Log Name:      Security
Source:        Microsoft-Windows-Security-Auditing
Date:          7/3/2016 5:19:21 PM
Event ID:      5038
Task Category: System Integrity
Level:         Information
Keywords:      Audit Failure
User:          N/A
Computer:      WIN-2MET7B9QQ8T
Description:
Code integrity determined that the image hash of a file is not valid.  The file could be corrupt due to unauthorized modification or the invalid hash could indicate a potential disk device error.

File Name:	\Device\HarddiskVolume4\Program Files (x86)\Common Files\BattlEye\BEDaisy.sys	
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" />
    <EventID>5038</EventID>
    <Version>0</Version>
    <Level>0</Level>
    <Task>12290</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8010000000000000</Keywords>
    <TimeCreated SystemTime="2016-07-03T21:19:21.719334700Z" />
    <EventRecordID>869</EventRecordID>
    <Correlation />
    <Execution ProcessID="4" ThreadID="4372" />
    <Channel>Security</Channel>
    <Computer>WIN-2MET7B9QQ8T</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">\Device\HarddiskVolume4\Program Files (x86)\Common Files\BattlEye\BEDaisy.sys</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          7/3/2016 5:19:21 PM
Event ID:      7000
Task Category: None
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      WIN-2MET7B9QQ8T
Description:
The BEDaisy service failed to start due to the following error: 
Windows cannot verify the digital signature for this file. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="49152">7000</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2016-07-03T21:19:21.719068100Z" />
    <EventRecordID>746</EventRecordID>
    <Correlation />
    <Execution ProcessID="824" ThreadID="4696" />
    <Channel>System</Channel>
    <Computer>WIN-2MET7B9QQ8T</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">BEDaisy</Data>
    <Data Name="param2">%%577</Data>
    <Binary>42004500440061006900730079000000</Binary>
  </EventData>
</Event>