jcgriff2 BSOD - Windows 8.1 x64 - 0xc000021a

jcgriff2 · Jun 17, 2015

Experienced a few Live Kernel Events early this morning (0x117); then a BSOD.

Bucheck = 0xc000021a, which is really an exception error code -- critical service termination.

Minidump is corrupted & won't open in Windbg, but FULL kernel dump will (open in Windbg).

FULL Kernel dump - 1.2 GB; 300 MB zipped - (.7z was the best I could do -- .zip files kept hanging while uploading) -

http://www.sysnative.com/temp/MEMORY_06-17-2015_0512.7z

Here is the system - HP ENVY TouchSmart 17-j130us Notebook PC Product Specifications - HP ENVY TouchSmart 17-j130us Notebook PC Product Specifications | HP®*Support

HP ENVY I7-j130us drivers - HP Software and Driver Downloads for HP Printers, Laptops, Desktops and More | HP® Support

I would appreciate help with this!

Sysnative app files attached. Please note - the minidump is corrupted/only ~240 bytes in size)

Thanks,

John

Code:

Microsoft (R) Windows Debugger Version 10.0.10075.9 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\Windows\Minidump\MEMORY_06-17-2015_0512.DMP]
Kernel Bitmap Dump File: Kernel address space is available, User address space may not be available.

************* Symbol Path validation summary **************
Response                         Time (ms)     Location
Deferred                                       SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 8.1 Kernel Version 9600 MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 9600.17736.amd64fre.winblue_r9.150322-1500
Machine Name:
Kernel base = 0xfffff803`9340a000 PsLoadedModuleList = 0xfffff803`936e3850
Debug session time: Wed Jun 17 05:11:00.321 2015 (UTC - 4:00)
System Uptime: 7 days 4:29:35.407
Loading Kernel Symbols
...............................................................
................................................................
........Page 14ebc7 not present in the dump file. Type ".hh dbgerr004" for details
...................................
Loading User Symbols
...........................
Loading unloaded module list
..........................
No .natvis files found at C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\Visualizers.
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck C000021A, {ffffc000905ed180, 0, 0, 0}
Page 14ebc7 not present in the dump file. Type ".hh dbgerr004" for details
Page 14ebc7 not present in the dump file. Type ".hh dbgerr004" for details
Page 14ebc7 not present in the dump file. Type ".hh dbgerr004" for details
Page 14ebc7 not present in the dump file. Type ".hh dbgerr004" for details
Probably caused by : ntkrnlmp.exe ( nt! ?? ::OKHAJAOM::`string'+269a )
Followup:     MachineOwner
---------

