jcgriff2 BSOD - Windows 8.1 x64 - 0x139

jcgriff2

jcgriff2

Co-Founder / Admin
BSOD Instructor/Expert
Microsoft MVP (Ret.)
Staff member
Joined
Feb 19, 2012
Posts
21,541
Location
New Jersey Shore
I was very surprised to be hit with a 0x139 bugcheck BSOD about 30 min ago.

0x139 = KERNEL_SECURITY_CHECK_FAILURE

Intel wifi driver is the apparent culprit, but I have the most recent version installed -
Code: 
NETwbw02.sys Mon Mar 23 04:53:41 2015 (550FD495)

Wifi - Intel Dual Band Wireless-AC 3160 - v17.16.0.4 (per Device Manager) - 3/23/2015

Intel driver download pages:


I had a lot of apps running at the time, including at least 15 IE; 8 Firefox; system was waiting to reboot to finish Windows Updates (I had delayed reboot several times)

Not much to do as the Intel wifi driver is up to date.

Also to note: Exception 0xc409 listed in dump -
The system detected an overrun of a stack-based buffer in this application. This overrun could potentially allow a malicious user to gain control of this application.
Click to expand...

Thanks,

John

EDIT: Having difficulty uploading Sysnative/jcgriff2 BSOD Collection app zip attachment

Code: 
Microsoft (R) Windows Debugger Version 6.3.9600.16384 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Windows\MEMORY_07-06-2015_2120.DMP]
Kernel Bitmap Dump File: Only kernel address space is available


************* Symbol Path validation summary **************
Response                         Time (ms)     Location
Deferred                                       SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 8 Kernel Version 9600 MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 9600.17736.amd64fre.winblue_r9.150322-1500
Machine Name:
Kernel base = 0xfffff803`27e81000 PsLoadedModuleList = 0xfffff803`2815a850
Debug session time: Mon Jul  6 21:19:12.908 2015 (UTC - 4:00)
System Uptime: 15 days 16:03:27.594
Loading Kernel Symbols
...............................................................
................................................................
...........................................
Loading User Symbols

Loading unloaded module list
..............................
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 139, {3, ffffd0002136fda0, ffffd0002136fcf8, 0}

*** ERROR: Module load completed but symbols could not be loaded for NETwbw02.sys
Processing initial command '!analyze -v;r;kv;lmtn;lmtsmn;.bugcheck'
Probably caused by : vwififlt.sys ( vwififlt!FilterSendNetBufferListsComplete+181 )

Followup: MachineOwner
---------

0: kd> !analyze -v;r;kv;lmtn;lmtsmn;.bugcheck
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

KERNEL_SECURITY_CHECK_FAILURE (139)
A kernel component has corrupted a critical data structure.  The corruption
could potentially allow a malicious user to gain control of this machine.
Arguments:
Arg1: 0000000000000003, A LIST_ENTRY has been corrupted (i.e. double remove).
Arg2: ffffd0002136fda0, Address of the trap frame for the exception that caused the bugcheck
Arg3: ffffd0002136fcf8, Address of the exception record for the exception that caused the bugcheck
Arg4: 0000000000000000, Reserved

Debugging Details:
------------------


TRAP_FRAME:  ffffd0002136fda0 -- (.trap 0xffffd0002136fda0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000002 rbx=0000000000000000 rcx=0000000000000003
rdx=ffffe00053b52018 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8008043ac3a rsp=ffffd0002136ff30 rbp=ffffd0002136ffc0
 r8=ffffe0001f555018  r9=0000000000000001 r10=ffffe0001c591c70
r11=ffffe0001c4dc5a1 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na po cy
ndis!ndisFreeToNPagedPool+0x59:
fffff800`8043ac3a cd29            int     29h
Resetting default scope

EXCEPTION_RECORD:  ffffd0002136fcf8 -- (.exr 0xffffd0002136fcf8)
ExceptionAddress: fffff8008043ac3a (ndis!ndisFreeToNPagedPool+0x0000000000000059)
   ExceptionCode: c0000409 (Security check failure or stack buffer overrun)
  ExceptionFlags: 00000001
NumberParameters: 1
   Parameter[0]: 0000000000000003

DEFAULT_BUCKET_ID:  LIST_ENTRY_CORRUPT

BUGCHECK_STR:  0x139

PROCESS_NAME:  System

CURRENT_IRQL:  2

ERROR_CODE: (NTSTATUS) 0xc0000409 - The system detected an overrun of a stack-based buffer in this application. This overrun could potentially allow a malicious user to gain control of this application.

EXCEPTION_CODE: (NTSTATUS) 0xc0000409 - The system detected an overrun of a stack-based buffer in this application. This overrun could potentially allow a malicious user to gain control of this application.

EXCEPTION_PARAMETER1:  0000000000000003

ANALYSIS_VERSION: 6.3.9600.16384 (debuggers(dbg).130821-1623) amd64fre

LAST_CONTROL_TRANSFER:  from fffff80327fdd7e9 to fffff80327fd1ca0

STACK_TEXT:  
ffffd000`2136fa78 fffff803`27fdd7e9 : 00000000`00000139 00000000`00000003 ffffd000`2136fda0 ffffd000`2136fcf8 : nt!KeBugCheckEx
ffffd000`2136fa80 fffff803`27fddb10 : ffffe000`16b27c70 00000000`00000001 ffffe000`4d0abd10 fffff800`8055c2df : nt!KiBugCheckDispatch+0x69
ffffd000`2136fbc0 fffff803`27fdcd34 : 00000000`00000000 fffff800`80653a9a ffffe000`16b27dd0 ffffe000`16b27c70 : nt!KiFastFailDispatch+0xd0
ffffd000`2136fda0 fffff800`8043ac3a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiRaiseSecurityCheckFailure+0xf4
ffffd000`2136ff30 fffff800`804359ff : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ndis!ndisFreeToNPagedPool+0x59
ffffd000`2136ff60 fffff800`804559dd : ffffe000`44049880 ffffe000`53b52030 00000000`00000000 ffffe000`1c592001 : ndis!NdisFreeNetBuffer+0xdf
ffffd000`2136ffd0 fffff800`81364e19 : ffffe000`1c592ca0 ffffe000`20695130 ffffe000`44049880 00000000`00000001 : ndis!NdisFreeCloneNetBufferList+0x292fd
ffffd000`21370080 fffff800`80430eee : 00000000`00000000 ffffd000`213701d0 fffff800`81364c98 00000000`00000000 : vwififlt!FilterSendNetBufferListsComplete+0x181
ffffd000`213700d0 fffff800`81e9e671 : ffffe000`1a7b61a0 ffffe000`44049880 00000000`00000001 00000000`00000000 : ndis!NdisMSendNetBufferListsComplete+0x4de
ffffd000`21370240 fffff800`81d0f222 : ffffe000`1adc95f0 fffff800`81d0ec3f ffffe000`1adc9478 ffffe000`1ade7fe0 : NETwbw02+0x1b1671
ffffd000`21370270 fffff800`81e4d73b : ffffe000`1adc9478 ffffe000`00000000 00000000`00000000 ffffe000`1a7de000 : NETwbw02+0x22222
ffffd000`213702b0 fffff800`81d10099 : ffffe000`1ade7fe0 ffffe000`1ade7fe0 00000000`00000000 fffff800`81d0fc1a : NETwbw02+0x16073b
ffffd000`213703c0 fffff800`81d08723 : ffffe000`1a930d70 ffffe000`1ade18b8 ffffe000`1ade7fe0 00000000`00000010 : NETwbw02+0x23099
ffffd000`21370410 fffff800`81d25782 : 00000000`00000000 ffffe000`1ade9ea0 ffffe000`1b796b00 ffffe000`1adc9420 : NETwbw02+0x1b723
ffffd000`21370460 fffff800`81d488dd : 00000000`00000000 ffffe000`00000000 ffff43c0`7aaeb3e0 00000000`00000000 : NETwbw02+0x38782
ffffd000`213704b0 fffff800`81e5296c : 00000000`00000000 00000000`00000000 ffffe000`1ade1920 ffffe000`1aa56000 : NETwbw02+0x5b8dd
ffffd000`213704e0 fffff800`81d10099 : ffffe000`0026da00 00000000`00000000 ffffe000`1aa56000 00000000`00000000 : NETwbw02+0x16596c
ffffd000`21370510 fffff800`81d08723 : ffffe000`1b1e8d70 ffffe000`1ade9ff0 ffffe000`1ade1920 00000000`00000018 : NETwbw02+0x23099
ffffd000`21370560 fffff800`81e7b5dd : ffffe000`1aa62d60 ffffd000`213706f0 00000000`00000000 ffffd000`213705e8 : NETwbw02+0x1b723
ffffd000`213705b0 fffff800`81e7ab8c : 00000000`00000000 ffffd000`21370750 00000000`00000000 ffffe000`1aa62d60 : NETwbw02+0x18e5dd
ffffd000`21370650 fffff800`81eb2d5d : ffffe000`1b1e8d70 ffffe000`1ade9ff0 ffffe000`1b163000 00000000`00000001 : NETwbw02+0x18db8c
ffffd000`21370790 fffff800`81eb434d : ffffd000`00006000 ffffe000`66e5f000 ffffe000`1a8983c0 ffffe000`1a7a76ff : NETwbw02+0x1c5d5d
ffffd000`21370810 fffff800`81eb53e9 : ffffe000`1a8983c0 ffffd000`21370888 ffffd000`21574044 01d0b852`eeece3d3 : NETwbw02+0x1c734d
ffffd000`21370840 fffff800`81eb5a42 : ffffe000`1a8e9890 ffffd000`21e73040 00000000`00000001 00000000`000000ff : NETwbw02+0x1c83e9
ffffd000`213708d0 fffff800`81eadc15 : ffffe000`00000001 fffff800`81eae4ff 00000000`00000000 fffff803`28184180 : NETwbw02+0x1c8a42
ffffd000`21370970 fffff800`81ea48c8 : ffffe000`ffffff00 ffffe000`1a925850 00000000`00000000 ffffe000`1a7b61a0 : NETwbw02+0x1c0c15
ffffd000`213709d0 fffff800`81e9647a : 00000000`00000005 ffffe000`1896e300 ffffd000`00000001 ffff9cfb`6a694bdf : NETwbw02+0x1b78c8
ffffd000`21370a00 fffff800`804391f0 : 00000000`00000000 00000000`00000000 fffff803`28184180 ffffe000`173cf180 : NETwbw02+0x1a947a
ffffd000`21370a30 fffff800`804394eb : ffffe000`1a925d38 00000000`0000000a 00000000`00000001 fffff803`27ef7635 : ndis!ndisMiniportDpc+0x110
ffffd000`21370ad0 fffff800`80438fae : ffffe000`173d53e0 ffffe000`173d53c0 ffffe000`173cf000 ffffe000`1a925d78 : ndis!ndisQueuedMiniportDpcWorkItem+0xfb
ffffd000`21370b70 fffff803`27f8136c : ffffd000`2054f3c0 ffffe000`173cf040 00000000`00000080 ffffe000`173cf040 : ndis!ndisReceiveWorkerThread+0x20e
ffffd000`21370c00 fffff803`27fd82c6 : ffffd000`20543180 ffffe000`173cf040 ffffd000`2054f3c0 ffffc000`1ac61c70 : nt!PspSystemThreadStartup+0x58
ffffd000`21370c60 00000000`00000000 : ffffd000`21371000 ffffd000`2136b000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x16


