Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [F:\a\Minidump\D M P\120710-26988-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0xfffff800`02c07000 PsLoadedModuleList = 0xfffff800`02e44e50
Debug session time: Tue Dec 7 17:36:06.490 2010 (UTC - 5:00)
System Uptime: 0 days 0:02:34.066
Loading Kernel Symbols
..
Press ctrl-c (cdb, kd, ntsd) or ctrl-break (windbg) to abort symbol loads that take too long.
Run !sym noisy before .reload to track down problems loading symbols.
.............................................................
................................................................
.....................
Loading User Symbols
Loading unloaded module list
......
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck BE, {fffff88001326788, 35f0000005962101, fffff88004326530, b}
Probably caused by : win32k.sys ( win32k!DestroyProcessInfo+327 )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
ATTEMPTED_WRITE_TO_READONLY_MEMORY (be)
An attempt was made to write to readonly memory. The guilty driver is on the
stack trace (and is typically the current instruction pointer).
When possible, the guilty driver's name (Unicode string) is printed on
the bugcheck screen and saved in KiBugCheckDriver.
Arguments:
Arg1: fffff88001326788, Virtual address for the attempted write.
Arg2: 35f0000005962101, PTE contents.
Arg3: fffff88004326530, (reserved)
Arg4: 000000000000000b, (reserved)
Debugging Details:
------------------
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0xBE
PROCESS_NAME: mscorsvw.exe
CURRENT_IRQL: 0
TRAP_FRAME: fffff88004326530 -- (.trap 0xfffff88004326530)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=fffffa8006639b60
rdx=fffffa8005dc5cf0 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002f1e661 rsp=fffff880043266c0 rbp=fffff960001ba058
r8=0000000000000000 r9=0000000000000001 r10=0000000000000000
r11=fffffa8003d512d0 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na po nc
nt!ExpWin32SessionCallout+0x61:
fffff800`02f1e661 8907 mov dword ptr [rdi],eax ds:cb60:00000000`00000000=????????
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff80002cf7ae2 to fffff80002c77740
STACK_TEXT:
fffff880`043263c8 fffff800`02cf7ae2 : 00000000`000000be fffff880`01326788 35f00000`05962101 fffff880`04326530 : nt!KeBugCheckEx
fffff880`043263d0 fffff800`02c7582e : 00000000`00000001 00000000`00000200 00000000`00000000 fffff800`02c7eb9d : nt! ?? ::FNODOBFM::`string'+0x4237e
fffff880`04326530 fffff800`02f1e661 : 00000000`00000200 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x16e
fffff880`043266c0 fffff800`02f33e15 : 00000000`00000000 fffffa80`065d8a70 fffffa80`06639b60 fffff8a0`031320c0 : nt!ExpWin32SessionCallout+0x61
fffff880`04326720 fffff800`02f8d561 : fffffa80`06150b50 fffff8a0`0316ed00 00000000`00000000 fffff800`c0000001 : nt!ExpWin32OkayToCloseProcedure+0x61
fffff880`04326770 fffff800`02f8d414 : 00000000`00000030 fffffa80`065d8a70 fffff8a0`030f6420 00000000`00000030 : nt!ObpCloseHandleTableEntry+0x111
fffff880`04326800 fffff960`001bd487 : 00000000`00000030 00000000`00004000 00000000`00000000 fffff900`c1aff010 : nt!ObpCloseHandle+0x94
fffff880`04326850 fffff960`001b42cb : fffff900`c1aff010 fffff880`04326c20 00000000`ffffffff fffffa80`065d8a70 : win32k!DestroyProcessInfo+0x327
fffff880`04326880 fffff960`001b43c6 : fffffa80`06150b00 fffff900`c1aff010 00000000`00000000 fffff880`04326c20 : win32k!xxxUserProcessCallout+0x15f
fffff880`043268d0 fffff800`02f5ca01 : fffffa80`06150b50 00000000`00000000 00000000`00000000 fffffa80`06639b60 : win32k!W32pProcessCallout+0x4e
fffff880`04326900 fffff800`02f35635 : 00000000`00000000 fffffa80`06639b01 fffffa80`78457300 fffffa80`06be6b60 : nt!PspExitThread+0x561