This is a STATUS_SYSTEM_PROCESS_TERMINATED bugcheck.
It signals that the system is rebooting due to a critical service termination.
The bugcheck is not very useful for debugging. To investigate the root cause
find the related svchost.exe crashes that happened on the same machine
around the time of this dump.
6: kd> k
 # Child-SP          RetAddr           Call Site
00 ffffd000`23ce86b8 fffff803`93795991 nt!KeBugCheckEx
01 ffffd000`23ce86c0 fffff803`9378f4ea nt!PopGracefulShutdown+0x2c9
02 ffffd000`23ce8700 fffff803`935664b3 nt! ?? ::OKHAJAOM::`string'+0x269a
03 ffffd000`23ce8840 fffff803`9355e900 nt!KiSystemServiceCopyEnd+0x13
04 ffffd000`23ce89d8 fffff803`939a5abb nt!KiServiceLinkage
05 ffffd000`23ce89e0 fffff803`938db75f nt! ?? ::NNGAKEGL::`string'+0x70c0b
06 ffffd000`23ce8aa0 fffff803`934e6fba nt!PopPolicyWorkerAction+0x63
07 ffffd000`23ce8b10 fffff803`934b76bc nt!PopPolicyWorkerThread+0xba
08 ffffd000`23ce8b50 fffff803`9350a36c nt!ExpWorkerThread+0x28c
09 ffffd000`23ce8c00 fffff803`935612c6 nt!PspSystemThreadStartup+0x58
0a ffffd000`23ce8c60 00000000`00000000 nt!KiStartSystemThread+0x16
6: kd> kv
 # Child-SP          RetAddr           : Args to Child                                                           : Call Site
00 ffffd000`23ce86b8 fffff803`93795991 : 00000000`0000004c 00000000`c000021a ffffd000`27cf13f8 ffffe001`32cd6120 : nt!KeBugCheckEx
01 ffffd000`23ce86c0 fffff803`9378f4ea : ffffe001`40072300 ffffd000`23ce87d9 00000000`00000000 00000000`00000002 : nt!PopGracefulShutdown+0x2c9
02 ffffd000`23ce8700 fffff803`935664b3 : ffffe001`40072040 00000000`00000000 00000000`c0000004 00000000`00000000 : nt! ?? ::OKHAJAOM::`string'+0x269a
03 ffffd000`23ce8840 fffff803`9355e900 : fffff803`939a5abb 00000000`00000001 ffffd000`23ce8a58 00000000`c0000004 : nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ ffffd000`23ce8840)
04 ffffd000`23ce89d8 fffff803`939a5abb : 00000000`00000001 ffffd000`23ce8a58 00000000`c0000004 ffffd001`61840180 : nt!KiServiceLinkage
05 ffffd000`23ce89e0 fffff803`938db75f : 00000000`00000000 00000000`00000000 ffffd001`61840180 ffffe001`40072180 : nt! ?? ::NNGAKEGL::`string'+0x70c0b
06 ffffd000`23ce8aa0 fffff803`934e6fba : fffff803`934e6f00 00000000`00000000 00000000`00000002 fffff803`936bc340 : nt!PopPolicyWorkerAction+0x63
07 ffffd000`23ce8b10 fffff803`934b76bc : 00000000`00000002 fffff803`936ca2a0 ffffe001`40072040 fffff803`00000005 : nt!PopPolicyWorkerThread+0xba
08 ffffd000`23ce8b50 fffff803`9350a36c : ffffc000`8268a140 ffffe001`40072040 00000000`00000080 ffffe001`40072040 : nt!ExpWorkerThread+0x28c
09 ffffd000`23ce8c00 fffff803`935612c6 : ffffd001`61743180 ffffe001`40072040 ffffd001`6174f3c0 00000000`00000000 : nt!PspSystemThreadStartup+0x58
0a ffffd000`23ce8c60 00000000`00000000 : ffffd000`23ce9000 ffffd000`23ce3000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x16
6: kd> r
rax=ffffe0013c60b770 rbx=ffffe00140072300 rcx=000000000000004c
rdx=00000000c000021a rsi=0000000000000000 rdi=0000000000000002
rip=fffff8039355aca0 rsp=ffffd00023ce86b8 rbp=0000000000000001
 r8=ffffd00027cf13f8  r9=ffffe00132cd6120 r10=0000000000000006
r11=0000000000000006 r12=0000000000000000 r13=0000000000000001
r14=0000000000000000 r15=0000000000000004
iopl=0         nv up ei ng nz na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00000286
nt!KeBugCheckEx:
fffff803`9355aca0 48894c2408      mov     qword ptr [rsp+8],rcx ss:0018:ffffd000`23ce86c0=000000000000004c
6: kd> lmnt
start             end                 module name
00007ff6`828c0000 00007ff6`82926000   services services.exe Wed Apr 08 00:32:12 2015 (5524AF4C)
00007ffd`aacf0000 00007ffd`aad0f000   SAMLIB   SAMLIB.dll   Tue Oct 28 21:28:26 2014 (545042BA)
00007ffd`aeec0000 00007ffd`aef4e000   apphelp  apphelp.dll  Tue Oct 28 22:44:53 2014 (545054A5)
00007ffd`af560000 00007ffd`af5a8000   AUTHZ    AUTHZ.dll    Mon Apr 13 18:37:35 2015 (552C452F)
00007ffd`af5b0000 00007ffd`af639000   scesrv   scesrv.dll   Mon Dec 08 20:56:35 2014 (548656D3)
00007ffd`af870000 00007ffd`af8af000   logoncli logoncli.dll Tue Oct 28 21:27:50 2014 (54504296)
00007ffd`afc20000 00007ffd`afc3a000   cryptdll cryptdll.dll Tue Oct 28 21:28:16 2014 (545042B0)
00007ffd`afc40000 00007ffd`afcac000   msv1_0   msv1_0.DLL   Tue Oct 28 21:26:08 2014 (54504230)
00007ffd`afcd0000 00007ffd`afd29000   mswsock  mswsock.dll  Tue Oct 28 21:29:41 2014 (54504305)
00007ffd`aff40000 00007ffd`aff5e000   spinf    spinf.dll    Tue Oct 28 22:44:58 2014 (545054AA)
00007ffd`aff60000 00007ffd`aff86000   srvcli   srvcli.dll   Tue Oct 28 21:27:34 2014 (54504286)
00007ffd`aff90000 00007ffd`aff9b000   EventAggregation EventAggregation.dll Tue Oct 28 21:27:19 2014 (54504277)
00007ffd`affa0000 00007ffd`affa8000   DABAPI   DABAPI.dll   Tue Oct 28 21:29:32 2014 (545042FC)
00007ffd`b0120000 00007ffd`b0131000   scext    scext.dll    Tue Oct 28 21:28:44 2014 (545042CC)
00007ffd`b0150000 00007ffd`b017e000   SspiCli  SspiCli.dll  Tue Oct 28 21:29:54 2014 (54504312)
00007ffd`b0180000 00007ffd`b01e3000   bcryptPrimitives bcryptPrimitives.dll Tue Oct 28 21:28:57 2014 (545042D9)
00007ffd`b01f0000 00007ffd`b01fb000   CRYPTBASE CRYPTBASE.dll Tue Oct 28 22:46:18 2014 (545054FA)
00007ffd`b0320000 00007ffd`b0335000   profapi  profapi.dll  Tue Oct 28 21:29:41 2014 (54504305)
00007ffd`b03f0000 00007ffd`b0505000   KERNELBASE KERNELBASE.dll Tue Oct 28 22:55:51 2014 (54505737)
00007ffd`b0510000 00007ffd`b055f000   cfgmgr32 cfgmgr32.dll Tue Oct 28 21:29:09 2014 (545042E5)
00007ffd`b25c0000 00007ffd`b2619000   sechost  sechost.dll  Fri Mar 20 00:08:34 2015 (550B9D42)
00007ffd`b2880000 00007ffd`b29c1000   RPCRT4   RPCRT4.dll   Tue Oct 28 21:40:56 2014 (545045A8)
00007ffd`b2d40000 00007ffd`b2e7e000   KERNEL32 KERNEL32.DLL Tue Oct 28 22:45:30 2014 (545054CA)
00007ffd`b3040000 00007ffd`b30ea000   msvcrt   msvcrt.dll   Tue Oct 28 22:50:38 2014 (545055FE)
00007ffd`b3160000 00007ffd`b31ba000   WS2_32   WS2_32.dll   Tue Oct 28 21:29:24 2014 (545042F4)
00007ffd`b31c0000 00007ffd`b31c9000   NSI      NSI.dll      Tue Oct 28 22:48:43 2014 (5450558B)
00007ffd`b31d0000 00007ffd`b337c000   ntdll    ntdll.dll    Sun Mar 22 18:33:26 2015 (550F4336)
ffffe001`37039000 ffffe001`37040000   em015_64 em015_64.dat Fri Mar 01 08:27:56 2013 (5130ACDC)
ffffe001`42e47000 ffffe001`42ea9000   em018_64 em018_64.dat Mon Jun 08 03:42:26 2015 (55754762)
ffffe001`497cc000 ffffe001`49800000   em006_64 em006_64.dat Wed Jun 03 03:58:23 2015 (556EB39F)
fffff801`e0200000 fffff801`e0288000   CI       CI.dll       Fri Dec 05 22:23:28 2014 (548276B0)
fffff801`e0299000 fffff801`e0316000   mcupdate_GenuineIntel mcupdate_GenuineIntel.dll Fri Jul 04 08:59:36 2014 (53B6A538)
fffff801`e0316000 fffff801`e0324000   werkernel werkernel.sys Thu Aug 22 07:40:24 2013 (5215F8A8)
fffff801`e0324000 fffff801`e0386000   CLFS     CLFS.SYS     Tue Mar 03 19:51:05 2015 (54F656F9)
fffff801`e0386000 fffff801`e03a8000   tm       tm.sys       Thu Aug 22 07:39:33 2013 (5215F875)
fffff801`e03a8000 fffff801`e03bd000   PSHED    PSHED.dll    Sat Sep 14 09:57:19 2013 (52346B3F)
fffff801`e03bd000 fffff801`e03c7000   BOOTVID  BOOTVID.dll  Thu Aug 22 07:40:26 2013 (5215F8AA)
fffff801`e0400000 fffff801`e0418000   acpiex   acpiex.sys   Thu Aug 22 07:37:47 2013 (5215F80B)
fffff801`e0418000 fffff801`e0423000   WppRecorder WppRecorder.sys Thu Aug 22 07:39:40 2013 (5215F87C)
fffff801`e0423000 fffff801`e04ab000   ACPI     ACPI.sys     Mon Oct 06 23:29:50 2014 (54335E2E)
fffff801`e04b2000 fffff801`e050f000   msrpc    msrpc.sys    Thu Aug 22 07:39:22 2013 (5215F86A)
fffff801`e050f000 fffff801`e05de000   Wdf01000 Wdf01000.sys Thu Aug 22 07:38:56 2013 (5215F850)
fffff801`e05de000 fffff801`e05ef000   WDFLDR   WDFLDR.SYS   Thu Aug 22 07:39:03 2013 (5215F857)
fffff801`e05ef000 fffff801`e05f9000   WMILIB   WMILIB.SYS   Thu Aug 22 07:40:23 2013 (5215F8A7)
fffff801`e0600000 fffff801`e0669000   spaceport spaceport.sys Tue Oct 28 22:47:03 2014 (54505527)
fffff801`e0669000 fffff801`e067e000   volmgr   volmgr.sys   Thu Aug 22 07:39:53 2013 (5215F889)
fffff801`e069d000 fffff801`e0728000   cng      cng.sys      Sun Mar 29 18:22:05 2015 (55187B0D)
fffff801`e0736000 fffff801`e0740000   msisadrv msisadrv.sys Thu Aug 22 07:39:03 2013 (5215F857)
fffff801`e0740000 fffff801`e0788000   pci      pci.sys      Thu Jul 24 07:45:24 2014 (53D0F1D4)
fffff801`e0788000 fffff801`e0795000   vdrvroot vdrvroot.sys Thu Aug 22 07:38:49 2013 (5215F849)
fffff801`e0795000 fffff801`e07b1000   pdc      pdc.sys      Wed Oct 15 00:34:24 2014 (543DF950)
fffff801`e07b1000 fffff801`e07c9000   partmgr  partmgr.sys  Wed Oct 08 03:34:42 2014 (5434E912)
fffff801`e0800000 fffff801`e084b000   mrxsmb10 mrxsmb10.sys Thu Mar 06 04:19:36 2014 (53183DA8)
fffff801`e084e000 fffff801`e08ad000   volmgrx  volmgrx.sys  Thu Aug 22 07:40:23 2013 (5215F8A7)
fffff801`e08ad000 fffff801`e08c8000   mountmgr mountmgr.sys Mon Oct 06 21:18:16 2014 (54333F58)
fffff801`e08c8000 fffff801`e090b000   WdFilter WdFilter.sys Fri Jan 30 05:20:58 2015 (54CB5B0A)
fffff801`e090b000 fffff801`e095a000   volsnap  volsnap.sys  Wed Jun 18 18:41:28 2014 (53A21598)
fffff801`e095a000 fffff801`e09a0000   rdyboost rdyboost.sys Sat Feb 22 07:13:40 2014 (53089474)
fffff801`e09a0000 fffff801`e09bc000   disk     disk.sys     Thu Aug 22 07:39:47 2013 (5215F883)
fffff801`e0a00000 fffff801`e0a17000   mup      mup.sys      Thu Aug 22 07:40:28 2013 (5215F8AC)
fffff801`e0a23000 fffff801`e0cdd000   iaStorA  iaStorA.sys  Fri Aug 16 13:22:01 2013 (520E5FB9)
fffff801`e0cdd000 fffff801`e0d3b000   storport storport.sys Wed Sep 24 22:47:07 2014 (5423822B)
fffff801`e0d3b000 fffff801`e0d55000   EhStorClass EhStorClass.sys Thu Aug 22 07:38:15 2013 (5215F827)
