\glu32.dll","SUCCESS","" "21:18:48,3972215","eso64.exe","12432","FASTIO_RELEASE_FOR_SECTION_SYNCHRONIZATION","C:\Windows\System32\ddraw.dll","SUCCESS","" "21:18:48,3973743","eso64.exe","12432","CreateFileMapping","C:\Windows\System32\ddraw.dll","SUCCESS","SyncType: SyncTypeOther" "21:18:48,3973970","eso64.exe","12432","Load Image","C:\Windows\System32\glu32.dll","SUCCESS","Image Base: 0x7ffc67410000, Image Size: 0x2e000" "21:18:48,3974134","eso64.exe","12432","FASTIO_RELEASE_FOR_SECTION_SYNCHRONIZATION","C:\Windows\System32\ddraw.dll","SUCCESS","" "21:18:48,3974352","eso64.exe","12432","QueryNameInformationFile","C:\Windows\System32\glu32.dll","SUCCESS","Name: \Windows\System32\glu32.dll" "21:18:48,3975269","eso64.exe","12432","CloseFile","C:\Windows\System32\glu32.dll","SUCCESS","" "21:18:48,3975548","eso64.exe","12432","IRP_MJ_CLOSE","C:\Windows\System32\glu32.dll","SUCCESS","" "21:18:48,3976171","eso64.exe","12432","Load Image","C:\Windows\System32\ddraw.dll","SUCCESS","Image Base: 0x7ffc66a30000, Image Size: 0xfa000" "21:18:48,3976534","eso64.exe","12432","QueryNameInformationFile","C:\Windows\System32\ddraw.dll","SUCCESS","Name: \Windows\System32\ddraw.dll" "21:18:48,3978135","eso64.exe","12432","CloseFile","C:\Windows\System32\ddraw.dll","SUCCESS","" "21:18:48,3978403","eso64.exe","12432","IRP_MJ_CLOSE","C:\Windows\System32\ddraw.dll","SUCCESS","" "21:18:48,3979901","eso64.exe","12432","QueryOpen","E:\Elder Scrolls Online\The Elder Scrolls Online PTS\game\client\DCIMAN32.dll","NAME NOT FOUND","" "21:18:48,3982580","eso64.exe","12432","QueryOpen","C:\Windows\System32\dciman32.dll","FAST IO DISALLOWED","" "21:18:48,3984493","eso64.exe","12432","CreateFile","C:\Windows\System32\dciman32.dll","SUCCESS","Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened" "21:18:48,3985516","eso64.exe","12432","QueryBasicInformationFile","C:\Windows\System32\dciman32.dll","SUCCESS","CreationTime: 14-11-2015 21:20:33, LastAccessTime: 14-11-2015 21:20:33, LastWriteTime: 14-11-2015 21:20:33, ChangeTime: 14-11-2015 21:20:40, FileAttributes: A" "21:18:48,3985762","eso64.exe","12432","CloseFile","C:\Windows\System32\dciman32.dll","SUCCESS","" "21:18:48,3986094","eso64.exe","12432","IRP_MJ_CLOSE","C:\Windows\System32\dciman32.dll","SUCCESS","" "21:18:48,3988284","eso64.exe","12432","CreateFile","C:\Windows\System32\dciman32.dll","SUCCESS","Desired Access: Read Data/List Directory, Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened" "21:18:48,3989421","eso64.exe","12432","CreateFileMapping","C:\Windows\System32\dciman32.dll","FILE LOCKED WITH ONLY READERS","SyncType: SyncTypeCreateSection, PageProtection: " "21:18:48,3989653","eso64.exe","12432","FASTIO_RELEASE_FOR_SECTION_SYNCHRONIZATION","C:\Windows\System32\dciman32.dll","SUCCESS","" "21:18:48,3990039","eso64.exe","12432","CreateFileMapping","C:\Windows\System32\dciman32.dll","SUCCESS","SyncType: SyncTypeOther" "21:18:48,3990243","eso64.exe","12432","FASTIO_RELEASE_FOR_SECTION_SYNCHRONIZATION","C:\Windows\System32\dciman32.dll","SUCCESS","" "21:18:48,3992078","eso64.exe","12432","Load Image","C:\Windows\System32\dciman32.dll","SUCCESS","Image Base: 0x7ffc7ed50000, Image Size: 0x8000" "21:18:48,3992427","eso64.exe","12432","QueryNameInformationFile","C:\Windows\System32\dciman32.dll","SUCCESS","Name: \Windows\System32\dciman32.dll" "21:18:48,3993416","eso64.exe","12432","CloseFile","C:\Windows\System32\dciman32.dll","SUCCESS","" "21:18:48,3993757","eso64.exe","12432","IRP_MJ_CLOSE","C:\Windows\System32\dciman32.dll","SUCCESS","" "21:18:48,3996621","eso64.exe","12432","RegQueryValue","HKLM\System\CurrentControlSet\Control\WMI\Security\d0f1a5c6-fc43-48ae-99bf-efb1c38be9d1","NAME NOT FOUND","Length: 524" "21:18:48,3999409","eso64.exe","12432","RegOpenKey","HKLM\System\CurrentControlSet\Control\Nls\Sorting\Versions","REPARSE","Desired Access: Read" "21:18:48,3999744","eso64.exe","12432","RegOpenKey","HKLM\System\CurrentControlSet\Control\Nls\Sorting\Versions","SUCCESS","Desired Access: Read" "21:18:48,4000154","eso64.exe","12432","RegQueryValue","HKLM\System\CurrentControlSet\Control\Nls\Sorting\Versions\(Default)","SUCCESS","Type: REG_SZ, Length: 18, Data: 0006020E" "21:18:48,4000856","eso64.exe","12432","RegOpenKey","HKLM\SYSTEM\CurrentControlSet\Control\Session Manager","REPARSE","Desired Access: Query Value, Enumerate Sub Keys" "21:18:48,4001115","eso64.exe","12432","RegOpenKey","HKLM\System\CurrentControlSet\Control\Session Manager","SUCCESS","Desired Access: Query Value, Enumerate Sub Keys" "21:18:48,4001412","eso64.exe","12432","RegQueryValue","HKLM\System\CurrentControlSet\Control\SESSION MANAGER\ResourcePolicies","NAME NOT FOUND","Length: 24" "21:18:48,4001632","eso64.exe","12432","RegCloseKey","HKLM\System\CurrentControlSet\Control\SESSION MANAGER","SUCCESS","" "21:18:48,4007966","eso64.exe","12432","QueryOpen","C:\Windows\System32\imm32.dll","FAST IO DISALLOWED","" "21:18:48,4009938","eso64.exe","12432","CreateFile","C:\Windows\System32\imm32.dll","SUCCESS","Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened" "21:18:48,4010748","eso64.exe","12432","QueryBasicInformationFile","C:\Windows\System32\imm32.dll","SUCCESS","CreationTime: 30-10-2015 08:17:58, LastAccessTime: 30-10-2015 08:17:58, LastWriteTime: 30-10-2015 08:17:58, ChangeTime: 14-11-2015 21:15:24, FileAttributes: A" "21:18:48,4010930","eso64.exe","12432","CloseFile","C:\Windows\System32\imm32.dll","SUCCESS","" "21:18:48,4011198","eso64.exe","12432","IRP_MJ_CLOSE","C:\Windows\System32\imm32.dll","SUCCESS","" "21:18:48,4013209","eso64.exe","12432","QueryOpen","C:\Windows\System32\imm32.dll","FAST IO DISALLOWED","" "21:18:48,4015475","eso64.exe","12432","CreateFile","C:\Windows\System32\imm32.dll","SUCCESS","Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened" "21:18:48,4016433","eso64.exe","12432","QueryBasicInformationFile","C:\Windows\System32\imm32.dll","SUCCESS","CreationTime: 