fffff880`043269c0 fffff800`02c541db : 00000000`00000000 00000000`00000000 fffffa80`066b7de0 00000000`00000000 : nt!PsExitSpecialApc+0x1d
fffff880`043269f0 fffff800`02c54620 : 00000000`002ae540 fffff880`04326a70 fffff800`02f3574c 00000000`00000001 : nt!KiDeliverApc+0x2eb
fffff880`04326a70 fffff800`02c76a37 : ffffffff`ffffffff 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiInitiateUserApc+0x70
fffff880`04326bb0 00000000`76f3fdba : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceExit+0x9c
00000000`00dcf288 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x76f3fdba
STACK_COMMAND: kb
FOLLOWUP_IP:
win32k!DestroyProcessInfo+327
fffff960`001bd487 4889b748010000 mov qword ptr [rdi+148h],rsi
SYMBOL_STACK_INDEX: 7
SYMBOL_NAME: win32k!DestroyProcessInfo+327
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: win32k
IMAGE_NAME: win32k.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4c7dc13c
FAILURE_BUCKET_ID: X64_0xBE_win32k!DestroyProcessInfo+327
BUCKET_ID: X64_0xBE_win32k!DestroyProcessInfo+327
Followup: MachineOwner
---------
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [F:\a\Minidump\D M P\120710-31153-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0xfffff800`02c61000 PsLoadedModuleList = 0xfffff800`02e9ee50
Debug session time: Tue Dec 7 17:06:52.582 2010 (UTC - 5:00)
System Uptime: 0 days 0:01:13.158
Loading Kernel Symbols
..
Press ctrl-c (cdb, kd, ntsd) or ctrl-break (windbg) to abort symbol loads that take too long.
Run !sym noisy before .reload to track down problems loading symbols.
.............................................................
................................................................
....................
Loading User Symbols
Loading unloaded module list
......
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck F7, {fffff88006a8f260, 1b0cc062ecf6, ffffe4f33f9d1309, 0}
Probably caused by : ntkrnlmp.exe ( nt!_report_gsfailure+25 )
Followup: MachineOwner
---------
6: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
DRIVER_OVERRAN_STACK_BUFFER (f7)
A driver has overrun a stack-based buffer. This overrun could potentially
allow a malicious user to gain control of this machine.
DESCRIPTION
A driver overran a stack-based buffer (or local variable) in a way that would
have overwritten the function's return address and jumped back to an arbitrary
address when the function returned. This is the classic "buffer overrun"
hacking attack and the system has been brought down to prevent a malicious user
from gaining complete control of it.
Do a kb to get a stack backtrace -- the last routine on the stack before the
buffer overrun handlers and bugcheck call is the one that overran its local
variable(s).
Arguments:
Arg1: fffff88006a8f260, Actual security check cookie from the stack
Arg2: 00001b0cc062ecf6, Expected security check cookie
Arg3: ffffe4f33f9d1309, Complement of the expected security check cookie
Arg4: 0000000000000000, zero
Debugging Details:
------------------
OVERLAPPED_MODULE: Address regions for 'nwifi' and 'usbvideo.sys' overlap
DEFAULT_BUCKET_ID: GS_FALSE_POSITIVE_MISSING_GSFRAME
SECURITY_COOKIE: Expected 00001b0cc062ecf6 found fffff88006a8f260
CUSTOMER_CRASH_COUNT: 1
BUGCHECK_STR: 0xF7
PROCESS_NAME: AtBroker.exe
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from fffff80002d664c5 to fffff80002cd1740
STACK_TEXT:
fffff880`06a8f1d8 fffff800`02d664c5 : 00000000`000000f7 fffff880`06a8f260 00001b0c`c062ecf6 ffffe4f3`3f9d1309 : nt!KeBugCheckEx
fffff880`06a8f1e0 fffff800`02caca52 : fffff880`00001000 00000000`00000000 fffff880`01800000 fffff880`06a8f2c0 : nt!_report_gsfailure+0x25
fffff880`06a8f220 fffff800`02cb49fe : fffffa80`04657e50 fffff8a0`034b9000 fffffa80`03da8be0 fffffa80`00000000 : nt!EtwpEventWriteFull+0x4b2