STACK_COMMAND:  kb

FOLLOWUP_IP: 
vwififlt!FilterSendNetBufferListsComplete+181
fffff800`81364e19 488b0d40920000  mov     rcx,qword ptr [vwififlt!WPP_GLOBAL_Control (fffff800`8136e060)]

SYMBOL_STACK_INDEX:  7

SYMBOL_NAME:  vwififlt!FilterSendNetBufferListsComplete+181

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: vwififlt

IMAGE_NAME:  vwififlt.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  53609ba2

BUCKET_ID_FUNC_OFFSET:  181

FAILURE_BUCKET_ID:  0x139_3_vwififlt!FilterSendNetBufferListsComplete

BUCKET_ID:  0x139_3_vwififlt!FilterSendNetBufferListsComplete

ANALYSIS_SOURCE:  KM

FAILURE_ID_HASH_STRING:  km:0x139_3_vwififlt!filtersendnetbufferlistscomplete

FAILURE_ID_HASH:  {e85670f0-8cf4-aafd-5f32-c9de2917d36a}

Followup: MachineOwner
---------

rax=ffffd0002136fb80 rbx=ffffe00053b52010 rcx=0000000000000139
rdx=0000000000000003 rsi=ffffe000173d14c0 rdi=ffffe000173d14c0
rip=fffff80327fd1ca0 rsp=ffffd0002136fa78 rbp=ffffd0002136fe20
 r8=ffffd0002136fda0  r9=ffffd0002136fcf8 r10=0000000000000000
r11=ffffe0001c4dc5a1 r12=0000000000000001 r13=0000000000000000
r14=ffffe000173d10c0 r15=0000000000000001
iopl=0         nv up ei ng nz na pe nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00200282
nt!KeBugCheckEx:
fffff803`27fd1ca0 48894c2408      mov     qword ptr [rsp+8],rcx ss:0018:ffffd000`2136fa80=0000000000000139
Child-SP          RetAddr           : Args to Child                                                           : Call Site
ffffd000`2136fa78 fffff803`27fdd7e9 : 00000000`00000139 00000000`00000003 ffffd000`2136fda0 ffffd000`2136fcf8 : nt!KeBugCheckEx
ffffd000`2136fa80 fffff803`27fddb10 : ffffe000`16b27c70 00000000`00000001 ffffe000`4d0abd10 fffff800`8055c2df : nt!KiBugCheckDispatch+0x69
ffffd000`2136fbc0 fffff803`27fdcd34 : 00000000`00000000 fffff800`80653a9a ffffe000`16b27dd0 ffffe000`16b27c70 : nt!KiFastFailDispatch+0xd0
ffffd000`2136fda0 fffff800`8043ac3a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiRaiseSecurityCheckFailure+0xf4 (TrapFrame @ ffffd000`2136fda0)
ffffd000`2136ff30 fffff800`804359ff : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ndis!ndisFreeToNPagedPool+0x59
ffffd000`2136ff60 fffff800`804559dd : ffffe000`44049880 ffffe000`53b52030 00000000`00000000 ffffe000`1c592001 : ndis!NdisFreeNetBuffer+0xdf
ffffd000`2136ffd0 fffff800`81364e19 : ffffe000`1c592ca0 ffffe000`20695130 ffffe000`44049880 00000000`00000001 : ndis!NdisFreeCloneNetBufferList+0x292fd
ffffd000`21370080 fffff800`80430eee : 00000000`00000000 ffffd000`213701d0 fffff800`81364c98 00000000`00000000 : vwififlt!FilterSendNetBufferListsComplete+0x181
ffffd000`213700d0 fffff800`81e9e671 : ffffe000`1a7b61a0 ffffe000`44049880 00000000`00000001 00000000`00000000 : ndis!NdisMSendNetBufferListsComplete+0x4de
ffffd000`21370240 fffff800`81d0f222 : ffffe000`1adc95f0 fffff800`81d0ec3f ffffe000`1adc9478 ffffe000`1ade7fe0 : NETwbw02+0x1b1671
ffffd000`21370270 fffff800`81e4d73b : ffffe000`1adc9478 ffffe000`00000000 00000000`00000000 ffffe000`1a7de000 : NETwbw02+0x22222
ffffd000`213702b0 fffff800`81d10099 : ffffe000`1ade7fe0 ffffe000`1ade7fe0 00000000`00000000 fffff800`81d0fc1a : NETwbw02+0x16073b
ffffd000`213703c0 fffff800`81d08723 : ffffe000`1a930d70 ffffe000`1ade18b8 ffffe000`1ade7fe0 00000000`00000010 : NETwbw02+0x23099
ffffd000`21370410 fffff800`81d25782 : 00000000`00000000 ffffe000`1ade9ea0 ffffe000`1b796b00 ffffe000`1adc9420 : NETwbw02+0x1b723
ffffd000`21370460 fffff800`81d488dd : 00000000`00000000 ffffe000`00000000 ffff43c0`7aaeb3e0 00000000`00000000 : NETwbw02+0x38782
ffffd000`213704b0 fffff800`81e5296c : 00000000`00000000 00000000`00000000 ffffe000`1ade1920 ffffe000`1aa56000 : NETwbw02+0x5b8dd
ffffd000`213704e0 fffff800`81d10099 : ffffe000`0026da00 00000000`00000000 ffffe000`1aa56000 00000000`00000000 : NETwbw02+0x16596c
ffffd000`21370510 fffff800`81d08723 : ffffe000`1b1e8d70 ffffe000`1ade9ff0 ffffe000`1ade1920 00000000`00000018 : NETwbw02+0x23099
ffffd000`21370560 fffff800`81e7b5dd : ffffe000`1aa62d60 ffffd000`213706f0 00000000`00000000 ffffd000`213705e8 : NETwbw02+0x1b723
ffffd000`213705b0 fffff800`81e7ab8c : 00000000`00000000 ffffd000`21370750 00000000`00000000 ffffe000`1aa62d60 : NETwbw02+0x18e5dd
ffffd000`21370650 fffff800`81eb2d5d : ffffe000`1b1e8d70 ffffe000`1ade9ff0 ffffe000`1b163000 00000000`00000001 : NETwbw02+0x18db8c
ffffd000`21370790 fffff800`81eb434d : ffffd000`00006000 ffffe000`66e5f000 ffffe000`1a8983c0 ffffe000`1a7a76ff : NETwbw02+0x1c5d5d
ffffd000`21370810 fffff800`81eb53e9 : ffffe000`1a8983c0 ffffd000`21370888 ffffd000`21574044 01d0b852`eeece3d3 : NETwbw02+0x1c734d
ffffd000`21370840 fffff800`81eb5a42 : ffffe000`1a8e9890 ffffd000`21e73040 00000000`00000001 00000000`000000ff : NETwbw02+0x1c83e9
ffffd000`213708d0 fffff800`81eadc15 : ffffe000`00000001 fffff800`81eae4ff 00000000`00000000 fffff803`28184180 : NETwbw02+0x1c8a42
ffffd000`21370970 fffff800`81ea48c8 : ffffe000`ffffff00 ffffe000`1a925850 00000000`00000000 ffffe000`1a7b61a0 : NETwbw02+0x1c0c15
ffffd000`213709d0 fffff800`81e9647a : 00000000`00000005 ffffe000`1896e300 ffffd000`00000001 ffff9cfb`6a694bdf : NETwbw02+0x1b78c8
ffffd000`21370a00 fffff800`804391f0 : 00000000`00000000 00000000`00000000 fffff803`28184180 ffffe000`173cf180 : NETwbw02+0x1a947a
ffffd000`21370a30 fffff800`804394eb : ffffe000`1a925d38 00000000`0000000a 00000000`00000001 fffff803`27ef7635 : ndis!ndisMiniportDpc+0x110
ffffd000`21370ad0 fffff800`80438fae : ffffe000`173d53e0 ffffe000`173d53c0 ffffe000`173cf000 ffffe000`1a925d78 : ndis!ndisQueuedMiniportDpcWorkItem+0xfb
ffffd000`21370b70 fffff803`27f8136c : ffffd000`2054f3c0 ffffe000`173cf040 00000000`00000080 ffffe000`173cf040 : ndis!ndisReceiveWorkerThread+0x20e
ffffd000`21370c00 fffff803`27fd82c6 : ffffd000`20543180 ffffe000`173cf040 ffffd000`2054f3c0 ffffc000`1ac61c70 : nt!PspSystemThreadStartup+0x58
ffffd000`21370c60 00000000`00000000 : ffffd000`21371000 ffffd000`2136b000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x16
start             end                 module name
ffffe000`1a437000 ffffe000`1a43e000   em015_64 em015_64.dat Fri Mar 01 08:27:56 2013 (5130ACDC)
ffffe000`1a46b000 ffffe000`1a49f000   em006_64 em006_64.dat Wed Jun 03 03:58:23 2015 (556EB39F)
ffffe000`1a545000 ffffe000`1a5a7000   em018_64 em018_64.dat Mon Jun 08 03:42:26 2015 (55754762)
fffff800`7f42b000 fffff800`7f4a8000   mcupdate_GenuineIntel mcupdate_GenuineIntel.dll Fri Jul 04 08:59:36 2014 (53B6A538)
fffff800`7f4a8000 fffff800`7f4b6000   werkernel werkernel.sys Thu Aug 22 07:40:24 2013 (5215F8A8)
fffff800`7f4b6000 fffff800`7f518000   CLFS     CLFS.SYS     Tue Mar 03 19:51:05 2015 (54F656F9)
fffff800`7f518000 fffff800`7f53a000   tm       tm.sys       Thu Aug 22 07:39:33 2013 (5215F875)
fffff800`7f53a000 fffff800`7f54f000   PSHED    PSHED.dll    Sat Sep 14 09:57:19 2013 (52346B3F)
fffff800`7f54f000 fffff800`7f559000   BOOTVID  BOOTVID.dll  Thu Aug 22 07:40:26 2013 (5215F8AA)
fffff800`7f559000 fffff800`7f5e1000   CI       CI.dll       Fri Dec 05 22:23:28 2014 (548276B0)
fffff800`7f63f000 fffff800`7f69c000   msrpc    msrpc.sys    Thu Aug 22 07:39:22 2013 (5215F86A)
fffff800`7f69c000 fffff800`7f76b000   Wdf01000 Wdf01000.sys Thu Aug 22 07:38:56 2013 (5215F850)
fffff800`7f76b000 fffff800`7f77c000   WDFLDR   WDFLDR.SYS   Thu Aug 22 07:39:03 2013 (5215F857)
fffff800`7f77c000 fffff800`7f794000   acpiex   acpiex.sys   Thu Aug 22 07:37:47 2013 (5215F80B)
fffff800`7f794000 fffff800`7f79f000   WppRecorder WppRecorder.sys Thu Aug 22 07:39:40 2013 (5215F87C)
fffff800`7f79f000 fffff800`7f7ea000   mrxsmb10 mrxsmb10.sys Thu Mar 06 04:19:36 2014 (53183DA8)