30-10-2015 08:17:58, LastAccessTime: 30-10-2015 08:17:58, LastWriteTime: 30-10-2015 08:17:58, ChangeTime: 14-11-2015 21:15:24, FileAttributes: A" "21:18:48,4016679","eso64.exe","12432","CloseFile","C:\Windows\System32\imm32.dll","SUCCESS","" "21:18:48,4017151","eso64.exe","12432","IRP_MJ_CLOSE","C:\Windows\System32\imm32.dll","SUCCESS","" "21:18:48,4017618","eso64.exe","12432","RegOpenKey","HKLM\System\CurrentControlSet\Control\Error Message Instrument","REPARSE","Desired Access: Read" "21:18:48,4017883","eso64.exe","12432","RegOpenKey","HKLM\System\CurrentControlSet\Control\Error Message Instrument","NAME NOT FOUND","Desired Access: Read" "21:18:48,4018355","eso64.exe","12432","RegQueryValue","HKLM\System\CurrentControlSet\Control\WMI\Security\f25bcd2e-2690-55dc-3bc4-07b65b1b41c9","NAME NOT FOUND","Length: 524" "21:18:48,4018964","eso64.exe","12432","RegOpenKey","HKLM\Software\Microsoft\Windows NT\CurrentVersion\GRE_Initialize","SUCCESS","Desired Access: Read" "21:18:48,4019506","eso64.exe","12432","RegQueryValue","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles","NAME NOT FOUND","Length: 20" "21:18:48,4019883","eso64.exe","12432","RegCloseKey","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize","SUCCESS","" "21:18:48,4020841","eso64.exe","12432","RegOpenKey","HKLM\Software\Microsoft\Windows NT\CurrentVersion\Compatibility32","SUCCESS","Desired Access: Read" "21:18:48,4021263","eso64.exe","12432","RegQueryValue","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Compatibility32\eso64","NAME NOT FOUND","Length: 172" "21:18:48,4021526","eso64.exe","12432","RegCloseKey","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Compatibility32","SUCCESS","" "21:18:48,4021789","eso64.exe","12432","RegOpenKey","HKLM\Software\Microsoft\Windows NT\CurrentVersion\IME Compatibility","NAME NOT FOUND","Desired Access: Read" "21:18:48,4025940","eso64.exe","12432","RegOpenKey","HKLM","SUCCESS","Desired Access: Maximum Allowed, Granted Access: Read" "21:18:48,4026281","eso64.exe","12432","RegQueryKey","HKLM","SUCCESS","Query: HandleTags, HandleTags: 0x0" "21:18:48,4026507","eso64.exe","12432","RegOpenKey","HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows","SUCCESS","Desired Access: Read" "21:18:48,4026837","eso64.exe","12432","RegQueryValue","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\LoadAppInit_DLLs","SUCCESS","Type: REG_DWORD, Length: 4, Data: 0" "21:18:48,4027119","eso64.exe","12432","RegCloseKey","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows","SUCCESS","" "21:18:48,4031382","eso64.exe","12432","RegOpenKey","HKLM\System\CurrentControlSet\Control\Lsa\FipsAlgorithmPolicy","REPARSE","Desired Access: Query Value" "21:18:48,4032008","eso64.exe","12432","RegOpenKey","HKLM\System\CurrentControlSet\Control\Lsa\FipsAlgorithmPolicy","SUCCESS","Desired Access: Query