fffff880`06a8f490 fffff800`030792f6 : 00000000`00000036 000007fe`fdbc00f0 fffff880`06a8f798 fffff880`06a8f780 : nt!EtwWrite+0xae
fffff880`06a8f500 fffff800`02d402ea : fffffa80`04d10000 00000000`00000000 000007fe`fdbc0000 fffff800`02fb0000 : nt!EtwpPsProvTraceImage+0x1c5
fffff880`06a8f5e0 fffff800`02f2cdc5 : fffffa80`05706070 fffffa80`04d10000 fffff8a0`00002000 fffff880`06a8f798 : nt! ?? ::FNODOBFM::`string'+0x29333
fffff880`06a8f700 fffff800`02f8e43e : fffffa80`04d0db30 00000000`00000000 fffffa80`06671060 00000000`00000001 : nt! ?? ::NNGAKEGL::`string'+0x210c6
fffff880`06a8f8a0 fffff800`02fb6cd4 : 000007ff`fffda000 fffff880`06a8fc20 00000000`00000000 fffffa80`062dde60 : nt!PspExitProcess+0x4e
fffff880`06a8f900 fffff800`02f8f635 : 00000000`00000001 fffff800`02fd0101 000007ff`fffda000 00000000`00000000 : nt!PspExitThread+0x834
fffff880`06a8f9c0 fffff800`02cae1db : fffffa80`05209001 fffffa80`062e1010 00000000`00000000 00000000`00000000 : nt!PsExitSpecialApc+0x1d
fffff880`06a8f9f0 fffff800`02cae620 : 00000000`002aea60 fffff880`06a8fa70 fffff800`02f8f74c 00000000`00000001 : nt!KiDeliverApc+0x2eb
fffff880`06a8fa70 fffff800`02cd0a37 : 00000000`00000382 00000000`00000000 00000000`00000001 0000007f`ffffffff : nt!KiInitiateUserApc+0x70
fffff880`06a8fbb0 00000000`7733008a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceExit+0x9c
00000000`0020f038 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7733008a
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!_report_gsfailure+25
fffff800`02d664c5 cc int 3
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt!_report_gsfailure+25
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4c1c44a9
FAILURE_BUCKET_ID: X64_0xF7_MISSING_GSFRAME_nt!_report_gsfailure+25
BUCKET_ID: X64_0xF7_MISSING_GSFRAME_nt!_report_gsfailure+25
Followup: MachineOwner
---------
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [F:\a\Minidump\D M P\120710-31184-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0xfffff800`02003000 PsLoadedModuleList = 0xfffff800`02240e50
Debug session time: Tue Dec 7 17:42:55.951 2010 (UTC - 5:00)
System Uptime: 0 days 0:00:31.340
Loading Kernel Symbols
..
Press ctrl-c (cdb, kd, ntsd) or ctrl-break (windbg) to abort symbol loads that take too long.
Run !sym noisy before .reload to track down problems loading symbols.
.............................................................
...................................................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck A, {0, 2, 0, fffff800020932b3}
Probably caused by : ntkrnlmp.exe ( nt!KiPageFault+260 )
Followup: MachineOwner
---------
2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 0000000000000000, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff800020932b3, address which referenced memory
Debugging Details:
------------------
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800022ab0e0
0000000000000000
CURRENT_IRQL: 2
FAULTING_IP:
nt!IopCompleteRequest+ae3
fffff800`020932b3 488b09 mov rcx,qword ptr [rcx]
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0xA
PROCESS_NAME: wlanext.exe
IRP_ADDRESS: ffffffffffffff89
TRAP_FRAME: fffff8800533c090 -- (.trap 0xfffff8800533c090)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff8800533c428 rbx=0000000000000000 rcx=0000000000000000
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff800020932b3 rsp=fffff8800533c220 rbp=fffff8800533c370
r8=fffffa8005d0e340 r9=fffff8800533c320 r10=0000000000000002
r11=fffffa8005bc6400 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz ac po cy
nt!IopCompleteRequest+0xae3:
fffff800`020932b3 488b09 mov rcx,qword ptr [rcx] ds:00000000`00000000=????????????????