fffff800`7f800000 fffff800`7f848000   pci      pci.sys      Thu Jul 24 07:45:24 2014 (53D0F1D4)
fffff800`7f848000 fffff800`7f855000   vdrvroot vdrvroot.sys Thu Aug 22 07:38:49 2013 (5215F849)
fffff800`7f855000 fffff800`7f871000   pdc      pdc.sys      Wed Oct 15 00:34:24 2014 (543DF950)
fffff800`7f888000 fffff800`7f910000   ACPI     ACPI.sys     Mon Oct 06 23:29:50 2014 (54335E2E)
fffff800`7f910000 fffff800`7f91a000   WMILIB   WMILIB.SYS   Thu Aug 22 07:40:23 2013 (5215F8A7)
fffff800`7f91a000 fffff800`7f9a5000   cng      cng.sys      Sun Mar 29 18:22:05 2015 (55187B0D)
fffff800`7f9b3000 fffff800`7f9bd000   msisadrv msisadrv.sys Thu Aug 22 07:39:03 2013 (5215F857)
fffff800`7f9bd000 fffff800`7f9d5000   partmgr  partmgr.sys  Wed Oct 08 03:34:42 2014 (5434E912)
fffff800`7fa00000 fffff800`7fa4c000   netbt    netbt.sys    Thu Aug 22 07:37:01 2013 (5215F7DD)
fffff800`7fa4c000 fffff800`7fab6000   usbhub   usbhub.sys   Thu Jul 24 07:45:29 2014 (53D0F1D9)
fffff800`7fabc000 fffff800`7fb25000   spaceport spaceport.sys Tue Oct 28 22:47:03 2014 (54505527)
fffff800`7fb25000 fffff800`7fb3a000   volmgr   volmgr.sys   Thu Aug 22 07:39:53 2013 (5215F889)
fffff800`7fb3a000 fffff800`7fb99000   volmgrx  volmgrx.sys  Thu Aug 22 07:40:23 2013 (5215F8A7)
fffff800`7fb99000 fffff800`7fbb4000   mountmgr mountmgr.sys Mon Oct 06 21:18:16 2014 (54333F58)
fffff800`7fbb4000 fffff800`7fbf7000   WdFilter WdFilter.sys Fri Jan 30 05:20:58 2015 (54CB5B0A)
fffff800`7fc00000 fffff800`7fc5c000   fltmgr   fltmgr.sys   Mon Aug 25 22:25:16 2014 (53FBF00C)
fffff800`7fc5c000 fffff800`7fc72000   fileinfo fileinfo.sys Sat Feb 22 07:13:10 2014 (53089456)
fffff800`7fc96000 fffff800`7ff50000   iaStorA  iaStorA.sys  Fri Aug 16 13:22:01 2013 (520E5FB9)
fffff800`7ff50000 fffff800`7ffae000   storport storport.sys Wed Sep 24 22:47:07 2014 (5423822B)
fffff800`7ffae000 fffff800`7ffc8000   EhStorClass EhStorClass.sys Thu Aug 22 07:38:15 2013 (5215F827)
fffff800`7ffc8000 fffff800`7fff3000   Wof      Wof.sys      Thu Mar 13 04:27:29 2014 (53216BF1)
fffff800`80000000 fffff800`80015000   crashdmp crashdmp.sys Thu Aug 22 07:40:03 2013 (5215F893)
fffff800`80015000 fffff800`80042000   ehdrv    ehdrv.sys    Tue Jan 20 05:39:52 2015 (54BE3078)
fffff800`80042000 fffff800`800a5000   dxgmms1  dxgmms1.sys  Tue Oct 28 22:46:30 2014 (54505506)
fffff800`800dc000 fffff800`802d6000   Ntfs     Ntfs.sys     Fri Oct 10 20:35:55 2014 (54387B6B)
fffff800`802d6000 fffff800`802f2000   ksecdd   ksecdd.sys   Tue Oct 28 22:47:36 2014 (54505548)
fffff800`802f2000 fffff800`80302000   pcw      pcw.sys      Thu Aug 22 04:46:34 2013 (5215CFEA)
fffff800`80302000 fffff800`8030d000   Fs_Rec   Fs_Rec.sys   Thu Aug 22 04:46:33 2013 (5215CFE9)
fffff800`8030d000 fffff800`8035c000   volsnap  volsnap.sys  Wed Jun 18 18:41:28 2014 (53A21598)
fffff800`8035c000 fffff800`803a2000   rdyboost rdyboost.sys Sat Feb 22 07:13:40 2014 (53089474)
fffff800`803a2000 fffff800`803f8000   CLASSPNP CLASSPNP.SYS Wed Oct 08 01:22:07 2014 (5434C9FF)
fffff800`80400000 fffff800`8041c000   disk     disk.sys     Thu Aug 22 07:39:47 2013 (5215F883)
fffff800`80429000 fffff800`80540000   ndis     ndis.sys     Mon Feb 02 19:03:15 2015 (54D01043)
fffff800`80540000 fffff800`805b8000   NETIO    NETIO.SYS    Sun Nov 09 21:58:13 2014 (546029C5)
fffff800`805b8000 fffff800`805e9000   ksecpkg  ksecpkg.sys  Sun Jan 11 22:01:17 2015 (54B338FD)
fffff800`805e9000 fffff800`80600000   mup      mup.sys      Thu Aug 22 07:40:28 2013 (5215F8AC)
fffff800`80610000 fffff800`8087c000   tcpip    tcpip.sys    Sun Nov 09 21:59:03 2014 (546029F7)
fffff800`8087c000 fffff800`808e8000   fwpkclnt fwpkclnt.sys Sun Nov 09 21:57:40 2014 (546029A4)
fffff800`808e8000 fffff800`8090d000   wfplwfs  wfplwfs.sys  Sun Nov 09 21:57:28 2014 (54602998)
fffff800`8090d000 fffff800`809a2000   fvevol   fvevol.sys   Mon Apr 07 18:25:31 2014 (534325DB)
fffff800`809a2000 fffff800`809ad000   hpdskflt hpdskflt.sys Tue Feb 26 15:08:12 2013 (512D162C)
fffff800`809ad000 fffff800`809ec000   edevmon  edevmon.sys  Tue Jan 20 05:39:37 2015 (54BE3069)
fffff800`809ec000 fffff800`809fb000   intelpep intelpep.sys Wed Oct 15 02:29:44 2014 (543E1458)
fffff800`80c00000 fffff800`80ccf000   eamonm   eamonm.sys   Tue Jan 20 05:39:35 2015 (54BE3067)
fffff800`80ccf000 fffff800`80cd8000   Null     Null.SYS     Thu Aug 22 07:40:24 2013 (5215F8A8)
fffff800`80cd8000 fffff800`80ce0000   Beep     Beep.SYS     Thu Aug 22 07:40:24 2013 (5215F8A8)
fffff800`80ce0000 fffff800`80cee000   BasicRender BasicRender.sys Sat Feb 22 07:14:02 2014 (5308948A)
fffff800`80cee000 fffff800`80fa8000   dump_iaStorA dump_iaStorA.sys Fri Aug 16 13:22:01 2013 (520E5FB9)
fffff800`80fca000 fffff800`80ff8000   cdrom    cdrom.sys    Thu Aug 22 04:46:35 2013 (5215CFEB)
fffff800`81000000 fffff800`8100c000   Msfs     Msfs.SYS     Thu Aug 22 07:40:24 2013 (5215F8A8)
fffff800`8100c000 fffff800`8102c000   tdx      tdx.sys      Thu Aug 22 07:36:34 2013 (5215F7C2)
fffff800`8102c000 fffff800`8103a000   TDI      TDI.SYS      Thu Aug 22 07:39:01 2013 (5215F855)
fffff800`8103e000 fffff800`811be000   dxgkrnl  dxgkrnl.sys  Tue Oct 28 22:46:45 2014 (54505515)
fffff800`811be000 fffff800`811d0000   watchdog watchdog.sys Sat Feb 22 07:14:39 2014 (530894AF)
fffff800`811d0000 fffff800`811e2000   BasicDisplay BasicDisplay.sys Thu Aug 22 07:39:31 2013 (5215F873)
fffff800`811e2000 fffff800`811f6000   Npfs     Npfs.SYS     Thu Aug 22 07:40:25 2013 (5215F8A9)
fffff800`81200000 fffff800`81219000   wanarp   wanarp.sys   Mon Jan 05 21:59:31 2015 (54AB4F93)
fffff800`81219000 fffff800`8123f000   VBoxUSBMon VBoxUSBMon.sys Tue Sep 09 11:26:34 2014 (540F1C2A)
fffff800`8123f000 fffff800`8128d000   ks       ks.sys       Fri Jul 04 08:58:59 2014 (53B6A513)
fffff800`812a2000 fffff800`81334000   afd      afd.sys      Thu May 29 23:03:01 2014 (5387F4E5)
fffff800`81334000 fffff800`8135e000   pacer    pacer.sys    Tue Oct 28 22:45:30 2014 (545054CA)
fffff800`8135e000 fffff800`81376000   vwififlt vwififlt.sys Wed Apr 30 02:43:46 2014 (53609BA2)
fffff800`81376000 fffff800`81387000   netbios  netbios.sys  Tue Oct 28 22:47:23 2014 (5450553B)
fffff800`81387000 fffff800`813f7000   rdbss    rdbss.sys    Tue Dec 17 02:21:22 2013 (52AFFB72)
fffff800`81400000 fffff800`8142b000   VBoxNetFlt VBoxNetFlt.sys Tue Sep 09 11:26:34 2014 (540F1C2A)
fffff800`81435000 fffff800`81518000   VBoxDrv  VBoxDrv.sys  Tue Sep 09 11:29:03 2014 (540F1CBF)
fffff800`81518000 fffff800`81526000   nsiproxy nsiproxy.sys Tue Oct 28 22:46:03 2014 (545054EB)
fffff800`81526000 fffff800`81532000   npsvctrig npsvctrig.sys Thu Aug 22 07:38:22 2013 (5215F82E)
fffff800`81532000 fffff800`8153e000   mssmbios mssmbios.sys Thu Aug 22 07:39:41 2013 (5215F87D)
fffff800`8153e000 fffff800`81564000   dfsc     dfsc.sys     Thu Mar 06 04:22:50 2014 (53183E6A)
fffff800`81564000 fffff800`81575000   umbus    umbus.sys    Thu Aug 22 07:38:59 2013 (5215F853)
fffff800`81575000 fffff800`8158f000   CLVirtualDrive CLVirtualDrive.sys Mon Dec 26 08:26:47 2011 (4EF87617)
fffff800`8158f000 fffff800`815a8000   ahcache  ahcache.sys  Thu Mar 19 21:56:10 2015 (550B7E3A)
fffff800`815a8000 fffff800`815d0000   VBoxNetAdp VBoxNetAdp.sys Tue Sep 09 11:26:34 2014 (540F1C2A)
fffff800`815d0000 fffff800`815df000   CompositeBus CompositeBus.sys Thu Aug 22 07:38:48 2013 (5215F848)
fffff800`815df000 fffff800`815ea000   kdnic    kdnic.sys    Thu Aug 22 07:38:26 2013 (5215F832)
fffff800`815ea000 fffff800`815f5000   rdpbus   rdpbus.sys   Thu Aug 22 07:38:52 2013 (5215F84C)
fffff800`81600000 fffff800`8161e000   intelppm intelppm.sys Thu Aug 22 04:46:35 2013 (5215CFEB)
