API tools faq
paste
Advertisement
Guest User

Untitled

a guest
Sep 23rd, 2017
278
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 246.68 KB | None | 0 0
raw download clone embed print report
  1.  
  2.  
  3. Microsoft (R) Windows Debugger Version 10.0.15063.468 AMD64
  4. Copyright (c) Microsoft Corporation. All rights reserved.
  5.  
  6.  
  7. Loading Dump File [B:\d\092217-14734-01.dmp]
  8. Mini Kernel Dump File: Only registers and stack trace are available
  9.  
  10.  
  11.  
  12. ************* Symbol Path validation summary **************
  13. Response Time (ms) Location
  14. Deferred srv*c:\symbols*http://msdl.microsoft.com/download/symbols
  15. Symbol search path is: srv*c:\symbols*http://msdl.microsoft.com/download/symbols
  16. Executable search path is:
  17. Unable to load image \SystemRoot\system32\ntoskrnl.exe, Win32 error 0n2
  18. *** WARNING: Unable to verify timestamp for ntoskrnl.exe
  19. *** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
  20. Windows 10 Kernel Version 16294 MP (16 procs) Free x64
  21. Product: WinNt, suite: TerminalServer SingleUserTS
  22. Built by: 16294.1.amd64fre.rs3_release.170916-2023
  23. Machine Name:
  24. Kernel base = 0xfffff800`2c087000 PsLoadedModuleList = 0xfffff800`2c3e8fb0
  25. Debug session time: Fri Sep 22 20:37:01.519 2017 (UTC + 1:00)
  26. System Uptime: 0 days 20:22:07.225
  27. Unable to load image \SystemRoot\system32\ntoskrnl.exe, Win32 error 0n2
  28. *** WARNING: Unable to verify timestamp for ntoskrnl.exe
  29. *** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
  30. Loading Kernel Symbols
  31. ...............................................................
  32. ................................................................
  33. ................................................................
  34. ...............................
  35. Loading User Symbols
  36. Loading unloaded module list
  37. ............................................
  38.  
  39. ************* Symbol Loading Error Summary **************
  40. Module name Error
  41. ntoskrnl The system cannot find the file specified
  42.  
  43. You can troubleshoot most symbol related issues by turning on symbol loading diagnostics (!sym noisy) and repeating the command that caused symbols to be loaded.
  44. You should also verify that your symbol search path (.sympath) is correct.
  45. *******************************************************************************
  46. * *
  47. * Bugcheck Analysis *
  48. * *
  49. *******************************************************************************
  50.  
  51. Use !analyze -v to get detailed debugging information.
  52.  
  53. BugCheck 9F, {3, ffff850ca8da5060, ffff8308022378f0, ffff850ca82b2640}
  54.  
  55. ***** Kernel symbols are WRONG. Please fix symbols to do analysis.
  56.  
  57. *************************************************************************
  58. *** ***
  59. *** ***
  60. *** Either you specified an unqualified symbol, or your debugger ***
  61. *** doesn't have full symbol information. Unqualified symbol ***
  62. *** resolution is turned off by default. Please either specify a ***
  63. *** fully qualified symbol module!symbolname, or enable resolution ***
  64. *** of unqualified symbols by typing ".symopt- 100". Note that ***
  65. *** enabling unqualified symbol resolution with network symbol ***
  66. *** server shares in the symbol path may cause the debugger to ***
  67. *** appear to hang for long periods of time when an incorrect ***
  68. *** symbol name is typed or the network symbol server is down. ***
  69. *** ***
  70. *** For some commands to work properly, your symbol path ***
  71. *** must point to .pdb files that have full type information. ***
  72. *** ***
  73. *** Certain .pdb files (such as the public OS symbols) do not ***
  74. *** contain the required information. Contact the group that ***
  75. *** provided you with these symbols if you need this command to ***
  76. *** work. ***
  77. *** ***
  78. *** Type referenced: NT!_DEVICE_OBJECT ***
  79. *** ***
  80. *************************************************************************
  81. *************************************************************************
  82. *** ***
  83. *** ***
  84. *** Either you specified an unqualified symbol, or your debugger ***
  85. *** doesn't have full symbol information. Unqualified symbol ***
  86. *** resolution is turned off by default. Please either specify a ***
  87. *** fully qualified symbol module!symbolname, or enable resolution ***
  88. *** of unqualified symbols by typing ".symopt- 100". Note that ***
  89. *** enabling unqualified symbol resolution with network symbol ***
  90. *** server shares in the symbol path may cause the debugger to ***
  91. *** appear to hang for long periods of time when an incorrect ***
  92. *** symbol name is typed or the network symbol server is down. ***
  93. *** ***
  94. *** For some commands to work properly, your symbol path ***
  95. *** must point to .pdb files that have full type information. ***
  96. *** ***
  97. *** Certain .pdb files (such as the public OS symbols) do not ***
  98. *** contain the required information. Contact the group that ***
  99. *** provided you with these symbols if you need this command to ***
  100. *** work. ***
  101. *** ***
  102. *** Type referenced: nt!_IRP ***
  103. *** ***
  104. *************************************************************************
  105. *************************************************************************
  106. *** ***
  107. *** ***
  108. *** Either you specified an unqualified symbol, or your debugger ***
  109. *** doesn't have full symbol information. Unqualified symbol ***
  110. *** resolution is turned off by default. Please either specify a ***
  111. *** fully qualified symbol module!symbolname, or enable resolution ***
  112. *** of unqualified symbols by typing ".symopt- 100". Note that ***
  113. *** enabling unqualified symbol resolution with network symbol ***
  114. *** server shares in the symbol path may cause the debugger to ***
  115. *** appear to hang for long periods of time when an incorrect ***
  116. *** symbol name is typed or the network symbol server is down. ***
  117. *** ***
  118. *** For some commands to work properly, your symbol path ***
  119. *** must point to .pdb files that have full type information. ***
  120. *** ***
  121. *** Certain .pdb files (such as the public OS symbols) do not ***
  122. *** contain the required information. Contact the group that ***
  123. *** provided you with these symbols if you need this command to ***
  124. *** work. ***
  125. *** ***
  126. *** Type referenced: nt!_IRP ***
  127. *** ***
  128. *************************************************************************
  129. *************************************************************************
  130. *** ***
  131. *** ***
  132. *** Either you specified an unqualified symbol, or your debugger ***
  133. *** doesn't have full symbol information. Unqualified symbol ***
  134. *** resolution is turned off by default. Please either specify a ***
  135. *** fully qualified symbol module!symbolname, or enable resolution ***
  136. *** of unqualified symbols by typing ".symopt- 100". Note that ***
  137. *** enabling unqualified symbol resolution with network symbol ***
  138. *** server shares in the symbol path may cause the debugger to ***
  139. *** appear to hang for long periods of time when an incorrect ***
  140. *** symbol name is typed or the network symbol server is down. ***
  141. *** ***
  142. *** For some commands to work properly, your symbol path ***
  143. *** must point to .pdb files that have full type information. ***
  144. *** ***
  145. *** Certain .pdb files (such as the public OS symbols) do not ***
  146. *** contain the required information. Contact the group that ***
  147. *** provided you with these symbols if you need this command to ***
  148. *** work. ***
  149. *** ***
  150. *** Type referenced: nt!_TRIAGE_9F_POWER ***
  151. *** ***
  152. *************************************************************************
  153. *************************************************************************
  154. *** ***
  155. *** ***
  156. *** Either you specified an unqualified symbol, or your debugger ***
  157. *** doesn't have full symbol information. Unqualified symbol ***
  158. *** resolution is turned off by default. Please either specify a ***
  159. *** fully qualified symbol module!symbolname, or enable resolution ***
  160. *** of unqualified symbols by typing ".symopt- 100". Note that ***
  161. *** enabling unqualified symbol resolution with network symbol ***
  162. *** server shares in the symbol path may cause the debugger to ***
  163. *** appear to hang for long periods of time when an incorrect ***
  164. *** symbol name is typed or the network symbol server is down. ***
  165. *** ***
  166. *** For some commands to work properly, your symbol path ***
  167. *** must point to .pdb files that have full type information. ***
  168. *** ***
  169. *** Certain .pdb files (such as the public OS symbols) do not ***
  170. *** contain the required information. Contact the group that ***
  171. *** provided you with these symbols if you need this command to ***
  172. *** work. ***
  173. *** ***
  174. *** Type referenced: nt!_IRP ***
  175. *** ***
  176. *************************************************************************
  177. *************************************************************************
  178. *** ***
  179. *** ***
  180. *** Either you specified an unqualified symbol, or your debugger ***
  181. *** doesn't have full symbol information. Unqualified symbol ***
  182. *** resolution is turned off by default. Please either specify a ***
  183. *** fully qualified symbol module!symbolname, or enable resolution ***
  184. *** of unqualified symbols by typing ".symopt- 100". Note that ***
  185. *** enabling unqualified symbol resolution with network symbol ***
  186. *** server shares in the symbol path may cause the debugger to ***
  187. *** appear to hang for long periods of time when an incorrect ***
  188. *** symbol name is typed or the network symbol server is down. ***
  189. *** ***
  190. *** For some commands to work properly, your symbol path ***
  191. *** must point to .pdb files that have full type information. ***
  192. *** ***
  193. *** Certain .pdb files (such as the public OS symbols) do not ***
  194. *** contain the required information. Contact the group that ***
  195. *** provided you with these symbols if you need this command to ***
  196. *** work. ***
  197. *** ***
  198. *** Type referenced: nt!_IO_STACK_LOCATION ***
  199. *** ***
  200. *************************************************************************
  201. *************************************************************************
  202. *** ***
  203. *** ***
  204. *** Either you specified an unqualified symbol, or your debugger ***
  205. *** doesn't have full symbol information. Unqualified symbol ***
  206. *** resolution is turned off by default. Please either specify a ***
  207. *** fully qualified symbol module!symbolname, or enable resolution ***
  208. *** of unqualified symbols by typing ".symopt- 100". Note that ***
  209. *** enabling unqualified symbol resolution with network symbol ***
  210. *** server shares in the symbol path may cause the debugger to ***
  211. *** appear to hang for long periods of time when an incorrect ***
  212. *** symbol name is typed or the network symbol server is down. ***
  213. *** ***
  214. *** For some commands to work properly, your symbol path ***
  215. *** must point to .pdb files that have full type information. ***
  216. *** ***
  217. *** Certain .pdb files (such as the public OS symbols) do not ***
  218. *** contain the required information. Contact the group that ***
  219. *** provided you with these symbols if you need this command to ***
  220. *** work. ***
  221. *** ***
  222. *** Type referenced: nt!_IRP ***
  223. *** ***
  224. *************************************************************************
  225. *************************************************************************
  226. *** ***
  227. *** ***
  228. *** Either you specified an unqualified symbol, or your debugger ***
  229. *** doesn't have full symbol information. Unqualified symbol ***
  230. *** resolution is turned off by default. Please either specify a ***
  231. *** fully qualified symbol module!symbolname, or enable resolution ***
  232. *** of unqualified symbols by typing ".symopt- 100". Note that ***
  233. *** enabling unqualified symbol resolution with network symbol ***
  234. *** server shares in the symbol path may cause the debugger to ***
  235. *** appear to hang for long periods of time when an incorrect ***
  236. *** symbol name is typed or the network symbol server is down. ***
  237. *** ***
  238. *** For some commands to work properly, your symbol path ***
  239. *** must point to .pdb files that have full type information. ***
  240. *** ***
  241. *** Certain .pdb files (such as the public OS symbols) do not ***
  242. *** contain the required information. Contact the group that ***
  243. *** provided you with these symbols if you need this command to ***
  244. *** work. ***
  245. *** ***
  246. *** Type referenced: nt!_DEVICE_OBJECT ***
  247. *** ***
  248. *************************************************************************
  249. *************************************************************************
  250. *** ***
  251. *** ***
  252. *** Either you specified an unqualified symbol, or your debugger ***
  253. *** doesn't have full symbol information. Unqualified symbol ***
  254. *** resolution is turned off by default. Please either specify a ***
  255. *** fully qualified symbol module!symbolname, or enable resolution ***
  256. *** of unqualified symbols by typing ".symopt- 100". Note that ***
  257. *** enabling unqualified symbol resolution with network symbol ***
  258. *** server shares in the symbol path may cause the debugger to ***
  259. *** appear to hang for long periods of time when an incorrect ***
  260. *** symbol name is typed or the network symbol server is down. ***
  261. *** ***
  262. *** For some commands to work properly, your symbol path ***
  263. *** must point to .pdb files that have full type information. ***
  264. *** ***
  265. *** Certain .pdb files (such as the public OS symbols) do not ***
  266. *** contain the required information. Contact the group that ***
  267. *** provided you with these symbols if you need this command to ***
  268. *** work. ***
  269. *** ***
  270. *** Type referenced: nt!_EPROCESS ***
  271. *** ***
  272. *************************************************************************
  273. *************************************************************************
  274. *** ***
  275. *** ***
  276. *** Either you specified an unqualified symbol, or your debugger ***
  277. *** doesn't have full symbol information. Unqualified symbol ***
  278. *** resolution is turned off by default. Please either specify a ***
  279. *** fully qualified symbol module!symbolname, or enable resolution ***
  280. *** of unqualified symbols by typing ".symopt- 100". Note that ***
  281. *** enabling unqualified symbol resolution with network symbol ***
  282. *** server shares in the symbol path may cause the debugger to ***
  283. *** appear to hang for long periods of time when an incorrect ***
  284. *** symbol name is typed or the network symbol server is down. ***
  285. *** ***
  286. *** For some commands to work properly, your symbol path ***
  287. *** must point to .pdb files that have full type information. ***
  288. *** ***
  289. *** Certain .pdb files (such as the public OS symbols) do not ***
  290. *** contain the required information. Contact the group that ***
  291. *** provided you with these symbols if you need this command to ***
  292. *** work. ***
  293. *** ***
  294. *** Type referenced: nt!_KPRCB ***
  295. *** ***
  296. *************************************************************************
  297. *************************************************************************
  298. *** ***
  299. *** ***
  300. *** Either you specified an unqualified symbol, or your debugger ***
  301. *** doesn't have full symbol information. Unqualified symbol ***
  302. *** resolution is turned off by default. Please either specify a ***
  303. *** fully qualified symbol module!symbolname, or enable resolution ***
  304. *** of unqualified symbols by typing ".symopt- 100". Note that ***
  305. *** enabling unqualified symbol resolution with network symbol ***
  306. *** server shares in the symbol path may cause the debugger to ***
  307. *** appear to hang for long periods of time when an incorrect ***
  308. *** symbol name is typed or the network symbol server is down. ***
  309. *** ***
  310. *** For some commands to work properly, your symbol path ***
  311. *** must point to .pdb files that have full type information. ***
  312. *** ***
  313. *** Certain .pdb files (such as the public OS symbols) do not ***
  314. *** contain the required information. Contact the group that ***
  315. *** provided you with these symbols if you need this command to ***
  316. *** work. ***
  317. *** ***
  318. *** Type referenced: nt!_IRP ***
  319. *** ***
  320. *************************************************************************
  321. *************************************************************************
  322. *** ***
  323. *** ***
  324. *** Either you specified an unqualified symbol, or your debugger ***
  325. *** doesn't have full symbol information. Unqualified symbol ***
  326. *** resolution is turned off by default. Please either specify a ***
  327. *** fully qualified symbol module!symbolname, or enable resolution ***
  328. *** of unqualified symbols by typing ".symopt- 100". Note that ***
  329. *** enabling unqualified symbol resolution with network symbol ***
  330. *** server shares in the symbol path may cause the debugger to ***
  331. *** appear to hang for long periods of time when an incorrect ***
  332. *** symbol name is typed or the network symbol server is down. ***
  333. *** ***
  334. *** For some commands to work properly, your symbol path ***
  335. *** must point to .pdb files that have full type information. ***
  336. *** ***
  337. *** Certain .pdb files (such as the public OS symbols) do not ***
  338. *** contain the required information. Contact the group that ***
  339. *** provided you with these symbols if you need this command to ***
  340. *** work. ***
  341. *** ***
  342. *** Type referenced: nt!_KPRCB ***
  343. *** ***
  344. *************************************************************************
  345. *************************************************************************
  346. *** ***
  347. *** ***
  348. *** Either you specified an unqualified symbol, or your debugger ***
  349. *** doesn't have full symbol information. Unqualified symbol ***
  350. *** resolution is turned off by default. Please either specify a ***
  351. *** fully qualified symbol module!symbolname, or enable resolution ***
  352. *** of unqualified symbols by typing ".symopt- 100". Note that ***
  353. *** enabling unqualified symbol resolution with network symbol ***
  354. *** server shares in the symbol path may cause the debugger to ***
  355. *** appear to hang for long periods of time when an incorrect ***
  356. *** symbol name is typed or the network symbol server is down. ***
  357. *** ***
  358. *** For some commands to work properly, your symbol path ***
  359. *** must point to .pdb files that have full type information. ***
  360. *** ***
  361. *** Certain .pdb files (such as the public OS symbols) do not ***
  362. *** contain the required information. Contact the group that ***
  363. *** provided you with these symbols if you need this command to ***
  364. *** work. ***
  365. *** ***
  366. *** Type referenced: nt!_KPRCB ***
  367. *** ***
  368. *************************************************************************
  369. *************************************************************************
  370. *** ***
  371. *** ***
  372. *** Either you specified an unqualified symbol, or your debugger ***
  373. *** doesn't have full symbol information. Unqualified symbol ***
  374. *** resolution is turned off by default. Please either specify a ***
  375. *** fully qualified symbol module!symbolname, or enable resolution ***
  376. *** of unqualified symbols by typing ".symopt- 100". Note that ***
  377. *** enabling unqualified symbol resolution with network symbol ***
  378. *** server shares in the symbol path may cause the debugger to ***
  379. *** appear to hang for long periods of time when an incorrect ***
  380. *** symbol name is typed or the network symbol server is down. ***
  381. *** ***
  382. *** For some commands to work properly, your symbol path ***
  383. *** must point to .pdb files that have full type information. ***
  384. *** ***
  385. *** Certain .pdb files (such as the public OS symbols) do not ***
  386. *** contain the required information. Contact the group that ***
  387. *** provided you with these symbols if you need this command to ***
  388. *** work. ***
  389. *** ***
  390. *** Type referenced: nt!_KPRCB ***
  391. *** ***
  392. *************************************************************************
  393. *************************************************************************
  394. *** ***
  395. *** ***
  396. *** Either you specified an unqualified symbol, or your debugger ***
  397. *** doesn't have full symbol information. Unqualified symbol ***
  398. *** resolution is turned off by default. Please either specify a ***
  399. *** fully qualified symbol module!symbolname, or enable resolution ***
  400. *** of unqualified symbols by typing ".symopt- 100". Note that ***
  401. *** enabling unqualified symbol resolution with network symbol ***
  402. *** server shares in the symbol path may cause the debugger to ***
  403. *** appear to hang for long periods of time when an incorrect ***
  404. *** symbol name is typed or the network symbol server is down. ***
  405. *** ***
  406. *** For some commands to work properly, your symbol path ***
  407. *** must point to .pdb files that have full type information. ***
  408. *** ***
  409. *** Certain .pdb files (such as the public OS symbols) do not ***
  410. *** contain the required information. Contact the group that ***
  411. *** provided you with these symbols if you need this command to ***
  412. *** work. ***
  413. *** ***
  414. *** Type referenced: nt!_KTHREAD ***
  415. *** ***
  416. *************************************************************************
  417. *************************************************************************
  418. *** ***
  419. *** ***
  420. *** Either you specified an unqualified symbol, or your debugger ***
  421. *** doesn't have full symbol information. Unqualified symbol ***
  422. *** resolution is turned off by default. Please either specify a ***
  423. *** fully qualified symbol module!symbolname, or enable resolution ***
  424. *** of unqualified symbols by typing ".symopt- 100". Note that ***
  425. *** enabling unqualified symbol resolution with network symbol ***
  426. *** server shares in the symbol path may cause the debugger to ***
  427. *** appear to hang for long periods of time when an incorrect ***
  428. *** symbol name is typed or the network symbol server is down. ***
  429. *** ***
  430. *** For some commands to work properly, your symbol path ***
  431. *** must point to .pdb files that have full type information. ***
  432. *** ***
  433. *** Certain .pdb files (such as the public OS symbols) do not ***
  434. *** contain the required information. Contact the group that ***
  435. *** provided you with these symbols if you need this command to ***
  436. *** work. ***
  437. *** ***
  438. *** Type referenced: nt!_KPRCB ***
  439. *** ***
  440. *************************************************************************
  441. *************************************************************************
  442. *** ***
  443. *** ***
  444. *** Either you specified an unqualified symbol, or your debugger ***
  445. *** doesn't have full symbol information. Unqualified symbol ***
  446. *** resolution is turned off by default. Please either specify a ***
  447. *** fully qualified symbol module!symbolname, or enable resolution ***
  448. *** of unqualified symbols by typing ".symopt- 100". Note that ***
  449. *** enabling unqualified symbol resolution with network symbol ***
  450. *** server shares in the symbol path may cause the debugger to ***
  451. *** appear to hang for long periods of time when an incorrect ***
  452. *** symbol name is typed or the network symbol server is down. ***
  453. *** ***
  454. *** For some commands to work properly, your symbol path ***
  455. *** must point to .pdb files that have full type information. ***
  456. *** ***
  457. *** Certain .pdb files (such as the public OS symbols) do not ***
  458. *** contain the required information. Contact the group that ***
  459. *** provided you with these symbols if you need this command to ***
  460. *** work. ***
  461. *** ***
  462. *** Type referenced: nt!_KPRCB ***
  463. *** ***
  464. *************************************************************************
  465. Probably caused by : ntoskrnl.wrong.symbols.exe ( nt_wrong_symbols!59BE13EC8D2000 )
  466.  
  467. Followup: MachineOwner
  468. ---------
  469.  
  470. 2: kd> .logclose
  471. Closing open log file C:\Users\Raymond\AppData\Local\msdart_crashanalyzer_kd_ansi.log
  472. Opened log file 'C:\Users\Raymond\AppData\Local\msdart_crashanalyzer_kd_unicode.log'
  473. 2: kd> !analyze -v
  474. *******************************************************************************
  475. * *
  476. * Bugcheck Analysis *
  477. * *
  478. *******************************************************************************
  479.  
  480. DRIVER_POWER_STATE_FAILURE (9f)
  481. A driver has failed to complete a power IRP within a specific time.
  482. Arguments:
  483. Arg1: 0000000000000003, A device object has been blocking an Irp for too long a time
  484. Arg2: ffff850ca8da5060, Physical Device Object of the stack
  485. Arg3: ffff8308022378f0, nt!TRIAGE_9F_POWER on Win7 and higher, otherwise the Functional Device Object of the stack
  486. Arg4: ffff850ca82b2640, The blocked IRP
  487.  
  488. Debugging Details:
  489. ------------------
  490.  
  491. ***** Kernel symbols are WRONG. Please fix symbols to do analysis.
  492.  
  493. *************************************************************************
  494. *** ***
  495. *** ***
  496. *** Either you specified an unqualified symbol, or your debugger ***
  497. *** doesn't have full symbol information. Unqualified symbol ***
  498. *** resolution is turned off by default. Please either specify a ***
  499. *** fully qualified symbol module!symbolname, or enable resolution ***
  500. *** of unqualified symbols by typing ".symopt- 100". Note that ***
  501. *** enabling unqualified symbol resolution with network symbol ***
  502. *** server shares in the symbol path may cause the debugger to ***
  503. *** appear to hang for long periods of time when an incorrect ***
  504. *** symbol name is typed or the network symbol server is down. ***
  505. *** ***
  506. *** For some commands to work properly, your symbol path ***
  507. *** must point to .pdb files that have full type information. ***
  508. *** ***
  509. *** Certain .pdb files (such as the public OS symbols) do not ***
  510. *** contain the required information. Contact the group that ***
  511. *** provided you with these symbols if you need this command to ***
  512. *** work. ***
  513. *** ***
  514. *** Type referenced: NT!_DEVICE_OBJECT ***
  515. *** ***
  516. *************************************************************************
  517. *************************************************************************
  518. *** ***
  519. *** ***
  520. *** Either you specified an unqualified symbol, or your debugger ***
  521. *** doesn't have full symbol information. Unqualified symbol ***
  522. *** resolution is turned off by default. Please either specify a ***
  523. *** fully qualified symbol module!symbolname, or enable resolution ***
  524. *** of unqualified symbols by typing ".symopt- 100". Note that ***
  525. *** enabling unqualified symbol resolution with network symbol ***
  526. *** server shares in the symbol path may cause the debugger to ***
  527. *** appear to hang for long periods of time when an incorrect ***
  528. *** symbol name is typed or the network symbol server is down. ***
  529. *** ***
  530. *** For some commands to work properly, your symbol path ***
  531. *** must point to .pdb files that have full type information. ***
  532. *** ***
  533. *** Certain .pdb files (such as the public OS symbols) do not ***
  534. *** contain the required information. Contact the group that ***
  535. *** provided you with these symbols if you need this command to ***
  536. *** work. ***
  537. *** ***
  538. *** Type referenced: nt!_IRP ***
  539. *** ***
  540. *************************************************************************
  541. *************************************************************************
  542. *** ***
  543. *** ***
  544. *** Either you specified an unqualified symbol, or your debugger ***
  545. *** doesn't have full symbol information. Unqualified symbol ***
  546. *** resolution is turned off by default. Please either specify a ***
  547. *** fully qualified symbol module!symbolname, or enable resolution ***
  548. *** of unqualified symbols by typing ".symopt- 100". Note that ***
  549. *** enabling unqualified symbol resolution with network symbol ***
  550. *** server shares in the symbol path may cause the debugger to ***
  551. *** appear to hang for long periods of time when an incorrect ***
  552. *** symbol name is typed or the network symbol server is down. ***
  553. *** ***
  554. *** For some commands to work properly, your symbol path ***
  555. *** must point to .pdb files that have full type information. ***
  556. *** ***
  557. *** Certain .pdb files (such as the public OS symbols) do not ***
  558. *** contain the required information. Contact the group that ***
  559. *** provided you with these symbols if you need this command to ***
  560. *** work. ***
  561. *** ***
  562. *** Type referenced: nt!_IRP ***
  563. *** ***
  564. *************************************************************************
  565. *************************************************************************
  566. *** ***
  567. *** ***
  568. *** Either you specified an unqualified symbol, or your debugger ***
  569. *** doesn't have full symbol information. Unqualified symbol ***
  570. *** resolution is turned off by default. Please either specify a ***
  571. *** fully qualified symbol module!symbolname, or enable resolution ***
  572. *** of unqualified symbols by typing ".symopt- 100". Note that ***
  573. *** enabling unqualified symbol resolution with network symbol ***
  574. *** server shares in the symbol path may cause the debugger to ***
  575. *** appear to hang for long periods of time when an incorrect ***
  576. *** symbol name is typed or the network symbol server is down. ***
  577. *** ***
  578. *** For some commands to work properly, your symbol path ***
  579. *** must point to .pdb files that have full type information. ***
  580. *** ***
  581. *** Certain .pdb files (such as the public OS symbols) do not ***
  582. *** contain the required information. Contact the group that ***
  583. *** provided you with these symbols if you need this command to ***
  584. *** work. ***
  585. *** ***
  586. *** Type referenced: nt!_TRIAGE_9F_POWER ***
  587. *** ***
  588. *************************************************************************
  589. *************************************************************************
  590. *** ***
  591. *** ***
  592. *** Either you specified an unqualified symbol, or your debugger ***
  593. *** doesn't have full symbol information. Unqualified symbol ***
  594. *** resolution is turned off by default. Please either specify a ***
  595. *** fully qualified symbol module!symbolname, or enable resolution ***
  596. *** of unqualified symbols by typing ".symopt- 100". Note that ***
  597. *** enabling unqualified symbol resolution with network symbol ***
  598. *** server shares in the symbol path may cause the debugger to ***
  599. *** appear to hang for long periods of time when an incorrect ***
  600. *** symbol name is typed or the network symbol server is down. ***
  601. *** ***
  602. *** For some commands to work properly, your symbol path ***
  603. *** must point to .pdb files that have full type information. ***
  604. *** ***
  605. *** Certain .pdb files (such as the public OS symbols) do not ***
  606. *** contain the required information. Contact the group that ***
  607. *** provided you with these symbols if you need this command to ***
  608. *** work. ***
  609. *** ***
  610. *** Type referenced: nt!_IRP ***
  611. *** ***
  612. *************************************************************************
  613. *************************************************************************
  614. *** ***
  615. *** ***
  616. *** Either you specified an unqualified symbol, or your debugger ***
  617. *** doesn't have full symbol information. Unqualified symbol ***
  618. *** resolution is turned off by default. Please either specify a ***
  619. *** fully qualified symbol module!symbolname, or enable resolution ***
  620. *** of unqualified symbols by typing ".symopt- 100". Note that ***
  621. *** enabling unqualified symbol resolution with network symbol ***
  622. *** server shares in the symbol path may cause the debugger to ***
  623. *** appear to hang for long periods of time when an incorrect ***
  624. *** symbol name is typed or the network symbol server is down. ***
  625. *** ***
  626. *** For some commands to work properly, your symbol path ***
  627. *** must point to .pdb files that have full type information. ***
  628. *** ***
  629. *** Certain .pdb files (such as the public OS symbols) do not ***
  630. *** contain the required information. Contact the group that ***
  631. *** provided you with these symbols if you need this command to ***
  632. *** work. ***
  633. *** ***
  634. *** Type referenced: nt!_IO_STACK_LOCATION ***
  635. *** ***
  636. *************************************************************************
  637. *************************************************************************
  638. *** ***
  639. *** ***
  640. *** Either you specified an unqualified symbol, or your debugger ***
  641. *** doesn't have full symbol information. Unqualified symbol ***
  642. *** resolution is turned off by default. Please either specify a ***
  643. *** fully qualified symbol module!symbolname, or enable resolution ***
  644. *** of unqualified symbols by typing ".symopt- 100". Note that ***
  645. *** enabling unqualified symbol resolution with network symbol ***
  646. *** server shares in the symbol path may cause the debugger to ***
  647. *** appear to hang for long periods of time when an incorrect ***
  648. *** symbol name is typed or the network symbol server is down. ***
  649. *** ***
  650. *** For some commands to work properly, your symbol path ***
  651. *** must point to .pdb files that have full type information. ***
  652. *** ***
  653. *** Certain .pdb files (such as the public OS symbols) do not ***
  654. *** contain the required information. Contact the group that ***
  655. *** provided you with these symbols if you need this command to ***
  656. *** work. ***
  657. *** ***
  658. *** Type referenced: nt!_IRP ***
  659. *** ***
  660. *************************************************************************
  661. *************************************************************************
  662. *** ***
  663. *** ***
  664. *** Either you specified an unqualified symbol, or your debugger ***
  665. *** doesn't have full symbol information. Unqualified symbol ***
  666. *** resolution is turned off by default. Please either specify a ***
  667. *** fully qualified symbol module!symbolname, or enable resolution ***
  668. *** of unqualified symbols by typing ".symopt- 100". Note that ***
  669. *** enabling unqualified symbol resolution with network symbol ***
  670. *** server shares in the symbol path may cause the debugger to ***
  671. *** appear to hang for long periods of time when an incorrect ***
  672. *** symbol name is typed or the network symbol server is down. ***
  673. *** ***
  674. *** For some commands to work properly, your symbol path ***
  675. *** must point to .pdb files that have full type information. ***
  676. *** ***
  677. *** Certain .pdb files (such as the public OS symbols) do not ***
  678. *** contain the required information. Contact the group that ***
  679. *** provided you with these symbols if you need this command to ***
  680. *** work. ***
  681. *** ***
  682. *** Type referenced: nt!_DEVICE_OBJECT ***
  683. *** ***
  684. *************************************************************************
  685. *************************************************************************
  686. *** ***
  687. *** ***
  688. *** Either you specified an unqualified symbol, or your debugger ***
  689. *** doesn't have full symbol information. Unqualified symbol ***
  690. *** resolution is turned off by default. Please either specify a ***
  691. *** fully qualified symbol module!symbolname, or enable resolution ***
  692. *** of unqualified symbols by typing ".symopt- 100". Note that ***
  693. *** enabling unqualified symbol resolution with network symbol ***
  694. *** server shares in the symbol path may cause the debugger to ***
  695. *** appear to hang for long periods of time when an incorrect ***
  696. *** symbol name is typed or the network symbol server is down. ***
  697. *** ***
  698. *** For some commands to work properly, your symbol path ***
  699. *** must point to .pdb files that have full type information. ***
  700. *** ***
  701. *** Certain .pdb files (such as the public OS symbols) do not ***
  702. *** contain the required information. Contact the group that ***
  703. *** provided you with these symbols if you need this command to ***
  704. *** work. ***
  705. *** ***
  706. *** Type referenced: nt!_EPROCESS ***
  707. *** ***
  708. *************************************************************************
  709. *************************************************************************
  710. *** ***
  711. *** ***
  712. *** Either you specified an unqualified symbol, or your debugger ***
  713. *** doesn't have full symbol information. Unqualified symbol ***
  714. *** resolution is turned off by default. Please either specify a ***
  715. *** fully qualified symbol module!symbolname, or enable resolution ***
  716. *** of unqualified symbols by typing ".symopt- 100". Note that ***
  717. *** enabling unqualified symbol resolution with network symbol ***
  718. *** server shares in the symbol path may cause the debugger to ***
  719. *** appear to hang for long periods of time when an incorrect ***
  720. *** symbol name is typed or the network symbol server is down. ***
  721. *** ***
  722. *** For some commands to work properly, your symbol path ***
  723. *** must point to .pdb files that have full type information. ***
  724. *** ***
  725. *** Certain .pdb files (such as the public OS symbols) do not ***
  726. *** contain the required information. Contact the group that ***
  727. *** provided you with these symbols if you need this command to ***
  728. *** work. ***
  729. *** ***
  730. *** Type referenced: nt!_KPRCB ***
  731. *** ***
  732. *************************************************************************
  733. *************************************************************************
  734. *** ***
  735. *** ***
  736. *** Either you specified an unqualified symbol, or your debugger ***
  737. *** doesn't have full symbol information. Unqualified symbol ***
  738. *** resolution is turned off by default. Please either specify a ***
  739. *** fully qualified symbol module!symbolname, or enable resolution ***
  740. *** of unqualified symbols by typing ".symopt- 100". Note that ***
  741. *** enabling unqualified symbol resolution with network symbol ***
  742. *** server shares in the symbol path may cause the debugger to ***
  743. *** appear to hang for long periods of time when an incorrect ***
  744. *** symbol name is typed or the network symbol server is down. ***
  745. *** ***
  746. *** For some commands to work properly, your symbol path ***
  747. *** must point to .pdb files that have full type information. ***
  748. *** ***
  749. *** Certain .pdb files (such as the public OS symbols) do not ***
  750. *** contain the required information. Contact the group that ***
  751. *** provided you with these symbols if you need this command to ***
  752. *** work. ***
  753. *** ***
  754. *** Type referenced: nt!_IRP ***
  755. *** ***
  756. *************************************************************************
  757. *************************************************************************
  758. *** ***
  759. *** ***
  760. *** Either you specified an unqualified symbol, or your debugger ***
  761. *** doesn't have full symbol information. Unqualified symbol ***
  762. *** resolution is turned off by default. Please either specify a ***
  763. *** fully qualified symbol module!symbolname, or enable resolution ***
  764. *** of unqualified symbols by typing ".symopt- 100". Note that ***
  765. *** enabling unqualified symbol resolution with network symbol ***
  766. *** server shares in the symbol path may cause the debugger to ***
  767. *** appear to hang for long periods of time when an incorrect ***
  768. *** symbol name is typed or the network symbol server is down. ***
  769. *** ***
  770. *** For some commands to work properly, your symbol path ***
  771. *** must point to .pdb files that have full type information. ***
  772. *** ***
  773. *** Certain .pdb files (such as the public OS symbols) do not ***
  774. *** contain the required information. Contact the group that ***
  775. *** provided you with these symbols if you need this command to ***
  776. *** work. ***
  777. *** ***
  778. *** Type referenced: nt!_KPRCB ***
  779. *** ***
  780. *************************************************************************
  781. *************************************************************************
  782. *** ***
  783. *** ***
  784. *** Either you specified an unqualified symbol, or your debugger ***
  785. *** doesn't have full symbol information. Unqualified symbol ***
  786. *** resolution is turned off by default. Please either specify a ***
  787. *** fully qualified symbol module!symbolname, or enable resolution ***
  788. *** of unqualified symbols by typing ".symopt- 100". Note that ***
  789. *** enabling unqualified symbol resolution with network symbol ***
  790. *** server shares in the symbol path may cause the debugger to ***
  791. *** appear to hang for long periods of time when an incorrect ***
  792. *** symbol name is typed or the network symbol server is down. ***
  793. *** ***
  794. *** For some commands to work properly, your symbol path ***
  795. *** must point to .pdb files that have full type information. ***
  796. *** ***
  797. *** Certain .pdb files (such as the public OS symbols) do not ***
  798. *** contain the required information. Contact the group that ***
  799. *** provided you with these symbols if you need this command to ***
  800. *** work. ***
  801. *** ***
  802. *** Type referenced: nt!_KPRCB ***
  803. *** ***
  804. *************************************************************************
  805. *************************************************************************
  806. *** ***
  807. *** ***
  808. *** Either you specified an unqualified symbol, or your debugger ***
  809. *** doesn't have full symbol information. Unqualified symbol ***
  810. *** resolution is turned off by default. Please either specify a ***
  811. *** fully qualified symbol module!symbolname, or enable resolution ***
  812. *** of unqualified symbols by typing ".symopt- 100". Note that ***
  813. *** enabling unqualified symbol resolution with network symbol ***
  814. *** server shares in the symbol path may cause the debugger to ***
  815. *** appear to hang for long periods of time when an incorrect ***
  816. *** symbol name is typed or the network symbol server is down. ***
  817. *** ***
  818. *** For some commands to work properly, your symbol path ***
  819. *** must point to .pdb files that have full type information. ***
  820. *** ***
  821. *** Certain .pdb files (such as the public OS symbols) do not ***
  822. *** contain the required information. Contact the group that ***
  823. *** provided you with these symbols if you need this command to ***
  824. *** work. ***
  825. *** ***
  826. *** Type referenced: nt!_KPRCB ***
  827. *** ***
  828. *************************************************************************
  829. *************************************************************************
  830. *** ***
  831. *** ***
  832. *** Either you specified an unqualified symbol, or your debugger ***
  833. *** doesn't have full symbol information. Unqualified symbol ***
  834. *** resolution is turned off by default. Please either specify a ***
  835. *** fully qualified symbol module!symbolname, or enable resolution ***
  836. *** of unqualified symbols by typing ".symopt- 100". Note that ***
  837. *** enabling unqualified symbol resolution with network symbol ***
  838. *** server shares in the symbol path may cause the debugger to ***
  839. *** appear to hang for long periods of time when an incorrect ***
  840. *** symbol name is typed or the network symbol server is down. ***
  841. *** ***
  842. *** For some commands to work properly, your symbol path ***
  843. *** must point to .pdb files that have full type information. ***
  844. *** ***
  845. *** Certain .pdb files (such as the public OS symbols) do not ***
  846. *** contain the required information. Contact the group that ***
  847. *** provided you with these symbols if you need this command to ***
  848. *** work. ***
  849. *** ***
  850. *** Type referenced: nt!_KTHREAD ***
  851. *** ***
  852. *************************************************************************
  853. *************************************************************************
  854. *** ***
  855. *** ***
  856. *** Either you specified an unqualified symbol, or your debugger ***
  857. *** doesn't have full symbol information. Unqualified symbol ***
  858. *** resolution is turned off by default. Please either specify a ***
  859. *** fully qualified symbol module!symbolname, or enable resolution ***
  860. *** of unqualified symbols by typing ".symopt- 100". Note that ***
  861. *** enabling unqualified symbol resolution with network symbol ***
  862. *** server shares in the symbol path may cause the debugger to ***
  863. *** appear to hang for long periods of time when an incorrect ***
  864. *** symbol name is typed or the network symbol server is down. ***
  865. *** ***
  866. *** For some commands to work properly, your symbol path ***
  867. *** must point to .pdb files that have full type information. ***
  868. *** ***
  869. *** Certain .pdb files (such as the public OS symbols) do not ***
  870. *** contain the required information. Contact the group that ***
  871. *** provided you with these symbols if you need this command to ***
  872. *** work. ***
  873. *** ***
  874. *** Type referenced: nt!_KPRCB ***
  875. *** ***
  876. *************************************************************************
  877. *************************************************************************
  878. *** ***
  879. *** ***
  880. *** Either you specified an unqualified symbol, or your debugger ***
  881. *** doesn't have full symbol information. Unqualified symbol ***
  882. *** resolution is turned off by default. Please either specify a ***
  883. *** fully qualified symbol module!symbolname, or enable resolution ***
  884. *** of unqualified symbols by typing ".symopt- 100". Note that ***
  885. *** enabling unqualified symbol resolution with network symbol ***
  886. *** server shares in the symbol path may cause the debugger to ***
  887. *** appear to hang for long periods of time when an incorrect ***
  888. *** symbol name is typed or the network symbol server is down. ***
  889. *** ***
  890. *** For some commands to work properly, your symbol path ***
  891. *** must point to .pdb files that have full type information. ***
  892. *** ***
  893. *** Certain .pdb files (such as the public OS symbols) do not ***
  894. *** contain the required information. Contact the group that ***
  895. *** provided you with these symbols if you need this command to ***
  896. *** work. ***
  897. *** ***
  898. *** Type referenced: nt!_KPRCB ***
  899. *** ***
  900. *************************************************************************
  901.  