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff80002072ca9 to fffff80002073740
STACK_TEXT:
fffff880`0533bf48 fffff800`02072ca9 : 00000000`0000000a 00000000`00000000 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff880`0533bf50 fffff800`02071920 : fffff8a0`01ce9c02 fffffa80`05ee9ac0 00000000`00002000 00000000`00080000 : nt!KiBugCheckDispatch+0x69
fffff880`0533c090 fffff800`020932b3 : fffffa80`05067ad8 00000000`00000000 00000000`00000101 fffffa80`060dbc20 : nt!KiPageFault+0x260
fffff880`0533c220 fffff800`020500c7 : 00000000`00000001 00000000`00000000 fffffa80`05fccf00 fffffa80`00000000 : nt!IopCompleteRequest+0xae3
fffff880`0533c2f0 fffff800`02050487 : fffffa80`05fccee0 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiDeliverApc+0x1d7
fffff880`0533c370 fffffa80`04be21d6 : fffffa80`05fccee0 fffffa80`05fccfb0 00000000`00004443 00000000`00000000 : nt!KiApcInterrupt+0xd7
fffff880`0533c500 fffffa80`05fccee0 : fffffa80`05fccfb0 00000000`00004443 00000000`00000000 fffffa80`04be193c : 0xfffffa80`04be21d6
fffff880`0533c508 fffffa80`05fccfb0 : 00000000`00004443 00000000`00000000 fffffa80`04be193c fffff880`0533c5a9 : 0xfffffa80`05fccee0
fffff880`0533c510 00000000`00004443 : 00000000`00000000 fffffa80`04be193c fffff880`0533c5a9 fffff880`00000000 : 0xfffffa80`05fccfb0
fffff880`0533c518 00000000`00000000 : fffffa80`04be193c fffff880`0533c5a9 fffff880`00000000 fffff800`00004443 : 0x4443
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!KiPageFault+260
fffff800`02071920 440f20c0 mov rax,cr8
SYMBOL_STACK_INDEX: 2
SYMBOL_NAME: nt!KiPageFault+260
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4c1c44a9
FAILURE_BUCKET_ID: X64_0xA_nt!KiPageFault+260
BUCKET_ID: X64_0xA_nt!KiPageFault+260lmtn
start end module name
fffff880`0376b000 fffff880`037a9000 1394ohci 1394ohci.sys Mon Jul 13 20:07:12 2009 (4A5BCC30)
fffff880`00f78000 fffff880`00fcf000 ACPI ACPI.sys Mon Jul 13 19:19:34 2009 (4A5BC106)
fffff880`02886000 fffff880`02910000 afd afd.sys Mon Jul 13 19:21:40 2009 (4A5BC184)
fffff880`02e00000 fffff880`02e16000 AgileVpn AgileVpn.sys Mon Jul 13 20:10:24 2009 (4A5BCCF0)
fffff880`01116000 fffff880`01121000 amdxata amdxata.sys Tue May 19 13:56:59 2009 (4A12F2EB)
fffff880`0343e000 fffff880`03460000 AnyDVD AnyDVD.sys Sat Dec 19 13:22:08 2009 (4B2D19D0)
fffff880`00e99000 fffff880`00ea2000 atapi atapi.sys Mon Jul 13 19:19:47 2009 (4A5BC113)
fffff880`010d1000 fffff880`010fb000 ataport ataport.SYS Mon Jul 13 19:19:52 2009 (4A5BC118)
fffff880`00e5e000 fffff880`00e6a000 BATTC BATTC.SYS Mon Jul 13 19:31:01 2009 (4A5BC3B5)