fffff800`8161e000 fffff800`8162f000   ISCTD64  ISCTD64.sys  Tue Nov 27 14:52:34 2012 (50B51A02)
fffff800`81632000 fffff800`81a48000   igdkmd64 igdkmd64.sys Mon Sep 09 13:27:52 2013 (522E0518)
fffff800`81a48000 fffff800`81a61000   HDAudBus HDAudBus.sys Thu Jul 24 07:45:39 2014 (53D0F1E3)
fffff800`81a61000 fffff800`81ab6000   USBXHCI  USBXHCI.SYS  Thu Apr 09 22:08:27 2015 (5527309B)
fffff800`81ab6000 fffff800`81ae8000   ucx01000 ucx01000.sys Tue Oct 07 01:00:55 2014 (54337387)
fffff800`81ae8000 fffff800`81b04000   TeeDriverx64 TeeDriverx64.sys Tue Jul 02 14:38:08 2013 (51D31E10)
fffff800`81b04000 fffff800`81b8a000   SynTP    SynTP.sys    Thu Aug 01 20:51:42 2013 (51FB029E)
fffff800`81b8a000 fffff800`81b98000   Accelerometer Accelerometer.sys Tue Feb 26 15:08:10 2013 (512D162A)
fffff800`81b98000 fffff800`81b9e380   CmBatt   CmBatt.sys   Thu Aug 22 07:39:43 2013 (5215F87F)
fffff800`81b9f000 fffff800`81bab000   BATTC    BATTC.SYS    Thu Aug 22 07:40:04 2013 (5215F894)
fffff800`81bab000 fffff800`81bb5000   WirelessButtonDriver64 WirelessButtonDriver64.sys Wed Aug 29 23:11:29 2012 (503ED9E1)
fffff800`81bb5000 fffff800`81bd4000   HIDCLASS HIDCLASS.SYS Thu Mar 06 04:24:40 2014 (53183ED8)
fffff800`81bd4000 fffff800`81bdbf00   HIDPARSE HIDPARSE.SYS Thu Aug 22 07:40:26 2013 (5215F8AA)
fffff800`81bdc000 fffff800`81be6000   wmiacpi  wmiacpi.sys  Thu Aug 22 07:40:04 2013 (5215F894)
fffff800`81be6000 fffff800`81bf1000   NdisVirtualBus NdisVirtualBus.sys Thu Aug 22 07:36:25 2013 (5215F7B9)
fffff800`81bf1000 fffff800`81bfd000   iwdbus   iwdbus.sys   Wed Jul 24 21:06:12 2013 (51F07A04)
fffff800`81c00000 fffff800`81c18000   usbehci  usbehci.sys  Sat May 31 02:29:54 2014 (538976E2)
fffff800`81c18000 fffff800`81c87000   USBPORT  USBPORT.SYS  Sat May 31 02:30:25 2014 (53897701)
fffff800`81c87000 fffff800`81ca6000   i8042prt i8042prt.sys Tue Nov 04 01:54:54 2014 (5458783E)
fffff800`81ca6000 fffff800`81cb0000   ikbevent ikbevent.sys Tue Aug 06 19:41:35 2013 (520189AF)
fffff800`81cb0000 fffff800`81cbc000   USBD     USBD.SYS     Sat May 31 02:31:17 2014 (53897735)
fffff800`81cbc000 fffff800`81cce000   kbdclass kbdclass.sys Tue Nov 04 01:54:54 2014 (5458783E)
fffff800`81cce000 fffff800`81cd9000   imsevent imsevent.sys Tue Aug 06 19:45:57 2013 (52018AB5)
fffff800`81cd9000 fffff800`81ce9000   mouclass mouclass.sys Tue Nov 04 01:54:47 2014 (54587837)
fffff800`81ced000 fffff800`82070000   NETwbw02 NETwbw02.sys Mon Mar 23 04:53:41 2015 (550FD495)
fffff800`82070000 fffff800`8207d000   vwifibus vwifibus.sys Thu Aug 22 07:39:00 2013 (5215F854)
fffff800`8207d000 fffff800`820b6000   fastfat  fastfat.SYS  Thu Aug 22 07:40:18 2013 (5215F8A2)
fffff800`820b6000 fffff800`82123000   RtsPer   RtsPer.sys   Wed Aug 21 03:23:24 2013 (52146AEC)
fffff800`82123000 fffff800`821ef000   Rt630x64 Rt630x64.sys Fri Jul 26 03:01:35 2013 (51F21ECF)
fffff800`821ef000 fffff800`821fc000   Smb_driver_Intel Smb_driver_Intel.sys Thu Aug 01 20:54:20 2013 (51FB033C)
fffff800`821fc000 fffff800`821fd600   swenum   swenum.sys   Tue Oct 28 22:47:41 2014 (5450554D)
fffff800`82200000 fffff800`82274000   nwifi    nwifi.sys    Tue Oct 28 22:45:41 2014 (545054D5)
fffff800`82274000 fffff800`8228c000   rspndr   rspndr.sys   Thu Aug 22 07:36:34 2013 (5215F7C2)
fffff800`8228c000 fffff800`822c4000   mrxsmb20 mrxsmb20.sys Sat Sep 27 00:59:28 2014 (54264430)
fffff800`822c4000 fffff800`822e1000   Ndu      Ndu.sys      Tue Oct 28 22:45:16 2014 (545054BC)
fffff800`822fa000 fffff800`82341000   portcls  portcls.sys  Tue Oct 28 22:46:35 2014 (5450550B)
fffff800`82341000 fffff800`8235d000   drmk     drmk.sys     Tue Oct 28 22:47:38 2014 (5450554A)
fffff800`8235d000 fffff800`82362300   ksthunk  ksthunk.sys  Thu Aug 22 07:39:31 2013 (5215F873)
fffff800`82363000 fffff800`823db000   UsbHub3  UsbHub3.sys  Mon Mar 16 23:34:24 2015 (5507A0C0)
fffff800`8240f000 fffff800`8249b000   stwrt64  stwrt64.sys  Fri Aug 16 06:26:26 2013 (520DFE52)
fffff800`8249b000 fffff800`824d8000   WUDFRd   WUDFRd.sys   Tue Oct 28 22:46:13 2014 (545054F5)
fffff800`824d8000 fffff800`824ec000   lltdio   lltdio.sys   Thu Aug 22 07:36:18 2013 (5215F7B2)
fffff800`824f1000 fffff800`82518000   usbccgp  usbccgp.sys  Thu Jul 24 07:44:51 2014 (53D0F1B3)
fffff800`82518000 fffff800`82526000   hidusb   hidusb.sys   Thu Mar 06 04:24:14 2014 (53183EBE)
fffff800`82526000 fffff800`82534000   kbdhid   kbdhid.sys   Tue Nov 04 01:54:47 2014 (54587837)
fffff800`82534000 fffff800`82541000   mouhid   mouhid.sys   Tue Nov 04 01:54:47 2014 (54587837)
fffff800`82541000 fffff800`8254b000   MTConfig MTConfig.sys Thu Aug 22 07:37:36 2013 (5215F800)
fffff800`8254b000 fffff800`82557000   dump_diskdump dump_diskdump.sys Thu Aug 22 07:40:18 2013 (5215F8A2)
fffff800`82557000 fffff800`8256d000   dump_dumpfve dump_dumpfve.sys Sat Feb 22 07:14:48 2014 (530894B8)
fffff800`8256d000 fffff800`8257b000   monitor  monitor.sys  Thu Aug 22 07:36:37 2013 (5215F7C5)
fffff800`8257b000 fffff800`8259f000   luafv    luafv.sys    Sat Feb 22 07:14:25 2014 (530894A1)
fffff800`8259f000 fffff800`825c0000   WudfPf   WudfPf.sys   Tue Oct 28 22:46:27 2014 (54505503)
fffff800`825c0000 fffff800`825d9000   WinUsb   WinUsb.sys   Thu Aug 22 07:37:55 2013 (5215F813)
fffff800`825d9000 fffff800`825ed000   ndisuio  ndisuio.sys  Thu Aug 22 07:37:34 2013 (5215F7FE)
fffff800`82619000 fffff800`82713000   HTTP     HTTP.sys     Mon Feb 23 19:40:28 2015 (54EBC87C)
fffff800`82713000 fffff800`82723000   condrv   condrv.sys   Thu Aug 22 07:40:17 2013 (5215F8A1)
fffff800`82723000 fffff800`82743000   bowser   bowser.sys   Thu Aug 22 07:38:38 2013 (5215F83E)
fffff800`82743000 fffff800`8276d000   epfwwfpr epfwwfpr.sys Wed Jan 28 08:02:44 2015 (54C8DDF4)
fffff800`8276d000 fffff800`82784000   mpsdrv   mpsdrv.sys   Tue Oct 28 22:45:31 2014 (545054CB)
fffff800`82784000 fffff800`827f1000   mrxsmb   mrxsmb.sys   Wed Oct 08 03:32:08 2014 (5434E878)
fffff800`827f1000 fffff800`82800000   vwifimp  vwifimp.sys  Wed Apr 30 02:41:59 2014 (53609B37)
fffff800`828a4000 fffff800`8294d000   peauth   peauth.sys   Sat Feb 22 07:09:37 2014 (53089381)
fffff800`8294d000 fffff800`82958000   secdrv   secdrv.SYS   Wed Sep 13 09:18:38 2006 (4508052E)
fffff800`82958000 fffff800`8299b000   srvnet   srvnet.sys   Fri Jun 27 02:22:21 2014 (53AD0D9D)
fffff800`8299b000 fffff800`829ad000   tcpipreg tcpipreg.sys Thu Mar 06 04:19:59 2014 (53183DBF)
fffff800`83600000 fffff800`8368e000   srv      srv.sys      Thu Jul 24 07:43:27 2014 (53D0F15F)
fffff800`8368e000 fffff800`836bb000   tunnel   tunnel.sys   Thu Aug 22 07:35:45 2013 (5215F791)
fffff800`836d3000 fffff800`836df000   PROCEXP152 PROCEXP152.SYS Mon May 11 00:52:10 2015 (5550357A)
fffff800`836ed000 fffff800`8379a000   srv2     srv2.sys     Wed Oct 08 03:33:30 2014 (5434E8CA)
fffff800`837ac000 fffff800`837b6000   cpuz138_x64 cpuz138_x64.sys Thu Oct 23 11:03:05 2014 (544918A9)
fffff803`24d26000 fffff803`24d2f000   kd       kd.dll       Thu Aug 22 07:40:43 2013 (5215F8BB)
fffff803`27e11000 fffff803`27e81000   hal      hal.dll      Sun Jun 01 18:49:12 2014 (538BADE8)
fffff803`27e81000 fffff803`28615000   nt       ntkrnlmp.exe Sun Mar 22 18:26:46 2015 (550F41A6)
fffff960`00103000 fffff960`00519000   win32k   win32k.sys   Thu May 21 12:46:18 2015 (555E0BDA)
fffff960`0067a000 fffff960`00683000   TSDDD    TSDDD.dll    Thu Aug 22 07:40:32 2013 (5215F8B0)
fffff960`008ea000 fffff960`00924000   cdd      cdd.dll      Tue Oct 28 23:51:32 2014 (54506444)
fffff960`00ae8000 fffff960`00b47000   ATMFD    ATMFD.DLL    Thu Feb 19 22:03:49 2015 (54E6A415)