Value" "21:18:48,4032416","eso64.exe","12432","RegQueryValue","HKLM\System\CurrentControlSet\Control\Lsa\FipsAlgorithmPolicy\Enabled","SUCCESS","Type: REG_DWORD, Length: 4, Data: 0" "21:18:48,4032726","eso64.exe","12432","RegOpenKey","HKLM\System\CurrentControlSet\Control\Lsa","REPARSE","Desired Access: Query Value" "21:18:48,4032966","eso64.exe","12432","RegOpenKey","HKLM\System\CurrentControlSet\Control\Lsa","SUCCESS","Desired Access: Query Value" "21:18:48,4033405","eso64.exe","12432","RegQueryValue","HKLM\System\CurrentControlSet\Control\Lsa\FipsAlgorithmPolicy","NAME NOT FOUND","Length: 20" "21:18:48,4033779","eso64.exe","12432","RegQueryValue","HKLM\System\CurrentControlSet\Control\Lsa\FipsAlgorithmPolicy\MDMEnabled","SUCCESS","Type: REG_DWORD, Length: 4, Data: 0" "21:18:48,4034055","eso64.exe","12432","RegCloseKey","HKLM\System\CurrentControlSet\Control\Lsa\FipsAlgorithmPolicy","SUCCESS","" "21:18:48,4034254","eso64.exe","12432","RegCloseKey","HKLM\System\CurrentControlSet\Control\Lsa","SUCCESS","" "21:18:48,4034491","eso64.exe","12432","RegOpenKey","HKLM\SYSTEM\CurrentControlSet\Policies\Microsoft\Cryptography\Configuration","REPARSE","Desired Access: Query Value" "21:18:48,4034796","eso64.exe","12432","RegOpenKey","HKLM\System\CurrentControlSet\Policies\Microsoft\Cryptography\Configuration","NAME NOT FOUND","Desired Access: Query Value" "21:18:48,4036559","eso64.exe","12432","RegQueryKey","HKLM","SUCCESS","Query: HandleTags, HandleTags: 0x0" "21:18:48,4036793","eso64.exe","12432","RegOpenKey","HKLM\SOFTWARE\Microsoft\OLE","SUCCESS","Desired Access: Read" "21:18:48,4037154","eso64.exe","12432","RegQueryValue","HKLM\SOFTWARE\Microsoft\OLE\PageAllocatorUseSystemHeap","NAME NOT FOUND","Length: 144" "21:18:48,4037419","eso64.exe","12432","RegCloseKey","HKLM\SOFTWARE\Microsoft\OLE","SUCCESS","" "21:18:48,4037615","eso64.exe","12432","RegQueryKey","HKLM","SUCCESS","Query: HandleTags, HandleTags: 0x0" "21:18:48,4037844","eso64.exe","12432","RegOpenKey","HKLM\SOFTWARE\Microsoft\OLE","SUCCESS","Desired Access: Read" "21:18:48,4038170","eso64.exe","12432","RegQueryValue","HKLM\SOFTWARE\Microsoft\OLE\PageAllocatorSystemHeapIsPrivate","NAME NOT FOUND","Length: 144" "21:18:48,4038402","eso64.exe","12432","RegCloseKey","HKLM\SOFTWARE\Microsoft\OLE","SUCCESS","" "21:18:48,4038598","eso64.exe","12432","RegQueryKey","HKLM","SUCCESS","Query: HandleTags, HandleTags: 0x0" "21:18:48,4038827","eso64.exe","12432","RegOpenKey","HKLM\SOFTWARE\Microsoft\OLE","SUCCESS","Desired Access: Read" "21:18:48,4039154","eso64.exe","12432","RegQueryValue","HKLM\SOFTWARE\Microsoft\OLE\AggressiveMTATesting","NAME NOT FOUND","Length: 144" "21:18:48,4039394","eso64.exe","12432","RegCloseKey","HKLM\SOFTWARE\Microsoft\OLE","SUCCESS","" "21:18:48,4040626","eso64.exe","12432","RegQueryKey","HKLM","SUCCESS","Query: HandleTags, HandleTags: 0x0" "21:18:48,4041003","eso64.exe","12432","RegOpenKey","HKLM\Software\Microsoft\OLE\Tracing","NAME NOT FOUND","Desired Access: Read" "21:18:48,4043330","eso64.exe","12432","RegQueryValue","HKLM\System\CurrentControlSet\Control\WMI\Security\1aff6089-e863-4d36-bdfd-3581f07440be","NAME NOT FOUND","Length: 524" "21:18:48,4044557","eso64.exe","12432","RegQueryKey","HKLM","SUCCESS","Query: HandleTags, HandleTags: 0x0" "21:18:48,4044923","eso64.exe","12432","RegOpenKey","HKLM\Software\Microsoft\OLE\Tracing","NAME NOT FOUND","Desired Access: Read" "21:18:48,4048099","eso64.exe","12432","QueryOpen","C:\Windows\System32\oleaut32.dll","FAST IO DISALLOWED","" "21:18:48,4051370","eso64.exe","12432","CreateFile","C:\Windows\System32\oleaut32.dll","SUCCESS","Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened" "21:18:48,4052491","eso64.exe","12432","QueryBasicInformationFile","C:\Windows\System32\oleaut32.dll","SUCCESS","CreationTime: 30-10-2015 08:18:03, LastAccessTime: 30-10-2015 08:18:03, LastWriteTime: 30-10-2015 08:18:03, ChangeTime: 14-11-2015 21:15:25, FileAttributes: A" "21:18:48,4052711","eso64.exe","12432","CloseFile","C:\Windows\System32\oleaut32.dll","SUCCESS","" "21:18:48,4053058","eso64.exe","12432","IRP_MJ_CLOSE","C:\Windows\System32\oleaut32.dll","SUCCESS","" "21:18:48,4055396","eso64.exe","12432","RegOpenKey","HKLM\SYSTEM\CurrentControlSet\Control\Session Manager","REPARSE","Desired Access: Query Value, Enumerate Sub Keys" "21:18:48,4055687","eso64.exe","12432","RegOpenKey","HKLM\System\CurrentControlSet\Control\Session Manager","SUCCESS","Desired Access: Query Value, Enumerate Sub Keys" "21:18:48,4056067","eso64.exe","12432","RegQueryValue","HKLM\System\CurrentControlSet\Control\SESSION MANAGER\ResourcePolicies","NAME NOT FOUND","Length: 24" "21:18:48,4056315","eso64.exe","12432","RegCloseKey","HKLM\System\CurrentControlSet\Control\SESSION MANAGER","SUCCESS","" "21:18:48,4062146","eso64.exe","12432","RegQueryValue","HKLM\System\CurrentControlSet\Control\WMI\Security\30336ed4-e327-447c-9de0-51b652c86108","NAME NOT FOUND","Length: 524" "21:18:48,4062847","eso64.exe","12432","RegQueryValue","HKLM\System\CurrentControlSet\Control\WMI\Security\b87cf16b-0bf8-4492-a510-d5f59626b033","NAME NOT FOUND","Length: 524" "21:18:48,4065948","eso64.exe","12432","RegQueryValue","HKLM\System\CurrentControlSet\Control\WMI\Security\30336ed4-e327-447c-9de0-51b652c86108","NAME NOT FOUND","Length: 524" "21:18:48,4066836","eso64.exe","12432","RegQueryValue","HKLM\System\CurrentControlSet\Control\WMI\Security\b87cf16b-0bf8-4492-a510-d5f59626b033","NAME NOT FOUND","Length: 524" "21:18:48,4069054","eso64.exe","12432","QueryOpen","C:\Windows\System32\ole32.dll","FAST IO DISALLOWED","" "21:18:48,4072368","eso64.exe","12432","CreateFile","C:\Windows\System32\ole32.dll","SUCCESS","Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened" "21:18:48,4073206","eso64.exe","12432","QueryBasicInformationFile","C:\Windows\System32\ole32.dll","SUCCESS","CreationTime: 30-10-2015 08:17:51, LastAccessTime: 30-10-2015 08:17:51, LastWriteTime: 30-10-2015 