fffff880`02ecb000 fffff880`02ed4000 bcmvwl64 bcmvwl64.sys Tue Dec 08 11:07:09 2009 (4B1E79AD)
fffff880`03470000 fffff880`0375e000 bcmwl664 bcmwl664.sys Tue Dec 08 11:10:06 2009 (4B1E7A5E)
fffff880`017c0000 fffff880`017c7000 Beep Beep.SYS Mon Jul 13 20:00:13 2009 (4A5BCA8D)
fffff880`02fd1000 fffff880`02fe2000 blbdrive blbdrive.sys Mon Jul 13 19:35:59 2009 (4A5BC4DF)
fffff880`02fa7000 fffff880`02fd1000 cdrom cdrom.sys Mon Jul 13 19:19:54 2009 (4A5BC11A)
fffff880`00c00000 fffff880`00cc0000 CI CI.dll Mon Jul 13 21:32:13 2009 (4A5BE01D)
fffff880`0174f000 fffff880`0177f000 CLASSPNP CLASSPNP.SYS Mon Jul 13 19:19:58 2009 (4A5BC11E)
fffff880`00d34000 fffff880`00d92000 CLFS CLFS.SYS Mon Jul 13 19:19:57 2009 (4A5BC11D)
fffff880`01000000 fffff880`01073000 cng cng.sys Mon Jul 13 19:49:40 2009 (4A5BC814)
fffff880`00e55000 fffff880`00e5e000 compbatt compbatt.sys Mon Jul 13 19:31:02 2009 (4A5BC3B6)
fffff880`02fe2000 fffff880`02ff2000 CompositeBus CompositeBus.sys Mon Jul 13 20:00:33 2009 (4A5BCAA1)
fffff880`03949000 fffff880`03957000 crashdmp crashdmp.sys Mon Jul 13 20:01:01 2009 (4A5BCABD)
fffff880`0280c000 fffff880`0282a000 dfsc dfsc.sys Mon Jul 13 19:23:44 2009 (4A5BC200)
fffff880`01739000 fffff880`0174f000 disk disk.sys Mon Jul 13 19:19:57 2009 (4A5BC11D)
fffff880`03957000 fffff880`03963000 dump_dumpata dump_dumpata.sys Mon Jul 13 19:19:47 2009 (4A5BC113)
fffff880`0396e000 fffff880`03981000 dump_dumpfve dump_dumpfve.sys Mon Jul 13 19:21:51 2009 (4A5BC18F)
fffff880`03963000 fffff880`0396e000 dump_msahci dump_msahci.sys Mon Jul 13 20:01:01 2009 (4A5BCABD)
fffff880`0393d000 fffff880`03949000 Dxapi Dxapi.sys Mon Jul 13 19:38:28 2009 (4A5BC574)
fffff960`00440000 fffff960`0045e000 dxg dxg.sys Mon Jul 13 19:38:28 2009 (4A5BC574)
fffff880`0116d000 fffff880`01181000 fileinfo fileinfo.sys Mon Jul 13 19:34:25 2009 (4A5BC481)
fffff880`01121000 fffff880`0116d000 fltmgr fltmgr.sys Mon Jul 13 19:19:59 2009 (4A5BC11F)
fffff960`00950000 fffff960`00959000 framebuf framebuf.dll unavailable (00000000)
fffff880`0122b000 fffff880`01235000 Fs_Rec Fs_Rec.sys Mon Jul 13 19:19:45 2009 (4A5BC111)
fffff880`02f4a000 fffff880`02f58000 ftusbrdload ftusbrdload.sys Tue Apr 13 10:40:06 2010 (4BC48246)
fffff880`016ff000 fffff880`01739000 fvevol fvevol.sys Fri Sep 25 22:34:26 2009 (4ABD7DB2)
fffff880`01635000 fffff880`0167f000 fwpkclnt fwpkclnt.sys Mon Jul 13 19:21:08 2009 (4A5BC164)
fffff880`03460000 fffff880`0346d000 GEARAspiWDM GEARAspiWDM.sys Mon May 18 08:17:04 2009 (4A1151C0)
fffff800`025df000 fffff800`02628000 hal hal.dll Mon Jul 13 21:27:36 2009 (4A5BDF08)