  902. DUMP_CLASS: 1
  903.  
  904. DUMP_QUALIFIER: 400
  905.  
  906. BUILD_VERSION_STRING: 16294.1.amd64fre.rs3_release.170916-2023
  907.  
  908. SYSTEM_PRODUCT_NAME: To Be Filled By O.E.M.
  909.  
  910. SYSTEM_SKU: To Be Filled By O.E.M.
  911.  
  912. SYSTEM_VERSION: To Be Filled By O.E.M.
  913.  
  914. BIOS_VENDOR: American Megatrends Inc.
  915.  
  916. BIOS_VERSION: P3.10
  917.  
  918. BIOS_DATE: 08/25/2017
  919.  
  920. BASEBOARD_MANUFACTURER: ASRock
  921.  
  922. BASEBOARD_PRODUCT: X370 Taichi
  923.  
  924. BASEBOARD_VERSION:
  925.  
  926. ADDITIONAL_DEBUG_TEXT:
  927.  
  928. You can run '.symfix; .reload' to try to fix the symbol path and load symbols.
  929.  
  930. WRONG_SYMBOLS_TIMESTAMP: 59be13ec
  931.  
  932. WRONG_SYMBOLS_SIZE: 8d2000
  933.  
  934. FAULTING_MODULE: fffff8002c087000 nt
  935.  
  936. DEBUG_FLR_IMAGE_TIMESTAMP: 59be13ec
  937.  
  938. DUMP_TYPE: 2
  939.  
  940. BUGCHECK_P1: 3
  941.  
  942. BUGCHECK_P2: ffff850ca8da5060
  943.  
  944. BUGCHECK_P3: ffff8308022378f0
  945.  
  946. BUGCHECK_P4: ffff850ca82b2640
  947.  
  948. DRVPOWERSTATE_SUBCODE: 3
  949.  
  950. IRP_ADDRESS: ffff850ca82b2640
  951.  
  952. DEVICE_OBJECT: ffff850ca8da5060
  953.  
  954. CPU_COUNT: 10
  955.  
  956. CPU_MHZ: d48
  957.  
  958. CPU_VENDOR: AuthenticAMD
  959.  
  960. CPU_FAMILY: 17
  961.  
  962. CPU_MODEL: 1
  963.  
  964. CPU_STEPPING: 1
  965.  
  966. CUSTOMER_CRASH_COUNT: 1
  967.  
  968. CURRENT_IRQL: 0
  969.  
  970. ANALYSIS_SESSION_HOST: MAINCLIENT
  971.  
  972. ANALYSIS_SESSION_TIME: 09-23-2017 14:33:40.0754
  973.  
  974. ANALYSIS_VERSION: 10.0.15063.468 amd64fre
  975.  
  976. LAST_CONTROL_TRANSFER: from fffff8002c2b8b27 to fffff8002c1ea7c0
  977.  
  978. STACK_TEXT:
  979. ffff8308`022378b8 fffff800`2c2b8b27 : 00000000`0000009f 00000000`00000003 ffff850c`a8da5060 ffff8308`022378f0 : nt+0x1637c0
  980. ffff8308`022378c0 00000000`0000009f : 00000000`00000003 ffff850c`a8da5060 ffff8308`022378f0 ffff850c`a82b2640 : nt+0x231b27
  981. ffff8308`022378c8 00000000`00000003 : ffff850c`a8da5060 ffff8308`022378f0 ffff850c`a82b2640 ffff850c`aacdf580 : 0x9f
  982. ffff8308`022378d0 ffff850c`a8da5060 : ffff8308`022378f0 ffff850c`a82b2640 ffff850c`aacdf580 00000000`00018000 : 0x3
  983. ffff8308`022378d8 ffff8308`022378f0 : ffff850c`a82b2640 ffff850c`aacdf580 00000000`00018000 fffff800`2c3e4c00 : 0xffff850c`a8da5060
  984. ffff8308`022378e0 ffff850c`a82b2640 : ffff850c`aacdf580 00000000`00018000 fffff800`2c3e4c00 fffff800`2c3e38d0 : 0xffff8308`022378f0
  985. ffff8308`022378e8 ffff850c`aacdf580 : 00000000`00018000 fffff800`2c3e4c00 fffff800`2c3e38d0 ffff850c`a4af3b30 : 0xffff850c`a82b2640
  986. ffff8308`022378f0 00000000`00018000 : fffff800`2c3e4c00 fffff800`2c3e38d0 ffff850c`a4af3b30 00000000`00000003 : 0xffff850c`aacdf580
  987. ffff8308`022378f8 fffff800`2c3e4c00 : fffff800`2c3e38d0 ffff850c`a4af3b30 00000000`00000003 fffff800`2c2b8a32 : 0x18000
  988. ffff8308`02237900 fffff800`2c3e38d0 : ffff850c`a4af3b30 00000000`00000003 fffff800`2c2b8a32 ffff850c`e0ac6f00 : nt+0x35dc00
  989. ffff8308`02237908 ffff850c`a4af3b30 : 00000000`00000003 fffff800`2c2b8a32 ffff850c`e0ac6f00 ffff9c80`46079180 : nt+0x35c8d0
  990. ffff8308`02237910 00000000`00000003 : fffff800`2c2b8a32 ffff850c`e0ac6f00 ffff9c80`46079180 ffff850c`e0ac6f78 : 0xffff850c`a4af3b30
  991. ffff8308`02237918 fffff800`2c2b8a32 : ffff850c`e0ac6f00 ffff9c80`46079180 ffff850c`e0ac6f78 00000000`00000080 : 0x3
  992. ffff8308`02237920 ffff850c`e0ac6f00 : ffff9c80`46079180 ffff850c`e0ac6f78 00000000`00000080 00000000`00000000 : nt+0x231a32
  993. ffff8308`02237928 ffff9c80`46079180 : ffff850c`e0ac6f78 00000000`00000080 00000000`00000000 fffff800`2c3e4c20 : 0xffff850c`e0ac6f00
  994. ffff8308`02237930 ffff850c`e0ac6f78 : 00000000`00000080 00000000`00000000 fffff800`2c3e4c20 00000000`00000002 : 0xffff9c80`46079180
  995. ffff8308`02237938 00000000`00000080 : 00000000`00000000 fffff800`2c3e4c20 00000000`00000002 ffff9c80`46079180 : 0xffff850c`e0ac6f78
  996. ffff8308`02237940 00000000`00000000 : fffff800`2c3e4c20 00000000`00000002 ffff9c80`46079180 00000000`00000002 : 0x80
  997.  
  998.  
  999. STACK_COMMAND: kb
  1000.  
  1001. THREAD_SHA1_HASH_MOD_FUNC: f08ac56120cad14894587db086f77ce277bfae84
  1002.  
  1003. THREAD_SHA1_HASH_MOD_FUNC_OFFSET: 96f1ac404d993a8805f8770c7c31121bc2791039
  1004.  
  1005. THREAD_SHA1_HASH_MOD: f08ac56120cad14894587db086f77ce277bfae84
  1006.  
  1007. FOLLOWUP_IP:
  1008. nt+1637c0
  1009. fffff800`2c1ea7c0 48894c2408 mov qword ptr [rsp+8],rcx
  1010.  
  1011. FAULT_INSTR_CODE: 244c8948
  1012.  
  1013. SYMBOL_STACK_INDEX: 0
  1014.  
  1015. FOLLOWUP_NAME: MachineOwner
  1016.  
  1017. BUGCHECK_STR: 59BE13EC
  1018.  
  1019. EXCEPTION_CODE: (NTSTATUS) 0x59be13ec - <Unable to get error code text>
  1020.  
  1021. EXCEPTION_CODE_STR: 59BE13EC
  1022.  
  1023. EXCEPTION_STR: WRONG_SYMBOLS
  1024.  
  1025. PROCESS_NAME: ntoskrnl.wrong.symbols.exe
  1026.  
  1027. IMAGE_NAME: ntoskrnl.wrong.symbols.exe
  1028.  
  1029. MODULE_NAME: nt_wrong_symbols
  1030.  
  1031. SYMBOL_NAME: nt_wrong_symbols!59BE13EC8D2000
  1032.  
  1033. BUCKET_ID: WRONG_SYMBOLS_X64_16294.1.amd64fre.rs3_release.170916-2023_TIMESTAMP_170917-061924
  1034.  
  1035. DEFAULT_BUCKET_ID: WRONG_SYMBOLS_X64_16294.1.amd64fre.rs3_release.170916-2023_TIMESTAMP_170917-061924
  1036.  
  1037. PRIMARY_PROBLEM_CLASS: WRONG_SYMBOLS
  1038.  
  1039. FAILURE_BUCKET_ID: WRONG_SYMBOLS_X64_16294.1.amd64fre.rs3_release.170916-2023_TIMESTAMP_170917-061924_59BE13EC_nt_wrong_symbols!59BE13EC8D2000
  1040.  
  1041. TARGET_TIME: 2017-09-22T19:37:01.000Z
  1042.  
  1043. OSBUILD: 16294
  1044.  
  1045. OSSERVICEPACK: 0
  1046.  
  1047. SERVICEPACK_NUMBER: 0
  1048.  
  1049. OS_REVISION: 0
  1050.  
  1051. SUITE_MASK: 272
  1052.  
  1053. PRODUCT_TYPE: 1
  1054.  
  1055. OSPLATFORM_TYPE: x64
  1056.  
  1057. OSNAME: Windows 10
  1058.  
  1059. OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS
  1060.  
  1061. OS_LOCALE:
  1062.  
  1063. USER_LCID: 0
  1064.  
  1065. OSBUILD_TIMESTAMP: 2017-09-17 07:19:24
  1066.  
  1067. BUILDDATESTAMP_STR: 170916-2023
  1068.  
  1069. BUILDLAB_STR: rs3_release
  1070.  
  1071. BUILDOSVER_STR: 10.0.16294.1.amd64fre.rs3_release.170916-2023
  1072.  
  1073. ANALYSIS_SESSION_ELAPSED_TIME: 20e2
  1074.  
  1075. ANALYSIS_SOURCE: KM
  1076.  
  1077. FAILURE_ID_HASH_STRING: km:wrong_symbols_x64_16294.1.amd64fre.rs3_release.170916-2023_timestamp_170917-061924_59be13ec_nt_wrong_symbols!59be13ec8d2000
  1078.  
  1079. FAILURE_ID_HASH: {5adaf15a-7e97-8e23-5afd-5b7678c493df}
  1080.  
  1081. Followup: MachineOwner
  1082. ---------
  1083.  
  1084. 2: kd> !thread
  1085. GetPointerFromAddress: unable to read from fffff8002c348200
  1086. *************************************************************************
  1087. *** ***
  1088. *** ***
  1089. *** Either you specified an unqualified symbol, or your debugger ***
  1090. *** doesn't have full symbol information. Unqualified symbol ***
  1091. *** resolution is turned off by default. Please either specify a ***
  1092. *** fully qualified symbol module!symbolname, or enable resolution ***
  1093. *** of unqualified symbols by typing ".symopt- 100". Note that ***
  1094. *** enabling unqualified symbol resolution with network symbol ***
  1095. *** server shares in the symbol path may cause the debugger to ***
  1096. *** appear to hang for long periods of time when an incorrect ***
  1097. *** symbol name is typed or the network symbol server is down. ***
  1098. *** ***
  1099. *** For some commands to work properly, your symbol path ***
  1100. *** must point to .pdb files that have full type information. ***
  1101. *** ***
  1102. *** Certain .pdb files (such as the public OS symbols) do not ***
  1103. *** contain the required information. Contact the group that ***
  1104. *** provided you with these symbols if you need this command to ***
  1105. *** work. ***
  1106. *** ***
  1107. *** Type referenced: nt!_ETHREAD ***
  1108. *** ***
  1109. *************************************************************************
  1110. ffff9c8046085ec0: Unable to get thread contents
  1111. 2: kd> lm kv
  1112. start end module name
  1113. fffff800`2ae00000 fffff800`2ae2b000 klupd_klif_mark (deferred)
  1114. Image path: \SystemRoot\System32\Drivers\klupd_klif_mark.sys
  1115. Image name: klupd_klif_mark.sys
  1116. Timestamp: Thu Mar 30 15:46:51 2017 (58DD1A5B)
  1117. CheckSum: 00039585
  1118. ImageSize: 0002B000
  1119. Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
  1120. fffff800`2ae40000 fffff800`2ae6d000 klids (deferred)
  1121. Image path: \??\C:\ProgramData\Kaspersky Lab\AVP18.0.0\Bases\klids.sys
  1122. Image name: klids.sys
  1123. Timestamp: Fri Jul 28 10:32:39 2017 (597B04B7)
  1124. CheckSum: 00032801
  1125. ImageSize: 0002D000
  1126. Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
  1127. fffff800`2ae70000 fffff800`2ae79000 CorsairVHidDriver (deferred)
  1128. Image path: \SystemRoot\System32\drivers\CorsairVHidDriver.sys
  1129. Image name: CorsairVHidDriver.sys
  1130. Timestamp: Thu May 25 14:04:02 2017 (5926D642)
  1131. CheckSum: 00008B73
  1132. ImageSize: 00009000
  1133. Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
  1134. fffff800`2aeb0000 fffff800`2aebd000 rdpvideominiport (deferred)
  1135. Mapped memory image file: c:\symbols\rdpvideominiport.sys\834709A4d000\rdpvideominiport.sys
  1136. Image path: \SystemRoot\System32\drivers\rdpvideominiport.sys
  1137. Image name: rdpvideominiport.sys
  1138. Timestamp: ***** Invalid (834709A4)
  1139. CheckSum: 0000D296
  1140. ImageSize: 0000D000
  1141. File version: 10.0.16273.1000
  1142. Product version: 10.0.16273.1000
  1143. File flags: 0 (Mask 3F)
  1144. File OS: 40004 NT Win32
  1145. File type: 3.0 Driver
  1146. File date: 00000000.00000000
  1147. Translations: 0409.04b0
  1148. CompanyName: Microsoft Corporation
  1149. ProductName: Microsoft® Windows® Operating System
  1150. InternalName: rdpvideominiport.sys
  1151. OriginalFilename: rdpvideominiport.sys
  1152. ProductVersion: 10.0.16273.1000
  1153. FileVersion: 10.0.16273.1000 (WinBuild.160101.0800)
  1154. FileDescription: Microsoft RDP Video Miniport driver
  1155. LegalCopyright: © Microsoft Corporation. All rights reserved.
  1156. fffff800`2aee0000 fffff800`2af1e000 klupd_klif_klark (deferred)
  1157. Image path: \SystemRoot\System32\Drivers\klupd_klif_klark.sys
  1158. Image name: klupd_klif_klark.sys
  1159. Timestamp: Thu Mar 30 15:51:16 2017 (58DD1B64)
  1160. CheckSum: 0003E432
  1161. ImageSize: 0003E000
  1162. Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
  1163. fffff800`2af80000 fffff800`2af8b000 umpass (deferred)
  1164. Mapped memory image file: c:\symbols\umpass.sys\FA98656Fb000\umpass.sys
  1165. Image path: \SystemRoot\System32\drivers\umpass.sys
  1166. Image name: umpass.sys
  1167. Timestamp: ***** Invalid (FA98656F)
  1168. CheckSum: 00003C8A
  1169. ImageSize: 0000B000
  1170. File version: 10.0.16262.1001
  1171. Product version: 10.0.16262.1001
  1172. File flags: 0 (Mask 3F)
  1173. File OS: 40004 NT Win32
  1174. File type: 2.0 Dll
  1175. File date: 00000000.00000000
  1176. Translations: 0409.04b0
  1177. CompanyName: Microsoft Corporation
  1178. ProductName: Microsoft® Windows® Operating System
  1179. InternalName: umpass.sys
  1180. OriginalFilename: fumpass.sys
  1181. ProductVersion: 10.0.16262.1001
  1182. FileVersion: 10.0.16262.1001 (WinBuild.160101.0800)
  1183. FileDescription: Generic pass-through driver
  1184. LegalCopyright: © Microsoft Corporation. All rights reserved.
  1185. fffff800`2afc0000 fffff800`2b598000 iqvw64e (deferred)
  1186. Image path: \??\C:\Windows\system32\Drivers\iqvw64e.sys
  1187. Image name: iqvw64e.sys
  1188. Timestamp: Mon Apr 3 16:14:26 2017 (58E266D2)
  1189. CheckSum: 00013DE1
  1190. ImageSize: 005D8000
  1191. Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
  1192. fffff800`2b5a0000 fffff800`2b5b0000 vwifimp (deferred)
  1193. Mapped memory image file: c:\symbols\vwifimp.sys\5BA3CDB810000\vwifimp.sys
  1194. Image path: \SystemRoot\System32\drivers\vwifimp.sys
  1195. Image name: vwifimp.sys
  1196. Timestamp: Thu Sep 20 17:41:28 2018 (5BA3CDB8)
  1197. CheckSum: 000110B8
  1198. ImageSize: 00010000
  1199. File version: 10.0.16262.1001
  1200. Product version: 10.0.16262.1001
  1201. File flags: 0 (Mask 3F)
  1202. File OS: 40004 NT Win32
  1203. File type: 3.6 Driver
  1204. File date: 00000000.00000000
  1205. Translations: 0000.04b0
  1206. CompanyName: Microsoft Corporation
  1207. ProductName: Microsoft® Windows® Operating System
  1208. InternalName: vwifimp.sys
  1209. OriginalFilename: vwifimp.sys
  1210. ProductVersion: 10.0.16262.1001
  1211. FileVersion: 10.0.16262.1001 (WinBuild.160101.0800)
  1212. FileDescription: Virtual WiFi Miniport Driver
  1213. LegalCopyright: © Microsoft Corporation. All rights reserved.
  1214. fffff800`2b5b0000 fffff800`2b5d4000 tunnel (deferred)
  1215. Mapped memory image file: c:\symbols\tunnel.sys\9206C4C024000\tunnel.sys
  1216. Image path: \SystemRoot\System32\drivers\tunnel.sys
  1217. Image name: tunnel.sys
  1218. Timestamp: ***** Invalid (9206C4C0)
  1219. CheckSum: 0001D5B9
  1220. ImageSize: 00024000
  1221. File version: 10.0.16288.1
  1222. Product version: 10.0.16288.1
  1223. File flags: 0 (Mask 3F)
  1224. File OS: 40004 NT Win32
  1225. File type: 3.6 Driver
  1226. File date: 00000000.00000000
  1227. Translations: 0409.04b0
  1228. CompanyName: Microsoft Corporation
  1229. ProductName: Microsoft® Windows® Operating System
  1230. InternalName: tunnel.sys
  1231. OriginalFilename: tunnel.sys
  1232. ProductVersion: 10.0.16288.1
  1233. FileVersion: 10.0.16288.1 (WinBuild.160101.0800)
  1234. FileDescription: Microsoft Tunnel Interface Driver
  1235. LegalCopyright: © Microsoft Corporation. All rights reserved.
  1236. fffff800`2b5e0000 fffff800`2b5f7000 klupd_klif_kimul (deferred)
  1237. Image path: \SystemRoot\System32\Drivers\klupd_klif_kimul.sys
  1238. Image name: klupd_klif_kimul.sys
  1239. Timestamp: Mon Feb 6 11:09:33 2017 (5898596D)
  1240. CheckSum: 0001F6D8
  1241. ImageSize: 00017000
  1242. Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
  1243. fffff800`2c008000 fffff800`2c087000 hal (deferred)
  1244. Mapped memory image file: c:\symbols\hal.dll\869C055B7f000\hal.dll
  1245. Image path: hal.dll
  1246. Image name: hal.dll
  1247. Timestamp: ***** Invalid (869C055B)
  1248. CheckSum: 000831A8
  1249. ImageSize: 0007F000
  1250. File version: 10.0.16288.1
  1251. Product version: 10.0.16288.1
  1252. File flags: 0 (Mask 3F)
  1253. File OS: 40004 NT Win32
  1254. File type: 2.0 Dll
  1255. File date: 00000000.00000000
  1256. Translations: 0409.04b0
  1257. CompanyName: Microsoft Corporation
  1258. ProductName: Microsoft® Windows® Operating System
  1259. InternalName: hal.dll
  1260. OriginalFilename: hal.dll
  1261. ProductVersion: 10.0.16288.1
  1262. FileVersion: 10.0.16288.1 (WinBuild.160101.0800)
  1263. FileDescription: Hardware Abstraction Layer DLL
  1264. LegalCopyright: © Microsoft Corporation. All rights reserved.
  1265. fffff800`2c087000 fffff800`2c959000 nt T (no symbols)
  1266. Loaded symbol image file: ntoskrnl.exe
  1267. Image path: \SystemRoot\system32\ntoskrnl.exe
  1268. Image name: ntoskrnl.exe
  1269. Timestamp: Sun Sep 17 07:19:24 2017 (59BE13EC)
  1270. CheckSum: 0083CA59
  1271. ImageSize: 008D2000
  1272. Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
  1273. fffff800`2ca00000 fffff800`2ca0b000 kd (deferred)
  1274. Mapped memory image file: c:\symbols\kd.dll\FA8983CBb000\kd.dll
  1275. Image path: \SystemRoot\system32\kd.dll
  1276. Image name: kd.dll
  1277. Timestamp: ***** Invalid (FA8983CB)
  1278. CheckSum: 0000864E
  1279. ImageSize: 0000B000
  1280. File version: 10.0.16262.1001
  1281. Product version: 10.0.16262.1001
  1282. File flags: 0 (Mask 3F)
  1283. File OS: 40004 NT Win32
  1284. File type: 3.A Driver
  1285. File date: 00000000.00000000
  1286. Translations: 0409.04b0
  1287. CompanyName: Microsoft Corporation
  1288. ProductName: Microsoft® Windows® Operating System
  1289. InternalName: kd.dll
  1290. OriginalFilename: kd.dll
  1291. ProductVersion: 10.0.16262.1001
  1292. FileVersion: 10.0.16262.1001 (WinBuild.160101.0800)
  1293. FileDescription: Local Kernel Debugger
  1294. LegalCopyright: © Microsoft Corporation. All rights reserved.
  1295. fffff805`13e00000 fffff805`13e68000 FLTMGR (deferred)
  1296. Mapped memory image file: c:\symbols\FLTMGR.SYS\7AD26C5168000\FLTMGR.SYS
  1297. Image path: \SystemRoot\System32\drivers\FLTMGR.SYS
  1298. Image name: FLTMGR.SYS
  1299. Timestamp: Thu Apr 19 16:50:41 2035 (7AD26C51)
  1300. CheckSum: 0006F9D8
  1301. ImageSize: 00068000
  1302. File version: 10.0.16288.1
  1303. Product version: 10.0.16288.1
  1304. File flags: 0 (Mask 3F)
  1305. File OS: 40004 NT Win32
  1306. File type: 3.7 Driver
  1307. File date: 00000000.00000000
  1308. Translations: 0409.04b0
  1309. CompanyName: Microsoft Corporation
  1310. ProductName: Microsoft® Windows® Operating System
  1311. InternalName: fltMgr.sys
  1312. OriginalFilename: fltMgr.sys
  1313. ProductVersion: 10.0.16288.1
  1314. FileVersion: 10.0.16288.1 (WinBuild.160101.0800)
  1315. FileDescription: Microsoft Filesystem Filter Manager
  1316. LegalCopyright: © Microsoft Corporation. All rights reserved.
  1317. fffff805`13e70000 fffff805`13f71000 clipsp (deferred)
  1318. Image path: \SystemRoot\System32\drivers\clipsp.sys
  1319. Image name: clipsp.sys
  1320. Timestamp: Sun Sep 17 07:29:18 2017 (59BE163E)
  1321. CheckSum: 000F9DF5
  1322. ImageSize: 00101000
  1323. Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
  1324. fffff805`13f80000 fffff805`13f8e000 cmimcext (deferred)
  1325. Mapped memory image file: c:\symbols\cmimcext.sys\D4EADF74e000\cmimcext.sys
  1326. Image path: \SystemRoot\System32\drivers\cmimcext.sys
  1327. Image name: cmimcext.sys
  1328. Timestamp: ***** Invalid (D4EADF74)
  1329. CheckSum: 00012094
  1330. ImageSize: 0000E000
  1331. File version: 10.0.16273.1000
  1332. Product version: 10.0.16273.1000
  1333. File flags: 0 (Mask 3F)
  1334. File OS: 40004 NT Win32
  1335. File type: 3.7 Driver
  1336. File date: 00000000.00000000
  1337. Translations: 0409.04b0
  1338. CompanyName: Microsoft Corporation
  1339. ProductName: Microsoft® Windows® Operating System
  1340. InternalName: cmimcext.sys
  1341. OriginalFilename: cmimcext.sys
  1342. ProductVersion: 10.0.16273.1000
  1343. FileVersion: 10.0.16273.1000 (WinBuild.160101.0800)
  1344. FileDescription: Kernel Configuration Manager Initial Configuration Extension Host Export Driver
  1345. LegalCopyright: © Microsoft Corporation. All rights reserved.
  1346. fffff805`13f90000 fffff805`13f9c000 ntosext (deferred)