fffff801`e0d55000 fffff801`e0db1000   fltmgr   fltmgr.sys   Mon Aug 25 22:25:16 2014 (53FBF00C)
fffff801`e0db1000 fffff801`e0dc7000   fileinfo fileinfo.sys Sat Feb 22 07:13:10 2014 (53089456)
fffff801`e0dc7000 fffff801`e0df2000   Wof      Wof.sys      Thu Mar 13 04:27:29 2014 (53216BF1)
fffff801`e0e0a000 fffff801`e1004000   Ntfs     Ntfs.sys     Fri Oct 10 20:35:55 2014 (54387B6B)
fffff801`e1004000 fffff801`e1020000   ksecdd   ksecdd.sys   Tue Oct 28 22:47:36 2014 (54505548)
fffff801`e1020000 fffff801`e1030000   pcw      pcw.sys      Thu Aug 22 04:46:34 2013 (5215CFEA)
fffff801`e1030000 fffff801`e103b000   Fs_Rec   Fs_Rec.sys   Thu Aug 22 04:46:33 2013 (5215CFE9)
fffff801`e103b000 fffff801`e1152000   ndis     ndis.sys     Mon Feb 02 19:03:15 2015 (54D01043)
fffff801`e1152000 fffff801`e11ca000   NETIO    NETIO.SYS    Sun Nov 09 21:58:13 2014 (546029C5)
fffff801`e11ca000 fffff801`e11fb000   ksecpkg  ksecpkg.sys  Sun Jan 11 22:01:17 2015 (54B338FD)
fffff801`e1200000 fffff801`e1295000   fvevol   fvevol.sys   Mon Apr 07 18:25:31 2014 (534325DB)
fffff801`e1295000 fffff801`e12a0000   hpdskflt hpdskflt.sys Tue Feb 26 15:08:12 2013 (512D162C)
fffff801`e12b2000 fffff801`e151e000   tcpip    tcpip.sys    Sun Nov 09 21:59:03 2014 (546029F7)
fffff801`e151e000 fffff801`e158a000   fwpkclnt fwpkclnt.sys Sun Nov 09 21:57:40 2014 (546029A4)
fffff801`e158a000 fffff801`e15af000   wfplwfs  wfplwfs.sys  Sun Nov 09 21:57:28 2014 (54602998)
fffff801`e15af000 fffff801`e15ee000   edevmon  edevmon.sys  Tue Jan 20 05:39:37 2015 (54BE3069)
fffff801`e15ee000 fffff801`e15fd000   intelpep intelpep.sys Wed Oct 15 02:29:44 2014 (543E1458)
fffff801`e163f000 fffff801`e1695000   CLASSPNP CLASSPNP.SYS Wed Oct 08 01:22:07 2014 (5434C9FF)
fffff801`e1695000 fffff801`e16aa000   crashdmp crashdmp.sys Thu Aug 22 07:40:03 2013 (5215F893)
fffff801`e16b6000 fffff801`e1785000   eamonm   eamonm.sys   Tue Jan 20 05:39:35 2015 (54BE3067)
fffff801`e1785000 fffff801`e17f9000   nwifi    nwifi.sys    Tue Oct 28 22:45:41 2014 (545054D5)
fffff801`e1a00000 fffff801`e1a26000   VBoxUSBMon VBoxUSBMon.sys Tue Sep 09 11:26:34 2014 (540F1C2A)
fffff801`e1a26000 fffff801`e1a51000   VBoxNetFlt VBoxNetFlt.sys Tue Sep 09 11:26:34 2014 (540F1C2A)
fffff801`e1a51000 fffff801`e1d0b000   dump_iaStorA dump_iaStorA.sys Fri Aug 16 13:22:01 2013 (520E5FB9)
fffff801`e1d0b000 fffff801`e1d43000   mrxsmb20 mrxsmb20.sys Sat Sep 27 00:59:28 2014 (54264430)
fffff801`e1d58000 fffff801`e1d86000   cdrom    cdrom.sys    Thu Aug 22 04:46:35 2013 (5215CFEB)
fffff801`e1d86000 fffff801`e1d8f000   Null     Null.SYS     Thu Aug 22 07:40:24 2013 (5215F8A8)
fffff801`e1d8f000 fffff801`e1d97000   Beep     Beep.SYS     Thu Aug 22 07:40:24 2013 (5215F8A8)
fffff801`e1d97000 fffff801`e1dc4000   ehdrv    ehdrv.sys    Tue Jan 20 05:39:52 2015 (54BE3078)
fffff801`e1dc4000 fffff801`e1dd2000   BasicRender BasicRender.sys Sat Feb 22 07:14:02 2014 (5308948A)
fffff801`e1dd2000 fffff801`e1deb000   wanarp   wanarp.sys   Mon Jan 05 21:59:31 2015 (54AB4F93)
fffff801`e1e00000 fffff801`e1e92000   afd      afd.sys      Thu May 29 23:03:01 2014 (5387F4E5)
fffff801`e1e92000 fffff801`e1ebc000   pacer    pacer.sys    Tue Oct 28 22:45:30 2014 (545054CA)
fffff801`e1ebc000 fffff801`e1ed4000   vwififlt vwififlt.sys Wed Apr 30 02:43:46 2014 (53609BA2)
fffff801`e1ed4000 fffff801`e1ee5000   netbios  netbios.sys  Tue Oct 28 22:47:23 2014 (5450553B)
fffff801`e1ee7000 fffff801`e2067000   dxgkrnl  dxgkrnl.sys  Tue Oct 28 22:46:45 2014 (54505515)
fffff801`e2067000 fffff801`e2079000   watchdog watchdog.sys Sat Feb 22 07:14:39 2014 (530894AF)
fffff801`e2079000 fffff801`e20dc000   dxgmms1  dxgmms1.sys  Tue Oct 28 22:46:30 2014 (54505506)
fffff801`e20dc000 fffff801`e20ee000   BasicDisplay BasicDisplay.sys Thu Aug 22 07:39:31 2013 (5215F873)
fffff801`e20ee000 fffff801`e2102000   Npfs     Npfs.SYS     Thu Aug 22 07:40:25 2013 (5215F8A9)
fffff801`e2102000 fffff801`e210e000   Msfs     Msfs.SYS     Thu Aug 22 07:40:24 2013 (5215F8A8)
fffff801`e210e000 fffff801`e212e000   tdx      tdx.sys      Thu Aug 22 07:36:34 2013 (5215F7C2)
fffff801`e212e000 fffff801`e213c000   TDI      TDI.SYS      Thu Aug 22 07:39:01 2013 (5215F855)
fffff801`e213c000 fffff801`e2188000   netbt    netbt.sys    Thu Aug 22 07:37:01 2013 (5215F7DD)
fffff801`e2188000 fffff801`e21f8000   rdbss    rdbss.sys    Tue Dec 17 02:21:22 2013 (52AFFB72)
fffff801`e2200000 fffff801`e221d000   Ndu      Ndu.sys      Tue Oct 28 22:45:16 2014 (545054BC)
fffff801`e2229000 fffff801`e230c000   VBoxDrv  VBoxDrv.sys  Tue Sep 09 11:29:03 2014 (540F1CBF)
fffff801`e230c000 fffff801`e231a000   nsiproxy nsiproxy.sys Tue Oct 28 22:46:03 2014 (545054EB)
fffff801`e231a000 fffff801`e2326000   npsvctrig npsvctrig.sys Thu Aug 22 07:38:22 2013 (5215F82E)
fffff801`e2326000 fffff801`e2332000   mssmbios mssmbios.sys Thu Aug 22 07:39:41 2013 (5215F87D)
fffff801`e2332000 fffff801`e2358000   dfsc     dfsc.sys     Thu Mar 06 04:22:50 2014 (53183E6A)
fffff801`e2369000 fffff801`e2383000   CLVirtualDrive CLVirtualDrive.sys Mon Dec 26 08:26:47 2011 (4EF87617)
fffff801`e2383000 fffff801`e239c000   ahcache  ahcache.sys  Thu Mar 19 21:56:10 2015 (550B7E3A)
fffff801`e239c000 fffff801`e23c4000   VBoxNetAdp VBoxNetAdp.sys Tue Sep 09 11:26:34 2014 (540F1C2A)
fffff801`e23c4000 fffff801`e23d3000   CompositeBus CompositeBus.sys Thu Aug 22 07:38:48 2013 (5215F848)
fffff801`e23d3000 fffff801`e23de000   kdnic    kdnic.sys    Thu Aug 22 07:38:26 2013 (5215F832)
fffff801`e23de000 fffff801`e23ef000   umbus    umbus.sys    Thu Aug 22 07:38:59 2013 (5215F853)
fffff801`e2400000 fffff801`e246a000   usbhub   usbhub.sys   Thu Jul 24 07:45:29 2014 (53D0F1D9)
fffff801`e246b000 fffff801`e2881000   igdkmd64 igdkmd64.sys Mon Sep 09 13:27:52 2013 (522E0518)
fffff801`e2881000 fffff801`e289a000   HDAudBus HDAudBus.sys Thu Jul 24 07:45:39 2014 (53D0F1E3)
fffff801`e289a000 fffff801`e28ef000   USBXHCI  USBXHCI.SYS  Thu Apr 09 22:08:27 2015 (5527309B)
fffff801`e28ef000 fffff801`e2921000   ucx01000 ucx01000.sys Tue Oct 07 01:00:55 2014 (54337387)
fffff801`e2921000 fffff801`e293d000   TeeDriverx64 TeeDriverx64.sys Tue Jul 02 14:38:08 2013 (51D31E10)
fffff801`e293d000 fffff801`e29aa000   RtsPer   RtsPer.sys   Wed Aug 21 03:23:24 2013 (52146AEC)
fffff801`e29aa000 fffff801`e29e7000   WUDFRd   WUDFRd.sys   Tue Oct 28 22:46:13 2014 (545054F5)
fffff801`e2a00000 fffff801`e2a18000   rspndr   rspndr.sys   Thu Aug 22 07:36:34 2013 (5215F7C2)
fffff801`e2a22000 fffff801`e2da5000   NETwbw02 NETwbw02.sys Mon Mar 23 04:53:41 2015 (550FD495)
fffff801`e2da5000 fffff801`e2dde000   fastfat  fastfat.SYS  Thu Aug 22 07:40:18 2013 (5215F8A2)
fffff801`e2dde000 fffff801`e2deb000   vwifibus vwifibus.sys Thu Aug 22 07:39:00 2013 (5215F854)
fffff801`e2e00000 fffff801`e2e47000   portcls  portcls.sys  Tue Oct 28 22:46:35 2014 (5450550B)
fffff801`e2e47000 fffff801`e2e5b000   lltdio   lltdio.sys   Thu Aug 22 07:36:18 2013 (5215F7B2)
fffff801`e2e5d000 fffff801`e2f29000   Rt630x64 Rt630x64.sys Fri Jul 26 03:01:35 2013 (51F21ECF)
fffff801`e2f29000 fffff801`e2f41000   usbehci  usbehci.sys  Sat May 31 02:29:54 2014 (538976E2)
fffff801`e2f41000 fffff801`e2fb0000   USBPORT  USBPORT.SYS  Sat May 31 02:30:25 2014 (53897701)
fffff801`e2fb0000 fffff801`e2fcf000   i8042prt i8042prt.sys Tue Nov 04 01:54:54 2014 (5458783E)
fffff801`e2fcf000 fffff801`e2fd9000   ikbevent ikbevent.sys Tue Aug 06 19:41:35 2013 (520189AF)
fffff801`e2fd9000 fffff801`e2fed000   ndisuio  ndisuio.sys  Thu Aug 22 07:37:34 2013 (5215F7FE)
fffff801`e3000000 fffff801`e300c000   iwdbus   iwdbus.sys   Wed Jul 24 21:06:12 2013 (51F07A04)
fffff801`e300c000 fffff801`e3017000   rdpbus   rdpbus.sys   Thu Aug 22 07:38:52 2013 (5215F84C)
fffff801`e3017000 fffff801`e3033000   drmk     drmk.sys     Tue Oct 28 22:47:38 2014 (5450554A)
fffff801`e3033000 fffff801`e3038300   ksthunk  ksthunk.sys  Thu Aug 22 07:39:31 2013 (5215F873)
fffff801`e304b000 fffff801`e30d1000   SynTP    SynTP.sys    Thu Aug 01 20:51:42 2013 (51FB029E)
fffff801`e30d1000 fffff801`e30dd000   USBD     USBD.SYS     Sat May 31 02:31:17 2014 (53897735)
fffff801`e30dd000 fffff801`e30ef000   kbdclass kbdclass.sys Tue Nov 04 01:54:54 2014 (5458783E)
fffff801`e30ef000 fffff801`e30fa000   imsevent imsevent.sys Tue Aug 06 19:45:57 2013 (52018AB5)
fffff801`e30fa000 fffff801`e310a000   mouclass mouclass.sys Tue Nov 04 01:54:47 2014 (54587837)
fffff801`e310a000 fffff801`e3117000   Smb_driver_Intel Smb_driver_Intel.sys Thu Aug 01 20:54:20 2013 (51FB033C)
fffff801`e3117000 fffff801`e3125000   Accelerometer Accelerometer.sys Tue Feb 26 15:08:10 2013 (512D162A)
fffff801`e3125000 fffff801`e312b380   CmBatt   CmBatt.sys   Thu Aug 22 07:39:43 2013 (5215F87F)
fffff801`e312c000 fffff801`e3138000   BATTC    BATTC.SYS    Thu Aug 22 07:40:04 2013 (5215F894)
fffff801`e3138000 fffff801`e3142000   WirelessButtonDriver64 WirelessButtonDriver64.sys Wed Aug 29 23:11:29 2012 (503ED9E1)
fffff801`e3142000 fffff801`e3161000   HIDCLASS HIDCLASS.SYS Thu Mar 06 04:24:40 2014 (53183ED8)
fffff801`e3161000 fffff801`e3168f00   HIDPARSE HIDPARSE.SYS Thu Aug 22 07:40:26 2013 (5215F8AA)
fffff801`e3169000 fffff801`e3173000   wmiacpi  wmiacpi.sys  Thu Aug 22 07:40:04 2013 (5215F894)
fffff801`e3173000 fffff801`e3191000   intelppm intelppm.sys Thu Aug 22 04:46:35 2013 (5215CFEB)
fffff801`e3191000 fffff801`e31a2000   ISCTD64  ISCTD64.sys  Tue Nov 27 14:52:34 2012 (50B51A02)
fffff801`e31a2000 fffff801`e31ad000   NdisVirtualBus NdisVirtualBus.sys Thu Aug 22 07:36:25 2013 (5215F7B9)
fffff801`e31ad000 fffff801`e31ae600   swenum   swenum.sys   Tue Oct 28 22:47:41 2014 (5450554D)
fffff801`e31af000 fffff801`e31fd000   ks       ks.sys       Fri Jul 04 08:58:59 2014 (53B6A513)