Unloaded modules:
fffff800`837d6000 fffff800`837e2000   hiber_storport.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  0000C000
fffff800`83c77000 fffff800`83f31000   hiber_iaStorA.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  002BA000
fffff800`83f31000 fffff800`83f47000   hiber_dumpfve.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00016000
fffff800`837ca000 fffff800`837d6000   hiber_storport.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  0000C000
fffff800`830a9000 fffff800`83363000   hiber_iaStorA.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  002BA000
fffff800`83363000 fffff800`83379000   hiber_dumpfve.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00016000
fffff800`837be000 fffff800`837ca000   hiber_storport.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  0000C000
fffff800`830ae000 fffff800`83368000   hiber_iaStorA.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  002BA000
fffff800`83368000 fffff800`8337e000   hiber_dumpfve.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00016000
fffff800`837b6000 fffff800`837be000   cec0cf97-6cf0-4af2-bc65-8b4393b9ba74
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00008000
fffff800`8379a000 fffff800`837a4000   cpuz138_x64.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  0000A000
fffff800`837a4000 fffff800`837ac000   e2160e41-2c34-4220-a4c9-d1f40b9f85f8
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00008000
fffff800`836df000 fffff800`836eb000   hiber_storport.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  0000C000
fffff800`83069000 fffff800`83323000   hiber_iaStorA.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  002BA000
fffff800`83323000 fffff800`83339000   hiber_dumpfve.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00016000
fffff800`836c7000 fffff800`836d3000   hiber_storport.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  0000C000
fffff800`82af8000 fffff800`82db2000   hiber_iaStorA.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  002BA000
fffff800`82db2000 fffff800`82dc8000   hiber_dumpfve.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00016000
fffff800`836bb000 fffff800`836c7000   hiber_storport.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  0000C000
fffff800`82aa1000 fffff800`82d5b000   hiber_iaStorA.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  002BA000
fffff800`82d5b000 fffff800`82d71000   hiber_dumpfve.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00016000
fffff800`82287000 fffff800`822fa000   IntcDAud.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00073000
fffff800`8249b000 fffff800`824b4000   WinUsb.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00019000
fffff800`824b4000 fffff800`824f1000   WUDFRd.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  0003D000
fffff800`80600000 fffff800`8060c000   dump_storport.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  0000C000
fffff800`80cfa000 fffff800`80fb4000   dump_iaStorA.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  002BA000
fffff800`80fb4000 fffff800`80fca000   dump_dumpfve.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00016000
fffff800`81564000 fffff800`81575000   dam.sys 
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00011000
fffff800`7f9a5000 fffff800`7f9b3000   WdBoot.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  0000E000
fffff800`80600000 fffff800`8060c000   hwpolicy.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  0000C000
start             end                 module name
fffff800`81b8a000 fffff800`81b98000   Accelerometer Accelerometer.sys Tue Feb 26 15:08:10 2013 (512D162A)
fffff800`7f888000 fffff800`7f910000   ACPI     ACPI.sys     Mon Oct 06 23:29:50 2014 (54335E2E)
fffff800`7f77c000 fffff800`7f794000   acpiex   acpiex.sys   Thu Aug 22 07:37:47 2013 (5215F80B)
fffff800`812a2000 fffff800`81334000   afd      afd.sys      Thu May 29 23:03:01 2014 (5387F4E5)
fffff800`8158f000 fffff800`815a8000   ahcache  ahcache.sys  Thu Mar 19 21:56:10 2015 (550B7E3A)
fffff960`00ae8000 fffff960`00b47000   ATMFD    ATMFD.DLL    Thu Feb 19 22:03:49 2015 (54E6A415)
fffff800`811d0000 fffff800`811e2000   BasicDisplay BasicDisplay.sys Thu Aug 22 07:39:31 2013 (5215F873)
fffff800`80ce0000 fffff800`80cee000   BasicRender BasicRender.sys Sat Feb 22 07:14:02 2014 (5308948A)
fffff800`81b9f000 fffff800`81bab000   BATTC    BATTC.SYS    Thu Aug 22 07:40:04 2013 (5215F894)
fffff800`80cd8000 fffff800`80ce0000   Beep     Beep.SYS     Thu Aug 22 07:40:24 2013 (5215F8A8)
fffff800`7f54f000 fffff800`7f559000   BOOTVID  BOOTVID.dll  Thu Aug 22 07:40:26 2013 (5215F8AA)
fffff800`82723000 fffff800`82743000   bowser   bowser.sys   Thu Aug 22 07:38:38 2013 (5215F83E)
fffff960`008ea000 fffff960`00924000   cdd      cdd.dll      Tue Oct 28 23:51:32 2014 (54506444)
fffff800`80fca000 fffff800`80ff8000   cdrom    cdrom.sys    Thu Aug 22 04:46:35 2013 (5215CFEB)
fffff800`7f559000 fffff800`7f5e1000   CI       CI.dll       Fri Dec 05 22:23:28 2014 (548276B0)
fffff800`803a2000 fffff800`803f8000   CLASSPNP CLASSPNP.SYS Wed Oct 08 01:22:07 2014 (5434C9FF)
fffff800`7f4b6000 fffff800`7f518000   CLFS     CLFS.SYS     Tue Mar 03 19:51:05 2015 (54F656F9)
fffff800`81575000 fffff800`8158f000   CLVirtualDrive CLVirtualDrive.sys Mon Dec 26 08:26:47 2011 (4EF87617)
fffff800`81b98000 fffff800`81b9e380   CmBatt   CmBatt.sys   Thu Aug 22 07:39:43 2013 (5215F87F)
fffff800`7f91a000 fffff800`7f9a5000   cng      cng.sys      Sun Mar 29 18:22:05 2015 (55187B0D)
fffff800`815d0000 fffff800`815df000   CompositeBus CompositeBus.sys Thu Aug 22 07:38:48 2013 (5215F848)
fffff800`82713000 fffff800`82723000   condrv   condrv.sys   Thu Aug 22 07:40:17 2013 (5215F8A1)
fffff800`837ac000 fffff800`837b6000   cpuz138_x64 cpuz138_x64.sys Thu Oct 23 11:03:05 2014 (544918A9)
fffff800`80000000 fffff800`80015000   crashdmp crashdmp.sys Thu Aug 22 07:40:03 2013 (5215F893)
fffff800`8153e000 fffff800`81564000   dfsc     dfsc.sys     Thu Mar 06 04:22:50 2014 (53183E6A)
fffff800`80400000 fffff800`8041c000   disk     disk.sys     Thu Aug 22 07:39:47 2013 (5215F883)
fffff800`82341000 fffff800`8235d000   drmk     drmk.sys     Tue Oct 28 22:47:38 2014 (5450554A)
fffff800`8254b000 fffff800`82557000   dump_diskdump dump_diskdump.sys Thu Aug 22 07:40:18 2013 (5215F8A2)
fffff800`82557000 fffff800`8256d000   dump_dumpfve dump_dumpfve.sys Sat Feb 22 07:14:48 2014 (530894B8)
fffff800`80cee000 fffff800`80fa8000   dump_iaStorA dump_iaStorA.sys Fri Aug 16 13:22:01 2013 (520E5FB9)
fffff800`8103e000 fffff800`811be000   dxgkrnl  dxgkrnl.sys  Tue Oct 28 22:46:45 2014 (54505515)
fffff800`80042000 fffff800`800a5000   dxgmms1  dxgmms1.sys  Tue Oct 28 22:46:30 2014 (54505506)
fffff800`80c00000 fffff800`80ccf000   eamonm   eamonm.sys   Tue Jan 20 05:39:35 2015 (54BE3067)
fffff800`809ad000 fffff800`809ec000   edevmon  edevmon.sys  Tue Jan 20 05:39:37 2015 (54BE3069)
fffff800`80015000 fffff800`80042000   ehdrv    ehdrv.sys    Tue Jan 20 05:39:52 2015 (54BE3078)
fffff800`7ffae000 fffff800`7ffc8000   EhStorClass EhStorClass.sys Thu Aug 22 07:38:15 2013 (5215F827)
ffffe000`1a46b000 ffffe000`1a49f000   em006_64 em006_64.dat Wed Jun 03 03:58:23 2015 (556EB39F)
ffffe000`1a437000 ffffe000`1a43e000   em015_64 em015_64.dat Fri Mar 01 08:27:56 2013 (5130ACDC)
ffffe000`1a545000 ffffe000`1a5a7000   em018_64 em018_64.dat Mon Jun 08 03:42:26 2015 (55754762)
fffff800`82743000 fffff800`8276d000   epfwwfpr epfwwfpr.sys Wed Jan 28 08:02:44 2015 (54C8DDF4)
fffff800`8207d000 fffff800`820b6000   fastfat  fastfat.SYS  Thu Aug 22 07:40:18 2013 (5215F8A2)
fffff800`7fc5c000 fffff800`7fc72000   fileinfo fileinfo.sys Sat Feb 22 07:13:10 2014 (53089456)
fffff800`7fc00000 fffff800`7fc5c000   fltmgr   fltmgr.sys   Mon Aug 25 22:25:16 2014 (53FBF00C)
fffff800`80302000 fffff800`8030d000   Fs_Rec   Fs_Rec.sys   Thu Aug 22 04:46:33 2013 (5215CFE9)
fffff800`8090d000 fffff800`809a2000   fvevol   fvevol.sys   Mon Apr 07 18:25:31 2014 (534325DB)
fffff800`8087c000 fffff800`808e8000   fwpkclnt fwpkclnt.sys Sun Nov 09 21:57:40 2014 (546029A4)
fffff803`27e11000 fffff803`27e81000   hal      hal.dll      Sun Jun 01 18:49:12 2014 (538BADE8)
fffff800`81a48000 fffff800`81a61000   HDAudBus HDAudBus.sys Thu Jul 24 07:45:39 2014 (53D0F1E3)
fffff800`81bb5000 fffff800`81bd4000   HIDCLASS HIDCLASS.SYS Thu Mar 06 04:24:40 2014 (53183ED8)
fffff800`81bd4000 fffff800`81bdbf00   HIDPARSE HIDPARSE.SYS Thu Aug 22 07:40:26 2013 (5215F8AA)
fffff800`82518000 fffff800`82526000   hidusb   hidusb.sys   Thu Mar 06 04:24:14 2014 (53183EBE)
fffff800`809a2000 fffff800`809ad000   hpdskflt hpdskflt.sys Tue Feb 26 15:08:12 2013 (512D162C)
fffff800`82619000 fffff800`82713000   HTTP     HTTP.sys     Mon Feb 23 19:40:28 2015 (54EBC87C)
fffff800`81c87000 fffff800`81ca6000   i8042prt i8042prt.sys Tue Nov 04 01:54:54 2014 (5458783E)
fffff800`7fc96000 fffff800`7ff50000   iaStorA  iaStorA.sys  Fri Aug 16 13:22:01 2013 (520E5FB9)
fffff800`81632000 fffff800`81a48000   igdkmd64 igdkmd64.sys Mon Sep 09 13:27:52 2013 (522E0518)
fffff800`81ca6000 fffff800`81cb0000   ikbevent ikbevent.sys Tue Aug 06 19:41:35 2013 (520189AF)
fffff800`81cce000 fffff800`81cd9000   imsevent imsevent.sys Tue Aug 06 19:45:57 2013 (52018AB5)
fffff800`809ec000 fffff800`809fb000   intelpep intelpep.sys Wed Oct 15 02:29:44 2014 (543E1458)
fffff800`81600000 fffff800`8161e000   intelppm intelppm.sys Thu Aug 22 04:46:35 2013 (5215CFEB)
fffff800`8161e000 fffff800`8162f000   ISCTD64  ISCTD64.sys  Tue Nov 27 14:52:34 2012 (50B51A02)
fffff800`81bf1000 fffff800`81bfd000   iwdbus   iwdbus.sys   Wed Jul 24 21:06:12 2013 (51F07A04)
fffff800`81cbc000 fffff800`81cce000   kbdclass kbdclass.sys Tue Nov 04 01:54:54 2014 (5458783E)
fffff800`82526000 fffff800`82534000   kbdhid   kbdhid.sys   Tue Nov 04 01:54:47 2014 (54587837)
fffff803`24d26000 fffff803`24d2f000   kd       kd.dll       Thu Aug 22 07:40:43 2013 (5215F8BB)
fffff800`815df000 fffff800`815ea000   kdnic    kdnic.sys    Thu Aug 22 07:38:26 2013 (5215F832)
fffff800`8123f000 fffff800`8128d000   ks       ks.sys       Fri Jul 04 08:58:59 2014 (53B6A513)