  1347. Mapped memory image file: c:\symbols\ntosext.sys\1B6DA4C4c000\ntosext.sys
  1348. Image path: \SystemRoot\System32\drivers\ntosext.sys
  1349. Image name: ntosext.sys
  1350. Timestamp: Wed Aug 1 02:07:16 1984 (1B6DA4C4)
  1351. CheckSum: 000130C8
  1352. ImageSize: 0000C000
  1353. File version: 10.0.16262.1001
  1354. Product version: 10.0.16262.1001
  1355. File flags: 0 (Mask 3F)
  1356. File OS: 40004 NT Win32
  1357. File type: 3.7 Driver
  1358. File date: 00000000.00000000
  1359. Translations: 0409.04b0
  1360. CompanyName: Microsoft Corporation
  1361. ProductName: Microsoft® Windows® Operating System
  1362. InternalName: ntosext.sys
  1363. OriginalFilename: ntosext.sys
  1364. ProductVersion: 10.0.16262.1001
  1365. FileVersion: 10.0.16262.1001 (WinBuild.160101.0800)
  1366. FileDescription: NTOS extension host driver
  1367. LegalCopyright: © Microsoft Corporation. All rights reserved.
  1368. fffff805`13fa0000 fffff805`14052000 CI (deferred)
  1369. Image path: \SystemRoot\system32\CI.dll
  1370. Image name: CI.dll
  1371. Timestamp: Sun May 1 17:48:30 1977 (0DCA2BDE)
  1372. CheckSum: 000B4C28
  1373. ImageSize: 000B2000
  1374. Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
  1375. fffff805`14060000 fffff805`1410a000 cng (deferred)
  1376. Mapped memory image file: c:\symbols\cng.sys\76DB7D7Daa000\cng.sys
  1377. Image path: \SystemRoot\System32\drivers\cng.sys
  1378. Image name: cng.sys
  1379. Timestamp: Thu Mar 10 19:33:17 2033 (76DB7D7D)
  1380. CheckSum: 000AB7FB
  1381. ImageSize: 000AA000
  1382. File version: 10.0.16273.1000
  1383. Product version: 10.0.16273.1000
  1384. File flags: 0 (Mask 3F)
  1385. File OS: 40004 NT Win32
  1386. File type: 3.7 Driver
  1387. File date: 00000000.00000000
  1388. Translations: 0409.04b0
  1389. CompanyName: Microsoft Corporation
  1390. ProductName: Microsoft® Windows® Operating System
  1391. InternalName: cng.sys
  1392. OriginalFilename: cng.sys
  1393. ProductVersion: 10.0.16273.1000
  1394. FileVersion: 10.0.16273.1000 (WinBuild.160101.0800)
  1395. FileDescription: Kernel Cryptography, Next Generation
  1396. LegalCopyright: © Microsoft Corporation. All rights reserved.
  1397. fffff805`14110000 fffff805`141f3000 Wdf01000 (deferred)
  1398. Mapped memory image file: c:\symbols\Wdf01000.sys\30874750e3000\Wdf01000.sys
  1399. Image path: \SystemRoot\system32\drivers\Wdf01000.sys
  1400. Image name: Wdf01000.sys
  1401. Timestamp: Fri Oct 20 07:53:04 1995 (30874750)
  1402. CheckSum: 000E7061
  1403. ImageSize: 000E3000
  1404. File version: 1.23.16288.1
  1405. Product version: 1.23.16288.1
  1406. File flags: 0 (Mask 3F)
  1407. File OS: 40004 NT Win32
  1408. File type: 3.7 Driver
  1409. File date: 00000000.00000000
  1410. Translations: 0409.04b0
  1411. CompanyName: Microsoft Corporation
  1412. ProductName: Microsoft® Windows® Operating System
  1413. InternalName: wdf01000.sys
  1414. OriginalFilename: wdf01000.sys
  1415. ProductVersion: 1.23.16288.1
  1416. FileVersion: 1.23.16288.1 (WinBuild.160101.0800)
  1417. FileDescription: Kernel Mode Driver Framework Runtime
  1418. LegalCopyright: © Microsoft Corporation. All rights reserved.
  1419. fffff805`14200000 fffff805`14213000 WDFLDR (deferred)
  1420. Mapped memory image file: c:\symbols\WDFLDR.SYS\B573265013000\WDFLDR.SYS
  1421. Image path: \SystemRoot\system32\drivers\WDFLDR.SYS
  1422. Image name: WDFLDR.SYS
  1423. Timestamp: ***** Invalid (B5732650)
  1424. CheckSum: 00018693
  1425. ImageSize: 00013000
  1426. File version: 1.23.16278.1000
  1427. Product version: 1.23.16278.1000
  1428. File flags: 0 (Mask 3F)
  1429. File OS: 40004 NT Win32
  1430. File type: 3.7 Driver
  1431. File date: 00000000.00000000
  1432. Translations: 0000.04b0
  1433. CompanyName: Microsoft Corporation
  1434. ProductName: Microsoft® Windows® Operating System
  1435. InternalName: wdfldr.sys
  1436. OriginalFilename: wdfldr.sys
  1437. ProductVersion: 1.23.16278.1000
  1438. FileVersion: 1.23.16278.1000 (WinBuild.160101.0800)
  1439. FileDescription: Kernel Mode Driver Framework Loader
  1440. LegalCopyright: © Microsoft Corporation. All rights reserved.
  1441. fffff805`14220000 fffff805`1422e000 WppRecorder (deferred)
  1442. Mapped memory image file: c:\symbols\WppRecorder.sys\A67A2B71e000\WppRecorder.sys
  1443. Image path: \SystemRoot\system32\drivers\WppRecorder.sys
  1444. Image name: WppRecorder.sys
  1445. Timestamp: ***** Invalid (A67A2B71)
  1446. CheckSum: 0000F3E4
  1447. ImageSize: 0000E000
  1448. File version: 10.0.16273.1000
  1449. Product version: 10.0.16273.1000
  1450. File flags: 0 (Mask 3F)
  1451. File OS: 40004 NT Win32
  1452. File type: 3.7 Driver
  1453. File date: 00000000.00000000
  1454. Translations: 0000.04b0
  1455. CompanyName: Microsoft Corporation
  1456. ProductName: Microsoft® Windows® Operating System
  1457. InternalName: WppRecorder.sys
  1458. OriginalFilename: WppRecorder.sys
  1459. ProductVersion: 10.0.16273.1000
  1460. FileVersion: 10.0.16273.1000 (WinBuild.160101.0800)
  1461. FileDescription: WPP Trace Recorder
  1462. LegalCopyright: © Microsoft Corporation. All rights reserved.
  1463. fffff805`14230000 fffff805`1423f000 SleepStudyHelper (deferred)
  1464. Mapped memory image file: c:\symbols\SleepStudyHelper.sys\A0E1B647f000\SleepStudyHelper.sys
  1465. Image path: \SystemRoot\system32\drivers\SleepStudyHelper.sys
  1466. Image name: SleepStudyHelper.sys
  1467. Timestamp: ***** Invalid (A0E1B647)
  1468. CheckSum: 000120B6
  1469. ImageSize: 0000F000
  1470. File version: 10.0.16273.1000
  1471. Product version: 10.0.16273.1000
  1472. File flags: 0 (Mask 3F)
  1473. File OS: 40004 NT Win32
  1474. File type: 3.7 Driver
  1475. File date: 00000000.00000000
  1476. Translations: 0000.04b0
  1477. CompanyName: Microsoft Corporation
  1478. ProductName: Microsoft® Windows® Operating System
  1479. InternalName: SleepStudyHelper.sys
  1480. OriginalFilename: SleepStudyHelper.sys
  1481. ProductVersion: 10.0.16273.1000
  1482. FileVersion: 10.0.16273.1000 (WinBuild.160101.0800)
  1483. FileDescription: Sleep Study Helper
  1484. LegalCopyright: © Microsoft Corporation. All rights reserved.
  1485. fffff805`14240000 fffff805`14260000 mcupdate_AuthenticAMD (deferred)
  1486. Image path: \SystemRoot\system32\mcupdate_AuthenticAMD.dll
  1487. Image name: mcupdate_AuthenticAMD.dll
  1488. Timestamp: Fri Jun 25 20:46:20 2010 (4C25078C)
  1489. CheckSum: 00022633
  1490. ImageSize: 00020000
  1491. Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
  1492. fffff805`14260000 fffff805`142c1000 msrpc (deferred)
  1493. Mapped memory image file: c:\symbols\msrpc.sys\687CE03761000\msrpc.sys
  1494. Image path: \SystemRoot\System32\drivers\msrpc.sys
  1495. Image name: msrpc.sys
  1496. Timestamp: Sun Jul 20 13:25:27 2025 (687CE037)
  1497. CheckSum: 0005CD09
  1498. ImageSize: 00061000
  1499. File version: 10.0.16281.1000
  1500. Product version: 10.0.16281.1000
  1501. File flags: 0 (Mask 3F)
  1502. File OS: 40004 NT Win32
  1503. File type: 3.7 Driver
  1504. File date: 00000000.00000000
  1505. Translations: 0409.04b0
  1506. CompanyName: Microsoft Corporation
  1507. ProductName: Microsoft® Windows® Operating System
  1508. InternalName: krpcdd.sys
  1509. OriginalFilename: krpcdd.sys
  1510. ProductVersion: 10.0.16281.1000
  1511. FileVersion: 10.0.16281.1000 (WinBuild.160101.0800)
  1512. FileDescription: Kernel Remote Procedure Call Provider
  1513. LegalCopyright: © Microsoft Corporation. All rights reserved.
  1514. fffff805`142d0000 fffff805`142f9000 ksecdd (deferred)
  1515. Image path: \SystemRoot\System32\drivers\ksecdd.sys
  1516. Image name: ksecdd.sys
  1517. Timestamp: ***** Invalid (9A56383F)
  1518. CheckSum: 0002B5CC
  1519. ImageSize: 00029000
  1520. Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
  1521. fffff805`14300000 fffff805`14311000 werkernel (deferred)
  1522. Mapped memory image file: c:\symbols\werkernel.sys\623CE79811000\werkernel.sys
  1523. Image path: \SystemRoot\System32\drivers\werkernel.sys
  1524. Image name: werkernel.sys
  1525. Timestamp: Thu Mar 24 21:50:16 2022 (623CE798)
  1526. CheckSum: 00010EA2
  1527. ImageSize: 00011000
  1528. File version: 10.0.16273.1000
  1529. Product version: 10.0.16273.1000
  1530. File flags: 0 (Mask 3F)
  1531. File OS: 40004 NT Win32
  1532. File type: 3.7 Driver
  1533. File date: 00000000.00000000
  1534. Translations: 0409.04b0
  1535. CompanyName: Microsoft Corporation
  1536. ProductName: Microsoft® Windows® Operating System
  1537. InternalName: werkernel
  1538. OriginalFilename: werkernel.sys
  1539. ProductVersion: 10.0.16273.1000
  1540. FileVersion: 10.0.16273.1000 (WinBuild.160101.0800)
  1541. FileDescription: Windows Error Reporting Kernel Driver
  1542. LegalCopyright: © Microsoft Corporation. All rights reserved.
  1543. fffff805`14320000 fffff805`14382000 CLFS (deferred)
  1544. Image path: \SystemRoot\System32\drivers\CLFS.SYS
  1545. Image name: CLFS.SYS
  1546. Timestamp: Sun Dec 8 05:07:42 2030 (729DB01E)
  1547. CheckSum: 00062255
  1548. ImageSize: 00062000
  1549. Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
  1550. fffff805`14390000 fffff805`143b4000 tm (deferred)
  1551. Mapped memory image file: c:\symbols\tm.sys\50FBCEC024000\tm.sys
  1552. Image path: \SystemRoot\System32\drivers\tm.sys
  1553. Image name: tm.sys
  1554. Timestamp: Sun Jan 20 11:02:24 2013 (50FBCEC0)
  1555. CheckSum: 0002BC46
  1556. ImageSize: 00024000
  1557. File version: 10.0.16281.1000
  1558. Product version: 10.0.16281.1000
  1559. File flags: 0 (Mask 3F)
  1560. File OS: 40004 NT Win32
  1561. File type: 3.7 Driver
  1562. File date: 00000000.00000000
  1563. Translations: 0409.04b0
  1564. CompanyName: Microsoft Corporation
  1565. ProductName: Microsoft® Windows® Operating System
  1566. InternalName: tm.sys
  1567. OriginalFilename: tm.sys
  1568. ProductVersion: 10.0.16281.1000
  1569. FileVersion: 10.0.16281.1000 (WinBuild.160101.0800)
  1570. FileDescription: Kernel Transaction Manager Driver
  1571. LegalCopyright: © Microsoft Corporation. All rights reserved.
  1572. fffff805`143c0000 fffff805`143d7000 PSHED (deferred)
  1573. Mapped memory image file: c:\symbols\PSHED.dll\FE1A7C4017000\PSHED.dll
  1574. Image path: \SystemRoot\system32\PSHED.dll
  1575. Image name: PSHED.dll
  1576. Timestamp: ***** Invalid (FE1A7C40)
  1577. CheckSum: 000115CB
  1578. ImageSize: 00017000
  1579. File version: 10.0.16273.1000
  1580. Product version: 10.0.16273.1000
  1581. File flags: 0 (Mask 3F)
  1582. File OS: 40004 NT Win32
  1583. File type: 3.7 Driver
  1584. File date: 00000000.00000000
  1585. Translations: 0409.04b0
  1586. CompanyName: Microsoft Corporation
  1587. ProductName: Microsoft® Windows® Operating System
  1588. InternalName: pshed.dll
  1589. OriginalFilename: pshed.dll
  1590. ProductVersion: 10.0.16273.1000
  1591. FileVersion: 10.0.16273.1000 (WinBuild.160101.0800)
  1592. FileDescription: Platform Specific Hardware Error Driver
  1593. LegalCopyright: © Microsoft Corporation. All rights reserved.
  1594. fffff805`143e0000 fffff805`143eb000 BOOTVID (deferred)
  1595. Mapped memory image file: c:\symbols\BOOTVID.dll\2FB571EAb000\BOOTVID.dll
  1596. Image path: \SystemRoot\system32\BOOTVID.dll
  1597. Image name: BOOTVID.dll
  1598. Timestamp: Sun May 14 03:58:50 1995 (2FB571EA)
  1599. CheckSum: 0000836F
  1600. ImageSize: 0000B000
  1601. File version: 10.0.16262.1001
  1602. Product version: 10.0.16262.1001
  1603. File flags: 0 (Mask 3F)
  1604. File OS: 40004 NT Win32
  1605. File type: 3.4 Driver
  1606. File date: 00000000.00000000
  1607. Translations: 0409.04b0
  1608. CompanyName: Microsoft Corporation
  1609. ProductName: Microsoft® Windows® Operating System
  1610. InternalName: bootvid.dll
  1611. OriginalFilename: bootvid.dll
  1612. ProductVersion: 10.0.16262.1001
  1613. FileVersion: 10.0.16262.1001 (WinBuild.160101.0800)
  1614. FileDescription: VGA Boot Driver
  1615. LegalCopyright: © Microsoft Corporation. All rights reserved.
  1616. fffff805`14400000 fffff805`144b9000 ACPI (deferred)
  1617. Image path: \SystemRoot\System32\drivers\ACPI.sys
  1618. Image name: ACPI.sys
  1619. Timestamp: ***** Invalid (F288DB9E)
  1620. CheckSum: 000BE79C
  1621. ImageSize: 000B9000
  1622. Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
  1623. fffff805`144c0000 fffff805`144cc000 WMILIB (deferred)
  1624. Mapped memory image file: c:\symbols\WMILIB.SYS\FD702A37c000\WMILIB.SYS
  1625. Image path: \SystemRoot\System32\drivers\WMILIB.SYS
  1626. Image name: WMILIB.SYS
  1627. Timestamp: ***** Invalid (FD702A37)
  1628. CheckSum: 000076EC
  1629. ImageSize: 0000C000
  1630. File version: 10.0.16262.1001
  1631. Product version: 10.0.16262.1001
  1632. File flags: 0 (Mask 3F)
  1633. File OS: 40004 NT Win32
  1634. File type: 3.7 Driver
  1635. File date: 00000000.00000000
  1636. Translations: 0409.04b0
  1637. CompanyName: Microsoft Corporation
  1638. ProductName: Microsoft® Windows® Operating System
  1639. InternalName: WmiLib.sys
  1640. OriginalFilename: WmiLib.sys
  1641. ProductVersion: 10.0.16262.1001
  1642. FileVersion: 10.0.16262.1001 (WinBuild.160101.0800)
  1643. FileDescription: WMILIB WMI support library Dll
  1644. LegalCopyright: © Microsoft Corporation. All rights reserved.
  1645. fffff805`144e0000 fffff805`14505000 intelpep (deferred)
  1646. Mapped memory image file: c:\symbols\intelpep.sys\EB730B5B25000\intelpep.sys
  1647. Image path: \SystemRoot\System32\drivers\intelpep.sys
  1648. Image name: intelpep.sys
  1649. Timestamp: ***** Invalid (EB730B5B)
  1650. CheckSum: 0002ACBD
  1651. ImageSize: 00025000
  1652. File version: 10.0.16273.1000
  1653. Product version: 10.0.16273.1000
  1654. File flags: 0 (Mask 3F)
  1655. File OS: 40004 NT Win32
  1656. File type: 3.A Driver
  1657. File date: 00000000.00000000
  1658. Translations: 0409.04b0
  1659. CompanyName: Microsoft Corporation
  1660. ProductName: Microsoft® Windows® Operating System
  1661. InternalName: intelpep.sys
  1662. OriginalFilename: intelpep.sys
  1663. ProductVersion: 10.0.16273.1000
  1664. FileVersion: 10.0.16273.1000 (WinBuild.160101.0800)
  1665. FileDescription: Intel Power Engine Plugin
  1666. LegalCopyright: © Microsoft Corporation. All rights reserved.
  1667. fffff805`14510000 fffff805`14526000 WindowsTrustedRT (deferred)
  1668. Mapped memory image file: c:\symbols\WindowsTrustedRT.sys\6174852016000\WindowsTrustedRT.sys
  1669. Image path: \SystemRoot\system32\drivers\WindowsTrustedRT.sys
  1670. Image name: WindowsTrustedRT.sys
  1671. Timestamp: Sat Oct 23 22:56:48 2021 (61748520)
  1672. CheckSum: 0001DF2A
  1673. ImageSize: 00016000
  1674. File version: 10.0.16273.1000
  1675. Product version: 10.0.16273.1000
  1676. File flags: 0 (Mask 3F)
  1677. File OS: 40004 NT Win32
  1678. File type: 3.7 Driver
  1679. File date: 00000000.00000000
  1680. Translations: 0409.04b0
  1681. CompanyName: Microsoft Corporation
  1682. ProductName: Microsoft® Windows® Operating System
  1683. InternalName: WindowsTrustedRT.sys
  1684. OriginalFilename: WindowsTrustedRT.sys
  1685. ProductVersion: 10.0.16273.1000
  1686. FileVersion: 10.0.16273.1000 (WinBuild.160101.0800)
  1687. FileDescription: Windows Trusted Runtime Interface Driver
  1688. LegalCopyright: © Microsoft Corporation. All rights reserved.
  1689. fffff805`14530000 fffff805`1453b000 WindowsTrustedRTProxy (deferred)
  1690. Mapped memory image file: c:\symbols\WindowsTrustedRTProxy.sys\C6109CE2b000\WindowsTrustedRTProxy.sys
  1691. Image path: \SystemRoot\System32\drivers\WindowsTrustedRTProxy.sys
  1692. Image name: WindowsTrustedRTProxy.sys
  1693. Timestamp: ***** Invalid (C6109CE2)
  1694. CheckSum: 0000F309
  1695. ImageSize: 0000B000
  1696. File version: 10.0.16262.1001
  1697. Product version: 10.0.16262.1001
  1698. File flags: 0 (Mask 3F)
  1699. File OS: 40004 NT Win32
  1700. File type: 3.7 Driver
  1701. File date: 00000000.00000000
  1702. Translations: 0409.04b0
  1703. CompanyName: Microsoft Corporation
  1704. ProductName: Microsoft® Windows® Operating System
  1705. InternalName: WindowsTrustedRTProxy.sys
  1706. OriginalFilename: WindowsTrustedRTProxy.sys
  1707. ProductVersion: 10.0.16262.1001
  1708. FileVersion: 10.0.16262.1001 (WinBuild.160101.0800)
  1709. FileDescription: Windows Trusted Runtime Service Proxy Driver
  1710. LegalCopyright: © Microsoft Corporation. All rights reserved.
  1711. fffff805`14540000 fffff805`14554000 pcw (deferred)
  1712. Mapped memory image file: c:\symbols\pcw.sys\B45241A014000\pcw.sys
  1713. Image path: \SystemRoot\System32\drivers\pcw.sys
  1714. Image name: pcw.sys
  1715. Timestamp: ***** Invalid (B45241A0)
  1716. CheckSum: 00017BEF
  1717. ImageSize: 00014000
  1718. File version: 10.0.16273.1000
  1719. Product version: 10.0.16273.1000
  1720. File flags: 0 (Mask 3F)
  1721. File OS: 40004 NT Win32
  1722. File type: 3.8 Driver
  1723. File date: 00000000.00000000
  1724. Translations: 0409.04b0
  1725. CompanyName: Microsoft Corporation
  1726. ProductName: Microsoft® Windows® Operating System
  1727. InternalName: pcw.sys
  1728. OriginalFilename: pcw.sys
  1729. ProductVersion: 10.0.16273.1000
  1730. FileVersion: 10.0.16273.1000 (WinBuild.160101.0800)
  1731. FileDescription: Performance Counters for Windows Driver
  1732. LegalCopyright: © Microsoft Corporation. All rights reserved.
  1733. fffff805`14560000 fffff805`14599000 klupd_klif_arkmon (deferred)
  1734. Image path: \SystemRoot\System32\Drivers\klupd_klif_arkmon.sys
  1735. Image name: klupd_klif_arkmon.sys
  1736. Timestamp: Thu Mar 30 15:41:32 2017 (58DD191C)
  1737. CheckSum: 00038D0D
  1738. ImageSize: 00039000
  1739. Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
  1740. fffff805`145a0000 fffff805`145ab000 msisadrv (deferred)
  1741. Mapped memory image file: c:\symbols\msisadrv.sys\2B3273BCb000\msisadrv.sys
  1742. Image path: \SystemRoot\System32\drivers\msisadrv.sys
  1743. Image name: msisadrv.sys
  1744. Timestamp: Sat Dec 19 00:58:36 1992 (2B3273BC)
  1745. CheckSum: 00012467
  1746. ImageSize: 0000B000
  1747. File version: 10.0.16262.1001
  1748. Product version: 10.0.16262.1001
  1749. File flags: 0 (Mask 3F)
  1750. File OS: 40004 NT Win32
  1751. File type: 3.7 Driver
  1752. File date: 00000000.00000000
  1753. Translations: 0409.04b0
  1754. CompanyName: Microsoft Corporation
  1755. ProductName: Microsoft® Windows® Operating System
  1756. InternalName: msisadrv.sys
  1757. OriginalFilename: msisadrv.sys
  1758. ProductVersion: 10.0.16262.1001
  1759. FileVersion: 10.0.16262.1001 (WinBuild.160101.0800)
  1760. FileDescription: ISA Driver
  1761. LegalCopyright: © Microsoft Corporation. All rights reserved.
  1762. fffff805`145b0000 fffff805`1460d000 pci (deferred)
  1763. Mapped memory image file: c:\symbols\pci.sys\F05D50D85d000\pci.sys
  1764. Image path: \SystemRoot\System32\drivers\pci.sys
  1765. Image name: pci.sys
  1766. Timestamp: ***** Invalid (F05D50D8)
  1767. CheckSum: 0005AC5B
  1768. ImageSize: 0005D000
  1769. File version: 10.0.16288.1
  1770. Product version: 10.0.16288.1
  1771. File flags: 0 (Mask 3F)
  1772. File OS: 40004 NT Win32
  1773. File type: 2.0 Dll
  1774. File date: 00000000.00000000
  1775. Translations: 0409.04b0
  1776. CompanyName: Microsoft Corporation
  1777. ProductName: Microsoft® Windows® Operating System
  1778. InternalName: pci.sys
  1779. OriginalFilename: pci.sys
  1780. ProductVersion: 10.0.16288.1
  1781. FileVersion: 10.0.16288.1 (WinBuild.160101.0800)
  1782. FileDescription: NT Plug and Play PCI Enumerator
  1783. LegalCopyright: © Microsoft Corporation. All rights reserved.
  1784. fffff805`14610000 fffff805`14622000 vdrvroot (deferred)
  1785. Mapped memory image file: c:\symbols\vdrvroot.sys\53ABAAC212000\vdrvroot.sys
  1786. Image path: \SystemRoot\System32\drivers\vdrvroot.sys
  1787. Image name: vdrvroot.sys
  1788. Timestamp: Thu Jun 26 06:08:18 2014 (53ABAAC2)
  1789. CheckSum: 0000F797
  1790. ImageSize: 00012000
  1791. File version: 10.0.16273.1000
  1792. Product version: 10.0.16273.1000
  1793. File flags: 0 (Mask 3F)
  1794. File OS: 40004 NT Win32
  1795. File type: 2.0 Dll
  1796. File date: 00000000.00000000
  1797. Translations: 0409.04b0
  1798. CompanyName: Microsoft Corporation
  1799. ProductName: Microsoft® Windows® Operating System
  1800. InternalName: vdrvroot.sys
  1801. OriginalFilename: vdrvroot.sys
  1802. ProductVersion: 10.0.16273.1000
  1803. FileVersion: 10.0.16273.1000 (WinBuild.160101.0800)
  1804. FileDescription: Virtual Drive Root Enumerator
  1805. LegalCopyright: © Microsoft Corporation. All rights reserved.
  1806. fffff805`14630000 fffff805`14655000 pdc (deferred)
  1807. Mapped memory image file: c:\symbols\pdc.sys\4003A61925000\pdc.sys
  1808. Image path: \SystemRoot\system32\drivers\pdc.sys
  1809. Image name: pdc.sys
  1810. Timestamp: Tue Jan 13 08:02:33 2004 (4003A619)
  1811. CheckSum: 00023068
  1812. ImageSize: 00025000
  1813. File version: 10.0.16281.1000
  1814. Product version: 10.0.16281.1000
  1815. File flags: 0 (Mask 3F)
  1816. File OS: 40004 NT Win32
  1817. File type: 3.7 Driver
  1818. File date: 00000000.00000000
  1819. Translations: 0000.04b0
  1820. CompanyName: Microsoft Corporation
  1821. ProductName: Microsoft® Windows® Operating System
  1822. InternalName: pdc.sys
  1823. OriginalFilename: pdc.sys
  1824. ProductVersion: 10.0.16281.1000
  1825. FileVersion: 10.0.16281.1000 (WinBuild.160101.0800)
  1826. FileDescription: Power Dependency Coordinator Driver
  1827. LegalCopyright: © Microsoft Corporation. All rights reserved.
  1828. fffff805`14660000 fffff805`14679000 CEA (deferred)
  1829. Mapped memory image file: c:\symbols\CEA.sys\CE9B9DFB19000\CEA.sys
  1830. Image path: \SystemRoot\system32\drivers\CEA.sys
  1831. Image name: CEA.sys
  1832. Timestamp: ***** Invalid (CE9B9DFB)
  1833. CheckSum: 00014C22
  1834. ImageSize: 00019000
  1835. File version: 10.0.16273.1000
  1836. Product version: 10.0.16273.1000
  1837. File flags: 0 (Mask 3F)
  1838. File OS: 40004 NT Win32
  1839. File type: 2.0 Dll
  1840. File date: 00000000.00000000
  1841. Translations: 0409.04b0
  1842. CompanyName: Microsoft Corporation
  1843. ProductName: Microsoft® Windows® Operating System
  1844. InternalName: EventAggregation.sys
  1845. OriginalFilename: EventAggregation.sys
  1846. ProductVersion: 10.0.16273.1000
  1847. FileVersion: 10.0.16273.1000 (WinBuild.160101.0800)
  1848. FileDescription: Event Aggregation Kernel Mode Library
  1849. LegalCopyright: © Microsoft Corporation. All rights reserved.
  1850. fffff805`14680000 fffff805`146ad000 partmgr (deferred)
  1851. Mapped memory image file: c:\symbols\partmgr.sys\0902AE712d000\partmgr.sys
  1852. Image path: \SystemRoot\System32\drivers\partmgr.sys
  1853. Image name: partmgr.sys
  1854. Timestamp: Wed Oct 16 16:51:13 1974 (0902AE71)
  1855. CheckSum: 0002AF94
  1856. ImageSize: 0002D000
  1857. File version: 10.0.16288.1
  1858. Product version: 10.0.16288.1
  1859. File flags: 0 (Mask 3F)
  1860. File OS: 40004 NT Win32
  1861. File type: 3.7 Driver
  1862. File date: 00000000.00000000
  1863. Translations: 0000.04b0
  1864. CompanyName: Microsoft Corporation
  1865. ProductName: Microsoft® Windows® Operating System
  1866. InternalName: partmgr.sys
  1867. OriginalFilename: partmgr.sys
  1868. ProductVersion: 10.0.16288.1
  1869. FileVersion: 10.0.16288.1 (WinBuild.160101.0800)
  1870. FileDescription: Partition driver
  1871. LegalCopyright: © Microsoft Corporation. All rights reserved.
  1872. fffff805`146b0000 fffff805`146e9000 cm_km (deferred)
  1873. Image path: \SystemRoot\system32\DRIVERS\cm_km.sys
  1874. Image name: cm_km.sys
  1875. Timestamp: Thu Dec 15 07:43:48 2016 (585249B4)
  1876. CheckSum: 0003DF46
  1877. ImageSize: 00039000
  1878. Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
  1879. fffff805`146f0000 fffff805`14780000 spaceport (deferred)
  1880. Image path: \SystemRoot\System32\drivers\spaceport.sys
  1881. Image name: spaceport.sys
  1882. Timestamp: Thu Jul 23 20:29:16 2020 (5F19E50C)
  1883. CheckSum: 0008D5EC
  1884. ImageSize: 00090000
  1885. Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
  1886. fffff805`14780000 fffff805`14799000 volmgr (deferred)
  1887. Mapped memory image file: c:\symbols\volmgr.sys\B0634E7119000\volmgr.sys
  1888. Image path: \SystemRoot\System32\drivers\volmgr.sys
  1889. Image name: volmgr.sys
  1890. Timestamp: ***** Invalid (B0634E71)
  1891. CheckSum: 000205D7
  1892. ImageSize: 00019000
  1893. File version: 10.0.16273.1000
  1894. Product version: 10.0.16273.1000
  1895. File flags: 0 (Mask 3F)
  1896. File OS: 40004 NT Win32
  1897. File type: 3.7 Driver
  1898. File date: 00000000.00000000
  1899. Translations: 0409.04b0
  1900. CompanyName: Microsoft Corporation
  1901. ProductName: Microsoft® Windows® Operating System
  1902. InternalName: volmgr.sys
  1903. OriginalFilename: volmgr.sys
  1904. ProductVersion: 10.0.16273.1000
  1905. FileVersion: 10.0.16273.1000 (WinBuild.160101.0800)
  1906. FileDescription: Volume Manager Driver
  1907. LegalCopyright: © Microsoft Corporation. All rights reserved.
  1908. fffff805`147a0000 fffff805`147fe000 volmgrx (deferred)
  1909. Mapped memory image file: c:\symbols\volmgrx.sys\BD8710A65e000\volmgrx.sys
  1910. Image path: \SystemRoot\System32\drivers\volmgrx.sys
  1911. Image name: volmgrx.sys
  1912. Timestamp: ***** Invalid (BD8710A6)
  1913. CheckSum: 0005CD83
  1914. ImageSize: 0005E000
  1915. File version: 10.0.16273.1000
  1916. Product version: 10.0.16273.1000
  1917. File flags: 0 (Mask 3F)
  1918. File OS: 40004 NT Win32
  1919. File type: 3.7 Driver
  1920. File date: 00000000.00000000
  1921. Translations: 0409.04b0
  1922. CompanyName: Microsoft Corporation
  1923. ProductName: Microsoft® Windows® Operating System
  1924. InternalName: volmgrx.sys
  1925. OriginalFilename: volmgrx.sys
  1926. ProductVersion: 10.0.16273.1000
  1927. FileVersion: 10.0.16273.1000 (WinBuild.160101.0800)
  1928. FileDescription: Volume Manager Extension Driver
  1929. LegalCopyright: © Microsoft Corporation. All rights reserved.
  1930. fffff805`14800000 fffff805`1481e000 mountmgr (deferred)
  1931. Image path: \SystemRoot\System32\drivers\mountmgr.sys
  1932. Image name: mountmgr.sys
  1933. Timestamp: ***** Invalid (ADA090FE)
  1934. CheckSum: 00021E13
  1935. ImageSize: 0001E000
  1936. Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
  1937. fffff805`14820000 fffff805`1482f000 klbackupdisk (deferred)
  1938. Image path: \SystemRoot\system32\DRIVERS\klbackupdisk.sys
  1939. Image name: klbackupdisk.sys
  1940. Timestamp: Wed Dec 7 09:11:58 2016 (5847D25E)
  1941. CheckSum: 0001925B
  1942. ImageSize: 0000F000
  1943. Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
  1944. fffff805`14830000 fffff805`14853000 secnvme (deferred)
  1945. Image path: \SystemRoot\System32\drivers\secnvme.sys
  1946. Image name: secnvme.sys
  1947. Timestamp: Fri Mar 17 06:03:34 2017 (58CB7C36)
  1948. CheckSum: 00030180
  1949. ImageSize: 00023000
  1950. Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
  1951. fffff805`14860000 fffff805`148ee000 storport (deferred)
  1952. Image path: \SystemRoot\System32\drivers\storport.sys
  1953. Image name: storport.sys
  1954. Timestamp: ***** Invalid (E9CDBFC5)
  1955. CheckSum: 0008D5D6
  1956. ImageSize: 0008E000
  1957. Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
  1958. fffff805`148f0000 fffff805`1490c000 EhStorClass (deferred)