fffff880`02859000 fffff880`0287d000 HDAudBus HDAudBus.sys Mon Jul 13 20:06:13 2009 (4A5BCBF5)
fffff880`01412000 fffff880`0141b000 hwpolicy hwpolicy.sys Mon Jul 13 19:19:22 2009 (4A5BC0FA)
fffff880`03400000 fffff880`0341e000 i8042prt i8042prt.sys Mon Jul 13 19:19:57 2009 (4A5BC11D)
fffff880`0341e000 fffff880`0342d000 kbdclass kbdclass.sys Mon Jul 13 19:19:50 2009 (4A5BC116)
fffff800`00bad000 fffff800`00bb0000 kdcom kdcom.dll Tue Nov 30 09:40:39 2010 (4CF50CE7)
fffff880`03879000 fffff880`038bc000 ks ks.sys Wed Mar 03 23:32:25 2010 (4B8F37D9)
fffff880`01200000 fffff880`0121a000 ksecdd ksecdd.sys Mon Jul 13 19:20:54 2009 (4A5BC156)
fffff880`0158b000 fffff880`015b6000 ksecpkg ksecpkg.sys Fri Dec 11 01:03:32 2009 (4B21E0B4)
fffff880`00cdc000 fffff880`00d20000 mcupdate_GenuineIntel mcupdate_GenuineIntel.dll Mon Jul 13 21:29:10 2009 (4A5BDF66)
fffff880`0342f000 fffff880`0343e000 mouclass mouclass.sys Mon Jul 13 19:19:50 2009 (4A5BC116)
fffff880`00e7f000 fffff880`00e99000 mountmgr mountmgr.sys Mon Jul 13 19:19:54 2009 (4A5BC11A)
fffff880`010fb000 fffff880`01106000 msahci msahci.sys Mon Jul 13 20:01:01 2009 (4A5BCABD)
fffff880`01619000 fffff880`01624000 Msfs Msfs.SYS Mon Jul 13 19:19:47 2009 (4A5BC113)
fffff880`00fd8000 fffff880`00fe2000 msisadrv msisadrv.sys Mon Jul 13 19:19:26 2009 (4A5BC0FE)
fffff880`0118d000 fffff880`011eb000 msrpc msrpc.sys Mon Jul 13 19:21:32 2009 (4A5BC17C)
fffff880`02ff2000 fffff880`02ffd000 mssmbios mssmbios.sys Mon Jul 13 19:31:10 2009 (4A5BC3BE)
fffff880`01400000 fffff880`01412000 mup mup.sys Mon Jul 13 19:23:45 2009 (4A5BC201)
fffff880`01439000 fffff880`0152b000 ndis ndis.sys Mon Jul 13 19:21:40 2009 (4A5BC184)
fffff880`02e3a000 fffff880`02e46000 ndistapi ndistapi.sys Mon Jul 13 20:10:00 2009 (4A5BCCD8)
fffff880`03853000 fffff880`03866000 ndisuio ndisuio.sys Mon Jul 13 20:09:25 2009 (4A5BCCB5)
fffff880`02e46000 fffff880`02e75000 ndiswan ndiswan.sys Mon Jul 13 20:10:11 2009 (4A5BCCE3)
fffff880`03928000 fffff880`0393d000 NDProxy NDProxy.SYS Mon Jul 13 20:10:05 2009 (4A5BCCDD)
fffff880`0299a000 fffff880`029a9000 netbios netbios.sys Mon Jul 13 20:09:26 2009 (4A5BCCB6)
fffff880`02910000 fffff880`02955000 netbt netbt.sys Mon Jul 13 19:21:28 2009 (4A5BC178)
fffff880`0152b000 fffff880`0158b000 NETIO NETIO.SYS Mon Jul 13 19:21:46 2009 (4A5BC18A)
fffff880`01624000 fffff880`01635000 Npfs Npfs.SYS Mon Jul 13 19:19:48 2009 (4A5BC114)
fffff880`02800000 fffff880`0280c000 nsiproxy nsiproxy.sys Mon Jul 13 19:21:02 2009 (4A5BC15E)
fffff800`02003000 fffff800`025df000 nt ntkrnlmp.exe Sat Jun 19 00:16:41 2010 (4C1C44A9)