fffff801`e320e000 fffff801`e3227000   WinUsb   WinUsb.sys   Thu Aug 22 07:37:55 2013 (5215F813)
fffff801`e3229000 fffff801`e32a1000   UsbHub3  UsbHub3.sys  Mon Mar 16 23:34:24 2015 (5507A0C0)
fffff801`e32a1000 fffff801`e332d000   stwrt64  stwrt64.sys  Fri Aug 16 06:26:26 2013 (520DFE52)
fffff801`e332d000 fffff801`e3339000   dump_diskdump dump_diskdump.sys Thu Aug 22 07:40:18 2013 (5215F8A2)
fffff801`e3339000 fffff801`e334f000   dump_dumpfve dump_dumpfve.sys Sat Feb 22 07:14:48 2014 (530894B8)
fffff801`e334f000 fffff801`e3373000   luafv    luafv.sys    Sat Feb 22 07:14:25 2014 (530894A1)
fffff801`e3373000 fffff801`e3394000   WudfPf   WudfPf.sys   Tue Oct 28 22:46:27 2014 (54505503)
fffff801`e33a5000 fffff801`e33cc000   usbccgp  usbccgp.sys  Thu Jul 24 07:44:51 2014 (53D0F1B3)
fffff801`e33cc000 fffff801`e33da000   hidusb   hidusb.sys   Thu Mar 06 04:24:14 2014 (53183EBE)
fffff801`e33da000 fffff801`e33e8000   kbdhid   kbdhid.sys   Tue Nov 04 01:54:47 2014 (54587837)
fffff801`e33e8000 fffff801`e33f5000   mouhid   mouhid.sys   Tue Nov 04 01:54:47 2014 (54587837)
fffff801`e341c000 fffff801`e34c5000   peauth   peauth.sys   Sat Feb 22 07:09:37 2014 (53089381)
fffff801`e34c5000 fffff801`e34d0000   secdrv   secdrv.SYS   Wed Sep 13 09:18:38 2006 (4508052E)
fffff801`e34d0000 fffff801`e3513000   srvnet   srvnet.sys   Fri Jun 27 02:22:21 2014 (53AD0D9D)
fffff801`e3513000 fffff801`e3525000   tcpipreg tcpipreg.sys Thu Mar 06 04:19:59 2014 (53183DBF)
fffff801`e3525000 fffff801`e35d2000   srv2     srv2.sys     Wed Oct 08 03:33:30 2014 (5434E8CA)
fffff801`e3637000 fffff801`e36c5000   srv      srv.sys      Thu Jul 24 07:43:27 2014 (53D0F15F)
fffff801`e36c5000 fffff801`e36f2000   tunnel   tunnel.sys   Thu Aug 22 07:35:45 2013 (5215F791)
fffff801`e36f2000 fffff801`e36fe000   PROCEXP152 PROCEXP152.SYS Tue Jul 08 02:28:27 2014 (53BB8F8B)
fffff801`e371c000 fffff801`e3726000   cpuz138_x64 cpuz138_x64.sys Thu Oct 23 11:03:05 2014 (544918A9)
fffff801`e3800000 fffff801`e386d000   mrxsmb   mrxsmb.sys   Wed Oct 08 03:32:08 2014 (5434E878)
fffff801`e386d000 fffff801`e387c000   vwifimp  vwifimp.sys  Wed Apr 30 02:41:59 2014 (53609B37)
fffff801`e3893000 fffff801`e398d000   HTTP     HTTP.sys     Mon Feb 23 19:40:28 2015 (54EBC87C)
fffff801`e398d000 fffff801`e399d000   condrv   condrv.sys   Thu Aug 22 07:40:17 2013 (5215F8A1)
fffff801`e399d000 fffff801`e39bd000   bowser   bowser.sys   Thu Aug 22 07:38:38 2013 (5215F83E)
fffff801`e39bd000 fffff801`e39e7000   epfwwfpr epfwwfpr.sys Wed Jan 28 08:02:44 2015 (54C8DDF4)
fffff801`e39e7000 fffff801`e39fe000   mpsdrv   mpsdrv.sys   Tue Oct 28 22:45:31 2014 (545054CB)
fffff801`e3d14000 fffff801`e3d22000   monitor  monitor.sys  Thu Aug 22 07:36:37 2013 (5215F7C5)
fffff801`e3d22000 fffff801`e3d2c000   MTConfig MTConfig.sys Thu Aug 22 07:37:36 2013 (5215F800)
fffff803`90504000 fffff803`9050d000   kd       kd.dll       Thu Aug 22 07:40:43 2013 (5215F8BB)
fffff803`9340a000 fffff803`93b9e000   nt       ntkrnlmp.exe Sun Mar 22 18:26:46 2015 (550F41A6)
fffff803`93b9e000 fffff803`93c0e000   hal      hal.dll      Sun Jun 01 18:49:12 2014 (538BADE8)
fffff960`00058000 fffff960`0046e000   win32k   win32k.sys   Thu May 21 12:46:18 2015 (555E0BDA)
fffff960`006ea000 fffff960`006f3000   TSDDD    TSDDD.dll    Thu Aug 22 07:40:32 2013 (5215F8B0)
fffff960`0082b000 fffff960`00865000   cdd      cdd.dll      Tue Oct 28 23:51:32 2014 (54506444)
fffff960`00ac9000 fffff960`00b28000   ATMFD    ATMFD.DLL    Thu Feb 19 22:03:49 2015 (54E6A415)
Unloaded modules:
fffff801`e3cd0000 fffff801`e3cdc000   hiber_storport.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  0000C000
fffff801`e3a00000 fffff801`e3cba000   hiber_iaStorA.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  002BA000
fffff801`e3cba000 fffff801`e3cd0000   hiber_dumpfve.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00016000
fffff801`e3d2c000 fffff801`e3d38000   hiber_storport.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  0000C000
fffff801`e3a00000 fffff801`e3cba000   hiber_iaStorA.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  002BA000
fffff801`e3cba000 fffff801`e3cd0000   hiber_dumpfve.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00016000
fffff801`e372e000 fffff801`e373a000   hiber_storport.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  0000C000
fffff801`e3a44000 fffff801`e3cfe000   hiber_iaStorA.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  002BA000
fffff801`e3cfe000 fffff801`e3d14000   hiber_dumpfve.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00016000
fffff801`e33f5000 fffff801`e33ff000   MTConfig.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  0000A000
fffff801`e3200000 fffff801`e320e000   monitor.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  0000E000
fffff801`e3726000 fffff801`e372e000   3794ff34-93e4-4eea-8d7a-6e2a65946d3e
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00008000
fffff801`e3710000 fffff801`e371c000   hiber_storport.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  0000C000
fffff801`e3a51000 fffff801`e3d0b000   hiber_iaStorA.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  002BA000
fffff801`e3d0b000 fffff801`e3d21000   hiber_dumpfve.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00016000
fffff801`e36fe000 fffff801`e3708000   cpuz138_x64.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  0000A000
fffff801`e3708000 fffff801`e3710000   0b6b62db-9bb3-4d3c-964f-5ccb6b2d7afe
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00008000
fffff801`e1785000 fffff801`e17f8000   IntcDAud.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00073000
fffff801`e334f000 fffff801`e3368000   WinUsb.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00019000
fffff801`e3368000 fffff801`e33a5000   WUDFRd.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  0003D000
fffff801`e16aa000 fffff801`e16b6000   dump_storport.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  0000C000
fffff801`e1a88000 fffff801`e1d42000   dump_iaStorA.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  002BA000
fffff801`e1d42000 fffff801`e1d58000   dump_dumpfve.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00016000
fffff801`e2358000 fffff801`e2369000   dam.sys 
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00011000
fffff801`e0728000 fffff801`e0736000   WdBoot.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  0000E000
fffff801`e12a0000 fffff801`e12ac000   hwpolicy.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  0000C000
6: kd> lmntsm
start             end                 module name
fffff801`e3117000 fffff801`e3125000   Accelerometer Accelerometer.sys Tue Feb 26 15:08:10 2013 (512D162A)
fffff801`e0423000 fffff801`e04ab000   ACPI     ACPI.sys     Mon Oct 06 23:29:50 2014 (54335E2E)
fffff801`e0400000 fffff801`e0418000   acpiex   acpiex.sys   Thu Aug 22 07:37:47 2013 (5215F80B)
fffff801`e1e00000 fffff801`e1e92000   afd      afd.sys      Thu May 29 23:03:01 2014 (5387F4E5)
fffff801`e2383000 fffff801`e239c000   ahcache  ahcache.sys  Thu Mar 19 21:56:10 2015 (550B7E3A)
00007ffd`aeec0000 00007ffd`aef4e000   apphelp  apphelp.dll  Tue Oct 28 22:44:53 2014 (545054A5)
fffff960`00ac9000 fffff960`00b28000   ATMFD    ATMFD.DLL    Thu Feb 19 22:03:49 2015 (54E6A415)
00007ffd`af560000 00007ffd`af5a8000   AUTHZ    AUTHZ.dll    Mon Apr 13 18:37:35 2015 (552C452F)
fffff801`e20dc000 fffff801`e20ee000   BasicDisplay BasicDisplay.sys Thu Aug 22 07:39:31 2013 (5215F873)
fffff801`e1dc4000 fffff801`e1dd2000   BasicRender BasicRender.sys Sat Feb 22 07:14:02 2014 (5308948A)
fffff801`e312c000 fffff801`e3138000   BATTC    BATTC.SYS    Thu Aug 22 07:40:04 2013 (5215F894)
00007ffd`b0180000 00007ffd`b01e3000   bcryptPrimitives bcryptPrimitives.dll Tue Oct 28 21:28:57 2014 (545042D9)
fffff801`e1d8f000 fffff801`e1d97000   Beep     Beep.SYS     Thu Aug 22 07:40:24 2013 (5215F8A8)
fffff801`e03bd000 fffff801`e03c7000   BOOTVID  BOOTVID.dll  Thu Aug 22 07:40:26 2013 (5215F8AA)
fffff801`e399d000 fffff801`e39bd000   bowser   bowser.sys   Thu Aug 22 07:38:38 2013 (5215F83E)
fffff960`0082b000 fffff960`00865000   cdd      cdd.dll      Tue Oct 28 23:51:32 2014 (54506444)
fffff801`e1d58000 fffff801`e1d86000   cdrom    cdrom.sys    Thu Aug 22 04:46:35 2013 (5215CFEB)
00007ffd`b0510000 00007ffd`b055f000   cfgmgr32 cfgmgr32.dll Tue Oct 28 21:29:09 2014 (545042E5)
fffff801`e0200000 fffff801`e0288000   CI       CI.dll       Fri Dec 05 22:23:28 2014 (548276B0)
fffff801`e163f000 fffff801`e1695000   CLASSPNP CLASSPNP.SYS Wed Oct 08 01:22:07 2014 (5434C9FF)
fffff801`e0324000 fffff801`e0386000   CLFS     CLFS.SYS     Tue Mar 03 19:51:05 2015 (54F656F9)
fffff801`e2369000 fffff801`e2383000   CLVirtualDrive CLVirtualDrive.sys Mon Dec 26 08:26:47 2011 (4EF87617)
fffff801`e3125000 fffff801`e312b380   CmBatt   CmBatt.sys   Thu Aug 22 07:39:43 2013 (5215F87F)
fffff801`e069d000 fffff801`e0728000   cng      cng.sys      Sun Mar 29 18:22:05 2015 (55187B0D)
fffff801`e23c4000 fffff801`e23d3000   CompositeBus CompositeBus.sys Thu Aug 22 07:38:48 2013 (5215F848)
fffff801`e398d000 fffff801`e399d000   condrv   condrv.sys   Thu Aug 22 07:40:17 2013 (5215F8A1)
fffff801`e371c000 fffff801`e3726000   cpuz138_x64 cpuz138_x64.sys Thu Oct 23 11:03:05 2014 (544918A9)
fffff801`e1695000 fffff801`e16aa000   crashdmp crashdmp.sys Thu Aug 22 07:40:03 2013 (5215F893)
00007ffd`b01f0000 00007ffd`b01fb000   CRYPTBASE CRYPTBASE.dll Tue Oct 28 22:46:18 2014 (545054FA)
00007ffd`afc20000 00007ffd`afc3a000   cryptdll cryptdll.dll Tue Oct 28 21:28:16 2014 (545042B0)
00007ffd`affa0000 00007ffd`affa8000   DABAPI   DABAPI.dll   Tue Oct 28 21:29:32 2014 (545042FC)
fffff801`e2332000 fffff801`e2358000   dfsc     dfsc.sys     Thu Mar 06 04:22:50 2014 (53183E6A)