08:17:51, ChangeTime: 14-11-2015 21:15:25, FileAttributes: A" "21:18:48,4073524","eso64.exe","12432","CloseFile","C:\Windows\System32\ole32.dll","SUCCESS","" "21:18:48,4074158","eso64.exe","12432","IRP_MJ_CLOSE","C:\Windows\System32\ole32.dll","SUCCESS","" "21:18:48,4076052","eso64.exe","12432","RegQueryKey","HKLM","SUCCESS","Query: HandleTags, HandleTags: 0x0" "21:18:48,4076265","eso64.exe","12432","RegOpenKey","HKLM\SOFTWARE\Microsoft\OLEAUT","NAME NOT FOUND","Desired Access: Query Value" "21:18:48,4078162","eso64.exe","12432","RegOpenKey","HKLM\SYSTEM\CurrentControlSet\Control\Session Manager","REPARSE","Desired Access: Query Value, Enumerate Sub Keys" "21:18:48,4078737","eso64.exe","12432","RegOpenKey","HKLM\System\CurrentControlSet\Control\Session Manager","SUCCESS","Desired Access: Query Value, Enumerate Sub Keys" "21:18:48,4079095","eso64.exe","12432","RegQueryValue","HKLM\System\CurrentControlSet\Control\SESSION MANAGER\ResourcePolicies","NAME NOT FOUND","Length: 24" "21:18:48,4079313","eso64.exe","12432","RegCloseKey","HKLM\System\CurrentControlSet\Control\SESSION MANAGER","SUCCESS","" "21:18:48,4081925","eso64.exe","12432","RegQueryValue","HKLM\System\CurrentControlSet\Control\WMI\Security\d479cbb9-0cf0-494c-b98f-684c33849782","NAME NOT FOUND","Length: 524" "21:18:49,1786127","eso64.exe","12432","Process Profiling","","SUCCESS","User Time: 0.6875000 seconds, Kernel Time: 0.1250000 seconds, Private Bytes: 71.593.984, Working Set: 73.216.000" "21:18:50,1786935","eso64.exe","12432","Process Profiling","","SUCCESS","User Time: 1.6875000 seconds, Kernel Time: 0.1250000 seconds, Private Bytes: 71.593.984, Working Set: 73.216.000" "21:18:51,1783574","eso64.exe","12432","Process Profiling","","SUCCESS","User Time: 2.6875000 seconds, Kernel Time: 0.1250000 seconds, Private Bytes: 71.593.984, Working Set: 73.216.000" "21:18:52,1785130","eso64.exe","12432","Process Profiling","","SUCCESS","User Time: 3.6875000 seconds, Kernel Time: 0.1250000 seconds, Private Bytes: 71.593.984, Working Set: 73.216.000" "21:18:53,1784303","eso64.exe","12432","Process Profiling","","SUCCESS","User Time: 4.6875000 seconds, Kernel Time: 0.1250000 seconds, Private Bytes: 71.593.984, Working Set: 73.216.000" "21:18:53,4071147","eso64.exe","12432","Process Create","C:\WINDOWS\system32\WerFault.exe","SUCCESS","PID: 12208, Command line: C:\WINDOWS\system32\WerFault.exe -u -p 12432 -s 116" "21:18:54,1784398","eso64.exe","12432","Process Profiling","","SUCCESS","User Time: 4.8906250 seconds, Kernel Time: 0.1250000 seconds, Private Bytes: 71.593.984, Working Set: 73.224.192" "21:18:55,1786476","eso64.exe","12432","Process Profiling","","SUCCESS","User Time: 4.8906250 seconds, Kernel Time: 0.1250000 seconds, Private Bytes: 71.593.984, Working Set: 73.224.192" "21:18:56,1786650","eso64.exe","12432","Process Profiling","","SUCCESS","User Time: 4.8906250 seconds, Kernel Time: 0.1250000 seconds, Private Bytes: 71.593.984, Working