  1959. Mapped memory image file: c:\symbols\EhStorClass.sys\6D0AE02C1c000\EhStorClass.sys
  1960. Image path: \SystemRoot\System32\drivers\EhStorClass.sys
  1961. Image name: EhStorClass.sys
  1962. Timestamp: Tue Dec 21 22:48:12 2027 (6D0AE02C)
  1963. CheckSum: 00018DBA
  1964. ImageSize: 0001C000
  1965. File version: 10.0.16273.1000
  1966. Product version: 10.0.16273.1000
  1967. File flags: 0 (Mask 3F)
  1968. File OS: 40004 NT Win32
  1969. File type: 3.7 Driver
  1970. File date: 00000000.00000000
  1971. Translations: 0409.04b0
  1972. CompanyName: Microsoft Corporation
  1973. ProductName: Microsoft® Windows® Operating System
  1974. InternalName: EhStorClass.sys
  1975. OriginalFilename: EhStorClass.sys
  1976. ProductVersion: 10.0.16273.1000
  1977. FileVersion: 10.0.16273.1000 (WinBuild.160101.0800)
  1978. FileDescription: Enhanced Storage Class driver for IEEE 1667 devices
  1979. LegalCopyright: © Microsoft Corporation. All rights reserved.
  1980. fffff805`14910000 fffff805`1492a000 fileinfo (deferred)
  1981. Mapped memory image file: c:\symbols\fileinfo.sys\19C047731a000\fileinfo.sys
  1982. Image path: \SystemRoot\System32\drivers\fileinfo.sys
  1983. Image name: fileinfo.sys
  1984. Timestamp: Sat Sep 10 09:46:43 1983 (19C04773)
  1985. CheckSum: 0001BEBA
  1986. ImageSize: 0001A000
  1987. File version: 10.0.16273.1000
  1988. Product version: 10.0.16273.1000
  1989. File flags: 0 (Mask 3F)
  1990. File OS: 40004 NT Win32
  1991. File type: 3.7 Driver
  1992. File date: 00000000.00000000
  1993. Translations: 0409.04b0
  1994. CompanyName: Microsoft Corporation
  1995. ProductName: Microsoft® Windows® Operating System
  1996. InternalName: FileInfo.sys
  1997. OriginalFilename: FileInfo.sys
  1998. ProductVersion: 10.0.16273.1000
  1999. FileVersion: 10.0.16273.1000 (WinBuild.160101.0800)
  2000. FileDescription: FileInfo Filter Driver
  2001. LegalCopyright: © Microsoft Corporation. All rights reserved.
  2002. fffff805`14930000 fffff805`1496b000 Wof (deferred)
  2003. Mapped memory image file: c:\symbols\Wof.sys\F9D43CDF3b000\Wof.sys
  2004. Image path: \SystemRoot\System32\Drivers\Wof.sys
  2005. Image name: Wof.sys
  2006. Timestamp: ***** Invalid (F9D43CDF)
  2007. CheckSum: 00034094
  2008. ImageSize: 0003B000
  2009. File version: 10.0.16288.1
  2010. Product version: 10.0.16288.1
  2011. File flags: 0 (Mask 3F)
  2012. File OS: 40004 NT Win32
  2013. File type: 3.7 Driver
  2014. File date: 00000000.00000000
  2015. Translations: 0409.04b0
  2016. CompanyName: Microsoft Corporation
  2017. ProductName: Microsoft® Windows® Operating System
  2018. InternalName: wof.sys
  2019. OriginalFilename: wof.sys
  2020. ProductVersion: 10.0.16288.1
  2021. FileVersion: 10.0.16288.1 (WinBuild.160101.0800)
  2022. FileDescription: Windows Overlay Filter
  2023. LegalCopyright: © Microsoft Corporation. All rights reserved.
  2024. fffff805`14970000 fffff805`14bc6000 NTFS (deferred)
  2025. Image path: \SystemRoot\System32\Drivers\NTFS.sys
  2026. Image name: NTFS.sys
  2027. Timestamp: Tue Nov 17 21:12:44 2037 (7FADEE4C)
  2028. CheckSum: 00259123
  2029. ImageSize: 00256000
  2030. Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
  2031. fffff805`14bd0000 fffff805`14be3000 rcbottom (deferred)
  2032. Image path: \SystemRoot\System32\drivers\rcbottom.sys
  2033. Image name: rcbottom.sys
  2034. Timestamp: Tue Mar 28 14:34:05 2017 (58DA664D)
  2035. CheckSum: 0001EFCB
  2036. ImageSize: 00013000
  2037. Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
  2038. fffff805`14bf0000 fffff805`14df5000 rcraid (deferred)
  2039. Image path: \SystemRoot\System32\drivers\rcraid.sys
  2040. Image name: rcraid.sys
  2041. Timestamp: Tue Mar 28 14:37:02 2017 (58DA66FE)
  2042. CheckSum: 00081861
  2043. ImageSize: 00205000
  2044. Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
  2045. fffff805`14e00000 fffff805`14e0d000 Fs_Rec (deferred)
  2046. Mapped memory image file: c:\symbols\Fs_Rec.sys\1F94F6F0d000\Fs_Rec.sys
  2047. Image path: \SystemRoot\System32\Drivers\Fs_Rec.sys
  2048. Image name: Fs_Rec.sys
  2049. Timestamp: Thu Oct 16 15:17:20 1986 (1F94F6F0)
  2050. CheckSum: 0001071A
  2051. ImageSize: 0000D000
  2052. File version: 10.0.16273.1000
  2053. Product version: 10.0.16273.1000
  2054. File flags: 0 (Mask 3F)
  2055. File OS: 40004 NT Win32
  2056. File type: 3.7 Driver
  2057. File date: 00000000.00000000
  2058. Translations: 0409.04b0
  2059. CompanyName: Microsoft Corporation
  2060. ProductName: Microsoft® Windows® Operating System
  2061. InternalName: fs_rec.sys
  2062. OriginalFilename: fs_rec.sys
  2063. ProductVersion: 10.0.16273.1000
  2064. FileVersion: 10.0.16273.1000 (WinBuild.160101.0800)
  2065. FileDescription: File System Recognizer Driver
  2066. LegalCopyright: © Microsoft Corporation. All rights reserved.
  2067. fffff805`14e10000 fffff805`14f4f000 ndis (deferred)
  2068. Mapped memory image file: c:\symbols\ndis.sys\AF6C505313f000\ndis.sys
  2069. Image path: \SystemRoot\system32\drivers\ndis.sys
  2070. Image name: ndis.sys
  2071. Timestamp: ***** Invalid (AF6C5053)
  2072. CheckSum: 00144092
  2073. ImageSize: 0013F000
  2074. File version: 10.0.16288.1
  2075. Product version: 10.0.16288.1
  2076. File flags: 0 (Mask 3F)
  2077. File OS: 40004 NT Win32
  2078. File type: 3.6 Driver
  2079. File date: 00000000.00000000
  2080. Translations: 0409.04b0
  2081. CompanyName: Microsoft Corporation
  2082. ProductName: Microsoft® Windows® Operating System
  2083. InternalName: NDIS.SYS
  2084. OriginalFilename: NDIS.SYS
  2085. ProductVersion: 10.0.16288.1
  2086. FileVersion: 10.0.16288.1 (WinBuild.160101.0800)
  2087. FileDescription: Network Driver Interface Specification (NDIS)
  2088. LegalCopyright: © Microsoft Corporation. All rights reserved.
  2089. fffff805`14f50000 fffff805`14fd8000 NETIO (deferred)
  2090. Mapped memory image file: c:\symbols\NETIO.SYS\302C3E5D88000\NETIO.SYS
  2091. Image path: \SystemRoot\system32\drivers\NETIO.SYS
  2092. Image name: NETIO.SYS
  2093. Timestamp: Sat Aug 12 06:38:37 1995 (302C3E5D)
  2094. CheckSum: 0008F95B
  2095. ImageSize: 00088000
  2096. File version: 10.0.16273.1000
  2097. Product version: 10.0.16273.1000
  2098. File flags: 0 (Mask 3F)
  2099. File OS: 40004 NT Win32
  2100. File type: 3.6 Driver
  2101. File date: 00000000.00000000
  2102. Translations: 0409.04b0
  2103. CompanyName: Microsoft Corporation
  2104. ProductName: Microsoft® Windows® Operating System
  2105. InternalName: netio.sys
  2106. OriginalFilename: netio.sys
  2107. ProductVersion: 10.0.16273.1000
  2108. FileVersion: 10.0.16273.1000 (WinBuild.160101.0800)
  2109. FileDescription: Network I/O Subsystem
  2110. LegalCopyright: © Microsoft Corporation. All rights reserved.
  2111. fffff805`14fe0000 fffff805`15010000 ksecpkg (deferred)
  2112. Mapped memory image file: c:\symbols\ksecpkg.sys\A2D0764A30000\ksecpkg.sys
  2113. Image path: \SystemRoot\System32\Drivers\ksecpkg.sys
  2114. Image name: ksecpkg.sys
  2115. Timestamp: ***** Invalid (A2D0764A)
  2116. CheckSum: 00033C2E
  2117. ImageSize: 00030000
  2118. File version: 10.0.16273.1000
  2119. Product version: 10.0.16273.1000
  2120. File flags: 0 (Mask 3F)
  2121. File OS: 40004 NT Win32
  2122. File type: 3.7 Driver
  2123. File date: 00000000.00000000
  2124. Translations: 0409.04b0
  2125. CompanyName: Microsoft Corporation
  2126. ProductName: Microsoft® Windows® Operating System
  2127. InternalName: ksecpkg.sys
  2128. OriginalFilename: ksecpkg.sys
  2129. ProductVersion: 10.0.16273.1000
  2130. FileVersion: 10.0.16273.1000 (WinBuild.160101.0800)
  2131. FileDescription: Kernel Security Support Provider Interface Packages
  2132. LegalCopyright: © Microsoft Corporation. All rights reserved.
  2133. fffff805`15010000 fffff805`150c8000 fvevol (deferred)
  2134. Mapped memory image file: c:\symbols\fvevol.sys\2493BBE7b8000\fvevol.sys
  2135. Image path: \SystemRoot\System32\DRIVERS\fvevol.sys
  2136. Image name: fvevol.sys
  2137. Timestamp: Mon Jun 12 14:34:31 1989 (2493BBE7)
  2138. CheckSum: 000BEB94
  2139. ImageSize: 000B8000
  2140. File version: 10.0.16288.1
  2141. Product version: 10.0.16288.1
  2142. File flags: 0 (Mask 3F)
  2143. File OS: 40004 NT Win32
  2144. File type: 3.7 Driver
  2145. File date: 00000000.00000000
  2146. Translations: 0000.04b0
  2147. CompanyName: Microsoft Corporation
  2148. ProductName: Microsoft® Windows® Operating System
  2149. InternalName: FVEVOL.SYS
  2150. OriginalFilename: FVEVOL.SYS
  2151. ProductVersion: 10.0.16288.1
  2152. FileVersion: 10.0.16288.1 (WinBuild.160101.0800)
  2153. FileDescription: BitLocker Drive Encryption Driver
  2154. LegalCopyright: © Microsoft Corporation. All rights reserved.
  2155. fffff805`150d0000 fffff805`15136000 volsnap (deferred)
  2156. Image path: \SystemRoot\System32\drivers\volsnap.sys
  2157. Image name: volsnap.sys
  2158. Timestamp: ***** Invalid (C10D9CA3)
  2159. CheckSum: 00068218
  2160. ImageSize: 00066000
  2161. Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
  2162. fffff805`15160000 fffff805`15183000 acpiex (deferred)
  2163. Mapped memory image file: c:\symbols\acpiex.sys\8F81B54323000\acpiex.sys
  2164. Image path: \SystemRoot\System32\Drivers\acpiex.sys
  2165. Image name: acpiex.sys
  2166. Timestamp: ***** Invalid (8F81B543)
  2167. CheckSum: 00021434
  2168. ImageSize: 00023000
  2169. File version: 10.0.16273.1000
  2170. Product version: 10.0.16273.1000
  2171. File flags: 0 (Mask 3F)
  2172. File OS: 40004 NT Win32
  2173. File type: 2.0 Dll
  2174. File date: 00000000.00000000
  2175. Translations: 0409.04b0
  2176. CompanyName: Microsoft Corporation
  2177. ProductName: Microsoft® Windows® Operating System
  2178. InternalName: acpiex.sys
  2179. OriginalFilename: acpiex.sys
  2180. ProductVersion: 10.0.16273.1000
  2181. FileVersion: 10.0.16273.1000 (WinBuild.160101.0800)
  2182. FileDescription: ACPIEx Driver
  2183. LegalCopyright: © Microsoft Corporation. All rights reserved.
  2184. fffff805`15190000 fffff805`151db000 mssecflt (deferred)
  2185. Image path: \SystemRoot\system32\drivers\mssecflt.sys
  2186. Image name: mssecflt.sys
  2187. Timestamp: Sat Mar 10 11:02:06 2035 (7A9D6CAE)
  2188. CheckSum: 0004A917
  2189. ImageSize: 0004B000
  2190. Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
  2191. fffff805`15200000 fffff805`1524c000 rdyboost (deferred)
  2192. Mapped memory image file: c:\symbols\rdyboost.sys\32E813EE4c000\rdyboost.sys
  2193. Image path: \SystemRoot\System32\drivers\rdyboost.sys
  2194. Image name: rdyboost.sys
  2195. Timestamp: Fri Jan 24 01:44:14 1997 (32E813EE)
  2196. CheckSum: 0004C494
  2197. ImageSize: 0004C000
  2198. File version: 10.0.16273.1000
  2199. Product version: 10.0.16273.1000
  2200. File flags: 0 (Mask 3F)
  2201. File OS: 40004 NT Win32
  2202. File type: 3.7 Driver
  2203. File date: 00000000.00000000
  2204. Translations: 0000.04b0
  2205. CompanyName: Microsoft Corporation
  2206. ProductName: Microsoft® Windows® Operating System
  2207. InternalName: rdyboost.sys
  2208. OriginalFilename: rdyboost.sys
  2209. ProductVersion: 10.0.16273.1000
  2210. FileVersion: 10.0.16273.1000 (WinBuild.160101.0800)
  2211. FileDescription: ReadyBoost Driver
  2212. LegalCopyright: © Microsoft Corporation. All rights reserved.
  2213. fffff805`15250000 fffff805`15502000 tcpip (deferred)
  2214. Mapped memory image file: c:\symbols\tcpip.sys\C818C3B32b2000\tcpip.sys
  2215. Image path: \SystemRoot\System32\drivers\tcpip.sys
  2216. Image name: tcpip.sys
  2217. Timestamp: ***** Invalid (C818C3B3)
  2218. CheckSum: 002A594E
  2219. ImageSize: 002B2000
  2220. File version: 10.0.16288.1
  2221. Product version: 10.0.16288.1
  2222. File flags: 0 (Mask 3F)
  2223. File OS: 40004 NT Win32
  2224. File type: 3.6 Driver
  2225. File date: 00000000.00000000
  2226. Translations: 0409.04b0
  2227. CompanyName: Microsoft Corporation
  2228. ProductName: Microsoft® Windows® Operating System
  2229. InternalName: tcpip.sys
  2230. OriginalFilename: tcpip.sys
  2231. ProductVersion: 10.0.16288.1
  2232. FileVersion: 10.0.16288.1 (WinBuild.160101.0800)
  2233. FileDescription: TCP/IP Driver
  2234. LegalCopyright: © Microsoft Corporation. All rights reserved.
  2235. fffff805`15510000 fffff805`15581000 fwpkclnt (deferred)
  2236. Mapped memory image file: c:\symbols\fwpkclnt.sys\CAEC7F6271000\fwpkclnt.sys
  2237. Image path: \SystemRoot\System32\drivers\fwpkclnt.sys
  2238. Image name: fwpkclnt.sys
  2239. Timestamp: ***** Invalid (CAEC7F62)
  2240. CheckSum: 00074586
  2241. ImageSize: 00071000
  2242. File version: 10.0.16273.1000
  2243. Product version: 10.0.16273.1000
  2244. File flags: 0 (Mask 3F)
  2245. File OS: 40004 NT Win32
  2246. File type: 2.0 Dll
  2247. File date: 00000000.00000000
  2248. Translations: 0409.04b0
  2249. CompanyName: Microsoft Corporation
  2250. ProductName: Microsoft® Windows® Operating System
  2251. InternalName: fwpkclnt.sys
  2252. OriginalFilename: fwpkclnt.sys
  2253. ProductVersion: 10.0.16273.1000
  2254. FileVersion: 10.0.16273.1000 (WinBuild.160101.0800)
  2255. FileDescription: FWP/IPsec Kernel-Mode API
  2256. LegalCopyright: © Microsoft Corporation. All rights reserved.
  2257. fffff805`15590000 fffff805`155bc000 wfplwfs (deferred)
  2258. Mapped memory image file: c:\symbols\wfplwfs.sys\E5844F932c000\wfplwfs.sys
  2259. Image path: \SystemRoot\System32\drivers\wfplwfs.sys
  2260. Image name: wfplwfs.sys
  2261. Timestamp: ***** Invalid (E5844F93)
  2262. CheckSum: 0002CCF4
  2263. ImageSize: 0002C000
  2264. File version: 10.0.16273.1000
  2265. Product version: 10.0.16273.1000
  2266. File flags: 0 (Mask 3F)
  2267. File OS: 40004 NT Win32
  2268. File type: 3.6 Driver
  2269. File date: 00000000.00000000
  2270. Translations: 0000.04b0
  2271. CompanyName: Microsoft Corporation
  2272. ProductName: Microsoft® Windows® Operating System
  2273. InternalName: WFPLWFS.SYS
  2274. OriginalFilename: WFPLWFS.SYS
  2275. ProductVersion: 10.0.16273.1000
  2276. FileVersion: 10.0.16273.1000 (WinBuild.160101.0800)
  2277. FileDescription: WFP NDIS 6.30 Lightweight Filter Driver
  2278. LegalCopyright: © Microsoft Corporation. All rights reserved.
  2279. fffff805`155c0000 fffff805`155d9000 asstahci64 (deferred)
  2280. Image path: \SystemRoot\System32\drivers\asstahci64.sys
  2281. Image name: asstahci64.sys
  2282. Timestamp: Tue May 17 10:38:26 2016 (573AE692)
  2283. CheckSum: 000210CE
  2284. ImageSize: 00019000
  2285. Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
  2286. fffff805`155e0000 fffff805`155eb000 volume (deferred)
  2287. Mapped memory image file: c:\symbols\volume.sys\1C3359ECb000\volume.sys
  2288. Image path: \SystemRoot\System32\drivers\volume.sys
  2289. Image name: volume.sys
  2290. Timestamp: Sat Dec 29 00:16:44 1984 (1C3359EC)
  2291. CheckSum: 0000EC6C
  2292. ImageSize: 0000B000
  2293. File version: 10.0.16246.1000
  2294. Product version: 10.0.16246.1000
  2295. File flags: 0 (Mask 3F)
  2296. File OS: 40004 NT Win32
  2297. File type: 3.7 Driver
  2298. File date: 00000000.00000000
  2299. Translations: 0000.04b0
  2300. CompanyName: Microsoft Corporation
  2301. ProductName: Microsoft® Windows® Operating System
  2302. InternalName: volume.sys
  2303. OriginalFilename: volume.sys
  2304. ProductVersion: 10.0.16246.1000
  2305. FileVersion: 10.0.16246.1000 (WinBuild.160101.0800)
  2306. FileDescription: Volume driver
  2307. LegalCopyright: © Microsoft Corporation. All rights reserved.
  2308. fffff805`155f0000 fffff805`155f8000 pwdrvio (deferred)
  2309. Image path: \SystemRoot\system32\pwdrvio.sys
  2310. Image name: pwdrvio.sys
  2311. Timestamp: Tue Jun 16 02:43:45 2009 (4A36F8D1)
  2312. CheckSum: 000123CB
  2313. ImageSize: 00008000
  2314. Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
  2315. fffff805`15600000 fffff805`15d09000 kl1 (deferred)
  2316. Image path: \SystemRoot\system32\DRIVERS\kl1.sys
  2317. Image name: kl1.sys
  2318. Timestamp: Fri Apr 1 15:20:28 2016 (56FE83AC)
  2319. CheckSum: 0009550A
  2320. ImageSize: 00709000
  2321. Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
  2322. fffff805`15d10000 fffff805`15d21000 iorate (deferred)
  2323. Mapped memory image file: c:\symbols\iorate.sys\6F697C3C11000\iorate.sys
  2324. Image path: \SystemRoot\system32\drivers\iorate.sys
  2325. Image name: iorate.sys
  2326. Timestamp: Mon Mar 26 02:47:40 2029 (6F697C3C)
  2327. CheckSum: 0000E990
  2328. ImageSize: 00011000
  2329. File version: 10.0.16273.1000
  2330. Product version: 10.0.16273.1000
  2331. File flags: 0 (Mask 3F)
  2332. File OS: 40004 NT Win32
  2333. File type: 3.7 Driver
  2334. File date: 00000000.00000000
  2335. Translations: 0409.04b0
  2336. CompanyName: Microsoft Corporation
  2337. ProductName: Microsoft® Windows® Operating System
  2338. InternalName: iorate.sys
  2339. OriginalFilename: iorate.sys
  2340. ProductVersion: 10.0.16273.1000
  2341. FileVersion: 10.0.16273.1000 (WinBuild.160101.0800)
  2342. FileDescription: I/O rate control Filter
  2343. LegalCopyright: © Microsoft Corporation. All rights reserved.
  2344. fffff805`15d40000 fffff805`15d5c000 disk (deferred)
  2345. Mapped memory image file: c:\symbols\disk.sys\C979741E1c000\disk.sys
  2346. Image path: \SystemRoot\System32\drivers\disk.sys
  2347. Image name: disk.sys
  2348. Timestamp: ***** Invalid (C979741E)
  2349. CheckSum: 00019C7D
  2350. ImageSize: 0001C000
  2351. File version: 10.0.16273.1000
  2352. Product version: 10.0.16273.1000
  2353. File flags: 0 (Mask 3F)
  2354. File OS: 40004 NT Win32
  2355. File type: 3.7 Driver
  2356. File date: 00000000.00000000
  2357. Translations: 0000.04b0
  2358. CompanyName: Microsoft Corporation
  2359. ProductName: Microsoft® Windows® Operating System
  2360. InternalName: disk.sys
  2361. OriginalFilename: disk.sys
  2362. ProductVersion: 10.0.16273.1000
  2363. FileVersion: 10.0.16273.1000 (WinBuild.160101.0800)
  2364. FileDescription: PnP Disk Driver
  2365. LegalCopyright: © Microsoft Corporation. All rights reserved.
  2366. fffff805`15d60000 fffff805`15dc8000 CLASSPNP (deferred)
  2367. Mapped memory image file: c:\symbols\CLASSPNP.SYS\BF85BFAE68000\CLASSPNP.SYS
  2368. Image path: \SystemRoot\System32\drivers\CLASSPNP.SYS
  2369. Image name: CLASSPNP.SYS
  2370. Timestamp: ***** Invalid (BF85BFAE)
  2371. CheckSum: 00064E8F
  2372. ImageSize: 00068000
  2373. File version: 10.0.16288.1
  2374. Product version: 10.0.16288.1
  2375. File flags: 0 (Mask 3F)
  2376. File OS: 40004 NT Win32
  2377. File type: 3.7 Driver
  2378. File date: 00000000.00000000
  2379. Translations: 0000.04b0
  2380. CompanyName: Microsoft Corporation
  2381. ProductName: Microsoft® Windows® Operating System
  2382. InternalName: Classpnp.sys
  2383. OriginalFilename: Classpnp.sys
  2384. ProductVersion: 10.0.16288.1
  2385. FileVersion: 10.0.16288.1 (WinBuild.160101.0800)
  2386. FileDescription: SCSI Class System Dll
  2387. LegalCopyright: © Microsoft Corporation. All rights reserved.
  2388. fffff805`15df0000 fffff805`15e0b000 crashdmp (deferred)
  2389. Mapped memory image file: c:\symbols\crashdmp.sys\8DC80A7C1b000\crashdmp.sys
  2390. Image path: \SystemRoot\System32\Drivers\crashdmp.sys
  2391. Image name: crashdmp.sys
  2392. Timestamp: ***** Invalid (8DC80A7C)
  2393. CheckSum: 0002044C
  2394. ImageSize: 0001B000
  2395. File version: 10.0.16273.1000
  2396. Product version: 10.0.16273.1000
  2397. File flags: 0 (Mask 3F)
  2398. File OS: 40004 NT Win32
  2399. File type: 3.7 Driver
  2400. File date: 00000000.00000000
  2401. Translations: 0409.04b0
  2402. CompanyName: Microsoft Corporation
  2403. ProductName: Microsoft® Windows® Operating System
  2404. InternalName: crashdmp.sys
  2405. OriginalFilename: crashdmp.sys
  2406. ProductVersion: 10.0.16273.1000
  2407. FileVersion: 10.0.16273.1000 (WinBuild.160101.0800)
  2408. FileDescription: Crash Dump Driver
  2409. LegalCopyright: © Microsoft Corporation. All rights reserved.
  2410. fffff805`15ed0000 fffff805`15f7e000 klhk (deferred)
  2411. Image path: \SystemRoot\System32\drivers\klhk.sys
  2412. Image name: klhk.sys
  2413. Timestamp: Tue Mar 28 13:43:13 2017 (58DA5A61)
  2414. CheckSum: 00081BB4
  2415. ImageSize: 000AE000
  2416. Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
  2417. fffff805`15f80000 fffff805`15fae000 cdrom (deferred)
  2418. Mapped memory image file: c:\symbols\cdrom.sys\1424F0702e000\cdrom.sys
  2419. Image path: \SystemRoot\System32\drivers\cdrom.sys
  2420. Image name: cdrom.sys
  2421. Timestamp: Tue Sep 16 16:12:48 1980 (1424F070)
  2422. CheckSum: 0002D825
  2423. ImageSize: 0002E000
  2424. File version: 10.0.16273.1000
  2425. Product version: 10.0.16273.1000
  2426. File flags: 0 (Mask 3F)
  2427. File OS: 40004 NT Win32
  2428. File type: 3.7 Driver
  2429. File date: 00000000.00000000
  2430. Translations: 0000.04b0
  2431. CompanyName: Microsoft Corporation
  2432. ProductName: Microsoft® Windows® Operating System
  2433. InternalName: cdrom.sys
  2434. OriginalFilename: cdrom.sys
  2435. ProductVersion: 10.0.16273.1000
  2436. FileVersion: 10.0.16273.1000 (WinBuild.160101.0800)
  2437. FileDescription: SCSI CD-ROM Driver
  2438. LegalCopyright: © Microsoft Corporation. All rights reserved.
  2439. fffff805`15fb0000 fffff805`15fc3000 klbackupflt (deferred)
  2440. Image path: \SystemRoot\system32\DRIVERS\klbackupflt.sys
  2441. Image name: klbackupflt.sys
  2442. Timestamp: Fri Dec 23 11:35:00 2016 (585D0BE4)
  2443. CheckSum: 00024F84
  2444. ImageSize: 00013000
  2445. Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
  2446. fffff805`15fd0000 fffff805`16010000 klflt (deferred)
  2447. Image path: \SystemRoot\system32\DRIVERS\klflt.sys
  2448. Image name: klflt.sys
  2449. Timestamp: Wed Jul 19 13:00:58 2017 (596F49FA)
  2450. CheckSum: 000422FC
  2451. ImageSize: 00040000
  2452. Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
  2453. fffff805`16010000 fffff805`16024000 filecrypt (deferred)
  2454. Mapped memory image file: c:\symbols\filecrypt.sys\518A49BF14000\filecrypt.sys
  2455. Image path: \SystemRoot\system32\drivers\filecrypt.sys
  2456. Image name: filecrypt.sys
  2457. Timestamp: Wed May 8 13:49:03 2013 (518A49BF)
  2458. CheckSum: 00017691
  2459. ImageSize: 00014000
  2460. File version: 10.0.16273.1000
  2461. Product version: 10.0.16273.1000
  2462. File flags: 0 (Mask 3F)
  2463. File OS: 40004 NT Win32
  2464. File type: 3.7 Driver
  2465. File date: 00000000.00000000
  2466. Translations: 0409.04b0
  2467. CompanyName: Microsoft Corporation
  2468. ProductName: Microsoft® Windows® Operating System
  2469. InternalName: filecrypt.sys
  2470. OriginalFilename: filecrypt.sys
  2471. ProductVersion: 10.0.16273.1000
  2472. FileVersion: 10.0.16273.1000 (WinBuild.160101.0800)
  2473. FileDescription: Windows sandboxing and encryption filter
  2474. LegalCopyright: © Microsoft Corporation. All rights reserved.
  2475. fffff805`16030000 fffff805`1603d000 tbs (deferred)
  2476. Mapped memory image file: c:\symbols\tbs.sys\237A7C1Dd000\tbs.sys
  2477. Image path: \SystemRoot\system32\drivers\tbs.sys
  2478. Image name: tbs.sys
  2479. Timestamp: Fri Nov 11 05:35:25 1988 (237A7C1D)
  2480. CheckSum: 0000A0B0
  2481. ImageSize: 0000D000
  2482. File version: 10.0.16273.1000
  2483. Product version: 10.0.16273.1000
  2484. File flags: 0 (Mask 3F)
  2485. File OS: 40004 NT Win32
  2486. File type: 3.7 Driver
  2487. File date: 00000000.00000000
  2488. Translations: 0409.04b0
  2489. CompanyName: Microsoft Corporation
  2490. ProductName: Microsoft® Windows® Operating System
  2491. InternalName: TBS.SYS
  2492. OriginalFilename: TBS.SYS
  2493. ProductVersion: 10.0.16273.1000
  2494. FileVersion: 10.0.16273.1000 (WinBuild.160101.0800)
  2495. FileDescription: Export driver for kernel mode TPM API
  2496. LegalCopyright: © Microsoft Corporation. All rights reserved.
  2497. fffff805`16040000 fffff805`1604b000 klpd (deferred)
  2498. Image path: \SystemRoot\system32\DRIVERS\klpd.sys
  2499. Image name: klpd.sys
  2500. Timestamp: Fri Mar 24 13:44:30 2017 (58D522BE)
  2501. CheckSum: 00014A77
  2502. ImageSize: 0000B000
  2503. Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
  2504. fffff805`16050000 fffff805`16074000 mup (deferred)
  2505. Mapped memory image file: c:\symbols\mup.sys\454D52CC24000\mup.sys
  2506. Image path: \SystemRoot\System32\Drivers\mup.sys
  2507. Image name: mup.sys
  2508. Timestamp: Sun Nov 5 02:56:12 2006 (454D52CC)
  2509. CheckSum: 0002706F
  2510. ImageSize: 00024000
  2511. File version: 10.0.16273.1000
  2512. Product version: 10.0.16273.1000
  2513. File flags: 0 (Mask 3F)
  2514. File OS: 40004 NT Win32
  2515. File type: 3.6 Driver
  2516. File date: 00000000.00000000
  2517. Translations: 0409.04b0
  2518. CompanyName: Microsoft Corporation
  2519. ProductName: Microsoft® Windows® Operating System
  2520. InternalName: MUP.SYS
  2521. OriginalFilename: MUP.SYS
  2522. ProductVersion: 10.0.16273.1000
  2523. FileVersion: 10.0.16273.1000 (WinBuild.160101.0800)
  2524. FileDescription: Multiple UNC Provider Driver
  2525. LegalCopyright: © Microsoft Corporation. All rights reserved.
  2526. fffff805`16080000 fffff805`1609c000 klupd_klif_klbg (deferred)
  2527. Image path: \SystemRoot\System32\Drivers\klupd_klif_klbg.sys
  2528. Image name: klupd_klif_klbg.sys
  2529. Timestamp: Thu Mar 30 15:51:17 2017 (58DD1B65)
  2530. CheckSum: 000234F1
  2531. ImageSize: 0001C000
  2532. Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
  2533. fffff805`160a0000 fffff805`161a7000 klif (deferred)
  2534. Image path: \SystemRoot\system32\DRIVERS\klif.sys
  2535. Image name: klif.sys
  2536. Timestamp: Fri Aug 11 17:04:35 2017 (598DD593)
  2537. CheckSum: 00102372
  2538. ImageSize: 00107000
  2539. Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
  2540. fffff805`161b0000 fffff805`161d3000 tdx (deferred)
  2541. Mapped memory image file: c:\symbols\tdx.sys\0CBC8CF323000\tdx.sys
  2542. Image path: \SystemRoot\system32\DRIVERS\tdx.sys
  2543. Image name: tdx.sys
  2544. Timestamp: Sat Oct 9 05:30:43 1976 (0CBC8CF3)
  2545. CheckSum: 000245BA
  2546. ImageSize: 00023000
  2547. File version: 10.0.16353.1000
  2548. Product version: 10.0.16353.1000
  2549. File flags: 0 (Mask 3F)
  2550. File OS: 40004 NT Win32
  2551. File type: 3.6 Driver
  2552. File date: 00000000.00000000
  2553. Translations: 0409.04b0
  2554. CompanyName: Microsoft Corporation
  2555. ProductName: Microsoft® Windows® Operating System
  2556. InternalName: tdx.sys
  2557. OriginalFilename: tdx.sys
  2558. ProductVersion: 10.0.16353.1000
  2559. FileVersion: 10.0.16353.1000 (WinBuild.160101.0800)
  2560. FileDescription: TDI Translation Driver
  2561. LegalCopyright: © Microsoft Corporation. All rights reserved.
  2562. fffff805`16400000 fffff805`16679000 dxgkrnl (deferred)
  2563. Image path: \SystemRoot\System32\drivers\dxgkrnl.sys
  2564. Image name: dxgkrnl.sys
  2565. Timestamp: Fri Feb 27 12:18:23 2015 (54F0608F)
  2566. CheckSum: 002806CF
  2567. ImageSize: 00279000
  2568. Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
  2569. fffff805`16680000 fffff805`16690000 TDI (deferred)