fffff801`e09a0000 fffff801`e09bc000   disk     disk.sys     Thu Aug 22 07:39:47 2013 (5215F883)
fffff801`e3017000 fffff801`e3033000   drmk     drmk.sys     Tue Oct 28 22:47:38 2014 (5450554A)
fffff801`e332d000 fffff801`e3339000   dump_diskdump dump_diskdump.sys Thu Aug 22 07:40:18 2013 (5215F8A2)
fffff801`e3339000 fffff801`e334f000   dump_dumpfve dump_dumpfve.sys Sat Feb 22 07:14:48 2014 (530894B8)
fffff801`e1a51000 fffff801`e1d0b000   dump_iaStorA dump_iaStorA.sys Fri Aug 16 13:22:01 2013 (520E5FB9)
fffff801`e1ee7000 fffff801`e2067000   dxgkrnl  dxgkrnl.sys  Tue Oct 28 22:46:45 2014 (54505515)
fffff801`e2079000 fffff801`e20dc000   dxgmms1  dxgmms1.sys  Tue Oct 28 22:46:30 2014 (54505506)
fffff801`e16b6000 fffff801`e1785000   eamonm   eamonm.sys   Tue Jan 20 05:39:35 2015 (54BE3067)
fffff801`e15af000 fffff801`e15ee000   edevmon  edevmon.sys  Tue Jan 20 05:39:37 2015 (54BE3069)
fffff801`e1d97000 fffff801`e1dc4000   ehdrv    ehdrv.sys    Tue Jan 20 05:39:52 2015 (54BE3078)
fffff801`e0d3b000 fffff801`e0d55000   EhStorClass EhStorClass.sys Thu Aug 22 07:38:15 2013 (5215F827)
ffffe001`497cc000 ffffe001`49800000   em006_64 em006_64.dat Wed Jun 03 03:58:23 2015 (556EB39F)
ffffe001`37039000 ffffe001`37040000   em015_64 em015_64.dat Fri Mar 01 08:27:56 2013 (5130ACDC)
ffffe001`42e47000 ffffe001`42ea9000   em018_64 em018_64.dat Mon Jun 08 03:42:26 2015 (55754762)
fffff801`e39bd000 fffff801`e39e7000   epfwwfpr epfwwfpr.sys Wed Jan 28 08:02:44 2015 (54C8DDF4)
00007ffd`aff90000 00007ffd`aff9b000   EventAggregation EventAggregation.dll Tue Oct 28 21:27:19 2014 (54504277)
fffff801`e2da5000 fffff801`e2dde000   fastfat  fastfat.SYS  Thu Aug 22 07:40:18 2013 (5215F8A2)
fffff801`e0db1000 fffff801`e0dc7000   fileinfo fileinfo.sys Sat Feb 22 07:13:10 2014 (53089456)
fffff801`e0d55000 fffff801`e0db1000   fltmgr   fltmgr.sys   Mon Aug 25 22:25:16 2014 (53FBF00C)
fffff801`e1030000 fffff801`e103b000   Fs_Rec   Fs_Rec.sys   Thu Aug 22 04:46:33 2013 (5215CFE9)
fffff801`e1200000 fffff801`e1295000   fvevol   fvevol.sys   Mon Apr 07 18:25:31 2014 (534325DB)
fffff801`e151e000 fffff801`e158a000   fwpkclnt fwpkclnt.sys Sun Nov 09 21:57:40 2014 (546029A4)
fffff803`93b9e000 fffff803`93c0e000   hal      hal.dll      Sun Jun 01 18:49:12 2014 (538BADE8)
fffff801`e2881000 fffff801`e289a000   HDAudBus HDAudBus.sys Thu Jul 24 07:45:39 2014 (53D0F1E3)
fffff801`e3142000 fffff801`e3161000   HIDCLASS HIDCLASS.SYS Thu Mar 06 04:24:40 2014 (53183ED8)
fffff801`e3161000 fffff801`e3168f00   HIDPARSE HIDPARSE.SYS Thu Aug 22 07:40:26 2013 (5215F8AA)
fffff801`e33cc000 fffff801`e33da000   hidusb   hidusb.sys   Thu Mar 06 04:24:14 2014 (53183EBE)
fffff801`e1295000 fffff801`e12a0000   hpdskflt hpdskflt.sys Tue Feb 26 15:08:12 2013 (512D162C)
fffff801`e3893000 fffff801`e398d000   HTTP     HTTP.sys     Mon Feb 23 19:40:28 2015 (54EBC87C)
fffff801`e2fb0000 fffff801`e2fcf000   i8042prt i8042prt.sys Tue Nov 04 01:54:54 2014 (5458783E)
fffff801`e0a23000 fffff801`e0cdd000   iaStorA  iaStorA.sys  Fri Aug 16 13:22:01 2013 (520E5FB9)
fffff801`e246b000 fffff801`e2881000   igdkmd64 igdkmd64.sys Mon Sep 09 13:27:52 2013 (522E0518)
fffff801`e2fcf000 fffff801`e2fd9000   ikbevent ikbevent.sys Tue Aug 06 19:41:35 2013 (520189AF)
fffff801`e30ef000 fffff801`e30fa000   imsevent imsevent.sys Tue Aug 06 19:45:57 2013 (52018AB5)
fffff801`e15ee000 fffff801`e15fd000   intelpep intelpep.sys Wed Oct 15 02:29:44 2014 (543E1458)
fffff801`e3173000 fffff801`e3191000   intelppm intelppm.sys Thu Aug 22 04:46:35 2013 (5215CFEB)
fffff801`e3191000 fffff801`e31a2000   ISCTD64  ISCTD64.sys  Tue Nov 27 14:52:34 2012 (50B51A02)
fffff801`e3000000 fffff801`e300c000   iwdbus   iwdbus.sys   Wed Jul 24 21:06:12 2013 (51F07A04)
fffff801`e30dd000 fffff801`e30ef000   kbdclass kbdclass.sys Tue Nov 04 01:54:54 2014 (5458783E)
fffff801`e33da000 fffff801`e33e8000   kbdhid   kbdhid.sys   Tue Nov 04 01:54:47 2014 (54587837)
fffff803`90504000 fffff803`9050d000   kd       kd.dll       Thu Aug 22 07:40:43 2013 (5215F8BB)
fffff801`e23d3000 fffff801`e23de000   kdnic    kdnic.sys    Thu Aug 22 07:38:26 2013 (5215F832)
00007ffd`b2d40000 00007ffd`b2e7e000   KERNEL32 KERNEL32.DLL Tue Oct 28 22:45:30 2014 (545054CA)
00007ffd`b03f0000 00007ffd`b0505000   KERNELBASE KERNELBASE.dll Tue Oct 28 22:55:51 2014 (54505737)
fffff801`e31af000 fffff801`e31fd000   ks       ks.sys       Fri Jul 04 08:58:59 2014 (53B6A513)
fffff801`e1004000 fffff801`e1020000   ksecdd   ksecdd.sys   Tue Oct 28 22:47:36 2014 (54505548)
fffff801`e11ca000 fffff801`e11fb000   ksecpkg  ksecpkg.sys  Sun Jan 11 22:01:17 2015 (54B338FD)
fffff801`e3033000 fffff801`e3038300   ksthunk  ksthunk.sys  Thu Aug 22 07:39:31 2013 (5215F873)
fffff801`e2e47000 fffff801`e2e5b000   lltdio   lltdio.sys   Thu Aug 22 07:36:18 2013 (5215F7B2)
00007ffd`af870000 00007ffd`af8af000   logoncli logoncli.dll Tue Oct 28 21:27:50 2014 (54504296)
fffff801`e334f000 fffff801`e3373000   luafv    luafv.sys    Sat Feb 22 07:14:25 2014 (530894A1)
fffff801`e0299000 fffff801`e0316000   mcupdate_GenuineIntel mcupdate_GenuineIntel.dll Fri Jul 04 08:59:36 2014 (53B6A538)
fffff801`e3d14000 fffff801`e3d22000   monitor  monitor.sys  Thu Aug 22 07:36:37 2013 (5215F7C5)
fffff801`e30fa000 fffff801`e310a000   mouclass mouclass.sys Tue Nov 04 01:54:47 2014 (54587837)
fffff801`e33e8000 fffff801`e33f5000   mouhid   mouhid.sys   Tue Nov 04 01:54:47 2014 (54587837)
fffff801`e08ad000 fffff801`e08c8000   mountmgr mountmgr.sys Mon Oct 06 21:18:16 2014 (54333F58)
fffff801`e39e7000 fffff801`e39fe000   mpsdrv   mpsdrv.sys   Tue Oct 28 22:45:31 2014 (545054CB)
fffff801`e3800000 fffff801`e386d000   mrxsmb   mrxsmb.sys   Wed Oct 08 03:32:08 2014 (5434E878)
fffff801`e0800000 fffff801`e084b000   mrxsmb10 mrxsmb10.sys Thu Mar 06 04:19:36 2014 (53183DA8)
fffff801`e1d0b000 fffff801`e1d43000   mrxsmb20 mrxsmb20.sys Sat Sep 27 00:59:28 2014 (54264430)
fffff801`e2102000 fffff801`e210e000   Msfs     Msfs.SYS     Thu Aug 22 07:40:24 2013 (5215F8A8)
fffff801`e0736000 fffff801`e0740000   msisadrv msisadrv.sys Thu Aug 22 07:39:03 2013 (5215F857)
fffff801`e04b2000 fffff801`e050f000   msrpc    msrpc.sys    Thu Aug 22 07:39:22 2013 (5215F86A)
fffff801`e2326000 fffff801`e2332000   mssmbios mssmbios.sys Thu Aug 22 07:39:41 2013 (5215F87D)
00007ffd`afc40000 00007ffd`afcac000   msv1_0   msv1_0.DLL   Tue Oct 28 21:26:08 2014 (54504230)
00007ffd`b3040000 00007ffd`b30ea000   msvcrt   msvcrt.dll   Tue Oct 28 22:50:38 2014 (545055FE)
00007ffd`afcd0000 00007ffd`afd29000   mswsock  mswsock.dll  Tue Oct 28 21:29:41 2014 (54504305)
fffff801`e3d22000 fffff801`e3d2c000   MTConfig MTConfig.sys Thu Aug 22 07:37:36 2013 (5215F800)
fffff801`e0a00000 fffff801`e0a17000   mup      mup.sys      Thu Aug 22 07:40:28 2013 (5215F8AC)
fffff801`e103b000 fffff801`e1152000   ndis     ndis.sys     Mon Feb 02 19:03:15 2015 (54D01043)
fffff801`e2fd9000 fffff801`e2fed000   ndisuio  ndisuio.sys  Thu Aug 22 07:37:34 2013 (5215F7FE)
fffff801`e31a2000 fffff801`e31ad000   NdisVirtualBus NdisVirtualBus.sys Thu Aug 22 07:36:25 2013 (5215F7B9)
fffff801`e2200000 fffff801`e221d000   Ndu      Ndu.sys      Tue Oct 28 22:45:16 2014 (545054BC)
fffff801`e1ed4000 fffff801`e1ee5000   netbios  netbios.sys  Tue Oct 28 22:47:23 2014 (5450553B)
fffff801`e213c000 fffff801`e2188000   netbt    netbt.sys    Thu Aug 22 07:37:01 2013 (5215F7DD)
fffff801`e1152000 fffff801`e11ca000   NETIO    NETIO.SYS    Sun Nov 09 21:58:13 2014 (546029C5)
fffff801`e2a22000 fffff801`e2da5000   NETwbw02 NETwbw02.sys Mon Mar 23 04:53:41 2015 (550FD495)
fffff801`e20ee000 fffff801`e2102000   Npfs     Npfs.SYS     Thu Aug 22 07:40:25 2013 (5215F8A9)
fffff801`e231a000 fffff801`e2326000   npsvctrig npsvctrig.sys Thu Aug 22 07:38:22 2013 (5215F82E)
00007ffd`b31c0000 00007ffd`b31c9000   NSI      NSI.dll      Tue Oct 28 22:48:43 2014 (5450558B)
fffff801`e230c000 fffff801`e231a000   nsiproxy nsiproxy.sys Tue Oct 28 22:46:03 2014 (545054EB)
fffff803`9340a000 fffff803`93b9e000   nt       ntkrnlmp.exe Sun Mar 22 18:26:46 2015 (550F41A6)
00007ffd`b31d0000 00007ffd`b337c000   ntdll    ntdll.dll    Sun Mar 22 18:33:26 2015 (550F4336)
fffff801`e0e0a000 fffff801`e1004000   Ntfs     Ntfs.sys     Fri Oct 10 20:35:55 2014 (54387B6B)
fffff801`e1d86000 fffff801`e1d8f000   Null     Null.SYS     Thu Aug 22 07:40:24 2013 (5215F8A8)
fffff801`e1785000 fffff801`e17f9000   nwifi    nwifi.sys    Tue Oct 28 22:45:41 2014 (545054D5)
fffff801`e1e92000 fffff801`e1ebc000   pacer    pacer.sys    Tue Oct 28 22:45:30 2014 (545054CA)
fffff801`e07b1000 fffff801`e07c9000   partmgr  partmgr.sys  Wed Oct 08 03:34:42 2014 (5434E912)
fffff801`e0740000 fffff801`e0788000   pci      pci.sys      Thu Jul 24 07:45:24 2014 (53D0F1D4)
fffff801`e1020000 fffff801`e1030000   pcw      pcw.sys      Thu Aug 22 04:46:34 2013 (5215CFEA)
fffff801`e0795000 fffff801`e07b1000   pdc      pdc.sys      Wed Oct 15 00:34:24 2014 (543DF950)
fffff801`e341c000 fffff801`e34c5000   peauth   peauth.sys   Sat Feb 22 07:09:37 2014 (53089381)
fffff801`e2e00000 fffff801`e2e47000   portcls  portcls.sys  Tue Oct 28 22:46:35 2014 (5450550B)
fffff801`e36f2000 fffff801`e36fe000   PROCEXP152 PROCEXP152.SYS Tue Jul 08 02:28:27 2014 (53BB8F8B)
00007ffd`b0320000 00007ffd`b0335000   profapi  profapi.dll  Tue Oct 28 21:29:41 2014 (54504305)
fffff801`e03a8000 fffff801`e03bd000   PSHED    PSHED.dll    Sat Sep 14 09:57:19 2013 (52346B3F)
fffff801`e2188000 fffff801`e21f8000   rdbss    rdbss.sys    Tue Dec 17 02:21:22 2013 (52AFFB72)
fffff801`e300c000 fffff801`e3017000   rdpbus   rdpbus.sys   Thu Aug 22 07:38:52 2013 (5215F84C)
fffff801`e095a000 fffff801`e09a0000   rdyboost rdyboost.sys Sat Feb 22 07:13:40 2014 (53089474)