fffff800`802d6000 fffff800`802f2000   ksecdd   ksecdd.sys   Tue Oct 28 22:47:36 2014 (54505548)
fffff800`805b8000 fffff800`805e9000   ksecpkg  ksecpkg.sys  Sun Jan 11 22:01:17 2015 (54B338FD)
fffff800`8235d000 fffff800`82362300   ksthunk  ksthunk.sys  Thu Aug 22 07:39:31 2013 (5215F873)
fffff800`824d8000 fffff800`824ec000   lltdio   lltdio.sys   Thu Aug 22 07:36:18 2013 (5215F7B2)
fffff800`8257b000 fffff800`8259f000   luafv    luafv.sys    Sat Feb 22 07:14:25 2014 (530894A1)
fffff800`7f42b000 fffff800`7f4a8000   mcupdate_GenuineIntel mcupdate_GenuineIntel.dll Fri Jul 04 08:59:36 2014 (53B6A538)
fffff800`8256d000 fffff800`8257b000   monitor  monitor.sys  Thu Aug 22 07:36:37 2013 (5215F7C5)
fffff800`81cd9000 fffff800`81ce9000   mouclass mouclass.sys Tue Nov 04 01:54:47 2014 (54587837)
fffff800`82534000 fffff800`82541000   mouhid   mouhid.sys   Tue Nov 04 01:54:47 2014 (54587837)
fffff800`7fb99000 fffff800`7fbb4000   mountmgr mountmgr.sys Mon Oct 06 21:18:16 2014 (54333F58)
fffff800`8276d000 fffff800`82784000   mpsdrv   mpsdrv.sys   Tue Oct 28 22:45:31 2014 (545054CB)
fffff800`82784000 fffff800`827f1000   mrxsmb   mrxsmb.sys   Wed Oct 08 03:32:08 2014 (5434E878)
fffff800`7f79f000 fffff800`7f7ea000   mrxsmb10 mrxsmb10.sys Thu Mar 06 04:19:36 2014 (53183DA8)
fffff800`8228c000 fffff800`822c4000   mrxsmb20 mrxsmb20.sys Sat Sep 27 00:59:28 2014 (54264430)
fffff800`81000000 fffff800`8100c000   Msfs     Msfs.SYS     Thu Aug 22 07:40:24 2013 (5215F8A8)
fffff800`7f9b3000 fffff800`7f9bd000   msisadrv msisadrv.sys Thu Aug 22 07:39:03 2013 (5215F857)
fffff800`7f63f000 fffff800`7f69c000   msrpc    msrpc.sys    Thu Aug 22 07:39:22 2013 (5215F86A)
fffff800`81532000 fffff800`8153e000   mssmbios mssmbios.sys Thu Aug 22 07:39:41 2013 (5215F87D)
fffff800`82541000 fffff800`8254b000   MTConfig MTConfig.sys Thu Aug 22 07:37:36 2013 (5215F800)
fffff800`805e9000 fffff800`80600000   mup      mup.sys      Thu Aug 22 07:40:28 2013 (5215F8AC)
fffff800`80429000 fffff800`80540000   ndis     ndis.sys     Mon Feb 02 19:03:15 2015 (54D01043)
fffff800`825d9000 fffff800`825ed000   ndisuio  ndisuio.sys  Thu Aug 22 07:37:34 2013 (5215F7FE)
fffff800`81be6000 fffff800`81bf1000   NdisVirtualBus NdisVirtualBus.sys Thu Aug 22 07:36:25 2013 (5215F7B9)
fffff800`822c4000 fffff800`822e1000   Ndu      Ndu.sys      Tue Oct 28 22:45:16 2014 (545054BC)
fffff800`81376000 fffff800`81387000   netbios  netbios.sys  Tue Oct 28 22:47:23 2014 (5450553B)
fffff800`7fa00000 fffff800`7fa4c000   netbt    netbt.sys    Thu Aug 22 07:37:01 2013 (5215F7DD)
fffff800`80540000 fffff800`805b8000   NETIO    NETIO.SYS    Sun Nov 09 21:58:13 2014 (546029C5)
fffff800`81ced000 fffff800`82070000   NETwbw02 NETwbw02.sys Mon Mar 23 04:53:41 2015 (550FD495)
fffff800`811e2000 fffff800`811f6000   Npfs     Npfs.SYS     Thu Aug 22 07:40:25 2013 (5215F8A9)
fffff800`81526000 fffff800`81532000   npsvctrig npsvctrig.sys Thu Aug 22 07:38:22 2013 (5215F82E)
fffff800`81518000 fffff800`81526000   nsiproxy nsiproxy.sys Tue Oct 28 22:46:03 2014 (545054EB)
fffff803`27e81000 fffff803`28615000   nt       ntkrnlmp.exe Sun Mar 22 18:26:46 2015 (550F41A6)
fffff800`800dc000 fffff800`802d6000   Ntfs     Ntfs.sys     Fri Oct 10 20:35:55 2014 (54387B6B)
fffff800`80ccf000 fffff800`80cd8000   Null     Null.SYS     Thu Aug 22 07:40:24 2013 (5215F8A8)
fffff800`82200000 fffff800`82274000   nwifi    nwifi.sys    Tue Oct 28 22:45:41 2014 (545054D5)
fffff800`81334000 fffff800`8135e000   pacer    pacer.sys    Tue Oct 28 22:45:30 2014 (545054CA)
fffff800`7f9bd000 fffff800`7f9d5000   partmgr  partmgr.sys  Wed Oct 08 03:34:42 2014 (5434E912)
fffff800`7f800000 fffff800`7f848000   pci      pci.sys      Thu Jul 24 07:45:24 2014 (53D0F1D4)
fffff800`802f2000 fffff800`80302000   pcw      pcw.sys      Thu Aug 22 04:46:34 2013 (5215CFEA)
fffff800`7f855000 fffff800`7f871000   pdc      pdc.sys      Wed Oct 15 00:34:24 2014 (543DF950)
fffff800`828a4000 fffff800`8294d000   peauth   peauth.sys   Sat Feb 22 07:09:37 2014 (53089381)
fffff800`822fa000 fffff800`82341000   portcls  portcls.sys  Tue Oct 28 22:46:35 2014 (5450550B)
fffff800`836d3000 fffff800`836df000   PROCEXP152 PROCEXP152.SYS Mon May 11 00:52:10 2015 (5550357A)
fffff800`7f53a000 fffff800`7f54f000   PSHED    PSHED.dll    Sat Sep 14 09:57:19 2013 (52346B3F)
fffff800`81387000 fffff800`813f7000   rdbss    rdbss.sys    Tue Dec 17 02:21:22 2013 (52AFFB72)
fffff800`815ea000 fffff800`815f5000   rdpbus   rdpbus.sys   Thu Aug 22 07:38:52 2013 (5215F84C)
fffff800`8035c000 fffff800`803a2000   rdyboost rdyboost.sys Sat Feb 22 07:13:40 2014 (53089474)
fffff800`82274000 fffff800`8228c000   rspndr   rspndr.sys   Thu Aug 22 07:36:34 2013 (5215F7C2)
fffff800`82123000 fffff800`821ef000   Rt630x64 Rt630x64.sys Fri Jul 26 03:01:35 2013 (51F21ECF)
fffff800`820b6000 fffff800`82123000   RtsPer   RtsPer.sys   Wed Aug 21 03:23:24 2013 (52146AEC)
fffff800`8294d000 fffff800`82958000   secdrv   secdrv.SYS   Wed Sep 13 09:18:38 2006 (4508052E)
fffff800`821ef000 fffff800`821fc000   Smb_driver_Intel Smb_driver_Intel.sys Thu Aug 01 20:54:20 2013 (51FB033C)
fffff800`7fabc000 fffff800`7fb25000   spaceport spaceport.sys Tue Oct 28 22:47:03 2014 (54505527)
fffff800`83600000 fffff800`8368e000   srv      srv.sys      Thu Jul 24 07:43:27 2014 (53D0F15F)
fffff800`836ed000 fffff800`8379a000   srv2     srv2.sys     Wed Oct 08 03:33:30 2014 (5434E8CA)
fffff800`82958000 fffff800`8299b000   srvnet   srvnet.sys   Fri Jun 27 02:22:21 2014 (53AD0D9D)
fffff800`7ff50000 fffff800`7ffae000   storport storport.sys Wed Sep 24 22:47:07 2014 (5423822B)
fffff800`8240f000 fffff800`8249b000   stwrt64  stwrt64.sys  Fri Aug 16 06:26:26 2013 (520DFE52)
fffff800`821fc000 fffff800`821fd600   swenum   swenum.sys   Tue Oct 28 22:47:41 2014 (5450554D)
fffff800`81b04000 fffff800`81b8a000   SynTP    SynTP.sys    Thu Aug 01 20:51:42 2013 (51FB029E)
fffff800`80610000 fffff800`8087c000   tcpip    tcpip.sys    Sun Nov 09 21:59:03 2014 (546029F7)
fffff800`8299b000 fffff800`829ad000   tcpipreg tcpipreg.sys Thu Mar 06 04:19:59 2014 (53183DBF)
fffff800`8102c000 fffff800`8103a000   TDI      TDI.SYS      Thu Aug 22 07:39:01 2013 (5215F855)
fffff800`8100c000 fffff800`8102c000   tdx      tdx.sys      Thu Aug 22 07:36:34 2013 (5215F7C2)
fffff800`81ae8000 fffff800`81b04000   TeeDriverx64 TeeDriverx64.sys Tue Jul 02 14:38:08 2013 (51D31E10)
fffff800`7f518000 fffff800`7f53a000   tm       tm.sys       Thu Aug 22 07:39:33 2013 (5215F875)
fffff960`0067a000 fffff960`00683000   TSDDD    TSDDD.dll    Thu Aug 22 07:40:32 2013 (5215F8B0)
fffff800`8368e000 fffff800`836bb000   tunnel   tunnel.sys   Thu Aug 22 07:35:45 2013 (5215F791)
fffff800`81ab6000 fffff800`81ae8000   ucx01000 ucx01000.sys Tue Oct 07 01:00:55 2014 (54337387)
fffff800`81564000 fffff800`81575000   umbus    umbus.sys    Thu Aug 22 07:38:59 2013 (5215F853)
fffff800`824f1000 fffff800`82518000   usbccgp  usbccgp.sys  Thu Jul 24 07:44:51 2014 (53D0F1B3)
fffff800`81cb0000 fffff800`81cbc000   USBD     USBD.SYS     Sat May 31 02:31:17 2014 (53897735)
fffff800`81c00000 fffff800`81c18000   usbehci  usbehci.sys  Sat May 31 02:29:54 2014 (538976E2)
fffff800`7fa4c000 fffff800`7fab6000   usbhub   usbhub.sys   Thu Jul 24 07:45:29 2014 (53D0F1D9)
fffff800`82363000 fffff800`823db000   UsbHub3  UsbHub3.sys  Mon Mar 16 23:34:24 2015 (5507A0C0)
fffff800`81c18000 fffff800`81c87000   USBPORT  USBPORT.SYS  Sat May 31 02:30:25 2014 (53897701)
fffff800`81a61000 fffff800`81ab6000   USBXHCI  USBXHCI.SYS  Thu Apr 09 22:08:27 2015 (5527309B)
fffff800`81435000 fffff800`81518000   VBoxDrv  VBoxDrv.sys  Tue Sep 09 11:29:03 2014 (540F1CBF)
fffff800`815a8000 fffff800`815d0000   VBoxNetAdp VBoxNetAdp.sys Tue Sep 09 11:26:34 2014 (540F1C2A)
fffff800`81400000 fffff800`8142b000   VBoxNetFlt VBoxNetFlt.sys Tue Sep 09 11:26:34 2014 (540F1C2A)
fffff800`81219000 fffff800`8123f000   VBoxUSBMon VBoxUSBMon.sys Tue Sep 09 11:26:34 2014 (540F1C2A)
fffff800`7f848000 fffff800`7f855000   vdrvroot vdrvroot.sys Thu Aug 22 07:38:49 2013 (5215F849)
fffff800`7fb25000 fffff800`7fb3a000   volmgr   volmgr.sys   Thu Aug 22 07:39:53 2013 (5215F889)
fffff800`7fb3a000 fffff800`7fb99000   volmgrx  volmgrx.sys  Thu Aug 22 07:40:23 2013 (5215F8A7)
fffff800`8030d000 fffff800`8035c000   volsnap  volsnap.sys  Wed Jun 18 18:41:28 2014 (53A21598)
fffff800`82070000 fffff800`8207d000   vwifibus vwifibus.sys Thu Aug 22 07:39:00 2013 (5215F854)
fffff800`8135e000 fffff800`81376000   vwififlt vwififlt.sys Wed Apr 30 02:43:46 2014 (53609BA2)
fffff800`827f1000 fffff800`82800000   vwifimp  vwifimp.sys  Wed Apr 30 02:41:59 2014 (53609B37)
fffff800`81200000 fffff800`81219000   wanarp   wanarp.sys   Mon Jan 05 21:59:31 2015 (54AB4F93)
fffff800`811be000 fffff800`811d0000   watchdog watchdog.sys Sat Feb 22 07:14:39 2014 (530894AF)
fffff800`7f69c000 fffff800`7f76b000   Wdf01000 Wdf01000.sys Thu Aug 22 07:38:56 2013 (5215F850)
fffff800`7fbb4000 fffff800`7fbf7000   WdFilter WdFilter.sys Fri Jan 30 05:20:58 2015 (54CB5B0A)
fffff800`7f76b000 fffff800`7f77c000   WDFLDR   WDFLDR.SYS   Thu Aug 22 07:39:03 2013 (5215F857)
fffff800`7f4a8000 fffff800`7f4b6000   werkernel werkernel.sys Thu Aug 22 07:40:24 2013 (5215F8A8)
fffff800`808e8000 fffff800`8090d000   wfplwfs  wfplwfs.sys  Sun Nov 09 21:57:28 2014 (54602998)
fffff960`00103000 fffff960`00519000   win32k   win32k.sys   Thu May 21 12:46:18 2015 (555E0BDA)
fffff800`825c0000 fffff800`825d9000   WinUsb   WinUsb.sys   Thu Aug 22 07:37:55 2013 (5215F813)
fffff800`81bab000 fffff800`81bb5000   WirelessButtonDriver64 WirelessButtonDriver64.sys Wed Aug 29 23:11:29 2012 (503ED9E1)
fffff800`81bdc000 fffff800`81be6000   wmiacpi  wmiacpi.sys  Thu Aug 22 07:40:04 2013 (5215F894)
fffff800`7f910000 fffff800`7f91a000   WMILIB   WMILIB.SYS   Thu Aug 22 07:40:23 2013 (5215F8A7)
fffff800`7ffc8000 fffff800`7fff3000   Wof      Wof.sys      Thu Mar 13 04:27:29 2014 (53216BF1)
fffff800`7f794000 fffff800`7f79f000   WppRecorder WppRecorder.sys Thu Aug 22 07:39:40 2013 (5215F87C)
fffff800`8259f000 fffff800`825c0000   WudfPf   WudfPf.sys   Tue Oct 28 22:46:27 2014 (54505503)
fffff800`8249b000 fffff800`824d8000   WUDFRd   WUDFRd.sys   Tue Oct 28 22:46:13 2014 (545054F5)