fffff880`01248000 fffff880`013eb000 Ntfs Ntfs.sys Mon Jul 13 19:20:47 2009 (4A5BC14F)
fffff880`017b7000 fffff880`017c0000 Null Null.SYS Mon Jul 13 19:19:37 2009 (4A5BC109)
fffff880`03800000 fffff880`03853000 nwifi nwifi.sys Mon Jul 13 20:07:23 2009 (4A5BCC3B)
fffff880`0295e000 fffff880`02984000 pacer pacer.sys Mon Jul 13 20:09:41 2009 (4A5BCCC5)
fffff880`00e40000 fffff880`00e55000 partmgr partmgr.sys Mon Jul 13 19:19:58 2009 (4A5BC11E)
fffff880`00e00000 fffff880`00e33000 pci pci.sys Mon Jul 13 19:19:51 2009 (4A5BC117)
fffff880`01106000 fffff880`01116000 PCIIDEX PCIIDEX.SYS Mon Jul 13 19:19:48 2009 (4A5BC114)
fffff880`0121a000 fffff880`0122b000 pcw pcw.sys Mon Jul 13 19:19:27 2009 (4A5BC0FF)
fffff880`00d20000 fffff880`00d34000 PSHED PSHED.dll Mon Jul 13 21:32:23 2009 (4A5BE027)
fffff880`01181000 fffff880`0118ce00 PxHlpa64 PxHlpa64.sys Tue Jun 23 19:16:35 2009 (4A416253)
fffff880`02e16000 fffff880`02e3a000 rasl2tp rasl2tp.sys Mon Jul 13 20:10:11 2009 (4A5BCCE3)
fffff880`02e75000 fffff880`02e90000 raspppoe raspppoe.sys Mon Jul 13 20:10:17 2009 (4A5BCCE9)
fffff880`02e90000 fffff880`02eb1000 raspptp raspptp.sys Mon Jul 13 20:10:18 2009 (4A5BCCEA)
fffff880`02eb1000 fffff880`02ecb000 rassstp rassstp.sys Mon Jul 13 20:10:25 2009 (4A5BCCF1)
fffff880`029a9000 fffff880`029fa000 rdbss rdbss.sys Mon Jul 13 19:24:09 2009 (4A5BC219)
fffff880`01610000 fffff880`01619000 rdpencdd rdpencdd.sys Mon Jul 13 20:16:34 2009 (4A5BCE62)
fffff880`015be000 fffff880`015f8000 rdyboost rdyboost.sys Mon Jul 13 19:34:34 2009 (4A5BC48A)
fffff880`037a9000 fffff880`03800000 Rt64win7 Rt64win7.sys Thu Mar 04 08:42:52 2010 (4B8FB8DC)
fffff880`016ca000 fffff880`016f9000 SCSIPORT SCSIPORT.SYS Mon Jul 13 20:01:04 2009 (4A5BCAC0)
fffff880`0346d000 fffff880`0346e480 swenum swenum.sys Mon Jul 13 20:00:18 2009 (4A5BCA92)
fffff880`02f58000 fffff880`02fa7000 SynTP SynTP.sys Thu Oct 29 20:19:12 2009 (4AEA3100)
fffff880`02c02000 fffff880`02dff000 tcpip tcpip.sys Sun Jun 13 23:39:04 2010 (4C15A458)
fffff880`0169d000 fffff880`016aa000 TDI TDI.SYS Mon Jul 13 19:21:18 2009 (4A5BC16E)
fffff880`0167f000 fffff880`0169d000 tdx tdx.sys Mon Jul 13 19:21:15 2009 (4A5BC16B)
fffff880`02ed4000 fffff880`02ee8000 termdd termdd.sys Mon Jul 13 20:16:36 2009 (4A5BCE64)
fffff960`006b0000 fffff960`006ba000 TSDDD TSDDD.dll Mon Jul 13 20:16:34 2009 (4A5BCE62)
fffff880`0282a000 fffff880`02850000 tunnel tunnel.sys Mon Jul 13 20:09:37 2009 (4A5BCCC1)
fffff880`038bc000 fffff880`038ce000 umbus umbus.sys Mon Jul 13 20:06:56 2009 (4A5BCC20)