Set: 73.224.192" "21:18:56,3882517","eso64.exe","12432","Thread Exit","","SUCCESS","Thread ID: 12476, User Time: 0.0000000, Kernel Time: 0.0156250" "21:18:56,3882670","eso64.exe","12432","Thread Exit","","SUCCESS","Thread ID: 11420, User Time: 0.0000000, Kernel Time: 0.0000000" "21:18:56,3882732","eso64.exe","12432","Thread Exit","","SUCCESS","Thread ID: 7160, User Time: 0.0000000, Kernel Time: 0.0000000" "21:18:56,3882785","eso64.exe","12432","Thread Exit","","SUCCESS","Thread ID: 1180, User Time: 4.8906250, Kernel Time: 0.1093750" "21:18:56,3893638","eso64.exe","12432","QueryNameInformationFile","C:\Windows\System32\winmmbase.dll","SUCCESS","Name: \Windows\System32\winmmbase.dll" "21:18:56,3894331","eso64.exe","12432","QueryNameInformationFile","C:\Windows\System32\wsock32.dll","SUCCESS","Name: \Windows\System32\wsock32.dll" "21:18:56,3894582","eso64.exe","12432","QueryNameInformationFile","C:\Windows\System32\version.dll","SUCCESS","Name: \Windows\System32\version.dll" "21:18:56,3894923","eso64.exe","12432","QueryNameInformationFile","C:\Windows\System32\IPHLPAPI.DLL","SUCCESS","Name: \Windows\System32\IPHLPAPI.DLL" "21:18:56,3895303","eso64.exe","12432","QueryNameInformationFile","C:\Windows\System32\winmm.dll","SUCCESS","Name: \Windows\System32\winmm.dll" "21:18:56,3895680","eso64.exe","12432","QueryNameInformationFile","C:\Windows\System32\powrprof.dll","SUCCESS","Name: \Windows\System32\powrprof.dll" "21:18:56,3895929","eso64.exe","12432","QueryNameInformationFile","C:\Windows\System32\kernel.appcore.dll","SUCCESS","Name: \Windows\System32\kernel.appcore.dll" "21:18:56,3896178","eso64.exe","12432","QueryNameInformationFile","C:\Windows\System32\profapi.dll","SUCCESS","Name: \Windows\System32\profapi.dll" "21:18:56,3896415","eso64.exe","12432","QueryNameInformationFile","C:\Windows\System32\KernelBase.dll","SUCCESS","Name: \Windows\System32\KernelBase.dll" "21:18:56,3896658","eso64.exe","12432","QueryNameInformationFile","C:\Windows\System32\cfgmgr32.dll","SUCCESS","Name: \Windows\System32\cfgmgr32.dll" "21:18:56,3896898","eso64.exe","12432","QueryNameInformationFile","C:\Windows\System32\windows.storage.dll","SUCCESS","Name: \Windows\System32\windows.storage.dll" "21:18:56,3897275","eso64.exe","12432","QueryNameInformationFile","C:\Windows\System32\SHCore.dll","SUCCESS","Name: \Windows\System32\SHCore.dll" "21:18:56,3897558","eso64.exe","12432","QueryNameInformationFile","C:\Windows\System32\bcryptprimitives.dll","SUCCESS","Name: \Windows\System32\bcryptprimitives.dll" "21:18:56,3897792","eso64.exe","12432","QueryNameInformationFile","C:\Windows\System32\imm32.dll","SUCCESS","Name: \Windows\System32\imm32.dll" "21:18:56,3898030","eso64.exe","12432","QueryNameInformationFile","C:\Windows\System32\msvcrt.dll","SUCCESS","Name: \Windows\System32\msvcrt.dll" "21:18:56,3898278","eso64.exe","12432","QueryNameInformationFile","C:\Windows\System32\shlwapi.dll","SUCCESS","Name: \Windows\System32\shlwapi.dll" "21:18:56,3898516","eso64.exe","12432","QueryNameInformationFile","C:\Windows\System32\ws2_32.dll","SUCCESS","Name: \Windows\System32\ws2_32.dll" "21:18:56,3898751","eso64.exe","12432","QueryNameInformationFile","C:\Windows\System32\user32.dll","SUCCESS","Name: \Windows\System32\user32.dll" "21:18:56,3898985","eso64.exe","12432","QueryNameInformationFile","C:\Windows\System32\sechost.dll","SUCCESS","Name: \Windows\System32\sechost.dll" "21:18:56,3899242","eso64.exe","12432","QueryNameInformationFile","C:\Windows\System32\rpcrt4.dll","SUCCESS","Name: \Windows\System32\rpcrt4.dll" "21:18:56,3899569","eso64.exe","12432","QueryNameInformationFile","C:\Windows\System32\shell32.dll","SUCCESS","Name: \Windows\System32\shell32.dll" "21:18:56,3899885","eso64.exe","12432","QueryNameInformationFile","C:\Windows\System32\oleaut32.dll","SUCCESS","Name: \Windows\System32\oleaut32.dll" "21:18:56,3900200","eso64.exe","12432","QueryNameInformationFile","C:\Windows\System32\advapi32.dll","SUCCESS","Name: \Windows\System32\advapi32.dll" "21:18:56,3900511","eso64.exe","12432","QueryNameInformationFile","C:\Windows\System32\combase.dll","SUCCESS","Name: \Windows\System32\combase.dll" "21:18:56,3900798","eso64.exe","12432","QueryNameInformationFile","C:\Windows\System32\psapi.dll","SUCCESS","Name: \Windows\System32\psapi.dll" "21:18:56,3901041","eso64.exe","12432","QueryNameInformationFile","C:\Windows\System32\kernel32.dll","SUCCESS","Name: \Windows\System32\kernel32.dll" "21:18:56,3901287","eso64.exe","12432","QueryNameInformationFile","C:\Windows\System32\gdi32.dll","SUCCESS","Name: \Windows\System32\gdi32.dll" "21:18:56,3901561","eso64.exe","12432","QueryNameInformationFile","C:\Windows\System32\ole32.dll","SUCCESS","Name: \Windows\System32\ole32.dll" "21:18:56,3901882","eso64.exe","12432","QueryNameInformationFile","C:\Windows\System32\ntdll.dll","SUCCESS","Name: \Windows\System32\ntdll.dll" "21:18:56,3902871","eso64.exe","12432","Process Exit","","SUCCESS","Exit Status: -1073741819, User Time: 4.8906250 seconds, Kernel Time: 0.1406250 seconds, Private Bytes: 71.557.120, Peak Private Bytes: 71.593.984, Working Set: 73.224.192, Peak Working Set: 73.224.192" "21:18:56,3903137","eso64.exe","12432","CloseFile","E:\Elder Scrolls Online\The Elder Scrolls Online PTS\game\client","SUCCESS","" "21:18:56,3903455","eso64.exe","12432","IRP_MJ_CLOSE","E:\Elder Scrolls Online\The Elder Scrolls Online PTS\game\client","SUCCESS","" "21:18:56,3904290","eso64.exe","12432","RegCloseKey","HKLM\System\CurrentControlSet\Control\SESSION MANAGER","SUCCESS","" "21:18:56,3904849","eso64.exe","12432","RegCloseKey","HKLM\System\CurrentControlSet\Control\Nls\Sorting\Versions","SUCCESS","" "21:18:56,3905162","eso64.exe","12432","RegCloseKey","HKLM","SUCCESS","" "21:18:56,4011885","eso64.exe","12432","IRP_MJ_CLOSE","E:\Elder Scrolls Online\The Elder Scrolls Online PTS\game\client\eso64.exe","SUCCESS",""