Unloaded modules:
fffff800`837d6000 fffff800`837e2000   hiber_storport.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  0000C000
fffff800`83c77000 fffff800`83f31000   hiber_iaStorA.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  002BA000
fffff800`83f31000 fffff800`83f47000   hiber_dumpfve.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00016000
fffff800`837ca000 fffff800`837d6000   hiber_storport.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  0000C000
fffff800`830a9000 fffff800`83363000   hiber_iaStorA.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  002BA000
fffff800`83363000 fffff800`83379000   hiber_dumpfve.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00016000
fffff800`837be000 fffff800`837ca000   hiber_storport.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  0000C000
fffff800`830ae000 fffff800`83368000   hiber_iaStorA.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  002BA000
fffff800`83368000 fffff800`8337e000   hiber_dumpfve.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00016000
fffff800`837b6000 fffff800`837be000   cec0cf97-6cf0-4af2-bc65-8b4393b9ba74
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00008000
fffff800`8379a000 fffff800`837a4000   cpuz138_x64.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  0000A000
fffff800`837a4000 fffff800`837ac000   e2160e41-2c34-4220-a4c9-d1f40b9f85f8
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00008000
fffff800`836df000 fffff800`836eb000   hiber_storport.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  0000C000
fffff800`83069000 fffff800`83323000   hiber_iaStorA.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  002BA000
fffff800`83323000 fffff800`83339000   hiber_dumpfve.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00016000
fffff800`836c7000 fffff800`836d3000   hiber_storport.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  0000C000
fffff800`82af8000 fffff800`82db2000   hiber_iaStorA.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  002BA000
fffff800`82db2000 fffff800`82dc8000   hiber_dumpfve.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00016000
fffff800`836bb000 fffff800`836c7000   hiber_storport.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  0000C000
fffff800`82aa1000 fffff800`82d5b000   hiber_iaStorA.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  002BA000
fffff800`82d5b000 fffff800`82d71000   hiber_dumpfve.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00016000
fffff800`82287000 fffff800`822fa000   IntcDAud.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00073000
fffff800`8249b000 fffff800`824b4000   WinUsb.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00019000
fffff800`824b4000 fffff800`824f1000   WUDFRd.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  0003D000
fffff800`80600000 fffff800`8060c000   dump_storport.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  0000C000
fffff800`80cfa000 fffff800`80fb4000   dump_iaStorA.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  002BA000
fffff800`80fb4000 fffff800`80fca000   dump_dumpfve.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00016000
fffff800`81564000 fffff800`81575000   dam.sys 
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00011000
fffff800`7f9a5000 fffff800`7f9b3000   WdBoot.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  0000E000
fffff800`80600000 fffff800`8060c000   hwpolicy.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  0000C000
Bugcheck code 00000139
Arguments 00000000`00000003 ffffd000`2136fda0 ffffd000`2136fcf8 00000000`00000000
0: kd> lmvm NETwbw02
start             end                 module name
fffff800`81ced000 fffff800`82070000   NETwbw02   (no symbols)           
    Loaded symbol image file: NETwbw02.sys
    Image path: \SystemRoot\system32\DRIVERS\NETwbw02.sys
    Image name: NETwbw02.sys
    Timestamp:        Mon Mar 23 04:53:41 2015 (550FD495)
    CheckSum:         0035F91B
    ImageSize:        00383000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4
 