00007ffd`b2880000 00007ffd`b29c1000   RPCRT4   RPCRT4.dll   Tue Oct 28 21:40:56 2014 (545045A8)
fffff801`e2a00000 fffff801`e2a18000   rspndr   rspndr.sys   Thu Aug 22 07:36:34 2013 (5215F7C2)
fffff801`e2e5d000 fffff801`e2f29000   Rt630x64 Rt630x64.sys Fri Jul 26 03:01:35 2013 (51F21ECF)
fffff801`e293d000 fffff801`e29aa000   RtsPer   RtsPer.sys   Wed Aug 21 03:23:24 2013 (52146AEC)
00007ffd`aacf0000 00007ffd`aad0f000   SAMLIB   SAMLIB.dll   Tue Oct 28 21:28:26 2014 (545042BA)
00007ffd`af5b0000 00007ffd`af639000   scesrv   scesrv.dll   Mon Dec 08 20:56:35 2014 (548656D3)
00007ffd`b0120000 00007ffd`b0131000   scext    scext.dll    Tue Oct 28 21:28:44 2014 (545042CC)
fffff801`e34c5000 fffff801`e34d0000   secdrv   secdrv.SYS   Wed Sep 13 09:18:38 2006 (4508052E)
00007ffd`b25c0000 00007ffd`b2619000   sechost  sechost.dll  Fri Mar 20 00:08:34 2015 (550B9D42)
00007ff6`828c0000 00007ff6`82926000   services services.exe Wed Apr 08 00:32:12 2015 (5524AF4C)
fffff801`e310a000 fffff801`e3117000   Smb_driver_Intel Smb_driver_Intel.sys Thu Aug 01 20:54:20 2013 (51FB033C)
fffff801`e0600000 fffff801`e0669000   spaceport spaceport.sys Tue Oct 28 22:47:03 2014 (54505527)
00007ffd`aff40000 00007ffd`aff5e000   spinf    spinf.dll    Tue Oct 28 22:44:58 2014 (545054AA)
fffff801`e3637000 fffff801`e36c5000   srv      srv.sys      Thu Jul 24 07:43:27 2014 (53D0F15F)
fffff801`e3525000 fffff801`e35d2000   srv2     srv2.sys     Wed Oct 08 03:33:30 2014 (5434E8CA)
00007ffd`aff60000 00007ffd`aff86000   srvcli   srvcli.dll   Tue Oct 28 21:27:34 2014 (54504286)
fffff801`e34d0000 fffff801`e3513000   srvnet   srvnet.sys   Fri Jun 27 02:22:21 2014 (53AD0D9D)
00007ffd`b0150000 00007ffd`b017e000   SspiCli  SspiCli.dll  Tue Oct 28 21:29:54 2014 (54504312)
fffff801`e0cdd000 fffff801`e0d3b000   storport storport.sys Wed Sep 24 22:47:07 2014 (5423822B)
fffff801`e32a1000 fffff801`e332d000   stwrt64  stwrt64.sys  Fri Aug 16 06:26:26 2013 (520DFE52)
fffff801`e31ad000 fffff801`e31ae600   swenum   swenum.sys   Tue Oct 28 22:47:41 2014 (5450554D)
fffff801`e304b000 fffff801`e30d1000   SynTP    SynTP.sys    Thu Aug 01 20:51:42 2013 (51FB029E)
fffff801`e12b2000 fffff801`e151e000   tcpip    tcpip.sys    Sun Nov 09 21:59:03 2014 (546029F7)
fffff801`e3513000 fffff801`e3525000   tcpipreg tcpipreg.sys Thu Mar 06 04:19:59 2014 (53183DBF)
fffff801`e212e000 fffff801`e213c000   TDI      TDI.SYS      Thu Aug 22 07:39:01 2013 (5215F855)
fffff801`e210e000 fffff801`e212e000   tdx      tdx.sys      Thu Aug 22 07:36:34 2013 (5215F7C2)
fffff801`e2921000 fffff801`e293d000   TeeDriverx64 TeeDriverx64.sys Tue Jul 02 14:38:08 2013 (51D31E10)
fffff801`e0386000 fffff801`e03a8000   tm       tm.sys       Thu Aug 22 07:39:33 2013 (5215F875)
fffff960`006ea000 fffff960`006f3000   TSDDD    TSDDD.dll    Thu Aug 22 07:40:32 2013 (5215F8B0)
fffff801`e36c5000 fffff801`e36f2000   tunnel   tunnel.sys   Thu Aug 22 07:35:45 2013 (5215F791)
fffff801`e28ef000 fffff801`e2921000   ucx01000 ucx01000.sys Tue Oct 07 01:00:55 2014 (54337387)
fffff801`e23de000 fffff801`e23ef000   umbus    umbus.sys    Thu Aug 22 07:38:59 2013 (5215F853)
fffff801`e33a5000 fffff801`e33cc000   usbccgp  usbccgp.sys  Thu Jul 24 07:44:51 2014 (53D0F1B3)
fffff801`e30d1000 fffff801`e30dd000   USBD     USBD.SYS     Sat May 31 02:31:17 2014 (53897735)
fffff801`e2f29000 fffff801`e2f41000   usbehci  usbehci.sys  Sat May 31 02:29:54 2014 (538976E2)
fffff801`e2400000 fffff801`e246a000   usbhub   usbhub.sys   Thu Jul 24 07:45:29 2014 (53D0F1D9)
fffff801`e3229000 fffff801`e32a1000   UsbHub3  UsbHub3.sys  Mon Mar 16 23:34:24 2015 (5507A0C0)
fffff801`e2f41000 fffff801`e2fb0000   USBPORT  USBPORT.SYS  Sat May 31 02:30:25 2014 (53897701)
fffff801`e289a000 fffff801`e28ef000   USBXHCI  USBXHCI.SYS  Thu Apr 09 22:08:27 2015 (5527309B)
fffff801`e2229000 fffff801`e230c000   VBoxDrv  VBoxDrv.sys  Tue Sep 09 11:29:03 2014 (540F1CBF)
fffff801`e239c000 fffff801`e23c4000   VBoxNetAdp VBoxNetAdp.sys Tue Sep 09 11:26:34 2014 (540F1C2A)
fffff801`e1a26000 fffff801`e1a51000   VBoxNetFlt VBoxNetFlt.sys Tue Sep 09 11:26:34 2014 (540F1C2A)
fffff801`e1a00000 fffff801`e1a26000   VBoxUSBMon VBoxUSBMon.sys Tue Sep 09 11:26:34 2014 (540F1C2A)
fffff801`e0788000 fffff801`e0795000   vdrvroot vdrvroot.sys Thu Aug 22 07:38:49 2013 (5215F849)
fffff801`e0669000 fffff801`e067e000   volmgr   volmgr.sys   Thu Aug 22 07:39:53 2013 (5215F889)
fffff801`e084e000 fffff801`e08ad000   volmgrx  volmgrx.sys  Thu Aug 22 07:40:23 2013 (5215F8A7)
fffff801`e090b000 fffff801`e095a000   volsnap  volsnap.sys  Wed Jun 18 18:41:28 2014 (53A21598)
fffff801`e2dde000 fffff801`e2deb000   vwifibus vwifibus.sys Thu Aug 22 07:39:00 2013 (5215F854)
fffff801`e1ebc000 fffff801`e1ed4000   vwififlt vwififlt.sys Wed Apr 30 02:43:46 2014 (53609BA2)
fffff801`e386d000 fffff801`e387c000   vwifimp  vwifimp.sys  Wed Apr 30 02:41:59 2014 (53609B37)
fffff801`e1dd2000 fffff801`e1deb000   wanarp   wanarp.sys   Mon Jan 05 21:59:31 2015 (54AB4F93)
fffff801`e2067000 fffff801`e2079000   watchdog watchdog.sys Sat Feb 22 07:14:39 2014 (530894AF)
fffff801`e050f000 fffff801`e05de000   Wdf01000 Wdf01000.sys Thu Aug 22 07:38:56 2013 (5215F850)
fffff801`e08c8000 fffff801`e090b000   WdFilter WdFilter.sys Fri Jan 30 05:20:58 2015 (54CB5B0A)
fffff801`e05de000 fffff801`e05ef000   WDFLDR   WDFLDR.SYS   Thu Aug 22 07:39:03 2013 (5215F857)
fffff801`e0316000 fffff801`e0324000   werkernel werkernel.sys Thu Aug 22 07:40:24 2013 (5215F8A8)
fffff801`e158a000 fffff801`e15af000   wfplwfs  wfplwfs.sys  Sun Nov 09 21:57:28 2014 (54602998)
fffff960`00058000 fffff960`0046e000   win32k   win32k.sys   Thu May 21 12:46:18 2015 (555E0BDA)
fffff801`e320e000 fffff801`e3227000   WinUsb   WinUsb.sys   Thu Aug 22 07:37:55 2013 (5215F813)
fffff801`e3138000 fffff801`e3142000   WirelessButtonDriver64 WirelessButtonDriver64.sys Wed Aug 29 23:11:29 2012 (503ED9E1)
fffff801`e3169000 fffff801`e3173000   wmiacpi  wmiacpi.sys  Thu Aug 22 07:40:04 2013 (5215F894)
fffff801`e05ef000 fffff801`e05f9000   WMILIB   WMILIB.SYS   Thu Aug 22 07:40:23 2013 (5215F8A7)
fffff801`e0dc7000 fffff801`e0df2000   Wof      Wof.sys      Thu Mar 13 04:27:29 2014 (53216BF1)
fffff801`e0418000 fffff801`e0423000   WppRecorder WppRecorder.sys Thu Aug 22 07:39:40 2013 (5215F87C)
00007ffd`b3160000 00007ffd`b31ba000   WS2_32   WS2_32.dll   Tue Oct 28 21:29:24 2014 (545042F4)
fffff801`e3373000 fffff801`e3394000   WudfPf   WudfPf.sys   Tue Oct 28 22:46:27 2014 (54505503)
fffff801`e29aa000 fffff801`e29e7000   WUDFRd   WUDFRd.sys   Tue Oct 28 22:46:13 2014 (545054F5)
Unloaded modules:
fffff801`e3cd0000 fffff801`e3cdc000   hiber_storport.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  0000C000
fffff801`e3a00000 fffff801`e3cba000   hiber_iaStorA.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  002BA000
fffff801`e3cba000 fffff801`e3cd0000   hiber_dumpfve.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00016000
fffff801`e3d2c000 fffff801`e3d38000   hiber_storport.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  0000C000
fffff801`e3a00000 fffff801`e3cba000   hiber_iaStorA.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  002BA000
fffff801`e3cba000 fffff801`e3cd0000   hiber_dumpfve.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00016000
fffff801`e372e000 fffff801`e373a000   hiber_storport.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  0000C000
fffff801`e3a44000 fffff801`e3cfe000   hiber_iaStorA.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  002BA000
fffff801`e3cfe000 fffff801`e3d14000   hiber_dumpfve.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00016000
fffff801`e33f5000 fffff801`e33ff000   MTConfig.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  0000A000
fffff801`e3200000 fffff801`e320e000   monitor.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  0000E000
fffff801`e3726000 fffff801`e372e000   3794ff34-93e4-4eea-8d7a-6e2a65946d3e
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00008000
fffff801`e3710000 fffff801`e371c000   hiber_storport.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  0000C000
fffff801`e3a51000 fffff801`e3d0b000   hiber_iaStorA.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  002BA000
fffff801`e3d0b000 fffff801`e3d21000   hiber_dumpfve.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00016000
fffff801`e36fe000 fffff801`e3708000   cpuz138_x64.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  0000A000
fffff801`e3708000 fffff801`e3710000   0b6b62db-9bb3-4d3c-964f-5ccb6b2d7afe
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00008000
fffff801`e1785000 fffff801`e17f8000   IntcDAud.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00073000
fffff801`e334f000 fffff801`e3368000   WinUsb.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00019000
fffff801`e3368000 fffff801`e33a5000   WUDFRd.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  0003D000
fffff801`e16aa000 fffff801`e16b6000   dump_storport.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  0000C000
fffff801`e1a88000 fffff801`e1d42000   dump_iaStorA.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  002BA000
fffff801`e1d42000 fffff801`e1d58000   dump_dumpfve.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00016000
fffff801`e2358000 fffff801`e2369000   dam.sys 
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00011000
fffff801`e0728000 fffff801`e0736000   WdBoot.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  0000E000
fffff801`e12a0000 fffff801`e12ac000   hwpolicy.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  0000C000
6: kd> .bugcheck
Bugcheck code C000021A
Arguments ffffc000`905ed180 00000000`00000000 00000000`00000000 00000000`00000000