  2570. Mapped memory image file: c:\symbols\TDI.SYS\1BBDCA2C10000\TDI.SYS
  2571. Image path: \SystemRoot\system32\DRIVERS\TDI.SYS
  2572. Image name: TDI.SYS
  2573. Timestamp: Sun Sep 30 21:08:12 1984 (1BBDCA2C)
  2574. CheckSum: 00018A08
  2575. ImageSize: 00010000
  2576. File version: 10.0.16273.1000
  2577. Product version: 10.0.16273.1000
  2578. File flags: 0 (Mask 3F)
  2579. File OS: 40004 NT Win32
  2580. File type: 3.6 Driver
  2581. File date: 00000000.00000000
  2582. Translations: 0409.04b0
  2583. CompanyName: Microsoft Corporation
  2584. ProductName: Microsoft® Windows® Operating System
  2585. InternalName: tdi.sys
  2586. OriginalFilename: tdi.sys
  2587. ProductVersion: 10.0.16273.1000
  2588. FileVersion: 10.0.16273.1000 (WinBuild.160101.0800)
  2589. FileDescription: TDI Wrapper
  2590. LegalCopyright: © Microsoft Corporation. All rights reserved.
  2591. fffff805`16690000 fffff805`166f8000 ks (deferred)
  2592. Mapped memory image file: c:\symbols\ks.sys\C5B6B46568000\ks.sys
  2593. Image path: \SystemRoot\system32\DRIVERS\ks.sys
  2594. Image name: ks.sys
  2595. Timestamp: ***** Invalid (C5B6B465)
  2596. CheckSum: 00067ECB
  2597. ImageSize: 00068000
  2598. File version: 10.0.16273.1000
  2599. Product version: 10.0.16273.1000
  2600. File flags: 0 (Mask 3F)
  2601. File OS: 40004 NT Win32
  2602. File type: 3.0 Driver
  2603. File date: 00000000.00000000
  2604. Translations: 0000.04b0
  2605. CompanyName: Microsoft Corporation
  2606. ProductName: Microsoft® Windows® Operating System
  2607. InternalName: ks.sys
  2608. OriginalFilename: ks.sys
  2609. ProductVersion: 10.0.16273.1000
  2610. FileVersion: 10.0.16273.1000 (WinBuild.160101.0800)
  2611. FileDescription: Kernel CSA Library
  2612. LegalCopyright: © Microsoft Corporation. All rights reserved.
  2613. fffff805`16700000 fffff805`1670a000 Null (deferred)
  2614. Mapped memory image file: c:\symbols\Null.SYS\E2BC2636a000\Null.SYS
  2615. Image path: \SystemRoot\System32\Drivers\Null.SYS
  2616. Image name: Null.SYS
  2617. Timestamp: ***** Invalid (E2BC2636)
  2618. CheckSum: 00005081
  2619. ImageSize: 0000A000
  2620. File version: 10.0.16262.1001
  2621. Product version: 10.0.16262.1001
  2622. File flags: 0 (Mask 3F)
  2623. File OS: 40004 NT Win32
  2624. File type: 3.7 Driver
  2625. File date: 00000000.00000000
  2626. Translations: 0409.04b0
  2627. CompanyName: Microsoft Corporation
  2628. ProductName: Microsoft® Windows® Operating System
  2629. InternalName: null.sys
  2630. OriginalFilename: null.sys
  2631. ProductVersion: 10.0.16262.1001
  2632. FileVersion: 10.0.16262.1001 (WinBuild.160101.0800)
  2633. FileDescription: NULL Driver
  2634. LegalCopyright: © Microsoft Corporation. All rights reserved.
  2635. fffff805`16710000 fffff805`1671a000 Beep (deferred)
  2636. Mapped memory image file: c:\symbols\Beep.SYS\85F9535Ba000\Beep.SYS
  2637. Image path: \SystemRoot\System32\Drivers\Beep.SYS
  2638. Image name: Beep.SYS
  2639. Timestamp: ***** Invalid (85F9535B)
  2640. CheckSum: 00004277
  2641. ImageSize: 0000A000
  2642. File version: 10.0.16262.1001
  2643. Product version: 10.0.16262.1001
  2644. File flags: 0 (Mask 3F)
  2645. File OS: 40004 NT Win32
  2646. File type: 3.7 Driver
  2647. File date: 00000000.00000000
  2648. Translations: 0409.04b0
  2649. CompanyName: Microsoft Corporation
  2650. ProductName: Microsoft® Windows® Operating System
  2651. InternalName: beep.sys
  2652. OriginalFilename: beep.sys
  2653. ProductVersion: 10.0.16262.1001
  2654. FileVersion: 10.0.16262.1001 (WinBuild.160101.0800)
  2655. FileDescription: BEEP Driver
  2656. LegalCopyright: © Microsoft Corporation. All rights reserved.
  2657. fffff805`16720000 fffff805`16735000 BasicDisplay (deferred)
  2658. Mapped memory image file: c:\symbols\BasicDisplay.sys\D192C74415000\BasicDisplay.sys
  2659. Image path: \SystemRoot\System32\drivers\BasicDisplay.sys
  2660. Image name: BasicDisplay.sys
  2661. Timestamp: ***** Invalid (D192C744)
  2662. CheckSum: 00019DDD
  2663. ImageSize: 00015000
  2664. File version: 10.0.16281.1000
  2665. Product version: 10.0.16281.1000
  2666. File flags: 0 (Mask 3F)
  2667. File OS: 40004 NT Win32
  2668. File type: 3.4 Driver
  2669. File date: 00000000.00000000
  2670. Translations: 0000.04b0
  2671. CompanyName: Microsoft Corporation
  2672. ProductName: Microsoft® Windows® Operating System
  2673. InternalName: BasicDisplay.sys
  2674. OriginalFilename: BasicDisplay.sys
  2675. ProductVersion: 10.0.16281.1000
  2676. FileVersion: 10.0.16281.1000 (WinBuild.160101.0800)
  2677. FileDescription: Microsoft Basic Display Driver
  2678. LegalCopyright: © Microsoft Corporation. All rights reserved.
  2679. fffff805`16740000 fffff805`16754000 watchdog (deferred)
  2680. Mapped memory image file: c:\symbols\watchdog.sys\EE73D2B814000\watchdog.sys
  2681. Image path: \SystemRoot\System32\drivers\watchdog.sys
  2682. Image name: watchdog.sys
  2683. Timestamp: ***** Invalid (EE73D2B8)
  2684. CheckSum: 00011EB8
  2685. ImageSize: 00014000
  2686. File version: 10.0.16273.1000
  2687. Product version: 10.0.16273.1000
  2688. File flags: 0 (Mask 3F)
  2689. File OS: 40004 NT Win32
  2690. File type: 2.0 Dll
  2691. File date: 00000000.00000000
  2692. Translations: 0000.04b0
  2693. CompanyName: Microsoft Corporation
  2694. ProductName: Microsoft® Windows® Operating System
  2695. InternalName: watchdog.sys
  2696. OriginalFilename: watchdog.sys
  2697. ProductVersion: 10.0.16273.1000
  2698. FileVersion: 10.0.16273.1000 (WinBuild.160101.0800)
  2699. FileDescription: Watchdog Driver
  2700. LegalCopyright: © Microsoft Corporation. All rights reserved.
  2701. fffff805`16760000 fffff805`1677a000 vmbkmclr (deferred)
  2702. Mapped memory image file: c:\symbols\vmbkmclr.sys\3FDEFDB51a000\vmbkmclr.sys
  2703. Image path: \SystemRoot\System32\drivers\vmbkmclr.sys
  2704. Image name: vmbkmclr.sys
  2705. Timestamp: Tue Dec 16 12:42:29 2003 (3FDEFDB5)
  2706. CheckSum: 000142E8
  2707. ImageSize: 0001A000
  2708. File version: 10.0.16273.1000
  2709. Product version: 10.0.16273.1000
  2710. File flags: 0 (Mask 3F)
  2711. File OS: 40004 NT Win32
  2712. File type: 3.7 Driver
  2713. File date: 00000000.00000000
  2714. Translations: 0409.04b0
  2715. CompanyName: Microsoft Corporation
  2716. ProductName: Microsoft® Windows® Operating System
  2717. InternalName: vmbkmclr.sys
  2718. OriginalFilename: vmbkmclr.sys
  2719. ProductVersion: 10.0.16273.1000
  2720. FileVersion: 10.0.16273.1000 (WinBuild.160101.0800)
  2721. FileDescription: Hyper-V VMBus Root KMCL
  2722. LegalCopyright: © Microsoft Corporation. All rights reserved.
  2723. fffff805`16780000 fffff805`16790000 BasicRender (deferred)
  2724. Mapped memory image file: c:\symbols\BasicRender.sys\6849FB6910000\BasicRender.sys
  2725. Image path: \SystemRoot\System32\drivers\BasicRender.sys
  2726. Image name: BasicRender.sys
  2727. Timestamp: Wed Jun 11 22:55:53 2025 (6849FB69)
  2728. CheckSum: 00011E03
  2729. ImageSize: 00010000
  2730. File version: 10.0.16273.1000
  2731. Product version: 10.0.16273.1000
  2732. File flags: 0 (Mask 3F)
  2733. File OS: 40004 NT Win32
  2734. File type: 3.4 Driver
  2735. File date: 00000000.00000000
  2736. Translations: 0000.04b0
  2737. CompanyName: Microsoft Corporation
  2738. ProductName: Microsoft® Windows® Operating System
  2739. InternalName: BasicRender.sys
  2740. OriginalFilename: BasicRender.sys
  2741. ProductVersion: 10.0.16273.1000
  2742. FileVersion: 10.0.16273.1000 (WinBuild.160101.0800)
  2743. FileDescription: Microsoft Basic Render Driver
  2744. LegalCopyright: © Microsoft Corporation. All rights reserved.
  2745. fffff805`16790000 fffff805`167ab000 Npfs (deferred)
  2746. Mapped memory image file: c:\symbols\Npfs.SYS\1A9900EF1b000\Npfs.SYS
  2747. Image path: \SystemRoot\System32\Drivers\Npfs.SYS
  2748. Image name: Npfs.SYS
  2749. Timestamp: Tue Feb 21 18:07:43 1984 (1A9900EF)
  2750. CheckSum: 000205EE
  2751. ImageSize: 0001B000
  2752. File version: 10.0.16278.1000
  2753. Product version: 10.0.16278.1000
  2754. File flags: 0 (Mask 3F)
  2755. File OS: 40004 NT Win32
  2756. File type: 3.7 Driver
  2757. File date: 00000000.00000000
  2758. Translations: 0409.04b0
  2759. CompanyName: Microsoft Corporation
  2760. ProductName: Microsoft® Windows® Operating System
  2761. InternalName: npfs.sys
  2762. OriginalFilename: npfs.sys
  2763. ProductVersion: 10.0.16278.1000
  2764. FileVersion: 10.0.16278.1000 (WinBuild.160101.0800)
  2765. FileDescription: NPFS Driver
  2766. LegalCopyright: © Microsoft Corporation. All rights reserved.
  2767. fffff805`167b0000 fffff805`167c0000 Msfs (deferred)
  2768. Mapped memory image file: c:\symbols\Msfs.SYS\B74D7D9A10000\Msfs.SYS
  2769. Image path: \SystemRoot\System32\Drivers\Msfs.SYS
  2770. Image name: Msfs.SYS
  2771. Timestamp: ***** Invalid (B74D7D9A)
  2772. CheckSum: 000103E6
  2773. ImageSize: 00010000
  2774. File version: 10.0.16273.1000
  2775. Product version: 10.0.16273.1000
  2776. File flags: 0 (Mask 3F)
  2777. File OS: 40004 NT Win32
  2778. File type: 3.7 Driver
  2779. File date: 00000000.00000000
  2780. Translations: 0409.04b0
  2781. CompanyName: Microsoft Corporation
  2782. ProductName: Microsoft® Windows® Operating System
  2783. InternalName: MSFS.SYS
  2784. OriginalFilename: MSFS.SYS
  2785. ProductVersion: 10.0.16273.1000
  2786. FileVersion: 10.0.16273.1000 (WinBuild.160101.0800)
  2787. FileDescription: Mailslot driver
  2788. LegalCopyright: © Microsoft Corporation. All rights reserved.
  2789. fffff805`167c0000 fffff805`167fd000 amdpsp (deferred)
  2790. Image path: \SystemRoot\system32\DRIVERS\amdpsp.sys
  2791. Image name: amdpsp.sys
  2792. Timestamp: Mon Jun 5 22:23:56 2017 (5935CBEC)
  2793. CheckSum: 000428AD
  2794. ImageSize: 0003D000
  2795. Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
  2796. fffff805`16800000 fffff805`16812000 netbios (deferred)
  2797. Mapped memory image file: c:\symbols\netbios.sys\1AF6149412000\netbios.sys
  2798. Image path: \SystemRoot\system32\drivers\netbios.sys
  2799. Image name: netbios.sys
  2800. Timestamp: Wed May 2 09:32:20 1984 (1AF61494)
  2801. CheckSum: 0001A463
  2802. ImageSize: 00012000
  2803. File version: 10.0.16273.1000
  2804. Product version: 10.0.16273.1000
  2805. File flags: 0 (Mask 3F)
  2806. File OS: 40004 NT Win32
  2807. File type: 3.6 Driver
  2808. File date: 00000000.00000000
  2809. Translations: 0409.04b0
  2810. CompanyName: Microsoft Corporation
  2811. ProductName: Microsoft® Windows® Operating System
  2812. InternalName: NETBIOS.SYS
  2813. OriginalFilename: NETBIOS.SYS
  2814. ProductVersion: 10.0.16273.1000
  2815. FileVersion: 10.0.16273.1000 (WinBuild.160101.0800)
  2816. FileDescription: NetBIOS interface driver
  2817. LegalCopyright: © Microsoft Corporation. All rights reserved.
  2818. fffff805`16820000 fffff805`16893000 rdbss (deferred)
  2819. Mapped memory image file: c:\symbols\rdbss.sys\E1D1CEAA73000\rdbss.sys
  2820. Image path: \SystemRoot\system32\DRIVERS\rdbss.sys
  2821. Image name: rdbss.sys
  2822. Timestamp: ***** Invalid (E1D1CEAA)
  2823. CheckSum: 00077CB6
  2824. ImageSize: 00073000
  2825. File version: 10.0.16288.1
  2826. Product version: 10.0.16288.1
  2827. File flags: 0 (Mask 3F)
  2828. File OS: 40004 NT Win32
  2829. File type: 3.7 Driver
  2830. File date: 00000000.00000000
  2831. Translations: 0409.04b0
  2832. CompanyName: Microsoft Corporation
  2833. ProductName: Microsoft® Windows® Operating System
  2834. InternalName: rdbss.sys
  2835. OriginalFilename: RDBSS.Sys
  2836. ProductVersion: 10.0.16288.1
  2837. FileVersion: 10.0.16288.1 (WinBuild.160101.0800)
  2838. FileDescription: Redirected Drive Buffering SubSystem Driver
  2839. LegalCopyright: © Microsoft Corporation. All rights reserved.
  2840. fffff805`168a0000 fffff805`1692f000 csc (deferred)
  2841. Mapped memory image file: c:\symbols\csc.sys\9EFA102F8f000\csc.sys
  2842. Image path: \SystemRoot\system32\drivers\csc.sys
  2843. Image name: csc.sys
  2844. Timestamp: ***** Invalid (9EFA102F)
  2845. CheckSum: 000932EF
  2846. ImageSize: 0008F000
  2847. File version: 10.0.16273.1000
  2848. Product version: 10.0.16273.1000
  2849. File flags: 0 (Mask 3F)
  2850. File OS: 40004 NT Win32
  2851. File type: 3.7 Driver
  2852. File date: 00000000.00000000
  2853. Translations: 0409.04b0
  2854. CompanyName: Microsoft Corporation
  2855. ProductName: Microsoft® Windows® Operating System
  2856. InternalName: csc.sys
  2857. OriginalFilename: CSC.Sys
  2858. ProductVersion: 10.0.16273.1000
  2859. FileVersion: 10.0.16273.1000 (WinBuild.160101.0800)
  2860. FileDescription: Windows Client Side Caching Driver
  2861. LegalCopyright: © Microsoft Corporation. All rights reserved.
  2862. fffff805`16930000 fffff805`16960000 VBoxUSBMon (deferred)
  2863. Image path: \SystemRoot\system32\DRIVERS\VBoxUSBMon.sys
  2864. Image name: VBoxUSBMon.sys
  2865. Timestamp: Wed Sep 13 10:04:22 2017 (59B8F496)
  2866. CheckSum: 0002D60A
  2867. ImageSize: 00030000
  2868. Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
  2869. fffff805`16960000 fffff805`16a59000 VBoxDrv (deferred)
  2870. Image path: \SystemRoot\system32\DRIVERS\VBoxDrv.sys
  2871. Image name: VBoxDrv.sys
  2872. Timestamp: Wed Sep 13 10:04:22 2017 (59B8F496)
  2873. CheckSum: 000F10CB
  2874. ImageSize: 000F9000
  2875. Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
  2876. fffff805`16a60000 fffff805`16a72000 nsiproxy (deferred)
  2877. Image path: \SystemRoot\system32\drivers\nsiproxy.sys
  2878. Image name: nsiproxy.sys
  2879. Timestamp: ***** Invalid (955A981E)
  2880. CheckSum: 00019605
  2881. ImageSize: 00012000
  2882. Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
  2883. fffff805`16a80000 fffff805`16a8d000 npsvctrig (deferred)
  2884. Mapped memory image file: c:\symbols\npsvctrig.sys\BCBD5B64d000\npsvctrig.sys
  2885. Image path: \SystemRoot\System32\drivers\npsvctrig.sys
  2886. Image name: npsvctrig.sys
  2887. Timestamp: ***** Invalid (BCBD5B64)
  2888. CheckSum: 0000CF41
  2889. ImageSize: 0000D000
  2890. File version: 10.0.16273.1000
  2891. Product version: 10.0.16273.1000
  2892. File flags: 0 (Mask 3F)
  2893. File OS: 40004 NT Win32
  2894. File type: 3.7 Driver
  2895. File date: 00000000.00000000
  2896. Translations: 0409.04b0
  2897. CompanyName: Microsoft Corporation
  2898. ProductName: Microsoft® Windows® Operating System
  2899. InternalName: npsvctrig.sys
  2900. OriginalFilename: npsvctrig.sys
  2901. ProductVersion: 10.0.16273.1000
  2902. FileVersion: 10.0.16273.1000 (WinBuild.160101.0800)
  2903. FileDescription: Named pipe service triggers
  2904. LegalCopyright: © Microsoft Corporation. All rights reserved.
  2905. fffff805`16a90000 fffff805`16a9f000 mssmbios (deferred)
  2906. Mapped memory image file: c:\symbols\mssmbios.sys\34839A22f000\mssmbios.sys
  2907. Image path: \SystemRoot\System32\drivers\mssmbios.sys
  2908. Image name: mssmbios.sys
  2909. Timestamp: Tue Dec 2 05:18:26 1997 (34839A22)
  2910. CheckSum: 000147F2
  2911. ImageSize: 0000F000
  2912. File version: 10.0.16273.1000
  2913. Product version: 10.0.16273.1000
  2914. File flags: 0 (Mask 3F)
  2915. File OS: 40004 NT Win32
  2916. File type: 3.7 Driver
  2917. File date: 00000000.00000000
  2918. Translations: 0409.04b0
  2919. CompanyName: Microsoft Corporation
  2920. ProductName: Microsoft® Windows® Operating System
  2921. InternalName: smbios.sys
  2922. OriginalFilename: smbios.sys
  2923. ProductVersion: 10.0.16273.1000
  2924. FileVersion: 10.0.16273.1000 (WinBuild.160101.0800)
  2925. FileDescription: System Management BIOS Driver
  2926. LegalCopyright: © Microsoft Corporation. All rights reserved.
  2927. fffff805`16aa0000 fffff805`16acd000 kneps (deferred)
  2928. Image path: \SystemRoot\system32\DRIVERS\kneps.sys
  2929. Image name: kneps.sys
  2930. Timestamp: Wed Jun 7 10:54:05 2017 (5937CD3D)
  2931. CheckSum: 0003FEA6
  2932. ImageSize: 0002D000
  2933. Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
  2934. fffff805`16b00000 fffff805`16b0a000 gpuenergydrv (deferred)
  2935. Mapped memory image file: c:\symbols\gpuenergydrv.sys\4E8D39D4a000\gpuenergydrv.sys
  2936. Image path: \SystemRoot\System32\drivers\gpuenergydrv.sys
  2937. Image name: gpuenergydrv.sys
  2938. Timestamp: Thu Oct 6 06:17:08 2011 (4E8D39D4)
  2939. CheckSum: 0000C3FE
  2940. ImageSize: 0000A000
  2941. File version: 10.0.16273.1000
  2942. Product version: 10.0.16273.1000
  2943. File flags: 0 (Mask 3F)
  2944. File OS: 40004 NT Win32
  2945. File type: 3.7 Driver
  2946. File date: 00000000.00000000
  2947. Translations: 0409.04b0
  2948. CompanyName: Microsoft Corporation
  2949. ProductName: Microsoft® Windows® Operating System
  2950. InternalName: gpuenergydrv.sys
  2951. OriginalFilename: gpuenergydrv.sys
  2952. ProductVersion: 10.0.16273.1000
  2953. FileVersion: 10.0.16273.1000 (WinBuild.160101.0800)
  2954. FileDescription: GPU Energy Kernel Driver
  2955. LegalCopyright: © Microsoft Corporation. All rights reserved.
  2956. fffff805`16b10000 fffff805`16b3a000 dfsc (deferred)
  2957. Mapped memory image file: c:\symbols\dfsc.sys\94C5D3E22a000\dfsc.sys
  2958. Image path: \SystemRoot\System32\Drivers\dfsc.sys
  2959. Image name: dfsc.sys
  2960. Timestamp: ***** Invalid (94C5D3E2)
  2961. CheckSum: 0002D468
  2962. ImageSize: 0002A000
  2963. File version: 10.0.16273.1000
  2964. Product version: 10.0.16273.1000
  2965. File flags: 0 (Mask 3F)
  2966. File OS: 40004 NT Win32
  2967. File type: 3.7 Driver
  2968. File date: 00000000.00000000
  2969. Translations: 0409.04b0
  2970. CompanyName: Microsoft Corporation
  2971. ProductName: Microsoft® Windows® Operating System
  2972. InternalName: dfsclient.sys
  2973. OriginalFilename: dfsclient.sys
  2974. ProductVersion: 10.0.16273.1000
  2975. FileVersion: 10.0.16273.1000 (WinBuild.160101.0800)
  2976. FileDescription: DFS Namespace Client Driver
  2977. LegalCopyright: © Microsoft Corporation. All rights reserved.
  2978. fffff805`16b60000 fffff805`16b74000 bam (deferred)
  2979. Mapped memory image file: c:\symbols\bam.sys\0CD64A3A14000\bam.sys
  2980. Image path: \SystemRoot\system32\drivers\bam.sys
  2981. Image name: bam.sys
  2982. Timestamp: Thu Oct 28 18:04:58 1976 (0CD64A3A)
  2983. CheckSum: 0001B21F
  2984. ImageSize: 00014000
  2985. File version: 10.0.16288.1
  2986. Product version: 10.0.16288.1
  2987. File flags: 0 (Mask 3F)
  2988. File OS: 40004 NT Win32
  2989. File type: 3.7 Driver
  2990. File date: 00000000.00000000
  2991. Translations: 0409.04b0
  2992. CompanyName: Microsoft Corporation
  2993. ProductName: Microsoft® Windows® Operating System
  2994. InternalName: bam.sys
  2995. OriginalFilename: bam.sys
  2996. ProductVersion: 10.0.16288.1
  2997. FileVersion: 10.0.16288.1 (WinBuild.160101.0800)
  2998. FileDescription: BAM Kernel Driver
  2999. LegalCopyright: © Microsoft Corporation. All rights reserved.
  3000. fffff805`16b80000 fffff805`16bc2000 ahcache (deferred)
  3001. Mapped memory image file: c:\symbols\ahcache.sys\D84C012D42000\ahcache.sys
  3002. Image path: \SystemRoot\system32\DRIVERS\ahcache.sys
  3003. Image name: ahcache.sys
  3004. Timestamp: ***** Invalid (D84C012D)
  3005. CheckSum: 0003BC67
  3006. ImageSize: 00042000
  3007. File version: 10.0.16278.1000
  3008. Product version: 10.0.16278.1000
  3009. File flags: 0 (Mask 3F)
  3010. File OS: 40004 NT Win32
  3011. File type: 3.7 Driver
  3012. File date: 00000000.00000000
  3013. Translations: 0409.04b0
  3014. CompanyName: Microsoft Corporation
  3015. ProductName: Microsoft® Windows® Operating System
  3016. InternalName: ahcache.sys
  3017. OriginalFilename: ahcache.sys
  3018. ProductVersion: 10.0.16278.1000
  3019. FileVersion: 10.0.16278.1000 (WinBuild.160101.0800)
  3020. FileDescription: Application Compatibility Cache
  3021. LegalCopyright: © Microsoft Corporation. All rights reserved.
  3022. fffff805`16bd0000 fffff805`16c0e000 VBoxNetAdp6 (deferred)
  3023. Image path: \SystemRoot\System32\drivers\VBoxNetAdp6.sys
  3024. Image name: VBoxNetAdp6.sys
  3025. Timestamp: Wed Sep 13 10:04:22 2017 (59B8F496)
  3026. CheckSum: 0003E509
  3027. ImageSize: 0003E000
  3028. Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
  3029. fffff805`16c10000 fffff805`16c1c000 kltap (deferred)
  3030. Image path: \SystemRoot\System32\drivers\kltap.sys
  3031. Image name: kltap.sys
  3032. Timestamp: Mon May 16 22:04:28 2016 (573A35DC)
  3033. CheckSum: 0000FCAA
  3034. ImageSize: 0000C000
  3035. Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
  3036. fffff805`16c20000 fffff805`16c31000 CompositeBus (deferred)
  3037. Mapped memory image file: c:\symbols\CompositeBus.sys\3D0FA01A11000\CompositeBus.sys
  3038. Image path: \SystemRoot\System32\DriverStore\FileRepository\compositebus.inf_amd64_164ab490b1c4a422\CompositeBus.sys
  3039. Image name: CompositeBus.sys
  3040. Timestamp: Tue Jun 18 22:03:22 2002 (3D0FA01A)
  3041. CheckSum: 000128FE
  3042. ImageSize: 00011000
  3043. File version: 10.0.16262.1001
  3044. Product version: 10.0.16262.1001
  3045. File flags: 0 (Mask 3F)
  3046. File OS: 40004 NT Win32
  3047. File type: 2.0 Dll
  3048. File date: 00000000.00000000
  3049. Translations: 0409.04b0
  3050. CompanyName: Microsoft Corporation
  3051. ProductName: Microsoft® Windows® Operating System
  3052. InternalName: compositebus.sys
  3053. OriginalFilename: compositebus.sys
  3054. ProductVersion: 10.0.16262.1001
  3055. FileVersion: 10.0.16262.1001 (WinBuild.160101.0800)
  3056. FileDescription: Multi-Transport Composite Bus Enumerator
  3057. LegalCopyright: © Microsoft Corporation. All rights reserved.
  3058. fffff805`16c40000 fffff805`16c4b000 serscan (deferred)
  3059. Mapped memory image file: c:\symbols\serscan.sys\D5242713b000\serscan.sys
  3060. Image path: \SystemRoot\system32\DRIVERS\serscan.sys
  3061. Image name: serscan.sys
  3062. Timestamp: ***** Invalid (D5242713)
  3063. CheckSum: 00012978
  3064. ImageSize: 0000B000
  3065. File version: 10.0.16262.1001
  3066. Product version: 10.0.16262.1001
  3067. File flags: 0 (Mask 3F)
  3068. File OS: 40004 NT Win32
  3069. File type: 3.7 Driver
  3070. File date: 00000000.00000000
  3071. Translations: 0409.04b0
  3072. CompanyName: Microsoft Corporation
  3073. ProductName: Microsoft® Windows® Operating System
  3074. InternalName: serscan.sys
  3075. OriginalFilename: serscan.sys
  3076. ProductVersion: 10.0.16262.1001
  3077. FileVersion: 10.0.16262.1001 (WinBuild.160101.0800)
  3078. FileDescription: Serial Imaging Device Driver
  3079. LegalCopyright: © Microsoft Corporation. All rights reserved.
  3080. fffff805`16c50000 fffff805`16c5f000 ksthunk (deferred)
  3081. Mapped memory image file: c:\symbols\ksthunk.sys\3E950951f000\ksthunk.sys
  3082. Image path: \SystemRoot\system32\drivers\ksthunk.sys
  3083. Image name: ksthunk.sys
  3084. Timestamp: Thu Apr 10 07:04:01 2003 (3E950951)
  3085. CheckSum: 0000D4C7
  3086. ImageSize: 0000F000
  3087. File version: 10.0.16273.1000
  3088. Product version: 10.0.16273.1000
  3089. File flags: 0 (Mask 3F)
  3090. File OS: 40004 NT Win32
  3091. File type: 3.0 Driver
  3092. File date: 00000000.00000000
  3093. Translations: 0409.04b0
  3094. CompanyName: Microsoft Corporation
  3095. ProductName: Microsoft® Windows® Operating System
  3096. InternalName: ksthunk.sys
  3097. OriginalFilename: ksthunk.sys
  3098. ProductVersion: 10.0.16273.1000
  3099. FileVersion: 10.0.16273.1000 (WinBuild.160101.0800)
  3100. FileDescription: Kernel Streaming WOW Thunk Service
  3101. LegalCopyright: © Microsoft Corporation. All rights reserved.
  3102. fffff805`16c60000 fffff805`16c6d000 kdnic (deferred)
  3103. Mapped memory image file: c:\symbols\kdnic.sys\E91C9C29d000\kdnic.sys
  3104. Image path: \SystemRoot\System32\drivers\kdnic.sys
  3105. Image name: kdnic.sys
  3106. Timestamp: ***** Invalid (E91C9C29)
  3107. CheckSum: 0000A619
  3108. ImageSize: 0000D000
  3109. File version: 6.1.0.0
  3110. Product version: 6.1.0.0
  3111. File flags: 0 (Mask 3F)
  3112. File OS: 40004 NT Win32
  3113. File type: 3.7 Driver
  3114. File date: 00000000.00000000
  3115. Translations: 0000.04b0
  3116. CompanyName: Microsoft Corporation
  3117. ProductName: Microsoft Kernel Debugger Network Adapter (NDIS 6.20 Miniport)
  3118. InternalName: kdnic.sys
  3119. OriginalFilename: kdnic.sys
  3120. ProductVersion: 6.01.00.0000
  3121. FileVersion: 6.01.00.0000 (WinBuild.160101.0800)
  3122. FileDescription: Microsoft Kernel Debugger Network Miniport
  3123. LegalCopyright: Copyright (C) Microsoft Corporation. All rights reserved.
  3124. fffff805`16c70000 fffff805`16c85000 umbus (deferred)
  3125. Mapped memory image file: c:\symbols\umbus.sys\6E2974CF15000\umbus.sys
  3126. Image path: \SystemRoot\System32\drivers\umbus.sys
  3127. Image name: umbus.sys
  3128. Timestamp: Wed Jul 26 08:50:39 2028 (6E2974CF)
  3129. CheckSum: 0001CDDF
  3130. ImageSize: 00015000
  3131. File version: 10.0.16262.1001
  3132. Product version: 10.0.16262.1001
  3133. File flags: 0 (Mask 3F)
  3134. File OS: 40004 NT Win32
  3135. File type: 2.0 Dll
  3136. File date: 00000000.00000000
  3137. Translations: 0409.04b0
  3138. CompanyName: Microsoft Corporation
  3139. ProductName: Microsoft® Windows® Operating System
  3140. InternalName: umbus.sys
  3141. OriginalFilename: umbus.sys
  3142. ProductVersion: 10.0.16262.1001
  3143. FileVersion: 10.0.16262.1001 (WinBuild.160101.0800)
  3144. FileDescription: User-Mode Bus Enumerator
  3145. LegalCopyright: © Microsoft Corporation. All rights reserved.
  3146. fffff805`16c90000 fffff805`16d00000 USBXHCI (deferred)
  3147. Mapped memory image file: c:\symbols\USBXHCI.SYS\EF002EB670000\USBXHCI.SYS
  3148. Image path: \SystemRoot\System32\drivers\USBXHCI.SYS
  3149. Image name: USBXHCI.SYS
  3150. Timestamp: ***** Invalid (EF002EB6)
  3151. CheckSum: 00079368
  3152. ImageSize: 00070000
  3153. File version: 10.0.16281.1000
  3154. Product version: 10.0.16281.1000
  3155. File flags: 0 (Mask 3F)
  3156. File OS: 40004 NT Win32
  3157. File type: 3.7 Driver
  3158. File date: 00000000.00000000
  3159. Translations: 0409.04b0
  3160. CompanyName: Microsoft Corporation
  3161. ProductName: Microsoft® Windows® Operating System
  3162. InternalName: usbxhci.sys
  3163. OriginalFilename: usbxhci.sys
  3164. ProductVersion: 10.0.16281.1000
  3165. FileVersion: 10.0.16281.1000 (WinBuild.160101.0800)
  3166. FileDescription: USB XHCI Driver
  3167. LegalCopyright: © Microsoft Corporation. All rights reserved.
  3168. fffff805`16d00000 fffff805`16d3c000 ucx01000 (deferred)