fffff880`03981000 fffff880`0399e000 usbccgp usbccgp.sys Mon Jul 13 20:06:45 2009 (4A5BCC15)
fffff880`0342d000 fffff880`0342ef00 USBD USBD.SYS Mon Jul 13 20:06:23 2009 (4A5BCBFF)
fffff880`016aa000 fffff880`016bb000 usbehci usbehci.sys Mon Jul 13 20:06:30 2009 (4A5BCC06)
fffff880`038ce000 fffff880`03928000 usbhub usbhub.sys Mon Jul 13 20:07:09 2009 (4A5BCC2D)
fffff880`02ef4000 fffff880`02f4a000 USBPORT USBPORT.SYS Mon Jul 13 20:06:31 2009 (4A5BCC07)
fffff880`016bb000 fffff880`016ca000 VClone VClone.sys Sun Aug 09 17:25:45 2009 (4A7F3ED9)
fffff880`00e33000 fffff880`00e40000 vdrvroot vdrvroot.sys Mon Jul 13 20:01:31 2009 (4A5BCADB)
fffff880`017c7000 fffff880`017d5000 vga vga.sys Mon Jul 13 19:38:47 2009 (4A5BC587)
fffff880`017d5000 fffff880`017fa000 VIDEOPRT VIDEOPRT.SYS Mon Jul 13 19:38:51 2009 (4A5BC58B)
fffff880`00e6a000 fffff880`00e7f000 volmgr volmgr.sys Mon Jul 13 19:19:57 2009 (4A5BC11D)
fffff880`00d92000 fffff880`00dee000 volmgrx volmgrx.sys Mon Jul 13 19:20:33 2009 (4A5BC141)
fffff880`01073000 fffff880`010bf000 volsnap volsnap.sys Mon Jul 13 19:20:08 2009 (4A5BC128)
fffff880`0375e000 fffff880`0376b000 vwifibus vwifibus.sys Mon Jul 13 20:07:21 2009 (4A5BCC39)
fffff880`02984000 fffff880`0299a000 vwififlt vwififlt.sys Mon Jul 13 20:07:22 2009 (4A5BCC3A)
fffff880`01600000 fffff880`01610000 watchdog watchdog.sys Mon Jul 13 19:37:35 2009 (4A5BC53F)
fffff880`00ec5000 fffff880`00f69000 Wdf01000 Wdf01000.sys Mon Jul 13 19:22:07 2009 (4A5BC19F)
fffff880`00f69000 fffff880`00f78000 WDFLDR WDFLDR.SYS Mon Jul 13 19:19:54 2009 (4A5BC11A)
fffff880`02955000 fffff880`0295e000 wfplwf wfplwf.sys Mon Jul 13 20:09:26 2009 (4A5BCCB6)
fffff960`00010000 fffff960`0031f000 win32k win32k.sys Tue Aug 31 22:58:04 2010 (4C7DC13C)
fffff880`02850000 fffff880`02859000 wmiacpi wmiacpi.sys Mon Jul 13 19:31:02 2009 (4A5BC3B6)
fffff880`00fcf000 fffff880`00fd8000 WMILIB WMILIB.SYS Mon Jul 13 19:19:51 2009 (4A5BC117)
fffff880`0399e000 fffff880`039bf000 WudfPf WudfPf.sys Mon Jul 13 20:05:37 2009 (4A5BCBD1)
Unloaded modules:
fffff880`0177f000 fffff880`0178d000 crashdmp.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 0000E000
fffff880`0178d000 fffff880`01799000 dump_pciidex
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 0000C000
fffff880`01799000 fffff880`017a4000 dump_msahci.
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 0000B000
fffff880`017a4000 fffff880`017b7000 dump_dumpfve
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 00013000
fffff880`015b6000 fffff880`015be000 spldr.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 00008000