Jared · Jun 17, 2015

Isn't it funny how we analyse people's problems quite easily, yet when it's our own, we still turn for help.

Code:

//Thread that initiated the bugcheck

6: kd> !thread ffffe00140072040
THREAD ffffe00140072040  Cid 0004.3fe2c  Teb: 0000000000000000 Win32Thread: 0000000000000000 RUNNING on processor 6
Not impersonating
DeviceMap                 ffffc0007ee0c300
Owning Process            ffffe0013204d840       Image:         System
Attached Process          ffffe00138db48c0       Image:         services.exe
Wait Start TickCount      39742426       Ticks: 0
Context Switch Count      2684           IdealProcessor: 4  NoStackSwap
UserTime                  00:00:00.000
KernelTime                00:00:00.531
Win32 Start Address nt!ExpWorkerThread (0xfffff803934b7430)
Stack Init ffffd00023ce8c90 Current ffffd00023ce8330
Base ffffd00023ce9000 Limit ffffd00023ce3000 Call 0
Priority 13 BasePriority 12 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5
Child-SP          RetAddr           : Args to Child                                                           : Call Site
ffffd000`23ce86b8 fffff803`93795991 : 00000000`0000004c 00000000`c000021a ffffd000`27cf13f8 ffffe001`32cd6120 : nt!KeBugCheckEx
ffffd000`23ce86c0 fffff803`9378f4ea : ffffe001`40072300 ffffd000`23ce87d9 00000000`00000000 00000000`00000002 : nt!PopGracefulShutdown+0x2c9
ffffd000`23ce8700 fffff803`935664b3 : ffffe001`40072040 00000000`00000000 00000000`c0000004 00000000`00000000 : nt!NtSetSystemPowerState+0x269a
ffffd000`23ce8840 fffff803`9355e900 : fffff803`939a5abb 00000000`00000001 ffffd000`23ce8a58 00000000`c0000004 : nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ ffffd000`23ce8840)
ffffd000`23ce89d8 fffff803`939a5abb : 00000000`00000001 ffffd000`23ce8a58 00000000`c0000004 ffffd001`61840180 : nt!KiServiceLinkage
ffffd000`23ce89e0 fffff803`938db75f : 00000000`00000000 00000000`00000000 ffffd001`61840180 ffffe001`40072180 : nt!PopIssueActionRequest+0x70c0b
ffffd000`23ce8aa0 fffff803`934e6fba : fffff803`934e6f00 00000000`00000000 00000000`00000002 fffff803`936bc340 : nt!PopPolicyWorkerAction+0x63
ffffd000`23ce8b10 fffff803`934b76bc : 00000000`00000002 fffff803`936ca2a0 ffffe001`40072040 fffff803`00000005 : nt!PopPolicyWorkerThread+0xba
ffffd000`23ce8b50 fffff803`9350a36c : ffffc000`8268a140 ffffe001`40072040 00000000`00000080 ffffe001`40072040 : nt!ExpWorkerThread+0x28c
ffffd000`23ce8c00 fffff803`935612c6 : ffffd001`61743180 ffffe001`40072040 ffffd001`6174f3c0 00000000`00000000 : nt!PspSystemThreadStartup+0x58
ffffd000`23ce8c60 00000000`00000000 : ffffd000`23ce9000 ffffd000`23ce3000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x16