  3169. Mapped memory image file: c:\symbols\ucx01000.sys\A2A8C6AD3c000\ucx01000.sys
  3170. Image path: \SystemRoot\system32\drivers\ucx01000.sys
  3171. Image name: ucx01000.sys
  3172. Timestamp: ***** Invalid (A2A8C6AD)
  3173. CheckSum: 0003B0B9
  3174. ImageSize: 0003C000
  3175. File version: 10.0.16273.1000
  3176. Product version: 10.0.16273.1000
  3177. File flags: 0 (Mask 3F)
  3178. File OS: 40004 NT Win32
  3179. File type: 3.7 Driver
  3180. File date: 00000000.00000000
  3181. Translations: 0409.04b0
  3182. CompanyName: Microsoft Corporation
  3183. ProductName: Microsoft® Windows® Operating System
  3184. InternalName: ucx01000.sys
  3185. OriginalFilename: ucx01000.sys
  3186. ProductVersion: 10.0.16273.1000
  3187. FileVersion: 10.0.16273.1000 (WinBuild.160101.0800)
  3188. FileDescription: USB Controller Extension
  3189. LegalCopyright: © Microsoft Corporation. All rights reserved.
  3190. fffff805`16d40000 fffff805`16d4a000 rccfg (deferred)
  3191. Image path: \SystemRoot\System32\drivers\rccfg.sys
  3192. Image name: rccfg.sys
  3193. Timestamp: Tue Mar 28 14:34:19 2017 (58DA665B)
  3194. CheckSum: 0000E708
  3195. ImageSize: 0000A000
  3196. Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
  3197. fffff805`17210000 fffff805`17266000 netbt (deferred)
  3198. Mapped memory image file: c:\symbols\netbt.sys\39FA0BBD56000\netbt.sys
  3199. Image path: \SystemRoot\System32\DRIVERS\netbt.sys
  3200. Image name: netbt.sys
  3201. Timestamp: Sat Oct 28 00:11:57 2000 (39FA0BBD)
  3202. CheckSum: 000552E5
  3203. ImageSize: 00056000
  3204. File version: 10.0.16288.1
  3205. Product version: 10.0.16288.1
  3206. File flags: 0 (Mask 3F)
  3207. File OS: 40004 NT Win32
  3208. File type: 3.7 Driver
  3209. File date: 00000000.00000000
  3210. Translations: 0409.04b0
  3211. CompanyName: Microsoft Corporation
  3212. ProductName: Microsoft® Windows® Operating System
  3213. InternalName: netbt.sys
  3214. OriginalFilename: netbt.sys
  3215. ProductVersion: 10.0.16288.1
  3216. FileVersion: 10.0.16288.1 (WinBuild.160101.0800)
  3217. FileDescription: MBT Transport driver
  3218. LegalCopyright: © Microsoft Corporation. All rights reserved.
  3219. fffff805`17270000 fffff805`17286000 klwfp (deferred)
  3220. Image path: \SystemRoot\system32\DRIVERS\klwfp.sys
  3221. Image name: klwfp.sys
  3222. Timestamp: Tue Nov 29 10:32:02 2016 (583D5922)
  3223. CheckSum: 0001703E
  3224. ImageSize: 00016000
  3225. Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
  3226. fffff805`17290000 fffff805`1732b000 afd (deferred)
  3227. Mapped memory image file: c:\symbols\afd.sys\AE5DA66C9b000\afd.sys
  3228. Image path: \SystemRoot\system32\drivers\afd.sys
  3229. Image name: afd.sys
  3230. Timestamp: ***** Invalid (AE5DA66C)
  3231. CheckSum: 0009FAC5
  3232. ImageSize: 0009B000
  3233. File version: 10.0.16273.1000
  3234. Product version: 10.0.16273.1000
  3235. File flags: 0 (Mask 3F)
  3236. File OS: 40004 NT Win32
  3237. File type: 3.7 Driver
  3238. File date: 00000000.00000000
  3239. Translations: 0409.04b0
  3240. CompanyName: Microsoft Corporation
  3241. ProductName: Microsoft® Windows® Operating System
  3242. InternalName: afd.sys
  3243. OriginalFilename: afd.sys
  3244. ProductVersion: 10.0.16273.1000
  3245. FileVersion: 10.0.16273.1000 (WinBuild.160101.0800)
  3246. FileDescription: Ancillary Function Driver for WinSock
  3247. LegalCopyright: © Microsoft Corporation. All rights reserved.
  3248. fffff805`17330000 fffff805`1733c000 klim6 (deferred)
  3249. Image path: \SystemRoot\system32\DRIVERS\klim6.sys
  3250. Image name: klim6.sys
  3251. Timestamp: Fri Sep 30 14:35:20 2016 (57EE6A18)
  3252. CheckSum: 0001BB70
  3253. ImageSize: 0000C000
  3254. Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
  3255. fffff805`17340000 fffff805`17381000 VBoxNetLwf (deferred)
  3256. Image path: \SystemRoot\system32\DRIVERS\VBoxNetLwf.sys
  3257. Image name: VBoxNetLwf.sys
  3258. Timestamp: Wed Sep 13 10:04:22 2017 (59B8F496)
  3259. CheckSum: 0003AE93
  3260. ImageSize: 00041000
  3261. Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
  3262. fffff805`17390000 fffff805`173aa000 vwififlt (deferred)
  3263. Mapped memory image file: c:\symbols\vwififlt.sys\F55574E71a000\vwififlt.sys
  3264. Image path: \SystemRoot\System32\drivers\vwififlt.sys
  3265. Image name: vwififlt.sys
  3266. Timestamp: ***** Invalid (F55574E7)
  3267. CheckSum: 00016A95
  3268. ImageSize: 0001A000
  3269. File version: 10.0.16273.1000
  3270. Product version: 10.0.16273.1000
  3271. File flags: 0 (Mask 3F)
  3272. File OS: 40004 NT Win32
  3273. File type: 3.6 Driver
  3274. File date: 00000000.00000000
  3275. Translations: 0000.04b0
  3276. CompanyName: Microsoft Corporation
  3277. ProductName: Microsoft® Windows® Operating System
  3278. InternalName: vwififlt.sys
  3279. OriginalFilename: vwififlt.sys
  3280. ProductVersion: 10.0.16273.1000
  3281. FileVersion: 10.0.16273.1000 (WinBuild.160101.0800)
  3282. FileDescription: Virtual WiFi Filter Driver
  3283. LegalCopyright: © Microsoft Corporation. All rights reserved.
  3284. fffff805`173b0000 fffff805`173d9000 pacer (deferred)
  3285. Mapped memory image file: c:\symbols\pacer.sys\5053745729000\pacer.sys
  3286. Image path: \SystemRoot\System32\drivers\pacer.sys
  3287. Image name: pacer.sys
  3288. Timestamp: Fri Sep 14 19:15:51 2012 (50537457)
  3289. CheckSum: 00025DF7
  3290. ImageSize: 00029000
  3291. File version: 10.0.16273.1000
  3292. Product version: 10.0.16273.1000
  3293. File flags: 0 (Mask 3F)
  3294. File OS: 40004 NT Win32
  3295. File type: 3.6 Driver
  3296. File date: 00000000.00000000
  3297. Translations: 0409.04b0
  3298. CompanyName: Microsoft Corporation
  3299. ProductName: Microsoft® Windows® Operating System
  3300. InternalName: pacer.sys
  3301. OriginalFilename: pacer.sys
  3302. ProductVersion: 10.0.16273.1000
  3303. FileVersion: 10.0.16273.1000 (WinBuild.160101.0800)
  3304. FileDescription: QoS Packet Scheduler
  3305. LegalCopyright: © Microsoft Corporation. All rights reserved.
  3306. fffff805`173e0000 fffff805`17400000 klwtp (deferred)
  3307. Image path: \SystemRoot\system32\DRIVERS\klwtp.sys
  3308. Image name: klwtp.sys
  3309. Timestamp: Fri Mar 24 13:45:50 2017 (58D5230E)
  3310. CheckSum: 0002607B
  3311. ImageSize: 00020000
  3312. Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
  3313. fffff805`17c00000 fffff805`17c87000 e1r65x64 (deferred)
  3314. Image path: \SystemRoot\system32\DRIVERS\e1r65x64.sys
  3315. Image name: e1r65x64.sys
  3316. Timestamp: Sat Jul 30 08:56:48 2016 (579C5DC0)
  3317. CheckSum: 00088915
  3318. ImageSize: 00087000
  3319. Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
  3320. fffff805`17c90000 fffff805`17d15000 atikmpag (deferred)
  3321. Image path: \SystemRoot\System32\DriverStore\FileRepository\c0318192.inf_amd64_d0f929f3a19ab987\atikmpag.sys
  3322. Image name: atikmpag.sys
  3323. Timestamp: Tue Sep 19 00:02:19 2017 (59C0507B)
  3324. CheckSum: 0008D373
  3325. ImageSize: 00085000
  3326. Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
  3327. fffff805`17d20000 fffff805`17d67000 srvnet (deferred)
  3328. Mapped memory image file: c:\symbols\srvnet.sys\0AF3550547000\srvnet.sys
  3329. Image path: \SystemRoot\System32\DRIVERS\srvnet.sys
  3330. Image name: srvnet.sys
  3331. Timestamp: Tue Oct 28 09:06:13 1975 (0AF35505)
  3332. CheckSum: 00043080
  3333. ImageSize: 00047000
  3334. File version: 10.0.16288.1
  3335. Product version: 10.0.16288.1
  3336. File flags: 0 (Mask 3F)
  3337. File OS: 40004 NT Win32
  3338. File type: 3.6 Driver
  3339. File date: 00000000.00000000
  3340. Translations: 0409.04b0
  3341. CompanyName: Microsoft Corporation
  3342. ProductName: Microsoft® Windows® Operating System
  3343. InternalName: SRVNET.SYS
  3344. OriginalFilename: SRVNET.SYS
  3345. ProductVersion: 10.0.16288.1
  3346. FileVersion: 10.0.16288.1 (WinBuild.160101.0800)
  3347. FileDescription: Server Network driver
  3348. LegalCopyright: © Microsoft Corporation. All rights reserved.
  3349. fffff805`17d70000 fffff805`17dbe000 mrxsmb10 (deferred)
  3350. Mapped memory image file: c:\symbols\mrxsmb10.sys\4BEADCED4e000\mrxsmb10.sys
  3351. Image path: \SystemRoot\system32\DRIVERS\mrxsmb10.sys
  3352. Image name: mrxsmb10.sys
  3353. Timestamp: Wed May 12 17:53:01 2010 (4BEADCED)
  3354. CheckSum: 00048977
  3355. ImageSize: 0004E000
  3356. File version: 10.0.16288.1
  3357. Product version: 10.0.16288.1
  3358. File flags: 0 (Mask 3F)
  3359. File OS: 40004 NT Win32
  3360. File type: 3.7 Driver
  3361. File date: 00000000.00000000
  3362. Translations: 0409.04b0
  3363. CompanyName: Microsoft Corporation
  3364. ProductName: Microsoft® Windows® Operating System
  3365. InternalName: MRxSmb0.sys
  3366. OriginalFilename: MRXSMB0.Sys
  3367. ProductVersion: 10.0.16288.1
  3368. FileVersion: 10.0.16288.1 (WinBuild.160101.0800)
  3369. FileDescription: Longhorn SMB Downlevel SubRdr
  3370. LegalCopyright: © Microsoft Corporation. All rights reserved.
  3371. fffff805`17dc0000 fffff805`17e81000 peauth (deferred)
  3372. Image path: \SystemRoot\system32\drivers\peauth.sys
  3373. Image name: peauth.sys
  3374. Timestamp: Tue Oct 28 05:03:18 2014 (544F2396)
  3375. CheckSum: 000B8888
  3376. ImageSize: 000C1000
  3377. Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
  3378. fffff805`17e90000 fffff805`17f49000 srv2 (deferred)
  3379. Mapped memory image file: c:\symbols\srv2.sys\F3EF8D9Db9000\srv2.sys
  3380. Image path: \SystemRoot\System32\DRIVERS\srv2.sys
  3381. Image name: srv2.sys
  3382. Timestamp: ***** Invalid (F3EF8D9D)
  3383. CheckSum: 000C0CE9
  3384. ImageSize: 000B9000
  3385. File version: 10.0.16288.1
  3386. Product version: 10.0.16288.1
  3387. File flags: 0 (Mask 3F)
  3388. File OS: 40004 NT Win32
  3389. File type: 3.6 Driver
  3390. File date: 00000000.00000000
  3391. Translations: 0409.04b0
  3392. CompanyName: Microsoft Corporation
  3393. ProductName: Microsoft® Windows® Operating System
  3394. InternalName: SRV2.SYS
  3395. OriginalFilename: SRV2.SYS
  3396. ProductVersion: 10.0.16288.1
  3397. FileVersion: 10.0.16288.1 (WinBuild.160101.0800)
  3398. FileDescription: Smb 2.0 Server driver
  3399. LegalCopyright: © Microsoft Corporation. All rights reserved.
  3400. fffff805`17f50000 fffff805`17f63000 tcpipreg (deferred)
  3401. Mapped memory image file: c:\symbols\tcpipreg.sys\5B8D9A4813000\tcpipreg.sys
  3402. Image path: \SystemRoot\System32\drivers\tcpipreg.sys
  3403. Image name: tcpipreg.sys
  3404. Timestamp: Mon Sep 3 21:32:08 2018 (5B8D9A48)
  3405. CheckSum: 0000DBDA
  3406. ImageSize: 00013000
  3407. File version: 10.0.16273.1000
  3408. Product version: 10.0.16273.1000
  3409. File flags: 0 (Mask 3F)
  3410. File OS: 40004 NT Win32
  3411. File type: 1.0 App
  3412. File date: 00000000.00000000
  3413. Translations: 0409.04b0
  3414. CompanyName: Microsoft Corporation
  3415. ProductName: Microsoft® Windows® Operating System
  3416. InternalName: tcpipreg.sys
  3417. OriginalFilename: tcpipreg.sys
  3418. ProductVersion: 10.0.16273.1000
  3419. FileVersion: 10.0.16273.1000 (WinBuild.160101.0800)
  3420. FileDescription: TCP/IP Registry Compatibility Driver
  3421. LegalCopyright: © Microsoft Corporation. All rights reserved.
  3422. fffff805`17f70000 fffff805`18000000 srv (deferred)
  3423. Mapped memory image file: c:\symbols\srv.sys\2C44A55390000\srv.sys
  3424. Image path: \SystemRoot\System32\DRIVERS\srv.sys
  3425. Image name: srv.sys
  3426. Timestamp: Thu Jul 15 01:31:15 1993 (2C44A553)
  3427. CheckSum: 00075884
  3428. ImageSize: 00090000
  3429. File version: 10.0.16288.1
  3430. Product version: 10.0.16288.1
  3431. File flags: 0 (Mask 3F)
  3432. File OS: 40004 NT Win32
  3433. File type: 3.6 Driver
  3434. File date: 00000000.00000000
  3435. Translations: 0409.04b0
  3436. CompanyName: Microsoft Corporation
  3437. ProductName: Microsoft® Windows® Operating System
  3438. InternalName: SRV.SYS
  3439. OriginalFilename: SRV.SYS
  3440. ProductVersion: 10.0.16288.1
  3441. FileVersion: 10.0.16288.1 (WinBuild.160101.0800)
  3442. FileDescription: Server driver
  3443. LegalCopyright: © Microsoft Corporation. All rights reserved.
  3444. fffff805`18000000 fffff805`1801b000 rassstp (deferred)
  3445. Mapped memory image file: c:\symbols\rassstp.sys\D487583C1b000\rassstp.sys
  3446. Image path: \SystemRoot\System32\drivers\rassstp.sys
  3447. Image name: rassstp.sys
  3448. Timestamp: ***** Invalid (D487583C)
  3449. CheckSum: 0001E748
  3450. ImageSize: 0001B000
  3451. File version: 10.0.16273.1000
  3452. Product version: 10.0.16273.1000
  3453. File flags: 0 (Mask 3F)
  3454. File OS: 40004 NT Win32
  3455. File type: 3.6 Driver
  3456. File date: 00000000.00000000
  3457. Translations: 0409.04b0
  3458. CompanyName: Microsoft Corporation
  3459. ProductName: Microsoft® Windows® Operating System
  3460. InternalName: rassstp.sys
  3461. OriginalFilename: rassstp.sys
  3462. ProductVersion: 10.0.16273.1000
  3463. FileVersion: 10.0.16273.1000 (WinBuild.160101.0800)
  3464. FileDescription: RAS SSTP Miniport Call Manager
  3465. LegalCopyright: © Microsoft Corporation. All rights reserved.
  3466. fffff805`18020000 fffff805`18036000 NDProxy (deferred)
  3467. Mapped memory image file: c:\symbols\NDProxy.sys\B13FCE4516000\NDProxy.sys
  3468. Image path: \SystemRoot\System32\DRIVERS\NDProxy.sys
  3469. Image name: NDProxy.sys
  3470. Timestamp: ***** Invalid (B13FCE45)
  3471. CheckSum: 00011FA8
  3472. ImageSize: 00016000
  3473. File version: 10.0.16273.1000
  3474. Product version: 10.0.16273.1000
  3475. File flags: 0 (Mask 3F)
  3476. File OS: 40004 NT Win32
  3477. File type: 3.7 Driver
  3478. File date: 00000000.00000000
  3479. Translations: 0409.04b0
  3480. CompanyName: Microsoft Corporation
  3481. ProductName: Microsoft® Windows® Operating System
  3482. InternalName: ndproxy.sys
  3483. OriginalFilename: ndproxy.sys
  3484. ProductVersion: 10.0.16273.1000
  3485. FileVersion: 10.0.16273.1000 (WinBuild.160101.0800)
  3486. FileDescription: NDIS Proxy
  3487. LegalCopyright: © Microsoft Corporation. All rights reserved.
  3488. fffff805`18040000 fffff805`18067000 AgileVpn (deferred)
  3489. Mapped memory image file: c:\symbols\AgileVpn.sys\BDD34C6E27000\AgileVpn.sys
  3490. Image path: \SystemRoot\System32\drivers\AgileVpn.sys
  3491. Image name: AgileVpn.sys
  3492. Timestamp: ***** Invalid (BDD34C6E)
  3493. CheckSum: 0002991F
  3494. ImageSize: 00027000
  3495. File version: 10.0.16273.1000
  3496. Product version: 10.0.16273.1000
  3497. File flags: 0 (Mask 3F)
  3498. File OS: 40004 NT Win32
  3499. File type: 3.6 Driver
  3500. File date: 00000000.00000000
  3501. Translations: 0409.04b0
  3502. CompanyName: Microsoft Corporation
  3503. ProductName: Microsoft® Windows® Operating System
  3504. InternalName: agilevpn.sys
  3505. OriginalFilename: agilevpn.sys
  3506. ProductVersion: 10.0.16273.1000
  3507. FileVersion: 10.0.16273.1000 (WinBuild.160101.0800)
  3508. FileDescription: RAS Agile Vpn Miniport Call Manager
  3509. LegalCopyright: © Microsoft Corporation. All rights reserved.
  3510. fffff805`18070000 fffff805`18090000 rasl2tp (deferred)
  3511. Mapped memory image file: c:\symbols\rasl2tp.sys\EDECEF5F20000\rasl2tp.sys
  3512. Image path: \SystemRoot\System32\drivers\rasl2tp.sys
  3513. Image name: rasl2tp.sys
  3514. Timestamp: ***** Invalid (EDECEF5F)
  3515. CheckSum: 0001F99D
  3516. ImageSize: 00020000
  3517. File version: 10.0.16273.1000
  3518. Product version: 10.0.16273.1000
  3519. File flags: 0 (Mask 3F)
  3520. File OS: 40004 NT Win32
  3521. File type: 3.6 Driver
  3522. File date: 00000000.00000000
  3523. Translations: 0409.04b0
  3524. CompanyName: Microsoft Corporation
  3525. ProductName: Microsoft® Windows® Operating System
  3526. InternalName: rasl2tp.sys
  3527. OriginalFilename: rasl2tp.sys
  3528. ProductVersion: 10.0.16273.1000
  3529. FileVersion: 10.0.16273.1000 (WinBuild.160101.0800)
  3530. FileDescription: RAS L2TP mini-port/call-manager driver
  3531. LegalCopyright: © Microsoft Corporation. All rights reserved.
  3532. fffff805`18090000 fffff805`180af000 raspptp (deferred)
  3533. Mapped memory image file: c:\symbols\raspptp.sys\30102AA91f000\raspptp.sys
  3534. Image path: \SystemRoot\System32\drivers\raspptp.sys
  3535. Image name: raspptp.sys
  3536. Timestamp: Fri Jul 21 23:31:05 1995 (30102AA9)
  3537. CheckSum: 00022328
  3538. ImageSize: 0001F000
  3539. File version: 10.0.16273.1000
  3540. Product version: 10.0.16273.1000
  3541. File flags: 0 (Mask 3F)
  3542. File OS: 40004 NT Win32
  3543. File type: 3.6 Driver
  3544. File date: 00000000.00000000
  3545. Translations: 0409.04b0
  3546. CompanyName: Microsoft Corporation
  3547. ProductName: Microsoft® Windows® Operating System
  3548. InternalName: RASPPTP.SYS
  3549. OriginalFilename: RASPPTP.SYS
  3550. ProductVersion: 10.0.16273.1000
  3551. FileVersion: 10.0.16273.1000 (WinBuild.160101.0800)
  3552. FileDescription: Peer-to-Peer Tunneling Protocol
  3553. LegalCopyright: © Microsoft Corporation. All rights reserved.
  3554. fffff805`180b0000 fffff805`180cb000 raspppoe (deferred)
  3555. Mapped memory image file: c:\symbols\raspppoe.sys\A080D0BE1b000\raspppoe.sys
  3556. Image path: \SystemRoot\System32\DRIVERS\raspppoe.sys
  3557. Image name: raspppoe.sys
  3558. Timestamp: ***** Invalid (A080D0BE)
  3559. CheckSum: 0001E766
  3560. ImageSize: 0001B000
  3561. File version: 10.0.16262.1001
  3562. Product version: 10.0.16262.1001
  3563. File flags: 0 (Mask 3F)
  3564. File OS: 40004 NT Win32
  3565. File type: 3.6 Driver
  3566. File date: 00000000.00000000
  3567. Translations: 0409.04b0
  3568. CompanyName: Microsoft Corporation
  3569. ProductName: Microsoft® Windows® Operating System
  3570. InternalName: raspppoe.sys
  3571. OriginalFilename: raspppoe.sys
  3572. ProductVersion: 10.0.16262.1001
  3573. FileVersion: 10.0.16262.1001 (WinBuild.160101.0800)
  3574. FileDescription: RAS PPPoE mini-port/call-manager driver
  3575. LegalCopyright: © Microsoft Corporation. All rights reserved.
  3576. fffff805`180d0000 fffff805`18107000 ndiswan (deferred)
  3577. Mapped memory image file: c:\symbols\ndiswan.sys\F58EC2FA37000\ndiswan.sys
  3578. Image path: \SystemRoot\System32\drivers\ndiswan.sys
  3579. Image name: ndiswan.sys
  3580. Timestamp: ***** Invalid (F58EC2FA)
  3581. CheckSum: 00034D9C
  3582. ImageSize: 00037000
  3583. File version: 10.0.16273.1000
  3584. Product version: 10.0.16273.1000
  3585. File flags: 0 (Mask 3F)
  3586. File OS: 40004 NT Win32
  3587. File type: 3.6 Driver
  3588. File date: 00000000.00000000
  3589. Translations: 0409.04b0
  3590. CompanyName: Microsoft Corporation
  3591. ProductName: Microsoft® Windows® Operating System
  3592. InternalName: NDISWAN.SYS
  3593. OriginalFilename: NDISWAN.SYS
  3594. ProductVersion: 10.0.16273.1000
  3595. FileVersion: 10.0.16273.1000 (WinBuild.160101.0800)
  3596. FileDescription: MS PPP Framing Driver (Strong Encryption)
  3597. LegalCopyright: © Microsoft Corporation. All rights reserved.
  3598. fffff805`18110000 fffff805`1813b000 ibtusb (deferred)
  3599. Image path: \SystemRoot\system32\DRIVERS\ibtusb.sys
  3600. Image name: ibtusb.sys
  3601. Timestamp: Wed Jun 21 21:09:28 2017 (594AD278)
  3602. CheckSum: 00035259
  3603. ImageSize: 0002B000
  3604. Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
  3605. fffff805`18140000 fffff805`1815c000 BTHUSB (deferred)
  3606. Mapped memory image file: c:\symbols\BTHUSB.sys\84C1E1731c000\BTHUSB.sys
  3607. Image path: \SystemRoot\system32\DRIVERS\BTHUSB.sys
  3608. Image name: BTHUSB.sys
  3609. Timestamp: ***** Invalid (84C1E173)
  3610. CheckSum: 000170CA
  3611. ImageSize: 0001C000
  3612. File version: 10.0.16288.1
  3613. Product version: 10.0.16288.1
  3614. File flags: 0 (Mask 3F)
  3615. File OS: 40004 NT Win32
  3616. File type: 2.0 Dll
  3617. File date: 00000000.00000000
  3618. Translations: 0409.04b0
  3619. CompanyName: Microsoft Corporation
  3620. ProductName: Microsoft® Windows® Operating System
  3621. InternalName: bthusb.sys
  3622. OriginalFilename: bthusb.sys
  3623. ProductVersion: 10.0.16288.1
  3624. FileVersion: 10.0.16288.1 (WinBuild.160101.0800)
  3625. FileDescription: Bluetooth Miniport Driver
  3626. LegalCopyright: © Microsoft Corporation. All rights reserved.
  3627. fffff805`18160000 fffff805`1825f000 bthport (deferred)
  3628. Mapped memory image file: c:\symbols\bthport.sys\7ACA307Aff000\bthport.sys
  3629. Image path: \SystemRoot\system32\DRIVERS\bthport.sys
  3630. Image name: bthport.sys
  3631. Timestamp: Fri Apr 13 10:57:14 2035 (7ACA307A)
  3632. CheckSum: 000FCD8B
  3633. ImageSize: 000FF000
  3634. File version: 10.0.16288.1
  3635. Product version: 10.0.16288.1
  3636. File flags: 0 (Mask 3F)
  3637. File OS: 40004 NT Win32
  3638. File type: 2.0 Dll
  3639. File date: 00000000.00000000
  3640. Translations: 0409.04b0
  3641. CompanyName: Microsoft Corporation
  3642. ProductName: Microsoft® Windows® Operating System
  3643. InternalName: bthport.sys
  3644. OriginalFilename: bthport.sys
  3645. ProductVersion: 10.0.16288.1
  3646. FileVersion: 10.0.16288.1 (WinBuild.160101.0800)
  3647. FileDescription: Bluetooth Bus Driver
  3648. LegalCopyright: © Microsoft Corporation. All rights reserved.
  3649. fffff805`18760000 fffff805`18eeb000 Netwtw04 (deferred)
  3650. Image path: \SystemRoot\System32\drivers\Netwtw04.sys
  3651. Image name: Netwtw04.sys
  3652. Timestamp: Sun Jul 2 19:25:56 2017 (59593AB4)
  3653. CheckSum: 00749699
  3654. ImageSize: 0078B000
  3655. Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
  3656. fffff805`18ef0000 fffff805`18fb3000 wdiwifi (deferred)
  3657. Mapped memory image file: c:\symbols\wdiwifi.sys\3BBEA85Dc3000\wdiwifi.sys
  3658. Image path: \SystemRoot\system32\DRIVERS\wdiwifi.sys
  3659. Image name: wdiwifi.sys
  3660. Timestamp: Sat Oct 6 07:44:45 2001 (3BBEA85D)
  3661. CheckSum: 000CB2BB
  3662. ImageSize: 000C3000
  3663. File version: 10.0.16288.1
  3664. Product version: 10.0.16288.1
  3665. File flags: 0 (Mask 3F)
  3666. File OS: 40004 NT Win32
  3667. File type: 3.7 Driver
  3668. File date: 00000000.00000000
  3669. Translations: 0409.04b0
  3670. CompanyName: Microsoft Corporation
  3671. ProductName: Microsoft® Windows® Operating System
  3672. InternalName: wdiwifi.sys
  3673. OriginalFilename: wdiwifi.sys
  3674. ProductVersion: 10.0.16288.1
  3675. FileVersion: 10.0.16288.1 (WinBuild.160101.0800)
  3676. FileDescription: WDI Driver Framework Driver
  3677. LegalCopyright: © Microsoft Corporation. All rights reserved.
  3678. fffff805`18fc0000 fffff805`18fce000 vwifibus (deferred)
  3679. Mapped memory image file: c:\symbols\vwifibus.sys\2AD49D54e000\vwifibus.sys
  3680. Image path: \SystemRoot\System32\drivers\vwifibus.sys
  3681. Image name: vwifibus.sys
  3682. Timestamp: Thu Oct 8 21:43:00 1992 (2AD49D54)
  3683. CheckSum: 0000C4A8
  3684. ImageSize: 0000E000
  3685. File version: 10.0.16273.1000
  3686. Product version: 10.0.16273.1000
  3687. File flags: 0 (Mask 3F)
  3688. File OS: 40004 NT Win32
  3689. File type: 3.7 Driver
  3690. File date: 00000000.00000000
  3691. Translations: 0409.04b0
  3692. CompanyName: Microsoft Corporation
  3693. ProductName: Microsoft® Windows® Operating System
  3694. InternalName: VWiFiBus.sys
  3695. OriginalFilename: VWiFiBus.sys
  3696. ProductVersion: 10.0.16273.1000
  3697. FileVersion: 10.0.16273.1000 (WinBuild.160101.0800)
  3698. FileDescription: Virtual Wireless Bus Driver
  3699. LegalCopyright: © Microsoft Corporation. All rights reserved.
  3700. fffff805`1b600000 fffff805`1bbaa000 RTKVHD64 (deferred)
  3701. Image path: \SystemRoot\system32\drivers\RTKVHD64.sys
  3702. Image name: RTKVHD64.sys
  3703. Timestamp: Tue Apr 18 13:08:20 2017 (58F601B4)
  3704. CheckSum: 00579AD6
  3705. ImageSize: 005AA000
  3706. Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
  3707. fffff805`1bbb0000 fffff805`1bc6c000 dxgmms2 (deferred)
  3708. Image path: \SystemRoot\System32\drivers\dxgmms2.sys
  3709. Image name: dxgmms2.sys
  3710. Timestamp: Sat Oct 18 04:03:01 1997 (344826E5)
  3711. CheckSum: 000BA097
  3712. ImageSize: 000BC000
  3713. Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
  3714. fffff805`1bc70000 fffff805`1bc96000 luafv (deferred)
  3715. Mapped memory image file: c:\symbols\luafv.sys\229F7AA626000\luafv.sys
  3716. Image path: \SystemRoot\system32\drivers\luafv.sys
  3717. Image name: luafv.sys
  3718. Timestamp: Sun May 29 03:42:46 1988 (229F7AA6)
  3719. CheckSum: 00023E56
  3720. ImageSize: 00026000
  3721. File version: 10.0.16273.1000
  3722. Product version: 10.0.16273.1000
  3723. File flags: 0 (Mask 3F)
  3724. File OS: 40004 NT Win32
  3725. File type: 3.7 Driver
  3726. File date: 00000000.00000000
  3727. Translations: 0409.04b0
  3728. CompanyName: Microsoft Corporation
  3729. ProductName: Microsoft® Windows® Operating System
  3730. InternalName: luafv.sys
  3731. OriginalFilename: luafv.sys
  3732. ProductVersion: 10.0.16273.1000
  3733. FileVersion: 10.0.16273.1000 (WinBuild.160101.0800)
  3734. FileDescription: LUA File Virtualization Filter Driver
  3735. LegalCopyright: © Microsoft Corporation. All rights reserved.
  3736. fffff805`1bca0000 fffff805`1bcc7000 wcifs (deferred)
  3737. Mapped memory image file: c:\symbols\wcifs.sys\549B61FA27000\wcifs.sys
  3738. Image path: \SystemRoot\system32\drivers\wcifs.sys
  3739. Image name: wcifs.sys
  3740. Timestamp: Thu Dec 25 01:01:46 2014 (549B61FA)
  3741. CheckSum: 0002A375
  3742. ImageSize: 00027000
  3743. File version: 10.0.16273.1000
  3744. Product version: 10.0.16273.1000
  3745. File flags: 0 (Mask 3F)
  3746. File OS: 40004 NT Win32
  3747. File type: 3.7 Driver
  3748. File date: 00000000.00000000
  3749. Translations: 0409.04b0
  3750. CompanyName: Microsoft Corporation
  3751. ProductName: Microsoft® Windows® Operating System
  3752. InternalName: wcifs.sys
  3753. OriginalFilename: wcifs.sys
  3754. ProductVersion: 10.0.16273.1000
  3755. FileVersion: 10.0.16273.1000 (WinBuild.160101.0800)
  3756. FileDescription: Windows Container Isolation FS Filter Driver
  3757. LegalCopyright: © Microsoft Corporation. All rights reserved.
  3758. fffff805`1bcd0000 fffff805`1bd16000 WUDFRd (deferred)