Last edited:
Sysnative/jcgriff2 BSOD Collection app zip file attached.

I had copied other full kernel dumps into \windows\minidump & the zip file ended up >700 MB in size!
 
Looks like the crash is occurring when passing an NBL structure via the miniport driver. Well, without a kmd, here's what I can see.

Code: 
0: kd> .bugcheck
Bugcheck code 00000139
Arguments 00000000`00000003 ffffd000`2136fda0 ffffd000`2136fcf8 00000000`00000000

Reason for bug check was corrupted LIST_ENTRY.

Code: 
0: kd> knL
 # Child-SP          RetAddr           Call Site
00 ffffd000`2136fa78 fffff803`27fdd7e9 nt!KeBugCheckEx
01 ffffd000`2136fa80 fffff803`27fddb10 nt!KiBugCheckDispatch+0x69
02 ffffd000`2136fbc0 fffff803`27fdcd34 nt!KiFastFailDispatch+0xd0
03 ffffd000`2136fda0 fffff800`8043ac3a nt!KiRaiseSecurityCheckFailure+0xf4
04 ffffd000`2136ff30 fffff800`804359ff ndis!ndisFreeToNPagedPool+0x59
05 ffffd000`2136ff60 fffff800`804559dd ndis!NdisFreeNetBuffer+0xdf
06 ffffd000`2136ffd0 fffff800`81364e19 ndis!NdisFreeCloneNetBufferList+0x292fd
07 ffffd000`21370080 fffff800`80430eee vwififlt!FilterSendNetBufferListsComplete+0x181
08 ffffd000`213700d0 fffff800`81e9e671 ndis!NdisMSendNetBufferListsComplete+0x4de
09 ffffd000`21370240 ffffe000`1a7b61a0 NETwbw02+0x1b1671
0a ffffd000`21370248 ffffe000`44049880 0xffffe000`1a7b61a0
0b ffffd000`21370250 00000000`00000001 0xffffe000`44049880
0c ffffd000`21370258 00000000`00000000 0x1

NETwbw02 calls NdisMSendNetBufferListsComplete to ultimately return a NBL (NET_BUFFER_LIST) structure to the miniport driver that called it (which is NETwbw02). These structures specify the data that is transmitted or received over the network. NDIS then calls FilterSendNetBufferListsComplete to complete the send request that the filter driver started by calling the NdisFSendNetBufferLists function. If you notice, we can't see that function on the stack, so we need to disassemble frame #07.

Code: 
0: kd> ub NdisMSendNetBufferListsComplete
ndis!NdisFSendNetBufferLists+0x32d:
fffff800`804309fe e9f0fcffff      jmp     ndis!NdisFSendNetBufferLists+0x24 (fffff800`804306f3)
fffff800`80430a03 cc              int     3
fffff800`80430a04 4c8bdb          mov     r11,rbx
fffff800`80430a07 e916feffff      jmp     ndis!NdisFSendNetBufferLists+0x153 (fffff800`80430822)
fffff800`80430a0c cc              int     3
fffff800`80430a0d 90              nop
fffff800`80430a0e 90              nop
fffff800`80430a0f 90              nop

NdisFSendNetBufferLists is called by filter drivers to send a list of data buffers from the network, which now needs to be sent back down by NDIS to the underlying miniport driver(s) (NETwbw02). This is done by NDIS calling the NdisAllocateCloneNetBufferList function, which creates a clone NBL structure to send duplicate data on a separate data path.

We can see the call to the NdisFreeCloneNetBufferList function, which free the NET_BUFFER, as well as any associated NBL structures and MDL chains (Memory Descriptor List) previously allocated by the NdisAllocateCloneNetBufferList function.

To quickly describe MDL chains, VG actually wrote about them on here - https://www.sysnative.com/forums/bsod-kernel-dump-analysis-debugging-information/269-fun-mdls.html

Anyway, with that said, the MDL chains that were freed were from NETwbw02's IRPs.

We go off the rails freeing a NET_BUFFER structure that was previously allocated from a NET_BUFFER structure pool to what looks like nonpaged pool?

Code: 
03 ffffd000`2136fda0 fffff800`8043ac3a nt!KiRaiseSecurityCheckFailure+0xf4
04 ffffd000`2136ff30 fffff800`804359ff ndis!ndisFreeToNPagedPool+0x59 // Here
05 ffffd000`2136ff60 fffff800`804559dd ndis!NdisFreeNetBuffer+0xdf

Let's look at the trap frame for the exception that caused the bugcheck.

Code: 
0: kd> .trap ffffd000`2136fda0
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000002 rbx=0000000000000000 rcx=0000000000000003
rdx=ffffe00053b52018 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8008043ac3a rsp=ffffd0002136ff30 rbp=ffffd0002136ffc0
 r8=ffffe0001f555018  r9=0000000000000001 r10=ffffe0001c591c70
r11=ffffe0001c4dc5a1 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na po cy
ndis!ndisFreeToNPagedPool+0x59:
fffff800`8043ac3a cd29            int     29h

So we see this weird instruction:

Code: 
int     29h

What is that?

If you do a livekd, and run !idt 29, you can see:

Code: 
kd> !idt 29

Dumping IDT: 809da400

29: 8158795c nt!KiRaiseSecurityCheckFailure

So on Windows 8, an ISR (Interrupt Service Routine) is defined by the kernel - i.e. nt!KiRaiseSecurityCheckFailure. When 0x29 is triggered, the function nt!KiFastFailDispatch is called, and then we bug check since this happened in kernel-mode and we can't recover.

Overall, without a kmd and no verifier, I feel pretty safe betting this is a problem in NETwbw02 as far as handling NBLs goes.
 
Patrick said:
Any chance for the kernel-dump of it, John?
Click to expand...

I hope this link to One Drive works! -

Full Kernel Dump - https://onedrive.live.com/embed?cid...=8B2951D529A2D2DE!130&authkey=AJ1jbvyQqbCvZ3I

satrow said:
Similar bugcheck here, May 4th, reporting that NETwbw02.sys had been updated to the latest version the previous day.

Looks like a notebook with an 8-core (Killer NIC) as well, minidump still available.
Click to expand...

I posted to that thread -- thanks -- same link.

My system is 8 core as well.
 
Great.

Code: 
1c ffffd000`21370a30 fffff800`804394eb ndis!ndisMiniportDpc+0x110 [COLOR=#008000]// NDIS queued miniport DPC for NETwbw02[/COLOR]
1d ffffd000`21370ad0 fffff800`80438fae ndis!ndisQueuedMiniportDpcWorkItem+0xfb[COLOR=#008000] // NDIS queuing a miniport DPC[/COLOR]
1e ffffd000`21370b70 fffff803`27f8136c ndis!ndisReceiveWorkerThread+0x20e [COLOR=#008000]// It's a worker thread regarding NDIS[/COLOR]
1f ffffd000`21370c00 fffff803`27fd82c6 nt!PspSystemThreadStartup+0x58
20 ffffd000`21370c60 00000000`00000000 nt!KiStartSystemThread+0x16 [COLOR=#008000]// Starting system thread[/COLOR]

Every other CPU minus 0 (bug check processor) was idle.

Code: 
0: kd> !running

System Processors:  (00000000000000ff)
  Idle Processors:  (00000000000000fe)

       Prcbs             Current         (pri) Next            (pri) Idle
  0    fffff80328184180  ffffe000173cf040 ( 8)                       fffff803281dda00  ................

Example:

Code: 
  5    ffffd000206c0180  ffffd000206cc3c0 ( 0)                       ffffd000206cc3c0  ................

Child-SP          RetAddr           Call Site
ffffd000`206ea8e8 fffff800`816011f7 intelppm!MWaitIdle+0x18
ffffd000`206ea8f0 fffff803`27ebfdf8 intelppm!AcpiCStateIdleExecute+0x17
ffffd000`206ea920 fffff803`27ebf856 nt!PpmIdleExecuteTransition+0x3e8
ffffd000`206eab10 fffff803`27fd57bc nt!PoIdle+0x2f6
ffffd000`206eac60 00000000`00000000 nt!KiIdleLoop+0x2c

So yeah, it basically looks like a bug with NETwbw02.

If you could enable verifier with:

Code: 
Special Pool
Force IRQL Checking
Pool Tracking
I/O Verification
Misc. checks
Invariant MDL checking for stack
Invariant MDL checking for driver
NDIS/WIFI Verification

and then upload its kernel after it crashes, maybe we can see exactly what's going wrong.
 
I will enable Verifier as soon as time permits.

I saw the 0xc409 exception in 2 user mode crashes today involving Adblock for IE, which means IE was being used, which means the Intel wifi driver was undoubtedly loaded.
 
Intel driver bug, no surprise with wireless network drivers in particular.
 
I'm shocked. I've always had nothing but Intel wifi - every system since 2007 - & consider them the best.
 
It happens to most network drivers I've seen, more so some manufacturers than others.
It's also more common in wireless drivers as well.
That being said, if I were to recommend a wireless network card, I would probably go with Intel or Asus as their drivers appear to be of better quality than, for example, Atheros or Realtek.
 

Has Sysnative Forums helped you? Please consider donating to help us support the site!

Back
Top