//Thread that caused the crash

6: kd> !thread ffffe00151628880
THREAD ffffe00151628880  Cid 02b8.4cf6c  Teb: 00007ff6822de000 Win32Thread: 0000000000000000 WAIT: (Suspended) KernelMode Alertable
    ffffe0013b8dc2a0  NotificationEvent
Not impersonating
DeviceMap                 ffffc0007ee0c300
Owning Process            ffffe00138db48c0       Image:         services.exe
Attached Process          N/A            Image:         N/A
Wait Start TickCount      39742041       Ticks: 385 (0:00:00:06.015)
Context Switch Count      2465           IdealProcessor: 7             
UserTime                  00:00:00.031
KernelTime                00:00:00.171
Win32 Start Address ntdll!TppWorkerThread (0x00007ffdb3208470)
Stack Init ffffd00027cf1c90 Current ffffd00027cf0d40
Base ffffd00027cf2000 Limit ffffd00027cec000 Call 0
Priority 9 BasePriority 9 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5
Child-SP          RetAddr           : Args to Child                                                           : Call Site
ffffd000`27cf0d80 fffff803`934bb1de : ffffd001`619c0180 ffffe001`51628880 ffffe001`fffffffe fffff803`fffffffe : nt!KiSwapContext+0x76
ffffd000`27cf0ec0 fffff803`934bac59 : ffffe001`51628880 fffff803`934a3d68 00000000`00000004 ffffd000`27cf0f00 : nt!KiSwapThread+0x14e
ffffd000`27cf0f60 fffff803`9345ee50 : 00000000`00000000 00000000`00000000 ffffd000`00000000 00000000`00000004 : nt!KiCommitThreadWait+0x129
ffffd000`27cf0fe0 fffff803`938daec0 : ffffe001`3b8dc2a0 ffffd000`00000005 00000000`00000000 fffff803`00000002 : nt!KeWaitForSingleObject+0x2c0
ffffd000`27cf1070 fffff803`935664b3 : ffffe001`51628880 ffffd000`27cf13f8 00000000`00000000 fffff803`93565057 : nt!NtInitiatePowerAction+0x170
ffffd000`27cf1100 fffff803`9355e900 : fffff803`93a15800 00000000`000000e0 00000000`00000801 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ ffffd000`27cf1100)
ffffd000`27cf1298 fffff803`93a15800 : 00000000`000000e0 00000000`00000801 00000000`00000000 fffff803`936f6d88 : nt!KiServiceLinkage
ffffd000`27cf12a0 fffff803`93798376 : ffffe001`3c60b770 ffffe001`32cd6120 ffffe001`3a06ba00 00000000`00000100 : nt!PoShutdownBugCheck+0xd4
ffffd000`27cf1340 fffff803`93562f32 : 00000000`00000000 00000000`000002b8 00000001`00000001 00000000`00000013 : nt!ExpSystemErrorHandler2+0x64e
ffffd000`27cf1590 fffff803`93a58614 : 00000000`c000021a 00000000`00000001 00000000`00000001 ffffd000`27cf19c8 : nt!ExpSystemErrorHandler+0xd2
ffffd000`27cf15d0 fffff803`93a58a11 : ffffe001`392faa10 00000000`00000000 00000000`00000000 00000000`00000000 : nt!ExpRaiseHardError+0x12c
ffffd000`27cf1950 fffff803`935664b3 : fffff6fb`7dbed7f8 fffff6fb`7daffed0 fffff6fb`5ffda0a0 fffff6bf`fb414750 : nt!NtRaiseHardError+0x1b9
ffffd000`27cf1a90 00007ffd`b326264a : 00007ff6`8290100e 00000012`ce2e1690 00007ff6`829143a8 00000012`cd96f6c0 : nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ ffffd000`27cf1b00)
00000012`cd96f658 00007ff6`8290100e : 00000012`ce2e1690 00007ff6`829143a8 00000012`cd96f6c0 00000012`ce2e1690 : ntdll!NtRaiseHardError+0xa
00000012`cd96f660 00007ffd`b31ed79b : 00007ff6`828c8ab0 00007ff6`828c8ab0 00000012`ce2d3ea0 00000000`00000000 : services!CRebootContext::Perform+0x1be
00000012`cd96fae0 00007ffd`b31e98da : 00007ffd`b31ed700 00000012`ce2d3ea0 00000012`cd96fcf8 00000012`00000102 : ntdll!RtlpTpWaitCallback+0x9b
00000012`cd96fb40 00007ffd`b32088ed : 00000012`ce2ac6e0 00000012`cdbc8120 00000000`00000000 00000012`cdae4278 : ntdll!TppExecuteWaitCallback+0x92
00000012`cd96fb80 00007ffd`b2d413d2 : 00000000`00000000 00007ffd`b3208470 00000012`cdae7ed0 00000000`00000000 : ntdll!TppWorkerThread+0x47d
00000012`cd96ff60 00007ffd`b31e5444 : 00007ffd`b2d413b0 00000000`00000000 00000000`00000000 00000000`00000000 : KERNEL32!BaseThreadInitThunk+0x22
00000012`cd96ff90 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!RtlUserThreadStart+0x34


6: kd> !chkimg -db kernel32
4 errors : kernel32 (7ffdb2e645b0-7ffdb2e645b3)
7ffdb2e645b0 *20 *21 *25 *b3  fd  7f  00  00  e0  50  12  00  00  00  00  00  !%......P......

It seems the Kernel32 binary library has suffered some corruption, thus the hard error when attempting to load information from it.
I'm still trying to dig, but it's going to be hard with a Kernel memory dump. I also don't have that much experience searching through hard errors.
It does look like your OS has become corrupt, most likely your C: drive.

blueelvis · Jun 17, 2015

Hi John ^_^,

I cannot see the Sysnative App files attached with your thread. Could you please check it once? I need to check those Event Logs.

Code:

6: kd> db ffffc000905ed180ffffc000`905ed180  57 69 6e 64 6f 77 73 20-6d 75 73 74 20 6e 6f 77  Windows must now
ffffc000`905ed190  20 72 65 73 74 61 72 74-20 62 65 63 61 75 73 65   restart because
ffffc000`905ed1a0  20 74 68 65 20 50 6f 77-65 72 20 73 65 72 76 69   the Power servi
ffffc000`905ed1b0  63 65 20 74 65 72 6d 69-6e 61 74 65 64 20 75 6e  ce terminated un
ffffc000`905ed1c0  65 78 70 65 63 74 65 64-6c 79 00 00 00 00 00 00  expectedly......
ffffc000`905ed1d0  06 02 03 03 4e 74 66 30-3a 5e a6 a7 0d de b2 e8  ....Ntf0:^......
ffffc000`905ed1e0  00 00 00 00 00 00 00 00-90 24 08 94 00 c0 ff ff  .........$......
ffffc000`905ed1f0  bc 6b 5d 0c 9e 00 00 00-00 00 a0 82 00 c0 ff ff  .k].............

On dumping the first parameter, we see that the Power Service terminated unexpectedly.

What I don't understand is that according to the stack, graceful shutdown was initiated which caused the crash?

Also, there is no error code as the second argument.

Like Jared has mentioned, there is corruption. For example, services.exe is also corrupted -

Code:

6: kd> !chkimg -db services
5 errors : services (7ff68291bb00-7ff68291bb04)
7ff68291bb00 *20 *21 *25 *b3 *fd  7f  00  00  80  c0  05  00  00  00  00  00  !%.............

-Pranav

Jared · Jun 17, 2015

blueelvis said:
Hi John ^_^,

I cannot see the Sysnative App files attached with your thread. Could you please check it once? I need to check those Event Logs.

Code:

6: kd> db ffffc000905ed180ffffc000`905ed180 57 69 6e 64 6f 77 73 20-6d 75 73 74 20 6e 6f 77 Windows must now ffffc000`905ed190 20 72 65 73 74 61 72 74-20 62 65 63 61 75 73 65 restart because ffffc000`905ed1a0 20 74 68 65 20 50 6f 77-65 72 20 73 65 72 76 69 the Power servi ffffc000`905ed1b0 63 65 20 74 65 72 6d 69-6e 61 74 65 64 20 75 6e ce terminated un ffffc000`905ed1c0 65 78 70 65 63 74 65 64-6c 79 00 00 00 00 00 00 expectedly...... ffffc000`905ed1d0 06 02 03 03 4e 74 66 30-3a 5e a6 a7 0d de b2 e8 ....Ntf0:^...... ffffc000`905ed1e0 00 00 00 00 00 00 00 00-90 24 08 94 00 c0 ff ff .........$...... ffffc000`905ed1f0 bc 6b 5d 0c 9e 00 00 00-00 00 a0 82 00 c0 ff ff .k].............

On dumping the first parameter, we see that the Power Service terminated unexpectedly.

What I don't understand is that according to the stack, graceful shutdown was initiated which caused the crash? Also, there is no error code as the second argument.

Like Jared has mentioned, there is corruption. For example, services.exe is also corrupted -

Code:

6: kd> !chkimg -db services 5 errors : services (7ff68291bb00-7ff68291bb04) 7ff68291bb00 *20 *21 *25 *b3 *fd 7f 00 00 80 c0 05 00 00 00 00 00 !%.............

-Pranav

What don't you understand?
A service, specifically the power service terminated, so Windows bugchecked because it is required to function.
There's no error code, probably because it's unknown, we cannot identify what caused it without searching through the code.

jcgriff2 · Jun 18, 2015

Sorry about the Sysnative app zip - completely forgot about it.

It's there now.

Also here - View attachment 13360 (actual attachment does not seem to work for me), so here is full URL -

https://www.sysnative.com/forums/at...x64-0xc000021a-sysnativefilecollectionapp-zip

Please note - the minidump is corrupted/only ~240 bytes in size)

Jared · Jun 19, 2015

The minidump won't really help. I think the OS has gone kaput. Most likely from a bad drive.
Best to run diagnostics on the drive and go from there.

jcgriff2 BSOD - Windows 8.1 x64 - 0xc000021a

jcgriff2

Co-Founder / Admin
BSOD Instructor/Expert
Microsoft MVP (Ret.)

Jared

Sysnative Staff, BSOD Kernel Dump Expert

blueelvis

BSOD Kernel Dump Senior Analyst

Jared

Sysnative Staff, BSOD Kernel Dump Expert

jcgriff2

Co-Founder / Admin
BSOD Instructor/Expert
Microsoft MVP (Ret.)

Jared

Sysnative Staff, BSOD Kernel Dump Expert

jcgriff2 BSOD - Windows 8.1 x64 - 0xc000021a

jcgriff2

Co-Founder / AdminBSOD Instructor/ExpertMicrosoft MVP (Ret.)

Jared

Sysnative Staff, BSOD Kernel Dump Expert

blueelvis

BSOD Kernel Dump Senior Analyst

Jared

Sysnative Staff, BSOD Kernel Dump Expert

jcgriff2

Co-Founder / AdminBSOD Instructor/ExpertMicrosoft MVP (Ret.)

Jared

Sysnative Staff, BSOD Kernel Dump Expert

Co-Founder / Admin
BSOD Instructor/Expert
Microsoft MVP (Ret.)

Co-Founder / Admin
BSOD Instructor/Expert
Microsoft MVP (Ret.)