  3759. Mapped memory image file: c:\symbols\WUDFRd.sys\9195B73B46000\WUDFRd.sys
  3760. Image path: \SystemRoot\system32\DRIVERS\WUDFRd.sys
  3761. Image name: WUDFRd.sys
  3762. Timestamp: ***** Invalid (9195B73B)
  3763. CheckSum: 0004D0BB
  3764. ImageSize: 00046000
  3765. File version: 10.0.16288.1
  3766. Product version: 10.0.16288.1
  3767. File flags: 0 (Mask 3F)
  3768. File OS: 40004 NT Win32
  3769. File type: 3.7 Driver
  3770. File date: 00000000.00000000
  3771. Translations: 0409.04b0
  3772. CompanyName: Microsoft Corporation
  3773. ProductName: Microsoft® Windows® Operating System
  3774. InternalName: WUDFRd.sys
  3775. OriginalFilename: WUDFRd.sys
  3776. ProductVersion: 10.0.16288.1
  3777. FileVersion: 10.0.16288.1 (WinBuild.160101.0800)
  3778. FileDescription: Windows Driver Foundation - User-mode Driver Framework Reflector
  3779. LegalCopyright: © Microsoft Corporation. All rights reserved.
  3780. fffff805`1bd20000 fffff805`1bd86000 cldflt (deferred)
  3781. Image path: \SystemRoot\system32\drivers\cldflt.sys
  3782. Image name: cldflt.sys
  3783. Timestamp: Thu Jun 29 10:42:13 1989 (24A9EEF5)
  3784. CheckSum: 00061F3D
  3785. ImageSize: 00066000
  3786. Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
  3787. fffff805`1bd90000 fffff805`1bda9000 storqosflt (deferred)
  3788. Mapped memory image file: c:\symbols\storqosflt.sys\426B6C8119000\storqosflt.sys
  3789. Image path: \SystemRoot\system32\drivers\storqosflt.sys
  3790. Image name: storqosflt.sys
  3791. Timestamp: Sun Apr 24 10:53:05 2005 (426B6C81)
  3792. CheckSum: 00019668
  3793. ImageSize: 00019000
  3794. File version: 10.0.16273.1000
  3795. Product version: 10.0.16273.1000
  3796. File flags: 0 (Mask 3F)
  3797. File OS: 40004 NT Win32
  3798. File type: 3.7 Driver
  3799. File date: 00000000.00000000
  3800. Translations: 0409.04b0
  3801. CompanyName: Microsoft Corporation
  3802. ProductName: Microsoft® Windows® Operating System
  3803. InternalName: storqosflt.sys
  3804. OriginalFilename: storqosflt.sys
  3805. ProductVersion: 10.0.16273.1000
  3806. FileVersion: 10.0.16273.1000 (WinBuild.160101.0800)
  3807. FileDescription: Storage QoS Filter
  3808. LegalCopyright: © Microsoft Corporation. All rights reserved.
  3809. fffff805`1bdb0000 fffff805`1bdca000 mslldp (deferred)
  3810. Mapped memory image file: c:\symbols\mslldp.sys\0A8826211a000\mslldp.sys
  3811. Image path: \SystemRoot\system32\drivers\mslldp.sys
  3812. Image name: mslldp.sys
  3813. Timestamp: Fri Aug 8 02:53:37 1975 (0A882621)
  3814. CheckSum: 00021544
  3815. ImageSize: 0001A000
  3816. File version: 10.0.16273.1000
  3817. Product version: 10.0.16273.1000
  3818. File flags: 0 (Mask 3F)
  3819. File OS: 40004 NT Win32
  3820. File type: 3.6 Driver
  3821. File date: 00000000.00000000
  3822. Translations: 0409.04b0
  3823. CompanyName: Microsoft Corporation
  3824. ProductName: Microsoft® Windows® Operating System
  3825. InternalName: MSLLDP.SYS
  3826. OriginalFilename: MSLLDP.SYS
  3827. ProductVersion: 10.0.16273.1000
  3828. FileVersion: 10.0.16273.1000 (WinBuild.160101.0800)
  3829. FileDescription: Microsoft Link-Layer Discovery Protocol Driver
  3830. LegalCopyright: © Microsoft Corporation. All rights reserved.
  3831. fffff805`1bdd0000 fffff805`1bde2000 condrv (deferred)
  3832. Mapped memory image file: c:\symbols\condrv.sys\A6EA12B512000\condrv.sys
  3833. Image path: \SystemRoot\System32\drivers\condrv.sys
  3834. Image name: condrv.sys
  3835. Timestamp: ***** Invalid (A6EA12B5)
  3836. CheckSum: 0001264A
  3837. ImageSize: 00012000
  3838. File version: 10.0.16273.1000
  3839. Product version: 10.0.16273.1000
  3840. File flags: 0 (Mask 3F)
  3841. File OS: 40004 NT Win32
  3842. File type: 3.7 Driver
  3843. File date: 00000000.00000000
  3844. Translations: 0409.04b0
  3845. CompanyName: Microsoft Corporation
  3846. ProductName: Microsoft® Windows® Operating System
  3847. InternalName: condrv.sys
  3848. OriginalFilename: condrv.sys
  3849. ProductVersion: 10.0.16273.1000
  3850. FileVersion: 10.0.16273.1000 (WinBuild.160101.0800)
  3851. FileDescription: Console Driver
  3852. LegalCopyright: © Microsoft Corporation. All rights reserved.
  3853. fffff805`1bdf0000 fffff805`1be06000 lltdio (deferred)
  3854. Mapped memory image file: c:\symbols\lltdio.sys\562D485116000\lltdio.sys
  3855. Image path: \SystemRoot\system32\drivers\lltdio.sys
  3856. Image name: lltdio.sys
  3857. Timestamp: Sun Oct 25 21:23:29 2015 (562D4851)
  3858. CheckSum: 0001D32C
  3859. ImageSize: 00016000
  3860. File version: 10.0.16273.1000
  3861. Product version: 10.0.16273.1000
  3862. File flags: 0 (Mask 3F)
  3863. File OS: 40004 NT Win32
  3864. File type: 3.6 Driver
  3865. File date: 00000000.00000000
  3866. Translations: 0409.04b0
  3867. CompanyName: Microsoft Corporation
  3868. ProductName: Microsoft® Windows® Operating System
  3869. InternalName: LLTDIO.SYS
  3870. OriginalFilename: LLTDIO.SYS
  3871. ProductVersion: 10.0.16273.1000
  3872. FileVersion: 10.0.16273.1000 (WinBuild.160101.0800)
  3873. FileDescription: Link-Layer Topology Mapper I/O Driver
  3874. LegalCopyright: © Microsoft Corporation. All rights reserved.
  3875. fffff805`1be10000 fffff805`1be2a000 rspndr (deferred)
  3876. Mapped memory image file: c:\symbols\rspndr.sys\808AAECD1a000\rspndr.sys
  3877. Image path: \SystemRoot\system32\drivers\rspndr.sys
  3878. Image name: rspndr.sys
  3879. Timestamp: ***** Invalid (808AAECD)
  3880. CheckSum: 0001DF2E
  3881. ImageSize: 0001A000
  3882. File version: 10.0.16273.1000
  3883. Product version: 10.0.16273.1000
  3884. File flags: 0 (Mask 3F)
  3885. File OS: 40004 NT Win32
  3886. File type: 3.6 Driver
  3887. File date: 00000000.00000000
  3888. Translations: 0409.04b0
  3889. CompanyName: Microsoft Corporation
  3890. ProductName: Microsoft® Windows® Operating System
  3891. InternalName: RSPNDR.SYS
  3892. OriginalFilename: RSPNDR.SYS
  3893. ProductVersion: 10.0.16273.1000
  3894. FileVersion: 10.0.16273.1000 (WinBuild.160101.0800)
  3895. FileDescription: Link-Layer Topology Responder Driver for NDIS 6
  3896. LegalCopyright: © Microsoft Corporation. All rights reserved.
  3897. fffff805`1be30000 fffff805`1be4b000 wanarp (deferred)
  3898. Mapped memory image file: c:\symbols\wanarp.sys\F90588841b000\wanarp.sys
  3899. Image path: \SystemRoot\System32\DRIVERS\wanarp.sys
  3900. Image name: wanarp.sys
  3901. Timestamp: ***** Invalid (F9058884)
  3902. CheckSum: 00014F65
  3903. ImageSize: 0001B000
  3904. File version: 10.0.16273.1000
  3905. Product version: 10.0.16273.1000
  3906. File flags: 0 (Mask 3F)
  3907. File OS: 40004 NT Win32
  3908. File type: 3.6 Driver
  3909. File date: 00000000.00000000
  3910. Translations: 0409.04b0
  3911. CompanyName: Microsoft Corporation
  3912. ProductName: Microsoft® Windows® Operating System
  3913. InternalName: WANARP.SYS
  3914. OriginalFilename: WANARP.SYS
  3915. ProductVersion: 10.0.16273.1000
  3916. FileVersion: 10.0.16273.1000 (WinBuild.160101.0800)
  3917. FileDescription: MS Remote Access and Routing ARP Driver
  3918. LegalCopyright: © Microsoft Corporation. All rights reserved.
  3919. fffff805`1be50000 fffff805`1bed7000 nwifi (deferred)
  3920. Mapped memory image file: c:\symbols\nwifi.sys\2D5908D487000\nwifi.sys
  3921. Image path: \SystemRoot\system32\DRIVERS\nwifi.sys
  3922. Image name: nwifi.sys
  3923. Timestamp: Wed Feb 9 16:01:24 1994 (2D5908D4)
  3924. CheckSum: 0008784A
  3925. ImageSize: 00087000
  3926. File version: 10.0.16273.1000
  3927. Product version: 10.0.16273.1000
  3928. File flags: 0 (Mask 3F)
  3929. File OS: 40004 NT Win32
  3930. File type: 3.6 Driver
  3931. File date: 00000000.00000000
  3932. Translations: 0409.04b0
  3933. CompanyName: Microsoft Corporation
  3934. ProductName: Microsoft® Windows® Operating System
  3935. InternalName: NWiFi.SYS
  3936. OriginalFilename: NWiFi.SYS
  3937. ProductVersion: 10.0.16273.1000
  3938. FileVersion: 10.0.16273.1000 (WinBuild.160101.0800)
  3939. FileDescription: NativeWiFi Miniport Driver
  3940. LegalCopyright: © Microsoft Corporation. All rights reserved.
  3941. fffff805`1bee0000 fffff805`1bef6000 ndisuio (deferred)
  3942. Mapped memory image file: c:\symbols\ndisuio.sys\9ABF995E16000\ndisuio.sys
  3943. Image path: \SystemRoot\system32\drivers\ndisuio.sys
  3944. Image name: ndisuio.sys
  3945. Timestamp: ***** Invalid (9ABF995E)
  3946. CheckSum: 00010091
  3947. ImageSize: 00016000
  3948. File version: 10.0.16273.1000
  3949. Product version: 10.0.16273.1000
  3950. File flags: 0 (Mask 3F)
  3951. File OS: 40004 NT Win32
  3952. File type: 3.6 Driver
  3953. File date: 00000000.00000000
  3954. Translations: 0409.04b0
  3955. CompanyName: Microsoft Corporation
  3956. ProductName: Microsoft® Windows® Operating System
  3957. InternalName: NDISUIO.SYS
  3958. OriginalFilename: NDISUIO.SYS
  3959. ProductVersion: 10.0.16273.1000
  3960. FileVersion: 10.0.16273.1000 (WinBuild.160101.0800)
  3961. FileDescription: NDIS User mode I/O driver
  3962. LegalCopyright: © Microsoft Corporation. All rights reserved.
  3963. fffff805`1bf00000 fffff805`1c013000 HTTP (deferred)
  3964. Mapped memory image file: c:\symbols\HTTP.sys\8E07C76C113000\HTTP.sys
  3965. Image path: \SystemRoot\system32\drivers\HTTP.sys
  3966. Image name: HTTP.sys
  3967. Timestamp: ***** Invalid (8E07C76C)
  3968. CheckSum: 00111897
  3969. ImageSize: 00113000
  3970. File version: 10.0.16288.1
  3971. Product version: 10.0.16288.1
  3972. File flags: 0 (Mask 3F)
  3973. File OS: 40004 NT Win32
  3974. File type: 3.7 Driver
  3975. File date: 00000000.00000000
  3976. Translations: 0409.04b0
  3977. CompanyName: Microsoft Corporation
  3978. ProductName: Microsoft® Windows® Operating System
  3979. InternalName: http.sys
  3980. OriginalFilename: http.sys
  3981. ProductVersion: 10.0.16288.1
  3982. FileVersion: 10.0.16288.1 (WinBuild.160101.0800)
  3983. FileDescription: HTTP Protocol Stack
  3984. LegalCopyright: © Microsoft Corporation. All rights reserved.
  3985. fffff805`1c020000 fffff805`1c041000 bowser (deferred)
  3986. Mapped memory image file: c:\symbols\bowser.sys\A73B9D4121000\bowser.sys
  3987. Image path: \SystemRoot\system32\DRIVERS\bowser.sys
  3988. Image name: bowser.sys
  3989. Timestamp: ***** Invalid (A73B9D41)
  3990. CheckSum: 0001AC75
  3991. ImageSize: 00021000
  3992. File version: 10.0.16273.1000
  3993. Product version: 10.0.16273.1000
  3994. File flags: 0 (Mask 3F)
  3995. File OS: 40004 NT Win32
  3996. File type: 3.7 Driver
  3997. File date: 00000000.00000000
  3998. Translations: 0409.04b0
  3999. CompanyName: Microsoft Corporation
  4000. ProductName: Microsoft® Windows® Operating System
  4001. InternalName: browser.sys
  4002. OriginalFilename: browser.sys
  4003. ProductVersion: 10.0.16273.1000
  4004. FileVersion: 10.0.16273.1000 (WinBuild.160101.0800)
  4005. FileDescription: NT Lan Manager Datagram Receiver Driver
  4006. LegalCopyright: © Microsoft Corporation. All rights reserved.
  4007. fffff805`1c050000 fffff805`1c069000 mpsdrv (deferred)
  4008. Mapped memory image file: c:\symbols\mpsdrv.sys\DFB7E61319000\mpsdrv.sys
  4009. Image path: \SystemRoot\System32\drivers\mpsdrv.sys
  4010. Image name: mpsdrv.sys
  4011. Timestamp: ***** Invalid (DFB7E613)
  4012. CheckSum: 0001BC83
  4013. ImageSize: 00019000
  4014. File version: 10.0.16273.1000
  4015. Product version: 10.0.16273.1000
  4016. File flags: 0 (Mask 3F)
  4017. File OS: 40004 NT Win32
  4018. File type: 3.7 Driver
  4019. File date: 00000000.00000000
  4020. Translations: 0409.04b0
  4021. CompanyName: Microsoft Corporation
  4022. ProductName: Microsoft® Windows® Operating System
  4023. InternalName: mpsdrv.sys
  4024. OriginalFilename: mpsdrv.sys
  4025. ProductVersion: 10.0.16273.1000
  4026. FileVersion: 10.0.16273.1000 (WinBuild.160101.0800)
  4027. FileDescription: Microsoft Protection Service Driver
  4028. LegalCopyright: © Microsoft Corporation. All rights reserved.
  4029. fffff805`1c070000 fffff805`1c0f1000 mrxsmb (deferred)
  4030. Image path: \SystemRoot\system32\DRIVERS\mrxsmb.sys
  4031. Image name: mrxsmb.sys
  4032. Timestamp: Fri Dec 18 12:18:57 1970 (01CF6BB1)
  4033. CheckSum: 00083D5C
  4034. ImageSize: 00081000
  4035. Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
  4036. fffff805`1c100000 fffff805`1c13d000 mrxsmb20 (deferred)
  4037. Mapped memory image file: c:\symbols\mrxsmb20.sys\BCF390873d000\mrxsmb20.sys
  4038. Image path: \SystemRoot\system32\DRIVERS\mrxsmb20.sys
  4039. Image name: mrxsmb20.sys
  4040. Timestamp: ***** Invalid (BCF39087)
  4041. CheckSum: 0003E809
  4042. ImageSize: 0003D000
  4043. File version: 10.0.16288.1
  4044. Product version: 10.0.16288.1
  4045. File flags: 0 (Mask 3F)
  4046. File OS: 40004 NT Win32
  4047. File type: 3.7 Driver
  4048. File date: 00000000.00000000
  4049. Translations: 0409.04b0
  4050. CompanyName: Microsoft Corporation
  4051. ProductName: Microsoft® Windows® Operating System
  4052. InternalName: MRxSmb20.sys
  4053. OriginalFilename: MRXSMB20.Sys
  4054. ProductVersion: 10.0.16288.1
  4055. FileVersion: 10.0.16288.1 (WinBuild.160101.0800)
  4056. FileDescription: Longhorn SMB 2.0 Redirector
  4057. LegalCopyright: © Microsoft Corporation. All rights reserved.
  4058. fffff805`1c140000 fffff805`1c174000 AMDRyzenMasterDriver (deferred)
  4059. Image path: \??\C:\Program Files\AMD\RyzenMaster\bin\AMDRyzenMasterDriver.sys
  4060. Image name: AMDRyzenMasterDriver.sys
  4061. Timestamp: Tue Mar 28 04:29:24 2017 (58D9D894)
  4062. CheckSum: 0001BACB
  4063. ImageSize: 00034000
  4064. Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
  4065. fffff805`1c180000 fffff805`1c192000 kldisk (deferred)
  4066. Image path: \SystemRoot\system32\DRIVERS\kldisk.sys
  4067. Image name: kldisk.sys
  4068. Timestamp: Fri Dec 25 07:47:51 2015 (567CF4A7)
  4069. CheckSum: 0001E276
  4070. ImageSize: 00012000
  4071. Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
  4072. fffff805`1c1a0000 fffff805`1e6f3000 atikmdag (deferred)
  4073. Image path: \SystemRoot\System32\DriverStore\FileRepository\c0318192.inf_amd64_d0f929f3a19ab987\atikmdag.sys
  4074. Image name: atikmdag.sys
  4075. Timestamp: Tue Sep 19 01:13:58 2017 (59C06146)
  4076. CheckSum: 02505205
  4077. ImageSize: 02553000
  4078. Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
  4079. fffff805`1e700000 fffff805`1e70f000 ndistapi (deferred)
  4080. Mapped memory image file: c:\symbols\ndistapi.sys\66B12A51f000\ndistapi.sys
  4081. Image path: \SystemRoot\System32\DRIVERS\ndistapi.sys
  4082. Image name: ndistapi.sys
  4083. Timestamp: Mon Aug 5 20:38:57 2024 (66B12A51)
  4084. CheckSum: 00009961
  4085. ImageSize: 0000F000
  4086. File version: 10.0.16273.1000
  4087. Product version: 10.0.16273.1000
  4088. File flags: 0 (Mask 3F)
  4089. File OS: 40004 NT Win32
  4090. File type: 3.6 Driver
  4091. File date: 00000000.00000000
  4092. Translations: 0409.04b0
  4093. CompanyName: Microsoft Corporation
  4094. ProductName: Microsoft® Windows® Operating System
  4095. InternalName: NDISTAPI.SYS
  4096. OriginalFilename: NDISTAPI.SYS
  4097. ProductVersion: 10.0.16273.1000
  4098. FileVersion: 10.0.16273.1000 (WinBuild.160101.0800)
  4099. FileDescription: NDIS 3.0 connection wrapper driver
  4100. LegalCopyright: © Microsoft Corporation. All rights reserved.
  4101. fffff805`1e710000 fffff805`1e72d000 HDAudBus (deferred)
  4102. Mapped memory image file: c:\symbols\HDAudBus.sys\186192D81d000\HDAudBus.sys
  4103. Image path: \SystemRoot\System32\drivers\HDAudBus.sys
  4104. Image name: HDAudBus.sys
  4105. Timestamp: Sat Dec 18 08:22:48 1982 (186192D8)
  4106. CheckSum: 0002097A
  4107. ImageSize: 0001D000
  4108. File version: 10.0.16273.1000
  4109. Product version: 10.0.16273.1000
  4110. File flags: 0 (Mask 3F)
  4111. File OS: 40004 NT Win32
  4112. File type: 3.9 Driver
  4113. File date: 00000000.00000000
  4114. Translations: 0409.04b0
  4115. CompanyName: Microsoft Corporation
  4116. ProductName: Microsoft® Windows® Operating System
  4117. InternalName: hdaudbus.sys
  4118. OriginalFilename: hdaudbus.sys
  4119. ProductVersion: 10.0.16273.1000
  4120. FileVersion: 10.0.16273.1000 (WinBuild.160101.0800)
  4121. FileDescription: High Definition Audio Bus Driver
  4122. LegalCopyright: © Microsoft Corporation. All rights reserved.
  4123. fffff805`1e730000 fffff805`1e793000 portcls (deferred)
  4124. Mapped memory image file: c:\symbols\portcls.sys\A7AAD0F563000\portcls.sys
  4125. Image path: \SystemRoot\System32\drivers\portcls.sys
  4126. Image name: portcls.sys
  4127. Timestamp: ***** Invalid (A7AAD0F5)
  4128. CheckSum: 0005E584
  4129. ImageSize: 00063000
  4130. File version: 10.0.16273.1000
  4131. Product version: 10.0.16273.1000
  4132. File flags: 0 (Mask 3F)
  4133. File OS: 40004 NT Win32
  4134. File type: 3.9 Driver
  4135. File date: 00000000.00000000
  4136. Translations: 0409.04b0
  4137. CompanyName: Microsoft Corporation
  4138. ProductName: Microsoft® Windows® Operating System
  4139. InternalName: portcls.sys
  4140. OriginalFilename: portcls.sys
  4141. ProductVersion: 10.0.16273.1000
  4142. FileVersion: 10.0.16273.1000 (WinBuild.160101.0800)
  4143. FileDescription: Port Class (Class Driver for Port/Miniport Devices)
  4144. LegalCopyright: © Microsoft Corporation. All rights reserved.
  4145. fffff805`1e7a0000 fffff805`1e7c1000 drmk (deferred)
  4146. Image path: \SystemRoot\System32\drivers\drmk.sys
  4147. Image name: drmk.sys
  4148. Timestamp: Fri Mar 28 09:18:28 2014 (53353E64)
  4149. CheckSum: 00021F69
  4150. ImageSize: 00021000
  4151. Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
  4152. fffff805`1e7d0000 fffff805`1e7f5000 Ndu (deferred)
  4153. Mapped memory image file: c:\symbols\Ndu.sys\59CB3F2125000\Ndu.sys
  4154. Image path: \SystemRoot\system32\drivers\Ndu.sys
  4155. Image name: Ndu.sys
  4156. Timestamp: Wed Sep 27 07:03:13 2017 (59CB3F21)
  4157. CheckSum: 000297EE
  4158. ImageSize: 00025000
  4159. File version: 10.0.16273.1000
  4160. Product version: 10.0.16273.1000
  4161. File flags: 0 (Mask 3F)
  4162. File OS: 40004 NT Win32
  4163. File type: 3.6 Driver
  4164. File date: 00000000.00000000
  4165. Translations: 0409.04b0
  4166. CompanyName: Microsoft Corporation
  4167. ProductName: Microsoft® Windows® Operating System
  4168. InternalName: ndu.sys
  4169. OriginalFilename: ndu.sys
  4170. ProductVersion: 10.0.16273.1000
  4171. FileVersion: 10.0.16273.1000 (WinBuild.160101.0800)
  4172. FileDescription: Windows Network Data Usage Monitoring Driver
  4173. LegalCopyright: © Microsoft Corporation. All rights reserved.
  4174. fffff805`1e800000 fffff805`1e80a000 digitalpower (deferred)
  4175. Image path: \SystemRoot\system32\drivers\digitalpower.sys
  4176. Image name: digitalpower.sys
  4177. Timestamp: Thu Sep 10 19:27:32 2015 (55F1CB94)
  4178. CheckSum: 00013314
  4179. ImageSize: 0000A000
  4180. Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
  4181. fffff805`1e830000 fffff805`1e865000 HIDCLASS (deferred)
  4182. Image path: \SystemRoot\System32\drivers\HIDCLASS.SYS
  4183. Image name: HIDCLASS.SYS
  4184. Timestamp: ***** Invalid (A4B57241)
  4185. CheckSum: 0003875B
  4186. ImageSize: 00035000
  4187. Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
  4188. fffff805`1e870000 fffff805`1e883000 HIDPARSE (deferred)
  4189. Mapped memory image file: c:\symbols\HIDPARSE.SYS\3B5CA86C13000\HIDPARSE.SYS
  4190. Image path: \SystemRoot\System32\drivers\HIDPARSE.SYS
  4191. Image name: HIDPARSE.SYS
  4192. Timestamp: Mon Jul 23 23:42:52 2001 (3B5CA86C)
  4193. CheckSum: 00018797
  4194. ImageSize: 00013000
  4195. File version: 10.0.16246.1000
  4196. Product version: 10.0.16246.1000
  4197. File flags: 0 (Mask 3F)
  4198. File OS: 40004 NT Win32
  4199. File type: 2.0 Dll
  4200. File date: 00000000.00000000
  4201. Translations: 0409.04b0
  4202. CompanyName: Microsoft Corporation
  4203. ProductName: Microsoft® Windows® Operating System
  4204. InternalName: hidparse.sys
  4205. OriginalFilename: hidparse.sys
  4206. ProductVersion: 10.0.16246.1000
  4207. FileVersion: 10.0.16246.1000 (WinBuild.160101.0800)
  4208. FileDescription: Hid Parsing Library
  4209. LegalCopyright: © Microsoft Corporation. All rights reserved.
  4210. fffff805`1e890000 fffff805`1e91c000 UsbHub3 (deferred)
  4211. Mapped memory image file: c:\symbols\UsbHub3.sys\FC3D204E8c000\UsbHub3.sys
  4212. Image path: \SystemRoot\System32\drivers\UsbHub3.sys
  4213. Image name: UsbHub3.sys
  4214. Timestamp: ***** Invalid (FC3D204E)
  4215. CheckSum: 0008FCB7
  4216. ImageSize: 0008C000
  4217. File version: 10.0.16281.1000
  4218. Product version: 10.0.16281.1000
  4219. File flags: 0 (Mask 3F)
  4220. File OS: 40004 NT Win32
  4221. File type: 3.7 Driver
  4222. File date: 00000000.00000000
  4223. Translations: 0409.04b0
  4224. CompanyName: Microsoft Corporation
  4225. ProductName: Microsoft® Windows® Operating System
  4226. InternalName: usbhub3.sys
  4227. OriginalFilename: usbhub3.sys
  4228. ProductVersion: 10.0.16281.1000
  4229. FileVersion: 10.0.16281.1000 (WinBuild.160101.0800)
  4230. FileDescription: USB3 HUB Driver
  4231. LegalCopyright: © Microsoft Corporation. All rights reserved.
  4232. fffff805`1e920000 fffff805`1e92e000 USBD (deferred)
  4233. Mapped memory image file: c:\symbols\USBD.SYS\638FCB99e000\USBD.SYS
  4234. Image path: \SystemRoot\System32\drivers\USBD.SYS
  4235. Image name: USBD.SYS
  4236. Timestamp: Tue Dec 6 23:09:13 2022 (638FCB99)
  4237. CheckSum: 0000C234
  4238. ImageSize: 0000E000
  4239. File version: 10.0.16273.1000
  4240. Product version: 10.0.16273.1000
  4241. File flags: 0 (Mask 3F)
  4242. File OS: 40004 NT Win32
  4243. File type: 2.0 Dll
  4244. File date: 00000000.00000000
  4245. Translations: 0000.04b0
  4246. CompanyName: Microsoft Corporation
  4247. ProductName: Microsoft® Windows® Operating System
  4248. InternalName: usbd.sys
  4249. OriginalFilename: usbd.sys
  4250. ProductVersion: 10.0.16273.1000
  4251. FileVersion: 10.0.16273.1000 (WinBuild.160101.0800)
  4252. FileDescription: Universal Serial Bus Driver
  4253. LegalCopyright: © Microsoft Corporation. All rights reserved.
  4254. fffff805`1e930000 fffff805`1e940000 kbdhid (deferred)
  4255. Mapped memory image file: c:\symbols\kbdhid.sys\30E4F78A10000\kbdhid.sys
  4256. Image path: \SystemRoot\System32\drivers\kbdhid.sys
  4257. Image name: kbdhid.sys
  4258. Timestamp: Sat Dec 30 08:25:46 1995 (30E4F78A)
  4259. CheckSum: 0000EB64
  4260. ImageSize: 00010000
  4261. File version: 10.0.16288.1
  4262. Product version: 10.0.16288.1
  4263. File flags: 0 (Mask 3F)
  4264. File OS: 40004 NT Win32
  4265. File type: 2.0 Dll
  4266. File date: 00000000.00000000
  4267. Translations: 0409.04b0
  4268. CompanyName: Microsoft Corporation
  4269. ProductName: Microsoft® Windows® Operating System
  4270. InternalName: kbdhid.sys
  4271. OriginalFilename: kbdhid.sys
  4272. ProductVersion: 10.0.16288.1
  4273. FileVersion: 10.0.16288.1 (WinBuild.160101.0800)
  4274. FileDescription: HID Keyboard Filter Driver
  4275. LegalCopyright: © Microsoft Corporation. All rights reserved.
  4276. fffff805`1e940000 fffff805`1e94e000 klkbdflt (deferred)
  4277. Image path: \SystemRoot\system32\DRIVERS\klkbdflt.sys
  4278. Image name: klkbdflt.sys
  4279. Timestamp: Tue Dec 20 22:06:18 2016 (5859AB5A)
  4280. CheckSum: 0001266F
  4281. ImageSize: 0000E000
  4282. Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
  4283. fffff805`1e950000 fffff805`1e963000 kbdclass (deferred)
  4284. Mapped memory image file: c:\symbols\kbdclass.sys\E1050CA813000\kbdclass.sys
  4285. Image path: \SystemRoot\System32\drivers\kbdclass.sys
  4286. Image name: kbdclass.sys
  4287. Timestamp: ***** Invalid (E1050CA8)
  4288. CheckSum: 00018EC4
  4289. ImageSize: 00013000
  4290. File version: 10.0.16273.1000
  4291. Product version: 10.0.16273.1000
  4292. File flags: 0 (Mask 3F)
  4293. File OS: 40004 NT Win32
  4294. File type: 3.7 Driver
  4295. File date: 00000000.00000000
  4296. Translations: 0409.04b0
  4297. CompanyName: Microsoft Corporation
  4298. ProductName: Microsoft® Windows® Operating System
  4299. InternalName: kbdclass.sys
  4300. OriginalFilename: kbdclass.sys
  4301. ProductVersion: 10.0.16273.1000
  4302. FileVersion: 10.0.16273.1000 (WinBuild.160101.0800)
  4303. FileDescription: Keyboard Class Driver
  4304. LegalCopyright: © Microsoft Corporation. All rights reserved.
  4305. fffff805`1e970000 fffff805`1e98e000 AtihdWT6 (deferred)
  4306. Image path: \SystemRoot\system32\drivers\AtihdWT6.sys
  4307. Image name: AtihdWT6.sys
  4308. Timestamp: Sat Mar 25 21:04:05 2017 (58D6DB45)
  4309. CheckSum: 00027D44
  4310. ImageSize: 0001E000
  4311. Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
  4312. fffff805`1e9a0000 fffff805`1e9d5000 nvhda64v (deferred)
  4313. Image path: \SystemRoot\system32\drivers\nvhda64v.sys
  4314. Image name: nvhda64v.sys
  4315. Timestamp: Tue May 16 14:02:27 2017 (591AF863)
  4316. CheckSum: 0003F6DE
  4317. ImageSize: 00035000
  4318. Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
  4319. fffff805`1e9e0000 fffff805`1e9f3000 mmcss (deferred)
  4320. Mapped memory image file: c:\symbols\mmcss.sys\6634461413000\mmcss.sys
  4321. Image path: \SystemRoot\system32\drivers\mmcss.sys
  4322. Image name: mmcss.sys
  4323. Timestamp: Fri May 3 03:04:04 2024 (66344614)
  4324. CheckSum: 0000F544
  4325. ImageSize: 00013000
  4326. File version: 10.0.16273.1000
  4327. Product version: 10.0.16273.1000
  4328. File flags: 0 (Mask 3F)
  4329. File OS: 40004 NT Win32
  4330. File type: 3.7 Driver
  4331. File date: 00000000.00000000
  4332. Translations: 0409.04b0
  4333. CompanyName: Microsoft Corporation
  4334. ProductName: Microsoft® Windows® Operating System
  4335. InternalName: mmcss.sys
  4336. OriginalFilename: mmcss.sys
  4337. ProductVersion: 10.0.16273.1000
  4338. FileVersion: 10.0.16273.1000 (WinBuild.160101.0800)
  4339. FileDescription: MMCSS Driver
  4340. LegalCopyright: © Microsoft Corporation. All rights reserved.
  4341. fffff805`1ea00000 fffff805`1ea2f000 usbccgp (deferred)
  4342. Mapped memory image file: c:\symbols\usbccgp.sys\D5E154C62f000\usbccgp.sys
  4343. Image path: \SystemRoot\System32\drivers\usbccgp.sys
  4344. Image name: usbccgp.sys
  4345. Timestamp: ***** Invalid (D5E154C6)
  4346. CheckSum: 00034C1F
  4347. ImageSize: 0002F000
  4348. File version: 10.0.16273.1000
  4349. Product version: 10.0.16273.1000
  4350. File flags: 0 (Mask 3F)
  4351. File OS: 40004 NT Win32
  4352. File type: 2.0 Dll
  4353. File date: 00000000.00000000
  4354. Translations: 0409.04b0
  4355. CompanyName: Microsoft Corporation
  4356. ProductName: Microsoft® Windows® Operating System
  4357. InternalName: USBCCGP.SYS
  4358. OriginalFilename: USBCCGP.SYS
  4359. ProductVersion: 10.0.16273.1000
  4360. FileVersion: 10.0.16273.1000 (WinBuild.160101.0800)
  4361. FileDescription: USB Common Class Generic Parent Driver
  4362. LegalCopyright: © Microsoft Corporation. All rights reserved.
  4363. fffff805`1ea30000 fffff805`1ea7b000 usbvideo (deferred)
  4364. Mapped memory image file: c:\symbols\usbvideo.sys\D45DD7944b000\usbvideo.sys
  4365. Image path: \SystemRoot\System32\Drivers\usbvideo.sys
  4366. Image name: usbvideo.sys
  4367. Timestamp: ***** Invalid (D45DD794)
  4368. CheckSum: 000505C2
  4369. ImageSize: 0004B000
  4370. File version: 10.0.16262.1001
  4371. Product version: 10.0.16262.1001
  4372. File flags: 0 (Mask 3F)
  4373. File OS: 40004 NT Win32
  4374. File type: 3.0 Driver
  4375. File date: 00000000.00000000
  4376. Translations: 0409.04b0
  4377. CompanyName: Microsoft Corporation
  4378. ProductName: Microsoft® Windows® Operating System
  4379. InternalName: usbvideo.sys
  4380. OriginalFilename: usbvideo.sys
  4381. ProductVersion: 10.0.16262.1001
  4382. FileVersion: 10.0.16262.1001 (WinBuild.160101.0800)
  4383. FileDescription: USB Video Class Driver
  4384. LegalCopyright: © Microsoft Corporation. All rights reserved.
  4385. fffff805`1ea80000 fffff805`1eaa7000 usbaudio (deferred)
  4386. Mapped memory image file: c:\symbols\usbaudio.sys\21F26F6027000\usbaudio.sys
  4387. Image path: \SystemRoot\system32\drivers\usbaudio.sys
  4388. Image name: usbaudio.sys
  4389. Timestamp: Mon Jan 18 20:32:32 1988 (21F26F60)
  4390. CheckSum: 00025FF6
  4391. ImageSize: 00027000
  4392. File version: 10.0.16273.1000
  4393. Product version: 10.0.16273.1000
  4394. File flags: 0 (Mask 3F)
  4395. File OS: 40004 NT Win32
  4396. File type: 2.0 Dll
  4397. File date: 00000000.00000000
  4398. Translations: 0409.04b0
  4399. CompanyName: Microsoft Corporation
  4400. ProductName: Microsoft® Windows® Operating System
  4401. InternalName: USBAudio.sys
  4402. OriginalFilename: USBAudio.sys
  4403. ProductVersion: 10.0.16273.1000
  4404. FileVersion: 10.0.16273.1000 (WinBuild.160101.0800)
  4405. FileDescription: USB Audio Class Driver
  4406. LegalCopyright: © Microsoft Corporation. All rights reserved.
  4407. fffff805`1eab0000 fffff805`1eabd000 WpdUpFltr (deferred)
  4408. Mapped memory image file: c:\symbols\WpdUpFltr.sys\B911FEB2d000\WpdUpFltr.sys
  4409. Image path: \SystemRoot\System32\drivers\WpdUpFltr.sys
  4410. Image name: WpdUpFltr.sys
  4411. Timestamp: ***** Invalid (B911FEB2)
  4412. CheckSum: 0000E2E6
  4413. ImageSize: 0000D000
  4414. File version: 10.0.16273.1000
  4415. Product version: 10.0.16273.1000
  4416. File flags: 0 (Mask 3F)
  4417. File OS: 40004 NT Win32
  4418. File type: 3.0 Driver
  4419. File date: 00000000.00000000
  4420. Translations: 0409.04b0
  4421. CompanyName: Microsoft Corporation
  4422. ProductName: Microsoft® Windows® Operating System
  4423. InternalName: WpdUpFltr.sys
  4424. OriginalFilename: WpdUpFltr.sys
  4425. ProductVersion: 10.0.16273.1000
  4426. FileVersion: 10.0.16273.1000 (WinBuild.160101.0800)
  4427. FileDescription: Windows Portable Device Upper Class Filter Driver
  4428. LegalCopyright: © Microsoft Corporation. All rights reserved.
  4429. fffff805`1eac0000 fffff805`1ead2000 hidusb (deferred)
  4430. Mapped memory image file: c:\symbols\hidusb.sys\2E8A200F12000\hidusb.sys
  4431. Image path: \SystemRoot\System32\drivers\hidusb.sys
  4432. Image name: hidusb.sys
  4433. Timestamp: Thu Sep 29 03:01:51 1994 (2E8A200F)
  4434. CheckSum: 0001082D
  4435. ImageSize: 00012000
  4436. File version: 10.0.16262.1001
  4437. Product version: 10.0.16262.1001
  4438. File flags: 0 (Mask 3F)
  4439. File OS: 40004 NT Win32
  4440. File type: 2.0 Dll
  4441. File date: 00000000.00000000
  4442. Translations: 0409.04b0
  4443. CompanyName: Microsoft Corporation
  4444. ProductName: Microsoft® Windows® Operating System
  4445. InternalName: HIDUSB.SYS
  4446. OriginalFilename: HIDUSB.SYS
  4447. ProductVersion: 10.0.16262.1001
  4448. FileVersion: 10.0.16262.1001 (WinBuild.160101.0800)
  4449. FileDescription: USB Miniport Driver for Input Devices
  4450. LegalCopyright: © Microsoft Corporation. All rights reserved.
  4451. fffff805`1eae0000 fffff805`1eaf9000 CorsairGamingAudioamd64 (deferred)
  4452. Image path: \SystemRoot\system32\DRIVERS\CorsairGamingAudioamd64.sys
  4453. Image name: CorsairGamingAudioamd64.sys
  4454. Timestamp: Thu Aug 3 14:51:06 2017 (59832A4A)
  4455. CheckSum: 000197AD
  4456. ImageSize: 00019000
  4457. Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
  4458. fffff805`1eb00000 fffff805`1eb0a000 speedfan (deferred)
  4459. Image path: \??\C:\Windows\SysWOW64\speedfan.sys
  4460. Image name: speedfan.sys
  4461. Timestamp: Sat Dec 29 20:59:35 2012 (50DF59B7)
  4462. CheckSum: 0000CE4F
  4463. ImageSize: 0000A000
  4464. Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
  4465. fffff805`1eb10000 fffff805`1eb1f000 mouhid (deferred)
  4466. Mapped memory image file: c:\symbols\mouhid.sys\25B918D8f000\mouhid.sys
  4467. Image path: \SystemRoot\System32\drivers\mouhid.sys
  4468. Image name: mouhid.sys
  4469. Timestamp: Sun Jan 21 02:05:12 1990 (25B918D8)
  4470. CheckSum: 00009DAF
  4471. ImageSize: 0000F000
  4472. File version: 10.0.16273.1000
  4473. Product version: 10.0.16273.1000
  4474. File flags: 0 (Mask 3F)
  4475. File OS: 40004 NT Win32
  4476. File type: 2.0 Dll
  4477. File date: 00000000.00000000
  4478. Translations: 0409.04b0
  4479. CompanyName: Microsoft Corporation
  4480. ProductName: Microsoft® Windows® Operating System
  4481. InternalName: mouhid.sys
  4482. OriginalFilename: mouhid.sys
  4483. ProductVersion: 10.0.16273.1000
  4484. FileVersion: 10.0.16273.1000 (WinBuild.160101.0800)
  4485. FileDescription: HID Mouse Filter Driver
  4486. LegalCopyright: © Microsoft Corporation. All rights reserved.
  4487. fffff805`1eb20000 fffff805`1eb2f000 klmouflt (deferred)
  4488. Image path: \SystemRoot\system32\DRIVERS\klmouflt.sys
  4489. Image name: klmouflt.sys
  4490. Timestamp: Wed Nov 30 07:58:40 2016 (583E86B0)
  4491. CheckSum: 0000F557
  4492. ImageSize: 0000F000
  4493. Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
  4494. fffff805`1eb30000 fffff805`1eb42000 mouclass (deferred)
  4495. Mapped memory image file: c:\symbols\mouclass.sys\92A73CAB12000\mouclass.sys
  4496. Image path: \SystemRoot\System32\drivers\mouclass.sys
  4497. Image name: mouclass.sys
  4498. Timestamp: ***** Invalid (92A73CAB)
  4499. CheckSum: 00014AD3
  4500. ImageSize: 00012000
  4501. File version: 10.0.16273.1000
  4502. Product version: 10.0.16273.1000
  4503. File flags: 0 (Mask 3F)
  4504. File OS: 40004 NT Win32
  4505. File type: 3.7 Driver
  4506. File date: 00000000.00000000
  4507. Translations: 0409.04b0
  4508. CompanyName: Microsoft Corporation
  4509. ProductName: Microsoft® Windows® Operating System
  4510. InternalName: mouclass.sys
  4511. OriginalFilename: mouclass.sys
  4512. ProductVersion: 10.0.16273.1000
  4513. FileVersion: 10.0.16273.1000 (WinBuild.160101.0800)
  4514. FileDescription: Mouse Class Driver
  4515. LegalCopyright: © Microsoft Corporation. All rights reserved.
  4516. fffff805`1eb50000 fffff805`1ebaf000 fastfat (deferred)
  4517. Mapped memory image file: c:\symbols\fastfat.SYS\67829B1C5f000\fastfat.SYS
  4518. Image path: \SystemRoot\System32\Drivers\fastfat.SYS
  4519. Image name: fastfat.SYS
  4520. Timestamp: Sat Jan 11 16:23:56 2025 (67829B1C)
  4521. CheckSum: 0005CBE3
  4522. ImageSize: 0005F000
  4523. File version: 10.0.16273.1000
  4524. Product version: 10.0.16273.1000
  4525. File flags: 0 (Mask 3F)
  4526. File OS: 40004 NT Win32
  4527. File type: 3.7 Driver
  4528. File date: 00000000.00000000
  4529. Translations: 0409.04b0
  4530. CompanyName: Microsoft Corporation
  4531. ProductName: Microsoft® Windows® Operating System
  4532. InternalName: fastfat.sys
  4533. OriginalFilename: FastFAT.Sys
  4534. ProductVersion: 10.0.16273.1000
  4535. FileVersion: 10.0.16273.1000 (WinBuild.160101.0800)
  4536. FileDescription: Fast FAT File System Driver
  4537. LegalCopyright: © Microsoft Corporation. All rights reserved.
  4538. fffff805`1ebc0000 fffff805`1ebcf000 dump_diskdump (deferred)
  4539. Mapped memory image file: c:\symbols\diskdump.sys\988D6CDEf000\diskdump.sys
  4540. Image path: \SystemRoot\System32\Drivers\dump_diskdump.sys
  4541. Image name: dump_diskdump.sys
  4542. Timestamp: ***** Invalid (988D6CDE)
  4543. CheckSum: 00016738
  4544. ImageSize: 0000F000
  4545. File version: 10.0.16262.1001
  4546. Product version: 10.0.16262.1001
  4547. File flags: 0 (Mask 3F)
  4548. File OS: 40004 NT Win32
  4549. File type: 3.7 Driver
  4550. File date: 00000000.00000000
  4551. Translations: 0409.04b0
  4552. CompanyName: Microsoft Corporation
  4553. ProductName: Microsoft® Windows® Operating System
  4554. InternalName: diskdump.sys
  4555. OriginalFilename: diskdump.sys
  4556. ProductVersion: 10.0.16262.1001
  4557. FileVersion: 10.0.16262.1001 (WinBuild.160101.0800)
  4558. FileDescription: Crash Dump Disk Driver
  4559. LegalCopyright: © Microsoft Corporation. All rights reserved.
  4560. fffff805`1ec00000 fffff805`1ec23000 dump_secnvme (deferred)
  4561. Image path: \SystemRoot\System32\Drivers\dump_secnvme.sys
  4562. Image name: dump_secnvme.sys
  4563. Timestamp: Fri Mar 17 06:03:34 2017 (58CB7C36)
  4564. CheckSum: 00030180
  4565. ImageSize: 00023000
  4566. Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
  4567. fffff805`1ec50000 fffff805`1ec6d000 dump_dumpfve (deferred)
  4568. Mapped memory image file: c:\symbols\dumpfve.sys\C2B56CB91d000\dumpfve.sys
  4569. Image path: \SystemRoot\System32\Drivers\dump_dumpfve.sys
  4570. Image name: dump_dumpfve.sys
  4571. Timestamp: ***** Invalid (C2B56CB9)
  4572. CheckSum: 0001E684
  4573. ImageSize: 0001D000
  4574. File version: 10.0.16262.1001
  4575. Product version: 10.0.16262.1001
  4576. File flags: 0 (Mask 3F)
  4577. File OS: 40004 NT Win32
  4578. File type: 3.7 Driver
  4579. File date: 00000000.00000000
  4580. Translations: 0000.04b0
  4581. CompanyName: Microsoft Corporation
  4582. ProductName: Microsoft® Windows® Operating System
  4583. InternalName: dumpfve.sys
  4584. OriginalFilename: dumpfve.sys
  4585. ProductVersion: 10.0.16262.1001
  4586. FileVersion: 10.0.16262.1001 (WinBuild.160101.0800)
  4587. FileDescription: Bitlocker Drive Encryption Crashdump Filter
  4588. LegalCopyright: © Microsoft Corporation. All rights reserved.
  4589. fffff805`1ec70000 fffff805`1ec81000 monitor (deferred)
  4590. Mapped memory image file: c:\symbols\monitor.sys\CBD8B93811000\monitor.sys
  4591. Image path: \SystemRoot\System32\drivers\monitor.sys
  4592. Image name: monitor.sys
  4593. Timestamp: ***** Invalid (CBD8B938)
  4594. CheckSum: 0000D8CC
  4595. ImageSize: 00011000
  4596. File version: 10.0.16273.1000
  4597. Product version: 10.0.16273.1000
  4598. File flags: 0 (Mask 3F)
  4599. File OS: 40004 NT Win32
  4600. File type: 3.7 Driver
  4601. File date: 00000000.00000000
  4602. Translations: 0409.04b0
  4603. CompanyName: Microsoft Corporation
  4604. ProductName: Microsoft® Windows® Operating System
  4605. InternalName: monitor.sys
  4606. OriginalFilename: monitor.sys
  4607. ProductVersion: 10.0.16273.1000
  4608. FileVersion: 10.0.16273.1000 (WinBuild.160101.0800)
  4609. FileDescription: Monitor Driver
  4610. LegalCopyright: © Microsoft Corporation. All rights reserved.
  4611. fffff805`1ec90000 fffff805`1ec9d000 000 (deferred)
  4612. Image path: \??\C:\Program Files (x86)\CyberLink\PowerDVD17\Common\NavFilter\000.fcl
  4613. Image name: 000.fcl
  4614. Timestamp: Tue Sep 1 07:15:20 2015 (55E54278)
  4615. CheckSum: 0000C388
  4616. ImageSize: 0000D000
  4617. Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
  4618. fffff805`1eca0000 fffff805`1fd07000 nvlddmkm (deferred)
  4619. Image path: \SystemRoot\System32\DriverStore\FileRepository\nv_ref_pubwu.inf_amd64_17a7729c4a220588\nvlddmkm.sys
  4620. Image name: nvlddmkm.sys
  4621. Timestamp: Sun Sep 3 22:34:19 2017 (59AC755B)
  4622. CheckSum: 01012A10
  4623. ImageSize: 01067000
  4624. Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
  4625. fffff805`1fd10000 fffff805`1fd1c000 wmiacpi (deferred)
  4626. Mapped memory image file: c:\symbols\wmiacpi.sys\DE409228c000\wmiacpi.sys
  4627. Image path: \SystemRoot\System32\drivers\wmiacpi.sys
  4628. Image name: wmiacpi.sys
  4629. Timestamp: ***** Invalid (DE409228)
  4630. CheckSum: 0000D824
  4631. ImageSize: 0000C000
  4632. File version: 10.0.16262.1001
  4633. Product version: 10.0.16262.1001
  4634. File flags: 0 (Mask 3F)
  4635. File OS: 40004 NT Win32
  4636. File type: 3.7 Driver
  4637. File date: 00000000.00000000
  4638. Translations: 0409.04b0
  4639. CompanyName: Microsoft Corporation
  4640. ProductName: Microsoft® Windows® Operating System
  4641. InternalName: wmiacpi.sys
  4642. OriginalFilename: wmiacpi.sys
  4643. ProductVersion: 10.0.16262.1001
  4644. FileVersion: 10.0.16262.1001 (WinBuild.160101.0800)
  4645. FileDescription: Windows Management Interface for ACPI
  4646. LegalCopyright: © Microsoft Corporation. All rights reserved.
  4647. fffff805`1fd20000 fffff805`1fd58000 amdppm (deferred)
  4648. Mapped memory image file: c:\symbols\amdppm.sys\E154DCE338000\amdppm.sys
  4649. Image path: \SystemRoot\System32\drivers\amdppm.sys
  4650. Image name: amdppm.sys
  4651. Timestamp: ***** Invalid (E154DCE3)
  4652. CheckSum: 00031F90
  4653. ImageSize: 00038000
  4654. File version: 10.0.16273.1000
  4655. Product version: 10.0.16273.1000
  4656. File flags: 0 (Mask 3F)
  4657. File OS: 40004 NT Win32
  4658. File type: 3.7 Driver
  4659. File date: 00000000.00000000
  4660. Translations: 0409.04b0
  4661. CompanyName: Microsoft Corporation
  4662. ProductName: Microsoft® Windows® Operating System
  4663. InternalName: amdppm.sys
  4664. OriginalFilename: amdppm.sys
  4665. ProductVersion: 10.0.16273.1000
  4666. FileVersion: 10.0.16273.1000 (WinBuild.160101.0800)
  4667. FileDescription: Processor Device Driver
  4668. LegalCopyright: © Microsoft Corporation. All rights reserved.
  4669. fffff805`1fd60000 fffff805`1fd6c000 amdgpio2 (deferred)
  4670. Image path: \SystemRoot\System32\drivers\amdgpio2.sys
  4671. Image name: amdgpio2.sys
  4672. Timestamp: Tue Aug 9 11:05:07 2016 (57A9AAD3)
  4673. CheckSum: 00008F89
  4674. ImageSize: 0000C000
  4675. Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
  4676. fffff805`1fd70000 fffff805`1fd9d000 msgpioclx (deferred)
  4677. Mapped memory image file: c:\symbols\msgpioclx.sys\984DCFE72d000\msgpioclx.sys
  4678. Image path: \SystemRoot\System32\Drivers\msgpioclx.sys
  4679. Image name: msgpioclx.sys
  4680. Timestamp: ***** Invalid (984DCFE7)
  4681. CheckSum: 0002C16F
  4682. ImageSize: 0002D000
  4683. File version: 10.0.16273.1000
  4684. Product version: 10.0.16273.1000
  4685. File flags: 0 (Mask 3F)
  4686. File OS: 40004 NT Win32
  4687. File type: 2.0 Dll
  4688. File date: 00000000.00000000
  4689. Translations: 0409.04b0
  4690. CompanyName: Microsoft Corporation
  4691. ProductName: Microsoft® Windows® Operating System
  4692. InternalName: msgpioclx.sys
  4693. OriginalFilename: msgpioclx.sys
  4694. ProductVersion: 10.0.16273.1000
  4695. FileVersion: 10.0.16273.1000 (WinBuild.160101.0800)
  4696. FileDescription: GPIO Class Extension Driver
  4697. LegalCopyright: © Microsoft Corporation. All rights reserved.
  4698. fffff805`1fda0000 fffff805`1fdaa000 amdgpio3 (deferred)
  4699. Image path: \SystemRoot\System32\drivers\amdgpio3.sys
  4700. Image name: amdgpio3.sys
  4701. Timestamp: Mon Mar 14 10:19:36 2016 (56E69038)
  4702. CheckSum: 00016CD4
  4703. ImageSize: 0000A000
  4704. Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
  4705. fffff805`1fdb0000 fffff805`1fdbd000 UEFI (deferred)
  4706. Mapped memory image file: c:\symbols\UEFI.sys\A89859B3d000\UEFI.sys
  4707. Image path: \SystemRoot\System32\drivers\UEFI.sys
  4708. Image name: UEFI.sys
  4709. Timestamp: ***** Invalid (A89859B3)
  4710. CheckSum: 0000D4DD
  4711. ImageSize: 0000D000
  4712. File version: 10.0.16273.1000
  4713. Product version: 10.0.16273.1000
  4714. File flags: 0 (Mask 3F)
  4715. File OS: 40004 NT Win32
  4716. File type: 3.7 Driver
  4717. File date: 00000000.00000000
  4718. Translations: 0409.04b0
  4719. CompanyName: Microsoft Corporation
  4720. ProductName: Microsoft® Windows® Operating System
  4721. InternalName: UEFI.sys
  4722. OriginalFilename: UEFI.sys
  4723. ProductVersion: 10.0.16273.1000
  4724. FileVersion: 10.0.16273.1000 (WinBuild.160101.0800)
  4725. FileDescription: UEFI Driver for NT
  4726. LegalCopyright: © Microsoft Corporation. All rights reserved.
  4727. fffff805`1fdc0000 fffff805`1fdcd000 NdisVirtualBus (deferred)
  4728. Mapped memory image file: c:\symbols\NdisVirtualBus.sys\74D36D6Ed000\NdisVirtualBus.sys
  4729. Image path: \SystemRoot\System32\drivers\NdisVirtualBus.sys
  4730. Image name: NdisVirtualBus.sys
  4731. Timestamp: Tue Feb 10 08:06:06 2032 (74D36D6E)
  4732. CheckSum: 00009F7A
  4733. ImageSize: 0000D000
  4734. File version: 10.0.16262.1001
  4735. Product version: 10.0.16262.1001
  4736. File flags: 0 (Mask 3F)
  4737. File OS: 40004 NT Win32
  4738. File type: 3.6 Driver
  4739. File date: 00000000.00000000
  4740. Translations: 0409.04b0
  4741. CompanyName: Microsoft Corporation
  4742. ProductName: Microsoft® Windows® Operating System
  4743. InternalName: NdisVirtualBus.sys
  4744. OriginalFilename: NdisVirtualBus.sys
  4745. ProductVersion: 10.0.16262.1001
  4746. FileVersion: 10.0.16262.1001 (WinBuild.160101.0800)
  4747. FileDescription: Microsoft Virtual Network Adapter Enumerator
  4748. LegalCopyright: © Microsoft Corporation. All rights reserved.
  4749. fffff805`1fdd0000 fffff805`1fddc000 swenum (deferred)
  4750. Mapped memory image file: c:\symbols\swenum.sys\3C18D717c000\swenum.sys
  4751. Image path: \SystemRoot\System32\drivers\swenum.sys
  4752. Image name: swenum.sys
  4753. Timestamp: Thu Dec 13 16:28:07 2001 (3C18D717)
  4754. CheckSum: 00005F7D
  4755. ImageSize: 0000C000
  4756. File version: 10.0.16246.1000
  4757. Product version: 10.0.16246.1000
  4758. File flags: 0 (Mask 3F)
  4759. File OS: 40004 NT Win32
  4760. File type: 3.0 Driver
  4761. File date: 00000000.00000000
  4762. Translations: 0000.04b0
  4763. CompanyName: Microsoft Corporation
  4764. ProductName: Microsoft® Windows® Operating System
  4765. InternalName: swenum.sys
  4766. OriginalFilename: swenum.sys
  4767. ProductVersion: 10.0.16246.1000
  4768. FileVersion: 10.0.16246.1000 (WinBuild.160101.0800)
  4769. FileDescription: Plug and Play Software Device Enumerator
  4770. LegalCopyright: © Microsoft Corporation. All rights reserved.
  4771. fffff805`1fde0000 fffff805`1fdee000 CorsairVBusDriver (deferred)
  4772. Image path: \SystemRoot\System32\drivers\CorsairVBusDriver.sys
  4773. Image name: CorsairVBusDriver.sys
  4774. Timestamp: Thu May 25 14:04:01 2017 (5926D641)
  4775. CheckSum: 00019E2A
  4776. ImageSize: 0000E000
  4777. Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
  4778. fffff805`1fdf0000 fffff805`1fdfe000 rdpbus (deferred)
  4779. Mapped memory image file: c:\symbols\rdpbus.sys\BF7D986Ce000\rdpbus.sys
  4780. Image path: \SystemRoot\System32\drivers\rdpbus.sys
  4781. Image name: rdpbus.sys
  4782. Timestamp: ***** Invalid (BF7D986C)
  4783. CheckSum: 0000C9F3
  4784. ImageSize: 0000E000
  4785. File version: 10.0.16273.1000
  4786. Product version: 10.0.16273.1000
  4787. File flags: 0 (Mask 3F)
  4788. File OS: 40004 NT Win32
  4789. File type: 3.0 Driver
  4790. File date: 00000000.00000000
  4791. Translations: 0409.04b0
  4792. CompanyName: Microsoft Corporation
  4793. ProductName: Microsoft® Windows® Operating System
  4794. InternalName: RDPBUS.SYS
  4795. OriginalFilename: RDPBUS.SYS
  4796. ProductVersion: 10.0.16273.1000
  4797. FileVersion: 10.0.16273.1000 (WinBuild.160101.0800)
  4798. FileDescription: Microsoft RDP Bus Device driver
  4799. LegalCopyright: © Microsoft Corporation. All rights reserved.
  4800. fffffb67`f8000000 fffffb67`f8394000 win32kfull (deferred)
  4801. Image path: \SystemRoot\System32\win32kfull.sys
  4802. Image name: win32kfull.sys
  4803. Timestamp: unavailable (00000000)
  4804. CheckSum: 00000000
  4805. ImageSize: 00394000
  4806. Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
  4807. fffffb67`f83a0000 fffffb67`f85b2000 win32kbase (deferred)
  4808. Image path: \SystemRoot\System32\win32kbase.sys
  4809. Image name: win32kbase.sys
  4810. Timestamp: unavailable (00000000)
  4811. CheckSum: 00000000
  4812. ImageSize: 00212000
  4813. Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
  4814. fffffb67`f85d0000 fffffb67`f85da000 TSDDD (deferred)
  4815. Image path: \SystemRoot\System32\TSDDD.dll
  4816. Image name: TSDDD.dll
  4817. Timestamp: unavailable (00000000)
  4818. CheckSum: 00000000
  4819. ImageSize: 0000A000
  4820. Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
  4821. fffffb67`f8730000 fffffb67`f8771000 cdd (deferred)
  4822. Image path: \SystemRoot\System32\cdd.dll
  4823. Image name: cdd.dll
  4824. Timestamp: unavailable (00000000)
  4825. CheckSum: 00000000
  4826. ImageSize: 00041000
  4827. Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
  4828. fffffb67`f88f0000 fffffb67`f8967000 win32k (deferred)
  4829. Image path: \SystemRoot\System32\win32k.sys
  4830. Image name: win32k.sys
  4831. Timestamp: unavailable (00000000)
  4832. CheckSum: 00000000
  4833. ImageSize: 00077000
  4834. Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
  4835.  
  4836. Unloaded modules:
  4837. fffff800`2af20000 fffff800`2af2f000 hiber_storpo
  4838. Timestamp: unavailable (00000000)
  4839. Checksum: 00000000
  4840. ImageSize: 0000F000
  4841. fffff800`2af30000 fffff800`2af53000 hiber_secnvm
  4842. Timestamp: unavailable (00000000)
  4843. Checksum: 00000000
  4844. ImageSize: 00023000
  4845. fffff800`2af60000 fffff800`2af7d000 hiber_dumpfv
  4846. Timestamp: unavailable (00000000)
  4847. Checksum: 00000000
  4848. ImageSize: 0001D000
  4849. fffff800`2aed0000 fffff800`2aed9000 optovcm.sys
  4850. Timestamp: unavailable (00000000)
  4851. Checksum: 00000000
  4852. ImageSize: 00009000
  4853. fffff800`2aec0000 fffff800`2aec7000 optousb.sys
  4854. Timestamp: unavailable (00000000)
  4855. Checksum: 00000000
  4856. ImageSize: 00007000
  4857. fffff800`2ae30000 fffff800`2ae3b000 umpass.sys
  4858. Timestamp: unavailable (00000000)
  4859. Checksum: 00000000
  4860. ImageSize: 0000B000
  4861. fffff805`1e990000 fffff805`1e999000 optovcm.sys
  4862. Timestamp: unavailable (00000000)
  4863. Checksum: 00000000
  4864. ImageSize: 00009000
  4865. fffff805`1e810000 fffff805`1e817000 optousb.sys
  4866. Timestamp: unavailable (00000000)
  4867. Checksum: 00000000
  4868. ImageSize: 00007000
  4869. fffff800`2aea0000 fffff800`2aea7000 magdrvamd64.
  4870. Timestamp: unavailable (00000000)
  4871. Checksum: 00000000
  4872. ImageSize: 00007000
  4873. fffff800`2ae90000 fffff800`2ae97000 magdrvamd64.
  4874. Timestamp: unavailable (00000000)
  4875. Checksum: 00000000
  4876. ImageSize: 00007000
  4877. fffff800`2ae80000 fffff800`2ae87000 magdrvamd64.
  4878. Timestamp: unavailable (00000000)
  4879. Checksum: 00000000
  4880. ImageSize: 00007000
  4881. fffff800`2af60000 fffff800`2af6f000 hiber_storpo
  4882. Timestamp: unavailable (00000000)
  4883. Checksum: 00000000
  4884. ImageSize: 0000F000
  4885. fffff800`2af70000 fffff800`2af93000 hiber_secnvm
  4886. Timestamp: unavailable (00000000)
  4887. Checksum: 00000000
  4888. ImageSize: 00023000
  4889. fffff800`2afa0000 fffff800`2afbd000 hiber_dumpfv
  4890. Timestamp: unavailable (00000000)
  4891. Checksum: 00000000
  4892. ImageSize: 0001D000
  4893. fffff800`2af20000 fffff800`2af2b000 umpass.sys
  4894. Timestamp: unavailable (00000000)
  4895. Checksum: 00000000
  4896. ImageSize: 0000B000
  4897. fffff800`2af50000 fffff800`2af57000 magdrvamd64.
  4898. Timestamp: unavailable (00000000)
  4899. Checksum: 00000000
  4900. ImageSize: 00007000
  4901. fffff800`2af40000 fffff800`2af47000 magdrvamd64.
  4902. Timestamp: unavailable (00000000)
  4903. Checksum: 00000000
  4904. ImageSize: 00007000
  4905. fffff800`2af30000 fffff800`2af37000 magdrvamd64.
  4906. Timestamp: unavailable (00000000)
  4907. Checksum: 00000000
  4908. ImageSize: 00007000
  4909. fffff800`2aec0000 fffff800`2aecf000 hiber_storpo
  4910. Timestamp: unavailable (00000000)
  4911. Checksum: 00000000
  4912. ImageSize: 0000F000
  4913. fffff800`2aed0000 fffff800`2aef3000 hiber_secnvm
  4914. Timestamp: unavailable (00000000)
  4915. Checksum: 00000000
  4916. ImageSize: 00023000
  4917. fffff800`2af00000 fffff800`2af1d000 hiber_dumpfv
  4918. Timestamp: unavailable (00000000)
  4919. Checksum: 00000000
  4920. ImageSize: 0001D000
  4921. fffff800`2ae30000 fffff800`2ae3b000 umpass.sys
  4922. Timestamp: unavailable (00000000)
  4923. Checksum: 00000000
  4924. ImageSize: 0000B000
  4925. fffff800`2b5b0000 fffff800`2b5d4000 tunnel.sys
  4926. Timestamp: unavailable (00000000)
  4927. Checksum: 00000000
  4928. ImageSize: 00024000
  4929. fffff800`2aea0000 fffff800`2aea7000 magdrvamd64.
  4930. Timestamp: unavailable (00000000)
  4931. Checksum: 00000000
  4932. ImageSize: 00007000
  4933. fffff800`2ae90000 fffff800`2ae97000 magdrvamd64.
  4934. Timestamp: unavailable (00000000)
  4935. Checksum: 00000000
  4936. ImageSize: 00007000
  4937. fffff800`2ae80000 fffff800`2ae87000 magdrvamd64.
  4938. Timestamp: unavailable (00000000)
  4939. Checksum: 00000000
  4940. ImageSize: 00007000
  4941. fffff805`1e820000 fffff805`1e829000 CorsairVHidD
  4942. Timestamp: unavailable (00000000)
  4943. Checksum: 00000000
  4944. ImageSize: 00009000
  4945. fffff805`16ad0000 fffff805`16afd000 klids.sys
  4946. Timestamp: unavailable (00000000)
  4947. Checksum: 00000000
  4948. ImageSize: 0002D000
  4949. fffff805`15e20000 fffff805`15e2f000 dump_storpor
  4950. Timestamp: unavailable (00000000)
  4951. Checksum: 00000000
  4952. ImageSize: 0000F000
  4953. fffff805`15e60000 fffff805`15e83000 dump_secnvme
  4954. Timestamp: unavailable (00000000)
  4955. Checksum: 00000000
  4956. ImageSize: 00023000
  4957. fffff805`15eb0000 fffff805`15ecd000 dump_dumpfve
  4958. Timestamp: unavailable (00000000)
  4959. Checksum: 00000000
  4960. ImageSize: 0001D000
  4961. fffff805`1eb80000 fffff805`1eb9c000 BTHUSB.sys
  4962. Timestamp: unavailable (00000000)
  4963. Checksum: 00000000
  4964. ImageSize: 0001C000
  4965. fffff805`1eba0000 fffff805`1ec9f000 bthport.sys
  4966. Timestamp: unavailable (00000000)
  4967. Checksum: 00000000
  4968. ImageSize: 000FF000
  4969. fffff805`1eb50000 fffff805`1eb7b000 ibtusb.sys
  4970. Timestamp: unavailable (00000000)
  4971. Checksum: 00000000
  4972. ImageSize: 0002B000
  4973. fffff805`1eb00000 fffff805`1eb0b000 klpnpflt.sys
  4974. Timestamp: unavailable (00000000)
  4975. Checksum: 00000000
  4976. ImageSize: 0000B000
  4977. fffff805`1eab0000 fffff805`1eabb000 klpnpflt.sys
  4978. Timestamp: unavailable (00000000)
  4979. Checksum: 00000000
  4980. ImageSize: 0000B000
  4981. fffff805`1e9f0000 fffff805`1e9fb000 klpnpflt.sys
  4982. Timestamp: unavailable (00000000)
  4983. Checksum: 00000000
  4984. ImageSize: 0000B000
  4985. fffff805`1e9e0000 fffff805`1e9eb000 klpnpflt.sys
  4986. Timestamp: unavailable (00000000)
  4987. Checksum: 00000000
  4988. ImageSize: 0000B000
  4989. fffff805`1e990000 fffff805`1e99b000 klpnpflt.sys
  4990. Timestamp: unavailable (00000000)
  4991. Checksum: 00000000
  4992. ImageSize: 0000B000
  4993. fffff805`1e810000 fffff805`1e81b000 klpnpflt.sys
  4994. Timestamp: unavailable (00000000)
  4995. Checksum: 00000000
  4996. ImageSize: 0000B000
  4997. fffff805`1e700000 fffff805`1e70a000 amdkmafd.sys
  4998. Timestamp: unavailable (00000000)
  4999. Checksum: 00000000
  5000. ImageSize: 0000A000
  5001. fffff805`16b40000 fffff805`16b59000 dam.sys
  5002. Timestamp: unavailable (00000000)
  5003. Checksum: 00000000
  5004. ImageSize: 00019000
  5005. fffff805`144d0000 fffff805`144dc000 klelam.sys
  5006. Timestamp: unavailable (00000000)
  5007. Checksum: 00000000
  5008. ImageSize: 0000C000
  5009. fffff805`15d30000 fffff805`15d3f000 hwpolicy.sys
  5010. Timestamp: unavailable (00000000)
  5011. Checksum: 00000000
  5012. ImageSize: 0000F000
  5013. 2: kd> q
  5014. quit:
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!